UseEquipmentSet unequips slots the set wants empty

Previously only `GUID_IGNORED` and `GUID_EMPTY` were both treated as
"skip this slot," so equipment sets with cleared (but not ignored)
slots couldn't be used to unequip — running a "naked" set returned
`true` but left the player's gear on.

Now `GUID_EMPTY` triggers a paperdoll-to-bag move. Implementation:

- `Item::Swap::ToBag` — new atomic primitive (paperdoll → bag) using
  the same `FUN_INVENTORY_SWAP` engine helper as the equip variants,
  just with player+slot as the source side and a bag-encoded
  destination.
- `Script_UseEquipmentSet` snapshots all empty bag slots at entry
  and consumes them sequentially. Snapshotting up front avoids the
  client-side stale-state collision where iterating `ResolveBag`
  per unequip would keep picking the same "first empty" slot — the
  client's bag state doesn't update between packet sends, so the
  second packet would target a slot the first had already filled,
  and the server would try to swap the previously-unequipped item
  back onto the wrong paperdoll slot ("This item cannot be
  equipped").

.github/workflows/release.yml

@@ -16,33 +16,27 @@ jobs:
         with:
           submodules: recursive
 
+      # Stamp the addon's TOC version from the tag (drops the leading `v`)
+      # BEFORE CMake configure, so the embed step picks up the stamped TOC.
+      # The DLL bundles AddOns/!!!ClassicAPI/ at build time — see the
+      # `embed_addon` custom command in CMakeLists.txt and the file-read
+      # hook in src/addons/Embedded.cpp.
+      - name: Stamp embedded TOC version
+        shell: pwsh
+        run: |
+          $version = '${{ github.ref_name }}' -replace '^v',''
+          $toc = 'AddOns/!!!ClassicAPI/!!!ClassicAPI.toc'
+          (Get-Content $toc) -replace '^## Version:.*', "## Version: $version" |
+            Set-Content $toc
+
       - name: Configure
         run: cmake -B build -A Win32 "-DCLASSICAPI_TAG=${{ github.ref_name }}"
 
       - name: Build
         run: cmake --build build --config Release
 
-      - name: Stage release bundle
-        shell: pwsh
-        run: |
-          $tag = '${{ github.ref_name }}'
-          $version = $tag -replace '^v',''
-          $stage = "ClassicAPI-$tag"
-          New-Item -ItemType Directory -Force -Path $stage | Out-Null
-          Copy-Item build/Release/ClassicAPI.dll $stage
-          Copy-Item -Recurse 'AddOns/!!!ClassicAPI' $stage
-          # Stamp the addon's TOC version line from the tag (drops the leading `v`)
-          $toc = Join-Path $stage '!!!ClassicAPI/!!!ClassicAPI.toc'
-          (Get-Content $toc) -replace '^## Version:.*', "## Version: $version" |
-            Set-Content $toc
-          Compress-Archive -Path "$stage/*" -DestinationPath "ClassicAPI-Bundle-$tag.zip"
-          Compress-Archive -Path "$stage/!!!ClassicAPI" -DestinationPath "ClassicAPI-AddOnOnly-$tag.zip"
-
       - name: Release
         uses: softprops/action-gh-release@v2
         with:
-          files: |
-            ClassicAPI-Bundle-${{ github.ref_name }}.zip
-            ClassicAPI-AddOnOnly-${{ github.ref_name }}.zip
-            ClassicAPI-${{ github.ref_name }}/ClassicAPI.dll
+          files: build/Release/ClassicAPI.dll
           generate_release_notes: true

AddOns/!!!ClassicAPI/!!!ClassicAPI.toc

@@ -1,7 +1,7 @@
 ## Interface: 11200
 ## Title: !!!ClassicAPI
 ## Notes: Library to emulate aspects of the modern WoW API on 1.12.1 / Lua 5.0.
-## Version: 1.0
+## Version: 1.3
 ## Author: Brues
 
 GlobalStrings.lua
@@ -28,3 +28,4 @@ Util\EquipmentManager.lua
 Util\PlayerUtil.lua
 Util\SlashCommandsRegistry.lua
 Util\LinkUtil.lua
+Util\IconDataProvider.lua

AddOns/!!!ClassicAPI/Util/EventUtil.lua

@@ -83,12 +83,11 @@ function EventUtil.TriggerOnVariablesLoaded()
 end
 
 function EventUtil.ContinueOnAddOnLoaded(addOnName, callback)
-    -- 1.12's IsAddOnLoaded returns a single bool. 3.3.5 split that into
-    -- (isLoadedOrLoading, isLoaded); treat truthy as "ready to use".
-    if IsAddOnLoaded(addOnName) then
-        callback()
-        return
-    end
+	local isLoadedOrLoading, isLoaded = C_AddOns.IsAddOnLoaded(addOnName)
+	if isLoaded then
+		callback();
+		return;
+	end
 
     EventUtil.RegisterOnceFrameEventAndCallback("ADDON_LOADED", callback, addOnName)
 end

AddOns/!!!ClassicAPI/Util/IconDataProvider.lua

@@ -0,0 +1,242 @@
+-- Backport of modern Classic Era's IconDataProvider.lua (lives in
+-- Blizzard_FrameXMLBase/Classic/) to vanilla 1.12 / Lua 5.0.
+--
+-- Wraps the four engine icon-enumeration mutators
+-- (`GetLooseMacroIcons` / `GetLooseMacroItemIcons` / `GetMacroIcons`
+-- / `GetMacroItemIcons` — all surfaced by ClassicAPI.dll) into a
+-- stateful `Spell`/`Item` bucket pair, with an optional
+-- "extras" array of icons prepended ahead of the base DB. The two
+-- "extra" types are:
+--
+--   * `Spellbook` — icons of every spell currently in the player's
+--     spellbook UI. Used by the modern Macro UI's icon picker so
+--     "icons relevant to my class" surface first. In vanilla this
+--     misses spells that aren't on the spellbook UI (racials kept
+--     off the bar, profession recipes the engine doesn't list as
+--     spells, etc.) but covers the common case.
+--   * `Equipment` — icons of currently-equipped items (slots 1..19
+--     via `GetInventoryItemTexture("player", i)`). Used by the
+--     modern Equipment-Manager popup so the picker leads with what
+--     the player is wearing.
+--
+-- Implementation differences from the modern source:
+--
+--   * `EnumUtil.MakeEnum` is inlined as a plain table.
+--   * Modern's `C_SpecializationInfo.GetTalentInfo(query)` (Cata+
+--     spec-aware talent API) and `GetPvpTalentInfoByID` (MoP+ PvP
+--     talents) are replaced with vanilla's `GetTalentInfo(tab, idx)`
+--     across the 3 talent trees. Vanilla has no specs, no dual-spec
+--     groups, and no PvP talent system, so those layers are dropped.
+--   * `GetSpellBookItemTexture(slot, "player")` is replaced with
+--     vanilla's `GetSpellTexture(slot, "spell")`. Flyouts don't
+--     exist in vanilla so that branch is dropped entirely.
+--   * `extraIconsMap` is a Lua-set keyed by texture path or
+--     fileID — `GetKeysArray` flattens it to a numbered array.
+--     Same dedup semantics as modern: each texture appears once
+--     within the extras section, but no cross-dedup with the
+--     base DB walk (the player's equipped weapon icon may still
+--     appear twice in the final picker, once in extras and once
+--     in `GetMacroItemIcons`).
+
+local QuestionMarkIconPath = "INTERFACE\\ICONS\\INV_MISC_QUESTIONMARK"
+
+local NumActiveIconDataProviders = 0
+local BaseIconFilenames = nil
+
+-- Builds the table BaseIconFilenames with engine icon DB.
+-- Lazy: shared across all active IconDataProvider instances, so
+-- the four engine calls (each of which scans thousands of files)
+-- only happens once per picker session.
+local function IconDataProvider_RefreshIconTextures()
+    if BaseIconFilenames ~= nil then
+        return
+    end
+
+    BaseIconFilenames = {}
+    BaseIconFilenames[IconDataProviderIconType.Spell] = {}
+    BaseIconFilenames[IconDataProviderIconType.Item] = {}
+    GetLooseMacroIcons(BaseIconFilenames[IconDataProviderIconType.Spell])
+    GetLooseMacroItemIcons(BaseIconFilenames[IconDataProviderIconType.Item])
+    GetMacroIcons(BaseIconFilenames[IconDataProviderIconType.Spell])
+    GetMacroItemIcons(BaseIconFilenames[IconDataProviderIconType.Item])
+end
+
+local function IconDataProvider_ClearIconTextures()
+    BaseIconFilenames = nil
+    collectgarbage()
+end
+
+local function IconDataProvider_GetBaseIconTexture(iconType, index)
+    local texture = BaseIconFilenames[iconType][index]
+    local fileDataID = tonumber(texture)
+    if fileDataID ~= nil then
+        return fileDataID
+    else
+        return "INTERFACE\\ICONS\\" .. texture
+    end
+end
+
+function IconDataProvider_GetAllIconTypes()
+    local iconTypeValues = GetValuesArray(IconDataProviderIconType)
+    table.sort(iconTypeValues)
+    return iconTypeValues
+end
+
+IconDataProviderMixin = {}
+
+-- `EnumUtil.MakeEnum("Spell", "Item")` produces `{ Spell = 1, Item = 2 }`.
+IconDataProviderIconType = { Spell = 1, Item = 2 }
+
+IconDataProviderExtraType = {
+    Spellbook = 1,
+    Equipment = 2,
+    None = 3,
+}
+
+local function FillOutExtraIconsMapWithSpells(extraIconsMap)
+    for tab = 1, GetNumSpellTabs() do
+        local _, _, offset, numSpells = GetSpellTabInfo(tab)
+        offset = offset + 1
+        local tabEnd = offset + numSpells
+        for slot = offset, tabEnd - 1 do
+            local tex = GetSpellTexture(slot, "spell")
+            if tex ~= nil and tex ~= "" then
+                extraIconsMap[tex] = true
+            end
+        end
+    end
+end
+
+-- Walks all three vanilla talent trees, gathering every talent's
+-- icon — including talents the player hasn't put points into. The
+-- whole tree is "relevant to my class" for picker purposes, not
+-- just maxed talents. `GetTalentInfo(tab, idx)` returns
+-- `(name, icon, tier, column, rank, maxRank, ...)` — we read the
+-- icon (second return) directly.
+local function FillOutExtraIconsMapWithTalents(extraIconsMap)
+    for tab = 1, GetNumTalentTabs() do
+        local numTalents = GetNumTalents(tab)
+        for talent = 1, numTalents do
+            local _, icon = GetTalentInfo(tab, talent)
+            if icon ~= nil and icon ~= "" then
+                extraIconsMap[icon] = true
+            end
+        end
+    end
+end
+
+local function FillOutExtraIconsMapWithEquipment(extraIconsMap)
+    for slot = INVSLOT_FIRST_EQUIPPED, INVSLOT_LAST_EQUIPPED do
+        for _, itemLink in pairs(GetInventoryItemsForSlot(slot, {})) do
+            local _, _, _, _, itemTexture = C_Item.GetItemInfoInstant(itemLink)
+            if itemTexture then
+                extraIconsMap[itemTexture] = true
+            end
+        end
+    end
+end
+
+function IconDataProviderMixin:Init(extraType, extraIconsOnly, requestedIconTypes)
+    self.extraIcons = {}
+    self.extraIconType = extraType
+    self.requestedIconTypes = requestedIconTypes or IconDataProvider_GetAllIconTypes()
+
+    if extraType == IconDataProviderExtraType.Spellbook then
+        local extraIconsMap = {}
+        FillOutExtraIconsMapWithSpells(extraIconsMap)
+        FillOutExtraIconsMapWithTalents(extraIconsMap)
+        self.extraIcons = GetKeysArray(extraIconsMap)
+    elseif extraType == IconDataProviderExtraType.Equipment then
+        local extraIconsMap = {}
+        FillOutExtraIconsMapWithEquipment(extraIconsMap)
+        self.extraIcons = GetKeysArray(extraIconsMap)
+    end
+
+    if not extraIconsOnly then
+        NumActiveIconDataProviders = NumActiveIconDataProviders + 1
+        IconDataProvider_RefreshIconTextures()
+    end
+end
+
+function IconDataProviderMixin:SetIconTypes(iconTypes)
+    self.requestedIconTypes = iconTypes or IconDataProvider_GetAllIconTypes()
+end
+
+function IconDataProviderMixin:GetNumIcons()
+    -- 1 to account for the leading `?` icon.
+    local numIcons = 1
+    if self:ShouldShowExtraIcons() then
+        numIcons = numIcons + table.getn(self.extraIcons)
+    end
+    if BaseIconFilenames then
+        for _, v in pairs(self.requestedIconTypes) do
+            numIcons = numIcons + table.getn(BaseIconFilenames[v])
+        end
+    end
+    return numIcons
+end
+
+function IconDataProviderMixin:GetIconByIndex(index)
+    if index == 1 then
+        return QuestionMarkIconPath
+    end
+
+    index = index - 1
+
+    local numExtraIcons = (self:ShouldShowExtraIcons() and
+                           table.getn(self.extraIcons)) or 0
+    if index <= numExtraIcons then
+        return self.extraIcons[index]
+    end
+
+    local baseIndex = index - numExtraIcons
+    local lookupIconType = nil
+    -- Each icon type's table is indexed from 1, so loop through the
+    -- tables to find which icon type we index to.
+    for _, v in pairs(self.requestedIconTypes) do
+        local numIconsForType = table.getn(BaseIconFilenames[v])
+        if baseIndex <= numIconsForType then
+            lookupIconType = v
+            break
+        end
+        baseIndex = baseIndex - numIconsForType
+    end
+
+    if lookupIconType then
+        return IconDataProvider_GetBaseIconTexture(lookupIconType, baseIndex)
+    else
+        return nil
+    end
+end
+
+function IconDataProviderMixin:GetIconForSaving(index)
+    local icon = self:GetIconByIndex(index)
+    if type(icon) == "string" then
+        icon = string.gsub(icon, "INTERFACE\\ICONS\\", "")
+    end
+    return icon
+end
+
+function IconDataProviderMixin:GetIndexOfIcon(icon)
+    local numIcons = self:GetNumIcons()
+    for i = 1, numIcons do
+        if self:GetIconByIndex(i) == icon then
+            return i
+        end
+    end
+    return nil
+end
+
+function IconDataProviderMixin:ShouldShowExtraIcons()
+    return (self.extraIconType == IconDataProviderExtraType.Spellbook and
+            tContains(self.requestedIconTypes, IconDataProviderIconType.Spell))
+        or (self.extraIconType == IconDataProviderExtraType.Equipment and
+            tContains(self.requestedIconTypes, IconDataProviderIconType.Item))
+end
+
+function IconDataProviderMixin:Release()
+    NumActiveIconDataProviders = NumActiveIconDataProviders - 1
+    if NumActiveIconDataProviders <= 0 then
+        IconDataProvider_ClearIconTextures()
+    end
+end

CMakeLists.txt

@@ -25,7 +25,31 @@ set(TINYCBOR_SOURCES
     external/tinycbor/src/cborparser_float.c
     external/tinycbor/src/cborerrorstrings.c)
 
-add_library(${PROJECT_NAME} SHARED ${SOURCES} ${HEADERS} ${TINYCBOR_SOURCES})
+# Bundle `AddOns/!!!ClassicAPI/` into a generated header so the DLL can
+# surface the addon to the engine even when the user doesn't have it
+# installed on disk. The file-read hook in `src/addons/Embedded.cpp`
+# returns these buffers when the engine asks for paths under
+# `Interface\AddOns\!!!ClassicAPI\`.
+set(EMBEDDED_CLASSICAPI_SRC "${CMAKE_CURRENT_SOURCE_DIR}/AddOns/!!!ClassicAPI")
+set(EMBEDDED_CLASSICAPI_HEADER "${CMAKE_BINARY_DIR}/generated/embedded_classicapi.h")
+file(GLOB_RECURSE EMBEDDED_CLASSICAPI_FILES CONFIGURE_DEPENDS
+     "${EMBEDDED_CLASSICAPI_SRC}/*")
+add_custom_command(
+    OUTPUT "${EMBEDDED_CLASSICAPI_HEADER}"
+    COMMAND ${CMAKE_COMMAND}
+        -DSRC_DIR=${EMBEDDED_CLASSICAPI_SRC}
+        -DOUT_HEADER=${EMBEDDED_CLASSICAPI_HEADER}
+        -DADDON_NAME=ClassicAPI
+        -P "${CMAKE_CURRENT_SOURCE_DIR}/cmake/embed_addon.cmake"
+    DEPENDS
+        ${EMBEDDED_CLASSICAPI_FILES}
+        "${CMAKE_CURRENT_SOURCE_DIR}/cmake/embed_addon.cmake"
+    COMMENT "Embedding !!!ClassicAPI addon into ${EMBEDDED_CLASSICAPI_HEADER}"
+    VERBATIM)
+
+add_library(${PROJECT_NAME} SHARED
+    ${SOURCES} ${HEADERS} ${TINYCBOR_SOURCES}
+    ${EMBEDDED_CLASSICAPI_HEADER})
 
 # Dev-build sentinel — represents "newer than every plausible
 # release". Encoded as v9999.99.99 = 9999 * 10000 + 99 * 100 + 99 =
@@ -55,10 +79,11 @@ target_compile_definitions(
   ${PROJECT_NAME}
   PRIVATE CLASSICAPI_VERSION_VALUE=${CLASSICAPI_VERSION_VALUE})
 
-target_link_libraries(${PROJECT_NAME} PRIVATE minhook)
+target_link_libraries(${PROJECT_NAME} PRIVATE minhook advapi32)
 
 target_include_directories(
   ${PROJECT_NAME} PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src
+                          ${CMAKE_BINARY_DIR}/generated
                           external/minhook/include
                           external
                           external/tinycbor/src)

README.md

@@ -18,11 +18,12 @@ Full per-function reference: **[docs/API.md](docs/API.md)**.
 | Namespace | Calls |
 |-----------|-------|
 | [Action](docs/API.md#action) | `GetActionInfo` |
-| [AddOns](docs/API.md#addons) | `C_AddOns.DoesAddOnExist`, `C_AddOns.GetAddOnName`, `C_AddOns.GetAddOnNotes`, `C_AddOns.GetAddOnSecurity`, `C_AddOns.GetAddOnTitle`, `C_AddOns.IsAddOnLoadable` |
+| [AddOns](docs/API.md#addons) | `C_AddOns.DoesAddOnExist`, `C_AddOns.GetAddOnName`, `C_AddOns.GetAddOnNotes`, `C_AddOns.GetAddOnSecurity`, `C_AddOns.GetAddOnTitle`, `C_AddOns.IsAddOnLoadable`, `C_AddOns.IsAddOnLoaded` |
 | [Chat](docs/API.md#chat) | `GetCurrentChatGUID` |
 | [Class](docs/API.md#class) | `FillLocalizedClassList` |
 | [Combat](docs/API.md#combat) | `InCombatLockdown` |
 | [CVar](docs/API.md#cvar) | `C_CVar.GetCVarBool` |
+| [Cursor](docs/API.md#cursor) | `GetCursorInfo` |
 | [Container](docs/API.md#container) | `C_Container.GetContainerItemCharges`, `C_Container.GetContainerItemDurability`, `C_Container.GetContainerItemID`, `C_Container.GetContainerItemRepairCost`, `C_Container.GetContainerNumFreeSlots`, `C_Container.GetItemCooldown`, `C_Container.IsContainerItemOpenable`, `C_Container.MoveItem`, `C_Container.PlayerHasHearthstone`, `C_Container.SwapItems`, `C_Container.UseHearthstone`, `GetItemCooldown` |
 | EncodingUtil | `C_EncodingUtil.CompressString`, `C_EncodingUtil.DecompressString`, `C_EncodingUtil.EncodeBase64`, `C_EncodingUtil.DecodeBase64`, `C_EncodingUtil.EncodeHex`, `C_EncodingUtil.DecodeHex`, `C_EncodingUtil.SerializeJSON`, `C_EncodingUtil.DeserializeJSON`, `C_EncodingUtil.SerializeCBOR`, `C_EncodingUtil.DeserializeCBOR` |
 | [EquipmentSet](docs/API.md#equipmentset) | `C_EquipmentSet.CanUseEquipmentSets`, `C_EquipmentSet.ClearIgnoredSlotsForSave`, `C_EquipmentSet.CreateEquipmentSet`, `C_EquipmentSet.DeleteEquipmentSet`, `C_EquipmentSet.EquipmentSetContainsLockedItems`, `C_EquipmentSet.GetEquipmentSetID`, `C_EquipmentSet.GetEquipmentSetIDs`, `C_EquipmentSet.GetEquipmentSetInfo`, `C_EquipmentSet.GetIgnoredSlots`, `C_EquipmentSet.GetItemIDs`, `C_EquipmentSet.GetItemLocations`, `C_EquipmentSet.GetNumEquipmentSets`, `C_EquipmentSet.IgnoreSlotForSave`, `C_EquipmentSet.IsSlotIgnoredForSave`, `C_EquipmentSet.ModifyEquipmentSet`, `C_EquipmentSet.SaveEquipmentSet`, `C_EquipmentSet.UnignoreSlotForSave`, `C_EquipmentSet.UseEquipmentSet` (sets persist to `WTF\Account\...\ClassicAPI_EquipmentSets.txt`) |
@@ -37,7 +38,7 @@ Full per-function reference: **[docs/API.md](docs/API.md)**.
 | [Input](docs/API.md#input) | `IsLeftAltKeyDown`, `IsLeftControlKeyDown`, `IsLeftShiftKeyDown`, `IsModifierKeyDown`, `IsRightAltKeyDown`, `IsRightControlKeyDown`, `IsRightShiftKeyDown` |
 | [Instance](docs/API.md#instance) | `GetInstanceInfo` |
 | [Item](docs/API.md#item) | `C_Item.DoesItemExist`, `C_Item.DoesItemExistByID`, `C_Item.EquipItemByName`, `C_Item.GetCurrentItemLevel`, `C_Item.GetDetailedItemLevelInfo`, `C_Item.GetItemCount`, `C_Item.GetItemFamily`, `C_Item.GetItemGUID`, `C_Item.GetItemIcon`, `C_Item.GetItemIconByID`, `C_Item.GetItemID`, `C_Item.GetItemInfoInstant`, `C_Item.GetItemInventoryType`, `C_Item.GetItemInventoryTypeByID`, `C_Item.GetItemLink`, `C_Item.GetItemLocation`, `C_Item.GetItemMaxStackSize`, `C_Item.GetItemMaxStackSizeByID`, `C_Item.GetItemName`, `C_Item.GetItemNameByID`, `C_Item.GetItemQuality`, `C_Item.GetItemQualityByID`, `C_Item.GetItemSellPrice`, `C_Item.GetItemSellPriceByID`, `C_Item.GetItemSetID`, `C_Item.GetItemSetIDByID`, `C_Item.GetItemSetInfo`, `C_Item.GetItemSpell`, `C_Item.GetItemUniqueness`, `C_Item.GetItemUniquenessByID`, `C_Item.GetStackCount`, `C_Item.GetWeaponEnchantInfo`, `C_Item.IsBound`, `C_Item.IsEquippableItem`, `C_Item.IsEquippedItem`, `C_Item.IsItemDataCached`, `C_Item.IsItemDataCachedByID`, `C_Item.IsItemOpenable`, `C_Item.IsLocked`, `C_Item.LockItem`, `C_Item.LockItemByGUID`, `C_Item.UnlockAllItems`, `C_Item.UnlockItem`, `C_Item.RequestLoadItemData`, `C_Item.RequestLoadItemDataByID`, `C_Item.UseItemByName`, `GetAuctionItemID`, `GetAuctionSellItemID`, `GetAverageItemLevel`, `GetCraftReagentItemID`, `GetInboxItemID`, `GetInventoryItemDurability`, `GetInventoryItemID`, `GetInventoryItemsForSlot`, `GetInventoryItemRepairCost`, `GetItemIcon`, `GetLootRollItemID`, `GetLootSlotItemID`, `GetMerchantItemID`, `GetQuestItemID`, `GetQuestLogItemID`, `GetTradePlayerItemID`, `GetTradeSkillItemID`, `GetTradeSkillReagentItemID`, `GetTradeTargetItemID`, `OffhandHasWeapon` |
-| [Macros](docs/API.md#macros) | `GetMacroSpell` |
+| [Macros](docs/API.md#macros) | `GetLooseMacroIcons`, `GetLooseMacroItemIcons`, `GetMacroIcons`, `GetMacroItemIcons`, `GetMacroSpell` |
 | [Map](docs/API.md#map) | `C_Map.GetBestMapForUnit` |
 | [MerchantFrame](docs/API.md#merchantframe) | `C_MerchantFrame.GetBuybackItemID`, `C_MerchantFrame.GetItemInfo`, `C_MerchantFrame.GetNumJunkItems`, `C_MerchantFrame.IsMerchantItemRefundable`, `C_MerchantFrame.IsSellAllJunkEnabled`, `C_MerchantFrame.SellAllJunkItems` |
 | [NamePlate](docs/API.md#nameplate) | `C_NamePlate.GetNamePlateForGUID`, `C_NamePlate.GetNamePlateForUnit`, `C_NamePlate.GetNamePlateGUIDs`, `C_NamePlate.GetNamePlates` |
@@ -66,6 +67,7 @@ the glue state because GlueXML had no way to reach them otherwise.
 
 | Group | Calls |
 |-------|-------|
+| [Account](docs/API.md#account) | `SaveAccount`, `DeleteAccount`, `GetSavedAccounts`, `LoginWithSavedAccount` (passwords encrypted in Windows Credential Manager, scoped per realmlist; plaintext never returned to Lua) |
 | [CharacterList](docs/API.md#characterlist) | `GetSavedCharacterOrder`, `SetSavedCharacterOrder` (persist to `WTF\Account\...\ClassicAPI.txt`) |
 | CVar | `GetCVar`, `SetCVar`, `RegisterCVar`, `GetCVarDefault`, `C_CVar.GetCVarBool` (storage is process-global — writes from glue are visible in-world and vice versa) |
 | Script | `RunScript` (compile and run a Lua chunk in the glue state's globals — useful for slash-command-style helpers in GlueXML) |
@@ -162,8 +164,19 @@ The triple-`!` prefix is **load-order-significant** — WoW loads
 addons alphabetically, so `!!!ClassicAPI` is guaranteed to run before
 any consumer that depends on its globals. Don't rename the folder.
 
-To install: copy [`AddOns/!!!ClassicAPI/`](AddOns/!!!ClassicAPI/) into
-your `Interface/AddOns/` directory.
+**You don't have to install the addon manually** — the DLL embeds
+the contents of [`AddOns/!!!ClassicAPI/`](AddOns/!!!ClassicAPI/) and
+registers them with the engine as a synthetic addon on startup, so
+the library is always available when the DLL is loaded. The engine
+sees it as a normal addon: it appears in `GetAddOnInfo`, fires
+`ADDON_LOADED`, supports `SavedVariables`, the works.
+
+If you do drop the folder into your `Interface/AddOns/` directory,
+**that copy wins** — the DLL's embedded version is only registered
+when the engine's normal scan doesn't already have an entry under
+that name. Useful for editing the Lua locally without rebuilding the
+DLL. The dispatch is transparent: addons consuming `Mixin`,
+`ColorMixin`, `TableUtil`, etc. behave identically in both cases.
 
 ## Bundled addon: DebugTools
 

cmake/embed_addon.cmake

@@ -0,0 +1,115 @@
+# embed_addon.cmake — bundle an addon directory into a generated C++ header.
+#
+# Invoked from CMakeLists.txt via `cmake -P` as a custom command. Reads every
+# file under SRC_DIR recursively and emits OUT_HEADER containing:
+#
+#   namespace Addons::Embedded {
+#       struct File {
+#           const char *path;
+#           const unsigned char *data;
+#           size_t size;
+#       };
+#       extern const File kFiles[];
+#       extern const size_t kFileCount;
+#   }
+#
+# Paths are normalized to lowercase backslash-form relative to
+# `Interface\AddOns\` so they match what the engine's TOC parser
+# constructs when it asks for the addon's files (see
+# `s_Interface_AddOns__s__s_toc_00853840` in the binary). The
+# manifest is hash-table-friendly for fast lookup but the lookup
+# walks the array linearly — fine for 25 files.
+#
+# Usage:
+#   cmake -DSRC_DIR=... -DOUT_HEADER=... -DADDON_NAME=... -P embed_addon.cmake
+
+if(NOT SRC_DIR)
+    message(FATAL_ERROR "embed_addon.cmake: SRC_DIR required")
+endif()
+if(NOT OUT_HEADER)
+    message(FATAL_ERROR "embed_addon.cmake: OUT_HEADER required")
+endif()
+if(NOT ADDON_NAME)
+    message(FATAL_ERROR "embed_addon.cmake: ADDON_NAME required")
+endif()
+
+file(GLOB_RECURSE INPUT_FILES RELATIVE "${SRC_DIR}" "${SRC_DIR}/*")
+list(SORT INPUT_FILES) # deterministic codegen
+
+set(BODY "")
+set(MANIFEST "")
+set(INDEX 0)
+foreach(REL_PATH ${INPUT_FILES})
+    set(ABS_PATH "${SRC_DIR}/${REL_PATH}")
+    file(READ "${ABS_PATH}" CONTENT_HEX HEX)
+    string(LENGTH "${CONTENT_HEX}" HEX_LEN)
+    math(EXPR FILE_SIZE "${HEX_LEN} / 2")
+
+    # Convert hex string to comma-separated byte literals. 16 bytes per line
+    # keeps the generated header readable.
+    set(BYTES "")
+    set(COL 0)
+    set(POS 0)
+    while(POS LESS HEX_LEN)
+        string(SUBSTRING "${CONTENT_HEX}" ${POS} 2 BYTE)
+        if(COL EQUAL 0)
+            string(APPEND BYTES "    ")
+        endif()
+        string(APPEND BYTES "0x${BYTE},")
+        math(EXPR POS "${POS} + 2")
+        math(EXPR COL "${COL} + 1")
+        if(COL EQUAL 16)
+            string(APPEND BYTES "\n")
+            set(COL 0)
+        else()
+            string(APPEND BYTES " ")
+        endif()
+    endwhile()
+    if(NOT COL EQUAL 0)
+        string(APPEND BYTES "\n")
+    endif()
+
+    # Normalize path to engine-style: `<AddonName>\Sub\Path.lua` with
+    # backslashes. Engine constructs full path as
+    # `Interface\AddOns\<AddonName>\<file>` — we strip the
+    # `Interface\AddOns\<AddonName>\` prefix at lookup time so storing
+    # just the relative form keeps the manifest small.
+    string(REPLACE "/" "\\\\" REL_PATH_BS "${REL_PATH}")
+
+    string(APPEND BODY "static const unsigned char kData_${INDEX}[] = {\n${BYTES}};\n\n")
+    string(APPEND MANIFEST "    { \"${REL_PATH_BS}\", kData_${INDEX}, ${FILE_SIZE} },\n")
+
+    math(EXPR INDEX "${INDEX} + 1")
+endforeach()
+
+set(HEADER_CONTENT "// Auto-generated by embed_addon.cmake — do not edit.
+// Source: ${SRC_DIR}
+//
+// Addon \"${ADDON_NAME}\" embedded as a fallback for users who don't have
+// it installed on disk. See src/addons/Embedded.cpp for the file-read
+// hook that surfaces these buffers to the engine.
+
+#pragma once
+
+#include <cstddef>
+
+namespace Addons::Embedded {
+
+namespace ${ADDON_NAME}Files {
+
+${BODY}static const struct File {
+    const char *path;
+    const unsigned char *data;
+    size_t size;
+} kFiles[] = {
+${MANIFEST}};
+
+static constexpr size_t kFileCount = sizeof(kFiles) / sizeof(kFiles[0]);
+
+} // namespace ${ADDON_NAME}Files
+
+} // namespace Addons::Embedded
+")
+
+file(WRITE "${OUT_HEADER}" "${HEADER_CONTENT}")
+message(STATUS "embed_addon: wrote ${OUT_HEADER} (${INDEX} files)")

docs/API.md

@@ -6,6 +6,9 @@ build instructions.
 
 ## Contents
 
+- [Account](#account)
+  - [`SaveAccount(name, password)` / `DeleteAccount(name)` / `GetSavedAccounts()` / `LoginWithSavedAccount(name)` — GlueXML only](#saveaccountname-password--deleteaccountname--getsavedaccounts--loginwithsavedaccountname--gluexml-only)
+
 - [Action](#action)
   - [`GetActionInfo(slot)`](#getactioninfoslot)
 
@@ -14,6 +17,7 @@ build instructions.
   - [`C_AddOns.GetAddOnTitle(indexOrName)`](#c_addonsgetaddontitleindexorname)
   - [`C_AddOns.GetAddOnNotes(indexOrName)`](#c_addonsgetaddonnotesindexorname)
   - [`C_AddOns.IsAddOnLoadable(indexOrName)`](#c_addonsisaddonloadableindexorname)
+  - [`C_AddOns.IsAddOnLoaded(indexOrName)`](#c_addonsisaddonloadedindexorname)
   - [`C_AddOns.GetAddOnSecurity(indexOrName)`](#c_addonsgetaddonsecurityindexorname)
   - [`C_AddOns.DoesAddOnExist(indexOrName)`](#c_addonsdoesaddonexistindexorname)
 
@@ -46,6 +50,9 @@ build instructions.
 - [CVar](#cvar)
   - [`C_CVar.GetCVarBool(cvar)`](#c_cvargetcvarboolcvar)
 
+- [Cursor](#cursor)
+  - [`GetCursorInfo()`](#getcursorinfo)
+
 - [EquipmentSet](#equipmentset)
   - [Overview & file format](#overview--file-format)
   - [`C_EquipmentSet.CanUseEquipmentSets()`](#c_equipmentsetcanuseequipmentsets)
@@ -193,6 +200,7 @@ build instructions.
   - [Numeric spellIDs in `/cast` and `CastSpellByName`](#numeric-spellids-in-cast-and-castspellbyname)
   - [`CastSpellNoToggle` as a macro cast line](#castspellnotoggle-as-a-macro-cast-line)
   - [`GetMacroSpell(macroSlot)`](#getmacrospellmacroslot)
+  - [`GetMacroIcons` / `GetMacroItemIcons` / `GetLooseMacroIcons` / `GetLooseMacroItemIcons`](#getmacroicons--getmacroitemicons--getloosemacroicons--getloosemacroitemicons)
 
 - [Map](#map)
   - [`C_Map.GetBestMapForUnit(unitToken)`](#c_mapgetbestmapforunitunittoken)
@@ -331,6 +339,120 @@ build instructions.
   - [`C_UnitAuras.GetUnitAuras(unit [, filter])`](#c_unitaurasgetunitaurasunit--filter)
   - [`C_UnitAuras.GetAuraDispelTypeColor(dispelName)`](#c_unitaurasgetauradispeltypecolordispelname)
 
+## Account
+
+### `SaveAccount(name, password)` / `DeleteAccount(name)` / `GetSavedAccounts()` / `LoginWithSavedAccount(name)` — GlueXML only
+
+Persists account credentials in Windows Credential Manager (per-user,
+DPAPI-encrypted) and dispatches login from C so the plaintext password
+never crosses the C↔Lua boundary on the way out. Designed for GlueXML
+rewrites of `AccountLogin.lua` that want a selection list of remembered
+accounts without persisting plaintext passwords to SavedVariables.
+
+> **Only callable from the login screen** (the "glue" Lua state).
+> Calling them from an in-world addon errors with "attempt to call nil"
+> — they aren't registered there.
+
+- `SaveAccount(name, password)` — encrypt and save under the current
+  realmlist. Returns `true` on success, `false` if name or password is
+  empty, no realmlist is set, or the OS rejects the write.
+- `DeleteAccount(name)` — remove the saved entry. Returns `true` if a
+  matching entry existed and was deleted.
+- `GetSavedAccounts()` — returns a numeric-keyed table of entries for
+  the current realmlist. Other realmlists' entries are invisible. Empty
+  table if no realmlist is set. Each entry is a table:
+
+  | Field | Type | Notes |
+  |---|---|---|
+  | `name` | string | Account name as saved. |
+  | `lastUsed` | number | Unix epoch seconds of the last write to the vault entry. Refreshed automatically by `LoginWithSavedAccount`, so this functions as a "last used" timestamp. `0` if Windows didn't supply a timestamp (extremely rare, e.g. credentials manually injected). |
+
+  ```lua
+  for i, entry in ipairs(GetSavedAccounts()) do
+      print(entry.name, date("%Y-%m-%d %H:%M", entry.lastUsed))
+  end
+  ```
+
+- `LoginWithSavedAccount(name)` — decrypt internally and feed the
+  credentials to the engine's login function. Returns `true` if
+  credentials were found and dispatched, `false` if no such entry
+  exists. **Plaintext is never returned to Lua.** Equivalent to what
+  `DefaultServerLogin(name, password)` does, but with the password
+  fetched from the vault rather than passed in. Also re-saves the
+  credential (same value) to refresh the `lastUsed` timestamp.
+
+#### Scoping per realmlist
+
+Every operation is scoped by the current `realmList` CVar (the address
+from `realmlist.wtf`, e.g. `"logon.turtle-wow.org"`), not the friendly
+display name. The same account name on two different private servers
+therefore gets two distinct vault entries:
+
+```
+ClassicAPI/WoW/logon.turtle-wow.org/MYACCT
+ClassicAPI/WoW/logon.other-server.com/MYACCT
+```
+
+Switching realmlists changes the visible account list automatically;
+no separate "select realm" step. If you need a refresh while still on
+the login screen, call `Autologin_Load()` (or `GetSavedAccounts()`
+directly) after the realmlist changes.
+
+#### Storage
+
+Entries live in the OS Credential Manager under the
+`ClassicAPI/WoW/<realmlist>/` namespace. Users can inspect and wipe
+them via Windows' `control /name Microsoft.CredentialManager` →
+Generic Credentials, the same way they'd manage any other Windows-
+stored credential.
+
+#### Security caveats
+
+Realistic about what this defends against:
+
+- **Defeats**: casual file inspection of WTF, sharing the WTF folder,
+  cloud-syncing it, another Windows user on the same machine, malware
+  running as a different Windows user.
+- **Does not defeat**: any process running as the current Windows user
+  can decrypt these via DPAPI — it's per-user, not per-process. No
+  "decrypt and return plaintext" path is exposed to Lua, so a hostile
+  addon can trigger a login with a saved account but can't extract the
+  password. Plaintext is also unavoidably in process memory while the
+  engine sends SRP.
+
+#### Addon example
+
+```lua
+-- GlueXML, e.g. AccountLogin.lua: save credentials on first manual
+-- login, one-click login on subsequent shows.
+
+local function OnLoginClicked()
+    local name = AccountLoginAccountEdit:GetText()
+    local password = AccountLoginPasswordEdit:GetText()
+    if not name or name == "" then return end
+
+    if password and password ~= "" then
+        -- Fresh login or password change: persist + log in.
+        SaveAccount(name, password)
+        LoginWithSavedAccount(name)
+    else
+        -- Reuse stored credentials.
+        LoginWithSavedAccount(name)
+    end
+end
+
+-- Populate a selection list from the vault, sorted by recency.
+local accounts = GetSavedAccounts()
+table.sort(accounts, function(a, b) return a.lastUsed > b.lastUsed end)
+for i = 1, table.getn(accounts) do
+    local e = accounts[i]
+    print(i, e.name, "last used:", date("%m/%d/%Y", e.lastUsed))
+end
+
+-- Forget an account.
+DeleteAccount("OLDACCT")
+```
+
 ## Action
 
 ### `GetActionInfo(slot)`
@@ -444,6 +566,29 @@ C_AddOns.IsAddOnLoadable("HardcoreTooltips")  -- false, "DISABLED"
 C_AddOns.IsAddOnLoadable("garbage")           -- false, nil
 ```
 
+### `C_AddOns.IsAddOnLoaded(indexOrName)`
+
+Returns `loadedOrLoading, loaded` — two booleans.
+
+```lua
+C_AddOns.IsAddOnLoaded("DebugTools")    -- true, true
+C_AddOns.IsAddOnLoaded("garbage")       -- false, false
+C_AddOns.IsAddOnLoaded(1)               -- true, true   (first addon by index)
+```
+
+Modern WoW splits the two returns to distinguish "load-in-progress"
+from "fully loaded" — the difference matters for `LoadOnDemand`
+addons whose load is split across multiple `LoadAddOn` callbacks.
+Vanilla 1.12's addon loader (`FUN_0051F240`) is fully synchronous:
+the `loaded` byte flips inside a single call, so the in-flight
+state is never observable from Lua. Both returns are always the
+same boolean here. We surface the two-return shape so consumer
+code written against modern API doesn't need to special-case
+vanilla.
+
+Unknown addons (numeric index past `GetNumAddOns()`, or
+string name not in the registry) return `false, false`.
+
 ### `C_AddOns.GetAddOnSecurity(indexOrName)`
 
 Returns an `Enum.AddOnSecurityStatus` integer (not a string — modern
@@ -1139,6 +1284,83 @@ immediately visible on the other (a `SetCVar("foo", "1")` from a
 GlueXML script will read back as `"1"` on the in-world side, and
 vice versa).
 
+## Cursor
+
+### `GetCursorInfo()`
+
+Returns a tuple describing whatever the player has picked up on the
+cursor (item, money, spell, macro, merchant slot), or nothing when
+the cursor is empty. Reads the same engine globals `CursorHasItem` /
+`CursorHasSpell` / `GetCursorMoney` consult, so the answer always
+matches what the rest of the engine sees.
+
+Return shape per cursor state:
+
+| Cursor holds | Returns |
+|---|---|
+| nothing | *nil* |
+| a bag item (PickupContainerItem, mail/trade detach with GUID) | `"item"`, `itemID`, `itemLink` |
+| a drag-source item (equipment slot, action bar, trade, mail) | `"item"`, `itemID` |
+| money (gold-split UI, `PickupPlayerMoney`) | `"money"`, `copperAmount` |
+| a spell from the spellbook | `"spell"`, `spellbookSlot`, `bookType`, `spellID` |
+| a macro | `"macro"`, `macroIndex` |
+| a merchant slot | `"merchant"`, `merchantIndex` |
+
+`bookType` is `"spell"` for player spells, `"pet"` for pet spells.
+`spellbookSlot` is the 1-based slot the spell lives at in the
+spellbook arrays, found by walking the player/pet books. `0` if the
+spellID isn't in either book (rare — passive talent-granted spells).
+
+```lua
+local kind, a, b, c = GetCursorInfo()
+if kind == "item" then
+    print(("cursor item: %d"):format(a))
+elseif kind == "money" then
+    print(("cursor money: %d copper"):format(a))
+elseif kind == "spell" then
+    print(("cursor spell: id=%d slot=%d (%s book)"):format(c, a, b))
+elseif kind == "macro" then
+    print(("cursor macro index: %d"):format(a))
+end
+```
+
+#### `itemLink` availability
+
+Returned only when the cursor holds a **bag item** (type 1) —
+`PickupContainerItem` / `PickupInventoryItem` from a bag slot, mail
+or trade detach. The cursor stores the item's GUID in this case, so
+we resolve back to the live `CGItem *` and feed it to the engine's
+link builder, which produces the full per-instance form including
+enchant ID and random-suffix decoration:
+
+```
+|cff1eff00|Hitem:16791:255:0:0|h[Silkstream Cuffs]|h|r
+|cff1eff00|Hitem:9877:0:767:0|h[Sorcerer Cloak of the Owl]|h|r
+```
+
+Not returned for drag-source items (equipment slot, action bar
+slot, trade slot, mail attachment — types 5/6/7/9). In those cases
+the cursor only stores the itemID (no GUID, no live `CGItem *`), so
+the engine's link builder isn't reachable. Derive a basic link from
+the itemID via `GetItemInfo` if you need one for display:
+
+```lua
+local kind, itemID, link = GetCursorInfo()
+if kind == "item" and not link then
+    link = (select(2, GetItemInfo(itemID))) or ("item:" .. itemID)
+end
+```
+
+#### Types we don't surface
+
+The engine has cursor types beyond what `GetCursorInfo` advertises in
+modern WoW — pet action drag, trade-slot drag, mail-attach drag,
+ability-bar drag from `PickupAction`, etc. These don't map cleanly to
+any modern `GetCursorInfo` string, so we return `nil` for them.
+Consumers needing to detect those can use the engine-native
+`CursorHasItem` / `CursorHasSpell` / `CursorHasMoney` (which already
+exist in vanilla) and the source-side `PickupX` calls.
+
 ## EquipmentSet
 
 Backports the modern `C_EquipmentSet.*` namespace on top of a
@@ -4475,6 +4697,58 @@ section tags them with the same spellID a `/cast` line would, so
 > opening them in the Macro UI and clicking Okay re-runs the parser
 > and the new behavior takes effect.
 
+### `GetMacroIcons` / `GetMacroItemIcons` / `GetLooseMacroIcons` / `GetLooseMacroItemIcons`
+
+Modern Classic Era's 4-function append-to-table icon enumeration
+surface. Each takes a Lua table as its only argument and appends icon
+basenames; returns nothing (mutation is the contract).
+
+```lua
+local spellList, itemList = {}, {}
+
+-- Modern's canonical call order (mirrors IconDataProvider.lua):
+GetLooseMacroIcons(spellList)
+GetLooseMacroItemIcons(itemList)
+GetMacroIcons(spellList)
+GetMacroItemIcons(itemList)
+
+-- spellList now has `Ability_*` / `Spell_*` basenames;
+-- itemList now has `INV_*` basenames.
+```
+
+The split is `loose` (icons the user dropped into `Interface\Icons\`
+on disk) vs `mpq` (icons baked into the game's MPQ archives), crossed
+with `Spell` (basenames starting with `Ability_` / `Spell_`) vs
+`Item` (basenames starting with `INV_`). Modern engines maintain four
+parallel arrays in their loader; we replicate the scheme by hooking
+vanilla's three scan callbacks
+(`FUN_MACRO_ICON_CB_DISK` / `*_USER_MPQ` / `*_INSTALL_MPQ`) and tagging
+each captured filename by source + prefix.
+
+**Vanilla quirk worth noting**: the engine's main icon DB (what
+`GetMacroIconInfo(i)` returns) is filtered down to `Ability_*` /
+`Spell_*` only — `INV_*` filenames flow through the scan callbacks
+(~2,500+ per session in the Octo client) but never land in the DB
+because something downstream of the callbacks rejects them. We
+capture before that rejection, so `GetMacroItemIcons` works even
+though no engine-level `GetMacroItemIconInfo(i)` exists.
+
+Each appended entry is the uppercase basename stripped of the
+`Interface\Icons\` prefix and any `.blp`/`.tga` extension (e.g.
+`"INV_SWORD_25"`, `"ABILITY_KICK"`). Callers concat the prefix
+themselves before `texture:SetTexture(...)`. Output is alphabetically
+sorted within each function (sorted lazily on first read).
+
+Capture-time dedup ensures each unique basename only appears once
+per source/prefix combination even though most files flow through
+multiple scan callbacks. There is **no cross-dedup** between loose
+and mpq, or between spell and item — matches modern engine
+behavior (a file that exists both as a loose drop-in and inside an
+MPQ will appear in both the loose and mpq lists).
+
+The vanilla legacy globals `GetNumMacroIcons` / `GetMacroIconInfo`
+remain available unchanged.
+
 ## Map
 
 ### `C_Map.GetBestMapForUnit(unitToken)`

src/Game.cpp

@@ -186,17 +186,45 @@ void PushLocalizedString(void *L, const char *globalName, const char *fallback)
     }
 }
 
+// In-place `string.gsub(stack[-1], pattern, replacement)` — replaces
+// the string at the top of the stack with the substitution result.
+// Discards gsub's second return (the substitution count) by
+// requesting only one return from `Call`.
+static void GsubInPlace(void *L, const char *pattern, const char *replacement) {
+    PushString(L, "string");
+    GetTable(L, GLOBALS_INDEX);
+    PushString(L, "gsub");
+    GetTable(L, -2);             // [..., str, string, gsub]
+    Remove(L, -2);                // [..., str, gsub]
+    Insert(L, -2);                // [..., gsub, str]
+    PushString(L, pattern);
+    PushString(L, replacement);
+    Call(L, 3, 1);                // [..., result]
+}
+
 void PushLocalizedFormatInt(void *L, const char *globalName,
                             const char *fallback, int n) {
-    // Resolve `string.format` from _G. The engine ships it as both a
-    // global and as `string.format`; the global is faster (one
-    // gettable instead of two) and equally available across builds.
+    // Resolve `string.format` from _G.
     PushString(L, "format");
     GetTable(L, GLOBALS_INDEX);
-
     PushLocalizedString(L, globalName, fallback);
+
+    // Expand WoW's `|4singular:plural;` (and 3-form
+    // `|4nom:gen_sing:plural;`) pluralization template by piggybacking
+    // on Lua's `string.gsub`. The 2- vs 3-form distinction is locale
+    // grammar (Slavic counting has a separate genitive-singular form
+    // for 2..4); we collapse to nominative/plural since vanilla has
+    // no proper locale-aware counting rules. 3-form pattern runs
+    // first because it's more specific. Vanilla's `string.format`
+    // doesn't process `|4` natively, so without this the template
+    // would render literally.
+    const char *picker3 = (n == 1) ? "%1" : "%3";
+    const char *picker2 = (n == 1) ? "%1" : "%2";
+    GsubInPlace(L, "|4([^:;]+):([^:;]+):([^;]+);", picker3);
+    GsubInPlace(L, "|4([^:;]+):([^;]+);", picker2);
+
     PushNumber(L, static_cast<double>(n));
-    Call(L, 2, 1); // format(fmt, n) → string
+    Call(L, 2, 1);                // format(expandedFmt, n) → string
 }
 } // namespace Lua
 

src/Offsets.h

@@ -1068,6 +1068,17 @@ enum Offsets {
     OFF_ITEMSTATS_NAME = 0x08,
     OFF_ITEMSTATS_DISPLAY_INFO_ID = 0x18,
     OFF_ITEMSTATS_QUALITY = 0x1C,    // u32 — 0=Poor … 5=Legendary
+
+    // Item-quality color-prefix table. Array of 7 `const char *`
+    // pointers, indexed by quality 0..6 (POOR..ARTIFACT); each
+    // points to a `"|cffRRGGBB"` markup string used by the engine's
+    // own link builder. Discovered via the inner color helper at
+    // `0x0052AD90` which does `(&table)[quality]` with a fallback
+    // to white (`"|cffffffff"`, the index-1 entry) for quality > 6.
+    // Quality 7 (Heirloom) doesn't exist in vanilla; consumers
+    // should mirror the engine's fallback for safety.
+    VAR_QUALITY_COLOR_TABLE = 0x00854124,
+    QUALITY_COLOR_TABLE_SIZE = 7,
     // `m_flags` — item-class flags bitfield. Bits we read:
     //   `ITEMSTATS_FLAG_OPENABLE` (`0x4`, bit 2): freely right-click-
     //     openable container (sack, clam, simple chest, quest box).
@@ -1772,6 +1783,41 @@ enum Offsets {
     // without re-parsing the body. See `Macro::Spell::Script_GetMacroSpell`.
     FUN_MACRO_SLOT_TO_ENTRY = 0x004F0E40,
 
+    // Macro-icon database. Populated lazily by `FUN_LOAD_MACRO_ICONS`
+    // on the first `GetNumMacroIcons` call — enumerates `Interface\Icons\`
+    // for `*.blp` files plus a wildcard match, sorts, and de-dupes. Each
+    // entry is the basename (e.g. `"Ability_Kick"`) without the
+    // `Interface\Icons\` prefix; vanilla's `Script_GetMacroIconInfo`
+    // joins the prefix via sprintf before pushing. Verified by reading
+    // `Script_GetNumMacroIcons` (`0x004F19F0`) and
+    // `Script_GetMacroIconInfo` (`0x004F1A30`).
+    //
+    // Vanilla's loader has 3 enumeration passes, each with a per-file
+    // callback. The first two (`FUN_MACRO_ICON_CB_DISK`,
+    // `FUN_MACRO_ICON_CB_USER_MPQ`) prefix-filter on `"Ability_"` and
+    // `"Spell_"` — anything else (including `INV_*` item icons) is
+    // rejected. The third (`FUN_MACRO_ICON_CB_INSTALL_MPQ`) reads as
+    // extension-only filter in the disassembly (any `.blp`/`.tga` is
+    // accepted), but the engine's main icon DB ends up with zero
+    // `INV_*` entries regardless (`GetNumMacroIcons() == 746`, all
+    // `Ability_*`/`Spell_*`). Best guess: a check inside the
+    // `SStrDup`/array-append helpers downstream of all three callbacks
+    // filters them out — but the per-file callbacks themselves DO see
+    // `INV_*` filenames (verified by hook capture: 5,226 unique
+    // `INV_*` basenames flow through the callbacks per session).
+    //
+    // For `C_Macro::GetMacroItemIcons` we hook each callback at its
+    // entry, capture any `INV_*` filename into a DLL-owned side array,
+    // then forward to the original — dodges whichever downstream
+    // filter the engine applies and matches the parallel item-icon
+    // array 4.3.4 exposes (via `Script_GetMacroItemIcons`).
+    VAR_MACRO_ICON_COUNT = 0x00BDCC1C,          // uint32 count of loaded icons
+    VAR_MACRO_ICON_ARRAY = 0x00BDCC20,          // char ** — pointer to flat array of icon-name C strings (4-byte stride)
+    FUN_LOAD_MACRO_ICONS = 0x004F0090,          // `__cdecl()` lazy populate; no-op if already loaded
+    FUN_MACRO_ICON_CB_DISK = 0x004F0220,        // disk enumerator callback — `__fastcall(const char *fullPath)` — prefix-filtered
+    FUN_MACRO_ICON_CB_USER_MPQ = 0x004F0350,    // user-MPQ enumerator callback — `__fastcall(MpqRecord *r)` — prefix-filtered
+    FUN_MACRO_ICON_CB_INSTALL_MPQ = 0x004F04F0, // install-MPQ enumerator callback — `__fastcall(MpqRecord *r)` — extension-only filter
+
     // Quest log: 16-byte-stride entry array and active count.
     // Field +0 of each entry is the questID for real quests (a category index
     // for headers); field +8 is the header indicator: non-NULL = header,
@@ -2349,6 +2395,86 @@ enum Offsets {
     FUN_STORM_SMEM_ALLOC = 0x006462E0,
     FUN_STORM_SMEM_FREE = 0x00646430,
 
+    // Engine's main file-content reader. Used by the TOC parser at
+    // `FUN_TOC_PARSER` to slurp addon `.toc` files and by the addon
+    // load pass for `.lua` source. Allocates a Storm buffer via
+    // `FUN_STORM_SMEM_ALLOC`, writes the file content + `extraBytes`
+    // trailing zeros, hands the buffer to the caller. Caller frees
+    // via `FUN_STORM_SMEM_FREE`.
+    //
+    //   __cdecl int FileRead(
+    //       int          unused,         // always 0 from engine call sites
+    //       const char  *path,           // "Interface\AddOns\X\Y.lua"
+    //       void       **outBuf,         // Storm-allocated content
+    //       size_t      *outSize,        // optional, may be NULL
+    //       size_t       extraBytes,     // trailing zero-fill (1 for nul-term)
+    //       int          flag1,          // always 1 from TOC parser
+    //       int          flag2);         // 0
+    //   Returns 1 on success, 0 on failure.
+    //
+    // We hook this to redirect reads of `Interface\AddOns\!!!ClassicAPI\*`
+    // to embedded buffers (see src/addons/Embedded.cpp). Allocating via
+    // the same Storm allocator the engine uses means the caller's
+    // normal `SMemFree` works without us tracking lifetime.
+    FUN_FILE_READ = 0x00648620,
+
+    // TOC parser — `__fastcall(this=addonName)`. Already documented in
+    // CLAUDE.md under "AddOn registry & hot-reload". Dedup-safe: if
+    // the addon is already in the hash table, returns immediately
+    // without re-parsing. Reads the TOC file via `FUN_FILE_READ`. We
+    // call this from the post-`FUN_ADDON_INIT` hook to register the
+    // embedded `!!!ClassicAPI` addon — the dedup behavior means our
+    // call is a no-op when the user has the addon installed on disk.
+    FUN_TOC_PARSER = 0x0051C9B0,
+
+    // AddOn registry init — `__fastcall(accountName)`. Documented in
+    // CLAUDE.md ("AddOn registry & hot-reload"). Hooked post-call so
+    // we can splice the embedded addon entry into the freshly-populated
+    // registry before the load pass.
+    FUN_ADDON_INIT = 0x0051C740,
+
+    // Generic intrusive-list insert/move helper used by `FUN_TOC_PARSER`
+    // to thread new addon entries into the registry's doubly-linked
+    // list. Signature (`__thiscall`):
+    //   `(ListCtrl *this, void *entry, int position, int anchor)`
+    // Where:
+    //   - `this`        — list-control struct (for the addon registry,
+    //                      this is `&VAR_ADDON_LIST_CTRL`).
+    //   - `entry`       — entry to insert. If already linked, the
+    //                      function removes it from its current
+    //                      position first.
+    //   - `position`    — `1` = insert at head, anything else (engine
+    //                      passes `2`) = insert at tail.
+    //   - `anchor`      — `0` = anchor against the list sentinel
+    //                      (default), nonzero = anchor relative to
+    //                      another entry's link field at that offset.
+    //
+    // Used by `Addons::Embedded` to move our injected `!!!ClassicAPI`
+    // entry from the tail (where `FUN_TOC_PARSER` puts it) to the head
+    // — vanilla's addon load pass at `FUN_0051F600` walks the linked
+    // list in insertion order, so without this fix our addon would
+    // load *last*, breaking dependent addons that expect our globals
+    // to be ready in their main chunk.
+    FUN_INTRUSIVE_LIST_INSERT = 0x00521AD0,
+
+    // Addon-registry intrusive-list control. Layout
+    // (`__thiscall`-friendly, generic across all intrusive lists in the
+    // binary):
+    //   +0x00 (= `0x00BE1B64`) — `int` next-pointer offset within each
+    //                              entry (= `0xC` at runtime; entries
+    //                              store their next-link at
+    //                              `entry+0xC..0x10`).
+    //   +0x04 (= `0x00BE1B68`) — sentinel `next` field
+    //                              (points back into &sentinel+1 when
+    //                              the list is empty).
+    //   +0x08 (= `0x00BE1B6C`) — list head (alias for sentinel `prev`
+    //                              when treated as circular).
+    //
+    // `VAR_ADDON_LIST_CTRL` is just the address of the control struct
+    // (i.e., `0x00BE1B64`). Pass `&VAR_ADDON_LIST_CTRL` as the `this`
+    // arg to `FUN_INTRUSIVE_LIST_INSERT`.
+    VAR_ADDON_LIST_CTRL = 0x00BE1B64,
+
     // `SStrDup(const char *src, const char *file, int line)`. `__stdcall`.
     // Storm's string-copy wrapper around `SMemAlloc` — used by the engine
     // itself to populate event entry names. We use it from `Event::Custom`
@@ -2483,9 +2609,11 @@ enum Offsets {
     // We dispatch to these directly so the wrappers don't need to
     // bounce through `Script_GetAddOnInfo` and unwind 7 returns.
     //
-    //   IS_LOAD_ON_DEMAND `__fastcall(entry) → byte`
-    //     Hash-table lookup in the addon registry. Non-zero ⇒
-    //     `## LoadOnDemand: 1` in the .toc.
+    //   IS_LOADED `__fastcall(entry) → byte`
+    //     Hash-table lookup in the addon registry. Returns the byte
+    //     at `entry+0x18`, which the addon loader (`FUN_0051F240`)
+    //     writes `1` to when the addon has finished loading. Non-zero
+    //     ⇒ the addon is loaded.
     //
     //   CAN_LOAD `__fastcall(entry, char fullCheck=1, int *outStatus,
     //                        int *outDepHandle, const char *accountName) → byte`
@@ -2506,7 +2634,7 @@ enum Offsets {
     //     Hash-table lookup that returns the security category index
     //     (0=SECURE, 1=INSECURE, 2=BANNED). Defaults to `1` (INSECURE)
     //     when the entry isn't in the override table.
-    FUN_ADDON_IS_LOAD_ON_DEMAND = 0x0051E6F0,
+    FUN_ADDON_IS_LOADED = 0x0051E6F0,
     FUN_ADDON_CAN_LOAD = 0x0051E780,
     FUN_ADDON_GET_SECURITY_INDEX = 0x0051E990,
 
@@ -3139,4 +3267,108 @@ enum Offsets {
     SMSG_OPCODE_MIRROR_TIMER_PAUSE = 0x1DA,
     SMSG_OPCODE_MIRROR_TIMER_STOP = 0x1DB,
     MIRROR_TIMER_SLOT_COUNT = 3,
+
+    // `realmList` CVar reader — returns the configured realmlist
+    // address (e.g. "logon.turtle-wow.org") as a `const char *`, or
+    // NULL when unset. `__fastcall(int forceRefresh)`; pass 0 to read
+    // the cached value (callers in the engine pass non-zero only
+    // around CMSG_AUTH_SESSION reconnects). Lazily registers the CVar
+    // on first call.
+    //
+    // This is the realmlist *address*, not the display name (the
+    // friendly server name visible in the realm-select dialog lives
+    // in the `realmName` CVar at `FUN_005AB7D0`, read by
+    // `Script_GetServerName`). Credentials are scoped on this value
+    // because two different private servers may share the same
+    // friendly name but never the same realmlist address.
+    FUN_CVAR_REALM_LIST = 0x005AB680,
+
+    // Engine login entry — the C function `Script_DefaultServerLogin`
+    // (the glue Lua binding at `0x0046D160`) tail-calls into here with
+    // the account/password as raw C strings. We invoke it directly from
+    // C++ when dispatching a saved-credential login, bypassing the
+    // round-trip through Lua so the plaintext never crosses the
+    // Lua boundary on the way out.
+    //
+    //   __fastcall void(ecx = const char *account, edx = char *password)
+    //
+    // The function:
+    //   1. Gates on three globals — VAR_GLUE_LOGIN_READY1,
+    //      VAR_GLUE_LOGIN_READY2 (both must be nonzero) and
+    //      VAR_GLUE_LOGIN_INPROGRESS (must be zero). All set up by the
+    //      normal glue boot flow; a call made while the AccountLogin
+    //      screen is showing is safe, an off-screen call silently no-ops.
+    //   2. Copies the account into a 0x40-byte buffer at `0x00B41DB0`
+    //      and uppercases it in place.
+    //   3. Fires the "connecting" status event.
+    //   4. Hands the (uppercased account, password) pair to the SRP
+    //      initiator at `FUN_005AB4B0`.
+    //   5. **Zeros the caller's password buffer in place** via an
+    //      unrolled `REP STOSD` loop counting strlen bytes — so the
+    //      decrypted-on-stack buffer we feed in gets scrubbed for free
+    //      after the SRP step consumes it.
+    //   6. Calls into the AddOn-registry init (`FUN_0051C740`) with the
+    //      uppercased account name. Same call documented in CLAUDE.md
+    //      under "AddOn registry & hot-reload".
+    FUN_GLUE_LOGIN_ATTEMPT = 0x0046AFB0,
+
+    // Glue-state readiness flags read by `FUN_GLUE_LOGIN_ATTEMPT`'s
+    // prologue. Names reflect the gate-condition logic, not anything
+    // intrinsic to the engine — the engine just checks `R1 && R2 && !IP`.
+    VAR_GLUE_LOGIN_READY1 = 0x00B41DFC,
+    VAR_GLUE_LOGIN_READY2 = 0x00B41E04,
+    VAR_GLUE_LOGIN_INPROGRESS = 0x00B41DA0,
+
+    // Cursor state — single global type-tag at VAR_CURSOR_TYPE
+    // dispatches reads through one of several payload slots depending
+    // on what's picked up. The engine's `CursorHasItem` /
+    // `CursorHasSpell` / `GetCursorMoney` and the various `Pickup*`
+    // functions all read/write through these. Discovered by tracing
+    // `Script_CursorHasItem` (`0x004895D0`) and the writers in
+    // `FUN_00494B60` (item), `FUN_00494CC0` (money), `FUN_00494D20`
+    // (spell), `FUN_00494E20` (pet action), `FUN_00494F80` (macro),
+    // `FUN_004950F0` (action/inv/etc.), `FUN_00495010` (merchant).
+    //
+    // Type values:
+    //   0  empty (nothing on cursor)
+    //   1  bag item — GUID at `VAR_CURSOR_ITEM_GUID_LO/_HI`,
+    //      itemID resolved by feeding the GUID to
+    //      `FUN_OBJECT_FROM_GUID` (filter 0x2).
+    //   2  money — copper at `VAR_CURSOR_MONEY_COPPER`
+    //   3  player spell — spellID at `VAR_CURSOR_SPELL_ID`
+    //   4  pet action — packed at `VAR_CURSOR_PETACTION_PACKED`
+    //   5  merchant item — itemID at `VAR_CURSOR_GENERIC_SLOT`,
+    //      0-based merchant slot at `VAR_CURSOR_GENERIC_SOURCE`.
+    //      Written by `Script_PickupMerchantItem` (`0x004FB760`) →
+    //      `FUN_004950F0(itemID, ?, slot0, 5)`.
+    //   6/7 other drag-source items — itemID at
+    //      `VAR_CURSOR_GENERIC_SLOT`. Type 7 is action-bar pickup
+    //      (`FUN_004E6130`); type 6 is another drag path (mail/etc.).
+    //   8  macro — 1-based index at `VAR_CURSOR_MACRO_INDEX`
+    //   9  inventory item (equipped slot) — itemID stored at
+    //      `VAR_CURSOR_GENERIC_SLOT`. Bare itemID rather than a GUID
+    //      because the item is out of the descriptor stream while
+    //      on the cursor.
+    //   10 stable pet — 1-based index at `VAR_CURSOR_STABLEPET_INDEX`.
+    //      Written by `Script_ClickStablePet` (`FUN_004CB420`) →
+    //      `FUN_00495010(slot)`.
+    //
+    // `CursorHasItem` returns true for types 1 *and* 9 only.
+    VAR_CURSOR_TYPE = 0x00B4D900,
+    VAR_CURSOR_ITEM_GUID_LO = 0x00B4E248,
+    VAR_CURSOR_ITEM_GUID_HI = 0x00B4E24C,
+    VAR_CURSOR_MONEY_COPPER = 0x00B4E2F0,
+    VAR_CURSOR_SPELL_ID = 0x00B4E2F4,
+    VAR_CURSOR_PETACTION_PACKED = 0x00B4E2F8,
+    VAR_CURSOR_MACRO_INDEX = 0x00B4E2FC,
+    VAR_CURSOR_STABLEPET_INDEX = 0x00B4E300,
+    VAR_CURSOR_GENERIC_SLOT = 0x00B4B41C,
+    VAR_CURSOR_GENERIC_DISPLAY = 0x00B4D8EC,
+    VAR_CURSOR_GENERIC_SOURCE = 0x00B4B420,
+
+    // GUID → CGObject resolver. `__fastcall(type_filter, guid_lo,
+    // guid_hi) → CGObject *` at `0x00468460`. Type filter 0x2 = item,
+    // matching what `FUN_00494B60` and the trade-attached paths pass
+    // when re-resolving the cursor GUID to a `CGItem *`.
+    FUN_OBJECT_FROM_GUID = 0x00468460,
 };

src/addons/Embedded.cpp

@@ -0,0 +1,370 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License along with
+// ClassicAPI. If not, see <https://www.gnu.org/licenses/>.
+
+// Embedded `!!!ClassicAPI` addon fallback. When the user doesn't have
+// the addon installed on disk, this module makes the engine think it
+// does — without writing anything to the filesystem.
+//
+// How:
+//
+//   1. The CMake build embeds every file under `AddOns/!!!ClassicAPI/`
+//      into a generated header (`embedded_classicapi.h`) as a byte
+//      array per file plus a `{path, data, size}` manifest.
+//
+//   2. We hook the engine's file-read function at `FUN_FILE_READ`.
+//      When the engine asks for a path under
+//      `Interface\AddOns\!!!ClassicAPI\`, we allocate a Storm buffer
+//      via the same allocator the engine itself uses, copy the
+//      embedded content in, and hand it back. The caller's normal
+//      `SMemFree` reclaims it on completion — no special lifetime.
+//
+//   3. We post-hook the engine's `FUN_ADDON_INIT`. After the engine's
+//      own `Interface\AddOns\` scan finishes, we call the TOC parser
+//      directly with `"!!!ClassicAPI"`. The parser opens its TOC via
+//      our hooked read function and registers the addon as a normal
+//      entry. The TOC parser is dedup-safe: if the user already has
+//      the addon on disk, the engine's scan picked it up, the
+//      hash-table lookup hits, and our call is a no-op. So the
+//      conditional "only if not on disk" behavior is free.
+//
+// Same pattern WeirdUtils.dll uses (we reverse-engineered it from
+// `0x10015A74` while figuring this out). The addon load pass then
+// reads each `.lua` file through the same hooked read path —
+// `GlobalStrings.lua`, `Util\Print.lua`, etc. all surface from
+// embedded buffers.
+
+#include "embedded_classicapi.h"
+
+#include "Game.h"
+#include "Offsets.h"
+
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+
+namespace Addons::Embedded {
+
+namespace {
+
+constexpr const char *kAddonName = "!!!ClassicAPI";
+constexpr const char *kAddonTocFile = "!!!ClassicAPI.toc";
+
+// `Interface\AddOns\!!!ClassicAPI\` — the prefix the engine
+// constructs for any of our addon's files. Comparing case-
+// insensitively because the TOC parser uses `Interface\AddOns\%s\…`
+// where %s comes from the on-disk directory name, and Windows file
+// paths are case-insensitive.
+constexpr const char *kAddonPathPrefix = "Interface\\AddOns\\!!!ClassicAPI\\";
+constexpr size_t kAddonPathPrefixLen = 30; // length of the literal above
+
+char NormalizeChar(char c) {
+    if (c == '/') return '\\';
+    if (c >= 'A' && c <= 'Z') return static_cast<char>(c + 32);
+    return c;
+}
+
+bool PathEqualsCI(const char *a, const char *b) {
+    while (*a && *b) {
+        if (NormalizeChar(*a) != NormalizeChar(*b)) return false;
+        ++a; ++b;
+    }
+    return *a == *b;
+}
+
+// Strip the `Interface\AddOns\!!!ClassicAPI\` prefix and return the
+// suffix (e.g. `Util\Print.lua`) on a match, NULL otherwise.
+const char *StripAddonPrefix(const char *path) {
+    if (path == nullptr) return nullptr;
+    const char *p = path;
+    const char *q = kAddonPathPrefix;
+    while (*q) {
+        if (*p == '\0') return nullptr;
+        if (NormalizeChar(*p) != NormalizeChar(*q)) return nullptr;
+        ++p; ++q;
+    }
+    return p;
+}
+
+const ClassicAPIFiles::File *LookupEmbedded(const char *suffix) {
+    for (size_t i = 0; i < ClassicAPIFiles::kFileCount; ++i) {
+        if (PathEqualsCI(suffix, ClassicAPIFiles::kFiles[i].path))
+            return &ClassicAPIFiles::kFiles[i];
+    }
+    return nullptr;
+}
+
+// Storm allocator — same one `FUN_FILE_READ` uses internally. Buffer
+// allocated here is freed cleanly by the caller's standard `SMemFree`
+// (`FUN_STORM_SMEM_FREE`). `__stdcall` per the function's `RET 0x10`
+// (4 args × 4 bytes = 16) epilogue.
+//   __stdcall void *SMemAlloc(size_t size, const char *file, int line, int flags)
+using SMemAlloc_t = void *(__stdcall *)(size_t size, const char *file, int line, int flags);
+
+// `FUN_FILE_READ` — same shape derived from the Octo decompile.
+// Calling convention is `__stdcall` (callee cleans 28 bytes via
+// `RET 0x1C`), not `__cdecl` — confirmed via the function epilogue.
+// Getting this wrong silently corrupts the caller's stack frame.
+//   __stdcall int FileRead(int unused, const char *path, void **outBuf,
+//                          size_t *outSize, size_t extraBytes,
+//                          int flag1, int flag2)
+using FileRead_t = int(__stdcall *)(int unused, const char *path, void **outBuf,
+                                    size_t *outSize, size_t extraBytes,
+                                    int flag1, int flag2);
+FileRead_t FileRead_o = nullptr;
+
+// Storm-allocator free. Used to release the disk-TOC buffer after we
+// scrape its version line — same path the engine itself uses when
+// `FileRead_o` succeeded and the caller's done with the result.
+//   __stdcall void SMemFree(void *buf, const char *file, int line, int flags)
+using SMemFree_t = void(__stdcall *)(void *buf, const char *file, int line, int flags);
+
+// Extracts the value of the `## Version: X` line from a TOC byte
+// buffer. Writes into `out` (size `outSize`) and returns true on
+// success. The TOC format is `## Key: Value`, one per line, case-
+// sensitive on the key. Returns false if no Version line is found.
+bool ExtractTocVersion(const char *content, size_t size,
+                       char *out, size_t outSize) {
+    static const char kKey[] = "## Version:";
+    constexpr size_t kKeyLen = sizeof(kKey) - 1;
+    for (size_t i = 0; i + kKeyLen <= size; ++i) {
+        const bool atLineStart = (i == 0) || content[i - 1] == '\n';
+        if (!atLineStart) continue;
+        if (std::memcmp(content + i, kKey, kKeyLen) != 0) continue;
+        const char *p = content + i + kKeyLen;
+        const char *end = content + size;
+        while (p < end && (*p == ' ' || *p == '\t')) ++p;
+        size_t j = 0;
+        while (p < end && *p != '\r' && *p != '\n' && j + 1 < outSize) {
+            out[j++] = *p++;
+        }
+        while (j > 0 && (out[j - 1] == ' ' || out[j - 1] == '\t')) --j;
+        out[j] = '\0';
+        return j > 0;
+    }
+    if (outSize > 0) out[0] = '\0';
+    return false;
+}
+
+// Returns -1/0/+1 for `a < b` / `a == b` / `a > b`. "DEV" is a
+// sentinel meaning "newer than any real release" — local dev builds
+// always win against installed-on-disk versions. Otherwise the two
+// strings are walked as dot-separated numeric semver components
+// (`1.2` < `1.10`).
+int CompareVersions(const char *a, const char *b) {
+    const bool aDev = std::strcmp(a, "DEV") == 0;
+    const bool bDev = std::strcmp(b, "DEV") == 0;
+    if (aDev && bDev) return 0;
+    if (aDev) return 1;
+    if (bDev) return -1;
+    while (*a || *b) {
+        int va = 0, vb = 0;
+        while (*a >= '0' && *a <= '9') { va = va * 10 + (*a - '0'); ++a; }
+        while (*b >= '0' && *b <= '9') { vb = vb * 10 + (*b - '0'); ++b; }
+        if (va != vb) return va < vb ? -1 : 1;
+        if (*a == '.') ++a;
+        if (*b == '.') ++b;
+        if (!*a && !*b) break;
+        if (!*a) return -1;
+        if (!*b) return 1;
+    }
+    return 0;
+}
+
+// Pre-extracted embedded TOC version, populated lazily on first
+// FileRead_h call under our prefix. Empty until populated.
+char g_embeddedVersion[64] = "";
+
+// Which source wins the embed-vs-disk comparison, decided once on
+// first relevant file read.
+enum class Source { Undecided, Disk, Embedded };
+Source g_source = Source::Undecided;
+
+void EnsureEmbeddedVersionExtracted() {
+    if (g_embeddedVersion[0] != '\0') return;
+    for (size_t i = 0; i < ClassicAPIFiles::kFileCount; ++i) {
+        if (PathEqualsCI(kAddonTocFile, ClassicAPIFiles::kFiles[i].path)) {
+            ExtractTocVersion(
+                reinterpret_cast<const char *>(ClassicAPIFiles::kFiles[i].data),
+                ClassicAPIFiles::kFiles[i].size,
+                g_embeddedVersion, sizeof(g_embeddedVersion));
+            return;
+        }
+    }
+}
+
+// Decide whether disk or embedded should serve all reads for this
+// addon. Called on the first FileRead_h call with a matching prefix.
+// Reads the on-disk TOC via the original `FUN_FILE_READ` (bypassing
+// our hook), parses its version, compares to the embedded version,
+// and caches the winner. If disk has no TOC at all, embedded wins by
+// default.
+void DecideSource() {
+    if (g_source != Source::Undecided) return;
+    EnsureEmbeddedVersionExtracted();
+
+    char fullPath[256];
+    std::snprintf(fullPath, sizeof(fullPath), "%s%s",
+                  kAddonPathPrefix, kAddonTocFile);
+
+    void *diskBuf = nullptr;
+    size_t diskSize = 0;
+    const int ok = FileRead_o(0, fullPath, &diskBuf, &diskSize, 1, 1, 0);
+    if (ok == 0 || diskBuf == nullptr) {
+        g_source = Source::Embedded;
+        return;
+    }
+
+    char diskVersion[64] = "";
+    ExtractTocVersion(static_cast<const char *>(diskBuf), diskSize,
+                      diskVersion, sizeof(diskVersion));
+
+    // Free the disk buffer we just borrowed — we only needed it for
+    // the version-line scrape. The actual content for the engine's
+    // TOC read comes through the regular hook path below.
+    auto SMemFree = reinterpret_cast<SMemFree_t>(Offsets::FUN_STORM_SMEM_FREE);
+    SMemFree(diskBuf, __FILE__, __LINE__, 0);
+
+    // Missing or unparseable disk version → assume it's older than
+    // anything we ship, embedded wins.
+    if (diskVersion[0] == '\0') {
+        g_source = Source::Embedded;
+        return;
+    }
+
+    const int cmp = CompareVersions(g_embeddedVersion, diskVersion);
+    g_source = (cmp > 0) ? Source::Embedded : Source::Disk;
+}
+
+int __stdcall FileRead_h(int unused, const char *path, void **outBuf,
+                         size_t *outSize, size_t extraBytes,
+                         int flag1, int flag2) {
+    const char *suffix = StripAddonPrefix(path);
+    if (suffix == nullptr) {
+        // Path isn't under `Interface\AddOns\!!!ClassicAPI\` — straight
+        // pass-through, we don't care.
+        return FileRead_o(unused, path, outBuf, outSize, extraBytes,
+                          flag1, flag2);
+    }
+
+    DecideSource();
+
+    if (g_source == Source::Disk) {
+        // Disk version is at least as new — serve disk. If disk
+        // doesn't have this specific file (e.g. embedded has files
+        // disk doesn't), fall through and try embedded.
+        const int diskResult = FileRead_o(unused, path, outBuf, outSize,
+                                           extraBytes, flag1, flag2);
+        if (diskResult != 0) return diskResult;
+    }
+
+    // Source::Embedded path, OR Source::Disk-but-file-missing fallback.
+    // Look up the embedded version and synthesize a Storm buffer the
+    // caller can free normally.
+    const auto *entry = LookupEmbedded(suffix);
+    if (entry == nullptr) {
+        // Not in our embedded set either — let the engine try disk
+        // one more time (returns 0 if that also fails). Covers
+        // pathological cases like an empty disk install + embedded
+        // missing some file.
+        return FileRead_o(unused, path, outBuf, outSize, extraBytes,
+                          flag1, flag2);
+    }
+
+    auto SMemAlloc = reinterpret_cast<SMemAlloc_t>(
+        Offsets::FUN_STORM_SMEM_ALLOC);
+    const size_t totalSize = entry->size + extraBytes;
+    void *buf = SMemAlloc(totalSize, __FILE__, __LINE__, 0);
+    if (buf == nullptr) return 0;
+    std::memcpy(buf, entry->data, entry->size);
+    if (extraBytes > 0) {
+        std::memset(static_cast<uint8_t *>(buf) + entry->size, 0, extraBytes);
+    }
+    if (outBuf != nullptr) *outBuf = buf;
+    if (outSize != nullptr) *outSize = entry->size;
+    return 1;
+}
+
+// `FUN_ADDON_INIT` — `__fastcall(accountName)`. We post-hook it: let
+// the engine's normal `Interface\AddOns\` scan run first, then call
+// the TOC parser with `"!!!ClassicAPI"`. Dedup-safe — see file header.
+using AddonInit_t = void(__fastcall *)(const char *accountName);
+AddonInit_t AddonInit_o = nullptr;
+
+using TocParser_t = void(__fastcall *)(const char *name);
+using ListInsert_t = void(__thiscall *)(void *listCtrl, void *entry,
+                                         int position, int anchor);
+
+// `FUN_TOC_PARSER` appends new entries to the *tail* of the addon
+// registry's linked list, and the engine's addon-load pass at
+// `FUN_0051F600` walks that list in *insertion order* (NOT
+// alphabetical order — the alphabetical sort only applies to the
+// flat array `GetAddOnInfo(i)` reads from). So our post-hook
+// injection lands at the very end of the load order, after every
+// disk-scanned addon. Addons that consume our globals from their
+// main chunk (idTip's `FrameWatcher`, etc.) would see `nil` and
+// hard-error during their boot.
+//
+// Fix: walk the linked list, find our entry by name, and re-link
+// it to the head via `FUN_INTRUSIVE_LIST_INSERT(position=1)`. The
+// engine's own insert helper handles remove-then-insert atomically,
+// so it's safe to call on an entry that's already in the list.
+//
+// Entries are pointed to by `[VAR_ADDON_LIST_HEAD]` (`0x00BE1B6C`),
+// with the next-pointer field at `entry + 0x10` (computed as
+// `*(value-at-VAR_ADDON_LIST_CTRL) + entry + 4` = `0xC + entry + 4`
+// = `entry + 0x10`). Low-bit-1 means "sentinel" (end of list).
+// Name pointer lives at `entry + 0x14`.
+constexpr uintptr_t VAR_ADDON_LIST_HEAD = 0x00BE1B6C;
+constexpr int OFF_ADDON_ENTRY_NAME_PTR = 0x14;
+
+void MoveEmbeddedToListHead() {
+    uintptr_t entry = *reinterpret_cast<uintptr_t *>(VAR_ADDON_LIST_HEAD);
+    const int linkOffset = *reinterpret_cast<const int *>(
+        static_cast<uintptr_t>(Offsets::VAR_ADDON_LIST_CTRL));
+    while ((entry & 1) == 0 && entry != 0) {
+        const char *name = *reinterpret_cast<const char *const *>(
+            entry + OFF_ADDON_ENTRY_NAME_PTR);
+        if (name != nullptr && std::strcmp(name, kAddonName) == 0) {
+            auto fn = reinterpret_cast<ListInsert_t>(
+                Offsets::FUN_INTRUSIVE_LIST_INSERT);
+            fn(reinterpret_cast<void *>(
+                   static_cast<uintptr_t>(Offsets::VAR_ADDON_LIST_CTRL)),
+               reinterpret_cast<void *>(entry),
+               /*position=*/ 1, /*anchor=*/ 0);
+            return;
+        }
+        entry = *reinterpret_cast<const uintptr_t *>(
+            entry + linkOffset + 4);
+    }
+}
+
+void __fastcall AddonInit_h(const char *accountName) {
+    AddonInit_o(accountName);
+    auto TocParser = reinterpret_cast<TocParser_t>(Offsets::FUN_TOC_PARSER);
+    TocParser(kAddonName);
+    MoveEmbeddedToListHead();
+}
+
+const Game::HookAutoRegister _hookFileRead{
+    Offsets::FUN_FILE_READ,
+    reinterpret_cast<void *>(&FileRead_h),
+    reinterpret_cast<void **>(&FileRead_o)};
+
+const Game::HookAutoRegister _hookAddonInit{
+    Offsets::FUN_ADDON_INIT,
+    reinterpret_cast<void *>(&AddonInit_h),
+    reinterpret_cast<void **>(&AddonInit_o)};
+
+} // namespace
+
+} // namespace Addons::Embedded

src/addons/Info.cpp

@@ -163,9 +163,13 @@ int __fastcall Script_IsAddOnLoadable(void *L) {
         return 2;
     }
 
-    auto isLoD = reinterpret_cast<EntryByteFn_t>(
-        Offsets::FUN_ADDON_IS_LOAD_ON_DEMAND);
-    if (isLoD(entry) != 0) {
+    // Already-loaded addons are trivially loadable — skip the
+    // recursive dep walk and return (true, nil) directly. `IS_LOADED`
+    // reads the byte at `entry+0x18` (the loader sets that to 1 on
+    // successful load).
+    auto isLoaded = reinterpret_cast<EntryByteFn_t>(
+        Offsets::FUN_ADDON_IS_LOADED);
+    if (isLoaded(entry) != 0) {
         Game::Lua::PushBoolean(L, 1);
         Game::Lua::PushNil(L);
         return 2;
@@ -229,6 +233,36 @@ int __fastcall Script_GetAddOnSecurity(void *L) {
     return 1;
 }
 
+// `C_AddOns.IsAddOnLoaded(indexOrName)` → `(loadedOrLoading, loaded)`.
+//
+// Modern WoW distinguishes "load-in-progress" from "fully loaded" —
+// matters for LoD addons whose load is split across multiple
+// `LoadAddOn` callbacks. Vanilla 1.12's `FUN_0051F240` is fully
+// synchronous: the loaded byte at `entry+0x18` flips from 0 → 1
+// inside a single call, so the "loading" state is never observable
+// from Lua. We return the same boolean twice — `loadedOrLoading`
+// and `loaded` are identical here.
+//
+// Resolves both numeric indices (via `FUN_ADDON_GET_BY_INDEX`) and
+// string names. `IS_LOADED` accepts an entry pointer as its name arg
+// because the entry's first 12 bytes are the inline NUL-terminated
+// directory name (same as the other per-field accessors), so we can
+// feed it either an entry or a Lua-side string transparently.
+int __fastcall Script_IsAddOnLoaded(void *L) {
+    const uint8_t *entry = ResolveAddOnName(L);
+    if (entry == nullptr) {
+        Game::Lua::PushBool(L, false);
+        Game::Lua::PushBool(L, false);
+        return 2;
+    }
+    auto isLoaded = reinterpret_cast<EntryByteFn_t>(
+        Offsets::FUN_ADDON_IS_LOADED);
+    const bool loaded = isLoaded(entry) != 0;
+    Game::Lua::PushBool(L, loaded);
+    Game::Lua::PushBool(L, loaded);
+    return 2;
+}
+
 // `C_AddOns.DoesAddOnExist(indexOrName)` — true iff the engine's
 // addon registry has a matching entry. For numeric input we trust
 // `GetByIndex`'s OOR-NULL; for string input we walk the flat array,
@@ -276,6 +310,8 @@ static void RegisterLuaFunctions() {
                                      &Script_GetAddOnSecurity);
     Game::Lua::RegisterTableFunction("C_AddOns", "DoesAddOnExist",
                                      &Script_DoesAddOnExist);
+    Game::Lua::RegisterTableFunction("C_AddOns", "IsAddOnLoaded",
+                                     &Script_IsAddOnLoaded);
     Game::Lua::RegisterIntegerEnum(
         "Enum", "AddOnSecurityStatus",
         kAddOnSecurityStatusEntries,

src/cursor/Info.cpp

@@ -0,0 +1,276 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License along with
+// ClassicAPI. If not, see <https://www.gnu.org/licenses/>.
+
+// `GetCursorInfo()` — backport of the modern WoW global. Surfaces
+// whatever the player has picked up (item, money, spell, macro,
+// merchant slot) as a tuple. Read from the same cursor-state globals
+// the engine's `CursorHasItem` / `CursorHasSpell` / `GetCursorMoney`
+// consult — see the cursor type table in [[src/Offsets.h]].
+//
+// Return shape per type (matches modern Lua API where it makes sense
+// for 1.12's actual storage):
+//
+//   nothing on cursor       — nil
+//   "item", itemID, link    — bag item (type 1; link is the full
+//                             per-instance form via the engine's link
+//                             builder, including enchantID and
+//                             random-suffix decoration)
+//   "item", itemID          — drag-source item (types 5/6/7 trade /
+//                             mail / action bar; type 9 equipment
+//                             slot) — only the itemID is in cursor
+//                             storage, no live CGItem to feed the
+//                             link builder
+//   "money", amount         — type 2; amount in copper
+//   "spell", slot, bookType, spellID
+//                           — type 3; bookType is "spell" or "pet"
+//                             (1.12 only writes player-spell IDs to
+//                             this slot, so bookType is always
+//                             "spell" here; the cursor's "pet
+//                             action" path is a distinct type)
+//   "macro", index          — type 8; 1-based macro index
+//   "merchant", index       — type 10; 1-based merchant-roster index
+//
+// Type 4 (pet action) is not surfaced — doesn't map cleanly to a
+// modern `GetCursorInfo` string. Consumers can fall back to
+// `CursorHasItem` / engine `PickupX` calls when they need to detect
+// that.
+
+#include "Game.h"
+#include "Offsets.h"
+#include "item/ID.h"
+#include "item/Link.h"
+#include "item/Location.h"
+#include "item/QualityColor.h"
+#include "spell/Lookup.h"
+
+#include <cstdint>
+#include <cstdio>
+
+namespace Cursor::Info {
+
+namespace {
+
+// Engine signature is `__thiscall(this = typeFilter, guidLo, guidHi,
+// unused)`. The "this" param is just a small integer filter — Ghidra
+// shows it cast as `(void *)0x2` at every call site for items. The
+// function reads only the first two stack args (`[ebp+8]` and
+// `[ebp+0xC]`) but cleans 12 bytes via `ret 0xc`, so the caller must
+// push a third dword for stack balance — engine callers push a
+// scratch dword (`0x90`, `0x1C13`, etc.) for this. Declaring a 4th
+// arg here makes MSVC emit the matching push; without it, stack
+// imbalance of -4 bytes silently corrupts the caller's frame and
+// (downstream) wedges things like chat input.
+using ObjectFromGUID_t = uint8_t *(__thiscall *)(uintptr_t typeFilter,
+                                                  uint32_t guidLo, uint32_t guidHi,
+                                                  uint32_t unused);
+
+constexpr uint32_t TYPE_EMPTY = 0;
+constexpr uint32_t TYPE_BAG_ITEM = 1;
+constexpr uint32_t TYPE_MONEY = 2;
+constexpr uint32_t TYPE_SPELL = 3;
+// Type 5 = merchant pickup. Written by `Script_PickupMerchantItem`
+// (`0x004FB760`) via `FUN_004950F0(itemID, ?, slot0Based, 5)`. The
+// itemID lands in `VAR_CURSOR_GENERIC_SLOT` and the 0-based merchant
+// slot in `VAR_CURSOR_GENERIC_SOURCE` — we push slot+1 to Lua to
+// match modern's 1-based merchant convention.
+constexpr uint32_t TYPE_MERCHANT = 5;
+// Types 6/7/9 — drag-source items from various pickup paths. All
+// share the same storage trio. Type 7 is action-bar item pickup
+// (`FUN_004E6130`), type 9 is equipment-slot pickup (`FUN_004C7300`),
+// and type 6 is another drag-source path (mail or similar). In all
+// cases the itemID is at `VAR_CURSOR_GENERIC_SLOT`. For modern API
+// compat we surface them as `"item"`.
+constexpr uint32_t TYPE_GENERIC_ITEM_LO = 6;
+constexpr uint32_t TYPE_GENERIC_ITEM_HI = 7;
+constexpr uint32_t TYPE_MACRO = 8;
+constexpr uint32_t TYPE_INVENTORY_ITEM = 9;
+// Type 10 is stable-pet pickup (`FUN_00495010`, the source of the
+// earlier misidentification as "merchant"). Modern WoW has no
+// equivalent `GetCursorInfo` return for stable pets, so we leave it
+// as nil.
+
+constexpr uint32_t GUID_TYPE_FILTER_ITEM = 0x2;
+
+uint32_t ReadVar(uintptr_t va) {
+    return *reinterpret_cast<const uint32_t *>(va);
+}
+
+int PushItem(void *L, const uint8_t *cgItem) {
+    if (cgItem == nullptr)
+        return 0;
+    const int itemID = Item::ID::FromCGItem(cgItem);
+    if (itemID <= 0)
+        return 0;
+    Game::Lua::PushString(L, "item");
+    Game::Lua::PushNumber(L, static_cast<double>(itemID));
+    // Engine link builder works fine on cursored items — the cursor
+    // leaves the instance block at `+0x08` and the m_objectFields
+    // descriptor at `+0x114` intact, which is all the builder reads
+    // (plus a virtual call into the sub-object at `+0x110`, whose
+    // vftable is also untouched while held on the cursor). Earlier
+    // crash repros were the stack-imbalance bug in the GUID resolver
+    // — see Offsets::FUN_OBJECT_FROM_GUID.
+    const char *link = Item::Link::FromCGItem(cgItem);
+    if (link != nullptr && *link != '\0') {
+        Game::Lua::PushString(L, link);
+        return 3;
+    }
+    return 2;
+}
+
+int PushBagItemCursor(void *L) {
+    const uint32_t lo = ReadVar(Offsets::VAR_CURSOR_ITEM_GUID_LO);
+    const uint32_t hi = ReadVar(Offsets::VAR_CURSOR_ITEM_GUID_HI);
+    if (lo == 0 && hi == 0)
+        return 0;
+    auto resolver = reinterpret_cast<ObjectFromGUID_t>(Offsets::FUN_OBJECT_FROM_GUID);
+    const uint8_t *cgItem = resolver(GUID_TYPE_FILTER_ITEM, lo, hi, 0);
+    return PushItem(L, cgItem);
+}
+
+using GetItemRecord_t = const uint8_t *(__thiscall *)(void *cache, uint32_t itemID,
+                                                      const uint64_t *guid, void *callback,
+                                                      void *userData, int unused);
+
+const uint8_t *PeekItemRecord(uint32_t itemID) {
+    auto fn = reinterpret_cast<GetItemRecord_t>(Offsets::FUN_DBCACHE_ITEMSTATS_GET_RECORD);
+    auto *cache = reinterpret_cast<void *>(Offsets::VAR_ITEMDB_CACHE);
+    const uint64_t zeroGuid = 0;
+    return fn(cache, itemID, &zeroGuid, nullptr, nullptr, 0);
+}
+
+// Builds a basic `"|cffRRGGBB|Hitem:N:0:0:0|h[Name]|h|r"` link from
+// the cached ItemStats record for `itemID`. No enchant / random-
+// suffix decoration — the cursor only stores the bare itemID for
+// drag-source items (types 6/7/9) with no live `CGItem *` to read
+// instance state from. Returns true and writes into `out` (size
+// `outSize`) on success; returns false if the item isn't cached.
+bool BuildBasicItemLink(uint32_t itemID, char *out, size_t outSize) {
+    const uint8_t *record = PeekItemRecord(itemID);
+    if (record == nullptr) return false;
+    const char *name = *reinterpret_cast<const char *const *>(
+        record + Offsets::OFF_ITEMSTATS_NAME);
+    if (name == nullptr || *name == '\0') return false;
+    const uint32_t quality = *reinterpret_cast<const uint32_t *>(
+        record + Offsets::OFF_ITEMSTATS_QUALITY);
+    const int n = std::snprintf(out, outSize,
+        "%s|Hitem:%u:0:0:0|h[%s]|h|r",
+        Item::QualityColor::Prefix(static_cast<int>(quality)),
+        itemID, name);
+    return n > 0 && static_cast<size_t>(n) < outSize;
+}
+
+// Shared path for types 6/7 (action bar / mail drag) and type 9
+// (equipment slot). All three write the itemID at
+// `VAR_CURSOR_GENERIC_SLOT` — see the type-table notes in
+// [[src/Offsets.h]]. The cursor doesn't preserve a GUID for these,
+// so the live CGItem isn't directly addressable here. To recover
+// enchant / random-suffix decoration we walk the player's
+// equipment + bags looking for the first CGItem with a matching
+// itemID — same trick the action-bar tooltip uses to display
+// enchanted bracers correctly when they're on an action bar. Falls
+// back to a basic ID-only link when no instance is found (item was
+// deleted, or it's a vendor-roster reference with no local copy).
+int PushGenericItemCursor(void *L) {
+    const uint32_t itemID = ReadVar(Offsets::VAR_CURSOR_GENERIC_SLOT);
+    if (itemID == 0)
+        return 0;
+    Game::Lua::PushString(L, "item");
+    Game::Lua::PushNumber(L, static_cast<double>(itemID));
+
+    Item::Location::ByGUIDResult found;
+    if (Item::Location::FindByItemID(L, static_cast<int>(itemID), &found)) {
+        const char *link = Item::Link::FromCGItem(found.item);
+        if (link != nullptr && *link != '\0') {
+            Game::Lua::PushString(L, link);
+            return 3;
+        }
+    }
+
+    char linkBuf[256];
+    if (BuildBasicItemLink(itemID, linkBuf, sizeof(linkBuf))) {
+        Game::Lua::PushString(L, linkBuf);
+        return 3;
+    }
+    return 2;
+}
+
+int PushMoneyCursor(void *L) {
+    const uint32_t copper = ReadVar(Offsets::VAR_CURSOR_MONEY_COPPER);
+    Game::Lua::PushString(L, "money");
+    Game::Lua::PushNumber(L, static_cast<double>(copper));
+    return 2;
+}
+
+int PushSpellCursor(void *L) {
+    const uint32_t spellID = ReadVar(Offsets::VAR_CURSOR_SPELL_ID);
+    if (spellID == 0)
+        return 0;
+    int bookType = 0;
+    const int slot = Spell::Lookup::FindSpellbookSlot(
+        static_cast<int>(spellID), &bookType);
+    Game::Lua::PushString(L, "spell");
+    // Slot can be 0 (rare — talent-passive auras the player has but
+    // that have no spellbook entry). Push it anyway; the modern API's
+    // contract is "slot may be 0 when there's no book row".
+    Game::Lua::PushNumber(L, static_cast<double>(slot));
+    Game::Lua::PushString(L, bookType == 1 ? "pet" : "spell");
+    Game::Lua::PushNumber(L, static_cast<double>(spellID));
+    return 4;
+}
+
+int PushMacroCursor(void *L) {
+    const uint32_t index = ReadVar(Offsets::VAR_CURSOR_MACRO_INDEX);
+    if (index == 0)
+        return 0;
+    Game::Lua::PushString(L, "macro");
+    Game::Lua::PushNumber(L, static_cast<double>(index));
+    return 2;
+}
+
+int PushMerchantCursor(void *L) {
+    // Engine stores the 0-based merchant slot at
+    // `VAR_CURSOR_GENERIC_SOURCE`. Convert to 1-based for the modern
+    // Lua-API contract (`MerchantItemButton`s and friends are
+    // 1-indexed).
+    const uint32_t slot0 = ReadVar(Offsets::VAR_CURSOR_GENERIC_SOURCE);
+    Game::Lua::PushString(L, "merchant");
+    Game::Lua::PushNumber(L, static_cast<double>(slot0 + 1));
+    return 2;
+}
+
+int __fastcall Script_GetCursorInfo(void *L) {
+    const uint32_t type = ReadVar(Offsets::VAR_CURSOR_TYPE);
+    if (type >= TYPE_GENERIC_ITEM_LO && type <= TYPE_GENERIC_ITEM_HI)
+        return PushGenericItemCursor(L);
+    switch (type) {
+        case TYPE_BAG_ITEM:       return PushBagItemCursor(L);
+        case TYPE_MERCHANT:       return PushMerchantCursor(L);
+        case TYPE_INVENTORY_ITEM: return PushGenericItemCursor(L);
+        case TYPE_MONEY:          return PushMoneyCursor(L);
+        case TYPE_SPELL:          return PushSpellCursor(L);
+        case TYPE_MACRO:          return PushMacroCursor(L);
+        case TYPE_EMPTY:
+        default:                  return 0;
+    }
+}
+
+void RegisterLuaFunctions() {
+    Game::Lua::RegisterGlobalFunction("GetCursorInfo", &Script_GetCursorInfo);
+}
+
+const Game::ModuleAutoRegister _autoreg{&RegisterLuaFunctions};
+
+} // namespace
+
+} // namespace Cursor::Info

src/equipmentset/Api.cpp

@@ -35,6 +35,7 @@
 #include "Offsets.h"
 #include "Set.h"
 #include "event/Custom.h"
+#include "item/Location.h"
 #include "item/Swap.h"
 
 #include <cstdint>
@@ -401,12 +402,55 @@ int __fastcall Script_UseEquipmentSet(void *L) {
     uint64_t guids[SLOT_COUNT];
     std::memcpy(guids, s->items, sizeof(guids));
 
+    // Snapshot empty bag slots up front. The CGItem state doesn't
+    // update between packet sends (server has to acknowledge each
+    // swap), so iterating the bag walk fresh per unequip would
+    // repeatedly pick the same "first empty" slot — second packet
+    // collides with what packet 1 just put there, and the server
+    // tries to swap that item back onto the wrong paperdoll slot
+    // → "This item cannot be equipped".
+    struct FreeSlot {
+        int bag;
+        int slot;
+    };
+    FreeSlot freeSlots[64];
+    int freeSlotCount = 0;
+    for (int bag = 0; bag <= 4 && freeSlotCount < 64; ++bag) {
+        const int slots = Item::Location::GetBagSlotCount(bag);
+        for (int slot = 1; slot <= slots && freeSlotCount < 64; ++slot) {
+            if (Item::Location::ResolveBag(L, bag, slot) == nullptr)
+                freeSlots[freeSlotCount++] = {bag, slot};
+        }
+    }
+    int nextFreeSlot = 0;
+
     for (int i = 0; i < SLOT_COUNT; ++i) {
         const int targetSlot = i + 1;
         const uint64_t g = guids[i];
-        if (g == GUID_EMPTY || g == GUID_IGNORED)
+
+        // GUID_IGNORED: leave whatever the player has in this slot
+        // as-is. Distinct from GUID_EMPTY (= 0), which means "this
+        // slot should be empty after the swap" — handled below.
+        if (g == GUID_IGNORED)
             continue;
 
+        if (g == GUID_EMPTY) {
+            // Set wants this slot empty. If it already is, no-op.
+            // Otherwise unequip whatever's there into the next bag
+            // slot we reserved during the pre-loop snapshot. If
+            // we've exhausted the snapshot, silently skip — matches
+            // the modern API which surfaces no per-slot reason.
+            const uint8_t *equipped =
+                Item::Location::ResolveEquipmentSlot(targetSlot);
+            if (equipped == nullptr)
+                continue;
+            if (nextFreeSlot >= freeSlotCount)
+                continue;
+            const FreeSlot &fs = freeSlots[nextFreeSlot++];
+            Item::Swap::ToBag(equipped, targetSlot, fs.bag, fs.slot);
+            continue;
+        }
+
         const int loc = Locations::FindGUID(g);
         if (loc == 0)
             continue; // missing — nothing to do

src/item/Location.cpp

@@ -146,6 +146,43 @@ const uint8_t *ResolveByGUID(uint64_t guid) {
                                             0x172));
 }
 
+bool FindByItemID(void *L, int itemID, ByGUIDResult *out) {
+    if (itemID <= 0)
+        return false;
+
+    for (int slot = Offsets::EQUIPMENT_SLOT_FIRST;
+         slot <= Offsets::EQUIPMENT_SLOT_LAST; ++slot) {
+        auto *item = ResolveEquipmentSlot(slot);
+        if (item == nullptr)
+            continue;
+        if (Item::ID::FromCGItem(item) == itemID) {
+            out->equipmentSlotIndex = slot;
+            out->bagID = 0;
+            out->slotIndex = 0;
+            out->item = item;
+            return true;
+        }
+    }
+
+    for (int bagID = 0; bagID <= 4; ++bagID) {
+        const int slotCount = GetBagSlotCount(bagID);
+        for (int slotIndex = 1; slotIndex <= slotCount; ++slotIndex) {
+            auto *item = ResolveBag(L, bagID, slotIndex);
+            if (item == nullptr)
+                continue;
+            if (Item::ID::FromCGItem(item) == itemID) {
+                out->equipmentSlotIndex = 0;
+                out->bagID = bagID;
+                out->slotIndex = slotIndex;
+                out->item = item;
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
 bool FindByGUID(void *L, uint64_t guid, ByGUIDResult *out) {
     if (guid == 0)
         return false;

src/item/Location.h

@@ -86,6 +86,16 @@ struct ByGUIDResult {
 // Lua stack — only safe from inside a Lua callback.
 bool FindByGUID(void *L, uint64_t guid, ByGUIDResult *out);
 
+// Same equipment-first, bag-second walk as `FindByGUID`, but matches
+// on itemID instead. Returns the FIRST instance found — equipment
+// slots are checked before bags, so an equipped enchanted copy is
+// preferred over an unenchanted duplicate in the backpack. Used
+// when we only have the itemID for a slot (e.g. cursor-held items
+// picked up from the action bar, which the engine stores as a
+// bare itemID with no GUID) and want to recover the live CGItem
+// for link-decoration purposes. Stomps the Lua stack.
+bool FindByItemID(void *L, int itemID, ByGUIDResult *out);
+
 // Parses the `"0xHHHHHHHHLLLLLLLL"` GUID string format
 // `C_Item.GetItemGUID` returns. Strict: requires exactly `0x` prefix
 // + 16 case-insensitive hex digits. Returns false (and leaves `*out`

src/item/QualityColor.h

@@ -0,0 +1,42 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License along with
+// ClassicAPI. If not, see <https://www.gnu.org/licenses/>.
+
+#pragma once
+
+#include "Offsets.h"
+
+#include <cstdint>
+
+namespace Item::QualityColor {
+
+// Returns the engine's `"|cffRRGGBB"` color-prefix string for the
+// given item quality. Reads directly from the engine table at
+// `Offsets::VAR_QUALITY_COLOR_TABLE` so we don't have to duplicate
+// the hex palette across modules. Mirrors the engine's own fallback
+// at `0x0052AD90`: quality > 6 returns white (index 1).
+inline const char *Prefix(int quality) {
+    auto *table = reinterpret_cast<const char *const *>(
+        Offsets::VAR_QUALITY_COLOR_TABLE);
+    if (quality < 0 || quality >= Offsets::QUALITY_COLOR_TABLE_SIZE)
+        return table[1]; // white fallback, matches engine
+    return table[quality];
+}
+
+// Returns just the 6-char hex (e.g. "9d9d9d"), pointing into the
+// engine string past the `|cff` prefix. Useful for callers that
+// build their own markup format and need the bare hex.
+inline const char *Hex(int quality) {
+    return Prefix(quality) + 4;
+}
+
+} // namespace Item::QualityColor

src/item/Swap.cpp

@@ -199,6 +199,38 @@ bool FromPaperdoll(const void *cgItem, int srcPaperdollSlot, int dstPaperdollSlo
                     dstPaperdollSlot);
 }
 
+bool ToBag(const void *cgItem, int srcPaperdollSlot, int dstBagID, int dstSlotInBag) {
+    if (srcPaperdollSlot < 1 || srcPaperdollSlot > 19)
+        return false;
+    if (cgItem == nullptr)
+        return false;
+
+    void *player = ResolvePlayer();
+    if (player == nullptr)
+        return false;
+    uint32_t playerLo = 0, playerHi = 0;
+    if (!ReadGuid(player, &playerLo, &playerHi))
+        return false;
+
+    uint32_t dstContainerLo = 0, dstContainerHi = 0, dstLinear = 0;
+    if (!EncodeBagSlot(dstBagID, dstSlotInBag,
+                       &dstContainerLo, &dstContainerHi, &dstLinear))
+        return false;
+
+    uint32_t itemLo = 0, itemHi = 0;
+    if (!ReadGuid(cgItem, &itemLo, &itemHi))
+        return false;
+
+    auto fn = reinterpret_cast<SwapFn_t>(Offsets::FUN_INVENTORY_SWAP);
+    fn(player,
+       itemLo, itemHi,
+       playerLo, playerHi,
+       static_cast<uint32_t>(srcPaperdollSlot - 1),
+       dstContainerLo, dstContainerHi, dstLinear,
+       0);
+    return true;
+}
+
 bool MoveCount(void *L, int srcBag, int srcSlot, int dstBag, int dstSlot, int count) {
     // Vanilla protocol writes count as a single byte. Clamp at 255;
     // anything larger would either truncate silently (255 sent) or

src/item/Swap.h

@@ -32,6 +32,12 @@ namespace Item::Swap {
 //   paperdoll slot `srcSlot` (1-based). Used for paperdoll-to-
 //   paperdoll swaps like rings 11/12, trinkets 13/14.
 //
+// - `ToBag(item, srcPaperdollSlot, dstBag, dstSlot)` — item currently
+//   in paperdoll slot, moving to a bag slot. The "unequip" direction
+//   `UseEquipmentSet` needs for slots the set wants empty. Uses the
+//   same atomic swap packet — server-side accept rules are identical
+//   (bagID 0..4, dst slot must be valid for that bag).
+//
 // All slot args are 1-based Lua-facing; helpers do the
 // linear-slot conversion. Returns `false` on bad args (slot out of
 // range, no player object, missing instance block on the item or
@@ -44,6 +50,8 @@ bool FromBag(const void *cgItem, int bagID, int slotInBag, int dstPaperdollSlot)
 
 bool FromPaperdoll(const void *cgItem, int srcPaperdollSlot, int dstPaperdollSlot);
 
+bool ToBag(const void *cgItem, int srcPaperdollSlot, int dstBagID, int dstSlotInBag);
+
 // General bag-to-bag swap — neither side is constrained to the
 // paperdoll. Same engine helper (`FUN_INVENTORY_SWAP`), which routes
 // to opcode 0x10D (same-container slot swap, e.g. backpack ↔ backpack)

src/item/Tooltip.cpp

@@ -17,6 +17,7 @@
 #include "item/ID.h"
 #include "item/Link.h"
 #include "item/Location.h"
+#include "item/QualityColor.h"
 
 #include <cstdint>
 #include <cstdio>
@@ -134,25 +135,6 @@ static int __fastcall Script_GameTooltipSetInventoryItemByID(void *L) {
     return fn(L);
 }
 
-// Modern `Enum.ItemQuality` color codes for the SetItemByID fallback
-// path (no CGItem → no engine link helper). For the CGItem-resolved
-// path we delegate to the engine's own builder, which uses the same
-// palette internally.
-static const char *QualityHex(int quality) {
-    static const char *const kHex[] = {
-        "9d9d9d", // POOR
-        "ffffff", // COMMON
-        "1eff00", // UNCOMMON
-        "0070dd", // RARE
-        "a335ee", // EPIC
-        "ff8000", // LEGENDARY
-        "e6cc80", // ARTIFACT (TBC+)
-        "00ccff", // HEIRLOOM (WotLK+)
-    };
-    if (quality < 0 || quality > 7)
-        return kHex[1];
-    return kHex[quality];
-}
 
 using GetItemRecord_t = const uint8_t *(__thiscall *)(void *cache, uint32_t itemID,
                                                       const uint64_t *guid, void *callback,
@@ -277,8 +259,9 @@ static int __fastcall Script_GameTooltipGetItem(void *L) {
 
     char link[256];
     std::snprintf(link, sizeof(link),
-                  "|cff%s|Hitem:%d:0:0:0:0:0:0:0|h[%s]|h|r",
-                  QualityHex(static_cast<int>(quality)), itemID, name);
+                  "%s|Hitem:%d:0:0:0:0:0:0:0|h[%s]|h|r",
+                  Item::QualityColor::Prefix(static_cast<int>(quality)),
+                  itemID, name);
 
     Game::Lua::PushString(L, name);
     Game::Lua::PushString(L, link);

src/macro/Icons.cpp

@@ -0,0 +1,311 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License along with
+// ClassicAPI. If not, see <https://www.gnu.org/licenses/>.
+
+// `GetMacroIcons(list)` / `GetMacroItemIcons(list)` /
+// `GetLooseMacroIcons(list)` / `GetLooseMacroItemIcons(list)` —
+// the modern 4-function append-to-table icon enumeration surface.
+// Each takes a Lua table as its only argument and appends icon
+// basenames; returns nothing (mutation is the contract).
+//
+// Modern WoW's `IconDataProviderMixin` (see
+// `AddOns/!!!ClassicAPI/Util/IconDataProvider.lua`) calls all four
+// in this order to assemble its `BaseIconFilenames` cache:
+//
+//     GetLooseMacroIcons(spellList)
+//     GetLooseMacroItemIcons(itemList)
+//     GetMacroIcons(spellList)
+//     GetMacroItemIcons(itemList)
+//
+// The split is `loose` (icons dropped onto disk under
+// `Interface\Icons\` by the user) vs MPQ (icons baked into the game's
+// MPQ archives), crossed with `Spell` (basenames starting with
+// `Ability_` / `Spell_`) vs `Item` (basenames starting with `INV_`).
+// Modern engines maintain four parallel arrays in their loader; we
+// replicate the same scheme by hooking vanilla's three scan
+// callbacks and tagging each captured filename by its callback
+// source and basename prefix.
+//
+// **Data source (vanilla 1.12 / Octo):**
+//
+// - `FUN_MACRO_ICON_CB_DISK` (`LAB_004f0220`) — engine's disk-scan
+//   per-file callback. Files the user has dropped loose into
+//   `Interface\Icons\`. Filename arg is the full
+//   `"Interface\Icons\<name>.blp"` path. Tagged as `loose`.
+// - `FUN_MACRO_ICON_CB_USER_MPQ` (`FUN_004f0350`) — user-mounted
+//   patch-MPQ callback. Already prefix-filtered to `Ability_*` /
+//   `Spell_*` by the engine. Tagged as `mpq`.
+// - `FUN_MACRO_ICON_CB_INSTALL_MPQ` (`LAB_004f04f0`) — install-MPQ
+//   callback. Accepts any `.blp`/`.tga` (no prefix filter in the
+//   engine), and is the only source that surfaces `INV_*` filenames
+//   in vanilla. Tagged as `mpq`.
+//
+// Each callback gets a hook that examines the filename, classifies
+// it by prefix (`INV_` → item, `Ability_`/`Spell_` → spell, else
+// ignore), and appends to the matching side array. Capture-time
+// dedup via per-array `unordered_set` ensures each unique basename
+// only appears once per source even though most files flow through
+// multiple callbacks. The arrays are sorted lazily on first Lua
+// read so the output order matches modern engines.
+//
+// Entry shape (all four functions): uppercase basename stripped of
+// the `Interface\Icons\` prefix and any `.blp`/`.tga` extension —
+// e.g. `"INV_SWORD_25"`, `"ABILITY_KICK"`. Callers concat the
+// prefix themselves before `texture:SetTexture(...)`.
+
+#include "Game.h"
+#include "Offsets.h"
+
+#include <algorithm>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <unordered_set>
+#include <vector>
+
+namespace Macro::Icons {
+
+namespace {
+
+using LoadIcons_t = void(__cdecl *)();
+
+void EnsureLoaded() {
+    if (*reinterpret_cast<const uint32_t *>(
+            static_cast<uintptr_t>(Offsets::VAR_MACRO_ICON_COUNT)) != 0)
+        return;
+    reinterpret_cast<LoadIcons_t>(Offsets::FUN_LOAD_MACRO_ICONS)();
+}
+
+constexpr int ICON_BUF_LEN = 128;
+
+// Last path-component of `s` (after the final `\` or `/`), or `s`
+// itself if no separator. NULL-safe.
+const char *Basename(const char *s) {
+    if (s == nullptr)
+        return nullptr;
+    const char *bn = s;
+    for (const char *p = s; *p; ++p) {
+        if (*p == '\\' || *p == '/')
+            bn = p + 1;
+    }
+    return bn;
+}
+
+// Case-insensitive prefix match. `prefix` must be uppercase ASCII.
+bool StartsWithCI(const char *s, const char *prefix) {
+    for (int i = 0; prefix[i] != '\0'; ++i) {
+        char c = s[i];
+        if (c >= 'a' && c <= 'z')
+            c = static_cast<char>(c - ('a' - 'A'));
+        if (c != prefix[i])
+            return false;
+    }
+    return true;
+}
+
+// Normalize an icon path for dedup: strip `Interface\Icons\` (or any
+// directory) prefix, strip extension at first `.`, uppercase ASCII.
+// `dst` must be `ICON_BUF_LEN` bytes. Result is null-terminated.
+void NormalizeIconKey(char *dst, const char *src) {
+    const char *bn = Basename(src);
+    if (bn == nullptr) {
+        dst[0] = '\0';
+        return;
+    }
+    int i = 0;
+    while (i + 1 < ICON_BUF_LEN && bn[i] != '\0' && bn[i] != '.') {
+        char c = bn[i];
+        if (c >= 'a' && c <= 'z')
+            c = static_cast<char>(c - ('a' - 'A'));
+        dst[i] = c;
+        ++i;
+    }
+    dst[i] = '\0';
+}
+
+// =============================================================
+// Four side arrays — (loose|mpq) × (spell|item). Each is a
+// dedup-on-insert set plus a parallel vector preserving insertion
+// order. We sort each vector once before the first Lua read so
+// `GetMacroIcons` etc. return alphabetical results matching modern
+// engines.
+// =============================================================
+
+enum Source { SRC_LOOSE = 0, SRC_MPQ = 1 };
+enum Category { CAT_SPELL = 0, CAT_ITEM = 1 };
+
+struct Bucket {
+    std::vector<std::string> vec;
+    std::unordered_set<std::string> set;
+};
+
+Bucket &BucketFor(Source src, Category cat) {
+    static Bucket buckets[2][2];
+    return buckets[src][cat];
+}
+
+void Capture(const char *raw, Source src) {
+    const char *bn = Basename(raw);
+    if (bn == nullptr || *bn == '\0')
+        return;
+    Category cat;
+    if (StartsWithCI(bn, "INV_"))
+        cat = CAT_ITEM;
+    else if (StartsWithCI(bn, "ABILITY_") || StartsWithCI(bn, "SPELL_"))
+        cat = CAT_SPELL;
+    else
+        return;
+    char key[ICON_BUF_LEN];
+    NormalizeIconKey(key, bn);
+    if (key[0] == '\0')
+        return;
+    Bucket &b = BucketFor(src, cat);
+    auto [it, inserted] = b.set.emplace(key);
+    if (inserted)
+        b.vec.emplace_back(*it);
+}
+
+// Sort all four buckets alphabetically. Called once before the first
+// Lua read so output is stable and matches modern engines' sorted
+// output. Idempotent — re-running re-sorts (cheap for already-sorted
+// vectors) but `EnsureSorted` short-circuits via the flag.
+bool g_sorted = false;
+void EnsureSorted() {
+    if (g_sorted)
+        return;
+    for (int s = 0; s < 2; ++s) {
+        for (int c = 0; c < 2; ++c) {
+            auto &v = BucketFor(static_cast<Source>(s),
+                                 static_cast<Category>(c)).vec;
+            std::sort(v.begin(), v.end());
+        }
+    }
+    g_sorted = true;
+}
+
+// =============================================================
+// Engine scan-callback hooks.
+// =============================================================
+
+// Disk-scan callback (`__fastcall(const char *fullPath)`). Path is
+// `"Interface\Icons\<NAME>"`-shaped — Basename() strips the prefix
+// before classification.
+using DiskCb_t = int (__fastcall *)(const char *path);
+DiskCb_t IconCbDisk_o = nullptr;
+int __fastcall IconCbDisk_h(const char *path) {
+    Capture(path, SRC_LOOSE);
+    return IconCbDisk_o(path);
+}
+
+// MPQ-scan callbacks (`__fastcall(MpqRecord *)`). Record layout:
+// `+0x04` = file flags (bit `0x10` = directory), `+0x08` = inline
+// null-terminated filename (no prefix, no extension stripped).
+using MpqCb_t = int (__fastcall *)(uint8_t *record);
+MpqCb_t IconCbUserMpq_o = nullptr;
+int __fastcall IconCbUserMpq_h(uint8_t *record) {
+    if (record != nullptr && (record[4] & 0x10) == 0)
+        Capture(reinterpret_cast<const char *>(record + 8), SRC_MPQ);
+    return IconCbUserMpq_o(record);
+}
+MpqCb_t IconCbInstallMpq_o = nullptr;
+int __fastcall IconCbInstallMpq_h(uint8_t *record) {
+    if (record != nullptr && (record[4] & 0x10) == 0)
+        Capture(reinterpret_cast<const char *>(record + 8), SRC_MPQ);
+    return IconCbInstallMpq_o(record);
+}
+
+const Game::HookAutoRegister _hookCbDisk{
+    Offsets::FUN_MACRO_ICON_CB_DISK,
+    reinterpret_cast<void *>(&IconCbDisk_h),
+    reinterpret_cast<void **>(&IconCbDisk_o)};
+const Game::HookAutoRegister _hookCbUserMpq{
+    Offsets::FUN_MACRO_ICON_CB_USER_MPQ,
+    reinterpret_cast<void *>(&IconCbUserMpq_h),
+    reinterpret_cast<void **>(&IconCbUserMpq_o)};
+const Game::HookAutoRegister _hookCbInstallMpq{
+    Offsets::FUN_MACRO_ICON_CB_INSTALL_MPQ,
+    reinterpret_cast<void *>(&IconCbInstallMpq_h),
+    reinterpret_cast<void **>(&IconCbInstallMpq_o)};
+
+// =============================================================
+// Lua surface — four global mutators.
+// =============================================================
+
+// Walks `list[1..]` to find the first nil slot — that's where we
+// start appending. Leaves the stack unchanged on return.
+int FindAppendIndex(void *L) {
+    int idx = 1;
+    while (true) {
+        Game::Lua::PushNumber(L, static_cast<double>(idx));
+        Game::Lua::RawGet(L, 1);
+        const int t = Game::Lua::Type(L, -1);
+        Game::Lua::SetTop(L, -2);
+        if (t == Game::Lua::TYPE_NIL)
+            return idx;
+        ++idx;
+    }
+}
+
+void AppendBucket(void *L, Source src, Category cat, const char *usage) {
+    if (Game::Lua::Type(L, 1) != Game::Lua::TYPE_TABLE) {
+        Game::Lua::Error(L, usage);
+        return;
+    }
+    EnsureLoaded();
+    EnsureSorted();
+    const auto &v = BucketFor(src, cat).vec;
+    if (v.empty())
+        return;
+    int idx = FindAppendIndex(L);
+    for (const auto &name : v) {
+        Game::Lua::PushNumber(L, static_cast<double>(idx++));
+        Game::Lua::PushString(L, name.c_str());
+        Game::Lua::RawSet(L, 1);
+    }
+}
+
+int __fastcall Script_GetMacroIcons(void *L) {
+    AppendBucket(L, SRC_MPQ, CAT_SPELL, "Usage: GetMacroIcons(table)");
+    return 0;
+}
+
+int __fastcall Script_GetMacroItemIcons(void *L) {
+    AppendBucket(L, SRC_MPQ, CAT_ITEM, "Usage: GetMacroItemIcons(table)");
+    return 0;
+}
+
+int __fastcall Script_GetLooseMacroIcons(void *L) {
+    AppendBucket(L, SRC_LOOSE, CAT_SPELL, "Usage: GetLooseMacroIcons(table)");
+    return 0;
+}
+
+int __fastcall Script_GetLooseMacroItemIcons(void *L) {
+    AppendBucket(L, SRC_LOOSE, CAT_ITEM,
+                 "Usage: GetLooseMacroItemIcons(table)");
+    return 0;
+}
+
+void RegisterLuaFunctions() {
+    Game::Lua::RegisterGlobalFunction("GetMacroIcons", &Script_GetMacroIcons);
+    Game::Lua::RegisterGlobalFunction("GetMacroItemIcons",
+                                       &Script_GetMacroItemIcons);
+    Game::Lua::RegisterGlobalFunction("GetLooseMacroIcons",
+                                       &Script_GetLooseMacroIcons);
+    Game::Lua::RegisterGlobalFunction("GetLooseMacroItemIcons",
+                                       &Script_GetLooseMacroItemIcons);
+}
+
+const Game::ModuleAutoRegister _autoreg{&RegisterLuaFunctions};
+
+} // namespace
+
+} // namespace Macro::Icons

src/security/Account.cpp

@@ -0,0 +1,164 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License along with
+// ClassicAPI. If not, see <https://www.gnu.org/licenses/>.
+
+// Glue-side bindings for the saved-credentials API:
+//
+//   SaveAccount(name, password)        -> bool
+//   DeleteAccount(name)                -> bool
+//   GetSavedAccounts()                 -> { "ACCT1", "ACCT2", ... }
+//   LoginWithSavedAccount(name)        -> bool   -- dispatched, plaintext
+//                                                   never crosses C↔Lua
+//                                                   boundary on the way out
+//
+// The first three are thin wrappers over `Security::CredStore`. The
+// fourth is the load-bearing one: it pulls the encrypted blob, calls
+// the engine's own `FUN_GLUE_LOGIN_ATTEMPT` (the function that
+// `Script_DefaultServerLogin` tail-calls into), then scrubs the
+// stack buffer. The engine itself zero-fills the password buffer
+// after consuming it (see Offsets::FUN_GLUE_LOGIN_ATTEMPT docs), so
+// the scrub here is belt-and-suspenders for any prefix bytes the
+// engine's strlen-based wipe might miss.
+//
+// Registered on the glue Lua state only — there's no use for these
+// outside the AccountLogin screen, and keeping them off the in-game
+// state means no addon can call `LoginWithSavedAccount` to trigger
+// an unexpected logout-and-login flow.
+
+#include "CredStore.h"
+#include "Game.h"
+#include "Offsets.h"
+
+#include <windows.h>
+
+#include <cstring>
+#include <vector>
+
+namespace Security::Account {
+
+namespace {
+
+const char *ArgString(void *L, int idx) {
+    if (!Game::Lua::IsString(L, idx))
+        return nullptr;
+    return Game::Lua::ToString(L, idx);
+}
+
+// Engine login entry. `__fastcall(ecx = account, edx = mutable
+// password buffer)`. The engine zero-fills the password buffer after
+// SRP consumes it.
+using LoginAttempt_t = void(__fastcall *)(const char *account, char *passwordMutable);
+// `reinterpret_cast` from integer to function-pointer isn't constant
+// in C++17, so the cast lives in the call site instead of a constexpr
+// const.
+inline void LoginAttempt(const char *account, char *passwordMutable) {
+    reinterpret_cast<LoginAttempt_t>(Offsets::FUN_GLUE_LOGIN_ATTEMPT)(
+        account, passwordMutable);
+}
+
+int __fastcall Script_SaveAccount(void *L) {
+    const char *name = ArgString(L, 1);
+    const char *password = ArgString(L, 2);
+    const bool ok =
+        name && *name && password && *password &&
+        Security::CredStore::Save(name, password);
+    Game::Lua::PushBool(L, ok);
+    return 1;
+}
+
+int __fastcall Script_DeleteAccount(void *L) {
+    const char *name = ArgString(L, 1);
+    const bool ok = name && *name && Security::CredStore::Delete(name);
+    Game::Lua::PushBool(L, ok);
+    return 1;
+}
+
+int __fastcall Script_GetSavedAccounts(void *L) {
+    auto accounts = Security::CredStore::List();
+    Game::Lua::SetTop(L, 0);
+    Game::Lua::NewTable(L);
+    int key = 1;
+    for (const auto &acct : accounts) {
+        // Push outer index → inner table { name=..., lastUsed=... }.
+        Game::Lua::PushNumber(L, static_cast<double>(key++));
+        Game::Lua::NewTable(L);
+        Game::Lua::SetFieldString(L, "name", acct.name.c_str());
+        Game::Lua::SetFieldNumber(L, "lastUsed",
+                                  static_cast<double>(acct.lastUsedUnix));
+        Game::Lua::SetTable(L, -3);
+    }
+    return 1;
+}
+
+int __fastcall Script_LoginWithSavedAccount(void *L) {
+    const char *name = ArgString(L, 1);
+    if (!name || !*name) {
+        Game::Lua::PushBool(L, false);
+        return 1;
+    }
+
+    std::vector<char> password;
+    if (!Security::CredStore::Load(name, password) || password.empty()) {
+        Game::Lua::PushBool(L, false);
+        return 1;
+    }
+
+    // Keep a copy of the plaintext on the stack — the engine's login
+    // path zeros the buffer it consumes (see Offsets::FUN_GLUE_LOGIN_ATTEMPT
+    // notes), but we need the plaintext for one more thing: re-saving
+    // the credential so Windows updates LastWritten. Without that,
+    // `lastUsed` in `GetSavedAccounts()` would only reflect the
+    // original `SaveAccount` time, not actual logins.
+    std::vector<char> copyForTouch(password.begin(), password.end());
+    copyForTouch.push_back('\0');
+
+    // CredStore::Load gives us a vector sized to the password length
+    // with a trailing nul one past the end (resize to len after writing
+    // len+1 bytes). The engine login function reads via strlen, so we
+    // need the nul terminator accessible — `data()[size()]` is valid
+    // on std::vector (the spec guarantees a writable element there
+    // since C++11). Engine will zero out the bytes up through strlen
+    // after SRP consumes them.
+    LoginAttempt(name, password.data());
+
+    // Refresh LastWritten by re-saving the credential. Done after
+    // engine consumes so a no-op call (e.g. glue guards not satisfied)
+    // doesn't update the timestamp on a login that didn't happen.
+    // ... actually, the engine no-ops silently, so we can't gate on
+    // success. We update unconditionally; in practice this only fires
+    // from the AccountLogin screen, which has the guards satisfied.
+    Security::CredStore::Save(name, copyForTouch.data());
+
+    // Belt-and-suspenders scrub. Engine already zeroed `password.size()`
+    // bytes, but we re-scrub the full vector capacity in case the
+    // engine's wipe assumed an exact strlen match. Also scrub the
+    // touch copy that lived through the engine call.
+    SecureZeroMemory(password.data(), password.size());
+    SecureZeroMemory(copyForTouch.data(), copyForTouch.size());
+
+    Game::Lua::PushBool(L, true);
+    return 1;
+}
+
+void RegisterGlueFunctions() {
+    Game::Lua::RegisterGlueFunction("SaveAccount", &Script_SaveAccount);
+    Game::Lua::RegisterGlueFunction("DeleteAccount", &Script_DeleteAccount);
+    Game::Lua::RegisterGlueFunction("GetSavedAccounts", &Script_GetSavedAccounts);
+    Game::Lua::RegisterGlueFunction("LoginWithSavedAccount",
+                                    &Script_LoginWithSavedAccount);
+}
+
+const Game::GlueModuleAutoRegister _autoreg{&RegisterGlueFunctions};
+
+} // namespace
+
+} // namespace Security::Account

src/security/CredStore.cpp

@@ -0,0 +1,238 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License along with
+// ClassicAPI. If not, see <https://www.gnu.org/licenses/>.
+
+#include "CredStore.h"
+
+#include "Offsets.h"
+
+#include <windows.h>
+#include <wincred.h>
+
+namespace Security::CredStore {
+
+namespace {
+
+constexpr const wchar_t kTargetPrefix[] = L"ClassicAPI/WoW/";
+constexpr size_t kTargetPrefixLen =
+    sizeof(kTargetPrefix) / sizeof(wchar_t) - 1;
+
+// Cred Manager target-name max is 32767 wchars; vanilla WoW account
+// names cap at 0x40 bytes (see VAR_GLUE_LOGIN_ATTEMPT prologue). We
+// allow generous bounds for the realm + account, leaving the rest of
+// the target-name budget unused.
+constexpr size_t kMaxRealmWChars = 256;
+constexpr size_t kMaxAccountWChars = 256;
+
+using GetRealmList_t = const char *(__fastcall *)(int forceRefresh);
+
+// Returns the current engine realmList CVar's value, or empty string
+// if unset. This is the realmlist address (e.g.
+// "logon.turtle-wow.org"), not the friendly display name — scoping
+// credentials on the address means two private servers with the same
+// display name still get distinct vault entries.
+std::string CurrentRealm() {
+    const char *r = reinterpret_cast<GetRealmList_t>(
+        Offsets::FUN_CVAR_REALM_LIST)(0);
+    if (!r || !*r) return {};
+    return r;
+}
+
+// Append a UTF-8 string `s` to `out` as wide chars. No-op (and false
+// return) on conversion error or empty input. `max` caps the wchar
+// count we'll append.
+bool AppendWide(std::wstring &out, const char *s, size_t max) {
+    if (!s || !*s) return false;
+    int needed = MultiByteToWideChar(CP_UTF8, 0, s, -1, nullptr, 0);
+    if (needed <= 1) return false;
+    if (static_cast<size_t>(needed) > max) return false;
+    size_t base = out.size();
+    out.resize(base + needed - 1);
+    MultiByteToWideChar(CP_UTF8, 0, s, -1, &out[base], needed);
+    return true;
+}
+
+// Builds the per-account target name:
+//     ClassicAPI/WoW/<realmName>/<accountName>
+//
+// Returns the bare prefix when the realm or account is missing —
+// callers use `result.size() > kTargetPrefixLen` to detect that and
+// abort.
+std::wstring MakeTargetName(const char *accountName) {
+    std::wstring out(kTargetPrefix, kTargetPrefixLen);
+    std::string realm = CurrentRealm();
+    if (realm.empty()) return out;
+    if (!AppendWide(out, realm.c_str(), kMaxRealmWChars)) {
+        out.resize(kTargetPrefixLen);
+        return out;
+    }
+    out.push_back(L'/');
+    if (!AppendWide(out, accountName, kMaxAccountWChars)) {
+        out.resize(kTargetPrefixLen);
+        return out;
+    }
+    return out;
+}
+
+// Builds the enumeration filter for the current realm:
+//     ClassicAPI/WoW/<realmName>/*
+//
+// Returns empty wstring if no realm is set (callers treat that as
+// "no entries to list").
+std::wstring MakeEnumFilter() {
+    std::wstring out(kTargetPrefix, kTargetPrefixLen);
+    std::string realm = CurrentRealm();
+    if (realm.empty()) return {};
+    if (!AppendWide(out, realm.c_str(), kMaxRealmWChars)) return {};
+    out.push_back(L'/');
+    out.push_back(L'*');
+    return out;
+}
+
+// Extracts the account-name suffix from a target-name during enum.
+// Returns empty string if the structural shape doesn't match — the
+// CredEnumerate filter should already restrict to our namespace, but
+// hostile or stale entries from a previous version of this code could
+// in theory land here.
+std::string ExtractAccount(const wchar_t *targetName) {
+    if (!targetName) return {};
+    if (wcsncmp(targetName, kTargetPrefix, kTargetPrefixLen) != 0) {
+        return {};
+    }
+    // After the prefix we expect `<realm>/<account>`. Skip past the
+    // realm by finding the next '/'.
+    const wchar_t *afterPrefix = targetName + kTargetPrefixLen;
+    const wchar_t *sep = wcschr(afterPrefix, L'/');
+    if (!sep || !sep[1]) return {};
+    const wchar_t *account = sep + 1;
+    int needed = WideCharToMultiByte(CP_UTF8, 0, account, -1,
+                                     nullptr, 0, nullptr, nullptr);
+    if (needed <= 1) return {};
+    std::string out(static_cast<size_t>(needed - 1), '\0');
+    WideCharToMultiByte(CP_UTF8, 0, account, -1, &out[0], needed,
+                        nullptr, nullptr);
+    return out;
+}
+
+} // namespace
+
+bool Save(const char *accountName, const char *password) {
+    if (!accountName || !*accountName) return false;
+    if (!password || !*password) return false;
+
+    std::wstring target = MakeTargetName(accountName);
+    if (target.size() == kTargetPrefixLen) return false; // empty account
+
+    size_t pwLen = strlen(password);
+    if (pwLen == 0 || pwLen > CRED_MAX_CREDENTIAL_BLOB_SIZE) return false;
+
+    CREDENTIALW cred{};
+    cred.Type = CRED_TYPE_GENERIC;
+    cred.TargetName = const_cast<LPWSTR>(target.c_str());
+    cred.CredentialBlobSize = static_cast<DWORD>(pwLen);
+    cred.CredentialBlob =
+        reinterpret_cast<LPBYTE>(const_cast<char *>(password));
+    cred.Persist = CRED_PERSIST_LOCAL_MACHINE;
+    // UserName is required by some advapi32 builds to be non-NULL even
+    // for generic credentials; reuse the target so the entry is
+    // visually labeled correctly in `control /name
+    // Microsoft.CredentialManager` even though we don't read it back.
+    cred.UserName = const_cast<LPWSTR>(target.c_str());
+
+    return CredWriteW(&cred, 0) != FALSE;
+}
+
+bool Delete(const char *accountName) {
+    if (!accountName || !*accountName) return false;
+    std::wstring target = MakeTargetName(accountName);
+    if (target.size() == kTargetPrefixLen) return false;
+    return CredDeleteW(target.c_str(), CRED_TYPE_GENERIC, 0) != FALSE;
+}
+
+namespace {
+
+// FILETIME (100-ns intervals since 1601-01-01) → Unix epoch seconds.
+// Returns 0 for zero/invalid input.
+uint64_t FileTimeToUnix(FILETIME ft) {
+    const uint64_t v = (static_cast<uint64_t>(ft.dwHighDateTime) << 32) |
+                       ft.dwLowDateTime;
+    if (v == 0) return 0;
+    // 11644473600 seconds between 1601-01-01 and 1970-01-01, expressed
+    // in 100-ns ticks.
+    constexpr uint64_t kEpochDiff100ns = 116444736000000000ULL;
+    if (v < kEpochDiff100ns) return 0;
+    return (v - kEpochDiff100ns) / 10000000ULL;
+}
+
+} // namespace
+
+std::vector<Entry> List() {
+    std::vector<Entry> result;
+
+    // Enumeration filter is scoped to the current realm, so entries
+    // for other private servers are invisible. The wildcard pattern
+    // `ClassicAPI/WoW/<realm>/*` matches every account under it.
+    std::wstring filter = MakeEnumFilter();
+    if (filter.empty()) return result;
+
+    DWORD count = 0;
+    PCREDENTIALW *entries = nullptr;
+    if (!CredEnumerateW(filter.c_str(), 0, &count, &entries)) {
+        // ERROR_NOT_FOUND is the expected "no entries yet" outcome.
+        return result;
+    }
+
+    result.reserve(count);
+    for (DWORD i = 0; i < count; ++i) {
+        if (!entries[i] || !entries[i]->TargetName) continue;
+        std::string account = ExtractAccount(entries[i]->TargetName);
+        if (account.empty()) continue;
+        result.push_back({std::move(account),
+                          FileTimeToUnix(entries[i]->LastWritten)});
+    }
+    CredFree(entries);
+    return result;
+}
+
+bool Load(const char *accountName, std::vector<char> &outPassword) {
+    outPassword.clear();
+    if (!accountName || !*accountName) return false;
+
+    std::wstring target = MakeTargetName(accountName);
+    if (target.size() == kTargetPrefixLen) return false;
+
+    PCREDENTIALW cred = nullptr;
+    if (!CredReadW(target.c_str(), CRED_TYPE_GENERIC, 0, &cred)) {
+        return false;
+    }
+    if (!cred || !cred->CredentialBlob || cred->CredentialBlobSize == 0) {
+        if (cred) CredFree(cred);
+        return false;
+    }
+
+    const DWORD len = cred->CredentialBlobSize;
+    outPassword.resize(static_cast<size_t>(len) + 1, '\0');
+    memcpy(outPassword.data(), cred->CredentialBlob, len);
+    outPassword[len] = '\0';
+    // size() should reflect the password length, not the trailing nul.
+    outPassword.resize(len);
+
+    // Zero the OS-returned buffer before freeing — CredFree itself
+    // doesn't scrub. Safe even though the blob is a const-ish field,
+    // because we own it until CredFree returns and the API never
+    // reuses the allocation.
+    SecureZeroMemory(cred->CredentialBlob, len);
+    CredFree(cred);
+    return true;
+}
+
+} // namespace Security::CredStore

src/security/CredStore.h

@@ -0,0 +1,74 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License along with
+// ClassicAPI. If not, see <https://www.gnu.org/licenses/>.
+
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+// Thin C++ wrapper over the Win32 Credential Manager API (advapi32.dll:
+// CredWriteW / CredReadW / CredEnumerateW / CredDeleteW). Entries are
+// stored under per-user, DPAPI-encrypted blobs that other Windows users
+// on the same machine cannot read; any process running as the current
+// user can decrypt them (DPAPI is per-user, not per-process), so this
+// is "secure at rest", not "secure against same-user attackers".
+//
+// Every operation is scoped by the current engine `realmList` CVar
+// (the realmlist address from `realmlist.wtf` — e.g.
+// "logon.turtle-wow.org", not the friendly display name). The same
+// account name on two different private servers therefore gets two
+// distinct vault entries:
+//     ClassicAPI/WoW/logon.turtle-wow.org/MYACCT
+//     ClassicAPI/WoW/logon.other-server.com/MYACCT
+// Users can inspect/wipe entries via
+// `control /name Microsoft.CredentialManager` → Generic Credentials.
+//
+// When no realmList is set, every operation returns false / empty —
+// there's no meaningful key to scope under.
+
+namespace Security::CredStore {
+
+// Save (or overwrite) the password for `accountName` under the current
+// engine realm. Returns false if no realm is set, the account name is
+// empty, the password is empty, or the OS rejects the write.
+bool Save(const char *accountName, const char *password);
+
+// Delete the saved entry for `accountName` under the current engine
+// realm. Returns true if a matching entry existed and was deleted.
+bool Delete(const char *accountName);
+
+// One entry returned by `List()` — the account name plus the
+// Windows-tracked `LastWritten` timestamp converted to Unix epoch
+// seconds. The engine refreshes `LastWritten` on every `CredWriteW`,
+// so `LoginWithSavedAccount` re-saves the credential after use to
+// keep the timestamp current ("last written" == "last used").
+struct Entry {
+    std::string name;
+    uint64_t lastUsedUnix;
+};
+
+// Enumerate every saved account for the current engine realm. Empty
+// list if no realm is set or no entries exist.
+std::vector<Entry> List();
+
+// Load the password for `accountName` under the current engine realm
+// into `outPassword`. The output is nul-terminated and the vector's
+// `size()` reflects the password length (not including the trailing
+// nul). Returns false if no realm is set or no such entry exists. The
+// caller should `SecureZeroMemory(outPassword.data(), outPassword.size())`
+// after use.
+bool Load(const char *accountName, std::vector<char> &outPassword);
+
+} // namespace Security::CredStore