Recover dropped auras in C_UnitAuras; evict on removal

The 1.12 engine drops a unit's UNIT_FIELD_AURA slots when it loses sync with
the unit (rogue stealth, party range fluctuation) even though the auras are
still active server-side, so C_UnitAuras.GetAuraDataByIndex /
GetBuffDataByIndex returned nil for auras that are still up.

Fall back to the Aura::Source cache (caster/timing captured from
SMSG_SPELL_GO at cast time, which survives descriptor clears) when the
descriptor has no slot:

- Aura::Source: entries gain a helpful/harmful kind, recorded from the
  descriptor slot at application time (OnAuraAdded/OnAuraStacksChanged);
  SpellGo-only entries stay unknown and are excluded. New Enumerate() returns
  non-expired entries of a given kind for a unit.
- Aura::Data: a shared BuildTable feeds both the descriptor Push and a new
  cache-fed path; PushNthCacheFallback / AppendCacheFallbacks append cache
  entries after the descriptor ones, deduped against populated slots.
- Aura::Api: the index path and GetUnitAuras consult the fallback.

To keep the fallback from resurrecting auras that are genuinely gone
(replaced by a higher rank, dispelled, fell off early), co-hook OnAuraRemoved
(FUN_00612320) and evict the cache entry. A rogue stealthing does NOT route
through OnAuraRemoved (object-visibility drop, not per-aura removal), so
eviction and stealth-recovery coexist: real removals evict, visibility drops
don't.

Add FUN_ON_AURA_REMOVED offset.
Fixes #5

README.md

@@ -56,7 +56,7 @@ Full per-function reference: **[docs/API.md](docs/API.md)**.
 | [Table](docs/API.md#table) | `table.wipe` |
 | [Talent](docs/API.md#talent) | `GetTalentIDByIndex`, `GetTalentSpellID` |
 | [Time](docs/API.md#time) | `C_DateAndTime.AdjustTimeByDays`, `C_DateAndTime.AdjustTimeByMinutes`, `C_DateAndTime.CompareCalendarTime`, `C_DateAndTime.GetCalendarTimeFromEpoch`, `C_DateAndTime.GetCurrentCalendarTime`, `C_DateAndTime.GetSecondsUntilDailyReset`, `C_DateAndTime.GetServerTimeLocal`, `C_Timer.After`, `C_Timer.NewTicker`, `C_Timer.NewTimer`, `GetServerTime` |
-| [UIColor](docs/API.md#uicolor) | `C_UIColor.GetColors` (backports `GlobalColor.dbc`; companion addon wraps each row with `ColorMixin` and assigns `_G[baseTag]` + `_G[baseTag.."_CODE"]`) |
+| [UIColor](docs/API.md#uicolor) | `C_UIColor.GetColors` |
 | [Unit](docs/API.md#unit) | `GetUnitSpeed`, `UnitClassBase`, `UnitGUID`, `UnitInRange`, `UnitIsAFK`, `UnitIsDND`, `UnitIsFeignDeath`, `UnitIsInMyGuild`, `UnitIsPossessed`, `UnitPower`, `UnitPowerMax`, `UnitPowerType`, `UnitRaceBase`, `UnitStandState`, `UnitSubName`, `UnitTokenFromGUID` |
 | [UnitAuras](docs/API.md#unitauras) | `C_UnitAuras.GetAuraDataByIndex`, `C_UnitAuras.GetAuraDataBySpellName`, `C_UnitAuras.GetAuraDispelTypeColor`, `C_UnitAuras.GetBuffDataByIndex`, `C_UnitAuras.GetDebuffDataByIndex`, `C_UnitAuras.GetPlayerAuraBySpellID`, `C_UnitAuras.GetUnitAuraBySpellID`, `C_UnitAuras.GetUnitAuras` |
 
@@ -166,14 +166,19 @@ See [Focus / Bindings](docs/API.md#bindings-focustarget--targetfocus) for the im
 
 ## Installation
 
-Use [VanillaFixes](https://github.com/hannesmann/vanillafixes) to load the
-DLL.
+Download the prebuilt `ClassicAPI.dll` from the
+[latest release](https://github.com/brues-code/ClassicAPI/releases/latest)
+(or [build it yourself](#building)). It's loaded with
+[VanillaFixes](https://github.com/hannesmann/vanillafixes):
 
 1. Install VanillaFixes if it isn't already.
 2. Copy `ClassicAPI.dll` into your game directory.
 3. Add `ClassicAPI.dll` to `dlls.txt`.
 4. Launch the game with `VanillaFixes.exe`.
 
+The bundled `!!!ClassicAPI` addon ships *inside* the DLL — no separate
+addon download or install step needed.
+
 ## Bundled addon: !!!ClassicAPI
 
 The Lua-side companion library lives in

docs/API.md

@@ -7951,15 +7951,27 @@ C_Spell.UnitCastingInfo("player")
 `startTimeMs`/`endTimeMs` share `GetTime()`'s epoch (`GetTime()*1000`),
 so progress is `(GetTime()*1000 - startTimeMs) / (endTimeMs - startTimeMs)`.
 
-> **Local player only.** Vanilla 1.12 stores no cast times anywhere
-> readable (the cast bar is Lua-driven off `SPELLCAST_START`), and it
-> tracks regular casts for nobody but you — other units' casts exist
-> only as transient animation visuals. So `C_Spell.UnitCastingInfo(otherUnit)`
-> returns `nil`. We self-track the player's cast on a per-frame tick
-> (`VAR_CURRENT_CAST_SPELL`), stamping `startTimeMs = now` and
-> `endTimeMs = now + base cast time`. Instant casts return `nil` (no
-> cast bar). See [`C_Spell.UnitChannelInfo`](#c_spellunitchannelinfounit--c_spellchannelinfo)
-> for channels, which *are* visible on other units.
+> **Works for any unit.** Vanilla 1.12 stores no cast times on the
+> CGUnit (the cast bar is Lua-driven off `SPELLCAST_START`), so we
+> source them two ways: the **local player** is self-tracked on a
+> per-frame tick (`VAR_CURRENT_CAST_SPELL`, stamping `startTimeMs = now`,
+> `endTimeMs = now + effective cast time`); **other units** come from a
+> co-hook on `SMSG_SPELL_START` (`Spell::Cast`), the one packet carrying
+> another unit's cast with a server-authoritative cast time, cached per
+> caster GUID. So `C_Spell.UnitCastingInfo("target")` now backs
+> enemy/target/focus/nameplate cast bars. Instant casts return `nil` (no
+> cast bar). Best-effort for remote units, in three ways: only casts that
+> began while the unit was in range are seen; since 1.12 has no per-unit
+> interrupt packet to hook, an *interrupted* remote cast lingers until its
+> computed `endTimeMs` rather than clearing instantly; and the remote
+> `startTimeMs`/`endTimeMs` are shifted later by roughly your latency.
+> (1.12's `SMSG_SPELL_START` carries only a single `castTime`, so we stamp
+> `start = now, end = now + castTime` on receipt. 3.3.5+ avoids the skew
+> because its packet carries *both* total and remaining cast time and
+> back-dates `start = now − elapsed`; the 1.12 packet has no field to
+> recover `elapsed` from.) The **local player is unaffected** by all of
+> this — its cast is detected client-side at the moment of cast, no packet
+> involved.
 >
 > `isTradeskill` is real — the spell's `SPELL_ATTR_TRADESPELL` flag, so
 > profession recipe casts (smelting, cooking/enchanting recipes, …)
@@ -7991,13 +8003,15 @@ C_Spell.ChannelInfo()
 --  907894314, 907902314, false, false, 10187
 ```
 
-Unlike casts, the channeled spellID **is** broadcast for every unit
-(`UNIT_FIELD_CHANNEL_SPELL`), so `C_Spell.UnitChannelInfo("target")`
-works on other units — returning `name`/`displayName`/`textureID`/`spellID`
-with **`nil` start/end times** (we only track the local player's channel
-start). For the player, the full timing is present
-(`endTimeMs - startTimeMs` = channel duration). Same placeholder fields
-as `C_Spell.UnitCastingInfo`.
+The channeled spellID **is** broadcast for every unit
+(`UNIT_FIELD_CHANNEL_SPELL`), so `C_Spell.UnitChannelInfo("target")` works
+on other units. Timing now comes from the same `SMSG_SPELL_START` co-hook
+as casts: when we observed the channel begin, the remote unit returns full
+**start/end times** (validated against the live `UNIT_FIELD_CHANNEL_SPELL`
+so a stale cache entry never applies to a different/ended channel);
+otherwise it falls back to `name`/`displayName`/`textureID`/`spellID` with
+**`nil` times**. The player path is unchanged (full timing). Same
+placeholder fields as `C_Spell.UnitCastingInfo`.
 
 ## SpellBook
 
@@ -9270,21 +9284,79 @@ selects.
 | `dispelName` | string | `"Magic"` / `"Curse"` / `"Disease"` / `"Poison"` (from `SpellDispelType.dbc`), or `""` if non-dispellable |
 | `isHelpful` | boolean | true for slot < 32 |
 | `isHarmful` | boolean | true for slot >= 32 |
-| `duration` | number | base applied duration in seconds, looked up via `Spell.dbc → SpellDuration.dbc` with level scaling. Talent / glyph duration extensions (Improved PW:F, etc.) aren't reflected here — those are baked into `expirationTime` on the caster's side. Returns 0 for spells flagged "no duration" (passives, paladin auras, infinite buffs) |
-| `expirationTime` | number | populated for `unit == "player"` (read from the engine's player-buff table at `0x00BC6040`; same data `GetPlayerBuffTimeLeft` returns). Always `0` for all other units — vanilla server only broadcasts cast/duration for the local player's own auras. `expirationTime - GetTime()` gives the true remaining time (including any talent extensions) |
+| `duration` | number | applied duration in seconds. When the aura's cast was observed (in the `Aura::Source` cache), this is the caster-modified duration — talent/glyph extensions like Improved Shadow Word: Pain included — so it stays consistent with `expirationTime` (`remaining ≤ duration`). On a cache miss it falls back to the base `Spell.dbc → SpellDuration.dbc` value with level scaling. Returns 0 for spells flagged "no duration" (passives, paladin auras, infinite buffs) |
+| `expirationTime` | number | for `unit == "player"`, read from the engine's player-buff table at `0x00BC6040` (same data `GetPlayerBuffTimeLeft` returns). For any other unit, taken from the `Aura::Source` cache (cast time + duration captured from `SMSG_SPELL_GO`; see below). `0` when neither source has it. `expirationTime - GetTime()` gives the true remaining time |
+| `sourceUnit` | string | unit token of the caster (`"player"`, `"raid7"`, `"nameplate1"`, …), resolved from the `Aura::Source` cache. `nil` if the cast wasn't observed or the caster maps to no current token |
+| `sourceGUID` | string | caster's `"0x…"` GUID string from the same cache. **ClassicAPI extension — not a retail `AuraData` field.** Set whenever a caster is known, including when `sourceUnit` is `nil` (caster left token range). Stable for the session, unlike the volatile nameplate token; doubles as a unit token under SuperWoW. `nil` on a cache miss |
 | `charges` / `maxCharges` | number | always `0` — vanilla has stacks, not charges |
 | `timeMod` | number | always `1` — vanilla has no haste-affected auras |
 | `isStealable`, `isBossAura`, `isFromPlayerOrPlayerPet`, `isNameplateOnly`, `nameplateShowAll`, `nameplateShowPersonal`, `canApplyAura`, `shouldConsolidate`, `isRaid` | boolean | always `false` — modern UI concepts vanilla doesn't have |
-| `sourceUnit`, `auraInstanceID`, `points` | (absent) | omitted from the table — Lua read yields nil, matching modern semantics for "field doesn't apply" |
+| `auraInstanceID`, `points` | (absent) | omitted from the table — Lua read yields nil, matching modern semantics for "field doesn't apply" |
 
 ### Filter parsing
 
 The optional `filter` string is a pipe-separated set of upper-case
 tokens, matching modern syntax (`"HELPFUL"`, `"HARMFUL"`,
-`"HELPFUL|PLAYER"`, etc.). Only `HELPFUL` (default) and `HARMFUL`
-are honored on vanilla; other tokens (`PLAYER` / `RAID` /
-`CANCELABLE` / `INCLUDE_NAME_PLATE_ONLY`) are accepted but no-op —
-they'd need source-GUID tracking or systems vanilla doesn't have.
+`"HELPFUL|PLAYER"`, etc.). Honored on vanilla:
+
+- **`HELPFUL`** (default) / **`HARMFUL`** — pick the buff or debuff range.
+  In `GetUnitAuras`, supplying neither returns both ranges.
+- **`PLAYER`** — restrict to auras the local player cast, via the
+  `Aura::Source` caster cache (`sourceGUID == ` player GUID). Combines with
+  the range tokens (`"HARMFUL|PLAYER"` = your debuffs only). Because the
+  caster is best-effort, an aura whose cast we didn't observe is treated as
+  not-player-cast and excluded — so `PLAYER` can under-report auras that
+  predate login.
+
+Other tokens (`RAID` / `CANCELABLE` / `INCLUDE_NAME_PLATE_ONLY`) are
+accepted but no-op — they need engine systems (raid-dispel relevance,
+nameplate visibility flags) vanilla doesn't have.
+
+### Caster & timing (`Aura::Source`)
+
+`sourceUnit`, `sourceGUID`, and non-player `expirationTime` come from a
+client-side cache that vanilla itself can't provide: the unit aura array
+stores only spell IDs — never the caster, and no cast/expiration timing for
+anyone but the local player. `Aura::Source` fills the gap by co-hooking
+three engine functions and caching `(targetGuid, spellId) → { casterGuid,
+expirationMs, durationMs }`; `Push` keys into it by the unit's GUID + the
+aura's spell ID.
+
+- **`SpellGo`** (`FUN_SPELL_GO`, `0x006E7A70`) — the cast packet, the only
+  place the client sees an aura's **caster** + a server-authoritative,
+  caster-modified duration. Fills `sourceUnit`/`sourceGUID` + timing for
+  directly-cast auras.
+- **`OnAuraAdded`** (`0x006123F0`) — fires when any aura first occupies a
+  slot, including proc/triggered auras that emit no `SMSG_SPELL_GO` (Shadow
+  Weaving etc.). Stamps `expirationMs = now + base duration` (no caster).
+- **`OnAuraStacksChanged`** (`0x00612450`) — fires when an existing aura's
+  stack count changes; re-stamps expiration so a climbing stacking debuff
+  (e.g. Shadow Weaving 1→5) refreshes.
+
+Application hooks never overwrite an entry `SpellGo` already owns, so a
+directly-cast aura keeps its talented timing + caster regardless of hook
+order.
+
+Implications:
+
+- **Best-effort.** Only auras observed *after* login carry data; auras
+  already up when you logged in leave the defaults (`sourceUnit`/`sourceGUID`
+  nil, non-player `expirationTime` 0).
+- **Max-stack refresh is a blind spot.** When a stacking debuff is refreshed
+  at *max* stacks (e.g. Shadow Weaving 5→5), no client-visible aura field
+  changes (spellID, stacks, flags, level all identical), so the server sends
+  no UpdateField and the engine fires no callback — there is no packet to
+  hook (verified: the stack-change dispatcher `FUN_00604ea0` calls
+  `OnAuraStacksChanged` unconditionally, so its silence proves nothing
+  arrived). The countdown therefore runs to 0 and the entry evicts; once
+  evicted, `expirationTime` falls back to 0 (unknown) while the aura is still
+  shown. Climbing stacks and single-stack refreshes (re-cast → fresh
+  `SpellGo`) are unaffected.
+- **No nampower dependency.** We parse the engine functions ourselves;
+  nampower (which hooks the same three) need not be loaded — when it is, we
+  co-hook the sites.
+- Entries are evicted once their timed aura elapses, so the cache stays
+  bounded; infinite-duration auras persist until overwritten under load.
 
 ### `C_UnitAuras.GetAuraDataByIndex(unit, index [, filter])`
 

src/Offsets.h

@@ -682,6 +682,69 @@ enum Offsets {
     OFF_SPELLDURATION_PER_LEVEL_MS = 0x08,
     OFF_SPELLDURATION_MAX_MS = 0x0C,
 
+    // `SMSG_SPELL_GO` inner handler — `void __fastcall(uint64_t *itemGUID,
+    // uint64_t *casterGUID, uint32_t spellId, CDataStore *packet)`. The
+    // engine has already decoded item/caster/spell into args; the packet
+    // read cursor sits at the post-header body (castFlags, hit/missed
+    // target lists, target mask). This is the ONLY place the client sees
+    // an aura's *caster* — the unit aura array stores spell IDs but never
+    // who applied them. `Aura::Source` co-hooks this (alongside nampower,
+    // which detours the same function) to cache `(targetGuid, spellId) →
+    // casterGuid` for `C_UnitAuras` sourceUnit + non-player expiration.
+    // Packet layout mirrored from nampower's SpellGoHook (verified on the
+    // same Octo/Turtle 1.12.1 client). Per-cast frequency, not per-frame.
+    FUN_SPELL_GO = 0x006E7A70,
+
+    // SMSG packet handler that processes `SMSG_SPELL_START` (opcode
+    // `0x131`) among others — `int __fastcall(uint32_t unk, uint32_t
+    // opCode, uint32_t unk2, CDataStore *packet)`. For `0x131` the body is
+    // `itemGuid(packed), casterGuid(packed), spellId(u32), castFlags(u16),
+    // castTime(u32), targetMask, …`. This is the only place the client sees
+    // *another* unit's cast with a server-authoritative cast time, so
+    // `Spell::Cast` co-hooks it (gated on `opCode == 0x131`) to back
+    // remote-unit `UnitCastingInfo` / `UnitChannelInfo`. Mirrored from
+    // nampower's SpellStartHandlerHook.
+    FUN_SPELL_START_HANDLER = 0x006E7640,
+
+    // `SMSG_SPELL_DELAYED` handler — `int __stdcall(uint32_t *opCode,
+    // CDataStore *packet)`. Body: `guid(u64), delayMs(u32)`. The server
+    // only sends this to the affected caster, so in practice it's always
+    // the local player's cast pushback (taking damage mid-cast). `Spell::
+    // Cast` co-hooks it to extend the tracked cast's end time so the bar
+    // reflects pushback. Mirrored from nampower's SpellDelayedHook.
+    FUN_SPELL_DELAYED = 0x006E74F0,
+
+    // `CGUnit_C::OnAuraAdded` — `__thiscall void(CGUnit *unit, uint32_t
+    // slot, uint32_t spellId)` (i.e. `__fastcall(unit /*ecx*/, edx_unused,
+    // slot, spellId)`). Fires for EVERY aura that lands on a tracked unit,
+    // including proc/triggered auras that never produce an `SMSG_SPELL_GO`
+    // (Shadow Weaving, etc.). `Aura::Source` co-hooks it to stamp
+    // expiration for those — it carries no caster, so it fills timing only
+    // and never overwrites an entry `SpellGo` already owns. Per-aura-change
+    // frequency. nampower hooks the same function (its BUFF/DEBUFF events).
+    FUN_ON_AURA_ADDED = 0x006123F0,
+
+    // `CGUnit_C::OnAuraStacksChanged` — `__thiscall void(CGUnit *unit, int
+    // slot, uint8_t stackCount)` (`__fastcall(unit, edx_unused, slot,
+    // stackCount)`). Fires when an existing aura's stack count changes
+    // without a fresh add — e.g. Shadow Weaving climbing 2→3. The slot's
+    // spellID is read from the unit aura array (`OnAuraAdded` gets it as an
+    // arg; here only the slot is given). `Aura::Source` co-hooks it to
+    // re-stamp expiration so stacking-DoT refreshes are picked up.
+    FUN_ON_AURA_STACKS_CHANGED = 0x00612450,
+
+    // `CGUnit_C::OnAuraRemoved` — same ABI as `OnAuraAdded`
+    // (`__fastcall(unit /*ecx*/, edx_unused, slot, spellId)`; the disassembly
+    // of the diff dispatcher `FUN_00604d00` at the call site `0x00604dc4`
+    // shows `ECX = unit`, stack `[slot, spellId]`). The sibling of
+    // `OnAuraAdded`: `FUN_00604d00` fires this when a descriptor aura slot
+    // goes from occupied to empty — a genuine removal (fell off, dispelled,
+    // or replaced by a higher rank, which fires Removed(old)+Added(new)).
+    // `Aura::Source` co-hooks it to EVICT the cached entry so the
+    // `GetAuraDataByIndex` fallback can't resurrect a superseded/dispelled
+    // aura that's still inside its computed duration window.
+    FUN_ON_AURA_REMOVED = 0x00612320,
+
     // CGPlayer-side sub-struct, allocated for any player-controlled
     // unit (local self, target, party, raid, inspect targets — all of
     // them). Holds player-specific data that's *not* in the broadcast
@@ -2322,6 +2385,18 @@ enum Offsets {
     // `FUN_006E3D10`. Non-zero means "the cast bar is showing this
     // spell"; cleared to 0 when the cast finishes or is cancelled.
     VAR_CURRENT_CAST_SPELL = 0x00CECA88,
+    // The cast-start state writer — `__fastcall(int spellID, int
+    // targetState)`. Sets `VAR_CURRENT_CAST_SPELL` (pushing any current
+    // spell into `VAR_QUEUED_CAST_SPELL`; `spellID == 0` restores the queued
+    // one). `Spell::Cast` co-hooks it for lag-free, client-side detection of
+    // NORMAL player casts (stamps from the spellID arg before the original).
+    // It does NOT fire for a chained same-spell recast: the caller
+    // `Spell_C_CastSpell` (`0x006E4B60`) short-circuits at `spellID ==
+    // VAR_CURRENT_CAST_SPELL` *before* reaching here, so those never run the
+    // client cast path — they're caught by the `SMSG_SPELL_START` backstop
+    // instead. nampower hooks the higher Spell_C_CastSpell, not this inner
+    // writer, so contention is low.
+    FUN_CAST_START_SET = 0x006E4AD0,
     // Previous / queued cast — holds the spellID that was active
     // before the latest one superseded it (mid-GCD queueing in
     // vanilla). When the current cast ends, `FUN_006E4AD0(0, ...)`

src/aura/Api.cpp

@@ -60,6 +60,13 @@ Data::Filter ParseFilter(const char *filter) {
     return Data::Filter::Helpful;
 }
 
+// The `PLAYER` filter token restricts results to auras the local player
+// cast. No other modern token contains the substring "PLAYER", so a plain
+// substring test is safe.
+bool HasPlayerFilter(const char *filter) {
+    return filter != nullptr && strstr(filter, "PLAYER") != nullptr;
+}
+
 const char *ArgUnit(void *L, int idx) {
     if (!Game::Lua::IsString(L, idx))
         return nullptr;
@@ -82,14 +89,19 @@ const char *ArgOptString(void *L, int idx) {
 // or nil if no such aura. Used by `GetAuraDataByIndex` and the
 // filter-locked aliases.
 int PushAuraByIndex(void *L, const char *unitToken, int index,
-                    Data::Filter filter) {
+                    Data::Filter filter, bool playerOnly = false) {
     const uint8_t *unit = ResolveUnit(unitToken);
-    const int slot = Data::FindNthSlot(unit, index, filter);
-    if (slot < 0) {
-        Game::Lua::PushNil(L);
+    const int slot = Data::FindNthSlot(unit, index, filter, playerOnly);
+    if (slot >= 0) {
+        Data::Push(L, unit, slot);
         return 1;
     }
-    Data::Push(L, unit, slot);
+    // Descriptor exhausted — an aura the engine dropped from the slot array
+    // (rogue stealth, party range fluctuation) may still be live in the
+    // Aura::Source cache. Surface it after the descriptor entries.
+    if (Data::PushNthCacheFallback(L, unit, index, filter, playerOnly))
+        return 1;
+    Game::Lua::PushNil(L);
     return 1;
 }
 
@@ -101,7 +113,8 @@ int __fastcall Script_GetAuraDataByIndex(void *L) {
         Game::Lua::PushNil(L);
         return 1;
     }
-    return PushAuraByIndex(L, unit, index, ParseFilter(filterStr));
+    return PushAuraByIndex(L, unit, index, ParseFilter(filterStr),
+                           HasPlayerFilter(filterStr));
 }
 
 int __fastcall Script_GetBuffDataByIndex(void *L) {
@@ -139,7 +152,8 @@ int __fastcall Script_GetUnitAuraBySpellID(void *L) {
         f = ParseFilter(filterStr);
         fp = &f;
     }
-    const int slot = Data::FindSlotBySpellID(unit, static_cast<uint32_t>(spellID), fp);
+    const int slot = Data::FindSlotBySpellID(unit, static_cast<uint32_t>(spellID),
+                                             fp, HasPlayerFilter(filterStr));
     if (slot < 0) {
         Game::Lua::PushNil(L);
         return 1;
@@ -163,7 +177,8 @@ int __fastcall Script_GetAuraDataBySpellName(void *L) {
         f = ParseFilter(filterStr);
         fp = &f;
     }
-    const int slot = Data::FindSlotBySpellName(unit, spellName, fp);
+    const int slot = Data::FindSlotBySpellName(unit, spellName, fp,
+                                               HasPlayerFilter(filterStr));
     if (slot < 0) {
         Game::Lua::PushNil(L);
         return 1;
@@ -192,7 +207,7 @@ int __fastcall Script_GetPlayerAuraBySpellID(void *L) {
 // sequential keys starting from `nextKey`. Updates `nextKey` so a
 // follow-up call can append to the same outer table.
 void AppendRangeToArray(void *L, const uint8_t *unit, int outerIdx,
-                       Data::Filter filter, int &nextKey) {
+                       Data::Filter filter, int &nextKey, bool playerOnly) {
     const int start = (filter == Data::Filter::Harmful)
                           ? Offsets::UNIT_AURA_BUFF_COUNT
                           : 0;
@@ -202,10 +217,14 @@ void AppendRangeToArray(void *L, const uint8_t *unit, int outerIdx,
     for (int slot = start; slot < end; ++slot) {
         if (!Data::IsSlotPopulated(unit, slot))
             continue;
+        if (playerOnly && !Data::IsPlayerCast(unit, slot))
+            continue;
         Game::Lua::PushNumber(L, static_cast<double>(nextKey++));
         Data::Push(L, unit, slot);
         Game::Lua::SetTable(L, outerIdx);
     }
+    // Append auras the descriptor dropped but Aura::Source still has live.
+    Data::AppendCacheFallbacks(L, unit, filter, playerOnly, outerIdx, nextKey);
 }
 
 int __fastcall Script_GetUnitAuras(void *L) {
@@ -218,14 +237,19 @@ int __fastcall Script_GetUnitAuras(void *L) {
     if (unit == nullptr)
         return 1;
 
+    // Range tokens are independent of PLAYER: an explicit HELPFUL/HARMFUL
+    // selects that range, neither selects both. So `"PLAYER"` alone returns
+    // both ranges restricted to player-cast auras (matching retail).
+    const bool playerOnly = HasPlayerFilter(filterStr);
+    const bool hasHelpful = filterStr != nullptr && strstr(filterStr, "HELPFUL") != nullptr;
+    const bool hasHarmful = filterStr != nullptr && strstr(filterStr, "HARMFUL") != nullptr;
+    const bool both = !hasHelpful && !hasHarmful;
+
     int nextKey = 1;
-    if (filterStr == nullptr) {
-        // No filter — return both ranges.
-        AppendRangeToArray(L, unit, 1, Data::Filter::Helpful, nextKey);
-        AppendRangeToArray(L, unit, 1, Data::Filter::Harmful, nextKey);
-    } else {
-        AppendRangeToArray(L, unit, 1, ParseFilter(filterStr), nextKey);
-    }
+    if (hasHelpful || both)
+        AppendRangeToArray(L, unit, 1, Data::Filter::Helpful, nextKey, playerOnly);
+    if (hasHarmful || both)
+        AppendRangeToArray(L, unit, 1, Data::Filter::Harmful, nextKey, playerOnly);
     return 1;
 }
 

src/aura/Data.cpp

@@ -15,7 +15,10 @@
 
 #include "Game.h"
 #include "Offsets.h"
+#include "aura/Source.h"
 #include "dbc/Lookup.h"
+#include "guid/Guid.h"
+#include "unit/Identity.h"
 
 #include <cstdint>
 #include <cstring>
@@ -38,6 +41,13 @@ const uint8_t *Descriptor(const uint8_t *unit) {
         unit + Offsets::OFF_CGUNIT_OBJECT_FIELDS);
 }
 
+// Keys into the `Aura::Source` caster/expiration cache. Thin alias for the
+// shared `Unit::Identity::GuidForObject` so the lookup here and the
+// OnAuraAdded hook in `Aura::Source` read the GUID the same way.
+uint64_t UnitGuid(const uint8_t *unit) {
+    return Unit::Identity::GuidForObject(unit);
+}
+
 const uint8_t *SpellRecord(uint32_t spellID) {
     return DBC::Record(Offsets::VAR_SPELL_RECORDS,
                        Offsets::VAR_SPELL_RECORD_COUNT, spellID);
@@ -219,7 +229,20 @@ bool IsSlotPopulated(const uint8_t *unit, int slot) {
     return IsVisible(SpellRecord(spellID));
 }
 
-int FindNthSlot(const uint8_t *unit, int oneBasedIndex, Filter filter) {
+bool IsPlayerCast(const uint8_t *unit, int slot) {
+    const uint32_t spellID = ReadSpellID(unit, slot);
+    if (spellID == 0)
+        return false;
+    uint64_t casterGuid = 0;
+    uint32_t expMs = 0;
+    uint32_t durMs = 0;
+    if (!Aura::Source::Get(UnitGuid(unit), spellID, &casterGuid, &expMs, &durMs))
+        return false;
+    return casterGuid != 0 && casterGuid == Unit::Identity::PlayerGuid();
+}
+
+int FindNthSlot(const uint8_t *unit, int oneBasedIndex, Filter filter,
+                bool playerOnly) {
     if (unit == nullptr || oneBasedIndex < 1)
         return -1;
     const int start = (filter == Filter::Harmful)
@@ -232,6 +255,8 @@ int FindNthSlot(const uint8_t *unit, int oneBasedIndex, Filter filter) {
     for (int slot = start; slot < end; ++slot) {
         if (!IsSlotPopulated(unit, slot))
             continue;
+        if (playerOnly && !IsPlayerCast(unit, slot))
+            continue;
         if (++matches == oneBasedIndex)
             return slot;
     }
@@ -239,7 +264,7 @@ int FindNthSlot(const uint8_t *unit, int oneBasedIndex, Filter filter) {
 }
 
 int FindSlotBySpellID(const uint8_t *unit, uint32_t spellID,
-                      const Filter *filter) {
+                      const Filter *filter, bool playerOnly) {
     if (unit == nullptr || spellID == 0)
         return -1;
     const int start = (filter != nullptr && *filter == Filter::Harmful)
@@ -251,14 +276,17 @@ int FindSlotBySpellID(const uint8_t *unit, uint32_t spellID,
     for (int slot = start; slot < end; ++slot) {
         if (!IsSlotPopulated(unit, slot))
             continue;
-        if (ReadSpellID(unit, slot) == spellID)
-            return slot;
+        if (ReadSpellID(unit, slot) != spellID)
+            continue;
+        if (playerOnly && !IsPlayerCast(unit, slot))
+            continue;
+        return slot;
     }
     return -1;
 }
 
 int FindSlotBySpellName(const uint8_t *unit, const char *spellName,
-                        const Filter *filter) {
+                        const Filter *filter, bool playerOnly) {
     if (unit == nullptr || spellName == nullptr || *spellName == '\0')
         return -1;
     const int start = (filter != nullptr && *filter == Filter::Harmful)
@@ -271,8 +299,11 @@ int FindSlotBySpellName(const uint8_t *unit, const char *spellName,
         if (!IsSlotPopulated(unit, slot))
             continue;
         const char *name = LocalizedSpellName(SpellRecord(ReadSpellID(unit, slot)));
-        if (name != nullptr && std::strcmp(name, spellName) == 0)
-            return slot;
+        if (name == nullptr || std::strcmp(name, spellName) != 0)
+            continue;
+        if (playerOnly && !IsPlayerCast(unit, slot))
+            continue;
+        return slot;
     }
     return -1;
 }
@@ -319,10 +350,13 @@ const char *DispelName(uint32_t dispelTypeID) {
     return (name == nullptr || *name == '\0') ? nullptr : name;
 }
 
-void Push(void *L, const uint8_t *unit, int slot) {
-    const uint32_t spellID = ReadSpellID(unit, slot);
+// Writes the full modern AuraData table on top of the Lua stack from
+// already-resolved values. Shared by the descriptor path (`Push`) and the
+// cache-fallback path (`PushFromCache`). Net stack effect: +1 (the table).
+static void BuildTable(void *L, uint32_t spellID, int applications,
+                       bool isHelpful, double duration, double expirationTime,
+                       uint64_t casterGuid) {
     const uint8_t *spellRecord = SpellRecord(spellID);
-    const bool isHelpful = slot < Offsets::UNIT_AURA_BUFF_COUNT;
 
     uint32_t dispelTypeID = 0;
     if (spellRecord != nullptr) {
@@ -339,43 +373,32 @@ void Push(void *L, const uint8_t *unit, int slot) {
     Game::Lua::SetFieldString(L, "name", name);
     Game::Lua::SetFieldString(L, "icon", icon);
     Game::Lua::SetFieldNumber(L, "applications",
-        static_cast<double>(ReadStacks(unit, slot)));
+                              static_cast<double>(applications));
     Game::Lua::SetFieldNumber(L, "spellId", static_cast<double>(spellID));
     Game::Lua::SetFieldString(L, "dispelName", dispel);
     Game::Lua::SetFieldBool(L, "isHelpful", isHelpful);
     Game::Lua::SetFieldBool(L, "isHarmful", !isHelpful);
-
-    // Timing fields. Vanilla doesn't broadcast cast time / duration
-    // for ANY unit's auras except the local player's — for everyone
-    // else (target, party, raid, mouseover) `expirationTime` stays 0
-    // and addons have to track expiry themselves via aura-add events.
-    // For the player we read the engine's `VAR_PLAYER_BUFF_TABLE`
-    // (same data `GetPlayerBuffTimeLeft` returns), which gives us a
-    // real expiration timestamp.
-    //
-    // `duration` comes from Spell.dbc → SpellDuration.dbc with
-    // level scaling. That's the *base* value; talent / glyph
-    // duration-extension modifiers (Improved PW:F, etc.) are
-    // already baked into the expiration timestamp on the
-    // caster's side, so `expirationTime - GetTime()` reflects the
-    // true remaining time even when `duration` doesn't include
-    // the talent boost. We populate `duration` for any unit (the
-    // base value is identical regardless of who's affected); only
-    // `expirationTime` is player-gated.
-    double duration = 0.0;
-    double expirationTime = 0.0;
-    const uint8_t *player = LocalPlayer();
-    if (spellID != 0) {
-        const int unitLevel = (unit != nullptr) ? PlayerLevel(unit) : 0;
-        duration = SpellBaseDurationSeconds(spellID, unitLevel);
-    }
-    if (unit != nullptr && unit == player) {
-        const uint8_t *entry = FindPlayerBuffEntry(spellID);
-        if (entry != nullptr)
-            expirationTime = PlayerBuffExpirationSeconds(entry);
-    }
     Game::Lua::SetFieldNumber(L, "duration", duration);
     Game::Lua::SetFieldNumber(L, "expirationTime", expirationTime);
+
+    if (casterGuid != 0) {
+        // `sourceUnit` is a token (nil when the caster maps to no current
+        // token); `sourceGUID` is the raw "0x..." GUID and is set whenever we
+        // have a caster — a ClassicAPI extension (not in retail AuraData) that
+        // survives the caster leaving token range and doubles as a unit token
+        // under SuperWoW.
+        char tokenBuf[32];
+        char guidBuf[Guid::STRING_SIZE];
+        const char *sourceUnit = Unit::Identity::TokenFromGUID(
+            casterGuid, tokenBuf, sizeof tokenBuf);
+        const char *sourceGUID =
+            Guid::FormatAsString(casterGuid, guidBuf, sizeof guidBuf);
+        if (sourceUnit != nullptr)
+            Game::Lua::SetFieldString(L, "sourceUnit", sourceUnit);
+        if (sourceGUID != nullptr)
+            Game::Lua::SetFieldString(L, "sourceGUID", sourceGUID);
+    }
+
     Game::Lua::SetFieldNumber(L, "charges", 0);
     Game::Lua::SetFieldNumber(L, "maxCharges", 0);
     Game::Lua::SetFieldNumber(L, "timeMod", 1);
@@ -391,10 +414,167 @@ void Push(void *L, const uint8_t *unit, int slot) {
     Game::Lua::SetFieldBool(L, "shouldConsolidate", false);
     Game::Lua::SetFieldBool(L, "isRaid", false);
 
-    // `sourceUnit`, `auraInstanceID`, `points` deliberately omitted
-    // — modern returns nil for those when they don't apply, and
-    // Lua reading a missing key yields nil, so the table doesn't
-    // need an explicit entry.
+    // `auraInstanceID` and `points` are deliberately omitted — modern returns
+    // nil for those when they don't apply, and Lua reading a missing key
+    // yields nil, so the table doesn't need an explicit entry.
+}
+
+void Push(void *L, const uint8_t *unit, int slot) {
+    const uint32_t spellID = ReadSpellID(unit, slot);
+    const bool isHelpful = slot < Offsets::UNIT_AURA_BUFF_COUNT;
+
+    // Timing fields. Vanilla doesn't broadcast cast time / duration for ANY
+    // unit's auras except the local player's — for everyone else (target,
+    // party, raid, mouseover) `expirationTime` stays 0 unless the
+    // `Aura::Source` cache observed the cast. For the player we read the
+    // engine's `VAR_PLAYER_BUFF_TABLE` (same data `GetPlayerBuffTimeLeft`
+    // returns), which gives a real expiration timestamp.
+    //
+    // `duration` comes from Spell.dbc → SpellDuration.dbc with level scaling
+    // (the *base* value); talent / glyph duration-extension modifiers are
+    // already baked into the expiration timestamp on the caster's side, so
+    // `expirationTime - GetTime()` reflects true remaining time even when the
+    // base `duration` doesn't include the talent boost.
+    double duration = 0.0;
+    double expirationTime = 0.0;
+    uint64_t casterGuid = 0;
+    const uint8_t *player = LocalPlayer();
+    if (spellID != 0) {
+        const int unitLevel = (unit != nullptr) ? PlayerLevel(unit) : 0;
+        duration = SpellBaseDurationSeconds(spellID, unitLevel);
+    }
+    if (unit != nullptr && unit == player) {
+        const uint8_t *entry = FindPlayerBuffEntry(spellID);
+        if (entry != nullptr)
+            expirationTime = PlayerBuffExpirationSeconds(entry);
+    }
+    // Caster + non-player expiration from the SMSG_SPELL_GO cache, captured at
+    // cast time (the descriptor has neither). The player-buff table above is
+    // authoritative for the player's own expiration; the cache fills it for
+    // everyone else. Prefer the applied (caster-modified) duration so it stays
+    // consistent with `expirationTime` — otherwise a talented DoT (Improved
+    // Shadow Word: Pain) would show remaining time exceeding the base.
+    if (spellID != 0) {
+        uint64_t c = 0;
+        uint32_t expMs = 0;
+        uint32_t durMs = 0;
+        if (Aura::Source::Get(UnitGuid(unit), spellID, &c, &expMs, &durMs)) {
+            if (expirationTime == 0.0 && expMs != 0)
+                expirationTime = static_cast<double>(expMs) * 0.001;
+            if (durMs != 0)
+                duration = static_cast<double>(durMs) * 0.001;
+            casterGuid = c;
+        }
+    }
+
+    BuildTable(L, spellID, ReadStacks(unit, slot), isHelpful, duration,
+               expirationTime, casterGuid);
+}
+
+namespace {
+
+// Builds an AuraData table from an `Aura::Source` cache entry — the fallback
+// when the descriptor has dropped the aura's slot. Stack count isn't broadcast
+// in SMSG_SPELL_GO, so `applications` defaults to 1. `duration` uses the
+// applied (caster-modified) ms when known, else the Spell.dbc base.
+void PushFromCache(void *L, const uint8_t *unit,
+                   const Aura::Source::CachedAura &c, bool isHelpful) {
+    double duration = 0.0;
+    if (c.durationMs != 0) {
+        duration = static_cast<double>(c.durationMs) * 0.001;
+    } else {
+        const int unitLevel = (unit != nullptr) ? PlayerLevel(unit) : 0;
+        duration = SpellBaseDurationSeconds(c.spellId, unitLevel);
+    }
+    const double expirationTime =
+        (c.expirationMs != 0) ? static_cast<double>(c.expirationMs) * 0.001 : 0.0;
+    BuildTable(L, c.spellId, 1, isHelpful, duration, expirationTime,
+               c.casterGuid);
+}
+
+// Counts populated descriptor slots matching `filter` (and `playerOnly`).
+int CountSlots(const uint8_t *unit, Filter filter, bool playerOnly) {
+    if (unit == nullptr)
+        return 0;
+    const int start = (filter == Filter::Harmful)
+                          ? Offsets::UNIT_AURA_BUFF_COUNT
+                          : 0;
+    const int end = (filter == Filter::Harmful) ? Offsets::UNIT_AURA_TOTAL
+                                                 : Offsets::UNIT_AURA_BUFF_COUNT;
+    int n = 0;
+    for (int slot = start; slot < end; ++slot) {
+        if (!IsSlotPopulated(unit, slot))
+            continue;
+        if (playerOnly && !IsPlayerCast(unit, slot))
+            continue;
+        ++n;
+    }
+    return n;
+}
+
+constexpr int kFallbackMax = Offsets::UNIT_AURA_TOTAL;
+
+// Whether cache entry `c` should be surfaced as a fallback for `unit` under
+// `filter`/`playerOnly`: it must not already be in a populated descriptor slot
+// (no double-listing the same live aura) and, when player-filtered, must have
+// been cast by us. Superseded / dispelled auras are kept out of the cache by
+// `Aura::Source`'s removal eviction, not filtered here.
+bool FallbackEligible(const uint8_t *unit, const Aura::Source::CachedAura &c,
+                      Filter filter, bool playerOnly) {
+    if (FindSlotBySpellID(unit, c.spellId, &filter, false) >= 0)
+        return false; // still in the descriptor — returned via the slot path
+    if (playerOnly && c.casterGuid != Unit::Identity::PlayerGuid())
+        return false;
+    return true;
+}
+
+} // namespace
+
+bool PushNthCacheFallback(void *L, const uint8_t *unit, int oneBasedIndex,
+                          Filter filter, bool playerOnly) {
+    if (unit == nullptr)
+        return false;
+    // The descriptor held `descCount` matches; the caller already found fewer
+    // than `oneBasedIndex` there, so the cache supplies index
+    // `oneBasedIndex - descCount` (1-based) of the entries it didn't.
+    const int target = oneBasedIndex - CountSlots(unit, filter, playerOnly);
+    if (target < 1)
+        return false;
+    const uint64_t guid = UnitGuid(unit);
+    if (guid == 0)
+        return false;
+    Aura::Source::CachedAura buf[kFallbackMax];
+    const int n = Aura::Source::Enumerate(
+        guid, filter == Filter::Harmful, buf, kFallbackMax);
+    int seen = 0;
+    for (int i = 0; i < n; ++i) {
+        if (!FallbackEligible(unit, buf[i], filter, playerOnly))
+            continue;
+        if (++seen == target) {
+            PushFromCache(L, unit, buf[i], filter == Filter::Helpful);
+            return true;
+        }
+    }
+    return false;
+}
+
+void AppendCacheFallbacks(void *L, const uint8_t *unit, Filter filter,
+                          bool playerOnly, int outerIdx, int &nextKey) {
+    if (unit == nullptr)
+        return;
+    const uint64_t guid = UnitGuid(unit);
+    if (guid == 0)
+        return;
+    Aura::Source::CachedAura buf[kFallbackMax];
+    const int n = Aura::Source::Enumerate(
+        guid, filter == Filter::Harmful, buf, kFallbackMax);
+    for (int i = 0; i < n; ++i) {
+        if (!FallbackEligible(unit, buf[i], filter, playerOnly))
+            continue;
+        Game::Lua::PushNumber(L, static_cast<double>(nextKey++));
+        PushFromCache(L, unit, buf[i], filter == Filter::Helpful);
+        Game::Lua::SetTable(L, outerIdx);
+    }
 }
 
 } // namespace Aura::Data

src/aura/Data.h

@@ -47,22 +47,29 @@ bool IsSlotPopulated(const uint8_t *unit, int slot);
 // Finds the absolute slot of the `oneBasedIndex`-th populated aura
 // matching `filter`. Returns -1 if no such aura. Walks
 // 0..UNIT_AURA_BUFF_COUNT-1 for Helpful, UNIT_AURA_BUFF_COUNT..
-// UNIT_AURA_TOTAL-1 for Harmful.
-int FindNthSlot(const uint8_t *unit, int oneBasedIndex, Filter filter);
+// UNIT_AURA_TOTAL-1 for Harmful. When `playerOnly` is true, only auras
+// the local player cast (per `IsPlayerCast`) are counted/returned.
+int FindNthSlot(const uint8_t *unit, int oneBasedIndex, Filter filter,
+                bool playerOnly = false);
 
 // Finds the absolute slot of a populated aura with the given spell
 // ID, optionally restricted to one filter range. `filter` of
 // nullptr searches both ranges (helpful first, then harmful).
-// Returns -1 if not found.
+// `playerOnly` restricts to player-cast auras. Returns -1 if not found.
 int FindSlotBySpellID(const uint8_t *unit, uint32_t spellID,
-                      const Filter *filter);
+                      const Filter *filter, bool playerOnly = false);
 
 // Finds the absolute slot of a populated aura whose locale-resolved
 // spell name exactly matches `spellName`. Case-sensitive. Otherwise
 // same semantics as `FindSlotBySpellID`. Returns -1 if not found
 // or if `spellName` is null/empty.
 int FindSlotBySpellName(const uint8_t *unit, const char *spellName,
-                        const Filter *filter);
+                        const Filter *filter, bool playerOnly = false);
+
+// True iff the aura at `slot` was cast by the local player, per the
+// `Aura::Source` cache. False on a cache miss (caster unknown) — so a
+// PLAYER-filtered query excludes auras whose cast we didn't observe.
+bool IsPlayerCast(const uint8_t *unit, int slot);
 
 // Display stack count for the given slot (engine stores stacks-1,
 // we add 1). Returns 0 if the unit is null.
@@ -85,12 +92,18 @@ const char *DispelName(uint32_t dispelTypeID);
 //
 // Populates these fields with real data:
 //   name, icon, applications, spellId, dispelName,
-//   isHelpful, isHarmful, timeMod
+//   isHelpful, isHarmful, timeMod, duration
+//
+// And these from the `Aura::Source` SMSG_SPELL_GO cache when available
+// (else their inapplicable default):
+//   expirationTime (player: engine buff table; others: cache; 0 on miss),
+//   sourceUnit     (caster token from the cache; nil on miss),
+//   sourceGUID     (caster "0x..." GUID string; nil on miss — a ClassicAPI
+//                   extension, not in retail AuraData)
 //
 // And these with vanilla-truthful defaults (matches modern's
 // "field present but inapplicable" semantics):
-//   duration=0, expirationTime=0, charges=0, maxCharges=0,
-//   sourceUnit=nil, auraInstanceID=nil, points=nil,
+//   charges=0, maxCharges=0, auraInstanceID=nil, points=nil,
 //   isStealable=false, isBossAura=false, isFromPlayerOrPlayerPet=false,
 //   isNameplateOnly=false, nameplateShowAll=false,
 //   nameplateShowPersonal=false, canApplyAura=false,
@@ -99,4 +112,24 @@ const char *DispelName(uint32_t dispelTypeID);
 // Net stack effect: +1 (the table).
 void Push(void *L, const uint8_t *unit, int slot);
 
+// Fallback for the index path when the descriptor has dropped an aura's slot
+// (rogue stealth, party range fluctuation) but it's still active server-side.
+// `oneBasedIndex` is the same index the caller passed to `FindNthSlot`; this
+// resolves it against the `Aura::Source` cache *after* the descriptor matches
+// (so cache entries append after descriptor ones, preserving existing index
+// order). On a hit it pushes the AuraData table and returns true; on a miss it
+// pushes nothing and returns false (caller pushes nil). Only entries whose
+// helpful/harmful classification matches `filter` and that aren't already in a
+// populated descriptor slot are considered.
+bool PushNthCacheFallback(void *L, const uint8_t *unit, int oneBasedIndex,
+                          Filter filter, bool playerOnly = false);
+
+// Appends every eligible `Aura::Source` cache fallback for `unit` matching
+// `filter` into the array table at `outerIdx`, continuing from `nextKey`
+// (updated in place). The bulk-enumeration analog of `PushNthCacheFallback`,
+// for `GetUnitAuras`. Skips entries already present in a populated descriptor
+// slot so it never double-lists.
+void AppendCacheFallbacks(void *L, const uint8_t *unit, Filter filter,
+                          bool playerOnly, int outerIdx, int &nextKey);
+
 } // namespace Aura::Data

src/aura/Source.cpp

@@ -0,0 +1,343 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+
+// See `Source.h` for the contract. This is the backend: a co-hook on
+// `FUN_SPELL_GO` that mirrors nampower's `SpellGoHook` parse to capture the
+// caster + duration of every aura-applying cast, and a small fixed-size
+// cache `Aura::Data::Push` reads from.
+
+#include "Source.h"
+
+#include "Data.h"
+#include "Game.h"
+#include "Offsets.h"
+#include "net/PacketReader.h"
+#include "spell/Lookup.h"
+#include "tick/WorldTick.h"
+#include "unit/Identity.h"
+
+#include <cstdint>
+
+namespace Aura::Source {
+
+namespace {
+
+using Net::CDataStore;
+
+// A cast applies an aura iff any of its three effects names an aura. The
+// EffectApplyAuraName[3] int32 array sits at `+0x16C` (already used by the
+// shapeshift / mechanic-immunity code). Gating on this keeps pure-damage
+// and utility casts out of the cache.
+bool SpellAppliesAura(const uint8_t *spellRecord) {
+    if (spellRecord == nullptr)
+        return false;
+    const auto *auraNames = reinterpret_cast<const int32_t *>(
+        spellRecord + Offsets::OFF_SPELL_RECORD_EFFECT_APPLY_AURA_NAME);
+    for (int i = 0; i < Offsets::SPELL_RECORD_EFFECT_COUNT; ++i) {
+        if (auraNames[i] != 0)
+            return true;
+    }
+    return false;
+}
+
+uint32_t NowMs() {
+    using TickCount_t = uint32_t(__fastcall *)();
+    return reinterpret_cast<TickCount_t>(
+        static_cast<uintptr_t>(Offsets::FUN_OS_TICKCOUNT_MS))();
+}
+
+// Server-authoritative duration (ms). When the local player is the caster
+// we let the engine fold in the player's duration modifiers (skipMod = 0);
+// for any other caster we take the unmodified base (skipMod = 1) since we
+// only have the local player's mod tables. `unit = 0` selects the player
+// mod context per FUN_GET_SPELL_DURATION's signature.
+uint32_t SpellDurationMs(const uint8_t *spellRecord, bool casterIsPlayer) {
+    using GetDuration_t = int(__fastcall *)(const uint8_t *spellRecord,
+                                            int unit, char skipMod);
+    const int ms = reinterpret_cast<GetDuration_t>(
+        static_cast<uintptr_t>(Offsets::FUN_GET_SPELL_DURATION))(
+        spellRecord, 0, casterIsPlayer ? 0 : 1);
+    return ms > 0 ? static_cast<uint32_t>(ms) : 0;
+}
+
+// ---- Cache ---------------------------------------------------------------
+
+// Helpful/harmful classification, recorded from the aura's descriptor slot
+// when it's applied (the only place the buff/debuff split is known). SpellGo
+// gives no slot, so casts we only saw there stay Unknown until/unless an
+// application hook fires for the same aura.
+enum Kind : int8_t { KIND_UNKNOWN = -1, KIND_HELPFUL = 0, KIND_HARMFUL = 1 };
+
+struct Entry {
+    uint64_t targetGuid;
+    uint64_t casterGuid;
+    uint32_t spellId;
+    uint32_t expirationMs; // 0 = infinite / unknown duration
+    uint32_t durationMs;   // applied duration (incl. caster mods); 0 = none
+    int8_t kind;           // Kind; descriptor-slot-derived, KIND_UNKNOWN if only seen via SpellGo
+    bool used;
+};
+
+constexpr int kCacheSize = 256;
+Entry g_cache[kCacheSize];
+int g_writeCursor = 0;
+
+// `fromCast` true: the SpellGo hook — authoritative caster + caster-modified
+// (talented) timing. False: the OnAuraAdded application hook — timing only,
+// no caster, and it must not clobber an entry SpellGo already owns (that
+// would replace talented timing with the unmodified base), so it skips
+// entries that already carry a caster.
+void Store(uint64_t targetGuid, uint32_t spellId, uint64_t casterGuid,
+           uint32_t expirationMs, uint32_t durationMs, bool fromCast,
+           int8_t kind) {
+    if (targetGuid == 0 || spellId == 0)
+        return;
+
+    // Update an existing entry for this exact aura instance.
+    for (auto &e : g_cache) {
+        if (e.used && e.targetGuid == targetGuid && e.spellId == spellId) {
+            // Learn the classification whenever a slot-derived kind arrives —
+            // independent of caster/timing ownership, and never downgrade a
+            // known kind back to unknown.
+            if (kind != KIND_UNKNOWN)
+                e.kind = kind;
+            if (!fromCast && e.casterGuid != 0)
+                return; // SpellGo owns this entry; keep its caster + timing
+            if (casterGuid != 0)
+                e.casterGuid = casterGuid;
+            e.expirationMs = expirationMs;
+            e.durationMs = durationMs;
+            return;
+        }
+    }
+    // Take a free slot, else an expired one, else evict round-robin.
+    const uint32_t now = NowMs();
+    for (auto &e : g_cache) {
+        if (!e.used || (e.expirationMs != 0 && now >= e.expirationMs)) {
+            e = {targetGuid, casterGuid, spellId, expirationMs, durationMs,
+                 kind, true};
+            return;
+        }
+    }
+    Entry &slot = g_cache[g_writeCursor];
+    g_writeCursor = (g_writeCursor + 1) % kCacheSize;
+    slot = {targetGuid, casterGuid, spellId, expirationMs, durationMs, kind,
+            true};
+}
+
+// Evict the entry for an aura the engine reports gone. Keyed by (target,
+// spell) like the rest of the cache. Without this, the GetAuraDataByIndex
+// fallback would keep surfacing a dropped aura until its computed expiry —
+// e.g. a Rank 1 buff replaced by Rank 2 (engine drops Rank 1 from the
+// descriptor) would show as a phantom second aura, or a dispelled buff would
+// linger.
+void Evict(uint64_t targetGuid, uint32_t spellId) {
+    if (targetGuid == 0 || spellId == 0)
+        return;
+    for (auto &e : g_cache) {
+        if (e.used && e.targetGuid == targetGuid && e.spellId == spellId) {
+            e.used = false;
+            return;
+        }
+    }
+}
+
+// Drop entries whose timed aura has elapsed so the table doesn't fill with
+// stale combat debuffs. Infinite-duration entries (expirationMs == 0) stay
+// until overwritten.
+void OnWorldTick() {
+    const uint32_t now = NowMs();
+    for (auto &e : g_cache) {
+        if (e.used && e.expirationMs != 0 && now >= e.expirationMs)
+            e.used = false;
+    }
+}
+
+const Tick::WorldTick::AutoSubscribe _tickSub{&OnWorldTick};
+
+// ---- SMSG_SPELL_GO co-hook ----------------------------------------------
+
+// The hit-target list is all we need: each entry is a unit the cast landed
+// on, which is exactly where an aura gets applied. We deliberately stop
+// before the missed-target list / target mask — the post-mask "intended"
+// target is redundant with the hit list for aura purposes, and skipping it
+// keeps the parse short and robust.
+constexpr int kMaxTargets = 16;
+
+using SpellGo_t = void(__fastcall *)(uint64_t *itemGUID, uint64_t *casterGUID,
+                                     uint32_t spellId, CDataStore *packet);
+SpellGo_t g_origSpellGo = nullptr;
+
+void __fastcall SpellGo_h(uint64_t *itemGUID, uint64_t *casterGUID,
+                          uint32_t spellId, CDataStore *packet) {
+    uint64_t targets[kMaxTargets];
+    int numTargets = 0;
+
+    if (packet != nullptr) {
+        const uint32_t savedRead = packet->m_read;
+        Net::Read<int16_t>(packet); // castFlags (unused)
+        const uint8_t numHit = Net::Read<uint8_t>(packet);
+        for (int i = 0; i < numHit; ++i) {
+            const uint64_t guid = Net::Read<uint64_t>(packet);
+            if (numTargets < kMaxTargets)
+                targets[numTargets++] = guid;
+        }
+        packet->m_read = savedRead; // restore so the engine re-parses cleanly
+    }
+
+    g_origSpellGo(itemGUID, casterGUID, spellId, packet);
+
+    const uint64_t caster = (casterGUID != nullptr) ? *casterGUID : 0;
+    if (caster == 0 || spellId == 0)
+        return;
+
+    const uint8_t *rec = Spell::Lookup::RecordForID(static_cast<int>(spellId));
+    if (!SpellAppliesAura(rec))
+        return;
+
+    const bool casterIsPlayer = (caster == Unit::Identity::PlayerGuid());
+    const uint32_t durationMs = SpellDurationMs(rec, casterIsPlayer);
+    const uint32_t expirationMs = durationMs > 0 ? NowMs() + durationMs : 0;
+
+    if (numTargets == 0) {
+        // No explicit hit list (self-cast with caster-implicit target).
+        Store(caster, spellId, caster, expirationMs, durationMs, true,
+              KIND_UNKNOWN);
+        return;
+    }
+    for (int i = 0; i < numTargets; ++i)
+        Store(targets[i], spellId, caster, expirationMs, durationMs, true,
+              KIND_UNKNOWN);
+}
+
+const Game::HookAutoRegister _hook{Offsets::FUN_SPELL_GO,
+                                   reinterpret_cast<void *>(&SpellGo_h),
+                                   reinterpret_cast<void **>(&g_origSpellGo)};
+
+// ---- Aura-application co-hooks (timing for proc / triggered auras) -------
+
+// Stamp expiration for an aura that just landed/refreshed on `unit`. Used by
+// both the add and stack-change hooks. No caster is available from these
+// paths, so it stamps timing only with `fromCast=false` — Store skips any
+// entry SpellGo already owns, so a directly-cast aura keeps its talented
+// timing. Base (unmodified) duration is the best estimate without a caster.
+void StampApplication(void *unit, uint32_t spellId, int8_t kind) {
+    if (spellId == 0)
+        return;
+    const uint8_t *rec = Spell::Lookup::RecordForID(static_cast<int>(spellId));
+    if (!SpellAppliesAura(rec))
+        return;
+    const uint64_t unitGuid = Unit::Identity::GuidForObject(unit);
+    if (unitGuid == 0)
+        return;
+    const uint32_t durationMs = SpellDurationMs(rec, /*casterIsPlayer*/ false);
+    const uint32_t expirationMs = durationMs > 0 ? NowMs() + durationMs : 0;
+    Store(unitGuid, spellId, /*casterGuid*/ 0, expirationMs, durationMs,
+          /*fromCast*/ false, kind);
+}
+
+// Classify by the absolute aura slot: 0..BUFF_COUNT-1 = buff (helpful),
+// BUFF_COUNT..TOTAL-1 = debuff (harmful).
+int8_t KindForSlot(int slot) {
+    return slot >= Offsets::UNIT_AURA_BUFF_COUNT ? KIND_HARMFUL : KIND_HELPFUL;
+}
+
+// OnAuraAdded — a new aura occupies a slot (gives the spellId directly).
+using OnAuraAdded_t = void(__fastcall *)(void *unit, void *edx, uint32_t slot,
+                                         uint32_t spellId);
+OnAuraAdded_t g_origOnAuraAdded = nullptr;
+
+void __fastcall OnAuraAdded_h(void *unit, void *edx, uint32_t slot,
+                              uint32_t spellId) {
+    g_origOnAuraAdded(unit, edx, slot, spellId);
+    StampApplication(unit, spellId, KindForSlot(static_cast<int>(slot)));
+}
+
+const Game::HookAutoRegister _hookAuraAdded{
+    Offsets::FUN_ON_AURA_ADDED, reinterpret_cast<void *>(&OnAuraAdded_h),
+    reinterpret_cast<void **>(&g_origOnAuraAdded)};
+
+// OnAuraStacksChanged — an existing aura's stack count changed (e.g. Shadow
+// Weaving climbing). Only the slot is given, so read the spellID back from
+// the unit's aura array. Re-stamps expiration so stacking refreshes count.
+using OnAuraStacksChanged_t = void(__fastcall *)(void *unit, void *edx,
+                                                 int slot, uint8_t stackCount);
+OnAuraStacksChanged_t g_origOnAuraStacksChanged = nullptr;
+
+void __fastcall OnAuraStacksChanged_h(void *unit, void *edx, int slot,
+                                      uint8_t stackCount) {
+    g_origOnAuraStacksChanged(unit, edx, slot, stackCount);
+    StampApplication(
+        unit,
+        Aura::Data::ReadSpellID(static_cast<const uint8_t *>(unit), slot),
+        KindForSlot(slot));
+}
+
+const Game::HookAutoRegister _hookAuraStacks{
+    Offsets::FUN_ON_AURA_STACKS_CHANGED,
+    reinterpret_cast<void *>(&OnAuraStacksChanged_h),
+    reinterpret_cast<void **>(&g_origOnAuraStacksChanged)};
+
+// OnAuraRemoved — a descriptor aura slot went empty: the aura fell off, was
+// dispelled, or was replaced by a higher rank (the diff dispatcher fires
+// Removed(old) + Added(new)). Evict the cache entry so the fallback stops
+// surfacing it. Same ABI as OnAuraAdded (unit in ecx, slot + spellId on the
+// stack); `slot` is unused here — we evict by spellId.
+using OnAuraRemoved_t = void(__fastcall *)(void *unit, void *edx, uint32_t slot,
+                                           uint32_t spellId);
+OnAuraRemoved_t g_origOnAuraRemoved = nullptr;
+
+void __fastcall OnAuraRemoved_h(void *unit, void *edx, uint32_t slot,
+                                uint32_t spellId) {
+    g_origOnAuraRemoved(unit, edx, slot, spellId);
+    (void)slot;
+    Evict(Unit::Identity::GuidForObject(unit), spellId);
+}
+
+const Game::HookAutoRegister _hookAuraRemoved{
+    Offsets::FUN_ON_AURA_REMOVED, reinterpret_cast<void *>(&OnAuraRemoved_h),
+    reinterpret_cast<void **>(&g_origOnAuraRemoved)};
+
+} // namespace
+
+bool Get(uint64_t unitGuid, uint32_t spellId, uint64_t *outCaster,
+         uint32_t *outExpirationMs, uint32_t *outDurationMs) {
+    if (unitGuid == 0 || spellId == 0)
+        return false;
+    for (const auto &e : g_cache) {
+        if (e.used && e.targetGuid == unitGuid && e.spellId == spellId) {
+            *outCaster = e.casterGuid;
+            *outExpirationMs = e.expirationMs;
+            *outDurationMs = e.durationMs;
+            return true;
+        }
+    }
+    return false;
+}
+
+int Enumerate(uint64_t unitGuid, bool harmful, CachedAura *out, int maxOut) {
+    if (unitGuid == 0 || out == nullptr || maxOut <= 0)
+        return 0;
+    const int8_t want = harmful ? KIND_HARMFUL : KIND_HELPFUL;
+    const uint32_t now = NowMs();
+    int n = 0;
+    for (const auto &e : g_cache) {
+        if (n >= maxOut)
+            break;
+        if (!e.used || e.targetGuid != unitGuid || e.kind != want)
+            continue;
+        if (e.expirationMs != 0 && now >= e.expirationMs)
+            continue; // expired (infinite-duration entries pass)
+        out[n++] = {e.spellId, e.casterGuid, e.expirationMs, e.durationMs};
+    }
+    return n;
+}
+
+} // namespace Aura::Source

src/aura/Source.h

@@ -0,0 +1,65 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+
+#pragma once
+
+#include <cstdint>
+
+// Aura caster / duration cache, fed by a co-hook on `SMSG_SPELL_GO`
+// (`FUN_SPELL_GO`). The vanilla unit aura array (`UNIT_FIELD_AURA`) stores
+// only spell IDs — it has no record of *who* cast an aura, and no
+// cast/expiration timing for any unit but the local player. The one place
+// the client ever sees the caster + a server-authoritative duration is the
+// `SMSG_SPELL_GO` packet at cast time. We parse it (the same packet
+// nampower parses for its `AURA_CAST_ON_*` events) and remember, per
+// `(targetGuid, spellId)`, who cast it and when it should expire.
+//
+// `Aura::Data::Push` consults this to fill `sourceUnit` (caster, resolved
+// to a unit token) and `expirationTime` for non-player units. The cache is
+// inherently best-effort: it only knows about casts observed since login,
+// and an entry survives until it expires (combat-duration auras) or is
+// evicted under pressure. Misses leave the modern-truthful defaults
+// (`sourceUnit` nil, `expirationTime` 0) in place — same outcome as before
+// this module existed.
+
+namespace Aura::Source {
+
+// Looks up the cached caster + timing for the aura `spellId` currently on
+// the unit identified by `unitGuid`. Returns true and fills the out params
+// on a hit. `*outExpirationMs` is an absolute `GetTickCount`-epoch timestamp
+// (0 = unknown / infinite-duration aura); `*outDurationMs` is the applied
+// duration including the caster's modifiers (talents etc.; 0 = none) — use
+// it for the `duration` field so it stays consistent with `expirationTime`;
+// `*outCaster` is the caster's 64-bit GUID (never 0 on a hit). Returns false
+// on a miss or for zero inputs.
+bool Get(uint64_t unitGuid, uint32_t spellId, uint64_t *outCaster,
+         uint32_t *outExpirationMs, uint32_t *outDurationMs);
+
+// One cached aura, as returned by `Enumerate`.
+struct CachedAura {
+    uint32_t spellId;
+    uint64_t casterGuid;   // 0 = caster unknown (application hook, no SpellGo)
+    uint32_t expirationMs; // 0 = infinite / unknown
+    uint32_t durationMs;   // applied duration (incl. caster mods); 0 = none
+};
+
+// Fills `out` with up to `maxOut` cached, non-expired auras on `unitGuid`
+// whose helpful/harmful classification matches `harmful`. Returns the count
+// written. The classification is recorded from the aura's descriptor slot at
+// application time (`OnAuraAdded`/`OnAuraStacksChanged`); entries we only ever
+// saw via `SMSG_SPELL_GO` have no slot and so an unknown classification —
+// those are excluded (we can't tell which range they belong to).
+//
+// This is the fallback source for `Aura::Data` when the unit descriptor has
+// dropped an aura's slot (rogue stealth, party range fluctuation) even though
+// the aura is still active server-side: the cache survives descriptor clears.
+int Enumerate(uint64_t unitGuid, bool harmful, CachedAura *out, int maxOut);
+
+} // namespace Aura::Source

src/map/Info.cpp

@@ -13,6 +13,7 @@
 
 #include "Game.h"
 #include "Offsets.h"
+#include "unit/Identity.h"
 
 #include <cstdint>
 #include <cstring>
@@ -74,14 +75,7 @@ uint16_t LocalPlayerArea() {
         static_cast<uintptr_t>(Offsets::VAR_PLAYER_AREA_ID)));
 }
 
-uint64_t LocalPlayerGUID() {
-    auto *player = *reinterpret_cast<uint8_t *const *>(
-        static_cast<uintptr_t>(Offsets::VAR_LOCAL_PLAYER_PTR));
-    if (player == nullptr)
-        return 0;
-    return *reinterpret_cast<const uint64_t *>(
-        player + Offsets::OFF_LOCAL_PLAYER_GUID);
-}
+uint64_t LocalPlayerGUID() { return Unit::Identity::PlayerGuid(); }
 
 
 // Pushes `area` as a number, or nil if `area == 0`. Vanilla zone 0

src/net/PacketReader.h

@@ -0,0 +1,68 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+
+#pragma once
+
+#include <cstdint>
+
+// Minimal reader for the engine's `CDataStore` packet buffer, shared by the
+// packet co-hooks (`Aura::Source`'s SpellGo, `Spell::Cast`'s SpellStart).
+//
+// `CDataStore` is POLYMORPHIC in the engine (virtual Internal*/Reset/etc.),
+// so a vtable pointer sits at offset 0 and the data members start at +0x04.
+// Omitting `vtable` shifts every field by 4 and makes `m_buffer` read the
+// vptr — a garbage read address (this caused an early ACCESS_VIOLATION in
+// the SpellGo hook before the slot was added).
+//
+// Incoming SMSG packets are a single contiguous buffer (`m_base == 0`,
+// `m_alloc == size`), so the simple `m_buffer - m_base + m_read` read with
+// an `m_size` bound is sufficient — the same critical guard as the engine's
+// own `CDataStore::Get`. Callers should save `m_read` before reading and
+// restore it before handing the packet to the original handler.
+
+namespace Net {
+
+struct CDataStore {
+    void *vtable;       // +0x00
+    uint8_t *m_buffer;  // +0x04
+    uint32_t m_base;    // +0x08
+    uint32_t m_alloc;   // +0x0C
+    uint32_t m_size;    // +0x10
+    uint32_t m_read;    // +0x14
+};
+
+// Reads a fixed-width field and advances the cursor. On overrun it poisons
+// `m_read` (so subsequent reads short-circuit) and returns a zero value.
+template <typename T>
+T Read(CDataStore *p) {
+    T val{};
+    const uint32_t end = p->m_read + sizeof(T);
+    if (end > p->m_size) {
+        p->m_read = p->m_size + 1;
+        return val;
+    }
+    val = *reinterpret_cast<const T *>(p->m_buffer - p->m_base + p->m_read);
+    p->m_read += sizeof(T);
+    return val;
+}
+
+// Reads a WoW packed GUID: a 1-byte mask followed by one byte per set bit,
+// each contributing the corresponding byte of the 64-bit value.
+inline uint64_t ReadPackedGuid(CDataStore *p) {
+    uint64_t guid = 0;
+    const uint8_t mask = Read<uint8_t>(p);
+    for (int i = 0; i < 8; ++i) {
+        if (mask & (1u << i))
+            guid |= static_cast<uint64_t>(Read<uint8_t>(p)) << (i * 8);
+    }
+    return guid;
+}
+
+} // namespace Net

src/player/LoginStatus.cpp

@@ -37,7 +37,7 @@
 // player object is ready, and stay stable across zone transitions.
 
 #include "Game.h"
-#include "Offsets.h"
+#include "unit/Identity.h"
 
 #include <cstdint>
 
@@ -46,15 +46,7 @@ namespace Player::LoginStatus {
 namespace {
 
 int __fastcall Script_IsLoggedIn(void *L) {
-    auto *player = *reinterpret_cast<const uint8_t *const *>(
-        Offsets::VAR_LOCAL_PLAYER_PTR);
-    if (player == nullptr) {
-        Game::Lua::PushBool(L, false);
-        return 1;
-    }
-    const uint64_t guid = *reinterpret_cast<const uint64_t *>(
-        player + Offsets::OFF_LOCAL_PLAYER_GUID);
-    Game::Lua::PushBool(L, guid != 0);
+    Game::Lua::PushBool(L, Unit::Identity::PlayerGuid() != 0);
     return 1;
 }
 

src/player/NameCache.cpp

@@ -62,6 +62,7 @@
 #include "Offsets.h"
 #include "guid/Guid.h"
 #include "settings/Account.h"
+#include "unit/Identity.h"
 
 #include <cstdint>
 #include <cstdio>
@@ -467,14 +468,7 @@ UnitBytes0 ReadBytes0(void *unit) {
 // on the local CGPlayer_C type, or it is but returns 0x1 to mean
 // "no remote name; ask the local source." Either way we don't need
 // to cache ourselves — we have the data via every other path.
-uint64_t LocalPlayerGUID() {
-    auto *player = *reinterpret_cast<uint8_t *const *>(
-        static_cast<uintptr_t>(Offsets::VAR_LOCAL_PLAYER_PTR));
-    if (player == nullptr)
-        return 0;
-    return *reinterpret_cast<const uint64_t *>(
-        player + Offsets::OFF_LOCAL_PLAYER_GUID);
-}
+uint64_t LocalPlayerGUID() { return Unit::Identity::PlayerGuid(); }
 
 // Pointer sanity check before dereferencing. The CGObject vftable
 // GetName slot has at least one known case where it returns 0x1

src/spell/Cast.cpp

@@ -17,26 +17,41 @@
 // Vanilla 1.12 stores NO cast start/end times anywhere readable (unlike
 // 3.3.5+, which keeps them per-unit on the CGUnit). The cast bar is
 // Lua-driven off `SPELLCAST_START(duration)` + `GetTime()`. So we
-// self-track the LOCAL PLAYER's cast/channel on `WorldTick`:
-//   - cast: `VAR_CURRENT_CAST_SPELL` (the player cast-bar spellID
-//     global). On a 0->nonzero transition we stamp startMs = now and
-//     endMs = now + base cast time (SpellCastTimes.dbc). Instant casts
-//     (cast time 0) and channels are filtered out here — a channel has
-//     no cast time and surfaces through the channel field instead.
+// self-track the LOCAL PLAYER's cast/channel with a HYBRID of two sources:
+//   - Normal casts (client path): co-hook the engine's cast-start writer
+//     `FUN_CAST_START_SET` and stamp from its spellID argument the instant
+//     the cast begins (startMs = now, endMs = now + effective cast time) —
+//     zero latency. `g_castFromServer = false`; cleared on `WorldTick` when
+//     `VAR_CURRENT_CAST_SPELL` returns to 0 (normal end / cancel / interrupt).
+//   - Chained same-spell recasts (server path): the engine SHORT-CIRCUITS
+//     `Spell_C_CastSpell` at `spellID == VAR_CURRENT_CAST_SPELL` — it never
+//     runs the client cast path, never sets the global, never fires
+//     SPELLCAST_START. So a chained recast is invisible client-side; the
+//     ONLY witness is the server's `SMSG_SPELL_START` (= nampower's
+//     SPELL_START_SELF). We stamp `g_cast` from that packet (server cast
+//     time), dedup'd against a just-made client stamp so a normal cast's
+//     confirming packet doesn't restart its bar. `g_castFromServer = true`;
+//     since the global was never set for these, the WorldTick VAR==0 clear
+//     must skip them — they expire on their computed endMs (and pfUI clears
+//     on nampower's SPELL_FAILED_SELF for interrupts).
 //   - channel: the player's broadcast `UNIT_FIELD_CHANNEL_SPELL`
-//     (descriptor +0x228). endMs = now + base channel duration
-//     (SpellDuration.dbc).
+//     (descriptor +0x228), polled on `WorldTick`. endMs = now + effective
+//     channel duration.
 // `now` is the engine ms clock (`FUN_OS_TICKCOUNT_MS`), the same source
 // Lua's `GetTime()` scales by 0.001 — so startMs/endMs are directly
 // comparable to `GetTime()*1000` in addon progress math.
 //
-// Scope (vanilla ceiling, confirmed against the binary — see TODO #68):
-//   - Player casts/channels: full timing.
-//   - Other units' CHANNELS: spellID/name/texture from the broadcast
-//     +0x228 field, but no times (we don't track per-remote-unit start).
-//   - Other units' regular CASTS: nil. Vanilla doesn't store them — the
-//     casting animation is driven by transient spell-visual objects, not
-//     a queryable cast record.
+// Other units have no engine-stored cast record, so we capture their casts
+// from the `SMSG_SPELL_START` packet (the only place the client sees
+// another unit's cast + a server-authoritative cast time) into a per-caster
+// cache — see the SpellStart co-hook below. Scope:
+//   - Player casts/channels: full timing (self-tracked, exact engine math).
+//   - Other units' regular CASTS: full timing while within the cast window,
+//     from the SpellStart cache. No clean per-unit interrupt signal exists
+//     in 1.12, so an interrupted remote cast lingers until its computed end.
+//   - Other units' CHANNELS: the broadcast +0x228 field gates "channeling
+//     now"; the SpellStart cache adds real start/end times when we observed
+//     the channel begin (else spellID/name/texture with nil times).
 //
 // Modern-signature fields vanilla can't fill are structurally-correct
 // placeholders: castID / castBarID = nil, notInterruptible = false,
@@ -45,8 +60,10 @@
 #include "Game.h"
 #include "Offsets.h"
 #include "dbc/Lookup.h"
+#include "net/PacketReader.h"
 #include "spell/Lookup.h"
 #include "tick/WorldTick.h"
+#include "unit/Identity.h"
 
 #include <cstdint>
 
@@ -75,12 +92,17 @@ struct TrackedSpell {
     int spellID; // 0 = not casting / channeling
     int startMs;
     int endMs;
+    int delayMs; // accumulated pushback (SMSG_SPELL_DELAYED), 0 = none
 };
 
-TrackedSpell g_cast{0, 0, 0};
-TrackedSpell g_channel{0, 0, 0};
-int g_lastCast = 0;
-int g_lastChannel = 0;
+TrackedSpell g_cast{0, 0, 0, 0};
+TrackedSpell g_channel{0, 0, 0, 0};
+
+// True when g_cast was stamped from SMSG_SPELL_START (a chained same-spell
+// recast the client cast path bailed on) rather than the client-side
+// FUN_CAST_START_SET hook. Such casts never set VAR_CURRENT_CAST_SPELL, so
+// the WorldTick VAR==0 clear must not touch them.
+bool g_castFromServer = false;
 
 int NowMs() { return static_cast<int>(reinterpret_cast<TickMs_t>(Offsets::FUN_OS_TICKCOUNT_MS)()); }
 
@@ -110,18 +132,6 @@ int ChannelDurationMs(int spellID) {
     return ms > 0 ? ms : 0; // negative = "infinite"; channels are finite
 }
 
-// The local player's currently-channeled spellID (broadcast +0x228), or 0.
-int PlayerChannelSpell() {
-    void *p = Resolve("player");
-    if (p == nullptr)
-        return 0;
-    auto *desc = *reinterpret_cast<const uint8_t *const *>(
-        static_cast<const uint8_t *>(p) + Offsets::OFF_UNIT_DESCRIPTOR);
-    if (desc == nullptr)
-        return 0;
-    return *reinterpret_cast<const int *>(desc + Offsets::OFF_UNIT_FIELD_CHANNEL_SPELL);
-}
-
 const char *SpellName(const uint8_t *rec) {
     const int locale = *reinterpret_cast<int *>(Offsets::VAR_LOCALE_INDEX);
     return *reinterpret_cast<const char *const *>(rec + OFF_NAME + locale * 4);
@@ -150,6 +160,12 @@ const char *SpellIconPath(const uint8_t *rec) {
 int PushCastInfo(void *L, const TrackedSpell &c) {
     if (c.spellID == 0)
         return 0;
+    // Self-expire: once the cast window has elapsed, report nothing even if
+    // the slot wasn't explicitly cleared. Keeps a stale cast (e.g. one whose
+    // clear we missed) from lingering on an addon's cast bar, and lets a
+    // fresh stamp for the next cast take over cleanly.
+    if (NowMs() >= c.endMs)
+        return 0;
     const uint8_t *rec = Spell::Lookup::RecordForID(c.spellID);
     if (rec == nullptr)
         return 0;
@@ -164,7 +180,7 @@ int PushCastInfo(void *L, const TrackedSpell &c) {
     Game::Lua::PushBool(L, false);                           // 8 notInterruptible
     Game::Lua::PushNumber(L, static_cast<double>(c.spellID)); // 9 castingSpellID
     Game::Lua::PushNil(L);                                   // 10 castBarID
-    Game::Lua::PushNumber(L, 0);                             // 11 delayTimeMs
+    Game::Lua::PushNumber(L, static_cast<double>(c.delayMs)); // 11 delayTimeMs
     return 11;
 }
 
@@ -173,6 +189,12 @@ int PushCastInfo(void *L, const TrackedSpell &c) {
 int PushChannelInfo(void *L, int spellID, int startMs, int endMs, bool haveTimes) {
     if (spellID == 0)
         return 0;
+    // Self-expire a timed channel once its window elapses (mirrors
+    // PushCastInfo) — this is how the player's channel clears, since we no
+    // longer poll the +0x228 field. Remote callers gate on endMs before
+    // passing haveTimes, so this is a no-op for them.
+    if (haveTimes && endMs != 0 && NowMs() >= endMs)
+        return 0;
     const uint8_t *rec = Spell::Lookup::RecordForID(spellID);
     if (rec == nullptr)
         return 0;
@@ -193,43 +215,240 @@ int PushChannelInfo(void *L, int spellID, int startMs, int endMs, bool haveTimes
     return 8;
 }
 
-// True if the unit at stack index 1 resolves to the local player.
-bool ArgIsPlayer(void *L) {
-    if (!Game::Lua::IsString(L, 1))
-        return false;
-    const char *token = Game::Lua::ToString(L, 1);
-    if (token == nullptr)
-        return false;
-    void *u = Resolve(token);
-    return u != nullptr && u == Resolve("player");
+// ---- Player cast detection (FUN_CAST_START_SET co-hook) ------------------
+
+// The engine's cast-start writer — the client path for a NORMAL cast. We
+// stamp from its spellID argument the instant the cast begins (zero
+// latency), *before* the original so any SPELLCAST_START it triggers sees
+// fresh times. This does NOT fire for a chained same-spell recast — the
+// caller (Spell_C_CastSpell) bails at `spellID == VAR_CURRENT_CAST_SPELL`
+// before ever reaching this writer; those are caught by the SMSG_SPELL_START
+// path instead. The `spellID == 0` (queued-restore / clear) path is left to
+// the OnWorldTick VAR==0 poll so a restore doesn't prematurely wipe a bar.
+using CastStartSet_t = void(__fastcall *)(int spellID, int targetState);
+CastStartSet_t g_origCastStartSet = nullptr;
+
+void __fastcall CastStartSet_h(int spellID, int targetState) {
+    if (spellID != 0) {
+        const int dur = CastTimeMs(spellID);
+        if (dur > 0) {
+            const int now = NowMs();
+            g_cast = TrackedSpell{spellID, now, now + dur, 0};
+            g_castFromServer = false; // client-tracked; VAR==0 clears it
+            g_channel.spellID = 0;    // a cast supersedes any channel
+        }
+        // dur == 0: instant (no bar) or channel (handled via +0x228 poll);
+        // leave g_cast — don't clobber an unrelated active cast.
+    }
+    g_origCastStartSet(spellID, targetState);
 }
 
+const Game::HookAutoRegister _castStartHook{
+    Offsets::FUN_CAST_START_SET, reinterpret_cast<void *>(&CastStartSet_h),
+    reinterpret_cast<void **>(&g_origCastStartSet)};
+
+// ---- Remote-unit cast tracking (SMSG_SPELL_START) ------------------------
+
+// Vanilla stores no cast record for other units, so we capture their casts
+// from SMSG_SPELL_START — the only packet carrying another unit's cast with
+// a server-authoritative cast time. Keyed by caster GUID (a unit casts one
+// thing at a time). Regular casts back `UnitCastingInfo`; channels add real
+// times to `UnitChannelInfo` (validated against the live +0x228 field).
+
+constexpr int OFF_ATTRIBUTES_EX = 0x1C; // Spell.dbc AttributesEx
+constexpr uint32_t SPELL_ATTR_EX_CHANNELED = 0x4 | 0x40; // IS_CHANNELED | SELF
+
+bool IsChannelSpell(const uint8_t *rec) {
+    return (*reinterpret_cast<const uint32_t *>(rec + OFF_ATTRIBUTES_EX) &
+            SPELL_ATTR_EX_CHANNELED) != 0;
+}
+
+// Channel duration for a non-player caster — base (skipMod=1), since we
+// only have the local player's spell-mod tables.
+int RemoteChannelDurationMs(const uint8_t *rec) {
+    const int ms = reinterpret_cast<GetDuration_t>(
+        Offsets::FUN_GET_SPELL_DURATION)(rec, 0, /*skipMod*/ 1);
+    return ms > 0 ? ms : 0;
+}
+
+struct RemoteCast {
+    uint64_t casterGuid;
+    int spellID;
+    int startMs;
+    int endMs;
+    bool isChannel;
+    bool used;
+};
+
+constexpr int kRemoteCastSlots = 64;
+RemoteCast g_remoteCasts[kRemoteCastSlots];
+int g_remoteCursor = 0;
+
+void StoreRemoteCast(uint64_t caster, int spellID, int startMs, int endMs,
+                     bool isChannel) {
+    const RemoteCast entry{caster, spellID, startMs, endMs, isChannel, true};
+    // One active cast per unit — replace any existing entry for this caster.
+    for (auto &e : g_remoteCasts) {
+        if (e.used && e.casterGuid == caster) {
+            e = entry;
+            return;
+        }
+    }
+    const int now = NowMs();
+    for (auto &e : g_remoteCasts) {
+        if (!e.used || now >= e.endMs) {
+            e = entry;
+            return;
+        }
+    }
+    g_remoteCasts[g_remoteCursor] = entry;
+    g_remoteCursor = (g_remoteCursor + 1) % kRemoteCastSlots;
+}
+
+const RemoteCast *FindRemoteCast(uint64_t caster) {
+    if (caster == 0)
+        return nullptr;
+    for (const auto &e : g_remoteCasts) {
+        if (e.used && e.casterGuid == caster)
+            return &e;
+    }
+    return nullptr;
+}
+
+// How recently the client-side FUN_CAST_START_SET hook must have stamped the
+// same spell for an SMSG_SPELL_START to count as that cast's confirming
+// packet (skip — don't restart the bar) rather than a new chained recast
+// (stamp). Must exceed worst-case latency but stay under a GCD / min cast
+// time so genuine chained casts aren't wrongly deduped.
+constexpr int kCastStartDedupMs = 500;
+
+void HandleSpellStart(uint64_t caster, int spellID, uint32_t castTime) {
+    if (caster == 0 || spellID == 0)
+        return;
+    const uint8_t *rec = Spell::Lookup::RecordForID(spellID);
+    if (rec == nullptr)
+        return;
+    const int now = NowMs();
+    const bool channel = IsChannelSpell(rec);
+
+    if (caster == Unit::Identity::PlayerGuid()) {
+        if (channel) {
+            // Player channel start. The broadcast +0x228 field that signals
+            // "channeling" is server-pushed and lands ~1 tick (~1s) after the
+            // channel actually begins, so a +0x228 poll shows the bar far too
+            // late — the addon already polled nil at SPELLCAST_CHANNEL_START
+            // and cleared. This packet IS the channel start: stamp g_channel
+            // now with the engine-computed duration. We run before the
+            // original handler that fires SPELLCAST_CHANNEL_START, so the data
+            // is fresh when addons poll. Cleared by self-expiry (PushChannel-
+            // Info) at endMs.
+            const int dur = ChannelDurationMs(spellID);
+            if (dur > 0) {
+                g_channel = TrackedSpell{spellID, now, now + dur, 0};
+                g_cast.spellID = 0; // a channel supersedes any cast
+            }
+            return;
+        }
+        if (castTime == 0)
+            return; // instant — no cast bar
+        // Backstop for chained same-spell recasts: the engine short-circuits
+        // Spell_C_CastSpell at `spellID == VAR_CURRENT_CAST_SPELL`, so the
+        // client path (FUN_CAST_START_SET hook) never fires for them — this
+        // server packet is the only signal. Dedup against a fresh client stamp
+        // (same spell, started within ~latency) so a normal cast's confirming
+        // packet doesn't restart its bar; otherwise it's a chained recast the
+        // client bailed on — take it, and flag it so the VAR==0 poll (which
+        // never saw it) won't clear it.
+        if (g_cast.spellID == spellID && now < g_cast.endMs &&
+            now - g_cast.startMs < kCastStartDedupMs)
+            return;
+        g_cast = TrackedSpell{spellID, now, now + static_cast<int>(castTime), 0};
+        g_castFromServer = true;
+        g_channel.spellID = 0; // a cast supersedes any channel
+        return;
+    }
+    const int endMs = channel ? now + RemoteChannelDurationMs(rec)
+                              : now + static_cast<int>(castTime);
+    StoreRemoteCast(caster, spellID, now, endMs, channel);
+}
+
+// Co-hook on the SMSG_SPELL_START handler. Gated on opCode 0x131 so every
+// other packet this handler processes is a cheap early-out. Packet layout
+// mirrors nampower's SpellStartHandlerHook.
+using SpellStartHandler_t = int(__fastcall *)(uint32_t unk, uint32_t opCode,
+                                              uint32_t unk2,
+                                              Net::CDataStore *packet);
+SpellStartHandler_t g_origSpellStart = nullptr;
+
+int __fastcall SpellStartHandler_h(uint32_t unk, uint32_t opCode,
+                                   uint32_t unk2, Net::CDataStore *packet) {
+    if (opCode == 0x131 && packet != nullptr) {
+        const uint32_t saved = packet->m_read;
+        Net::ReadPackedGuid(packet); // itemGuid (unused)
+        const uint64_t caster = Net::ReadPackedGuid(packet);
+        const int spellID = static_cast<int>(Net::Read<uint32_t>(packet));
+        Net::Read<uint16_t>(packet); // castFlags (unused)
+        const uint32_t castTime = Net::Read<uint32_t>(packet);
+        packet->m_read = saved; // restore before the engine re-parses
+        HandleSpellStart(caster, spellID, castTime);
+    }
+    return g_origSpellStart(unk, opCode, unk2, packet);
+}
+
+const Game::HookAutoRegister _spellStartHook{
+    Offsets::FUN_SPELL_START_HANDLER,
+    reinterpret_cast<void *>(&SpellStartHandler_h),
+    reinterpret_cast<void **>(&g_origSpellStart)};
+
+// Co-hook on the SMSG_SPELL_DELAYED handler — cast pushback. The server
+// only sends it to the affected caster, so it's effectively always the
+// local player; extend the tracked cast's end time (and report the
+// accumulated delay as delayTimeMs) so an addon's bar stretches on damage.
+using SpellDelayed_t = int(__stdcall *)(uint32_t *opCode,
+                                        Net::CDataStore *packet);
+SpellDelayed_t g_origSpellDelayed = nullptr;
+
+int __stdcall SpellDelayed_h(uint32_t *opCode, Net::CDataStore *packet) {
+    if (packet != nullptr) {
+        const uint32_t saved = packet->m_read;
+        const uint64_t guid = Net::Read<uint64_t>(packet);
+        const uint32_t delay = Net::Read<uint32_t>(packet);
+        packet->m_read = saved;
+        if (delay != 0 && g_cast.spellID != 0 &&
+            guid == Unit::Identity::PlayerGuid()) {
+            g_cast.endMs += static_cast<int>(delay);
+            g_cast.delayMs += static_cast<int>(delay);
+        }
+    }
+    return g_origSpellDelayed(opCode, packet);
+}
+
+const Game::HookAutoRegister _spellDelayedHook{
+    Offsets::FUN_SPELL_DELAYED, reinterpret_cast<void *>(&SpellDelayed_h),
+    reinterpret_cast<void **>(&g_origSpellDelayed)};
+
 } // namespace
 
-// Per-frame: detect the player's cast/channel start, stamp times.
+// Per-frame upkeep for the player. The regular cast is stamped by the
+// FUN_CAST_START_SET hook; here we clear it when the engine's cast global
+// drops to 0, and poll the broadcast +0x228 field for the channel (which
+// has no comparable client-side start hook).
 void OnWorldTick() {
-    const int now = NowMs();
+    // Clear a CLIENT-tracked cast when the cast global returns to 0 — covering
+    // normal end, cancel, and interrupt. No grace window is needed: the
+    // FUN_CAST_START_SET hook stamps g_cast in the same call that writes the
+    // global non-zero, so it's never transiently 0 right after a stamp.
+    // Server-stamped chained casts (g_castFromServer) never set the global,
+    // so they're exempt — they expire on their computed endMs (self-expiry in
+    // PushCastInfo).
+    if (g_cast.spellID != 0 && !g_castFromServer &&
+        *reinterpret_cast<const int *>(Offsets::VAR_CURRENT_CAST_SPELL) == 0)
+        g_cast.spellID = 0;
 
-    const int cast = *reinterpret_cast<const int *>(Offsets::VAR_CURRENT_CAST_SPELL);
-    if (cast != g_lastCast) {
-        const int dur = (cast != 0) ? CastTimeMs(cast) : 0;
-        if (cast != 0 && dur > 0) {
-            g_cast = {cast, now, now + dur};
-        } else {
-            g_cast.spellID = 0; // 0, instant, or channel — no cast bar
-        }
-        g_lastCast = cast;
-    }
-
-    const int chan = PlayerChannelSpell();
-    if (chan != g_lastChannel) {
-        if (chan != 0) {
-            g_channel = {chan, now, now + ChannelDurationMs(chan)};
-        } else {
-            g_channel.spellID = 0;
-        }
-        g_lastChannel = chan;
-    }
+    // Channels are stamped from SMSG_SPELL_START (HandleSpellStart) and expire
+    // on their computed endMs (self-expiry in PushChannelInfo). We don't poll
+    // the broadcast +0x228 field for the player — it lags the channel start by
+    // ~1 tick, so the bar would show ~1s late.
 }
 
 static const Tick::WorldTick::AutoSubscribe _tickSub{&OnWorldTick};
@@ -237,15 +456,25 @@ static const Tick::WorldTick::AutoSubscribe _tickSub{&OnWorldTick};
 // `CastingInfo()` — local player's cast, no token lookup.
 static int __fastcall Script_CastingInfo(void *L) { return PushCastInfo(L, g_cast); }
 
-// `UnitCastingInfo(unit)` — only the local player has regular-cast data
-// in vanilla; any other unit returns nil.
+// `UnitCastingInfo(unit)` — local player from self-tracking; other units
+// from the SMSG_SPELL_START cache (regular casts still within their cast
+// window). An interrupted remote cast lingers until its computed end time
+// (no clean per-unit interrupt signal in 1.12) — acceptable best-effort.
 static int __fastcall Script_UnitCastingInfo(void *L) {
     if (!Game::Lua::IsString(L, 1)) {
         Game::Lua::Error(L, "Usage: C_Spell.UnitCastingInfo(\"unit\")");
         return 0;
     }
-    if (ArgIsPlayer(L))
+    const char *token = Game::Lua::ToString(L, 1);
+    void *u = (token != nullptr) ? Resolve(token) : nullptr;
+    if (u == nullptr)
+        return 0;
+    if (u == Resolve("player"))
         return PushCastInfo(L, g_cast);
+
+    const RemoteCast *rc = FindRemoteCast(Unit::Identity::GuidForObject(u));
+    if (rc != nullptr && !rc->isChannel && NowMs() < rc->endMs)
+        return PushCastInfo(L, TrackedSpell{rc->spellID, rc->startMs, rc->endMs});
     return 0;
 }
 
@@ -272,7 +501,15 @@ static int __fastcall Script_UnitChannelInfo(void *L) {
         static_cast<const uint8_t *>(u) + Offsets::OFF_UNIT_DESCRIPTOR);
     if (desc == nullptr)
         return 0;
+    // The live +0x228 field is authoritative for "is this unit channeling
+    // right now"; the SMSG_SPELL_START cache adds real start/end times when
+    // we observed the channel begin (and still matches the current spell).
     const int spellID = *reinterpret_cast<const int *>(desc + Offsets::OFF_UNIT_FIELD_CHANNEL_SPELL);
+    if (spellID == 0)
+        return 0;
+    const RemoteCast *rc = FindRemoteCast(Unit::Identity::GuidForObject(u));
+    if (rc != nullptr && rc->isChannel && rc->spellID == spellID && NowMs() < rc->endMs)
+        return PushChannelInfo(L, spellID, rc->startMs, rc->endMs, /*haveTimes*/ true);
     return PushChannelInfo(L, spellID, 0, 0, /*haveTimes*/ false);
 }
 

src/unit/Identity.cpp

@@ -11,6 +11,8 @@
 // You should have received a copy of the GNU Lesser General Public License along with
 // ClassicAPI. If not, see <https://www.gnu.org/licenses/>.
 
+#include "unit/Identity.h"
+
 #include "Game.h"
 #include "Offsets.h"
 #include "guid/Guid.h"
@@ -44,15 +46,29 @@ using TokenToGUID_t = uint64_t(__fastcall *)(const char *token);
 // `FUN_00468550() != 0` for the same reason — the GUID isn't ready
 // yet. Addons that need the player GUID at boot must wait for
 // `PLAYER_LOGIN`. See the trace notes in commit history.
-static uint64_t ResolveTokenGUID(const char *token) {
-    if (token != nullptr && _stricmp(token, "player") == 0) {
-        auto *player = *reinterpret_cast<uint8_t *const *>(
-            static_cast<uintptr_t>(Offsets::VAR_LOCAL_PLAYER_PTR));
-        if (player == nullptr)
-            return 0;
-        return *reinterpret_cast<const uint64_t *>(
-            player + Offsets::OFF_LOCAL_PLAYER_GUID);
-    }
+uint64_t PlayerGuid() {
+    auto *player = *reinterpret_cast<uint8_t *const *>(
+        static_cast<uintptr_t>(Offsets::VAR_LOCAL_PLAYER_PTR));
+    if (player == nullptr)
+        return 0;
+    return *reinterpret_cast<const uint64_t *>(
+        player + Offsets::OFF_LOCAL_PLAYER_GUID);
+}
+
+uint64_t GuidForObject(const void *unitObject) {
+    if (unitObject == nullptr)
+        return 0;
+    const auto *unit = static_cast<const uint8_t *>(unitObject);
+    const uint8_t *block = *reinterpret_cast<const uint8_t *const *>(
+        unit + Offsets::OFF_UNIT_GUID_PTR);
+    if (block == nullptr)
+        return 0;
+    return *reinterpret_cast<const uint64_t *>(block);
+}
+
+uint64_t GuidForToken(const char *token) {
+    if (token != nullptr && _stricmp(token, "player") == 0)
+        return PlayerGuid();
     auto fn = reinterpret_cast<TokenToGUID_t>(Offsets::FUN_TOKEN_TO_GUID);
     return fn(token);
 }
@@ -92,7 +108,7 @@ static int __fastcall Script_UnitGUID(void *L) {
     if (token == nullptr)
         return 0;
 
-    const uint64_t guid = ResolveTokenGUID(token);
+    const uint64_t guid = GuidForToken(token);
     if (guid == 0)
         return 0;
 
@@ -127,25 +143,20 @@ static int __fastcall Script_UnitGUID(void *L) {
 //
 // Returns `nil` if the input string isn't a parseable GUID, or the
 // GUID is zero, or no token currently maps to it.
-static int __fastcall Script_UnitTokenFromGUID(void *L) {
-    if (!Game::Lua::IsString(L, 1)) {
-        Game::Lua::Error(L, "Usage: UnitTokenFromGUID(\"unitGUID\")");
-        return 0;
-    }
-    const char *guidStr = Game::Lua::ToString(L, 1);
-    uint64_t target = 0;
-    if (guidStr == nullptr || !Guid::Parse(guidStr, &target) || target == 0)
-        return 0;
+const char *TokenFromGUID(uint64_t target, char *buf, size_t bufSize) {
+    if (target == 0)
+        return nullptr;
 
+    auto set = [&](const char *token) -> const char * {
+        std::snprintf(buf, bufSize, "%s", token);
+        return buf;
+    };
     auto check = [&](const char *token) -> bool {
-        if (ResolveTokenGUID(token) != target)
-            return false;
-        Game::Lua::PushString(L, token);
-        return true;
+        return GuidForToken(token) == target;
     };
 
-    if (check("player")) return 1;
-    if (check("pet")) return 1;
+    if (check("player")) return set("player");
+    if (check("pet")) return set("pet");
 
     // Cap each indexed-token scan at the actual populated slot
     // count, read straight out of engine memory. Solo skips all 88
@@ -170,22 +181,21 @@ static int __fastcall Script_UnitTokenFromGUID(void *L) {
     if (raidCount > Offsets::RAID_MAX_SLOTS)
         raidCount = Offsets::RAID_MAX_SLOTS;
 
-    char buf[16];
     for (int i = 1; i <= partyCount; ++i) {
-        std::snprintf(buf, sizeof buf, "party%d", i);
-        if (check(buf)) return 1;
+        std::snprintf(buf, bufSize, "party%d", i);
+        if (GuidForToken(buf) == target) return buf;
     }
     for (int i = 1; i <= partyCount; ++i) {
-        std::snprintf(buf, sizeof buf, "partypet%d", i);
-        if (check(buf)) return 1;
+        std::snprintf(buf, bufSize, "partypet%d", i);
+        if (GuidForToken(buf) == target) return buf;
     }
     for (int i = 1; i <= raidCount; ++i) {
-        std::snprintf(buf, sizeof buf, "raid%d", i);
-        if (check(buf)) return 1;
+        std::snprintf(buf, bufSize, "raid%d", i);
+        if (GuidForToken(buf) == target) return buf;
     }
     for (int i = 1; i <= raidCount; ++i) {
-        std::snprintf(buf, sizeof buf, "raidpet%d", i);
-        if (check(buf)) return 1;
+        std::snprintf(buf, bufSize, "raidpet%d", i);
+        if (GuidForToken(buf) == target) return buf;
     }
 
     // Visible nameplates. The ordered list (see
@@ -198,18 +208,35 @@ static int __fastcall Script_UnitTokenFromGUID(void *L) {
         if (plateGuid == 0)
             break;
         if (plateGuid == target) {
-            std::snprintf(buf, sizeof buf, "nameplate%d", i);
-            Game::Lua::PushString(L, buf);
-            return 1;
+            std::snprintf(buf, bufSize, "nameplate%d", i);
+            return buf;
         }
     }
 
-    if (check("target")) return 1;
-    if (check("focus")) return 1;
-    if (check("npc")) return 1;
-    if (check("mouseover")) return 1;
+    if (check("target")) return set("target");
+    if (check("focus")) return set("focus");
+    if (check("npc")) return set("npc");
+    if (check("mouseover")) return set("mouseover");
 
-    return 0;
+    return nullptr;
+}
+
+static int __fastcall Script_UnitTokenFromGUID(void *L) {
+    if (!Game::Lua::IsString(L, 1)) {
+        Game::Lua::Error(L, "Usage: UnitTokenFromGUID(\"unitGUID\")");
+        return 0;
+    }
+    const char *guidStr = Game::Lua::ToString(L, 1);
+    uint64_t target = 0;
+    if (guidStr == nullptr || !Guid::Parse(guidStr, &target) || target == 0)
+        return 0;
+
+    char buf[32];
+    const char *token = TokenFromGUID(target, buf, sizeof buf);
+    if (token == nullptr)
+        return 0;
+    Game::Lua::PushString(L, token);
+    return 1;
 }
 
 static void RegisterLuaFunctions() {

src/unit/Identity.h

@@ -0,0 +1,55 @@
+// This file is part of ClassicAPI.
+//
+// ClassicAPI is free software: you can redistribute it and/or modify it under the terms
+// of the GNU Lesser General Public License as published by the Free Software Foundation, either
+// version 3 of the License, or (at your option) any later version.
+//
+// ClassicAPI is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+// PURPOSE. See the GNU Lesser General Public License for more details.
+
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+// Unit identity helpers shared across modules. The Lua surface
+// (`UnitGUID` / `UnitTokenFromGUID`) lives in `Identity.cpp`; these are the
+// reusable C++ cores other modules call directly (e.g. `Aura::Data`
+// resolving an aura's caster GUID to a `sourceUnit` token).
+
+namespace Unit::Identity {
+
+// The local player's 64-bit GUID, read from the canonical local-player
+// pointer (`VAR_LOCAL_PLAYER_PTR + OFF_LOCAL_PLAYER_GUID`). Independent of
+// object-manager state, so it stays valid across zone transitions / brief
+// CGPlayer rebuilds. Returns 0 before login (pointer null) or before the
+// GUID is populated. This is the canonical "who am I" read — prefer it over
+// re-dereferencing the globals inline.
+uint64_t PlayerGuid();
+
+// The 64-bit GUID of a resolved CGUnit/CGObject pointer, read through the
+// pointer at `+0x08` to an instance block whose first 8 bytes are the GUID
+// (verified in `Script_GetInventoryItemLink`; see `OFF_UNIT_GUID_PTR`).
+// Returns 0 if `unitObject` or the block pointer is null. Use this for any
+// "GUID of this object pointer" read so callers stay consistent (the aura
+// caster cache keys on it from both the lookup and the OnAuraAdded hook).
+uint64_t GuidForObject(const void *unitObject);
+
+// Resolves a unit token (`"player"`, `"target"`, `"party3"`, …) to its
+// 64-bit GUID, or 0 if the token currently maps to nothing. `"player"` is
+// read from the canonical local-player pointer so it works regardless of
+// object-manager state; everything else goes through the engine's
+// token→GUID resolver (so out-of-range party/raid members resolve too).
+// NOTE: raises a Lua error for tokens the engine doesn't recognize — only
+// pass known unit tokens.
+uint64_t GuidForToken(const char *token);
+
+// Best-effort reverse lookup: given a unit GUID, writes the first unit
+// token currently mapped to it into `buf` and returns `buf`, or returns
+// nullptr if no known token points at it (or `guid` is 0). The mapping is
+// unstable across frames — callers should treat the result as a snapshot.
+// `buf` should be at least 32 bytes.
+const char *TokenFromGUID(uint64_t guid, char *buf, size_t bufSize);
+
+} // namespace Unit::Identity