[toby-wong]

Windows sign-in failures such as -80046/HTTP 503 need an authentication-data source whose client identity stays consistent through GrandSlam and verification. This draft adds an opt-in external header provider to the native Windows implementation, rather than hard-coding another Mac user-agent string onto locally generated Windows data.

Behavior

• ALTSERVER_ANISETTE_SERVER selects a provider base URL. AltServer fetches the header dictionary from the base endpoint and client_info/user_agent from v3/client_info. There is no default public provider; without configuration, local iTunes anisette remains the source.
• Provider data supplies both the client description and user agent. Fresh data is fetched before GSA/verification requests, including updates to cpd before app-token requests. Identity changes mid-sign-in fail before replacing the existing OTP. Provider-backed GSA requests use fresh TLS-validated clients.
• Handle Apple's already-pushed trusted-device code (hsc=409, absent/empty au) without requesting a replacement. Surface non-2xx authentication HTTP status without echoing response bodies.
• Require HTTPS except on loopback; disable provider redirects; bound provider responses to 16 KiB and SDK request timeouts to 15 seconds. External failures do not reset local ADI files. The existing AltStore TCP format and USB/device-selection path remain in place.

The adapter uses a provider-managed header API, not a new per-client anisette-v3 provisioning/WebSocket implementation. V3-only servers without the base header endpoint are unsupported. Configuration and that boundary are documented in docs/external-anisette.md.

Validation and draft status

• MSVC v142, Windows SDK 10.0.19041: 18 native cases and 9 loopback HTTP cases passed on Win32 and x64.
• The changed production authentication translation unit compiled on both architectures using Tests/AuthenticationCompile.vcxproj.
• A credential-free native provider fetch/refresh compatibility probe succeeded against a Mac-based header provider. This does not establish successful Apple account authentication.
• Still required before release: full application build/link and end-to-end native AltServer Apple sign-in, 2FA, reinstall and refresh tests. The normal application build here was blocked by missing baseline dependencies (including the libimobiledevice-vs project and cpprest include setup). No installed AltServer was replaced for this draft.

Related work and base

Related: #51 (closed Windows GSA transport/user-agent proposal), rileytestut/AltSign#61 (provider identity), rileytestut/AltSign#59 (fresh anisette and pushed-code handling), altstoreio/AltStore#1840.

Targets 1.7.4, matching #51; the public master/develop branches are older. This is intentionally draft for author review and native end-to-end validation, not a claim that every Apple authentication failure is resolved.