@@ -62,19 +62,28 @@ set(ROBOT_COMMON_SOURCES
     src/common/Image.cpp
     src/common/Recorder.cpp
     src/common/EventTap.cpp
+    src/common/Windows.cpp
 )
 
 # ── Platform selection: exactly one directory is compiled ─────────────────────
 # This is the single compile boundary. No consumer translation unit contains a
 # platform #ifdef; the platform is chosen here, once.
 if(APPLE)
+    # The window backend talks to ScreenCaptureKit, which has no C API.
+    enable_language(OBJCXX)
+    set(CMAKE_OBJCXX_STANDARD 23)
+    set(CMAKE_OBJCXX_STANDARD_REQUIRED ON)
     set(ROBOT_PLATFORM_SOURCES
         src/platform/macos/MacBackendFactory.cpp
         src/platform/macos/MacKeyMap.cpp
         src/platform/macos/MacKeyboardBackend.cpp
         src/platform/macos/MacMouseBackend.cpp
         src/platform/macos/MacScreenBackend.cpp
         src/platform/macos/MacEventTapBackend.cpp
+        src/platform/macos/MacWindowBackend.mm
+    )
+    set_source_files_properties(src/platform/macos/MacWindowBackend.mm
+        PROPERTIES COMPILE_OPTIONS "-fobjc-arc"
     )
 elseif(WIN32)
     set(ROBOT_PLATFORM_SOURCES
@@ -136,9 +145,19 @@ set_target_properties(robot PROPERTIES POSITION_INDEPENDENT_CODE ON)
 # ── Platform dependencies, scoped per target ──────────────────────────────────
 if(APPLE)
     find_library(APPLICATION_SERVICES ApplicationServices REQUIRED)
-    # ApplicationServices types appear only in .cpp files (behind the backend
-    # interfaces), so the dependency is PRIVATE. Carbon is intentionally NOT used.
-    target_link_libraries(robot PRIVATE ${APPLICATION_SERVICES})
+    find_library(SCREEN_CAPTURE_KIT ScreenCaptureKit REQUIRED)
+    find_library(CORE_MEDIA CoreMedia REQUIRED)
+    find_library(CORE_VIDEO CoreVideo REQUIRED)
+    find_library(APP_KIT AppKit REQUIRED)
+    # Platform framework types appear only in the platform .cpp/.mm files
+    # (behind the backend interfaces), so the dependencies are PRIVATE. Carbon
+    # is intentionally NOT used.
+    target_link_libraries(robot PRIVATE
+        ${APPLICATION_SERVICES}
+        ${SCREEN_CAPTURE_KIT}
+        ${CORE_MEDIA}
+        ${CORE_VIDEO}
+        ${APP_KIT})
 elseif(WIN32)
     # user32/gdi32 for SendInput, hooks, GDI capture. Shcore and the DPI context
     # API are resolved at runtime (see WinDpi.cpp / WinScreenBackend.cpp), so they
 
@@ -20,17 +20,18 @@ robot-cpp is built around the distinctions those libraries collapse:
 - Move the cursor (absolute or smoothly interpolated), click, double-click, drag, and scroll, with buttons through X1/X2 and line- or pixel-unit scrolling.
 - Press and release physical keys by position, build modifier chords, and type arbitrary Unicode text independent of the active keyboard layout.
 - Enumerate every display with its own scale factor and both logical and physical bounds, capture any region or a whole monitor at native pixel resolution, sample individual pixels, and encode captures as PNG.
+- Enumerate on-screen application windows, query their current bounds and z-order, activate their owning application, and stream a single window as zero-copy video frames carrying the density and content-rect metadata needed to map frame pixels back to desktop coordinates (macOS ScreenCaptureKit; reported as Unsupported elsewhere until those backends exist).
 - Record global mouse and keyboard input and replay it with its original timing.
 - Report per-environment capabilities and return typed errors instead of failing silently.
 
 ## Supported platforms
 
-| Platform          | Backend                       | Injection                       | Capture | Recording |
-| ----------------- | ----------------------------- | ------------------------------- | ------- | --------- |
-| macOS             | Quartz (CoreGraphics)         | yes (needs Accessibility)       | yes (needs Screen Recording) | yes (needs Accessibility) |
-| Windows           | SendInput + GDI               | yes                             | yes     | yes       |
-| Linux (X11)       | XTest + XRandR + XRecord      | yes                             | yes     | yes       |
-| Linux (Wayland)   | uinput (opt-in)               | keyboard + relative mouse only  | no      | no        |
+| Platform          | Backend                       | Injection                       | Capture | Window streaming | Recording |
+| ----------------- | ----------------------------- | ------------------------------- | ------- | ---------------- | --------- |
+| macOS             | Quartz + ScreenCaptureKit     | yes (needs Accessibility)       | yes (needs Screen Recording) | yes (needs Screen Recording) | yes (needs Accessibility) |
+| Windows           | SendInput + GDI               | yes                             | yes     | no               | yes       |
+| Linux (X11)       | XTest + XRandR + XRecord      | yes                             | yes     | no               | yes       |
+| Linux (Wayland)   | uinput (opt-in)               | keyboard + relative mouse only  | no      | no               | no        |
 
 Wayland does not expose a protocol for an unprivileged client to inject input, warp the cursor, or capture the screen. Under a native Wayland session robot-cpp either runs through Xwayland (the X11 backend) or through the kernel-level uinput backend, with the limits above reported explicitly. See [Platform limitations](#platform-limitations) for the details.
 
@@ -207,6 +208,38 @@ if (auto color = screen.pixel({100, 200})) {
 }
 ```
 
+## Windows
+
+Window enumeration and streaming live on `session->windows()`. Streaming is push-based: frames arrive on an internal capture thread, serialized and in order, as `VideoFrame` values that share (never copy) the platform pixel buffer. Each frame carries the scale and content-rect metadata needed to map its pixels back to window coordinates - `robot::toWindowPoint()` is the one implementation of that formula. On macOS, access the pixels through the typed bridge in `robot/mac/VideoFrame.h`.
+
+```cpp
+robot::Windows& windows = (*session)->windows();
+
+// Pick a window (list() needs canEnumerateWindows):
+auto list = windows.list();
+const robot::Window& target = (*list)[0];
+
+// Stream it. The callback must hand the frame off quickly and never call
+// back into robot-cpp.
+auto stream = windows.stream(
+    target.id, {.maxFps = 60.0},
+    [&](const robot::VideoFrame& frame) { mailbox.publish(frame); },
+    [&](const robot::Error& error) { std::println("stream died: {}", error.message); });
+
+// ... later. After stop() returns no callback is running or will start.
+stream->stop();
+
+// Input coordinate math: re-read the window's current bounds, then map a
+// frame pixel to desktop coordinates.
+if (auto point = robot::toWindowPoint(frame.info(), pixelX, pixelY)) {
+  auto bounds = windows.frame(target.id);
+  robot::LogicalPoint global{bounds->origin.x + point->x,
+                             bounds->origin.y + point->y};
+}
+```
+
+`topmostWindowId()` reports the topmost normal-layer window in z-order (an ordering query - the honest primitive for "is my target frontmost"), and `activateApplicationFor(windowId)` brings a window's owning application forward; which of its windows ends up on top is the OS's decision.
+
 ## Recording and replay
 
 A global event tap observes all mouse and keyboard activity and forwards it as normalized events, which a `Recorder` stamps with elapsed time. Recording is a privileged, platform-limited capability, so check `canRecordEvents` first. Key events are captured as physical keys, so a recording replays by position and is layout-independent.
 
@@ -33,6 +33,8 @@ struct Capabilities {
 
   bool canCaptureScreen = false;
   bool canEnumerateMonitors = false;
+  bool canEnumerateWindows = false;   // Window list, frame, and focus queries.
+  bool canStreamWindows = false;      // Push-based per-window capture streams.
   bool canRecordEvents = false;  // Global input tap / hook.
 
   bool requiresAccessibilityPermission = false;
 
@@ -25,6 +25,8 @@ enum class ErrorCode : std::uint16_t {
   InvalidArgument,
   // A referenced monitor id does not exist.
   MonitorNotFound,
+  // A referenced window id no longer exists on screen.
+  WindowNotFound,
   // A character or key cannot be represented by the active keyboard layout or
   // injection method.
   UnmappableInput,
@@ -44,6 +46,7 @@ constexpr std::string_view toString(const ErrorCode code) {
     case ErrorCode::BackendUnavailable: return "BackendUnavailable";
     case ErrorCode::InvalidArgument: return "InvalidArgument";
     case ErrorCode::MonitorNotFound: return "MonitorNotFound";
+    case ErrorCode::WindowNotFound: return "WindowNotFound";
     case ErrorCode::UnmappableInput: return "UnmappableInput";
     case ErrorCode::CaptureFailed: return "CaptureFailed";
     case ErrorCode::EncodeFailed: return "EncodeFailed";
@@ -79,6 +82,10 @@ struct Error {
   static Error monitorNotFound(const std::uint32_t id) {
     return {ErrorCode::MonitorNotFound, std::format("Monitor {} not found", id)};
   }
+  static Error windowNotFound(const std::uint32_t id) {
+    return {ErrorCode::WindowNotFound,
+            std::format("Window {} no longer exists on screen", id)};
+  }
   static Error unmappableInput(std::string_view detail) {
     return {ErrorCode::UnmappableInput,
             std::format("Cannot map input: {}", detail)};
 
@@ -22,4 +22,8 @@
 #include "robot/Recorder.h"
 #include "robot/Scroll.h"
 #include "robot/Screen.h"
-#include "robot/Session.h"
+#include "robot/Session.h"
+#include "robot/VideoFrame.h"
+#include "robot/Window.h"
+#include "robot/Windows.h"
+#include "robot/WindowStream.h"
@@ -12,6 +12,7 @@
 #include "robot/Monitor.h"
 #include "robot/Mouse.h"
 #include "robot/Screen.h"
+#include "robot/Windows.h"
 
 namespace robot {
 namespace backend {
@@ -73,6 +74,10 @@ class Session {
   // implementation (see EventTap).
   [[nodiscard]] EventTap& eventTap() { return eventTap_; }
 
+  // Always present; calls report Unsupported if this platform build has no
+  // window enumeration/capture implementation (see Windows).
+  [[nodiscard]] Windows& windows() { return windows_; }
+
   [[nodiscard]] const Capabilities& capabilities() const {
     return capabilities_;
   }
@@ -96,6 +101,7 @@ class Session {
   Mouse mouse_;
   Screen screen_;
   EventTap eventTap_;
+  Windows windows_;
 };
 
 }  // namespace robot
@@ -0,0 +1,92 @@
+#pragma once
+
+#include <chrono>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <utility>
+
+#include "robot/Geometry.h"
+
+namespace robot {
+
+// Per-frame metadata for a streamed window frame. The scale fields and the
+// content rectangle map buffer pixels back to window points - see
+// toWindowPoint() below, which is the one implementation of that formula.
+// All fields are zero when the OS omitted the metadata; consumers must refuse
+// coordinate-dependent work rather than guess.
+struct VideoFrameInfo {
+  std::uint32_t windowId = 0;
+  PhysicalSize size;          // buffer size in device pixels
+  double scaleFactor = 0.0;   // device pixels per surface point (Retina: 2.0)
+  double contentScale = 0.0;  // downscale applied to fit content in the buffer
+  // Where the window content sits within the buffer's surface, in surface
+  // points. The content can sit away from the buffer origin (shadows,
+  // padding, resize letterboxing), so this is part of the contract.
+  LogicalRect contentRect;
+  // Presentation timestamp mapped onto steady_clock (not delivery time), so
+  // frame age reflects how old the pixels actually are.
+  std::chrono::steady_clock::time_point capturedAt;
+};
+
+// Maps a buffer pixel coordinate to window-local logical coordinates:
+//
+//   surfacePoint = pixel / scaleFactor
+//   windowPoint  = (surfacePoint - contentRect.origin) / contentScale
+//
+// Returns nullopt when the metadata is missing or the pixel lies outside the
+// window content area (shadow/letterbox padding) - callers must treat that as
+// a refusal, not round it into range.
+[[nodiscard]] inline std::optional<LogicalPoint> toWindowPoint(
+    const VideoFrameInfo& info, const double pixelX, const double pixelY
+) {
+  if (info.scaleFactor <= 0.0 || info.contentScale <= 0.0 ||
+      info.contentRect.size.width <= 0.0 ||
+      info.contentRect.size.height <= 0.0) {
+    return std::nullopt;
+  }
+
+  const double contentX = pixelX / info.scaleFactor - info.contentRect.origin.x;
+  const double contentY = pixelY / info.scaleFactor - info.contentRect.origin.y;
+  if (contentX < 0.0 || contentX >= info.contentRect.size.width ||
+      contentY < 0.0 || contentY >= info.contentRect.size.height) {
+    return std::nullopt;
+  }
+
+  return LogicalPoint{
+      .x = contentX / info.contentScale,
+      .y = contentY / info.contentScale,
+  };
+}
+
+// One streamed frame: metadata plus a retained, shareable reference to the
+// platform pixel buffer (BGRA layout). Copies share the same buffer - a frame
+// is never deep-copied on its way through a consumer's pipeline.
+//
+// Access the pixels through the typed platform bridge (robot/mac/VideoFrame.h
+// on macOS) rather than casting nativeHandle() by hand. A portable pixel
+// accessor is deliberately absent until a cross-platform consumer exists.
+class VideoFrame {
+ public:
+  VideoFrame() = default;
+
+  // Constructed by backends; the buffer's deleter releases the platform
+  // reference the backend retained.
+  VideoFrame(const VideoFrameInfo& info, std::shared_ptr<void> nativeBuffer)
+      : info_(info), nativeBuffer_(std::move(nativeBuffer)) {}
+
+  [[nodiscard]] const VideoFrameInfo& info() const noexcept { return info_; }
+
+  // Borrowed for this frame's lifetime. Prefer the typed platform bridge.
+  [[nodiscard]] void* nativeHandle() const noexcept {
+    return nativeBuffer_.get();
+  }
+
+  explicit operator bool() const noexcept { return nativeBuffer_ != nullptr; }
+
+ private:
+  VideoFrameInfo info_;
+  std::shared_ptr<void> nativeBuffer_;
+};
+
+}  // namespace robot
@@ -0,0 +1,22 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+#include "robot/Geometry.h"
+
+namespace robot {
+
+// One on-screen application window, as reported by enumeration. Windows move
+// and resize after enumeration - query Windows::frame() for the current
+// bounds before doing coordinate math against one.
+struct Window {
+  std::uint32_t id = 0;
+  std::int32_t ownerPid = 0;
+  std::string appName;
+  std::string title;
+  // Global logical desktop coordinates (top-left origin), at enumeration time.
+  LogicalRect frame;
+};
+
+}  // namespace robot
@@ -0,0 +1,57 @@
+#pragma once
+
+#include <functional>
+#include <memory>
+
+#include "robot/Error.h"
+#include "robot/VideoFrame.h"
+
+namespace robot {
+namespace backend {
+class IWindowStreamBackend;
+}
+
+struct WindowStreamOptions {
+  double maxFps = 60.0;
+  bool showsCursor = true;
+};
+
+// Invoked on the stream's internal capture thread for every delivered frame,
+// serialized and in order. The callback must be brief (hand the frame off;
+// VideoFrame copies are cheap), must not throw, and must not call back into
+// robot-cpp APIs or touch this stream's handle.
+using VideoFrameCallback = std::function<void(const VideoFrame&)>;
+
+// Invoked on the same capture thread (serialized with frame delivery) when
+// the stream dies outside stop(): the window closed, the OS revoked capture,
+// the display reconfigured. After it fires, isRunning() is false and no
+// further frames arrive. Same rules as VideoFrameCallback.
+using StreamErrorCallback = std::function<void(const Error&)>;
+
+// A running window capture stream, returned by Windows::stream(). Move-only
+// value type owning the platform stream; destruction stops it.
+//
+// stop() contract: when stop() returns, no callback is executing and none
+// will start. That makes it safe to destroy callback-captured state right
+// after stopping. Corollary: never call stop() (or destroy the stream) from
+// inside one of its own callbacks - that would deadlock on the drain.
+class WindowStream {
+ public:
+  explicit WindowStream(std::unique_ptr<backend::IWindowStreamBackend> impl);
+  ~WindowStream();
+  WindowStream(WindowStream&&) noexcept;
+  WindowStream& operator=(WindowStream&&) noexcept;
+  WindowStream(const WindowStream&) = delete;
+  WindowStream& operator=(const WindowStream&) = delete;
+
+  // Idempotent. Blocks until in-flight callbacks have drained.
+  void stop();
+
+  // False after stop() or a stream failure.
+  [[nodiscard]] bool isRunning() const;
+
+ private:
+  std::unique_ptr<backend::IWindowStreamBackend> impl_;
+};
+
+}  // namespace robot