Bump proxy-addr from 2.0.7 to 2.0.8 in /frontend

Bumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8.
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8)

---
updated-dependencies:
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

AGENTS.md

@@ -44,6 +44,7 @@ explicitly authorizes a cache cleanup.
 - Prefer `use` imports over inline fully-qualified paths; only qualify inline for true one-offs or std collisions
 - TypeScript with Nx, React, Vite, Zustand, and Three.js
 - Use two spaces for indentation
+- Each Tauri command belongs in its own file module, named after the command. Keep shared state, types, and helpers in separate support modules; see the [Storyteller command conventions](crates/desktop/artcraft/src/services/storyteller/commands/AGENTS.md).
 
 ### File Layout
 

Cargo.lock

@@ -262,6 +262,7 @@ version = "0.0.1"
 dependencies = [
  "anyhow",
  "artcraft_api_defs",
+ "artcraft_client_identity",
  "backoff",
  "chrono",
  "cloudflare_errors",
@@ -282,6 +283,13 @@ dependencies = [
  "uuid_utils",
 ]
 
+[[package]]
+name = "artcraft_client_identity"
+version = "0.0.1"
+dependencies = [
+ "url",
+]
+
 [[package]]
 name = "artcraft_router"
 version = "0.0.1"
@@ -7018,6 +7026,7 @@ dependencies = [
 name = "tauri-plugin-http"
 version = "2.4.3"
 dependencies = [
+ "artcraft_client_identity",
  "bytes",
  "cookie_store 0.21.1",
  "data-url",

Cargo.toml

@@ -16,6 +16,7 @@ members = [
   "crates/api_clients/worldlabs_api_client",
   "crates/api_clients/worldlabs_consumer_client",
   "crates/desktop/artcraft",
+  "crates/lib/artcraft_client_identity",
   "crates/lib/browser_emulation",
   "crates/lib/build_metadata",
   "crates/lib/caching/memory_store",
@@ -49,6 +50,7 @@ publish = false
 [workspace.dependencies]
 artcraft_api_defs = { path = "crates/api_clients/artcraft/artcraft_api_defs" }
 artcraft_client = { path = "crates/api_clients/artcraft/artcraft_client" }
+artcraft_client_identity = { path = "crates/lib/artcraft_client_identity" }
 artcraft_router = { path = "crates/api_clients/artcraft/artcraft_router" }
 browser_emulation = { path = "crates/lib/browser_emulation" }
 cookie_store_wrapper = { path = "crates/lib/cookie_store_wrapper" }

LICENSE-APACHE

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ArtCraft Team and the ArtCraft contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

LICENSE.md

@@ -1,86 +0,0 @@
-ArtCraft License (WIP)
-======================
-
-(**Warning**: This isn't a real lawyery license full of legitimate legalese yet, but we'll take care of that ASAP.)
-
-ArtCraft is a form of "fair source" software. It's like [free beer](https://en.wiktionary.org/wiki/free_as_in_beer) 
-in that we give you the code, but there are a few small limitations on what you can do with it.
-
-First, what you *can* do with ArtCraft:
-
->  1. You do not have to pay us to use ArtCraft. It's free.
-> 
->  2. You can back up, copy, modify, compile, and use the code for your own private personal purposes.
->  
->  3. You can do anything you want with the media you create with ArtCraft. Generated assets are yours.
-
-What you *can't do* with ArtCraft:
-
-> 1. You cannot sell the ArtCraft software commercially (eg. as your own software).
->  
-> 2. You cannot use the ArtCraft code to develop a competing business or product (eg. selling AI image and video tools).
->
-> 3. You cannot fork ArtCraft and remove ArtCraft community, donation links, or paid model services. We intend to 
->    make money to improve ArtCraft for everyone.
-> 
-> 4. You cannot use the ArtCraft name, logo, or mascot characters to promote your business without permission.
-
-This license means you can see what we're doing and not be at risk of having the rug pulled out from under 
-you (eg. if our founders die, if our business collapses, if zombies or space aliens invade). It also gives 
-you a really great way to customize the software or lend a hand in reporting (or even fixing) bugs.
-
-Our desire is to support artists, designers, and filmmakers. We want to help you build your own creative studios
-and businesses. We want to give you creative software you can use forever.
-
-ArtCraft is free. We do offer models available through us where you can pay us and support our development, but we also 
-offer the ability for you to use other providers - and we'll keep adding more options so you have maximum flexibility.
-
-## Our Promise
-
-- All development and business plans will be communicated openly with the community.
-
-- Except for minor test scripts or a few small places where we might need to use licensed 3rd party code, all of 
-  our engineering efforts will live in a single publicly available monorepo. You can see everything we do and even 
-  benefit from using it for personal use. We plan on building a lot more than what you see today, and you'll get 
-  all of it.
-
-- We will not "rug pull" our users. If our business shuts down, gets acquired, or otherwise changes, the tools 
-  we create will always continue to function in the same way.
-
-- If the business ends and our founders quit working in this space, we'll make it so the software transitions 
-  to an OSI-approved open source license. (We don't intend to quit!)
-
-## Why not OSI Open Source?
-
-Philosophical answer: The OSI is an industry body led by hyperscalers. They poach from open source all the time, yet 
-hyperscaler systems and code (AWS, GCP, YouTube, etc.) remain closed source. The tiniest nuggets are open, but the vast 
-machinery surrounding it - systems, user behaviors, funnels, at-scale moneymakers - is totally closed.
-
-Practical answer: OSI licenses make it exceptionally challenging to grow big things commercially. And many of 
-the licenses leave room for hyperscalers to reach in and cherry-pick pieces for themselves that they can better 
-commercialize than the original authors.
-
-Then there's completely open source software that doesn't even attempt to be a business. 
-
-We love software like Blender, but (1) developing ArtCraft is our full-time job, (2) we want to build something at scale
-that is much bigger than what you presently see, and (3) this will eventually become much more capital intensive than 
-just writing code - we want to train novel models that work directly in conjunction with the user interface. 
-
-If and when we do get to scale, we intend to keep every bit of our work in the open, including the models. Available 
-for use, inspection, learning, fitting onto consumer GPU hardware, and more. 
-
-Not having a way to make money is unfortunately what killed Stability.ai. Stability.ai walked so that others could 
-eventually run. (Black Forest Labs, et al.) We're not egotistical enough to count ourselves in that party yet, but we 
-believe in the original Stability.ai ethos and that their model can work with a few tweaks. 
-
-We want to build big and incredible tools the world hasn't seen before. We want to keep them free and entirely source 
-available. You don't have to pay us, but if you do, all of your investment goes right back into the engineering 
-and the tools. We're writing code you can clone and keep.
-
-## Inspiration
-
-We took inspiration for this from [Fair Source](https://fair.io/), [Fair Code](https://faircode.io/), 
-the [Defold License](https://defold.com/license/), and Hacker News discussions. The folks at Obsidian 
-have some pretty good thoughts on this as well.
-
-~ Brandon Thomas

NOTICE

@@ -0,0 +1,48 @@
+ArtCraft
+Copyright (c) 2026 ArtCraft Team and the ArtCraft contributors.
+Licensed under the MIT License or the Apache License, Version 2.0, at your option
+(LICENSE-MIT, LICENSE-APACHE).
+
+The ArtCraft name, wordmark and logos are trademarks of the ArtCraft Team. They are not covered
+by the license above.
+
+Third-party material
+
+This product bundles third-party material under its own licenses, listed below.
+
+ammo.js (frontend/apps/artcraft/app/public/jsm/libs/ammo.wasm.*) — zlib License. A port of the
+  Bullet Physics engine. https://github.com/kripken/ammo.js
+tauri-plugin-http (crates/vendor/tauri-plugin-http/) — MIT or Apache-2.0. Copyright (c) 2017 -
+  Present Tauri Apps Contributors; Copyright 2019-2023 Tauri Programme within The Commons
+  Conservancy. Modified fork; see that directory's LICENSE_MIT and LICENSE_APACHE-2.0.
+normalize.css v8.0.1 (frontend/apps/artcraft/app/src/styles/normalize.css) — MIT License.
+  Copyright (c) Nicolas Gallagher and Jonathan Neal. https://github.com/necolas/normalize.css
+three-dots v0.3.2 (portion of frontend/apps/artcraft/app/src/styles/base.css) — MIT License.
+  Copyright (c) 2018 nzbin. https://nzbin.github.io/three-dots/
+Font Awesome Free icons (frontend/libs/icons/src/lib/brand-icons.tsx,
+  frontend/apps/artcraft/app/public/resources/images/services/generic.svg) — CC BY 4.0.
+  Copyright Fonticons, Inc. https://fontawesome.com/license/free
+Carter One font (frontend/apps/artcraft/app/public/resources/fonts/CarterOneRegular.json) —
+  SIL Open Font License 1.1. https://fonts.google.com/specimen/Carter+One
+
+Third-party trademarks
+
+The AI provider and service logos in frontend/apps/artcraft/app/public/resources/images/services/
+are trademarks of their respective owners. They are used only to identify those services and are
+not covered by the license above.
+
+Material not covered by the license above
+
+The following files are owned by third parties. They are not licensed under MIT or Apache-2.0,
+and no rights to them are granted by this repository. They remain the property of their
+respective owners. These assets will be phased out of ArtCraft over time.
+
+frontend/apps/artcraft/app/public/resources/sound/ — sound effects from Nintendo games (Golden
+  Sun, Metroid Prime, The Legend of Zelda: Ocarina of Time, Super Mario RPG).
+frontend/apps/artcraft/app/public/resources/memes/ — meme images and likenesses owned by their
+  respective rights holders.
+frontend/apps/artcraft/app/public/resources/skybox/gray/ and skybox/night/ — skybox textures
+  from a third-party asset pack.
+frontend/apps/artcraft/app/public/resources/pose/Lumine Idle cycle.vmd — third-party MMD motion
+  data.
+frontend/apps/artcraft/app/public/resources/characters_gif/ — renders of Mixamo animations.

README.md

@@ -136,4 +136,10 @@ Additional provider integrations are planned for Kling, Google, Runway, and Luma
 - [Developer documentation](./_docs)
 - [Desktop build and development scripts](./script/artcraft)
 - [Roadmap](./ROADMAP.md)
-- [License](./LICENSE.md)
+- [License](#license)
+
+## License
+
+ArtCraft is dual-licensed under [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), at your option.
+Copyright (c) 2026 ArtCraft Team and the ArtCraft contributors. Required notices, including
+third-party material not covered by this license, are in [NOTICE](NOTICE).

_docs/dev_setup.md

@@ -9,21 +9,67 @@ To set up the ArtCraft development environment,  install the following:
 
 1. [Install Rust](https://doc.rust-lang.org/cargo/getting-started/installation.html).
 2. [Install npm](https://nodejs.org/en/download) or [nvm](https://github.com/nvm-sh/nvm). (Node version `v24.13.0` works at time of writing.) 
-3. [Install nx](https://nx.dev/docs/getting-started/installation). (Nx version `v22.4.5` works at time of writing.)
+3. The frontend's Nx and Vite dependencies are installed locally with npm; a global Nx installation is not required for the combined Unix launcher.
 4. [Install Tauri CLI](https://v2.tauri.app/reference/cli/). (Version `tauri-cli 2.10.0` works at time of writing.)
 
-An easy way to get started with running the app in development is to run the two commands (in separate terminals):
-
 **Mac and Linux Development** 
 
 ```bash
-# Run the frontend dev server
-./script/artcraft/unix_frontend_dev.sh
+# Start the frontend and Rust/Tauri together in one terminal
+./script/artcraft/unix_dev.sh
 
-# Run the Tauri Rust application
-./script/artcraft/unix_rust_dev.sh
+# Optionally start the free-port search at another port
+ARTCRAFT_DEV_PORT=6200 ./script/artcraft/unix_dev.sh
 ```
 
+Use the combined launcher instead of starting the two legacy dev scripts. It
+works from any working directory when invoked by its path and installs frontend
+dependencies if the local Vite installation is missing. Node.js 20+ is required.
+
+The launcher binds Vite to `127.0.0.1`, starting at port **5193** and trying
+successive ports until one is available. It leaves existing listeners alone.
+Only after the real frontend socket is bound does it start Tauri with that exact
+`devUrl`. HTTP and the HMR websocket share the selected port; Rust communicates
+through native Tauri IPC and needs no separate HTTP port. Configuration overrides
+are passed in memory, without changing the checked-in Tauri config.
+
+The native HTTP bridge normalizes loopback development origins for first-party
+API requests so an automatically selected port does not break login or media
+loading. See the [desktop session regression checks](../docs/desktop-session-regression.md)
+when changing ports, the launcher, or authentication.
+
+JavaScript, TypeScript, React, and CSS changes use Vite hot reload; compatible
+React component edits use Fast Refresh. Changes that cannot be hot-replaced
+reload the page. Rust changes use `cargo tauri dev`'s automatic **rebuild and app
+restart**, including dependent workspace crates. SQLx metadata and SQLite
+migrations are also watched. Rust reload is a process restart, so it does not
+preserve unsaved in-memory app state. See [Tauri's watch behavior](https://v2.tauri.app/develop/#reacting-to-source-code-changes).
+
+After startup, a Vite configuration restart must reuse the chosen port or report
+an error; it cannot silently switch to another port while Tauri uses an old URL.
+Ctrl-C stops this session's frontend, Rust watcher/compiler, and desktop app.
+If the Rust watcher exits, the launcher closes Vite and propagates the exit code.
+It never finds or terminates another app by name or port.
+
+The launcher retains the existing Unix defaults for `VITE_ENVIRONMENT_TYPE`,
+`SQLX_OFFLINE`, `RUSTFLAGS`, and the Linux WebKit workarounds. Explicit environment
+overrides are preserved. It uses the normal Artcraft app data and Cargo target
+directory; port separation does not create an isolated account/data profile, and
+concurrent Rust builds can wait on Cargo's build lock.
+
+To verify the launcher without compiling Rust or opening a desktop window:
+
+```bash
+node --test frontend/scripts/unix-dev.test.mjs
+```
+
+The tests use real Vite listeners and HMR, with a test-owned fake Cargo process
+tree. They cover occupied ports, simultaneous launches, React edits, shutdown,
+Rust-process failure, and watcher arguments. To verify native Rust reload, run
+the launcher, wait for the desktop window, make a Rust source edit, and check for
+a rebuild/restart in the same terminal. Frontend edits should update the webview
+without restarting the Rust process.
+
 **Windows Development**
 
 ```powershell

crates/api_clients/artcraft/artcraft_api_defs/src/omni_gen/cost_and_generate_requests/omni_gen_video_cost_and_generate_request.rs

@@ -6,6 +6,7 @@ use enums::common::generation::common_bitrate::CommonBitrate;
 use enums::common::generation::common_quality::CommonQuality;
 use enums::common::generation::common_resolution::CommonResolution;
 use enums::common::generation::common_video_model::CommonVideoModel;
+use enums::common::generation::common_video_output_format::CommonVideoOutputFormat;
 use tokens::tokens::characters::CharacterToken;
 use tokens::tokens::media_files::MediaFileToken;
 
@@ -55,6 +56,11 @@ pub struct OmniGenVideoCostAndGenerateRequest {
   /// Not all models support this; models that don't simply ignore it.
   pub bitrate: Option<CommonBitrate>,
 
+  /// Output container for Seedance 2.5 (including Ultra). Other models ignore it.
+  /// Use "mp4" or "mov" (QuickTime). Omitted or null defaults to MP4.
+  #[serde(rename = "output_format", skip_serializing_if = "Option::is_none")]
+  pub maybe_output_format: Option<CommonVideoOutputFormat>,
+
   /// The quality to use.
   pub quality: Option<CommonQuality>,
 

crates/api_clients/artcraft/artcraft_api_defs/src/omni_gen/models/omni_gen_video_models.rs

@@ -2,6 +2,7 @@ use enums::common::generation::common_aspect_ratio::CommonAspectRatio;
 use enums::common::generation::common_quality::CommonQuality;
 use enums::common::generation::common_resolution::CommonResolution;
 use enums::common::generation::common_video_model::CommonVideoModel;
+use enums::common::generation::common_video_output_format::CommonVideoOutputFormat;
 use enums::common::generation::model_creator::ModelCreator;
 use enums::common::generation_provider::GenerationProvider;
 use serde_derive::{Deserialize, Serialize};
@@ -156,6 +157,12 @@ pub struct OmniGenVideoModelDetails {
 
   #[serde(skip_serializing_if = "Option::is_none")]
   pub bitrate_default: Option<CommonBitrate>,
+
+  #[serde(skip_serializing_if = "Option::is_none")]
+  pub output_format_options: Option<Vec<CommonVideoOutputFormat>>,
+
+  #[serde(skip_serializing_if = "Option::is_none")]
+  pub output_format_default: Option<CommonVideoOutputFormat>,
   
   #[serde(skip_serializing_if = "Option::is_none")]
   pub quality_options: Option<Vec<CommonQuality>>,
@@ -229,6 +236,8 @@ impl Default for OmniGenVideoModelDetails {
       resolution_default: None,
       bitrate_options: None,
       bitrate_default: None,
+      output_format_options: None,
+      output_format_default: None,
       quality_options: None,
       default_quality: None,
       duration_seconds_min: None,

crates/api_clients/artcraft/artcraft_api_defs/src/users/login_challenges.rs

@@ -0,0 +1,73 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct CreateLoginChallengeRequest {}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct ReviewLoginChallengeRequest {
+  pub approval_token: String,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct DecideLoginChallengeRequest {
+  pub approval_token: String,
+  pub approve: bool,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct PollLoginChallengeRequest {
+  pub device_token: String,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct CreateLoginChallengeResponse {
+  pub success: bool,
+  pub device_token: String,
+  pub verification_url: String,
+  pub confirmation_code: String,
+  pub expires_at: DateTime<Utc>,
+  pub poll_interval_seconds: u32,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct ReviewLoginChallengeResponse {
+  pub success: bool,
+  pub status: LoginChallengeState,
+  pub maybe_failure_type: Option<LoginChallengeFailure>,
+  pub confirmation_code: String,
+  pub requesting_ip: String,
+  pub expires_at: DateTime<Utc>,
+  pub username: String,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct LoginChallengeResponse {
+  pub success: bool,
+  pub status: LoginChallengeState,
+  pub maybe_failure_type: Option<LoginChallengeFailure>,
+  /// Present only to the device after the redemption transaction commits.
+  #[serde(skip_serializing_if = "Option::is_none")]
+  pub maybe_signed_session: Option<String>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum LoginChallengeState {
+  Pending,
+  Approved,
+  Redeemed,
+  Failed,
+  #[serde(other)]
+  Unknown,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum LoginChallengeFailure {
+  UserDeclined,
+  Expired,
+  #[serde(other)]
+  Unknown,
+}

crates/api_clients/artcraft/artcraft_api_defs/src/users/mod.rs

@@ -2,4 +2,5 @@ pub mod change_password;
 pub mod edit_email;
 pub mod edit_username;
 pub mod login;
-pub mod session_info;
+pub mod session_info;
+pub mod login_challenges;

crates/api_clients/artcraft/artcraft_api_defs/src/users/session_info.rs

@@ -1,11 +1,12 @@
 use crate::common::responses::user_details_light::UserDetailsLight;
 use enums::by_table::users::user_feature_flag::UserFeatureFlag;
-use serde_derive::Serialize;
+use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize as DeserializeTrait, Deserializer};
 use std::collections::BTreeSet;
 use tokens::tokens::users::UserToken;
 use utoipa::ToSchema;
 
-#[derive(Serialize, Copy, Clone, ToSchema)]
+#[derive(Serialize, Deserialize, Copy, Clone, ToSchema)]
 #[serde(rename_all = "snake_case")]
 pub enum FakeYouPlan {
   Free,
@@ -14,7 +15,7 @@ pub enum FakeYouPlan {
   Pro,
 }
 
-#[derive(Serialize, Copy, Clone, ToSchema)]
+#[derive(Serialize, Deserialize, Copy, Clone, ToSchema)]
 #[serde(rename_all = "snake_case")]
 pub enum StorytellerStreamPlan {
   Free,
@@ -23,7 +24,7 @@ pub enum StorytellerStreamPlan {
   Pro,
 }
 
-#[derive(Serialize, ToSchema)]
+#[derive(Serialize, Deserialize, ToSchema)]
 pub struct SessionUserInfo {
   pub core_info: UserDetailsLight,
 
@@ -41,6 +42,7 @@ pub struct SessionUserInfo {
   /// Collection of feature / rollout flags
   /// This is the proper place to detect if a user has access to some rollout (non-paywall) feature.
   /// NB: The BTreeSet maintains order so React doesn't introduce re-render state bugs when order changes
+  #[serde(default, deserialize_with = "deserialize_known_feature_flags")]
   pub maybe_feature_flags: BTreeSet<UserFeatureFlag>,
 
   // Premium plans:
@@ -76,7 +78,7 @@ pub struct SessionUserInfo {
   pub can_delete_users: bool,
 }
 
-#[derive(Serialize, ToSchema)]
+#[derive(Serialize, Deserialize, ToSchema)]
 pub struct SessionOnboardingState {
   /// If true, the user hasn't set their email.
   pub email_not_set: bool,
@@ -91,9 +93,18 @@ pub struct SessionOnboardingState {
   pub username_not_customized: bool,
 }
 
-#[derive(Serialize, ToSchema)]
+#[derive(Serialize, Deserialize, ToSchema)]
 pub struct SessionInfoSuccessResponse {
   pub success: bool,
   pub logged_in: bool,
   pub user: Option<SessionUserInfo>,
 }
+
+// Server rollouts may introduce flags before a desktop release understands them.
+// Ignore only unknown flag names; malformed values and authentication fields
+// still fail decoding. Unknown flags never grant a client-side capability.
+fn deserialize_known_feature_flags<'de, D>(deserializer: D) -> Result<BTreeSet<UserFeatureFlag>, D::Error>
+where D: Deserializer<'de> {
+  let names = Vec::<String>::deserialize(deserializer)?;
+  Ok(names.into_iter().filter_map(|name| UserFeatureFlag::from_str(&name).ok()).collect())
+}

crates/api_clients/artcraft/artcraft_client/AGENTS.md

@@ -0,0 +1,27 @@
+# artcraft_client
+
+Rust HTTP endpoint bindings used by the ArtCraft Tauri desktop app.
+
+## Endpoint layout
+
+- Each HTTP endpoint binding must live in its own descriptively named `.rs` file.
+  This applies to both free functions and methods implemented on a shared client.
+  Do not combine several routes into a catch-all file such as `login_challenges.rs`
+  or `password_auth.rs`.
+- Group related bindings in a directory module. Keep `mod.rs` for module declarations;
+  it must not contain endpoint implementations. For example:
+  `endpoints/users/login_challenges/create_login_challenge.rs` and
+  `endpoints/users/login_challenges/poll_login_challenge.rs`.
+- Keep each endpoint's route constant, request construction, and endpoint-specific
+  request/response types in its file. Keep shared wire types in `artcraft_api_defs`
+  or a dedicated shared type module; do not duplicate them across endpoint files.
+- Put shared HTTP transport, client setup, and common error handling in a separate
+  utility module. A transport module must not accumulate endpoint bindings.
+- Update callers to import types from their new modules when splitting bindings.
+  Preserve request methods, paths, headers, error behavior, and cookie handling.
+
+## Validation
+
+Run `cargo check --offline -p artcraft_client` for client changes. For native login
+bindings, also run `SQLX_OFFLINE=true cargo test --offline -p artcraft --lib
+login_bridge_tests`; these tests use local HTTP fixtures and temporary cookie jars.

crates/api_clients/artcraft/artcraft_client/Cargo.toml

@@ -19,6 +19,7 @@ path = "src/lib.rs"
 
 # Internal
 artcraft_api_defs.workspace = true
+artcraft_client_identity.workspace = true
 cloudflare_errors.workspace = true
 enums.workspace = true
 errors.workspace = true

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/get_media_file.rs

@@ -29,7 +29,7 @@ pub async fn get_media_file(api_host: &ApiHost, media_file_token: &MediaFileToke
 
   debug!("Requesting {:?}", &url);
 
-  let response = http_get_anonymous(url).await?;
+  let response = http_get_anonymous(api_host, url).await?;
   let response = filter_bad_response(response).await?;
   let response_body = &response.text().await
       .map_err(|err| StorytellerError::Api(ApiError::from(err)))?;

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/legacy_upload_media_file_from_file.rs

@@ -3,7 +3,8 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use chrono::{DateTime, Utc};
@@ -11,7 +12,6 @@ use enums::common::generation_provider::GenerationProvider;
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::path::Path;
 use tokens::tokens::batch_generations::BatchGenerationToken;
@@ -56,8 +56,7 @@ pub async fn legacy_upload_media_file_from_file<P: AsRef<Path>>(
 
   //let mut file = File::open(path)?;
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(args.api_host)
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
@@ -86,7 +85,6 @@ pub async fn legacy_upload_media_file_from_file<P: AsRef<Path>>(
   }
 
   let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON);
   
   if let Some(creds) = args.maybe_creds {

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_image_media_file_from_bytes.rs

@@ -3,7 +3,8 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use enums::common::generation_provider::GenerationProvider;
@@ -11,7 +12,6 @@ use chrono::{DateTime, Utc};
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::fs::File;
 use std::io::Read;
@@ -72,8 +72,7 @@ pub async fn upload_image_media_file_from_bytes(
 
   debug!("Requesting {:?}", &url);
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(args.api_host)
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
@@ -95,7 +94,6 @@ pub async fn upload_image_media_file_from_bytes(
   }
 
   let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON);
   
   if let Some(creds) = args.maybe_creds {

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_image_media_file_from_file.rs

@@ -3,7 +3,8 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use chrono::{DateTime, Utc};
@@ -11,7 +12,6 @@ use enums::common::generation_provider::GenerationProvider;
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::path::Path;
 use tokens::tokens::batch_generations::BatchGenerationToken;
@@ -65,8 +65,7 @@ pub async fn upload_image_media_file_from_file_with_idempotency_token<P: AsRef<P
 
   //let mut file = File::open(path)?;
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(args.api_host)
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
@@ -95,7 +94,6 @@ pub async fn upload_image_media_file_from_file_with_idempotency_token<P: AsRef<P
   }
 
   let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON);
   
   if let Some(creds) = args.maybe_creds {

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_new_engine_asset_from_file.rs

@@ -1,7 +1,8 @@
 use crate::credentials::storyteller_credential_set::StorytellerCredentialSet;
 use crate::error::api_error::ApiError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use enums::common::generation_provider::GenerationProvider;
@@ -9,7 +10,6 @@ use chrono::{DateTime, Utc};
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::path::Path;
 use tokens::tokens::batch_generations::BatchGenerationToken;
@@ -32,8 +32,7 @@ pub async fn upload_new_engine_asset_from_file<P: AsRef<Path>>(
 
   debug!("Requesting {:?}", &url);
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
       .build()?;
 
   let file_bytes = std::fs::read(path.as_ref())?;
@@ -49,7 +48,6 @@ pub async fn upload_new_engine_asset_from_file<P: AsRef<Path>>(
   }
 
   let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON);
   
   if let Some(creds) = maybe_creds {

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_video_media_file_from_file.rs

@@ -1,7 +1,8 @@
 use crate::credentials::storyteller_credential_set::StorytellerCredentialSet;
 use crate::error::api_error::ApiError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use enums::common::generation_provider::GenerationProvider;
@@ -9,7 +10,6 @@ use chrono::{DateTime, Utc};
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::path::Path;
 use tokens::tokens::batch_generations::BatchGenerationToken;
@@ -58,8 +58,7 @@ pub async fn upload_video_media_file_from_file<P: AsRef<Path>>(
 
   debug!("Requesting {:?}", &url);
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(args.api_host)
       .build()?;
 
   let file_bytes = std::fs::read(args.path.as_ref())?;
@@ -78,7 +77,6 @@ pub async fn upload_video_media_file_from_file<P: AsRef<Path>>(
   }
 
   let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON);
   
   if let Some(creds) = args.maybe_creds {

crates/api_clients/artcraft/artcraft_client/src/endpoints/mod.rs

@@ -7,3 +7,4 @@ pub mod media_files;
 pub mod prompts;
 pub mod stripe_artcraft;
 pub mod subscriptions;
+pub mod users;

crates/api_clients/artcraft/artcraft_client/src/endpoints/omni_gen/models/video/omni_gen_list_video_models.rs

@@ -158,6 +158,10 @@ pub struct OmniGenVideoModelDetails {
   #[serde(default)]
   pub bitrate_default: Option<ApiClientBitrate>,
   #[serde(default)]
+  pub output_format_options: Option<Vec<String>>,
+  #[serde(default)]
+  pub output_format_default: Option<String>,
+  #[serde(default)]
   pub quality_options: Option<Vec<ApiClientQuality>>,
   #[serde(default)]
   pub default_quality: Option<ApiClientQuality>,

crates/api_clients/artcraft/artcraft_client/src/endpoints/users/login_challenges/create_login_challenge.rs

@@ -0,0 +1,16 @@
+use artcraft_api_defs::users::login_challenges::{CreateLoginChallengeRequest, CreateLoginChallengeResponse};
+use reqwest::Method;
+
+use crate::utils::login_challenge_client::{LoginChallengeClient, LoginChallengeClientError};
+
+pub const CREATE_PATH: &str = "/v1/login_challenges/create";
+
+impl LoginChallengeClient {
+  pub async fn create(&self) -> Result<CreateLoginChallengeResponse, LoginChallengeClientError> {
+    let request = self
+      .request(Method::POST, CREATE_PATH)
+      .json(&CreateLoginChallengeRequest {});
+    let (result, _) = self.send(request, CREATE_PATH).await?;
+    Ok(result)
+  }
+}

crates/api_clients/artcraft/artcraft_client/src/endpoints/users/login_challenges/mod.rs

@@ -0,0 +1,2 @@
+pub mod create_login_challenge;
+pub mod poll_login_challenge;

crates/api_clients/artcraft/artcraft_client/src/endpoints/users/login_challenges/poll_login_challenge.rs

@@ -0,0 +1,30 @@
+use artcraft_api_defs::users::login_challenges::{LoginChallengeResponse, PollLoginChallengeRequest};
+use reqwest::Method;
+
+use crate::utils::login_challenge_client::{LoginChallengeClient, LoginChallengeClientError};
+
+pub const POLL_PATH: &str = "/v1/login_challenges/poll";
+
+// Deliberately no Debug/Serialize: the wire result contains a bearer credential.
+pub struct PollLoginChallengeResult {
+  pub response: LoginChallengeResponse,
+  pub session_set_cookie: Option<String>,
+}
+
+impl LoginChallengeClient {
+  pub async fn poll(
+    &self,
+    device_token: &str,
+  ) -> Result<PollLoginChallengeResult, LoginChallengeClientError> {
+    let request = self
+      .request(Method::POST, POLL_PATH)
+      .json(&PollLoginChallengeRequest {
+        device_token: device_token.to_owned(),
+      });
+    let (response, session_set_cookie) = self.send(request, POLL_PATH).await?;
+    Ok(PollLoginChallengeResult {
+      response,
+      session_set_cookie,
+    })
+  }
+}

crates/api_clients/artcraft/artcraft_client/src/endpoints/users/mod.rs

@@ -0,0 +1,5 @@
+pub mod login_challenges;
+pub mod password_auth_response;
+pub mod password_login;
+pub mod password_signup;
+pub mod session_info;

crates/api_clients/artcraft/artcraft_client/src/endpoints/users/password_auth_response.rs

@@ -0,0 +1,8 @@
+use serde::Deserialize;
+
+// No Debug: the response contains a bearer credential.
+#[derive(Deserialize)]
+pub struct PasswordAuthResponse {
+  pub success: bool,
+  pub signed_session: Option<String>,
+}

crates/api_clients/artcraft/artcraft_client/src/endpoints/users/password_login.rs

@@ -0,0 +1,20 @@
+use reqwest::Method;
+use serde::{Deserialize, Serialize};
+
+use crate::utils::login_challenge_client::{LoginChallengeClient, LoginChallengeClientError};
+use super::password_auth_response::PasswordAuthResponse;
+
+pub const LOGIN_PATH: &str = "/v1/login";
+
+// No Debug: the request contains credentials.
+#[derive(Deserialize, Serialize)]
+pub struct PasswordLoginRequest {
+  pub username_or_email: String,
+  pub password: String,
+}
+
+impl LoginChallengeClient {
+  pub async fn password_login(&self, request: &PasswordLoginRequest) -> Result<(PasswordAuthResponse, Option<String>), LoginChallengeClientError> {
+    self.send(self.request(Method::POST, LOGIN_PATH).json(request), LOGIN_PATH).await
+  }
+}

crates/api_clients/artcraft/artcraft_client/src/endpoints/users/password_signup.rs

@@ -0,0 +1,23 @@
+use reqwest::Method;
+use serde::{Deserialize, Serialize};
+
+use crate::utils::login_challenge_client::{LoginChallengeClient, LoginChallengeClientError};
+use super::password_auth_response::PasswordAuthResponse;
+
+pub const SIGNUP_PATH: &str = "/v1/create_account";
+
+// No Debug: the request contains credentials.
+#[derive(Deserialize, Serialize)]
+pub struct PasswordSignupRequest {
+  pub username: String,
+  pub email_address: String,
+  pub password: String,
+  pub password_confirmation: String,
+  pub signup_source: String,
+}
+
+impl LoginChallengeClient {
+  pub async fn password_signup(&self, request: &PasswordSignupRequest) -> Result<(PasswordAuthResponse, Option<String>), LoginChallengeClientError> {
+    self.send(self.request(Method::POST, SIGNUP_PATH).json(request), SIGNUP_PATH).await
+  }
+}

crates/api_clients/artcraft/artcraft_client/src/endpoints/users/session_info.rs

@@ -0,0 +1,19 @@
+use artcraft_api_defs::users::session_info::SessionInfoSuccessResponse;
+use reqwest::Method;
+
+use crate::utils::login_challenge_client::{LoginChallengeClient, LoginChallengeClientError};
+
+pub const SESSION_PATH: &str = "/v1/session";
+
+impl LoginChallengeClient {
+  pub async fn session(
+    &self,
+    signed_session: &str,
+  ) -> Result<SessionInfoSuccessResponse, LoginChallengeClientError> {
+    let request = self
+      .request(Method::GET, SESSION_PATH)
+      .header("Cookie", format!("session={signed_session}"));
+    let (result, _) = self.send(request, SESSION_PATH).await?;
+    Ok(result)
+  }
+}

crates/api_clients/artcraft/artcraft_client/src/utils/api_host.rs

@@ -1,4 +1,6 @@
 
+use artcraft_client_identity::origins::{ARTCRAFT_DESKTOP_DEVELOPMENT_ORIGIN, ARTCRAFT_DESKTOP_ORIGIN};
+
 const HTTP_SCHEME: &str = "http";
 
 const HTTPS_SCHEME: &str = "https";
@@ -27,6 +29,15 @@ impl ApiHost {
     }
   }
   
+  /// The `Origin` the desktop client declares to this API.
+  pub fn request_origin(&self) -> &'static str {
+    match self {
+      ApiHost::Storyteller => ARTCRAFT_DESKTOP_ORIGIN,
+      ApiHost::FakeYou => ARTCRAFT_DESKTOP_ORIGIN,
+      ApiHost::Localhost { .. } => ARTCRAFT_DESKTOP_DEVELOPMENT_ORIGIN,
+    }
+  }
+
   pub fn scheme(&self) -> &'static str {
     match self {
       ApiHost::Storyteller => HTTPS_SCHEME,

crates/api_clients/artcraft/artcraft_client/src/utils/basic_json_delete_request.rs

@@ -3,10 +3,10 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use log::{debug, info};
-use reqwest::Client;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 
@@ -21,13 +21,11 @@ pub async fn basic_json_delete_request<Req: Serialize, Res: DeserializeOwned>(
 
   info!("DELETE {:?}", &url);
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
   let mut request_builder = client.delete(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON)
       .header("Content-Type", APPLICATION_JSON);
 

crates/api_clients/artcraft/artcraft_client/src/utils/basic_json_get_request.rs

@@ -3,10 +3,10 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use log::{debug, info};
-use reqwest::Client;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 
@@ -20,13 +20,11 @@ pub async fn basic_json_get_request<Res: DeserializeOwned>(
 
   debug!("Requesting {:?}", &url);
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
   let mut request_builder = client.get(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON);
 
   if let Some(creds) = maybe_creds {

crates/api_clients/artcraft/artcraft_client/src/utils/basic_json_post_request.rs

@@ -3,10 +3,10 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use log::{debug, info};
-use reqwest::Client;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 
@@ -30,13 +30,11 @@ pub async fn basic_json_post_request<Req: Serialize, Res: DeserializeOwned>(
     info!("Requesting {:?}", &url);
   }
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
   let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON)
       .header("Content-Type", APPLICATION_JSON);
 

crates/api_clients/artcraft/artcraft_client/src/utils/basic_query_string_post_request.rs

@@ -3,11 +3,11 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use errors::AnyhowResult;
 use log::{debug, info};
-use reqwest::Client;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -26,13 +26,11 @@ pub async fn basic_query_string_post_request<Res: DeserializeOwned>(
 
   debug!("Requesting {:?}", &url);
 
-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
   let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", APPLICATION_JSON);
 
   if let Some(creds) = maybe_creds {

crates/api_clients/artcraft/artcraft_client/src/utils/constants.rs

@@ -1,4 +1 @@
-
-pub const USER_AGENT: &str = "storyteller-client/1.0";
-
 pub const APPLICATION_JSON : &str = "application/json";

crates/api_clients/artcraft/artcraft_client/src/utils/http_get_anonymous.rs

@@ -1,14 +1,12 @@
 use crate::error::api_error::ApiError;
-use reqwest::Client;
-const USER_AGENT: &str = "storyteller-client/1.0";
+use crate::utils::api_host::ApiHost;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 
-pub async fn http_get_anonymous(url: String) -> Result<reqwest::Response, ApiError> {
-  let client = Client::builder()
-      .gzip(true)
+pub async fn http_get_anonymous(api_host: &ApiHost, url: String) -> Result<reqwest::Response, ApiError> {
+  let client = storyteller_client_builder(api_host)
       .build()?;
 
   let response = client.get(url)
-      .header("User-Agent", USER_AGENT)
       .header("Accept", "application/json")
       //.header("Accept-Encoding", "gzip, deflate, br")
       .send()

crates/api_clients/artcraft/artcraft_client/src/utils/login_challenge_client.rs

@@ -0,0 +1,184 @@
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+use log::{info, warn};
+use reqwest::header::SET_COOKIE;
+use reqwest::{Client, Method, RequestBuilder, Response};
+use serde::de::DeserializeOwned;
+use serde::Deserialize;
+use url::Url;
+
+use crate::utils::api_host::ApiHost;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
+
+/// Rejection bodies are small JSON objects; anything larger is not one of ours.
+const MAX_REJECTION_BODY_BYTES: usize = 16 * 1024;
+
+/// Native transport for the session bridge. No request/response bodies, cookies,
+/// or challenge credentials are logged, even at debug level. Never follows redirects.
+#[derive(Clone)]
+pub struct LoginChallengeClient {
+  client: Client,
+  api_host: ApiHost,
+}
+
+#[derive(Debug)]
+pub struct LoginChallengeClientError {
+  pub status: Option<u16>,
+  pub message: &'static str,
+  /// The server's explanation for a non-2xx response, when it sent one.
+  pub maybe_rejection: Option<LoginRejection>,
+}
+
+/// The error fields of a rejected login or signup response, such as
+/// `{"error_type":"UsernameTaken","error_fields":{"username":"username is taken"}}`.
+/// Only these fields are parsed, so no credential can end up in this struct.
+#[derive(Debug, Default, Deserialize)]
+pub struct LoginRejection {
+  pub error_type: Option<String>,
+  pub error_message: Option<String>,
+  #[serde(default)]
+  pub error_fields: BTreeMap<String, String>,
+}
+
+impl LoginChallengeClient {
+  pub fn new(api_host: &ApiHost) -> Result<Self, LoginChallengeClientError> {
+    let mut builder = storyteller_client_builder(api_host);
+    if matches!(api_host, ApiHost::Localhost { .. }) {
+      builder = builder.no_proxy();
+    }
+    let client = builder
+      .timeout(Duration::from_secs(15))
+      .redirect(reqwest::redirect::Policy::none())
+      .build()
+      .map_err(|_| LoginChallengeClientError::invalid("Unable to initialize login client"))?;
+    Ok(Self {
+      client,
+      api_host: api_host.clone(),
+    })
+  }
+
+  pub fn api_origin(&self) -> String {
+    self.api_host.to_api_hostname_and_scheme()
+  }
+
+  pub fn api_url(&self) -> Url {
+    Url::parse(&format!("{}/", self.api_origin())).expect("ApiHost must produce a valid origin")
+  }
+
+  pub fn allows_verification_url(&self, value: &str) -> bool {
+    let Ok(url) = Url::parse(value) else {
+      return false;
+    };
+    let origin_allowed = match self.api_host {
+      ApiHost::Localhost { .. } => ["http://localhost:4200", "http://127.0.0.1:4200", "http://localhost:4201", "http://127.0.0.1:4201"]
+        .contains(&url.origin().ascii_serialization().as_str()),
+      ApiHost::Storyteller => ["https://app.getartcraft.com", "https://getartcraft.com", "https://www.getartcraft.com"]
+        .contains(&url.origin().ascii_serialization().as_str()),
+      ApiHost::FakeYou => false,
+    };
+    origin_allowed
+      && url.username().is_empty()
+      && url.password().is_none()
+      && url.path() == "/login/desktop"
+      && url.query().is_none()
+      && url
+        .fragment()
+        .and_then(|f| f.strip_prefix("approval_token="))
+        .map(|s| {
+          s.len() == 43
+            && s
+              .bytes()
+              .all(|b| b.is_ascii_alphanumeric() || b == b'_' || b == b'-')
+        })
+        .unwrap_or(false)
+  }
+
+  pub(crate) fn request(&self, method: Method, path: &str) -> RequestBuilder {
+    self
+      .client
+      .request(method, format!("{}{path}", self.api_origin()))
+      .header("Accept", "application/json")
+  }
+
+  pub(crate) async fn send<T: DeserializeOwned>(
+    &self,
+    request: RequestBuilder,
+    path: &str,
+  ) -> Result<(T, Option<String>), LoginChallengeClientError> {
+    let origin = self.api_origin();
+    info!("Website login request: origin={} path={}", origin, path);
+    let response = request.send().await.map_err(|_| {
+      warn!(
+        "Website login network failure: origin={} path={}",
+        origin, path
+      );
+      LoginChallengeClientError::invalid("Unable to reach the login server")
+    })?;
+    let status = response.status();
+    if !status.is_success() {
+      warn!(
+        "Website login HTTP failure: origin={} path={} status={}",
+        origin,
+        path,
+        status.as_u16()
+      );
+      return Err(LoginChallengeClientError {
+        status: Some(status.as_u16()),
+        message: "Login server rejected the request",
+        maybe_rejection: read_rejection(response).await,
+      });
+    }
+    let session_cookie = response
+      .headers()
+      .get_all(SET_COOKIE)
+      .iter()
+      .filter_map(|v| v.to_str().ok())
+      .find(|v| {
+        cookie::Cookie::parse(*v)
+          .map(|c| c.name() == "session")
+          .unwrap_or(false)
+      })
+      .map(str::to_owned);
+    let body = response.json().await.map_err(|_| {
+      warn!(
+        "Website login invalid response: origin={} path={}",
+        origin, path
+      );
+      LoginChallengeClientError::invalid("Invalid response from login server")
+    })?;
+    Ok((body, session_cookie))
+  }
+}
+
+impl LoginChallengeClientError {
+  pub fn invalid(message: &'static str) -> Self {
+    Self {
+      status: None,
+      message,
+      maybe_rejection: None,
+    }
+  }
+}
+
+impl std::fmt::Display for LoginChallengeClientError {
+  fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+    match self.status {
+      Some(status) => write!(f, "{} (HTTP {})", self.message, status),
+      None => write!(f, "{}", self.message),
+    }
+  }
+}
+
+impl std::error::Error for LoginChallengeClientError {}
+
+async fn read_rejection(response: Response) -> Option<LoginRejection> {
+  if response.content_length().is_some_and(|len| len > MAX_REJECTION_BODY_BYTES as u64) {
+    return None;
+  }
+  let body = response.bytes().await.ok()?;
+  if body.len() > MAX_REJECTION_BODY_BYTES {
+    return None;
+  }
+  serde_json::from_slice(&body).ok()
+}

crates/api_clients/artcraft/artcraft_client/src/utils/mod.rs

@@ -4,6 +4,8 @@ pub mod basic_json_post_request;
 pub (crate) mod basic_query_string_post_request;
 pub (crate) mod filter_bad_response;
 pub (crate) mod http_get_anonymous;
+pub (crate) mod storyteller_client_builder;
 pub mod api_host;
 pub mod constants;
 pub mod status_codes;
+pub mod login_challenge_client;

crates/api_clients/artcraft/artcraft_client/src/utils/storyteller_client_builder.rs

@@ -0,0 +1,17 @@
+use artcraft_client_identity::user_agents::ARTCRAFT_DESKTOP_USER_AGENT;
+use reqwest::header::{HeaderMap, HeaderValue, ORIGIN};
+use reqwest::{Client, ClientBuilder};
+
+use crate::utils::api_host::ApiHost;
+
+/// Every request to our API is built from this so the desktop client identifies itself
+/// consistently (`User-Agent` and `Origin`). Only use it for Storyteller / ArtCraft APIs.
+pub(crate) fn storyteller_client_builder(api_host: &ApiHost) -> ClientBuilder {
+  let mut headers = HeaderMap::new();
+  headers.insert(ORIGIN, HeaderValue::from_static(api_host.request_origin()));
+
+  Client::builder()
+    .user_agent(ARTCRAFT_DESKTOP_USER_AGENT)
+    .default_headers(headers)
+    .gzip(true)
+}

crates/api_clients/artcraft/artcraft_router/src/api/router_quality.rs

@@ -1,10 +1,20 @@
 use serde_derive::{Deserialize, Serialize};
 
 /// Common quality levels you can specify when enqueuing a generation.
-/// Not every model will use this; models that don't simply ignore it.
+/// Not every model will use this; models that don't simply ignore it, and models that only
+/// offer a subset of tiers clamp to the nearest tier they support.
+///
+/// Serialized names mirror the server's `CommonQuality` so the two convert via serde.
 #[derive(Copy, Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum RouterQuality {
+  /// Let the model choose. Models without a native "auto" use their default tier.
+  Auto,
+  /// Highest tier (GPT Image 2.5 `max`).
+  Max,
+  /// Between High and Max (GPT Image 2.5 `xhigh`).
+  #[serde(rename = "xhigh")]
+  XHigh,
   High,
   Medium,
   Low,

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/artcraft/build_common.rs

@@ -151,8 +151,11 @@ fn to_resolution_enum(r: RouterResolution) -> CommonResolutionEnum {
 
 fn to_quality_enum(q: RouterQuality) -> CommonQualityEnum {
   match q {
-    RouterQuality::Low => CommonQualityEnum::Low,
-    RouterQuality::Medium => CommonQualityEnum::Medium,
+    RouterQuality::Auto => CommonQualityEnum::Auto,
+    RouterQuality::Max => CommonQualityEnum::Max,
+    RouterQuality::XHigh => CommonQualityEnum::XHigh,
     RouterQuality::High => CommonQualityEnum::High,
+    RouterQuality::Medium => CommonQualityEnum::Medium,
+    RouterQuality::Low => CommonQualityEnum::Low,
   }
 }

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/artcraft/gpt_image_1/cost.rs

@@ -36,7 +36,7 @@ impl ArtcraftGptImage1CostState {
   }
 
   pub fn estimate_cost(&self) -> ImageGenerationCostEstimate {
-    let quality = self.quality.unwrap_or(CommonQualityEnum::High);
+    let quality = clamp_to_supported_quality(self.quality);
     let is_square = is_square_or_none(self.aspect_ratio);
 
     let output_cost_per_image: u64 = match (quality, is_square) {
@@ -45,6 +45,8 @@ impl ArtcraftGptImage1CostState {
       (CommonQualityEnum::Medium, false) => 7,
       (CommonQualityEnum::High, true) => 17,
       (CommonQualityEnum::High, false) => 25,
+      // Clamped away above.
+      (CommonQualityEnum::Auto | CommonQualityEnum::XHigh | CommonQualityEnum::Max, _) => unreachable!(),
     };
 
     let output_cost = output_cost_per_image * self.num_images as u64;
@@ -63,6 +65,20 @@ impl ArtcraftGptImage1CostState {
   }
 }
 
+/// GPT Image 1 only offers low / medium / high. `auto` prices as the default (high) and the
+/// higher GPT Image 2.5 tiers clamp down to high, matching the Fal request planner.
+fn clamp_to_supported_quality(quality: Option<CommonQualityEnum>) -> CommonQualityEnum {
+  match quality {
+    Some(CommonQualityEnum::Low) => CommonQualityEnum::Low,
+    Some(CommonQualityEnum::Medium) => CommonQualityEnum::Medium,
+    Some(CommonQualityEnum::High)
+    | Some(CommonQualityEnum::XHigh)
+    | Some(CommonQualityEnum::Max)
+    | Some(CommonQualityEnum::Auto)
+    | None => CommonQualityEnum::High,
+  }
+}
+
 fn is_square_or_none(aspect_ratio: Option<CommonAspectRatioEnum>) -> bool {
   use CommonAspectRatioEnum as Ar;
   matches!(

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/artcraft/gpt_image_1p5/cost.rs

@@ -37,7 +37,7 @@ impl ArtcraftGptImage1p5CostState {
   }
 
   pub fn estimate_cost(&self) -> ImageGenerationCostEstimate {
-    let quality = self.quality.unwrap_or(CommonQualityEnum::High);
+    let quality = clamp_to_supported_quality(self.quality);
     let size = size_bucket(self.aspect_ratio);
 
     let cost_per_image: u64 = match (quality, size) {
@@ -50,6 +50,8 @@ impl ArtcraftGptImage1p5CostState {
 
       (CommonQualityEnum::High, SizeBucket::Square) => 14,
       (CommonQualityEnum::High, _) => 20,
+      // Clamped away above.
+      (CommonQualityEnum::Auto | CommonQualityEnum::XHigh | CommonQualityEnum::Max, _) => unreachable!(),
     };
 
     let cost_in_usd_cents = cost_per_image * self.num_images as u64;
@@ -65,6 +67,20 @@ impl ArtcraftGptImage1p5CostState {
   }
 }
 
+/// GPT Image 1.5 only offers low / medium / high. `auto` prices as the default (high) and the
+/// higher GPT Image 2.5 tiers clamp down to high, matching the Fal request planner.
+fn clamp_to_supported_quality(quality: Option<CommonQualityEnum>) -> CommonQualityEnum {
+  match quality {
+    Some(CommonQualityEnum::Low) => CommonQualityEnum::Low,
+    Some(CommonQualityEnum::Medium) => CommonQualityEnum::Medium,
+    Some(CommonQualityEnum::High)
+    | Some(CommonQualityEnum::XHigh)
+    | Some(CommonQualityEnum::Max)
+    | Some(CommonQualityEnum::Auto)
+    | None => CommonQualityEnum::High,
+  }
+}
+
 fn size_bucket(aspect_ratio: Option<CommonAspectRatioEnum>) -> SizeBucket {
   use CommonAspectRatioEnum as Ar;
   match aspect_ratio {

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/artcraft/gpt_image_2/cost.rs

@@ -42,7 +42,7 @@ impl ArtcraftGptImage2CostState {
   }
 
   pub fn estimate_cost(&self) -> ImageGenerationCostEstimate {
-    let quality = self.quality.unwrap_or(CommonQualityEnum::High);
+    let quality = clamp_to_supported_quality(self.quality);
     let size = size_bucket(self.aspect_ratio);
 
     let cost_per_image: u64 = match (quality, size) {
@@ -62,6 +62,8 @@ impl ArtcraftGptImage2CostState {
       | (CommonQualityEnum::High, SizeBucket::Portrait4x3) => 15,
       (CommonQualityEnum::High, SizeBucket::Landscape16x9)
       | (CommonQualityEnum::High, SizeBucket::Portrait16x9) => 16,
+      // Clamped away above.
+      (CommonQualityEnum::Auto | CommonQualityEnum::XHigh | CommonQualityEnum::Max, _) => unreachable!(),
     };
 
     let cost_in_usd_cents = cost_per_image * self.num_images as u64;
@@ -77,6 +79,20 @@ impl ArtcraftGptImage2CostState {
   }
 }
 
+/// GPT Image 2 only offers low / medium / high. `auto` prices as the default (high) and the
+/// higher GPT Image 2.5 tiers clamp down to high, matching the Fal request planner.
+fn clamp_to_supported_quality(quality: Option<CommonQualityEnum>) -> CommonQualityEnum {
+  match quality {
+    Some(CommonQualityEnum::Low) => CommonQualityEnum::Low,
+    Some(CommonQualityEnum::Medium) => CommonQualityEnum::Medium,
+    Some(CommonQualityEnum::High)
+    | Some(CommonQualityEnum::XHigh)
+    | Some(CommonQualityEnum::Max)
+    | Some(CommonQualityEnum::Auto)
+    | None => CommonQualityEnum::High,
+  }
+}
+
 /// Mirrors v1's `plan_image_size` for GPT Image 2 — see the v1 file
 /// `plan_generate_image_artcraft_gpt_image_2.rs::plan_image_size`.
 fn size_bucket(aspect_ratio: Option<CommonAspectRatioEnum>) -> SizeBucket {

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/artcraft/gpt_image_2p5_common_cost.rs

@@ -8,25 +8,27 @@ use fal_client::requests::api::image::common::gpt_image_2p5::gpt_image_2p5_image
 use crate::generate::generate_image::image_generation_cost_estimate::ImageGenerationCostEstimate;
 
 /// Artcraft price per output image, in hundredths of a US cent, by output dimensions and
-/// quality (`[low, medium, high]`). Rows are stored landscape-first; portrait orientations of
-/// the same dimensions price identically. Dimensions come from the aspect ratio preset and
-/// resolution tier the same way the Fal request builder derives them.
-const OUTPUT_IMAGE_PRICE_TABLE: &[(u32, u32, [u64; 3])] = &[
+/// quality (`[low, medium, high, xhigh, max]`). Each cell is the `fal_client` GPT Image 2.5
+/// estimate for that size and tier with a 10% markup, rounded up. Rows are stored
+/// landscape-first; portrait orientations of the same dimensions price identically.
+/// Dimensions come from the aspect ratio preset and resolution tier the same way the Fal
+/// request builder derives them.
+const OUTPUT_IMAGE_PRICE_TABLE: &[(u32, u32, [u64; 5])] = &[
   // 1:1
-  (1024, 1024, [ 65, 152,  582]),
-  (2048, 2048, [103, 239,  919]),
-  (2880, 2880, [151, 352, 1357]),
+  (1024, 1024, [ 65, 152,  582, 1034, 2327]),
+  (2048, 2048, [103, 239,  919, 1633, 3672]),
+  (2880, 2880, [151, 352, 1357, 2412, 5426]),
   // 4:3
-  (1024,  768, [ 46, 105,  400]),
-  (2048, 1536, [ 73, 170,  652]),
-  (3072, 2304, [120, 279, 1073]),
-  (3312, 2480, [134, 311, 1194]),
+  (1024,  768, [ 46, 105,  400,  710, 1597]),
+  (2048, 1536, [ 73, 170,  652, 1159, 2605]),
+  (3072, 2304, [120, 279, 1073, 1906, 4287]),
+  (3312, 2480, [134, 311, 1194, 2122, 4773]),
   // 16:9
-  (1088,  608, [ 32,  75,  285]),
-  (1920, 1080, [ 49, 114,  436]),
-  (2048, 1152, [ 53, 121,  467]),
-  (3072, 1728, [ 87, 204,  783]),
-  (3840, 2160, [124, 286, 1102]),
+  (1088,  608, [ 32,  75,  285,  506, 1139]),
+  (1920, 1080, [ 49, 114,  436,  775, 1743]),
+  (2048, 1152, [ 53, 121,  467,  830, 1865]),
+  (3072, 1728, [ 87, 204,  783, 1390, 3127]),
+  (3840, 2160, [124, 286, 1102, 1957, 4404]),
 ];
 
 /// Artcraft price per reference image on an edit request, in hundredths of a US cent.
@@ -55,7 +57,8 @@ impl ArtcraftGptImage2p5CostInputs {
   }
 
   /// Per-image price rounded up to whole cents, times the batch size. Quality defaults to
-  /// high. Without an aspect ratio, text-to-image prices as landscape 4:3 and edit as auto,
+  /// high, and `auto` is priced as high (the documented default the model falls back to).
+  /// Without an aspect ratio, text-to-image prices as landscape 4:3 and edit as auto,
   /// matching the Fal defaults the request would fall back to.
   pub fn estimate_cost(&self) -> ImageGenerationCostEstimate {
     let quality = self.quality.unwrap_or(CommonQualityEnum::High);
@@ -91,11 +94,13 @@ fn output_image_price(quality: CommonQualityEnum, width: u32, height: u32) -> u6
   match quality {
     CommonQualityEnum::Low => prices[0],
     CommonQualityEnum::Medium => prices[1],
-    CommonQualityEnum::High => prices[2],
+    CommonQualityEnum::High | CommonQualityEnum::Auto => prices[2],
+    CommonQualityEnum::XHigh => prices[3],
+    CommonQualityEnum::Max => prices[4],
   }
 }
 
-fn lookup_price_row(width: u32, height: u32) -> Option<[u64; 3]> {
+fn lookup_price_row(width: u32, height: u32) -> Option<[u64; 5]> {
   let long_edge = width.max(height);
   let short_edge = width.min(height);
   OUTPUT_IMAGE_PRICE_TABLE.iter()
@@ -176,6 +181,18 @@ mod tests {
     (Some(Ar::Auto4k),            Some(R::OneK),  [2, 3, 12]),
   ];
 
+  // (aspect_ratio, resolution, [xhigh, max]) — cents per image, text-to-image
+  const TEXT_GRID_UPPER_TIERS: &[(Option<Ar>, Option<R>, [u64; 2])] = &[
+    (None,                        None,           [ 8, 16]), // landscape 4:3 default
+    (Some(Ar::Square),            None,           [11, 24]),
+    (Some(Ar::Square),            Some(R::TwoK),  [17, 37]),
+    (Some(Ar::Square),            Some(R::FourK), [25, 55]),
+    (Some(Ar::WideSixteenByNine), None,           [ 8, 18]),
+    (Some(Ar::WideSixteenByNine), Some(R::OneK),  [ 6, 12]),
+    (Some(Ar::TallNineBySixteen), Some(R::FourK), [20, 45]),
+    (Some(Ar::Auto),              None,           [20, 45]),
+  ];
+
   mod text_to_image_tests {
     use super::*;
 
@@ -189,11 +206,32 @@ mod tests {
       }
     }
 
+    #[test]
+    fn upper_tier_grid() {
+      for &(aspect_ratio, resolution, expected) in TEXT_GRID_UPPER_TIERS {
+        for (quality, expected) in [Q::XHigh, Q::Max].into_iter().zip(expected) {
+          let actual = cents(make_inputs(0, Some(quality), aspect_ratio, resolution, 1));
+          assert_eq!(actual, expected, "{aspect_ratio:?} {resolution:?} {quality:?}");
+        }
+      }
+    }
+
     #[test]
     fn quality_defaults_to_high() {
       assert_eq!(cents(make_inputs(0, None, Some(Ar::Square), None, 1)), 6);
     }
 
+    #[test]
+    fn auto_prices_as_high() {
+      for &(aspect_ratio, resolution, _) in TEXT_GRID {
+        assert_eq!(
+          cents(make_inputs(0, Some(Q::Auto), aspect_ratio, resolution, 1)),
+          cents(make_inputs(0, Some(Q::High), aspect_ratio, resolution, 1)),
+          "{aspect_ratio:?} {resolution:?}",
+        );
+      }
+    }
+
     #[test]
     fn batch_multiplies_per_image_cents() {
       for &(aspect_ratio, resolution, _) in TEXT_GRID {
@@ -265,7 +303,7 @@ mod tests {
     #[test]
     fn prices_rise_with_quality_and_size() {
       for &(_, _, prices) in OUTPUT_IMAGE_PRICE_TABLE {
-        assert!(prices[0] < prices[1] && prices[1] < prices[2], "{prices:?}");
+        assert!(prices.windows(2).all(|pair| pair[0] < pair[1]), "{prices:?}");
       }
       assert!(output_image_price(Q::High, 1024, 1024) < output_image_price(Q::High, 2048, 2048));
       assert!(output_image_price(Q::High, 2048, 2048) < output_image_price(Q::High, 2880, 2880));

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/fal/gpt_image_1/build.rs

@@ -100,11 +100,17 @@ fn plan_num_images(
   }
 }
 
+/// This endpoint only offers low / medium / high. `auto` falls back to Fal's default (`high`)
+/// and the higher GPT Image 2.5 tiers (`xhigh`, `max`) clamp down to `high`.
 fn plan_quality(quality: Option<RouterQuality>) -> PlannedQuality {
   match quality {
     Some(RouterQuality::Low) => PlannedQuality::Low,
     Some(RouterQuality::Medium) => PlannedQuality::Medium,
-    Some(RouterQuality::High) | None => PlannedQuality::High,
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max)
+    | Some(RouterQuality::Auto)
+    | None => PlannedQuality::High,
   }
 }
 
@@ -337,6 +343,10 @@ mod tests {
       (Some(RouterQuality::Low), "Some(Low)"),
       (Some(RouterQuality::Medium), "Some(Medium)"),
       (Some(RouterQuality::High), "Some(High)"),
+      // Tiers this endpoint lacks clamp to high.
+      (Some(RouterQuality::Auto), "Some(High)"),
+      (Some(RouterQuality::XHigh), "Some(High)"),
+      (Some(RouterQuality::Max), "Some(High)"),
     ];
 
     for (quality, expected) in cases {

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/fal/gpt_image_1p5/build.rs

@@ -100,11 +100,17 @@ fn plan_num_images(
   }
 }
 
+/// This endpoint only offers low / medium / high. `auto` falls back to Fal's default (`high`)
+/// and the higher GPT Image 2.5 tiers (`xhigh`, `max`) clamp down to `high`.
 fn plan_quality(quality: Option<RouterQuality>) -> PlannedQuality {
   match quality {
     Some(RouterQuality::Low) => PlannedQuality::Low,
     Some(RouterQuality::Medium) => PlannedQuality::Medium,
-    Some(RouterQuality::High) | None => PlannedQuality::High,
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max)
+    | Some(RouterQuality::Auto)
+    | None => PlannedQuality::High,
   }
 }
 
@@ -337,6 +343,10 @@ mod tests {
       (Some(RouterQuality::Low), "Some(Low)"),
       (Some(RouterQuality::Medium), "Some(Medium)"),
       (Some(RouterQuality::High), "Some(High)"),
+      // Tiers this endpoint lacks clamp to high.
+      (Some(RouterQuality::Auto), "Some(High)"),
+      (Some(RouterQuality::XHigh), "Some(High)"),
+      (Some(RouterQuality::Max), "Some(High)"),
     ];
 
     for (quality, expected) in cases {

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/fal/gpt_image_2/build.rs

@@ -106,11 +106,17 @@ fn plan_num_images(
   }
 }
 
+/// This endpoint only offers low / medium / high. `auto` falls back to Fal's default (`high`)
+/// and the higher GPT Image 2.5 tiers (`xhigh`, `max`) clamp down to `high`.
 fn plan_quality(quality: Option<RouterQuality>) -> PlannedQuality {
   match quality {
     Some(RouterQuality::Low) => PlannedQuality::Low,
     Some(RouterQuality::Medium) => PlannedQuality::Medium,
-    Some(RouterQuality::High) | None => PlannedQuality::High,
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max)
+    | Some(RouterQuality::Auto)
+    | None => PlannedQuality::High,
   }
 }
 
@@ -362,6 +368,10 @@ mod tests {
       (Some(RouterQuality::Low), "Some(Low)"),
       (Some(RouterQuality::Medium), "Some(Medium)"),
       (Some(RouterQuality::High), "Some(High)"),
+      // Tiers this endpoint lacks clamp to high.
+      (Some(RouterQuality::Auto), "Some(High)"),
+      (Some(RouterQuality::XHigh), "Some(High)"),
+      (Some(RouterQuality::Max), "Some(High)"),
     ];
 
     for (quality, expected) in cases {

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/fal/gpt_image_2p5_common/plan.rs

@@ -82,13 +82,16 @@ fn plan_num_images(
   }
 }
 
-/// The router only exposes low / medium / high; GPT Image 2.5's `xhigh` and `max` tiers are
-/// not reachable through it. Fal's default (`high`) applies when unspecified.
+/// GPT Image 2.5 supports every router tier natively. Fal's default (`high`) applies when
+/// unspecified.
 fn plan_quality(quality: Option<RouterQuality>) -> GptImage2p5Quality {
   match quality {
-    Some(RouterQuality::Low) => GptImage2p5Quality::Low,
-    Some(RouterQuality::Medium) => GptImage2p5Quality::Medium,
+    Some(RouterQuality::Auto) => GptImage2p5Quality::Auto,
+    Some(RouterQuality::Max) => GptImage2p5Quality::Max,
+    Some(RouterQuality::XHigh) => GptImage2p5Quality::XHigh,
     Some(RouterQuality::High) | None => GptImage2p5Quality::High,
+    Some(RouterQuality::Medium) => GptImage2p5Quality::Medium,
+    Some(RouterQuality::Low) => GptImage2p5Quality::Low,
   }
 }
 
@@ -220,9 +223,12 @@ mod tests {
   fn quality_maps_exhaustively_for_text_and_edit() {
     let cases = [
       (None, "Some(High)"),
-      (Some(RouterQuality::Low), "Some(Low)"),
-      (Some(RouterQuality::Medium), "Some(Medium)"),
+      (Some(RouterQuality::Auto), "Some(Auto)"),
+      (Some(RouterQuality::Max), "Some(Max)"),
+      (Some(RouterQuality::XHigh), "Some(XHigh)"),
       (Some(RouterQuality::High), "Some(High)"),
+      (Some(RouterQuality::Medium), "Some(Medium)"),
+      (Some(RouterQuality::Low), "Some(Low)"),
     ];
     for (quality, expected) in cases {
       let text = unwrap_t2i(plan_gpt_image_2p5_params(&GenerateImageRequestBuilder { quality, ..base_builder() }));

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/fal/gpt_image_2p5_flare/cost.rs

@@ -53,6 +53,9 @@ mod tests {
     (Some(Q::Low),    Some(Ar::Square),        None,          1,  1),
     (Some(Q::Medium), Some(Ar::Square),        None,          1,  2),
     (Some(Q::High),   Some(Ar::Square),        None,          1,  6),
+    (Some(Q::Auto),   Some(Ar::Square),        None,          1,  6), // auto is priced as high
+    (Some(Q::XHigh),  Some(Ar::Square),        None,          1, 10),
+    (Some(Q::Max),    Some(Ar::Square),        None,          1, 22),
     (Some(Q::High),   Some(Ar::Square),        None,          4, 24),
     (Some(Q::High),   Some(Ar::SquareHd),      None,          1,  9),
     (Some(Q::High),   Some(Ar::Square),        Some(R::TwoK), 1,  9),

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/fal/gpt_image_2p5_sunburst/cost.rs

@@ -53,6 +53,9 @@ mod tests {
     (Some(Q::Low),    Some(Ar::Square),        None,          1,  1),
     (Some(Q::Medium), Some(Ar::Square),        None,          1,  2),
     (Some(Q::High),   Some(Ar::Square),        None,          1,  6),
+    (Some(Q::Auto),   Some(Ar::Square),        None,          1,  6), // auto is priced as high
+    (Some(Q::XHigh),  Some(Ar::Square),        None,          1, 10),
+    (Some(Q::Max),    Some(Ar::Square),        None,          1, 22),
     (Some(Q::High),   Some(Ar::Square),        None,          4, 24),
     (Some(Q::High),   Some(Ar::SquareHd),      None,          1,  9),
     (Some(Q::High),   Some(Ar::Square),        Some(R::TwoK), 1,  9),

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/kinovi/midjourney_7/build.rs

@@ -122,10 +122,14 @@ pub(crate) fn plan_quality(quality: Option<RouterQuality>) -> Option<GenerateMid
   // Kinovi pricing — pass through whatever the caller asked for, and let
   // `None` ride Midjourney's server-side default.
   match quality {
-    None => None,
+    // `auto` has no Midjourney equivalent; leave it to the provider default.
+    None | Some(RouterQuality::Auto) => None,
     Some(RouterQuality::Low) => Some(GenerateMidjourneyV7Quality::Quarter),
     Some(RouterQuality::Medium) => Some(GenerateMidjourneyV7Quality::Half),
-    Some(RouterQuality::High) => Some(GenerateMidjourneyV7Quality::Full),
+    // Midjourney tops out at full quality; the higher GPT Image tiers clamp to it.
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max) => Some(GenerateMidjourneyV7Quality::Full),
   }
 }
 

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/kinovi/midjourney_7_niji/build.rs

@@ -110,10 +110,14 @@ pub(crate) fn plan_aspect_ratio(
 
 pub(crate) fn plan_quality(quality: Option<RouterQuality>) -> Option<GenerateMidjourneyV7NijiQuality> {
   match quality {
-    None => None,
+    // `auto` has no Midjourney equivalent; leave it to the provider default.
+    None | Some(RouterQuality::Auto) => None,
     Some(RouterQuality::Low) => Some(GenerateMidjourneyV7NijiQuality::Quarter),
     Some(RouterQuality::Medium) => Some(GenerateMidjourneyV7NijiQuality::Half),
-    Some(RouterQuality::High) => Some(GenerateMidjourneyV7NijiQuality::Full),
+    // Midjourney tops out at full quality; the higher GPT Image tiers clamp to it.
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max) => Some(GenerateMidjourneyV7NijiQuality::Full),
   }
 }
 

crates/api_clients/artcraft/artcraft_router/src/generate/generate_image/providers/kinovi/midjourney_8/build.rs

@@ -110,10 +110,14 @@ pub(crate) fn plan_aspect_ratio(
 
 pub(crate) fn plan_quality(quality: Option<RouterQuality>) -> Option<GenerateMidjourneyV8Quality> {
   match quality {
-    None => None,
+    // `auto` has no Midjourney equivalent; leave it to the provider default.
+    None | Some(RouterQuality::Auto) => None,
     Some(RouterQuality::Low) => Some(GenerateMidjourneyV8Quality::Quarter),
     Some(RouterQuality::Medium) => Some(GenerateMidjourneyV8Quality::Half),
-    Some(RouterQuality::High) => Some(GenerateMidjourneyV8Quality::Full),
+    // Midjourney tops out at full quality; the higher GPT Image tiers clamp to it.
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max) => Some(GenerateMidjourneyV8Quality::Full),
   }
 }
 

crates/api_clients/artcraft/artcraft_router/src/generate/generate_video/providers/artcraft/build_common.rs

@@ -77,6 +77,7 @@ pub fn build_artcraft_omni_video_request(
     resolution,
     aspect_ratio,
     bitrate,
+    maybe_output_format: None,
     duration_seconds: duration_seconds.map(|d| d as u16),
     video_batch_count: Some(batch_count),
     negative_prompt: None,

crates/api_clients/artcraft/artcraft_router/src/generate/generate_video/providers/artcraft/grok_imagine_video_1p5/request.rs

@@ -59,6 +59,7 @@ mod tests {
         resolution: None,
         aspect_ratio: None,
         bitrate: None,
+        maybe_output_format: None,
         quality: None,
         duration_seconds: Some(5),
         video_batch_count: Some(1),

crates/desktop/artcraft/.taurignore

@@ -1,4 +1,5 @@
-# Don't restart the dev server on Rust changes
-crates/
-Cargo.toml
-Cargo.lock
+# Rust sources and Cargo manifests must remain watched for `cargo tauri dev`.
+# Vite owns frontend reloads; build artifacts must not trigger Rust rebuilds.
+target/
+node_modules/
+dist/

crates/desktop/artcraft/Cargo.toml

@@ -3,7 +3,7 @@ name = "artcraft"
 version = "0.0.1"
 description = "Artcraft"
 authors = ["you"]
-license = ""
+license = "MIT OR Apache-2.0"
 repository = ""
 edition = "2021"
 rust-version = "1.77.2"