NOTICE: note third-party assets will be phased out

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
NOTICE: drop Adobe mention from Mixamo line
2026-10-21 17:28:24 -04:00 · 2026-10-10 04:13:52 -04:00 · 2026-10-10 04:12:51 -04:00 · 2026-10-10 04:09:57 -04:00 · 2026-10-09 13:03:51 -04:00 · 2026-10-09 13:01:10 -04:00
329 changed files with 6858 additions and 2911 deletions
@@ -262,6 +262,7 @@ version = "0.0.1"
 dependencies = [
 "anyhow",
 "artcraft_api_defs",
+ "artcraft_client_identity",
 "backoff",
 "chrono",
 "cloudflare_errors",
@@ -282,6 +283,13 @@ dependencies = [
 "uuid_utils",
 ]

+[[package]]
+name = "artcraft_client_identity"
+version = "0.0.1"
+dependencies = [
+ "url",
+]
+
 [[package]]
 name = "artcraft_router"
 version = "0.0.1"
@@ -7018,6 +7026,7 @@ dependencies = [
 name = "tauri-plugin-http"
 version = "2.4.3"
 dependencies = [
+ "artcraft_client_identity",
 "bytes",
 "cookie_store 0.21.1",
 "data-url",
@@ -16,6 +16,7 @@ members = [
  "crates/api_clients/worldlabs_api_client",
  "crates/api_clients/worldlabs_consumer_client",
  "crates/desktop/artcraft",
+  "crates/lib/artcraft_client_identity",
  "crates/lib/browser_emulation",
  "crates/lib/build_metadata",
  "crates/lib/caching/memory_store",
@@ -49,6 +50,7 @@ publish = false
 [workspace.dependencies]
 artcraft_api_defs = { path = "crates/api_clients/artcraft/artcraft_api_defs" }
 artcraft_client = { path = "crates/api_clients/artcraft/artcraft_client" }
+artcraft_client_identity = { path = "crates/lib/artcraft_client_identity" }
 artcraft_router = { path = "crates/api_clients/artcraft/artcraft_router" }
 browser_emulation = { path = "crates/lib/browser_emulation" }
 cookie_store_wrapper = { path = "crates/lib/cookie_store_wrapper" }
@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ArtCraft Team and the ArtCraft contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -1,86 +0,0 @@
-ArtCraft License (WIP)
-======================
-
-(**Warning**: This isn't a real lawyery license full of legitimate legalese yet, but we'll take care of that ASAP.)
-
-ArtCraft is a form of "fair source" software. It's like [free beer](https://en.wiktionary.org/wiki/free_as_in_beer) 
-in that we give you the code, but there are a few small limitations on what you can do with it.
-
-First, what you *can* do with ArtCraft:
-
->  1. You do not have to pay us to use ArtCraft. It's free.
-> 
->  2. You can back up, copy, modify, compile, and use the code for your own private personal purposes.
->  
->  3. You can do anything you want with the media you create with ArtCraft. Generated assets are yours.
-
-What you *can't do* with ArtCraft:
-
-> 1. You cannot sell the ArtCraft software commercially (eg. as your own software).
->  
-> 2. You cannot use the ArtCraft code to develop a competing business or product (eg. selling AI image and video tools).
->
-> 3. You cannot fork ArtCraft and remove ArtCraft community, donation links, or paid model services. We intend to 
->    make money to improve ArtCraft for everyone.
-> 
-> 4. You cannot use the ArtCraft name, logo, or mascot characters to promote your business without permission.
-
-This license means you can see what we're doing and not be at risk of having the rug pulled out from under 
-you (eg. if our founders die, if our business collapses, if zombies or space aliens invade). It also gives 
-you a really great way to customize the software or lend a hand in reporting (or even fixing) bugs.
-
-Our desire is to support artists, designers, and filmmakers. We want to help you build your own creative studios
-and businesses. We want to give you creative software you can use forever.
-
-ArtCraft is free. We do offer models available through us where you can pay us and support our development, but we also 
-offer the ability for you to use other providers - and we'll keep adding more options so you have maximum flexibility.
-
-## Our Promise
-
- All development and business plans will be communicated openly with the community.
-
- Except for minor test scripts or a few small places where we might need to use licensed 3rd party code, all of 
-  our engineering efforts will live in a single publicly available monorepo. You can see everything we do and even 
-  benefit from using it for personal use. We plan on building a lot more than what you see today, and you'll get 
-  all of it.
-
- We will not "rug pull" our users. If our business shuts down, gets acquired, or otherwise changes, the tools 
-  we create will always continue to function in the same way.
-
- If the business ends and our founders quit working in this space, we'll make it so the software transitions 
-  to an OSI-approved open source license. (We don't intend to quit!)
-
-## Why not OSI Open Source?
-
-Philosophical answer: The OSI is an industry body led by hyperscalers. They poach from open source all the time, yet 
-hyperscaler systems and code (AWS, GCP, YouTube, etc.) remain closed source. The tiniest nuggets are open, but the vast 
-machinery surrounding it - systems, user behaviors, funnels, at-scale moneymakers - is totally closed.
-
-Practical answer: OSI licenses make it exceptionally challenging to grow big things commercially. And many of 
-the licenses leave room for hyperscalers to reach in and cherry-pick pieces for themselves that they can better 
-commercialize than the original authors.
-
-Then there's completely open source software that doesn't even attempt to be a business. 
-
-We love software like Blender, but (1) developing ArtCraft is our full-time job, (2) we want to build something at scale
-that is much bigger than what you presently see, and (3) this will eventually become much more capital intensive than 
-just writing code - we want to train novel models that work directly in conjunction with the user interface. 
-
-If and when we do get to scale, we intend to keep every bit of our work in the open, including the models. Available 
-for use, inspection, learning, fitting onto consumer GPU hardware, and more. 
-
-Not having a way to make money is unfortunately what killed Stability.ai. Stability.ai walked so that others could 
-eventually run. (Black Forest Labs, et al.) We're not egotistical enough to count ourselves in that party yet, but we 
-believe in the original Stability.ai ethos and that their model can work with a few tweaks. 
-
-We want to build big and incredible tools the world hasn't seen before. We want to keep them free and entirely source 
-available. You don't have to pay us, but if you do, all of your investment goes right back into the engineering 
-and the tools. We're writing code you can clone and keep.
-
-## Inspiration
-
-We took inspiration for this from [Fair Source](https://fair.io/), [Fair Code](https://faircode.io/), 
-the [Defold License](https://defold.com/license/), and Hacker News discussions. The folks at Obsidian 
-have some pretty good thoughts on this as well.
-
-~ Brandon Thomas
@@ -0,0 +1,48 @@
+ArtCraft
+Copyright (c) 2026 ArtCraft Team and the ArtCraft contributors.
+Licensed under the MIT License or the Apache License, Version 2.0, at your option
+(LICENSE-MIT, LICENSE-APACHE).
+
+The ArtCraft name, wordmark and logos are trademarks of the ArtCraft Team. They are not covered
+by the license above.
+
+Third-party material
+
+This product bundles third-party material under its own licenses, listed below.
+
+ammo.js (frontend/apps/artcraft/app/public/jsm/libs/ammo.wasm.*) — zlib License. A port of the
+  Bullet Physics engine. https://github.com/kripken/ammo.js
+tauri-plugin-http (crates/vendor/tauri-plugin-http/) — MIT or Apache-2.0. Copyright (c) 2017 -
+  Present Tauri Apps Contributors; Copyright 2019-2023 Tauri Programme within The Commons
+  Conservancy. Modified fork; see that directory's LICENSE_MIT and LICENSE_APACHE-2.0.
+normalize.css v8.0.1 (frontend/apps/artcraft/app/src/styles/normalize.css) — MIT License.
+  Copyright (c) Nicolas Gallagher and Jonathan Neal. https://github.com/necolas/normalize.css
+three-dots v0.3.2 (portion of frontend/apps/artcraft/app/src/styles/base.css) — MIT License.
+  Copyright (c) 2018 nzbin. https://nzbin.github.io/three-dots/
+Font Awesome Free icons (frontend/libs/icons/src/lib/brand-icons.tsx,
+  frontend/apps/artcraft/app/public/resources/images/services/generic.svg) — CC BY 4.0.
+  Copyright Fonticons, Inc. https://fontawesome.com/license/free
+Carter One font (frontend/apps/artcraft/app/public/resources/fonts/CarterOneRegular.json) —
+  SIL Open Font License 1.1. https://fonts.google.com/specimen/Carter+One
+
+Third-party trademarks
+
+The AI provider and service logos in frontend/apps/artcraft/app/public/resources/images/services/
+are trademarks of their respective owners. They are used only to identify those services and are
+not covered by the license above.
+
+Material not covered by the license above
+
+The following files are owned by third parties. They are not licensed under MIT or Apache-2.0,
+and no rights to them are granted by this repository. They remain the property of their
+respective owners. These assets will be phased out of ArtCraft over time.
+
+frontend/apps/artcraft/app/public/resources/sound/ — sound effects from Nintendo games (Golden
+  Sun, Metroid Prime, The Legend of Zelda: Ocarina of Time, Super Mario RPG).
+frontend/apps/artcraft/app/public/resources/memes/ — meme images and likenesses owned by their
+  respective rights holders.
+frontend/apps/artcraft/app/public/resources/skybox/gray/ and skybox/night/ — skybox textures
+  from a third-party asset pack.
+frontend/apps/artcraft/app/public/resources/pose/Lumine Idle cycle.vmd — third-party MMD motion
+  data.
+frontend/apps/artcraft/app/public/resources/characters_gif/ — renders of Mixamo animations.
@@ -136,4 +136,10 @@ Additional provider integrations are planned for Kling, Google, Runway, and Luma
 - [Developer documentation](./_docs)
 - [Desktop build and development scripts](./script/artcraft)
 - [Roadmap](./ROADMAP.md)
- [License](./LICENSE.md)
+- [License](#license)
+
+## License
+
+ArtCraft is dual-licensed under [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), at your option.
+Copyright (c) 2026 ArtCraft Team and the ArtCraft contributors. Required notices, including
+third-party material not covered by this license, are in [NOTICE](NOTICE).
@@ -9,21 +9,67 @@ To set up the ArtCraft development environment,  install the following:

 1. [Install Rust](https://doc.rust-lang.org/cargo/getting-started/installation.html).
 2. [Install npm](https://nodejs.org/en/download) or [nvm](https://github.com/nvm-sh/nvm). (Node version `v24.13.0` works at time of writing.) 
-3. [Install nx](https://nx.dev/docs/getting-started/installation). (Nx version `v22.4.5` works at time of writing.)
+3. The frontend's Nx and Vite dependencies are installed locally with npm; a global Nx installation is not required for the combined Unix launcher.
 4. [Install Tauri CLI](https://v2.tauri.app/reference/cli/). (Version `tauri-cli 2.10.0` works at time of writing.)

-An easy way to get started with running the app in development is to run the two commands (in separate terminals):
-
 **Mac and Linux Development** 

 ```bash
-# Run the frontend dev server
-./script/artcraft/unix_frontend_dev.sh
+# Start the frontend and Rust/Tauri together in one terminal
+./script/artcraft/unix_dev.sh

-# Run the Tauri Rust application
-./script/artcraft/unix_rust_dev.sh
+# Optionally start the free-port search at another port
+ARTCRAFT_DEV_PORT=6200 ./script/artcraft/unix_dev.sh
 ```

+Use the combined launcher instead of starting the two legacy dev scripts. It
+works from any working directory when invoked by its path and installs frontend
+dependencies if the local Vite installation is missing. Node.js 20+ is required.
+
+The launcher binds Vite to `127.0.0.1`, starting at port **5193** and trying
+successive ports until one is available. It leaves existing listeners alone.
+Only after the real frontend socket is bound does it start Tauri with that exact
+`devUrl`. HTTP and the HMR websocket share the selected port; Rust communicates
+through native Tauri IPC and needs no separate HTTP port. Configuration overrides
+are passed in memory, without changing the checked-in Tauri config.
+
+The native HTTP bridge normalizes loopback development origins for first-party
+API requests so an automatically selected port does not break login or media
+loading. See the [desktop session regression checks](../docs/desktop-session-regression.md)
+when changing ports, the launcher, or authentication.
+
+JavaScript, TypeScript, React, and CSS changes use Vite hot reload; compatible
+React component edits use Fast Refresh. Changes that cannot be hot-replaced
+reload the page. Rust changes use `cargo tauri dev`'s automatic **rebuild and app
+restart**, including dependent workspace crates. SQLx metadata and SQLite
+migrations are also watched. Rust reload is a process restart, so it does not
+preserve unsaved in-memory app state. See [Tauri's watch behavior](https://v2.tauri.app/develop/#reacting-to-source-code-changes).
+
+After startup, a Vite configuration restart must reuse the chosen port or report
+an error; it cannot silently switch to another port while Tauri uses an old URL.
+Ctrl-C stops this session's frontend, Rust watcher/compiler, and desktop app.
+If the Rust watcher exits, the launcher closes Vite and propagates the exit code.
+It never finds or terminates another app by name or port.
+
+The launcher retains the existing Unix defaults for `VITE_ENVIRONMENT_TYPE`,
+`SQLX_OFFLINE`, `RUSTFLAGS`, and the Linux WebKit workarounds. Explicit environment
+overrides are preserved. It uses the normal Artcraft app data and Cargo target
+directory; port separation does not create an isolated account/data profile, and
+concurrent Rust builds can wait on Cargo's build lock.
+
+To verify the launcher without compiling Rust or opening a desktop window:
+
+```bash
+node --test frontend/scripts/unix-dev.test.mjs
+```
+
+The tests use real Vite listeners and HMR, with a test-owned fake Cargo process
+tree. They cover occupied ports, simultaneous launches, React edits, shutdown,
+Rust-process failure, and watcher arguments. To verify native Rust reload, run
+the launcher, wait for the desktop window, make a Rust source edit, and check for
+a rebuild/restart in the same terminal. Frontend edits should update the webview
+without restarting the Rust process.
+
 **Windows Development**

 ```powershell
@@ -19,6 +19,7 @@ path = "src/lib.rs"

 # Internal
 artcraft_api_defs.workspace = true
+artcraft_client_identity.workspace = true
 cloudflare_errors.workspace = true
 enums.workspace = true
 errors.workspace = true
@@ -29,7 +29,7 @@ pub async fn get_media_file(api_host: &ApiHost, media_file_token: &MediaFileToke

  debug!("Requesting {:?}", &url);

-  let response = http_get_anonymous(url).await?;
+  let response = http_get_anonymous(api_host, url).await?;
  let response = filter_bad_response(response).await?;
  let response_body = &response.text().await
      .map_err(|err| StorytellerError::Api(ApiError::from(err)))?;
@@ -3,7 +3,8 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use chrono::{DateTime, Utc};
@@ -11,7 +12,6 @@ use enums::common::generation_provider::GenerationProvider;
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::path::Path;
 use tokens::tokens::batch_generations::BatchGenerationToken;
@@ -56,8 +56,7 @@ pub async fn legacy_upload_media_file_from_file<P: AsRef<Path>>(

  //let mut file = File::open(path)?;

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(args.api_host)
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

@@ -86,7 +85,6 @@ pub async fn legacy_upload_media_file_from_file<P: AsRef<Path>>(
  }

  let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON);
  
  if let Some(creds) = args.maybe_creds {
@@ -3,7 +3,8 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use enums::common::generation_provider::GenerationProvider;
@@ -11,7 +12,6 @@ use chrono::{DateTime, Utc};
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::fs::File;
 use std::io::Read;
@@ -72,8 +72,7 @@ pub async fn upload_image_media_file_from_bytes(

  debug!("Requesting {:?}", &url);

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(args.api_host)
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

@@ -95,7 +94,6 @@ pub async fn upload_image_media_file_from_bytes(
  }

  let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON);
  
  if let Some(creds) = args.maybe_creds {
@@ -3,7 +3,8 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use chrono::{DateTime, Utc};
@@ -11,7 +12,6 @@ use enums::common::generation_provider::GenerationProvider;
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::path::Path;
 use tokens::tokens::batch_generations::BatchGenerationToken;
@@ -65,8 +65,7 @@ pub async fn upload_image_media_file_from_file_with_idempotency_token<P: AsRef<P

  //let mut file = File::open(path)?;

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(args.api_host)
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

@@ -95,7 +94,6 @@ pub async fn upload_image_media_file_from_file_with_idempotency_token<P: AsRef<P
  }

  let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON);
  
  if let Some(creds) = args.maybe_creds {
@@ -1,7 +1,8 @@
 use crate::credentials::storyteller_credential_set::StorytellerCredentialSet;
 use crate::error::api_error::ApiError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use enums::common::generation_provider::GenerationProvider;
@@ -9,7 +10,6 @@ use chrono::{DateTime, Utc};
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::path::Path;
 use tokens::tokens::batch_generations::BatchGenerationToken;
@@ -32,8 +32,7 @@ pub async fn upload_new_engine_asset_from_file<P: AsRef<Path>>(

  debug!("Requesting {:?}", &url);

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
      .build()?;

  let file_bytes = std::fs::read(path.as_ref())?;
@@ -49,7 +48,6 @@ pub async fn upload_new_engine_asset_from_file<P: AsRef<Path>>(
  }

  let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON);
  
  if let Some(creds) = maybe_creds {
@@ -1,7 +1,8 @@
 use crate::credentials::storyteller_credential_set::StorytellerCredentialSet;
 use crate::error::api_error::ApiError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use crate::utils::http_get_anonymous::http_get_anonymous;
 use enums::common::generation_provider::GenerationProvider;
@@ -9,7 +10,6 @@ use chrono::{DateTime, Utc};
 use uuid_utils::uuid::generate_random_uuid;
 use log::debug;
 use reqwest::multipart::{Form, Part};
-use reqwest::Client;
 use serde_derive::{Deserialize, Serialize};
 use std::path::Path;
 use tokens::tokens::batch_generations::BatchGenerationToken;
@@ -58,8 +58,7 @@ pub async fn upload_video_media_file_from_file<P: AsRef<Path>>(

  debug!("Requesting {:?}", &url);

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(args.api_host)
      .build()?;

  let file_bytes = std::fs::read(args.path.as_ref())?;
@@ -78,7 +77,6 @@ pub async fn upload_video_media_file_from_file<P: AsRef<Path>>(
  }

  let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON);
  
  if let Some(creds) = args.maybe_creds {
@@ -1,4 +1,6 @@

+use artcraft_client_identity::origins::{ARTCRAFT_DESKTOP_DEVELOPMENT_ORIGIN, ARTCRAFT_DESKTOP_ORIGIN};
+
 const HTTP_SCHEME: &str = "http";

 const HTTPS_SCHEME: &str = "https";
@@ -27,6 +29,15 @@ impl ApiHost {
    }
  }
  
+  /// The `Origin` the desktop client declares to this API.
+  pub fn request_origin(&self) -> &'static str {
+    match self {
+      ApiHost::Storyteller => ARTCRAFT_DESKTOP_ORIGIN,
+      ApiHost::FakeYou => ARTCRAFT_DESKTOP_ORIGIN,
+      ApiHost::Localhost { .. } => ARTCRAFT_DESKTOP_DEVELOPMENT_ORIGIN,
+    }
+  }
+
  pub fn scheme(&self) -> &'static str {
    match self {
      ApiHost::Storyteller => HTTPS_SCHEME,
@@ -3,10 +3,10 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use log::{debug, info};
-use reqwest::Client;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};

@@ -21,13 +21,11 @@ pub async fn basic_json_delete_request<Req: Serialize, Res: DeserializeOwned>(

  info!("DELETE {:?}", &url);

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

  let mut request_builder = client.delete(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON)
      .header("Content-Type", APPLICATION_JSON);

@@ -3,10 +3,10 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use log::{debug, info};
-use reqwest::Client;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};

@@ -20,13 +20,11 @@ pub async fn basic_json_get_request<Res: DeserializeOwned>(

  debug!("Requesting {:?}", &url);

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

  let mut request_builder = client.get(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON);

  if let Some(creds) = maybe_creds {
@@ -3,10 +3,10 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use log::{debug, info};
-use reqwest::Client;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};

@@ -30,13 +30,11 @@ pub async fn basic_json_post_request<Req: Serialize, Res: DeserializeOwned>(
    info!("Requesting {:?}", &url);
  }

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

  let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON)
      .header("Content-Type", APPLICATION_JSON);

@@ -3,11 +3,11 @@ use crate::error::api_error::ApiError;
 use crate::error::client_error::ClientError;
 use crate::error::storyteller_error::StorytellerError;
 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::{APPLICATION_JSON, USER_AGENT};
+use crate::utils::constants::APPLICATION_JSON;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
 use crate::utils::filter_bad_response::filter_bad_response;
 use errors::AnyhowResult;
 use log::{debug, info};
-use reqwest::Client;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -26,13 +26,11 @@ pub async fn basic_query_string_post_request<Res: DeserializeOwned>(

  debug!("Requesting {:?}", &url);

-  let client = Client::builder()
-      .gzip(true)
+  let client = storyteller_client_builder(api_host)
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

  let mut request_builder = client.post(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", APPLICATION_JSON);

  if let Some(creds) = maybe_creds {
@@ -1,4 +1 @@
-
-pub const USER_AGENT: &str = "storyteller-client/1.0";
-
 pub const APPLICATION_JSON : &str = "application/json";
@@ -1,14 +1,12 @@
 use crate::error::api_error::ApiError;
-use reqwest::Client;
-const USER_AGENT: &str = "storyteller-client/1.0";
+use crate::utils::api_host::ApiHost;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;

-pub async fn http_get_anonymous(url: String) -> Result<reqwest::Response, ApiError> {
-  let client = Client::builder()
-      .gzip(true)
+pub async fn http_get_anonymous(api_host: &ApiHost, url: String) -> Result<reqwest::Response, ApiError> {
+  let client = storyteller_client_builder(api_host)
      .build()?;

  let response = client.get(url)
-      .header("User-Agent", USER_AGENT)
      .header("Accept", "application/json")
      //.header("Accept-Encoding", "gzip, deflate, br")
      .send()
@@ -1,13 +1,18 @@
+use std::collections::BTreeMap;
 use std::time::Duration;

 use log::{info, warn};
 use reqwest::header::SET_COOKIE;
-use reqwest::{Client, Method, RequestBuilder};
+use reqwest::{Client, Method, RequestBuilder, Response};
 use serde::de::DeserializeOwned;
+use serde::Deserialize;
 use url::Url;

 use crate::utils::api_host::ApiHost;
-use crate::utils::constants::USER_AGENT;
+use crate::utils::storyteller_client_builder::storyteller_client_builder;
+
+/// Rejection bodies are small JSON objects; anything larger is not one of ours.
+const MAX_REJECTION_BODY_BYTES: usize = 16 * 1024;

 /// Native transport for the session bridge. No request/response bodies, cookies,
 /// or challenge credentials are logged, even at debug level. Never follows redirects.
@@ -21,18 +26,30 @@ pub struct LoginChallengeClient {
 pub struct LoginChallengeClientError {
  pub status: Option<u16>,
  pub message: &'static str,
+  /// The server's explanation for a non-2xx response, when it sent one.
+  pub maybe_rejection: Option<LoginRejection>,
+}
+
+/// The error fields of a rejected login or signup response, such as
+/// `{"error_type":"UsernameTaken","error_fields":{"username":"username is taken"}}`.
+/// Only these fields are parsed, so no credential can end up in this struct.
+#[derive(Debug, Default, Deserialize)]
+pub struct LoginRejection {
+  pub error_type: Option<String>,
+  pub error_message: Option<String>,
+  #[serde(default)]
+  pub error_fields: BTreeMap<String, String>,
 }

 impl LoginChallengeClient {
  pub fn new(api_host: &ApiHost) -> Result<Self, LoginChallengeClientError> {
-    let mut builder = Client::builder();
+    let mut builder = storyteller_client_builder(api_host);
    if matches!(api_host, ApiHost::Localhost { .. }) {
      builder = builder.no_proxy();
    }
    let client = builder
      .timeout(Duration::from_secs(15))
      .redirect(reqwest::redirect::Policy::none())
-      .user_agent(USER_AGENT)
      .build()
      .map_err(|_| LoginChallengeClientError::invalid("Unable to initialize login client"))?;
    Ok(Self {
@@ -109,6 +126,7 @@ impl LoginChallengeClient {
      return Err(LoginChallengeClientError {
        status: Some(status.as_u16()),
        message: "Login server rejected the request",
+        maybe_rejection: read_rejection(response).await,
      });
    }
    let session_cookie = response
@@ -138,14 +156,29 @@ impl LoginChallengeClientError {
    Self {
      status: None,
      message,
+      maybe_rejection: None,
    }
  }
 }

 impl std::fmt::Display for LoginChallengeClientError {
  fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-    write!(f, "{} (HTTP {:?})", self.message, self.status)
+    match self.status {
+      Some(status) => write!(f, "{} (HTTP {})", self.message, status),
+      None => write!(f, "{}", self.message),
+    }
  }
 }

 impl std::error::Error for LoginChallengeClientError {}
+
+async fn read_rejection(response: Response) -> Option<LoginRejection> {
+  if response.content_length().is_some_and(|len| len > MAX_REJECTION_BODY_BYTES as u64) {
+    return None;
+  }
+  let body = response.bytes().await.ok()?;
+  if body.len() > MAX_REJECTION_BODY_BYTES {
+    return None;
+  }
+  serde_json::from_slice(&body).ok()
+}
@@ -4,6 +4,7 @@ pub mod basic_json_post_request;
 pub (crate) mod basic_query_string_post_request;
 pub (crate) mod filter_bad_response;
 pub (crate) mod http_get_anonymous;
+pub (crate) mod storyteller_client_builder;
 pub mod api_host;
 pub mod constants;
 pub mod status_codes;
@@ -0,0 +1,17 @@
+use artcraft_client_identity::user_agents::ARTCRAFT_DESKTOP_USER_AGENT;
+use reqwest::header::{HeaderMap, HeaderValue, ORIGIN};
+use reqwest::{Client, ClientBuilder};
+
+use crate::utils::api_host::ApiHost;
+
+/// Every request to our API is built from this so the desktop client identifies itself
+/// consistently (`User-Agent` and `Origin`). Only use it for Storyteller / ArtCraft APIs.
+pub(crate) fn storyteller_client_builder(api_host: &ApiHost) -> ClientBuilder {
+  let mut headers = HeaderMap::new();
+  headers.insert(ORIGIN, HeaderValue::from_static(api_host.request_origin()));
+
+  Client::builder()
+    .user_agent(ARTCRAFT_DESKTOP_USER_AGENT)
+    .default_headers(headers)
+    .gzip(true)
+}
@@ -1,4 +1,5 @@
-# Don't restart the dev server on Rust changes
-crates/
-Cargo.toml
-Cargo.lock
+# Rust sources and Cargo manifests must remain watched for `cargo tauri dev`.
+# Vite owns frontend reloads; build artifacts must not trigger Rust rebuilds.
+target/
+node_modules/
+dist/
@@ -3,7 +3,7 @@ name = "artcraft"
 version = "0.0.1"
 description = "Artcraft"
 authors = ["you"]
-license = ""
+license = "MIT OR Apache-2.0"
 repository = ""
 edition = "2021"
 rust-version = "1.77.2"
@@ -19,6 +19,7 @@ use tokio::sync::Mutex;
 use uuid_utils::uuid::generate_random_uuid;

 use crate::core::threads::main_window_thread::persist_storyteller_cookies_task::get_credentials_from_cookie_store;
+use crate::services::storyteller::commands::password_auth_error_message::password_auth_error_message;
 use crate::services::storyteller::state::storyteller_credential_manager::StorytellerCredentialManager;

 const MAX_PENDING_CHALLENGES: usize = 8;
@@ -74,12 +75,27 @@ impl DesktopLoginError {
      origin, error.status, error.message
    );
    Self {
-      retryable: error
-        .status
-        .map(|s| s == 429 || s >= 500)
-        .unwrap_or(error.message == "Unable to reach the login server"),
+      retryable: is_retryable(&error),
      status: error.status,
-      message: format!("{}: {} (HTTP {:?})", origin, error.message, error.status),
+      message: format!("{}: {}", origin, error),
+    }
+  }
+
+  /// Password login/signup errors are shown to the user verbatim, so they say
+  /// what went wrong ("That username is already taken.") instead of the host.
+  fn from_password_auth(origin: &str, error: LoginChallengeClientError, is_signup: bool) -> Self {
+    warn!(
+      "Password auth failed: origin={} signup={} status={:?} reason={} error_type={:?}",
+      origin,
+      is_signup,
+      error.status,
+      error.message,
+      error.maybe_rejection.as_ref().and_then(|r| r.error_type.as_deref())
+    );
+    Self {
+      retryable: is_retryable(&error),
+      status: error.status,
+      message: password_auth_error_message(&error, is_signup),
    }
  }
 }
@@ -120,12 +136,13 @@ pub(super) async fn password_auth(
 ) -> Result<SessionUserInfo, DesktopLoginError> {
  let client = LoginChallengeClient::new(host)
    .map_err(|e| DesktopLoginError::from_client(&host.to_api_hostname_and_scheme(), e))?;
+  let is_signup = signup.is_some();
  let response = match (login, signup) {
    (Some(request), None) => client.password_login(&request).await,
    (None, Some(request)) => client.password_signup(&request).await,
    _ => return Err(DesktopLoginError::local("Invalid authentication request")),
  }
-  .map_err(|e| DesktopLoginError::from_client(&client.api_origin(), e))?;
+  .map_err(|e| DesktopLoginError::from_password_auth(&client.api_origin(), e, is_signup))?;
  let (response, cookie) = response;
  if !response.success {
    return Err(DesktopLoginError::local(
@@ -335,6 +352,13 @@ fn expired() -> DesktopLoginOutcome {
  }
 }

+fn is_retryable(error: &LoginChallengeClientError) -> bool {
+  error
+    .status
+    .map(|s| s == 429 || s >= 500)
+    .unwrap_or(error.message == "Unable to reach the login server")
+}
+
 #[cfg(test)]
 #[path = "storyteller_login_bridge_tests.rs"]
 mod login_bridge_tests;
@@ -4,6 +4,7 @@ pub mod storyteller_get_subscription_command;
 pub mod stripe_checkout;
 pub mod stripe_customer_portal;
 pub(crate) mod login_bridge;
+mod password_auth_error_message;
 pub mod storyteller_cancel_login_challenge_command;
 pub mod storyteller_create_login_challenge_command;
 pub mod storyteller_get_login_session_command;
@@ -0,0 +1,254 @@
+use artcraft_client::utils::login_challenge_client::{LoginChallengeClientError, LoginRejection};
+
+/// Signup validation fields, in the order they appear on the form.
+const FORM_FIELD_ORDER: [&str; 3] = ["username", "email_address", "password"];
+
+/// Turns a rejected `/v1/login` or `/v1/create_account` call into a sentence a
+/// user can act on, e.g. "That username is already taken."
+pub(super) fn password_auth_error_message(error: &LoginChallengeClientError, is_signup: bool) -> String {
+  let Some(status) = error.status else {
+    return match error.message {
+      "Unable to reach the login server" => {
+        "Couldn't reach the ArtCraft servers. Check your internet connection and try again.".to_owned()
+      }
+      _ => "Something went wrong while signing in. Please try again.".to_owned(),
+    };
+  };
+  if status == 429 {
+    return "Too many attempts. Please wait a minute and try again.".to_owned();
+  }
+  if status >= 500 {
+    return "ArtCraft's servers are having trouble right now. Please try again in a few minutes.".to_owned();
+  }
+  if let Some(message) = error.maybe_rejection.as_ref().and_then(rejection_message) {
+    return message;
+  }
+  match (status, is_signup) {
+    (401, false) => "Incorrect username, email, or password.".to_owned(),
+    (_, true) => "We couldn't create your account. Please check your details and try again.".to_owned(),
+    (_, false) => "We couldn't sign you in. Please check your details and try again.".to_owned(),
+  }
+}
+
+fn rejection_message(rejection: &LoginRejection) -> Option<String> {
+  match rejection.error_type.as_deref() {
+    Some("InvalidCredentials") => return Some("Incorrect username, email, or password.".to_owned()),
+    Some("AccountNeedsPassword") => {
+      return Some(
+        "This account doesn't have a password yet. Sign in through the website, or reset your password.".to_owned(),
+      )
+    }
+    _ => {}
+  }
+
+  let ordered_fields = FORM_FIELD_ORDER
+    .iter()
+    .filter_map(|field| rejection.error_fields.get(*field))
+    .chain(
+      rejection
+        .error_fields
+        .iter()
+        .filter(|(field, _)| !FORM_FIELD_ORDER.contains(&field.as_str()))
+        .map(|(_, reason)| reason),
+    );
+  let field_messages: Vec<String> = ordered_fields.map(|reason| field_reason_message(reason)).collect();
+  if !field_messages.is_empty() {
+    return Some(field_messages.join(" "));
+  }
+
+  match rejection.error_type.as_deref() {
+    Some("UsernameTaken") => Some(field_reason_message("username is taken")),
+    Some("EmailTaken") => Some(field_reason_message("email is taken")),
+    Some("UsernameReserved") => Some(field_reason_message("username is reserved")),
+    _ => rejection
+      .error_message
+      .as_deref()
+      .filter(|message| !message.trim().is_empty())
+      .map(sentence),
+  }
+}
+
+/// Server validation reasons are terse lowercase phrases; known ones get a
+/// friendlier rewrite, and anything else is shown as a sentence.
+fn field_reason_message(reason: &str) -> String {
+  let friendly = match reason {
+    "username is taken" => "That username is already taken. Please choose another.",
+    "username is reserved" | "username contains slurs" => "That username isn't available. Please choose another.",
+    "username is too short" => "Usernames must be at least 3 characters.",
+    "username is too long" => "Usernames can be at most 16 characters.",
+    "invalid username characters" => {
+      "Usernames can only contain letters, numbers, underscores (_), and hyphens (-)."
+    }
+    "email is taken" => "An account with that email already exists. Try logging in instead.",
+    "invalid email address" => "Please enter a valid email address.",
+    "password is too short" => "Passwords must be at least 6 characters.",
+    "passwords do not match" => "Passwords do not match.",
+    other => return sentence(other),
+  };
+  friendly.to_owned()
+}
+
+fn sentence(text: &str) -> String {
+  let text = text.trim();
+  let mut chars = text.chars();
+  let mut sentence: String = match chars.next() {
+    Some(first) => first.to_uppercase().chain(chars).collect(),
+    None => return String::new(),
+  };
+  if !sentence.ends_with(['.', '!', '?']) {
+    sentence.push('.');
+  }
+  sentence
+}
+
+#[cfg(test)]
+mod tests {
+  use std::collections::BTreeMap;
+
+  use super::*;
+
+  mod signup_tests {
+    use super::*;
+
+    #[test]
+    fn username_taken() {
+      let error = rejected(400, Some("UsernameTaken"), None, &[("username", "username is taken")]);
+      assert_eq!(signup_message(&error), "That username is already taken. Please choose another.");
+    }
+
+    #[test]
+    fn email_taken() {
+      let error = rejected(400, Some("EmailTaken"), None, &[("email_address", "email is taken")]);
+      assert_eq!(signup_message(&error), "An account with that email already exists. Try logging in instead.");
+    }
+
+    #[test]
+    fn reserved_username_without_fields_uses_error_type() {
+      let error = rejected(400, Some("UsernameReserved"), None, &[]);
+      assert_eq!(signup_message(&error), "That username isn't available. Please choose another.");
+    }
+
+    #[test]
+    fn multiple_bad_fields_follow_form_order() {
+      let error = rejected(
+        400,
+        Some("BadInput"),
+        None,
+        &[("password", "password is too short"), ("email_address", "invalid email address"), ("username", "invalid username characters")],
+      );
+      assert_eq!(
+        signup_message(&error),
+        "Usernames can only contain letters, numbers, underscores (_), and hyphens (-). Please enter a valid email address. Passwords must be at least 6 characters."
+      );
+    }
+
+    #[test]
+    fn unknown_reason_is_shown_as_a_sentence() {
+      let error = rejected(400, Some("BadInput"), None, &[("username", "username cannot start with 'user_'")]);
+      assert_eq!(signup_message(&error), "Username cannot start with 'user_'.");
+    }
+
+    #[test]
+    fn unparseable_400_gets_generic_signup_message() {
+      let error = status_only(400);
+      assert_eq!(signup_message(&error), "We couldn't create your account. Please check your details and try again.");
+    }
+  }
+
+  mod login_tests {
+    use super::*;
+
+    #[test]
+    fn invalid_credentials() {
+      let error = rejected(401, Some("InvalidCredentials"), Some("invalid credentials"), &[]);
+      assert_eq!(login_message(&error), "Incorrect username, email, or password.");
+    }
+
+    #[test]
+    fn account_needs_password() {
+      let error = rejected(401, Some("AccountNeedsPassword"), Some("account was created without a password"), &[]);
+      assert_eq!(
+        login_message(&error),
+        "This account doesn't have a password yet. Sign in through the website, or reset your password."
+      );
+    }
+
+    #[test]
+    fn bare_401_is_treated_as_bad_credentials() {
+      assert_eq!(login_message(&status_only(401)), "Incorrect username, email, or password.");
+    }
+  }
+
+  mod transport_tests {
+    use super::*;
+
+    #[test]
+    fn rate_limited() {
+      assert_eq!(login_message(&status_only(429)), "Too many attempts. Please wait a minute and try again.");
+    }
+
+    #[test]
+    fn server_error() {
+      let error = rejected(500, Some("ServerError"), Some("server error"), &[]);
+      assert_eq!(
+        signup_message(&error),
+        "ArtCraft's servers are having trouble right now. Please try again in a few minutes."
+      );
+    }
+
+    #[test]
+    fn unreachable() {
+      let error = LoginChallengeClientError::invalid("Unable to reach the login server");
+      assert_eq!(
+        login_message(&error),
+        "Couldn't reach the ArtCraft servers. Check your internet connection and try again."
+      );
+    }
+
+    #[test]
+    fn messages_never_expose_raw_http_details() {
+      for status in [400, 401, 403, 404, 429, 500, 502] {
+        for message in [login_message(&status_only(status)), signup_message(&status_only(status))] {
+          assert!(!message.contains("HTTP"), "{message}");
+          assert!(!message.contains("Some("), "{message}");
+          assert!(!message.contains("://"), "{message}");
+        }
+      }
+    }
+  }
+
+  fn login_message(error: &LoginChallengeClientError) -> String {
+    password_auth_error_message(error, false)
+  }
+
+  fn signup_message(error: &LoginChallengeClientError) -> String {
+    password_auth_error_message(error, true)
+  }
+
+  fn status_only(status: u16) -> LoginChallengeClientError {
+    LoginChallengeClientError {
+      status: Some(status),
+      message: "Login server rejected the request",
+      maybe_rejection: None,
+    }
+  }
+
+  fn rejected(
+    status: u16,
+    error_type: Option<&str>,
+    error_message: Option<&str>,
+    error_fields: &[(&str, &str)],
+  ) -> LoginChallengeClientError {
+    LoginChallengeClientError {
+      maybe_rejection: Some(LoginRejection {
+        error_type: error_type.map(str::to_owned),
+        error_message: error_message.map(str::to_owned),
+        error_fields: error_fields
+          .iter()
+          .map(|(field, reason)| (field.to_string(), reason.to_string()))
+          .collect::<BTreeMap<_, _>>(),
+      }),
+      ..status_only(status)
+    }
+  }
+}
@@ -263,6 +263,31 @@ async fn password_login_and_signup_verify_persist_and_recheck_via_native_api() {
  }
 }

+#[tokio::test]
+async fn password_signup_and_login_rejections_explain_what_went_wrong() {
+  let cases = [
+    (true, 400, json!({"success":false,"error_type":"UsernameTaken","error_fields":{"username":"username is taken"}}), "That username is already taken. Please choose another."),
+    (false, 401, json!({"success":false,"error_type":"InvalidCredentials","error_message":"invalid credentials"}), "Incorrect username, email, or password."),
+  ];
+  for (signup, status, body, expected) in cases {
+    let mut rejected = step(if signup { "/v1/create_account" } else { "/v1/login" }, body);
+    rejected.status = status;
+    let server = server(vec![rejected]);
+    let h = harness();
+    let (login, signup) = if signup {
+      (None, Some(PasswordSignupRequest { username: "google_user".into(), email_address: "user@example.test".into(), password: "fixture_password".into(), password_confirmation: "fixture_password".into(), signup_source: "artcraft".into() }))
+    } else {
+      (Some(PasswordLoginRequest { username_or_email: "google_user".into(), password: "fixture_password".into() }), None)
+    };
+    let error = password_auth(&server.host, &h.manager, &h.jar, login, signup).await.err().unwrap();
+    assert_eq!(error.message, expected);
+    assert_eq!(error.status, Some(status));
+    assert!(!error.retryable);
+    assert!(h.manager.get_credentials().unwrap().is_none());
+    server.thread.join().unwrap();
+  }
+}
+
 #[tokio::test]
 async fn empty_native_cookie_jar_needs_no_session_http_request() {
  let h = harness();
@@ -1,4 +1,4 @@

 /// The version of the ArtCraft desktop app reported in the UI and via Analytics.
 /// This should match the CI builds.
-pub const ARTCRAFT_VERSION: &str = "0.41.0";
+pub const ARTCRAFT_VERSION: &str = "0.42.0";
@@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2.0.0-rc",
  "productName": "ArtCraft",
-  "version": "0.41.0",
+  "version": "0.42.0",
  "identifier": "ai.artcraft.app",
  "build": {
    "frontendDist": "../../../frontend/apps/artcraft/dist",
@@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2.0.0-rc",
  "productName": "ArtCraft",
-  "version": "0.41.0",
+  "version": "0.42.0",
  "identifier": "ai.artcraft.app",
  "build": {
    "frontendDist": "../../../frontend/apps/artcraft/dist",
@@ -0,0 +1,17 @@
+[package]
+name = "artcraft_client_identity"
+edition = "2024"
+version = "0.0.1"
+publish = false
+
+[lib]
+name = "artcraft_client_identity"
+path = "src/lib.rs"
+
+[dependencies]
+
+# External
+url.workspace = true
+
+[dev-dependencies]
+# (None)
@@ -0,0 +1,166 @@
+use url::{Host, Url};
+
+use crate::origins::{ARTCRAFT_DESKTOP_DEVELOPMENT_ORIGIN, ARTCRAFT_DESKTOP_ORIGIN};
+use crate::third_party_provider::{ThirdPartyProvider, THIRD_PARTY_PROVIDERS};
+
+/// Hostnames of our deployed APIs (HTTPS only).
+const ARTCRAFT_API_HOSTNAMES: [&str; 3] = [
+  "api.storyteller.ai",
+  "api.getartcraft.com",
+  "api.fakeyou.com",
+];
+
+/// Domains we own. Subdomains match too (CDNs, uploads, websites).
+const ARTCRAFT_DOMAINS: [&str; 4] = [
+  "storyteller.ai",
+  "getartcraft.com",
+  "fakeyou.com",
+  "artcraft.ai",
+];
+
+/// Who a request is going to, which decides how the desktop app identifies itself.
+#[derive(Debug, PartialEq, Eq)]
+pub enum Destination {
+  /// Our HTTP API, deployed or running locally, and the `Origin` to declare to it.
+  ArtcraftApi { origin: &'static str },
+  /// Our other hosts: CDNs, uploads, websites.
+  ArtcraftHost,
+  /// A known third-party provider.
+  ThirdParty(&'static ThirdPartyProvider),
+  /// Anything else.
+  Unknown,
+}
+
+impl Destination {
+  pub fn classify(destination: &Url) -> Self {
+    if is_local_development_api(destination) {
+      return Self::ArtcraftApi { origin: ARTCRAFT_DESKTOP_DEVELOPMENT_ORIGIN };
+    }
+    let Some(host) = destination.host_str() else {
+      return Self::Unknown;
+    };
+    if destination.scheme() == "https" && ARTCRAFT_API_HOSTNAMES.contains(&host) {
+      return Self::ArtcraftApi { origin: ARTCRAFT_DESKTOP_ORIGIN };
+    }
+    if ARTCRAFT_DOMAINS.iter().any(|domain| is_domain_or_subdomain(host, domain)) {
+      return Self::ArtcraftHost;
+    }
+    THIRD_PARTY_PROVIDERS
+      .iter()
+      .find(|provider| provider.domains.iter().any(|domain| is_domain_or_subdomain(host, domain)))
+      .map_or(Self::Unknown, Self::ThirdParty)
+  }
+}
+
+fn is_local_development_api(destination: &Url) -> bool {
+  if !matches!(destination.scheme(), "http" | "https") {
+    return false;
+  }
+  match destination.host() {
+    Some(Host::Domain("localhost")) => true,
+    Some(Host::Ipv4(address)) => address.is_loopback(),
+    Some(Host::Ipv6(address)) => address.is_loopback(),
+    _ => false,
+  }
+}
+
+fn is_domain_or_subdomain(host: &str, domain: &str) -> bool {
+  host == domain
+    || host
+      .strip_suffix(domain)
+      .is_some_and(|prefix| prefix.ends_with('.'))
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  mod artcraft {
+    use super::*;
+
+    #[test]
+    fn deployed_apis_get_desktop_origin() {
+      for destination in [
+        "https://api.storyteller.ai/v1/session",
+        "https://api.getartcraft.com/v1/session",
+        "https://api.fakeyou.com/v1/session",
+      ] {
+        assert_eq!(classify(destination), Destination::ArtcraftApi { origin: "https://desktop.getartcraft.com" });
+      }
+    }
+
+    #[test]
+    fn local_apis_get_development_origin() {
+      for destination in [
+        "http://localhost:12345/v1/session",
+        "https://localhost:12345/v1/session",
+        "http://127.0.0.1:12345/v1/session",
+        "http://[::1]:12345/v1/session",
+      ] {
+        assert_eq!(classify(destination), Destination::ArtcraftApi { origin: "http://localhost" });
+      }
+    }
+
+    #[test]
+    fn other_owned_hosts_are_not_apis() {
+      for destination in [
+        "https://cdn-2.fakeyou.com/media/a/b.png",
+        "https://cdn.storyteller.ai/media/a/b.png",
+        "https://style.storyteller.ai/",
+        "https://app.getartcraft.com/",
+        "https://getartcraft.com/",
+        "http://api.storyteller.ai/v1/session",
+      ] {
+        assert_eq!(classify(destination), Destination::ArtcraftHost, "{destination}");
+      }
+    }
+  }
+
+  mod third_party {
+    use super::*;
+
+    #[test]
+    fn providers_get_their_own_origins() {
+      for (destination, name, origin) in [
+        ("https://grok.com/rest/app-chat/conversations/new", "Grok", "https://grok.com"),
+        ("https://assets.grok.com/users/a/b.mp4", "Grok", "https://grok.com"),
+        ("https://imagine-public.x.ai/a.png", "Grok", "https://grok.com"),
+        ("https://www.midjourney.com/api/submit-jobs", "Midjourney", "https://www.midjourney.com"),
+        ("https://cdn.midjourney.com/a/0_0.png", "Midjourney", "https://www.midjourney.com"),
+        ("https://sora.chatgpt.com/backend/nf/create", "Sora", "https://sora.chatgpt.com"),
+        ("https://videos.openai.com/a.mp4", "Sora", "https://sora.chatgpt.com"),
+        ("https://chatgpt.com/backend-api/sentinel", "ChatGPT", "https://chatgpt.com"),
+        ("https://api.worldlabs.ai/api/v1/worlds", "World Labs", "https://marble.worldlabs.ai"),
+        ("https://static.kinovi.ai/a.png", "Kinovi", "https://kinovi.ai"),
+        ("https://static.seedance2-pro.com/materials/a.png", "Seedance 2 Pro", "https://seedance2-pro.com"),
+        ("https://v3b.fal.media/files/a.png", "fal", "https://fal.ai"),
+        ("https://console.gmicloud.ai/api", "GMI Cloud", "https://console.gmicloud.ai"),
+      ] {
+        let Destination::ThirdParty(provider) = classify(destination) else {
+          panic!("{destination} is not a third party");
+        };
+        assert_eq!((provider.name, provider.origin), (name, origin));
+      }
+    }
+
+    #[test]
+    fn lookalikes_and_others_are_unknown() {
+      for destination in [
+        "https://api.storyteller.ai.example.com/v1/session",
+        "https://notstoryteller.ai/",
+        "https://evilgrok.com/",
+        "https://grok.com.example.com/",
+        "https://www.gravatar.com/avatar/a",
+        "https://storage.googleapis.com/bucket/a.png",
+        "http://192.168.1.2:12345/v1/session",
+        "tauri://localhost",
+      ] {
+        assert_eq!(classify(destination), Destination::Unknown, "{destination}");
+      }
+    }
+  }
+
+  fn classify(destination: &str) -> Destination {
+    Destination::classify(&Url::parse(destination).unwrap())
+  }
+}
@@ -0,0 +1,12 @@
+//! artcraft_client_identity
+//!
+//! How the ArtCraft desktop app identifies itself (`Origin`, `User-Agent`) to each destination.
+//!
+//! Our own APIs get the declared ArtCraft desktop identity. Known third-party providers get an
+//! identity close to their own website, and never ours. The native third-party Rust clients
+//! (Grok, Midjourney, Sora, etc.) set their own headers and do not use this crate.
+
+pub mod destination;
+pub mod origins;
+pub mod third_party_provider;
+pub mod user_agents;
@@ -0,0 +1,11 @@
+/// `Origin` sent to our deployed APIs.
+/// Keep in sync with `actix_cors_configs/src/configs/artcraft_desktop.rs` in artcraft-services.
+pub const ARTCRAFT_DESKTOP_ORIGIN: &str = "https://desktop.getartcraft.com";
+
+/// `Origin` sent to a locally running API (eg. `http://localhost:12345`).
+/// Development CORS accepts any `localhost` origin.
+pub const ARTCRAFT_DESKTOP_DEVELOPMENT_ORIGIN: &str = "http://localhost";
+
+/// `Origin` packaged builds historically sent everywhere. Now only sent to our non-API hosts
+/// (CDNs, websites), where it is left unchanged.
+pub const LEGACY_DESKTOP_ORIGIN: &str = "https://studio.storyteller.ai";
@@ -0,0 +1,30 @@
+/// A third-party provider, and the `Origin` of its own website that we present to its hosts.
+#[derive(Debug, PartialEq, Eq)]
+pub struct ThirdPartyProvider {
+  pub name: &'static str,
+  /// Registrable domains; subdomains match too.
+  pub domains: &'static [&'static str],
+  pub origin: &'static str,
+}
+
+/// Every third party that gets an invented origin. Origins match what each provider's native
+/// Rust client already sends. First match wins, so more specific entries go first.
+pub const THIRD_PARTY_PROVIDERS: [ThirdPartyProvider; 9] = [
+  ThirdPartyProvider { name: "Grok", domains: &["grok.com", "x.ai"], origin: "https://grok.com" },
+  ThirdPartyProvider { name: "Midjourney", domains: &["midjourney.com"], origin: "https://www.midjourney.com" },
+  ThirdPartyProvider {
+    name: "Sora",
+    domains: &["sora.chatgpt.com", "sora.com", "openai.com", "oaistatic.com"],
+    origin: "https://sora.chatgpt.com",
+  },
+  ThirdPartyProvider { name: "ChatGPT", domains: &["chatgpt.com"], origin: "https://chatgpt.com" },
+  ThirdPartyProvider {
+    name: "World Labs",
+    domains: &["worldlabs.ai", "wlt-ai.art"],
+    origin: "https://marble.worldlabs.ai",
+  },
+  ThirdPartyProvider { name: "Kinovi", domains: &["kinovi.ai"], origin: "https://kinovi.ai" },
+  ThirdPartyProvider { name: "Seedance 2 Pro", domains: &["seedance2-pro.com"], origin: "https://seedance2-pro.com" },
+  ThirdPartyProvider { name: "fal", domains: &["fal.ai", "fal.run", "fal.media"], origin: "https://fal.ai" },
+  ThirdPartyProvider { name: "GMI Cloud", domains: &["gmicloud.ai"], origin: "https://console.gmicloud.ai" },
+];
@@ -0,0 +1,23 @@
+/// `User-Agent` sent to our own APIs and hosts.
+///
+/// TODO: Change to "artcraft-desktop/1.0" once the backend services can parse it.
+pub const ARTCRAFT_DESKTOP_USER_AGENT: &str = "storyteller-client/1.0";
+
+/// `User-Agent` sent to third parties: the default of the OS webview Tauri runs on
+/// (WKWebView on macOS, WebView2 on Windows, WebKitGTK on Linux).
+///
+/// NB: These are hardcoded snapshots and WILL go out of date as the OS webviews update
+/// (especially WebView2's Chrome/Edge version, which auto-updates on Windows). Rust can't read
+/// the webview's real `navigator.userAgent`, so refresh these periodically by checking
+/// `navigator.userAgent` in the desktop app's devtools on each OS.
+#[cfg(target_os = "macos")]
+pub const WEBVIEW_USER_AGENT: &str =
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)";
+
+#[cfg(target_os = "windows")]
+pub const WEBVIEW_USER_AGENT: &str =
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0";
+
+#[cfg(not(any(target_os = "macos", target_os = "windows")))]
+pub const WEBVIEW_USER_AGENT: &str =
+  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/605.1.15 (KHTML, like Gecko)";
@@ -36,6 +36,7 @@ urlpattern = "0.3"
 regex = "1"

 [dependencies]
+artcraft_client_identity = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tauri = { workspace = true }
@@ -0,0 +1,207 @@
+use artcraft_client_identity::destination::Destination;
+use artcraft_client_identity::origins::LEGACY_DESKTOP_ORIGIN;
+use artcraft_client_identity::user_agents::{ARTCRAFT_DESKTOP_USER_AGENT, WEBVIEW_USER_AGENT};
+use http::{header, HeaderMap, HeaderValue};
+use url::{Host, Url};
+
+/// The `User-Agent` to send when the frontend didn't set one.
+pub(crate) fn artcraft_default_user_agent(destination: &Url) -> &'static str {
+  match Destination::classify(destination) {
+    Destination::ArtcraftApi { .. } | Destination::ArtcraftHost => ARTCRAFT_DESKTOP_USER_AGENT,
+    Destination::ThirdParty(_) | Destination::Unknown => WEBVIEW_USER_AGENT,
+  }
+}
+
+/// Replace the webview's own `Origin` (packaged `tauri://localhost` etc., or a Vite loopback
+/// origin at any port) with the identity chosen for the destination. The native HTTP bridge
+/// shares the desktop cookie jar, so its identity must not depend on the webview.
+pub(crate) fn normalize_artcraft_origin(destination: &Url, headers: &mut HeaderMap) {
+  let origin = headers.get(header::ORIGIN).and_then(|value| value.to_str().ok());
+  // Packaged-app webview origins on macOS and Windows.
+  let packaged_origin = headers.get(header::ORIGIN).is_none()
+    || matches!(origin, Some("null" | "http://tauri.localhost" | "tauri://localhost"));
+  // Development webview origins (Vite on any loopback port).
+  let webview_origin = packaged_origin || origin.is_some_and(is_loopback_origin);
+
+  let replacement = match Destination::classify(destination) {
+    // Our APIs (deployed or local) see the declared desktop identity.
+    Destination::ArtcraftApi { origin } if webview_origin => origin,
+    // Known third parties see an origin close to their own website.
+    Destination::ThirdParty(provider) if webview_origin => provider.origin,
+    // Our CDNs and websites keep the historical packaged-app handling.
+    Destination::ArtcraftHost if packaged_origin => LEGACY_DESKTOP_ORIGIN,
+    // Unknown hosts and ordinary website origins are left untouched.
+    _ => return,
+  };
+
+  // HeaderMap is a multimap; insert replaces all existing Origin values.
+  headers.insert(header::ORIGIN, HeaderValue::from_static(replacement));
+}
+
+fn is_loopback_origin(origin: &str) -> bool {
+  let Ok(url) = Url::parse(origin) else {
+    return false;
+  };
+  if !matches!(url.scheme(), "http" | "https") {
+    return false;
+  }
+  match url.host() {
+    Some(Host::Domain("localhost")) => true,
+    Some(Host::Ipv4(address)) => address.is_loopback(),
+    Some(Host::Ipv6(address)) => address.is_loopback(),
+    _ => false,
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  const API: &str = "https://api.storyteller.ai/v1/session";
+  const LOCAL_API: &str = "http://localhost:12345/v1/session";
+  const CDN: &str = "https://cdn-2.fakeyou.com/media/a/b.png";
+  const GCS: &str = "https://storage.googleapis.com/bucket/a.png";
+  const GROK: &str = "https://grok.com/rest/app-chat/conversations/new";
+  const MIDJOURNEY: &str = "https://www.midjourney.com/api/submit-jobs";
+  const UNKNOWN: &str = "https://www.gravatar.com/avatar/a";
+
+  const DEV_WEBVIEW_ORIGIN: &str = "http://127.0.0.1:5193";
+  const PACKAGED_ORIGINS: [Option<&str>; 4] =
+    [None, Some("null"), Some("http://tauri.localhost"), Some("tauri://localhost")];
+
+  mod development {
+    use super::*;
+
+    #[test]
+    fn normalizes_dynamic_ports_and_loopback_hosts() {
+      for origin in [
+        "http://127.0.0.1:5193",
+        "http://127.0.0.1:5194",
+        "http://127.0.0.1:65535",
+        "http://localhost:5173",
+        "http://[::1]:5193",
+      ] {
+        assert_eq!(normalized(API, Some(origin)), "https://desktop.getartcraft.com");
+        assert_eq!(normalized(LOCAL_API, Some(origin)), "http://localhost");
+        assert_eq!(normalized(GROK, Some(origin)), "https://grok.com");
+      }
+      assert_eq!(
+        normalized("https://api.fakeyou.com/v1/session", Some(DEV_WEBVIEW_ORIGIN)),
+        "https://desktop.getartcraft.com"
+      );
+    }
+
+    #[test]
+    fn leaves_cdns_and_unknown_destinations_unchanged() {
+      for destination in [
+        CDN,
+        GCS,
+        UNKNOWN,
+        "https://api.storyteller.ai.example.com/v1/session",
+        "http://api.storyteller.ai/v1/session",
+      ] {
+        assert_eq!(normalized(destination, Some(DEV_WEBVIEW_ORIGIN)), DEV_WEBVIEW_ORIGIN, "{destination}");
+      }
+    }
+
+    #[test]
+    fn leaves_non_webview_origins_unchanged() {
+      for origin in [
+        "https://app.getartcraft.com",
+        "https://example.com",
+        "http://localhost.example.com:5193",
+        "http://192.168.1.2:5193",
+        "not a URL",
+        "",
+      ] {
+        assert_eq!(normalized(API, Some(origin)), origin);
+        assert_eq!(normalized(GROK, Some(origin)), origin);
+      }
+    }
+  }
+
+  mod packaged {
+    use super::*;
+
+    #[test]
+    fn our_apis_get_desktop_identity() {
+      for origin in PACKAGED_ORIGINS {
+        assert_eq!(normalized(API, origin), "https://desktop.getartcraft.com");
+        assert_eq!(normalized(LOCAL_API, origin), "http://localhost");
+      }
+    }
+
+    #[test]
+    fn third_parties_get_their_own_origin() {
+      for origin in PACKAGED_ORIGINS {
+        assert_eq!(normalized(GROK, origin), "https://grok.com");
+        assert_eq!(normalized(MIDJOURNEY, origin), "https://www.midjourney.com");
+      }
+    }
+
+    #[test]
+    fn cdns_keep_legacy_origin() {
+      for origin in PACKAGED_ORIGINS {
+        assert_eq!(normalized(CDN, origin), "https://studio.storyteller.ai");
+      }
+    }
+
+    #[test]
+    fn unknown_destinations_never_get_our_origin() {
+      for destination in [UNKNOWN, GCS] {
+        assert_eq!(normalized(destination, Some("tauri://localhost")), "tauri://localhost");
+        assert_eq!(normalized(destination, Some("null")), "null");
+        assert_eq!(normalized_or_missing(destination, None), None);
+      }
+    }
+
+    #[test]
+    fn replaces_duplicate_origin_values_without_changing_session_headers() {
+      let mut headers = HeaderMap::new();
+      headers.append(header::ORIGIN, HeaderValue::from_static(DEV_WEBVIEW_ORIGIN));
+      headers.append(header::ORIGIN, HeaderValue::from_static(DEV_WEBVIEW_ORIGIN));
+      headers.insert(header::COOKIE, HeaderValue::from_static("session=fixture"));
+      normalize_artcraft_origin(&Url::parse(API).unwrap(), &mut headers);
+      assert_eq!(headers.get_all(header::ORIGIN).iter().count(), 1);
+      assert_eq!(headers[header::ORIGIN], "https://desktop.getartcraft.com");
+      assert_eq!(headers[header::COOKIE], "session=fixture");
+    }
+  }
+
+  mod user_agent {
+    use super::*;
+
+    #[test]
+    fn ours_get_artcraft_user_agent() {
+      for destination in [API, LOCAL_API, CDN] {
+        assert_eq!(user_agent(destination), "storyteller-client/1.0");
+      }
+    }
+
+    #[test]
+    fn third_parties_get_webview_user_agent() {
+      for destination in [GROK, MIDJOURNEY, GCS, UNKNOWN] {
+        let user_agent = user_agent(destination);
+        assert!(user_agent.starts_with("Mozilla/5.0 ("), "{user_agent}");
+        assert!(!user_agent.contains("storyteller"), "{user_agent}");
+      }
+    }
+
+    fn user_agent(destination: &str) -> &'static str {
+      artcraft_default_user_agent(&Url::parse(destination).unwrap())
+    }
+  }
+
+  fn normalized(destination: &str, origin: Option<&str>) -> String {
+    normalized_or_missing(destination, origin).unwrap()
+  }
+
+  fn normalized_or_missing(destination: &str, origin: Option<&str>) -> Option<String> {
+    let mut headers = HeaderMap::new();
+    if let Some(origin) = origin {
+      headers.insert(header::ORIGIN, HeaderValue::from_str(origin).unwrap());
+    }
+    normalize_artcraft_origin(&Url::parse(destination).unwrap(), &mut headers);
+    headers.get(header::ORIGIN).map(|value| value.to_str().unwrap().to_owned())
+  }
+}
@@ -16,12 +16,11 @@ use tauri::{
 use tokio::sync::oneshot::{channel, Receiver, Sender};

 use crate::{
+    artcraft_identity::{artcraft_default_user_agent, normalize_artcraft_origin},
    scope::{Entry, Scope},
    Error, Http, Result,
 };

-const HTTP_USER_AGENT: &str = concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"),);
-
 struct ReqwestResponse(reqwest::Response);
 impl tauri::Resource for ReqwestResponse {}

@@ -269,7 +268,7 @@ pub async fn fetch<R: Runtime>(
                    builder = builder.cookie_provider(state.cookies_jar.clone());
                }

-                let mut request = builder.build()?.request(method.clone(), url);
+                let mut request = builder.build()?.request(method.clone(), url.clone());

                // POST and PUT requests should always have a 0 length content-length,
                // if there is no body. https://fetch.spec.whatwg.org/#http-network-or-cache-fetch
@@ -284,7 +283,7 @@ pub async fn fetch<R: Runtime>(
                }

                if !headers.contains_key(header::USER_AGENT) {
-                    headers.append(header::USER_AGENT, HeaderValue::from_str(HTTP_USER_AGENT)?);
+                    headers.append(header::USER_AGENT, HeaderValue::from_static(artcraft_default_user_agent(&url)));
                }

                // ensure we have an Origin header set
@@ -305,26 +304,7 @@ pub async fn fetch<R: Runtime>(
                    headers.remove(header::ORIGIN);
                };

-                // NB(bt): In production builds, the origin seems to be "null". This is what our server CORS filter sees:
-                //   [2025-05-01T23:42:35Z WARN  actix_cors_configs::configs::fakeyou] Invalid origin: "null"
-                //   [2025-05-01T23:42:35Z WARN  actix_cors_configs::util::netlify_branch_domain_matches] Invalid origin: "null"
-                //   [2025-05-01T23:42:35Z WARN  actix_cors_configs::util::netlify_branch_domain_matches] Invalid origin: "null"
-                //     ...
-                //   [2025-05-01T23:42:35Z WARN  actix_cors_configs::util::netlify_branch_domain_matches] Invalid origin: "null"
-                //   [2025-05-01T23:42:35Z INFO  actix_web::middleware::logger] [storyteller-web-85f9b4974-ddvq7] IP=[redact] 
-                //               939322e1095ee5e4-IAD "POST /v1/login HTTP/1.1" 400 42 "-" "tauri-plugin-http/2.4.3" 0.000076
-                let mut maybe_origin_header = headers.get(header::ORIGIN);
-
-                let replace_origin_header = maybe_origin_header.is_none()
-                    || maybe_origin_header == Some(&HeaderValue::from_static("null")) // Above error (Mac)
-                    || maybe_origin_header == Some(&HeaderValue::from_static("http://tauri.localhost")) // Windows
-                    || maybe_origin_header == Some(&HeaderValue::from_static("tauri://localhost")); // Mac plausibly causes this
-
-                if replace_origin_header {
-                    // TODO(bt): Make this a sentinel origin, eg. sentinel.storyteller.ai.
-                    // NB: HeadersMap is a multimap, but this should ensure we just have one value.
-                    headers.insert(header::ORIGIN, HeaderValue::from_static("https://studio.storyteller.ai"));
-                }
+                normalize_artcraft_origin(&url, &mut headers);

                if let Some(data) = data {
                    request = request.body(data);
@@ -12,6 +12,8 @@ use tauri::{

 pub use error::{Error, Result};

+mod artcraft_identity;
+
 // NB(bt): We're making everything public so we can access it.
 pub mod commands;
 pub mod error;
@@ -0,0 +1,189 @@
+# Desktop session regression — September 27, 2026
+
+The combined development launcher (`92e6f438c3`, following the performance
+change `df707bf8e1`) moved Vite from `localhost:5173` to an available port on
+`127.0.0.1`. The vendored HTTP plugin forwarded that webview Origin to the
+production API. The API rejected it with **400: Origin is not allowed to make
+this request**.
+
+The native login bridge and credits commands use a different HTTP transport and
+continued working. Consequently the login modal correctly recognized the native
+session, but Accounts, Library, and page media requests failed. Accounts treated
+the error as logged out; its Log In button rechecked the valid native session
+and immediately closed the login modal again.
+
+The fix extends the existing packaged-desktop Origin normalization to loopback
+development origins, at any port, for HTTPS requests to `api.storyteller.ai` and
+`api.fakeyou.com`. Other development request destinations and non-loopback
+website origins retain their headers. Cookie handling and API authorization are
+unchanged. A frontend reload alone cannot update this fix: Rust must rebuild.
+
+## Dedicated desktop origin and rollout
+
+The desktop app now declares itself per destination. Both transports read the
+values from one place, `crates/lib/artcraft_client_identity`
+(`Destination::classify`, origins, user agents, third-party provider table):
+
+| Destination                                            | Origin sent                         | User-Agent               |
+|--------------------------------------------------------|-------------------------------------|--------------------------|
+| Our APIs (`api.storyteller.ai`, `api.fakeyou.com`, …)  | `https://desktop.getartcraft.com`   | `storyteller-client/1.0` |
+| Local API (`localhost`, `127.0.0.1`, `[::1]`)          | `http://localhost`                  | `storyteller-client/1.0` |
+| Our CDNs / sites (`*.storyteller.ai`, `*.fakeyou.com`) | unchanged (`studio.storyteller.ai`) | `storyteller-client/1.0` |
+| Named third parties (`THIRD_PARTY_PROVIDERS`)          | the provider's own site             | OS webview               |
+| Any other host (incl. `storage.googleapis.com`)        | webview origin, untouched           | OS webview               |
+
+- The native Rust client (`artcraft_client`) sends the Origin and User-Agent on
+  every API request via `storyteller_client_builder`; it previously sent no
+  Origin.
+- The "OS webview" User-Agents are hardcoded snapshots in
+  `artcraft_client_identity/src/user_agents.rs` and go out of date as the
+  webviews update (notably WebView2's Edge version on Windows). Refresh them
+  from `navigator.userAgent` in the desktop app's devtools on each OS.
+- The vendored HTTP plugin only replaces the webview's own origin (packaged
+  `tauri://localhost` etc., or a loopback Vite origin), and only sets the
+  User-Agent when the frontend didn't.
+- Native third-party Rust clients (Grok, Midjourney, Sora, World Labs, Kinovi)
+  set their own headers and are not affected.
+- Older desktop releases keep working: the server still allows the studio and
+  Tauri origins, and requests without an Origin.
+
+Keep the deployed origin in sync with
+`../artcraft-services/crates/lib/actix_cors_configs/src/configs/artcraft_desktop.rs`.
+Development servers accept any `localhost` origin.
+
+Deploy the server allowlist to the APIs **before running or releasing a desktop
+build with the new origin**. Otherwise the deployed server will reject desktop
+requests until its allowlist is updated. The server retains the studio and
+legacy Tauri origins so existing desktop releases continue working.
+
+Check both repositories:
+
+```sh
+# From artcraft/
+cargo test --offline -p artcraft_client_identity -p tauri-plugin-http --lib
+
+# From artcraft-services/
+cargo test --offline -p actix_cors_configs --lib
+```
+
+The server tests verify credentialed GET/POST requests and OPTIONS preflights in
+production and development, rejection of lookalike domains/HTTP/alternate ports,
+and compatibility with previous desktop origins. After server deployment, repeat
+the native checks below using the updated app.
+
+## Observed native results
+
+These observations were captured with the earlier studio origin, before the
+dedicated desktop origin migration. They do not establish that production has
+deployed the new allowlist.
+
+Checked in the real macOS Tauri dev app at `http://127.0.0.1:5193`, using its
+existing session. Temporary probes were removed after verification. No cookies,
+tokens, passwords, account identifiers, or media contents are recorded here.
+
+| Check                          | Before                                | After                      |
+|--------------------------------|---------------------------------------|----------------------------|
+| Frontend HTTP `/v1/session`    | 400, Origin rejected                  | 200                        |
+| Shared `UsersApi.GetSession()` | `success: false`                      | Success, logged in         |
+| Native vs. frontend identity   | Frontend could not resolve an account | Same account               |
+| Shared media API, page size 1  | Not measured separately               | Success, one item returned |
+
+## Automated checks
+
+From the repository root:
+
+```sh
+cargo test --offline -p tauri-plugin-http artcraft_origin --lib
+./script/artcraft/unix_dev.sh
+```
+
+In a second terminal, substitute the URL printed by the launcher:
+
+```sh
+cd frontend
+npm run test:desktop-session -- http://127.0.0.1:5193
+```
+
+The Rust tests cover the default port, alternate/collision ports, IPv4, IPv6,
+localhost, packaged origins, duplicate headers, session-header preservation,
+and destinations/origins that must remain unchanged.
+
+The browser check uses the real frontend with an isolated Chrome profile and
+mocked IPC. It verifies matching credits and Accounts state, a visible Library
+image, media after opening the deferred image page, video/audio page rendering,
+and logout followed by sign-in. It blocks remote browser traffic and never uses
+your real account or native credentials. It requires installed Google Chrome.
+It can also run against a locally served production frontend build.
+
+These browser mocks cannot validate native transport or server CORS. The
+performance fixture deliberately rejects HTTP requests and is **not** an
+authentication acceptance test. Run the native check below when changing the
+launcher, HTTP bridge, or authentication plumbing.
+
+Validation on September 27: all 12 HTTP-plugin tests, 20 login-modal tests, and
+10 app tests passed. The browser check passed against both the Vite dev server
+and a fresh production build. To repeat the production check, serve a build in
+one terminal, then pass its printed URL to `test:desktop-session` in another:
+
+```sh
+cd frontend/apps/artcraft
+npm run build -- --outDir /tmp/artcraft-session-build
+npm run preview -- --outDir /tmp/artcraft-session-build --host 127.0.0.1 --port 6215
+```
+
+## Repeat the real native check
+
+1. Start the combined launcher, with an existing signed-in test session. Verify
+   Accounts displays that account, My Library loads its media, and Create Image,
+   Create Video, and Create Audio load their content.
+2. Right-click inside the desktop webview, choose **Inspect Element**, and open
+   **Console**. Run this read-only probe. It prints statuses/counts, not credentials
+   or account/media contents:
+
+```js
+void (async () => {
+  const invoke = window.__TAURI_INTERNALS__.invoke;
+  const host = (await invoke("get_app_info_command")).payload.storyteller_host;
+  const options = { method: "GET", credentials: "include" };
+  const started = performance.now();
+  const [native, response] = await Promise.all([
+    invoke("storyteller_get_login_session_command"),
+    window.FetchProxy(`${host}/v1/session`, { ...options }),
+  ]);
+  if (!response.ok) {
+    console.log({ origin: location.origin, sessionStatus: response.status });
+    return;
+  }
+  const session = await response.json();
+  const result = {
+    origin: location.origin,
+    sessionStatus: response.status,
+    nativeLoggedIn: !!native,
+    frontendLoggedIn: session.logged_in,
+    sameAccount: native?.user_token === session.user?.user_token,
+    sessionElapsedMs: performance.now() - started,
+  };
+  if (session.logged_in && session.user) {
+    const username = encodeURIComponent(session.user.username);
+    const media = await window.FetchProxy(
+      `${host}/v1/media_files/list/user/${username}?page_size=1`, { ...options },
+    );
+    result.mediaStatus = media.status;
+    if (media.ok) result.mediaCount = (await media.json()).results?.length;
+  }
+  console.log(result);
+})().catch((error) => console.error("Desktop session probe failed", String(error)));
+```
+
+3. Repeat with a changed port (`ARTCRAFT_DEV_PORT=6200`) and with the starting
+   port occupied. For example, keep this listener running in another terminal
+   before starting the launcher; stop it with Ctrl-C afterward:
+
+```sh
+node -e 'require("node:net").createServer().listen(5193, "127.0.0.1")'
+```
+
+The launcher should select a later port, and both session transports should
+still agree. An empty account may legitimately return zero media; it should
+still return HTTP 200. Verify a genuinely signed-out session shows the login
+screen using the isolated browser check, or a disposable account/profile.
@@ -6,6 +6,11 @@ headless Chrome with mocked Tauri services. They do **not** measure native
 process launch, WKWebView/WebView2, Rust, disk startup, real account loading,
 or generation latency.

+These timings are not authentication acceptance tests: the benchmark mocks the
+native session and rejects frontend HTTP requests. Before accepting a desktop
+change, also run the [session and Library checks](desktop-session-regression.md),
+including real Tauri HTTP requests when changing the launcher or bridge.
+
 ## Changes and results

 Seven samples per version; table values are medians. Each sample uses a fresh
@@ -28,10 +28,11 @@
  </script>

  <base href="/" />
+  <link rel="icon" type="image/svg+xml" href="/artcraft-icon.svg" />
  <link rel="icon" type="image/x-icon" href="/favicon.ico" />
  <link rel="preconnect" href="https://fonts.googleapis.com" />
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-  <link href="https://fonts.googleapis.com/css2?family=Outfit:wght@100..900&family=Source+Sans+3:ital,wght@0,200..900;1,200..900&display=swap"
+  <link href="https://fonts.googleapis.com/css2?family=Archivo:wdth,wght@62..125,100..900&family=Instrument+Serif:ital@0;1&family=Geist+Mono:wght@300..800&display=swap"
    rel="stylesheet" />
  <!-- <link rel="stylesheet" href="/src/styles.css" /> -->
 </head>
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 116.34 97.5">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: #4e7bfb;
+      }
+    </style>
+  </defs>
+  <g id="Layer_1-2" data-name="Layer 1">
+    <path class="cls-1" d="M104.28,49.49L81.55,0h-31.23l-3.17,4.76L14.75,53.63,0,75.85l21.55,21.55,63.79-36.94,16.99,37.04,14.01-21.74-12.06-26.27ZM32.89,65.66l32.42-48.87,10.91,23.77-43.32,25.09Z"/>
+  </g>
+</svg>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Brandon ThomasandClaude Opus 5.5	43409d46d3	NOTICE: note third-party assets will be phased out Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 04:13:52 -04:00
Brandon ThomasandClaude Opus 5.5	1f7bec1603	NOTICE: drop Adobe mention from Mixamo line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 04:12:51 -04:00
Brandon ThomasandClaude Opus 5.5	1cef2abe0a	Relicense ArtCraft under MIT OR Apache-2.0 Replace the WIP fair-source LICENSE.md with the MIT/Apache dual license used by PhotoCraft, LightCraft, and the other craft apps. Add a NOTICE listing bundled third-party material, and carve out bundled assets that ArtCraft does not own and cannot relicense. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 04:09:57 -04:00
Brandon Thomas	910bfe4e84	artcraft 0.42.0 (#2026 )	2026-10-09 13:03:51 -04:00
Brandon Thomas	7aebfc1c59	fix error messages so they're user friendly (#2025 )	2026-10-09 13:01:10 -04:00
Tanish Manku heojunfo Claude Opus 5.5	3e5793b693	PageScene: dispose GPU assets on desktop (#1972 ) Targets PageScene and other 3D viewers, handles uniforms and textures, amongst other general editor mount improvements --------- Co-authored-by: heojunfo <kleague3@gmail.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-06 17:56:14 -07:00
BFlat	3210977fb1	Use the new ArtCraft icon for the app icon and favicons (#1965 ) - Regenerate the desktop app icons (Windows, macOS, Store, Android, iOS) from the new angular ArtCraft mark in the website logo blue - Replace favicon.ico, the 16/32 favicons, and the apple-touch icon - Add the SVG icon as the primary favicon, same as the webapp	2026-09-28 13:16:34 +07:00
BFlat	90c7a8a118	Match desktop app styling to the webapp (#1963 )	2026-09-28 12:29:54 +07:00
Brandon Thomas	1b27c31531	thumbnail speedup (and fix for non-rendering thumbnails) (#1964 )	2026-09-28 01:28:45 -04:00
Brandon Thomas	93b664d871	client identity (origin, user agent) (#1962 )	2026-09-27 23:41:15 -04:00
Brandon Thomas	92e6f438c3	better dev script (#1961 )	2026-09-27 14:48:34 -04:00