add opengraph metadata (social media tags)

Merge pull request #35 from storytold/bt-media-previews
fix media previews in new design
2026-09-26 16:30:57 -07:00 · 2026-09-26 10:30:44 -07:00 · 2026-09-26 09:58:16 -07:00 · 2026-09-26 09:33:04 -07:00 · 2026-09-26 09:25:40 -07:00 · 2026-09-26 21:49:03 +07:00
241 changed files with 9945 additions and 706 deletions
@@ -0,0 +1,102 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [
+      {
+        "name": "id",
+        "ordinal": 0,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL | PRIMARY_KEY | UNSIGNED | AUTO_INCREMENT",
+          "max_size": 20,
+          "type": "LongLong"
+        }
+      },
+      {
+        "name": "confirmation_code",
+        "ordinal": 1,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 32,
+          "type": "String"
+        }
+      },
+      {
+        "name": "status: UserLoginChallengeStatus",
+        "ordinal": 2,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 64,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "maybe_deciding_user_token",
+        "ordinal": 3,
+        "type_info": {
+          "char_set": 224,
+          "flags": "MULTIPLE_KEY | BINARY",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "maybe_redeemed_user_session_id",
+        "ordinal": 4,
+        "type_info": {
+          "char_set": 63,
+          "flags": "UNIQUE_KEY",
+          "max_size": 20,
+          "type": "LongLong"
+        }
+      },
+      {
+        "name": "maybe_failure_type: UserLoginChallengeFailureType",
+        "ordinal": 5,
+        "type_info": {
+          "char_set": 224,
+          "flags": "BINARY",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "ip_address_creation",
+        "ordinal": 6,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 160,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "expires_at",
+        "ordinal": 7,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | TIMESTAMP",
+          "max_size": 19,
+          "type": "Timestamp"
+        }
+      }
+    ],
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false
+    ],
+    "parameters": {
+      "Right": 1
+    }
+  },
+  "hash": "06dc6f19f013fe24ffd32a313b66dd10a87498bf17c9a63b1ece87e338b0dc74",
+  "query": "\nSELECT id, confirmation_code, status AS `status: UserLoginChallengeStatus`, maybe_deciding_user_token, maybe_redeemed_user_session_id,\n  maybe_failure_type AS `maybe_failure_type: UserLoginChallengeFailureType`, ip_address_creation, expires_at\nFROM user_login_challenges WHERE device_token_sha256 = ? FOR UPDATE\n"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 5
+    }
+  },
+  "hash": "1af20e0d9a5630302f987aea4847b65a34d6c412245f7fbf9c6fb7b513d7324b",
+  "query": "\nUPDATE user_login_challenges SET status = ?, maybe_failure_type = ?, maybe_failed_at = expires_at\nWHERE id = ? AND status IN (?, ?) AND expires_at <= NOW()\n"
+}
@@ -0,0 +1,25 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [
+      {
+        "name": "expired",
+        "ordinal": 0,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL | BINARY",
+          "max_size": 1,
+          "type": "LongLong"
+        }
+      }
+    ],
+    "nullable": [
+      false
+    ],
+    "parameters": {
+      "Right": 1
+    }
+  },
+  "hash": "1c618e9816d6f3f7f217770f988a132d9521693da6474e945628d1b3efbc4b80",
+  "query": "\nSELECT expires_at <= NOW() AS expired FROM user_login_challenges WHERE id = ?\n"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 6
+    }
+  },
+  "hash": "2ddd5589138c822385b39dde58fc0d44ffa003b09018f1799e243d8f09530981",
+  "query": "\nINSERT INTO user_sessions (\n  token,\n  user_token,\n  maybe_impersonation_user_token,\n  ip_address_creation,\n  maybe_creation_type,\n  expires_at\n)\nVALUES (?, ?, ?, ?, ?, ?)\n    "
+}
@@ -0,0 +1,36 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [
+      {
+        "name": "session_token",
+        "ordinal": 0,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | UNIQUE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "user_token",
+        "ordinal": 1,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      }
+    ],
+    "nullable": [
+      false,
+      false
+    ],
+    "parameters": {
+      "Right": 1
+    }
+  },
+  "hash": "459898b1b42a51097dcbc0f182bd0badce642b11bd33a7e1973a6cc25538ffbf",
+  "query": "\nSELECT\n    token as session_token,\n    user_token\nFROM user_sessions\nWHERE token = ?\nAND deleted_at IS NULL\nAND expires_at > NOW()\n        "
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 4
+    }
+  },
+  "hash": "4d3666433b8100c9b5f351c2be0faa982127c5bb4431ef14e84ff11c5a2fd9ff",
+  "query": "\nINSERT INTO user_sessions (\n  token,\n  user_token,\n  ip_address_creation,\n  maybe_creation_type,\n  expires_at\n)\nVALUES ( ?, ?, ?, ?, NOW() + interval 1 year )\n        "
+}
@@ -0,0 +1,58 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [
+      {
+        "name": "id",
+        "ordinal": 0,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL | PRIMARY_KEY | AUTO_INCREMENT",
+          "max_size": 20,
+          "type": "LongLong"
+        }
+      },
+      {
+        "name": "token",
+        "ordinal": 1,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | UNIQUE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "user_token",
+        "ordinal": 2,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "username",
+        "ordinal": 3,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | UNIQUE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 80,
+          "type": "VarString"
+        }
+      }
+    ],
+    "nullable": [
+      false,
+      false,
+      false,
+      false
+    ],
+    "parameters": {
+      "Right": 3
+    }
+  },
+  "hash": "705c952102e32df11ba98ec39a3c7943bdf633947c32d4e8f7d77a861560b1bd",
+  "query": "\nSELECT s.id, s.token, s.user_token, u.username FROM user_sessions s JOIN users u ON u.token = s.user_token\nWHERE s.id = ? AND s.user_token = ? AND s.maybe_creation_type = ?\n  AND s.deleted_at IS NULL AND s.expires_at > NOW() AND s.maybe_impersonation_user_token IS NULL\n  AND u.is_banned = FALSE AND u.user_deleted_at IS NULL AND u.mod_deleted_at IS NULL\n"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 5
+    }
+  },
+  "hash": "7e9bc784634f436a8bf898223a5ddeea57886b7c248d82e782dd3289c23cbaec",
+  "query": "\nUPDATE user_login_challenges SET status = ?, maybe_redeemed_user_session_id = ?,\n  maybe_ip_address_redemption = ?, maybe_redeemed_at = NOW()\nWHERE id = ? AND status = ? AND expires_at > NOW() AND maybe_redeemed_user_session_id IS NULL\n"
+}
@@ -0,0 +1,58 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [
+      {
+        "name": "id",
+        "ordinal": 0,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL | PRIMARY_KEY | AUTO_INCREMENT",
+          "max_size": 20,
+          "type": "LongLong"
+        }
+      },
+      {
+        "name": "token",
+        "ordinal": 1,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | UNIQUE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "user_token",
+        "ordinal": 2,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "username",
+        "ordinal": 3,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | UNIQUE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 80,
+          "type": "VarString"
+        }
+      }
+    ],
+    "nullable": [
+      false,
+      false,
+      false,
+      false
+    ],
+    "parameters": {
+      "Right": 1
+    }
+  },
+  "hash": "8bfbb8bef3bec235f37c5f4f5c2f3a8b0833241a63da122b8abd97cd9b71208f",
+  "query": "\nSELECT s.id, s.token, s.user_token, u.username FROM user_sessions s JOIN users u ON u.token = s.user_token\nWHERE s.token = ? AND s.deleted_at IS NULL AND s.expires_at > NOW()\n  AND s.maybe_impersonation_user_token IS NULL AND u.is_banned = FALSE\n  AND u.user_deleted_at IS NULL AND u.mod_deleted_at IS NULL\n"
+}
@@ -0,0 +1,454 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [
+      {
+        "name": "user_token",
+        "ordinal": 0,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | UNIQUE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "username",
+        "ordinal": 1,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | UNIQUE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 80,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "display_name",
+        "ordinal": 2,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 80,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "email_address",
+        "ordinal": 3,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | UNIQUE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 1020,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "email_gravatar_hash",
+        "ordinal": 4,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 128,
+          "type": "String"
+        }
+      },
+      {
+        "name": "email_confirmed",
+        "ordinal": 5,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "email_confirmed_by_google",
+        "ordinal": 6,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "email_is_synthetic",
+        "ordinal": 7,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "is_without_password",
+        "ordinal": 8,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "username_is_not_customized",
+        "ordinal": 9,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "maybe_stripe_customer_id",
+        "ordinal": 10,
+        "type_info": {
+          "char_set": 224,
+          "flags": "BINARY",
+          "max_size": 1020,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "maybe_loyalty_program_key",
+        "ordinal": 11,
+        "type_info": {
+          "char_set": 224,
+          "flags": "BINARY",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "disable_gravatar",
+        "ordinal": 12,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "auto_play_audio_preference",
+        "ordinal": 13,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "auto_play_video_preference",
+        "ordinal": 14,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "preferred_tts_result_visibility: enums::common::visibility::Visibility",
+        "ordinal": 15,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | BINARY | ENUM",
+          "max_size": 28,
+          "type": "String"
+        }
+      },
+      {
+        "name": "preferred_w2l_result_visibility: enums::common::visibility::Visibility",
+        "ordinal": 16,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | BINARY | ENUM",
+          "max_size": 28,
+          "type": "String"
+        }
+      },
+      {
+        "name": "user_role_slug",
+        "ordinal": 17,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 64,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "is_banned",
+        "ordinal": 18,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_access_studio",
+        "ordinal": 19,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL | MULTIPLE_KEY",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "maybe_feature_flags",
+        "ordinal": 20,
+        "type_info": {
+          "char_set": 224,
+          "flags": "BINARY",
+          "max_size": 1020,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "can_use_tts",
+        "ordinal": 21,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_use_w2l",
+        "ordinal": 22,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_own_tts_results",
+        "ordinal": 23,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_own_w2l_results",
+        "ordinal": 24,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_own_account",
+        "ordinal": 25,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_upload_tts_models",
+        "ordinal": 26,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_upload_w2l_templates",
+        "ordinal": 27,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_own_tts_models",
+        "ordinal": 28,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_own_w2l_templates",
+        "ordinal": 29,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_approve_w2l_templates",
+        "ordinal": 30,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_edit_other_users_profiles",
+        "ordinal": 31,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_edit_other_users_tts_models",
+        "ordinal": 32,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_edit_other_users_w2l_templates",
+        "ordinal": 33,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_other_users_tts_models",
+        "ordinal": 34,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_other_users_tts_results",
+        "ordinal": 35,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_other_users_w2l_templates",
+        "ordinal": 36,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_other_users_w2l_results",
+        "ordinal": 37,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_ban_users",
+        "ordinal": 38,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      },
+      {
+        "name": "can_delete_users",
+        "ordinal": 39,
+        "type_info": {
+          "char_set": 63,
+          "flags": "",
+          "max_size": 1,
+          "type": "Tiny"
+        }
+      }
+    ],
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      true,
+      true,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true
+    ],
+    "parameters": {
+      "Right": 1
+    }
+  },
+  "hash": "934aad794dcb0057e39c471e7b25e5e191a395a2bd16553cb58a483b91c68437",
+  "query": "\nSELECT\n    users.token as user_token,\n    users.username,\n    users.display_name,\n\n    users.email_address,\n    users.email_gravatar_hash,\n    \n    users.email_confirmed,\n    users.email_confirmed_by_google,\n    users.email_is_synthetic,\n    users.is_without_password,\n    users.username_is_not_customized,\n\n    users.maybe_stripe_customer_id,\n    users.maybe_loyalty_program_key,\n\n    users.disable_gravatar,\n    users.auto_play_audio_preference,\n    users.auto_play_video_preference,\n    users.preferred_tts_result_visibility as `preferred_tts_result_visibility: enums::common::visibility::Visibility`,\n    users.preferred_w2l_result_visibility as `preferred_w2l_result_visibility: enums::common::visibility::Visibility`,\n\n    users.user_role_slug,\n    users.is_banned,\n\n    users.can_access_studio,\n    users.maybe_feature_flags,\n\n    user_roles.can_use_tts,\n    user_roles.can_use_w2l,\n    user_roles.can_delete_own_tts_results,\n    user_roles.can_delete_own_w2l_results,\n    user_roles.can_delete_own_account,\n\n    user_roles.can_upload_tts_models,\n    user_roles.can_upload_w2l_templates,\n    user_roles.can_delete_own_tts_models,\n    user_roles.can_delete_own_w2l_templates,\n\n    user_roles.can_approve_w2l_templates,\n    user_roles.can_edit_other_users_profiles,\n    user_roles.can_edit_other_users_tts_models,\n    user_roles.can_edit_other_users_w2l_templates,\n    user_roles.can_delete_other_users_tts_models,\n    user_roles.can_delete_other_users_tts_results,\n    user_roles.can_delete_other_users_w2l_templates,\n    user_roles.can_delete_other_users_w2l_results,\n    user_roles.can_ban_users,\n    user_roles.can_delete_users\n\nFROM users\nLEFT OUTER JOIN user_sessions\n    ON users.token = user_sessions.user_token\nLEFT OUTER JOIN user_roles\n    ON users.user_role_slug = user_roles.slug\nWHERE user_sessions.token = ?\n    AND user_sessions.deleted_at IS NULL\n    AND user_sessions.expires_at > NOW()\n    AND users.user_deleted_at IS NULL\n    AND users.mod_deleted_at IS NULL\n        "
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 4
+    }
+  },
+  "hash": "ab9e5c27ce0c460aa6d5d1b202829c2082fa0701773582d22aae05a9d376d4a6",
+  "query": "\nINSERT INTO user_sessions (\n  token,\n  user_token,\n  ip_address_creation,\n  maybe_creation_type,\n  expires_at\n)\nVALUES ( ?, ?, ?, ?, NOW() + interval 1 year )\n    "
+}
@@ -0,0 +1,102 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [
+      {
+        "name": "id",
+        "ordinal": 0,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL | PRIMARY_KEY | UNSIGNED | AUTO_INCREMENT",
+          "max_size": 20,
+          "type": "LongLong"
+        }
+      },
+      {
+        "name": "confirmation_code",
+        "ordinal": 1,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 32,
+          "type": "String"
+        }
+      },
+      {
+        "name": "status: UserLoginChallengeStatus",
+        "ordinal": 2,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 64,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "maybe_deciding_user_token",
+        "ordinal": 3,
+        "type_info": {
+          "char_set": 224,
+          "flags": "MULTIPLE_KEY | BINARY",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "maybe_redeemed_user_session_id",
+        "ordinal": 4,
+        "type_info": {
+          "char_set": 63,
+          "flags": "UNIQUE_KEY",
+          "max_size": 20,
+          "type": "LongLong"
+        }
+      },
+      {
+        "name": "maybe_failure_type: UserLoginChallengeFailureType",
+        "ordinal": 5,
+        "type_info": {
+          "char_set": 224,
+          "flags": "BINARY",
+          "max_size": 128,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "ip_address_creation",
+        "ordinal": 6,
+        "type_info": {
+          "char_set": 224,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | NO_DEFAULT_VALUE",
+          "max_size": 160,
+          "type": "VarString"
+        }
+      },
+      {
+        "name": "expires_at",
+        "ordinal": 7,
+        "type_info": {
+          "char_set": 63,
+          "flags": "NOT_NULL | MULTIPLE_KEY | BINARY | TIMESTAMP",
+          "max_size": 19,
+          "type": "Timestamp"
+        }
+      }
+    ],
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false
+    ],
+    "parameters": {
+      "Right": 1
+    }
+  },
+  "hash": "c0c85c8c55fb494d44efa6f1f2d37491c740d0ac897dcfb7a7e737bb01b824d6",
+  "query": "\nSELECT id, confirmation_code, status AS `status: UserLoginChallengeStatus`, maybe_deciding_user_token, maybe_redeemed_user_session_id,\n  maybe_failure_type AS `maybe_failure_type: UserLoginChallengeFailureType`, ip_address_creation, expires_at\nFROM user_login_challenges WHERE approval_token_sha256 = ? FOR UPDATE\n"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 6
+    }
+  },
+  "hash": "cc29378fa77e7f09ca2ca0803127d111703a4edca24acfe3ccecf79c22fc1a80",
+  "query": "\nINSERT INTO user_login_challenges\n  (token, approval_token_sha256, device_token_sha256, confirmation_code, ip_address_creation, status, created_at, expires_at)\nVALUES (?, ?, ?, ?, ?, ?, NOW(), NOW() + INTERVAL 20 MINUTE)\n"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 4
+    }
+  },
+  "hash": "d0067b5e1b3ef5dec5572eb2c0741d129ab2f706db4bb9f37a32bb89aa44fa4f",
+  "query": "\nUPDATE user_login_challenges SET status = ?, maybe_failure_type = ?, maybe_failed_at = expires_at\nWHERE status IN (?, ?) AND expires_at <= NOW() ORDER BY expires_at LIMIT 1000\n"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "MySQL",
-  "query": "\nSELECT\n    id,\n    token as `token: MediaFileToken`,\n    created_at as `created_at: DateTime<Utc>`,\n    maybe_thumbnail_version as `maybe_thumbnail_version: u8`,\n    public_bucket_directory_hash,\n    maybe_public_bucket_prefix,\n    maybe_public_bucket_extension\nFROM media_files\nWHERE\n    id >= (SELECT COALESCE(MIN(id), 0) FROM media_files WHERE created_at >= NOW() - INTERVAL ? HOUR)\n    AND id < ?\n    AND media_class = ?\n    AND maybe_thumbnail_version IS NULL\n    AND user_deleted_at IS NULL\n    AND mod_deleted_at IS NULL\nORDER BY id DESC\nLIMIT ?\n    ",
+  "query": "\nSELECT\n    media.id,\n    media.token as `token: MediaFileToken`,\n    media.created_at as `created_at: DateTime<Utc>`,\n    NOW(6) as `database_read_at!: DateTime<Utc>`,\n    jobs.successfully_completed_at as `maybe_generation_completed_at?: DateTime<Utc>`,\n    media.maybe_thumbnail_version as `maybe_thumbnail_version: u8`,\n    media.public_bucket_directory_hash,\n    media.maybe_public_bucket_prefix,\n    media.maybe_public_bucket_extension\nFROM media_files AS media\nLEFT JOIN generic_inference_jobs AS jobs ON jobs.token = media.maybe_source_job_token\nWHERE\n    media.id >= (SELECT COALESCE(MIN(id), 0) FROM media_files WHERE created_at >= NOW() - INTERVAL ? HOUR)\n    AND media.id < ?\n    AND media.media_class = ?\n    AND media.maybe_thumbnail_version IS NULL\n    AND media.user_deleted_at IS NULL\n    AND media.mod_deleted_at IS NULL\nORDER BY media.id DESC\nLIMIT ?\n    ",
  "describe": {
    "columns": [
      {
@@ -35,6 +35,26 @@
      },
      {
        "ordinal": 3,
+        "name": "database_read_at!: DateTime<Utc>",
+        "type_info": {
+          "type": "Datetime",
+          "flags": "NOT_NULL | BINARY",
+          "char_set": 63,
+          "max_size": 26
+        }
+      },
+      {
+        "ordinal": 4,
+        "name": "maybe_generation_completed_at?: DateTime<Utc>",
+        "type_info": {
+          "type": "Timestamp",
+          "flags": "BINARY",
+          "char_set": 63,
+          "max_size": 19
+        }
+      },
+      {
+        "ordinal": 5,
        "name": "maybe_thumbnail_version: u8",
        "type_info": {
          "type": "Tiny",
@@ -44,7 +64,7 @@
        }
      },
      {
-        "ordinal": 4,
+        "ordinal": 6,
        "name": "public_bucket_directory_hash",
        "type_info": {
          "type": "VarString",
@@ -54,7 +74,7 @@
        }
      },
      {
-        "ordinal": 5,
+        "ordinal": 7,
        "name": "maybe_public_bucket_prefix",
        "type_info": {
          "type": "VarString",
@@ -64,7 +84,7 @@
        }
      },
      {
-        "ordinal": 6,
+        "ordinal": 8,
        "name": "maybe_public_bucket_extension",
        "type_info": {
          "type": "VarString",
@@ -81,11 +101,13 @@
      false,
      false,
      false,
+      false,
+      true,
      true,
      false,
      true,
      true
    ]
  },
-  "hash": "daed2dcd03b3c9fbdb9057b743df078f43e2af87a2c31f418234f98da5ff979f"
+  "hash": "d14ad3a64d261e64fa75f97c93ca74af97fad8591d6ebe9887aeabc43bed0982"
 }
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 8
+    }
+  },
+  "hash": "da64968638e564d28ed180270df407157f6c9b3f27c3443417f30c12c158ab89",
+  "query": "\nUPDATE user_login_challenges SET status = ?, maybe_deciding_user_token = ?,\n  maybe_ip_address_decision = ?, maybe_decided_at = NOW(), maybe_failure_type = ?,\n  maybe_ip_address_failure = ?, maybe_failed_at = IF(?, NULL, NOW())\nWHERE id = ? AND status = ? AND expires_at > NOW()\n"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "MySQL",
+  "describe": {
+    "columns": [],
+    "nullable": [],
+    "parameters": {
+      "Right": 4
+    }
+  },
+  "hash": "eb5fdd0e93978edfbe97c58238ea81f0c21dba047975beb53a39224894e9d41c",
+  "query": "\nINSERT INTO user_sessions (token, user_token, ip_address_creation, maybe_creation_type, expires_at)\nSELECT ?, token, ?, ?, NOW() + INTERVAL 1 YEAR FROM users\nWHERE token = ? AND is_banned = FALSE AND user_deleted_at IS NULL AND mod_deleted_at IS NULL\n"
+}
@@ -32,12 +32,45 @@ artcraft-services/
 │       ├── plugins/              # Shared billing and service components
 │       └── web/storyteller_web/  # Main Actix Web HTTP API
 ├── frontend/
-│   ├── apps/artcraft-webapp/     # Browser application at app.getartcraft.com
-│   ├── apps/artcraft-website/    # Product website at getartcraft.com
-│   └── libs/                     # Shared React components and TypeScript libraries
+│   ├── apps/artcraft-webapp/       # Browser application at app.getartcraft.com
+│   ├── apps/artcraft-website-next/ # Current public website at getartcraft.com (Next.js)
+│   ├── apps/artcraft-website/      # Legacy product website (Vite)
+│   └── libs/                      # Shared React components and TypeScript libraries
 └── Cargo.toml                    # Rust workspace
 ```

+## Updating Desktop Download Links
+
+Desktop release links are configured independently in **three places**. When
+updating the advertised ArtCraft release, update both `WINDOWS_VERSION` and
+`MAC_VERSION` in all three unless the request explicitly targets one platform or
+app:
+
+1. **Current public website (Next.js):**
+   [frontend/apps/artcraft-website-next/src/lib/download-links.ts](frontend/apps/artcraft-website-next/src/lib/download-links.ts).
+   This controls the installer links and visible version at
+   `https://getartcraft.com/download`. Add the release to `DOWNLOAD_HISTORY`
+   (newest first), then update both version selectors.
+2. **Legacy website (Vite):**
+   [frontend/apps/artcraft-website/src/config/github_download_links.ts](frontend/apps/artcraft-website/src/config/github_download_links.ts).
+   Add the release to `DOWNLOAD_HISTORY` and update both version selectors.
+   Updating only this file does **not** update the current public website.
+3. **Browser webapp:**
+   [frontend/apps/artcraft-webapp/src/config/github_download_links.ts](frontend/apps/artcraft-webapp/src/config/github_download_links.ts).
+   Update both version constants; these links are used by the welcome and
+   checkout-success pages at `app.getartcraft.com`.
+
+Keep previous releases for rollback. The Next.js download page reads its visible
+version from `DOWNLOAD_VERSIONS`, which uses the same selectors as the URLs; do
+not hardcode a separate version in the page component.
+
+Check that all three configs produce the requested release tag and installer
+filenames for Windows (`ArtCraft_<version>_x64-setup.exe`) and macOS
+(`ArtCraft_<version>_universal.dmg`). Run `npm run typecheck` from
+`frontend/apps/artcraft-website-next` after changing its config. Repository edits
+require deployment of the affected apps before the public pages change; do not
+report a local update as a deployed update.
+
 ## Code Style

 - Rust with no minimum supported version
@@ -8764,6 +8764,7 @@ dependencies = [
 "redis_common",
 "redis_schema",
 "regex",
+ "reqwest 0.12.23",
 "resend-rs",
 "reusable_types",
 "rootly_client",
@@ -8775,6 +8776,7 @@ dependencies = [
 "serde_json",
 "server_environment",
 "sha1_hash",
+ "sha2 0.11.0-rc.5",
 "shared_env_var_config",
 "speculoos",
 "sqlx",
@@ -10384,11 +10386,13 @@ dependencies = [
 "anyhow",
 "bootstrap",
 "bucket_paths",
+ "chrono",
 "cloud_storage",
 "concurrency",
 "easyenv",
 "errors",
 "ffmpeg_utils",
+ "futures 0.3.32",
 "jobs_common",
 "log",
 "mysql_queries",
@@ -0,0 +1,5 @@
+-- noinspection SqlDialectInspectionForFile
+-- noinspection SqlNoDataSourceInspectionForFile
+-- noinspection SqlResolveForFile
+
+DROP TABLE IF EXISTS user_login_challenges;
@@ -0,0 +1,93 @@
+-- noinspection SqlDialectInspectionForFile
+-- noinspection SqlNoDataSourceInspectionForFile
+-- noinspection SqlResolveForFile
+
+-- One approval request for a new cookie-based user session on another device.
+-- See _database/sql/user_login_challenges.md for transitions and API requirements.
+-- This table does not authorize MCP sessions or API keys.
+CREATE TABLE user_login_challenges (
+  id BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT,
+
+  -- Non-secret identifier for logs/support. Never sufficient to approve or redeem.
+  token VARCHAR(32) NOT NULL,
+
+  -- SHA-256 digests of TWO INDEPENDENT cryptographically random 256-bit tokens.
+  -- Hash the canonical unpadded base64url token text; never store the raw tokens.
+  -- The approval token goes in the browser/QR URL and only permits reviewing a
+  -- request and submitting an authenticated user's explicit approve/decline choice.
+  approval_token_sha256 BINARY(32) NOT NULL,
+
+  -- Only the initiating device receives this token. Required for polling/redeeming.
+  -- Never include it in the approval URL, QR code, browser page, or application logs.
+  device_token_sha256 BINARY(32) NOT NULL,
+
+  -- Eight random uppercase consonants, displayed as e.g. WDJB-MJHT on BOTH screens.
+  -- Comparison aid only: not unique, not a lookup key, not an authentication factor.
+  confirmation_code CHAR(8) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+
+  -- UserLoginChallengeStatus: pending, approved, redeemed, failed.
+  -- Only pending may be approved/declined. Only approved may mint a session.
+  -- Expiry is checked independently of status on EVERY approval/redemption request.
+  -- Application inserts explicitly bind UserLoginChallengeStatus::Pending.
+  status VARCHAR(16) NOT NULL,
+
+  -- The authenticated web user who approved OR declined. NULL until a decision.
+  -- On approval this becomes the immutable owner of the session to be minted.
+  maybe_deciding_user_token VARCHAR(32) DEFAULT NULL,
+
+  -- Set atomically with status=redeemed and session insertion, under a row lock.
+  -- Numeric reference avoids copying a session credential into this audit table.
+  -- Intentionally signed to match the existing user_sessions.id column.
+  -- At most one session per challenge; retries may only return that SAME live session.
+  maybe_redeemed_user_session_id BIGINT(20) DEFAULT NULL,
+
+  -- UserLoginChallengeFailureType: user_declined, expired.
+  -- Only failed rows have a failure type and maybe_failed_at.
+  -- Transient errors / invalid credentials must not overwrite a valid challenge.
+  maybe_failure_type VARCHAR(32) DEFAULT NULL,
+
+  -- ========== IP ADDRESSES ==========
+
+  -- Server-observed requesting device IP, displayed on the approval screen.
+  -- Canonical IPv4/IPv6 strings; never accept an IP supplied in a request body.
+  ip_address_creation VARCHAR(40) NOT NULL,
+
+  -- Browser/mobile IP for approval or denial; may differ from the device IP.
+  maybe_ip_address_decision VARCHAR(40) DEFAULT NULL,
+
+  -- Device IP at FIRST successful redemption. Retries do not overwrite it.
+  maybe_ip_address_redemption VARCHAR(40) DEFAULT NULL,
+
+  -- For user_declined this is the browser IP. For expiry there is no actor/IP.
+  -- ip_address_creation is retained on ALL failures, including timeouts.
+  maybe_ip_address_failure VARCHAR(40) DEFAULT NULL,
+
+  -- ========== TIMESTAMPS ==========
+
+  created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+  -- Immutable deadline: insert with created_at=NOW(), expires_at=NOW()+INTERVAL 20 MINUTE.
+  -- The default deliberately fails closed if a writer forgets to set the deadline.
+  -- Approval, polling, and retrying must NEVER extend it. NOW() >= expires_at is expired.
+  expires_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  maybe_decided_at TIMESTAMP NULL DEFAULT NULL,
+  maybe_redeemed_at TIMESTAMP NULL DEFAULT NULL,
+
+  -- Decision time for user_declined; expires_at for expired (even if recorded later).
+  maybe_failed_at TIMESTAMP NULL DEFAULT NULL,
+
+  -- INDICES --
+  PRIMARY KEY (id),
+  UNIQUE KEY (token),
+  UNIQUE KEY (approval_token_sha256),
+  UNIQUE KEY (device_token_sha256),
+  UNIQUE KEY (maybe_redeemed_user_session_id),
+  KEY index_status_expires_at (status, expires_at),
+  KEY index_expires_at (expires_at),
+  KEY index_deciding_user_created_at (maybe_deciding_user_token, created_at),
+  KEY index_creation_ip_created_at (ip_address_creation, created_at),
+  KEY index_failure_ip_failed_at (maybe_ip_address_failure, maybe_failed_at)
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;
@@ -0,0 +1,6 @@
+-- noinspection SqlDialectInspectionForFile
+-- noinspection SqlNoDataSourceInspectionForFile
+-- noinspection SqlResolveForFile
+
+ALTER TABLE user_sessions
+  DROP COLUMN maybe_creation_type;
@@ -0,0 +1,10 @@
+-- noinspection SqlDialectInspectionForFile
+-- noinspection SqlNoDataSourceInspectionForFile
+-- noinspection SqlResolveForFile
+
+-- UserWebSessionCreationType: direct_login, device_approval, impersonation.
+-- NULL means unknown / legacy writer, not direct_login. Do not backfill guesses.
+-- Additive metadata only: does not change validation, expiry, or impersonation rules.
+-- MCP sessions and API keys are separate tables and do not use this field.
+ALTER TABLE user_sessions
+  ADD COLUMN maybe_creation_type VARCHAR(32) DEFAULT NULL;
@@ -24,6 +24,11 @@ These are created with the `diesel` tool, and in particular:

 - Primary key `id` columns must be `BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT`. Do not use signed IDs.
 - Always create tables with `ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin`.
+- Application-owned state/status/type columns must not have schema defaults. Use
+  `NOT NULL` without `DEFAULT` when required, and have application inserts explicitly
+  supply the value. Document the corresponding Rust enum; application queries bind its
+  variants instead of hardcoding enum strings in SQL. See
+  `crates/schema/database/mysql_queries/AGENTS.md` for the query rules.
 - All SQL files should start with the standard IntelliJ noinspection comments:
  ```sql
  -- noinspection SqlDialectInspectionForFile
@@ -33,6 +38,7 @@ These are created with the `diesel` tool, and in particular:

 ## Rules

+- Keep documentation in this directory as regular files, not symlinks. Diesel can treat a documentation symlink as a migration directory and reject the entire migration list.
 - Every `up.sql` must have a corresponding `down.sql` that cleanly reverses the migration.
 - For `CREATE TABLE` migrations, the `down.sql` is typically `DROP TABLE IF EXISTS table_name;`.
 - For `ALTER TABLE` migrations, the `down.sql` reverses the alteration (e.g. `DROP COLUMN`).
@@ -1 +0,0 @@
-AGENTS.md
@@ -0,0 +1,6 @@
+# SQL Migrations
+
+Read and follow [AGENTS.md](AGENTS.md) in this directory.
+
+This must remain a regular file. Diesel treats a symlink here as a migration
+directory and fails with `Invalid migration directory`.
@@ -13,6 +13,9 @@ Update the corresponding squashed file whenever a migration changes a table's sc

 - Primary key `id` columns must be `BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT`. Do not use signed IDs.
 - Always create tables with `ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin`.
+- Application-owned state/status/type columns must not have schema defaults. Required
+  values stay `NOT NULL` and are supplied explicitly by application code using the
+  corresponding Rust enum. Keep these definitions consistent with the applied migrations.
 - All SQL files should start with the standard IntelliJ noinspection comments:
  ```sql
  -- noinspection SqlDialectInspectionForFile
@@ -0,0 +1,93 @@
+-- noinspection SqlDialectInspectionForFile
+-- noinspection SqlNoDataSourceInspectionForFile
+-- noinspection SqlResolveForFile
+
+-- One approval request for a new cookie-based user session on another device.
+-- See _database/sql/user_login_challenges.md for transitions and API requirements.
+-- This table does not authorize MCP sessions or API keys.
+CREATE TABLE user_login_challenges (
+  id BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT,
+
+  -- Non-secret identifier for logs/support. Never sufficient to approve or redeem.
+  token VARCHAR(32) NOT NULL,
+
+  -- SHA-256 digests of TWO INDEPENDENT cryptographically random 256-bit tokens.
+  -- Hash the canonical unpadded base64url token text; never store the raw tokens.
+  -- The approval token goes in the browser/QR URL and only permits reviewing a
+  -- request and submitting an authenticated user's explicit approve/decline choice.
+  approval_token_sha256 BINARY(32) NOT NULL,
+
+  -- Only the initiating device receives this token. Required for polling/redeeming.
+  -- Never include it in the approval URL, QR code, browser page, or application logs.
+  device_token_sha256 BINARY(32) NOT NULL,
+
+  -- Eight random uppercase consonants, displayed as e.g. WDJB-MJHT on BOTH screens.
+  -- Comparison aid only: not unique, not a lookup key, not an authentication factor.
+  confirmation_code CHAR(8) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+
+  -- UserLoginChallengeStatus: pending, approved, redeemed, failed.
+  -- Only pending may be approved/declined. Only approved may mint a session.
+  -- Expiry is checked independently of status on EVERY approval/redemption request.
+  -- Application inserts explicitly bind UserLoginChallengeStatus::Pending.
+  status VARCHAR(16) NOT NULL,
+
+  -- The authenticated web user who approved OR declined. NULL until a decision.
+  -- On approval this becomes the immutable owner of the session to be minted.
+  maybe_deciding_user_token VARCHAR(32) DEFAULT NULL,
+
+  -- Set atomically with status=redeemed and session insertion, under a row lock.
+  -- Numeric reference avoids copying a session credential into this audit table.
+  -- Intentionally signed to match the existing user_sessions.id column.
+  -- At most one session per challenge; retries may only return that SAME live session.
+  maybe_redeemed_user_session_id BIGINT(20) DEFAULT NULL,
+
+  -- UserLoginChallengeFailureType: user_declined, expired.
+  -- Only failed rows have a failure type and maybe_failed_at.
+  -- Transient errors / invalid credentials must not overwrite a valid challenge.
+  maybe_failure_type VARCHAR(32) DEFAULT NULL,
+
+  -- ========== IP ADDRESSES ==========
+
+  -- Server-observed requesting device IP, displayed on the approval screen.
+  -- Canonical IPv4/IPv6 strings; never accept an IP supplied in a request body.
+  ip_address_creation VARCHAR(40) NOT NULL,
+
+  -- Browser/mobile IP for approval or denial; may differ from the device IP.
+  maybe_ip_address_decision VARCHAR(40) DEFAULT NULL,
+
+  -- Device IP at FIRST successful redemption. Retries do not overwrite it.
+  maybe_ip_address_redemption VARCHAR(40) DEFAULT NULL,
+
+  -- For user_declined this is the browser IP. For expiry there is no actor/IP.
+  -- ip_address_creation is retained on ALL failures, including timeouts.
+  maybe_ip_address_failure VARCHAR(40) DEFAULT NULL,
+
+  -- ========== TIMESTAMPS ==========
+
+  created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+  -- Immutable deadline: insert with created_at=NOW(), expires_at=NOW()+INTERVAL 20 MINUTE.
+  -- The default deliberately fails closed if a writer forgets to set the deadline.
+  -- Approval, polling, and retrying must NEVER extend it. NOW() >= expires_at is expired.
+  expires_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  maybe_decided_at TIMESTAMP NULL DEFAULT NULL,
+  maybe_redeemed_at TIMESTAMP NULL DEFAULT NULL,
+
+  -- Decision time for user_declined; expires_at for expired (even if recorded later).
+  maybe_failed_at TIMESTAMP NULL DEFAULT NULL,
+
+  -- INDICES --
+  PRIMARY KEY (id),
+  UNIQUE KEY (token),
+  UNIQUE KEY (approval_token_sha256),
+  UNIQUE KEY (device_token_sha256),
+  UNIQUE KEY (maybe_redeemed_user_session_id),
+  KEY index_status_expires_at (status, expires_at),
+  KEY index_expires_at (expires_at),
+  KEY index_deciding_user_created_at (maybe_deciding_user_token, created_at),
+  KEY index_creation_ip_created_at (ip_address_creation, created_at),
+  KEY index_failure_ip_failed_at (maybe_ip_address_failure, maybe_failed_at)
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;
@@ -41,6 +41,12 @@ CREATE TABLE user_sessions (
  -- designed to be recoverable.
  deleted_at TIMESTAMP NULL,

+  -- UserWebSessionCreationType: direct_login, device_approval, impersonation.
+  -- NULL means unknown / legacy writer, not direct_login. Do not backfill guesses.
+  -- Additive metadata only: does not change validation, expiry, or impersonation rules.
+  -- MCP sessions and API keys are separate tables and do not use this field.
+  maybe_creation_type VARCHAR(32) DEFAULT NULL,
+
  -- INDICES --
  PRIMARY KEY (id),
  UNIQUE KEY (token),
@@ -0,0 +1,323 @@
+# Website-approved device login
+
+Implemented across storyteller-web, the browser approval page, and the Tauri
+login dialog. Apply the two migrations before deploying the API; deploy the web
+approval route before releasing the desktop buttons. No production migrations or
+deployments were performed while developing this change.
+
+Call the flow **device approval**, and each attempt a **login challenge**. It works
+for a desktop browser link or a phone scanning a QR code, regardless of how the
+approving account signed in. It creates an ordinary cookie-based web session.
+
+The design borrows separate device/browser credentials, polling, explicit consent,
+and code comparison from [OAuth device authorization (RFC 8628)](https://www.rfc-editor.org/rfc/rfc8628.html#section-3.3.1).
+It is an ArtCraft session bridge, not an OAuth token endpoint implementation.
+
+## Two migrations
+
+1. `2026-09-25-120000-0000_create_user_login_challenges` creates the challenge and
+   its terminal outcome audit record together. A separate failure table is not
+   needed for one immutable outcome per attempt. Status is `NOT NULL` without a
+   default; inserts explicitly bind `UserLoginChallengeStatus::Pending`.
+2. `2026-09-25-120000-0001_alter_user_sessions_add_maybe_creation_type` adds nullable
+   provenance to cookie sessions. Existing rows and older writers retain NULL.
+
+Both have reverse migrations and matching materialized schemas under
+`migrations_squashed/user_tables/`. Deploy the schema before new writers. Roll
+back feature code before dropping the column/table; rollback removes bridge audit
+records but does not revoke sessions already issued.
+
+`UserWebSessionCreationType` values:
+
+| Rust variant     | Stored value      | Meaning                                                           |
+|------------------|-------------------|-------------------------------------------------------------------|
+| DirectLogin      | direct_login      | Password or SSO login/signup, including desktop password login.   |
+| DeviceApproval   | device_approval   | A new session minted from an approved login challenge.            |
+| Impersonation    | impersonation     | Existing consented staff impersonation flow.                      |
+| None             | NULL              | Unknown provenance, including existing rows and older writers.    |
+
+`DirectLogin` describes the creation mechanism more accurately than `Web`, since
+ordinary password login is also available in the desktop app. This field does not
+replace `maybe_impersonation_user_token` or influence authentication/authorization.
+MCP and API credentials continue using `mcp_sessions` and `api_keys` respectively.
+Existing password/SSO and impersonation session writers now record provenance.
+There is no historical backfill or default that would invent it.
+
+## Credentials and confirmation
+
+Generate two independent 32-byte CSPRNG values per challenge. Encode each as
+unpadded base64url (43 ASCII characters). Store only the SHA-256 digest of that
+canonical ASCII representation in the two uniquely indexed `BINARY(32)` columns.
+Reject noncanonical input instead of accepting multiple representations. These
+are random tokens, not passwords, so a fast cryptographic hash is appropriate.
+
+| Value               | Who receives it               | What it permits                                        |
+|---------------------|-------------------------------|--------------------------------------------------------|
+| token               | Internal logs/support         | Identifying a row; no authentication.                  |
+| approval token      | Desktop, browser link, QR     | Review and authenticated approval/decline only.        |
+| device token        | Initiating desktop only       | Polling and collecting the newly authorized session.   |
+| confirmation code   | Desktop and approval screen   | Visual comparison only; no lookup or authentication.   |
+
+Use eight uniformly random characters from `BCDFGHJKLMNPQRSTVWXZ` for the code.
+Store `WDJBMJHT`, display `WDJB-MJHT`, and ask the user to verify the match. It need
+not be unique because it is never used to locate or authorize a challenge. Manual
+short-code entry is outside this initial flow; both entry points carry the full
+approval token. The private device token must never be in the URL or QR code.
+
+The website displays the requesting IP, the account being authorized, the matching
+code, and explicit **Approve desktop login** / **Decline** actions. An existing
+website session skips only the login screen, never consent. If login is needed,
+keep the pending approval context in first-party browser state and resume the
+confirmation page after password or Google SSO login. Recheck expiry after login.
+Do not send the bridge tokens to Google or another identity provider. Allow only
+the fixed first-party return route, not an arbitrary caller-supplied redirect URL.
+
+The approval page is a read-only GET; link scanners and previews cannot decide
+the challenge. Decisions require a valid, non-impersonated user web session plus
+CSRF/origin protection. Never accept an API key or MCP credential as consent.
+Require the user to have initiated the request on a device in their possession;
+the visible code and IP help detect phishing but are not authentication factors.
+
+The approval URL uses HTTPS and carries the browser credential in its fragment.
+The page captures and removes that fragment before referral collection or React
+providers initialize, skips analytics/referral tracking on direct entry, and sets
+a no-referrer policy. API responses send `Cache-Control: no-store` and
+`Referrer-Policy: no-referrer`; API credentials travel in JSON bodies, never query
+strings. Shared fonts and the Google sign-in provider still load. Keep request and
+response bodies out of gateway logs. Invalid credentials reveal no account or
+challenge details. The IP follows the existing trusted-gateway forwarding policy;
+the gateway must replace untrusted incoming forwarding headers.
+
+## State and the 20-minute deadline
+
+```mermaid
+stateDiagram-v2
+  [*] --> pending
+  pending --> approved: authenticated approval
+  pending --> failed: user_declined
+  pending --> failed: expired
+  approved --> failed: expired before redemption
+  approved --> redeemed: atomically mint one session
+  redeemed --> [*]
+  failed --> [*]
+```
+
+Set `created_at = NOW()` and `expires_at = NOW() + INTERVAL 20 MINUTE` in the same
+INSERT using the database's clock. The default expiry is immediate so a writer
+that omits it fails closed. Neither approval nor polling extends this deadline.
+All eligibility checks require `expires_at > NOW()`; equality means expired.
+The create query enforces this exact lifetime; these migrations do not add
+triggers or database CHECK constraints. Keep database connections in UTC.
+
+The persisted status alone is insufficient to decide validity. A pending or
+approved row whose deadline passed is already expired even before a sweeper
+marks it `failed`. Approvals and first redemptions must check the deadline again
+under the row lock. Polls are normally read-only and do not touch `updated_at`.
+
+| Status     | Required accompanying data                                                          |
+|------------|-------------------------------------------------------------------------------------|
+| pending    | No decision, failure, redemption, or session reference.                             |
+| approved   | Deciding user, decision IP/time; no failure, redemption, or session reference.      |
+| redeemed   | Approval data plus session ID, first redemption IP/time; no failure.                |
+| failed     | Failure type/time; no redemption or session reference; retain any prior approval.   |
+
+`UserLoginChallengeFailureType` initially has two values:
+
+- `user_declined`: record the deciding user, browser IP in both decision/failure
+  IP fields, and the decision time in both decision/failure timestamps. Keep the
+  original desktop IP. Polling with the valid device token reports the decline.
+- `expired`: record `maybe_failed_at = expires_at`. Retain original desktop IP and
+  any prior approval, but leave the failure IP NULL: a timeout has no actor. A
+  scheduled sweep records abandoned requests even when nobody polls again.
+
+Failed challenges are unusable for approval or redemption. Their digests and
+audit metadata remain for diagnosing failures; do not physically delete the row
+when a user declines. A new attempt creates a new row and fresh tokens. Closing
+the desktop dialog stops polling; unused requests expire normally.
+
+Invalid tokens, failed website sign-ins, throttling, and transient infrastructure
+errors do not terminally fail a valid challenge. Record those requests in the
+existing operational/abuse logging with their IP and failure category, without
+credentials. A second decision cannot replace the first actor or outcome.
+
+## Atomic redemption and response loss
+
+The website's approval records consent; it never creates or receives the desktop
+cookie. The desktop's authenticated poll performs redemption after approval:
+
+1. Begin an InnoDB transaction on the primary and find the challenge by the device
+   token digest with `SELECT ... FOR UPDATE`.
+2. Validate the immutable deadline and state after taking the lock. Handle
+   failed/pending states without creating a session. Revalidate that the approved
+   user exists and is permitted to log in under the ordinary session rules.
+3. For `approved`, insert a fresh `user_sessions` row owned by the deciding user,
+   with `maybe_creation_type = 'device_approval'`, no impersonation, the current
+   desktop redemption IP, and the ordinary web-session lifetime.
+4. Store its numeric ID, redemption IP/time, and `status = 'redeemed'` on the
+   challenge in that same transaction. Generate the signed cookie using
+   `HttpUserSessionManager::create_cookie` before commit, so signing failure rolls
+   back too. Commit successfully before returning any credential to the caller.
+
+Both approval/decline and redemption must serialize on the same challenge row;
+conditional updates include the expected state and the unexpired deadline, and
+must check rows affected. SQL for this flow belongs in `mysql_queries`, with
+executor/transaction support, not in the web handler. All three Rust enums in this
+change are database enums; separate client-facing status/failure enums include
+an unknown-value fallback. Desktop callers fail closed on an unknown state.
+
+One-time means **at most one new session per challenge**. If the first successful
+HTTP response is lost, a retry with the same device token may return the same
+session until the original 20-minute deadline. For `redeemed`, read the linked
+session and verify its owner, creation type, absence of impersonation, expiry,
+deletion state, and the user's current eligibility before reconstructing its
+cookie. Never mint a replacement or resurrect a deleted session. After the
+deadline, return expiry without a cookie; the already-issued session keeps its
+normal lifetime, and the audit outcome remains `redeemed`.
+
+The unique nullable session ID index prevents two challenges from referencing one
+session and supports retries without duplicating bearer credentials in this
+table. The reference is intentionally signed because the legacy `user_sessions.id`
+is signed. Like neighboring schemas, references are indexed logical links rather
+than cascading foreign keys; removal of a session must not erase the audit row.
+If the referenced session is missing, redemption fails closed.
+
+## Implemented endpoints and clients
+
+All endpoints are JSON POSTs under `/v1/login_challenges`:
+
+| Endpoint   | Authentication                              | Effect                                                       |
+|------------|---------------------------------------------|--------------------------------------------------------------|
+| create     | None; limited by requesting IP              | Returns device token, verification URL, code, expiry.        |
+| review     | Approval token + web session + Origin       | Returns code, requesting IP, account, state, expiry.         |
+| decide     | Approval token + web session + Origin       | Records the first Yes/No; never creates a desktop session.   |
+| poll       | Private device token                        | Reports state or atomically redeems approved consent.        |
+
+The API advertises five-second polling. Per-process IP limits are ten creates and
+120 other requests per minute, shared across Actix workers, with bounded memory.
+Production gateways can additionally enforce aggregate limits across replicas.
+A worker expires up to 1,000 abandoned challenges every 30 seconds. Audit retention
+is intentionally not an automatic purge policy in this change.
+
+Both browser applications implement `/login/desktop`: `https://getartcraft.com`
+(including `www`) and `https://app.getartcraft.com`. They share the approval UI in
+`frontend/libs/login`. The API currently advertises the webapp URL. Local API
+requests advertise `http://localhost:4201/login/desktop`; the website also handles
+the route on port 4200. Run either frontend with `USE_LOCAL_API=1` so approval
+reaches the same local API; local origins cannot approve production challenges.
+The website signs in inline to preserve its origin-scoped pending token and
+mobile session header. The webapp preserves the return destination through login,
+signup, and password reset, bypassing billing redirects for desktop consent.
+Tokens stay in tab-scoped session storage, are removed from URL fragments before
+tracking, and are cleared on terminal results. Returning from authentication
+always requires explicit consent. The code stays visible for comparison; a single
+Approve or Decline click records the choice, without an extra checkbox.
+The desktop displays the QR code, code comparison, countdown, and status. Opening
+the website invokes the native system browser. Network errors back off up to 30
+seconds; closing the dialog stops polling and cancels the native handle. A response
+arriving after cancellation cannot install credentials.
+
+Successful polling returns the signed value and the normal `Set-Cookie` header.
+Tauri commands use the Rust `artcraft_client` bindings for creation, polling, and
+ordinary session verification, all against `AppEnvConfigs.storyteller_host`. Rust
+keeps the private device token and signed session out of IPC/JavaScript; the UI
+holds only a local handle and public display data. After verifying the downstream
+session, Rust installs and persists the cookie in the native HTTP jar and updates
+the credential manager. No browser session is copied into the desktop.
+The desktop login/signup modal also uses Rust commands for its initial session
+check and password forms. Website/QR buttons appear only in login mode. Unknown
+optional feature flags in the session response are ignored by older desktops;
+malformed authentication data still fails verification. A stale initial session
+check cannot reset a pending or completed login.
+
+## Integration tests
+
+The backend harness uses the fixed local Unix socket `/tmp/mysql.sock` and local
+root account. It never reads `DATABASE_URL`, any environment database URL, DNS,
+or a TCP endpoint (including localhost SSH forwarding). Each test creates a new
+randomly named `artcraft_test_bridge_*` database, replays all migrations, and drops
+only its own database on success. Existing `storyteller` and `artcraft_test` data
+are not used. A failed test leaves its isolated database for diagnosis. The local
+MySQL instance must be running; there is no fallback to a remote database.
+
+The HTTP endpoint suite is
+`crates/service/web/storyteller_web/src/http_server/endpoints/login_challenges/endpoint_integration_tests.rs`.
+It starts the real challenge handlers and `/v1/session` handler on an ephemeral
+`127.0.0.1` port. Separate browser and desktop HTTP clients maintain their own
+cookie jars; requests cannot follow redirects or use system proxies. Fixtures in
+`mysql_testing::fixtures::login_challenges` create passwordless users, Google email
+confirmation, feature flags (including `use_qt`), and signed browser sessions.
+The desktop cookie comes only from the real redemption response and is then sent
+to the real session endpoint. HTTP responses and SQL queries are not mocked.
+
+From the services repository:
+
+```sh
+SQLX_OFFLINE=true cargo test --offline -p storyteller-web --bin storyteller-web login_challenges
+cd frontend
+npm exec vitest -- run --config apps/artcraft-webapp/vite.config.ts src/pages/login/desktop-login.spec.tsx src/pages/login/login-bridge-continuation.spec.tsx
+npm exec vitest -- run --config apps/artcraft-website/vite.config.ts src/pages/login/desktop-login.spec.tsx
+```
+
+`SQLX_OFFLINE` controls compile-time query metadata only. These tests still execute
+real SQL against local MySQL. Do not enable `skip_database_tests` for this run.
+
+To run only the four HTTP endpoint tests with database fixtures:
+
+```sh
+SQLX_OFFLINE=true cargo test --offline -p storyteller-web --bin storyteller-web login_challenges::endpoint_integration_tests
+```
+
+From the desktop repository:
+
+```sh
+SQLX_OFFLINE=true cargo test --offline -p artcraft --lib login_bridge_tests
+cd frontend
+npm exec vitest -- run --config libs/components/login-modal/vite.config.ts src/lib/DesktopLoginBridge.spec.tsx src/lib/login-modal.spec.tsx
+```
+
+Coverage:
+
+- Four HTTP endpoint integration tests with database fixtures: the complete
+  create/review/approve/redeem/session flow, independent browser/desktop cookies,
+  passwordless onboarding and `use_qt` serialization, concurrent redemption,
+  lost-response recovery with a fresh client, no sessions before redemption,
+  audit ownership/IPs/timestamps, decline, pending/approved expiry, downstream
+  session revocation/expiry/bans, and immutable approval ownership across accounts.
+- Seven additional backend handler integration tests: both production browser origins, passwordless account approval, zero sessions
+  before redemption, rejection/audit IPs, token separation, CSRF, MCP rejection,
+  invalid approving sessions, concurrent decisions/redemptions, response-loss
+  retries, abandoned expiry, expiry during lock contention, revocation, bans,
+  signed-cookie authentication through the production session guard, and an issued
+  session remaining valid after the challenge expires.
+- Twenty-five browser tests: API/consent interaction, code/IP display, decline,
+  expiry, terminal/unknown states, lost-response retries, safe return URLs,
+  website inline Google/password sign-in, and webapp login/signup/password-reset
+  continuation without subscription gating or bridge credentials in SSO requests.
+- Thirteen desktop UI tests: IPC-only transport (JavaScript HTTP is forbidden),
+  native browser invocation, QR/code values, polling, verified user results,
+  decline, timeout, network backoff, cancellation, host/status diagnostics,
+  login-only button placement, native password forms, and stale session checks.
+- Thirteen native tests: real API bindings against ephemeral loopback HTTP servers,
+  downstream verification before cookie installation, persistence, retries,
+  rejection, timeout, cancellation during HTTP, unknown states, no redirects,
+  redacted errors, local/production origin isolation, visitor-only telemetry,
+  forward-compatible feature flags, malformed session data, and native password
+  login/signup/session recheck. Desktop tests do not connect to MySQL.
+
+Frontend tests replace external Google/native boundaries; they do not
+perform a live Google OAuth exchange or drive a packaged Tauri GUI. Backend tests
+use real MySQL and the production cookie signer/session guard with Redis disabled;
+the HTTP suite also exercises the real session endpoint and its serialized body.
+These endpoint tests do not drive a live Google OAuth exchange or the Tauri GUI.
+Existing session-cache TTL behavior is unchanged. SQL lookups now reject expired
+sessions; bridge consent/redemption always checks MySQL directly.
+
+Validation also covered both migration directions, nullable compatibility with
+legacy session writers, uniqueness constraints, fail-closed expiry defaults, and
+matching materialized schemas. The focused web TypeScript check and the production
+builds of both browser apps (including 53 dependency tasks) passed. Broad workspace TypeScript
+checks have existing errors. The desktop Nx build is blocked by the existing
+`api -> tauri-api -> api` cycle; its direct Vite login bundle builds but declaration
+checks report unavailable dependency outputs. A source-only desktop check reports
+four existing `model-list` imports of `src/index.js`, with no bridge-file errors.
+The full native Rust test target compiled successfully.
@@ -0,0 +1,73 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct CreateLoginChallengeRequest {}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct ReviewLoginChallengeRequest {
+  pub approval_token: String,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct DecideLoginChallengeRequest {
+  pub approval_token: String,
+  pub approve: bool,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct PollLoginChallengeRequest {
+  pub device_token: String,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct CreateLoginChallengeResponse {
+  pub success: bool,
+  pub device_token: String,
+  pub verification_url: String,
+  pub confirmation_code: String,
+  pub expires_at: DateTime<Utc>,
+  pub poll_interval_seconds: u32,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct ReviewLoginChallengeResponse {
+  pub success: bool,
+  pub status: LoginChallengeState,
+  pub maybe_failure_type: Option<LoginChallengeFailure>,
+  pub confirmation_code: String,
+  pub requesting_ip: String,
+  pub expires_at: DateTime<Utc>,
+  pub username: String,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct LoginChallengeResponse {
+  pub success: bool,
+  pub status: LoginChallengeState,
+  pub maybe_failure_type: Option<LoginChallengeFailure>,
+  /// Present only to the device after the redemption transaction commits.
+  #[serde(skip_serializing_if = "Option::is_none")]
+  pub maybe_signed_session: Option<String>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum LoginChallengeState {
+  Pending,
+  Approved,
+  Redeemed,
+  Failed,
+  #[serde(other)]
+  Unknown,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum LoginChallengeFailure {
+  UserDeclined,
+  Expired,
+  #[serde(other)]
+  Unknown,
+}
@@ -2,4 +2,5 @@ pub mod change_password;
 pub mod edit_email;
 pub mod edit_username;
 pub mod login;
-pub mod session_info;
+pub mod login_challenges;
+pub mod session_info;
@@ -8,6 +8,9 @@ use serde_derive::{Deserialize, Serialize};
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(from = "String", into = "String")]
 pub enum ApiClientQuality {
+  Auto,
+  Max,
+  XHigh,
  High,
  Medium,
  Low,
@@ -18,6 +21,9 @@ pub enum ApiClientQuality {
 impl From<String> for ApiClientQuality {
  fn from(value: String) -> Self {
    match value.as_str() {
+      "auto" => Self::Auto,
+      "max" => Self::Max,
+      "xhigh" => Self::XHigh,
      "high" => Self::High,
      "medium" => Self::Medium,
      "low" => Self::Low,
@@ -29,6 +35,9 @@ impl From<String> for ApiClientQuality {
 impl From<ApiClientQuality> for String {
  fn from(value: ApiClientQuality) -> Self {
    match value {
+      ApiClientQuality::Auto => "auto".to_string(),
+      ApiClientQuality::Max => "max".to_string(),
+      ApiClientQuality::XHigh => "xhigh".to_string(),
      ApiClientQuality::High => "high".to_string(),
      ApiClientQuality::Medium => "medium".to_string(),
      ApiClientQuality::Low => "low".to_string(),
@@ -58,6 +67,9 @@ mod tests {
  #[test]
  fn every_known_variant_round_trips() {
    let all = [
+      (ApiClientQuality::Auto, "auto"),
+      (ApiClientQuality::Max, "max"),
+      (ApiClientQuality::XHigh, "xhigh"),
      (ApiClientQuality::High, "high"),
      (ApiClientQuality::Medium, "medium"),
      (ApiClientQuality::Low, "low"),
@@ -1,10 +1,20 @@
 use serde_derive::{Deserialize, Serialize};

 /// Common quality levels you can specify when enqueuing a generation.
-/// Not every model will use this; models that don't simply ignore it.
+/// Not every model will use this; models that don't simply ignore it, and models that only
+/// offer a subset of tiers clamp to the nearest tier they support.
+///
+/// Serialized names mirror the server's `CommonQuality` so the two convert via serde.
 #[derive(Copy, Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum RouterQuality {
+  /// Let the model choose. Models without a native "auto" use their default tier.
+  Auto,
+  /// Highest tier (GPT Image 2.5 `max`).
+  Max,
+  /// Between High and Max (GPT Image 2.5 `xhigh`).
+  #[serde(rename = "xhigh")]
+  XHigh,
  High,
  Medium,
  Low,
@@ -97,6 +97,12 @@ pub enum RouterVideoModel {
  #[serde(rename = "happy_horse_1p0")]
  HappyHorse1p0,

+  #[serde(rename = "wan_3p0")]
+  Wan3p0,
+
+  #[serde(rename = "wan_3p0_prime")]
+  Wan3p0Prime,
+
  #[serde(rename = "sora_2")]
  Sora2,

@@ -151,8 +151,11 @@ fn to_resolution_enum(r: RouterResolution) -> CommonResolutionEnum {

 fn to_quality_enum(q: RouterQuality) -> CommonQualityEnum {
  match q {
-    RouterQuality::Low => CommonQualityEnum::Low,
-    RouterQuality::Medium => CommonQualityEnum::Medium,
+    RouterQuality::Auto => CommonQualityEnum::Auto,
+    RouterQuality::Max => CommonQualityEnum::Max,
+    RouterQuality::XHigh => CommonQualityEnum::XHigh,
    RouterQuality::High => CommonQualityEnum::High,
+    RouterQuality::Medium => CommonQualityEnum::Medium,
+    RouterQuality::Low => CommonQualityEnum::Low,
  }
 }
@@ -36,7 +36,7 @@ impl ArtcraftGptImage1CostState {
  }

  pub fn estimate_cost(&self) -> ImageGenerationCostEstimate {
-    let quality = self.quality.unwrap_or(CommonQualityEnum::High);
+    let quality = clamp_to_supported_quality(self.quality);
    let is_square = is_square_or_none(self.aspect_ratio);

    let output_cost_per_image: u64 = match (quality, is_square) {
@@ -45,6 +45,8 @@ impl ArtcraftGptImage1CostState {
      (CommonQualityEnum::Medium, false) => 7,
      (CommonQualityEnum::High, true) => 17,
      (CommonQualityEnum::High, false) => 25,
+      // Clamped away above.
+      (CommonQualityEnum::Auto | CommonQualityEnum::XHigh | CommonQualityEnum::Max, _) => unreachable!(),
    };

    let output_cost = output_cost_per_image * self.num_images as u64;
@@ -63,6 +65,20 @@ impl ArtcraftGptImage1CostState {
  }
 }

+/// GPT Image 1 only offers low / medium / high. `auto` prices as the default (high) and the
+/// higher GPT Image 2.5 tiers clamp down to high, matching the Fal request planner.
+fn clamp_to_supported_quality(quality: Option<CommonQualityEnum>) -> CommonQualityEnum {
+  match quality {
+    Some(CommonQualityEnum::Low) => CommonQualityEnum::Low,
+    Some(CommonQualityEnum::Medium) => CommonQualityEnum::Medium,
+    Some(CommonQualityEnum::High)
+    | Some(CommonQualityEnum::XHigh)
+    | Some(CommonQualityEnum::Max)
+    | Some(CommonQualityEnum::Auto)
+    | None => CommonQualityEnum::High,
+  }
+}
+
 fn is_square_or_none(aspect_ratio: Option<CommonAspectRatioEnum>) -> bool {
  use CommonAspectRatioEnum as Ar;
  matches!(
@@ -37,7 +37,7 @@ impl ArtcraftGptImage1p5CostState {
  }

  pub fn estimate_cost(&self) -> ImageGenerationCostEstimate {
-    let quality = self.quality.unwrap_or(CommonQualityEnum::High);
+    let quality = clamp_to_supported_quality(self.quality);
    let size = size_bucket(self.aspect_ratio);

    let cost_per_image: u64 = match (quality, size) {
@@ -50,6 +50,8 @@ impl ArtcraftGptImage1p5CostState {

      (CommonQualityEnum::High, SizeBucket::Square) => 14,
      (CommonQualityEnum::High, _) => 20,
+      // Clamped away above.
+      (CommonQualityEnum::Auto | CommonQualityEnum::XHigh | CommonQualityEnum::Max, _) => unreachable!(),
    };

    let cost_in_usd_cents = cost_per_image * self.num_images as u64;
@@ -65,6 +67,20 @@ impl ArtcraftGptImage1p5CostState {
  }
 }

+/// GPT Image 1.5 only offers low / medium / high. `auto` prices as the default (high) and the
+/// higher GPT Image 2.5 tiers clamp down to high, matching the Fal request planner.
+fn clamp_to_supported_quality(quality: Option<CommonQualityEnum>) -> CommonQualityEnum {
+  match quality {
+    Some(CommonQualityEnum::Low) => CommonQualityEnum::Low,
+    Some(CommonQualityEnum::Medium) => CommonQualityEnum::Medium,
+    Some(CommonQualityEnum::High)
+    | Some(CommonQualityEnum::XHigh)
+    | Some(CommonQualityEnum::Max)
+    | Some(CommonQualityEnum::Auto)
+    | None => CommonQualityEnum::High,
+  }
+}
+
 fn size_bucket(aspect_ratio: Option<CommonAspectRatioEnum>) -> SizeBucket {
  use CommonAspectRatioEnum as Ar;
  match aspect_ratio {
@@ -42,7 +42,7 @@ impl ArtcraftGptImage2CostState {
  }

  pub fn estimate_cost(&self) -> ImageGenerationCostEstimate {
-    let quality = self.quality.unwrap_or(CommonQualityEnum::High);
+    let quality = clamp_to_supported_quality(self.quality);
    let size = size_bucket(self.aspect_ratio);

    let cost_per_image: u64 = match (quality, size) {
@@ -62,6 +62,8 @@ impl ArtcraftGptImage2CostState {
      | (CommonQualityEnum::High, SizeBucket::Portrait4x3) => 15,
      (CommonQualityEnum::High, SizeBucket::Landscape16x9)
      | (CommonQualityEnum::High, SizeBucket::Portrait16x9) => 16,
+      // Clamped away above.
+      (CommonQualityEnum::Auto | CommonQualityEnum::XHigh | CommonQualityEnum::Max, _) => unreachable!(),
    };

    let cost_in_usd_cents = cost_per_image * self.num_images as u64;
@@ -79,6 +81,20 @@ impl ArtcraftGptImage2CostState {

 /// Mirrors v1's `plan_image_size` for GPT Image 2 — see the v1 file
 /// `plan_generate_image_artcraft_gpt_image_2.rs::plan_image_size`.
+/// GPT Image 2 only offers low / medium / high. `auto` prices as the default (high) and the
+/// higher GPT Image 2.5 tiers clamp down to high, matching the Fal request planner.
+fn clamp_to_supported_quality(quality: Option<CommonQualityEnum>) -> CommonQualityEnum {
+  match quality {
+    Some(CommonQualityEnum::Low) => CommonQualityEnum::Low,
+    Some(CommonQualityEnum::Medium) => CommonQualityEnum::Medium,
+    Some(CommonQualityEnum::High)
+    | Some(CommonQualityEnum::XHigh)
+    | Some(CommonQualityEnum::Max)
+    | Some(CommonQualityEnum::Auto)
+    | None => CommonQualityEnum::High,
+  }
+}
+
 fn size_bucket(aspect_ratio: Option<CommonAspectRatioEnum>) -> SizeBucket {
  use CommonAspectRatioEnum as Ar;
  match aspect_ratio {
@@ -8,25 +8,27 @@ use fal_client::requests::api::image::common::gpt_image_2p5::gpt_image_2p5_image
 use crate::generate::generate_image::image_generation_cost_estimate::ImageGenerationCostEstimate;

 /// Artcraft price per output image, in hundredths of a US cent, by output dimensions and
-/// quality (`[low, medium, high]`). Rows are stored landscape-first; portrait orientations of
-/// the same dimensions price identically. Dimensions come from the aspect ratio preset and
-/// resolution tier the same way the Fal request builder derives them.
-const OUTPUT_IMAGE_PRICE_TABLE: &[(u32, u32, [u64; 3])] = &[
+/// quality (`[low, medium, high, xhigh, max]`). Each cell is the `fal_client` GPT Image 2.5
+/// estimate for that size and tier with a 10% markup, rounded up. Rows are stored
+/// landscape-first; portrait orientations of the same dimensions price identically.
+/// Dimensions come from the aspect ratio preset and resolution tier the same way the Fal
+/// request builder derives them.
+const OUTPUT_IMAGE_PRICE_TABLE: &[(u32, u32, [u64; 5])] = &[
  // 1:1
-  (1024, 1024, [ 65, 152,  582]),
-  (2048, 2048, [103, 239,  919]),
-  (2880, 2880, [151, 352, 1357]),
+  (1024, 1024, [ 65, 152,  582, 1034, 2327]),
+  (2048, 2048, [103, 239,  919, 1633, 3672]),
+  (2880, 2880, [151, 352, 1357, 2412, 5426]),
  // 4:3
-  (1024,  768, [ 46, 105,  400]),
-  (2048, 1536, [ 73, 170,  652]),
-  (3072, 2304, [120, 279, 1073]),
-  (3312, 2480, [134, 311, 1194]),
+  (1024,  768, [ 46, 105,  400,  710, 1597]),
+  (2048, 1536, [ 73, 170,  652, 1159, 2605]),
+  (3072, 2304, [120, 279, 1073, 1906, 4287]),
+  (3312, 2480, [134, 311, 1194, 2122, 4773]),
  // 16:9
-  (1088,  608, [ 32,  75,  285]),
-  (1920, 1080, [ 49, 114,  436]),
-  (2048, 1152, [ 53, 121,  467]),
-  (3072, 1728, [ 87, 204,  783]),
-  (3840, 2160, [124, 286, 1102]),
+  (1088,  608, [ 32,  75,  285,  506, 1139]),
+  (1920, 1080, [ 49, 114,  436,  775, 1743]),
+  (2048, 1152, [ 53, 121,  467,  830, 1865]),
+  (3072, 1728, [ 87, 204,  783, 1390, 3127]),
+  (3840, 2160, [124, 286, 1102, 1957, 4404]),
 ];

 /// Artcraft price per reference image on an edit request, in hundredths of a US cent.
@@ -55,7 +57,8 @@ impl ArtcraftGptImage2p5CostInputs {
  }

  /// Per-image price rounded up to whole cents, times the batch size. Quality defaults to
-  /// high. Without an aspect ratio, text-to-image prices as landscape 4:3 and edit as auto,
+  /// high, and `auto` is priced as high (the documented default the model falls back to).
+  /// Without an aspect ratio, text-to-image prices as landscape 4:3 and edit as auto,
  /// matching the Fal defaults the request would fall back to.
  pub fn estimate_cost(&self) -> ImageGenerationCostEstimate {
    let quality = self.quality.unwrap_or(CommonQualityEnum::High);
@@ -91,11 +94,13 @@ fn output_image_price(quality: CommonQualityEnum, width: u32, height: u32) -> u6
  match quality {
    CommonQualityEnum::Low => prices[0],
    CommonQualityEnum::Medium => prices[1],
-    CommonQualityEnum::High => prices[2],
+    CommonQualityEnum::High | CommonQualityEnum::Auto => prices[2],
+    CommonQualityEnum::XHigh => prices[3],
+    CommonQualityEnum::Max => prices[4],
  }
 }

-fn lookup_price_row(width: u32, height: u32) -> Option<[u64; 3]> {
+fn lookup_price_row(width: u32, height: u32) -> Option<[u64; 5]> {
  let long_edge = width.max(height);
  let short_edge = width.min(height);
  OUTPUT_IMAGE_PRICE_TABLE.iter()
@@ -176,6 +181,18 @@ mod tests {
    (Some(Ar::Auto4k),            Some(R::OneK),  [2, 3, 12]),
  ];

+  // (aspect_ratio, resolution, [xhigh, max]) — cents per image, text-to-image
+  const TEXT_GRID_UPPER_TIERS: &[(Option<Ar>, Option<R>, [u64; 2])] = &[
+    (None,                        None,           [ 8, 16]), // landscape 4:3 default
+    (Some(Ar::Square),            None,           [11, 24]),
+    (Some(Ar::Square),            Some(R::TwoK),  [17, 37]),
+    (Some(Ar::Square),            Some(R::FourK), [25, 55]),
+    (Some(Ar::WideSixteenByNine), None,           [ 8, 18]),
+    (Some(Ar::WideSixteenByNine), Some(R::OneK),  [ 6, 12]),
+    (Some(Ar::TallNineBySixteen), Some(R::FourK), [20, 45]),
+    (Some(Ar::Auto),              None,           [20, 45]),
+  ];
+
  mod text_to_image_tests {
    use super::*;

@@ -189,11 +206,32 @@ mod tests {
      }
    }

+    #[test]
+    fn upper_tier_grid() {
+      for &(aspect_ratio, resolution, expected) in TEXT_GRID_UPPER_TIERS {
+        for (quality, expected) in [Q::XHigh, Q::Max].into_iter().zip(expected) {
+          let actual = cents(make_inputs(0, Some(quality), aspect_ratio, resolution, 1));
+          assert_eq!(actual, expected, "{aspect_ratio:?} {resolution:?} {quality:?}");
+        }
+      }
+    }
+
    #[test]
    fn quality_defaults_to_high() {
      assert_eq!(cents(make_inputs(0, None, Some(Ar::Square), None, 1)), 6);
    }

+    #[test]
+    fn auto_prices_as_high() {
+      for &(aspect_ratio, resolution, _) in TEXT_GRID {
+        assert_eq!(
+          cents(make_inputs(0, Some(Q::Auto), aspect_ratio, resolution, 1)),
+          cents(make_inputs(0, Some(Q::High), aspect_ratio, resolution, 1)),
+          "{aspect_ratio:?} {resolution:?}",
+        );
+      }
+    }
+
    #[test]
    fn batch_multiplies_per_image_cents() {
      for &(aspect_ratio, resolution, _) in TEXT_GRID {
@@ -265,7 +303,7 @@ mod tests {
    #[test]
    fn prices_rise_with_quality_and_size() {
      for &(_, _, prices) in OUTPUT_IMAGE_PRICE_TABLE {
-        assert!(prices[0] < prices[1] && prices[1] < prices[2], "{prices:?}");
+        assert!(prices.windows(2).all(|pair| pair[0] < pair[1]), "{prices:?}");
      }
      assert!(output_image_price(Q::High, 1024, 1024) < output_image_price(Q::High, 2048, 2048));
      assert!(output_image_price(Q::High, 2048, 2048) < output_image_price(Q::High, 2880, 2880));
@@ -100,11 +100,17 @@ fn plan_num_images(
  }
 }

+/// This endpoint only offers low / medium / high. `auto` falls back to Fal's default (`high`)
+/// and the higher GPT Image 2.5 tiers (`xhigh`, `max`) clamp down to `high`.
 fn plan_quality(quality: Option<RouterQuality>) -> PlannedQuality {
  match quality {
    Some(RouterQuality::Low) => PlannedQuality::Low,
    Some(RouterQuality::Medium) => PlannedQuality::Medium,
-    Some(RouterQuality::High) | None => PlannedQuality::High,
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max)
+    | Some(RouterQuality::Auto)
+    | None => PlannedQuality::High,
  }
 }

@@ -337,6 +343,10 @@ mod tests {
      (Some(RouterQuality::Low), "Some(Low)"),
      (Some(RouterQuality::Medium), "Some(Medium)"),
      (Some(RouterQuality::High), "Some(High)"),
+      // Tiers this endpoint lacks clamp to high.
+      (Some(RouterQuality::Auto), "Some(High)"),
+      (Some(RouterQuality::XHigh), "Some(High)"),
+      (Some(RouterQuality::Max), "Some(High)"),
    ];

    for (quality, expected) in cases {
@@ -100,11 +100,17 @@ fn plan_num_images(
  }
 }

+/// This endpoint only offers low / medium / high. `auto` falls back to Fal's default (`high`)
+/// and the higher GPT Image 2.5 tiers (`xhigh`, `max`) clamp down to `high`.
 fn plan_quality(quality: Option<RouterQuality>) -> PlannedQuality {
  match quality {
    Some(RouterQuality::Low) => PlannedQuality::Low,
    Some(RouterQuality::Medium) => PlannedQuality::Medium,
-    Some(RouterQuality::High) | None => PlannedQuality::High,
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max)
+    | Some(RouterQuality::Auto)
+    | None => PlannedQuality::High,
  }
 }

@@ -337,6 +343,10 @@ mod tests {
      (Some(RouterQuality::Low), "Some(Low)"),
      (Some(RouterQuality::Medium), "Some(Medium)"),
      (Some(RouterQuality::High), "Some(High)"),
+      // Tiers this endpoint lacks clamp to high.
+      (Some(RouterQuality::Auto), "Some(High)"),
+      (Some(RouterQuality::XHigh), "Some(High)"),
+      (Some(RouterQuality::Max), "Some(High)"),
    ];

    for (quality, expected) in cases {
@@ -106,11 +106,17 @@ fn plan_num_images(
  }
 }

+/// This endpoint only offers low / medium / high. `auto` falls back to Fal's default (`high`)
+/// and the higher GPT Image 2.5 tiers (`xhigh`, `max`) clamp down to `high`.
 fn plan_quality(quality: Option<RouterQuality>) -> PlannedQuality {
  match quality {
    Some(RouterQuality::Low) => PlannedQuality::Low,
    Some(RouterQuality::Medium) => PlannedQuality::Medium,
-    Some(RouterQuality::High) | None => PlannedQuality::High,
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max)
+    | Some(RouterQuality::Auto)
+    | None => PlannedQuality::High,
  }
 }

@@ -362,6 +368,10 @@ mod tests {
      (Some(RouterQuality::Low), "Some(Low)"),
      (Some(RouterQuality::Medium), "Some(Medium)"),
      (Some(RouterQuality::High), "Some(High)"),
+      // Tiers this endpoint lacks clamp to high.
+      (Some(RouterQuality::Auto), "Some(High)"),
+      (Some(RouterQuality::XHigh), "Some(High)"),
+      (Some(RouterQuality::Max), "Some(High)"),
    ];

    for (quality, expected) in cases {
@@ -82,13 +82,16 @@ fn plan_num_images(
  }
 }

-/// The router only exposes low / medium / high; GPT Image 2.5's `xhigh` and `max` tiers are
-/// not reachable through it. Fal's default (`high`) applies when unspecified.
+/// GPT Image 2.5 supports every router tier natively. Fal's default (`high`) applies when
+/// unspecified.
 fn plan_quality(quality: Option<RouterQuality>) -> GptImage2p5Quality {
  match quality {
-    Some(RouterQuality::Low) => GptImage2p5Quality::Low,
-    Some(RouterQuality::Medium) => GptImage2p5Quality::Medium,
+    Some(RouterQuality::Auto) => GptImage2p5Quality::Auto,
+    Some(RouterQuality::Max) => GptImage2p5Quality::Max,
+    Some(RouterQuality::XHigh) => GptImage2p5Quality::XHigh,
    Some(RouterQuality::High) | None => GptImage2p5Quality::High,
+    Some(RouterQuality::Medium) => GptImage2p5Quality::Medium,
+    Some(RouterQuality::Low) => GptImage2p5Quality::Low,
  }
 }

@@ -220,9 +223,12 @@ mod tests {
  fn quality_maps_exhaustively_for_text_and_edit() {
    let cases = [
      (None, "Some(High)"),
-      (Some(RouterQuality::Low), "Some(Low)"),
-      (Some(RouterQuality::Medium), "Some(Medium)"),
+      (Some(RouterQuality::Auto), "Some(Auto)"),
+      (Some(RouterQuality::Max), "Some(Max)"),
+      (Some(RouterQuality::XHigh), "Some(XHigh)"),
      (Some(RouterQuality::High), "Some(High)"),
+      (Some(RouterQuality::Medium), "Some(Medium)"),
+      (Some(RouterQuality::Low), "Some(Low)"),
    ];
    for (quality, expected) in cases {
      let text = unwrap_t2i(plan_gpt_image_2p5_params(&GenerateImageRequestBuilder { quality, ..base_builder() }));
@@ -53,6 +53,9 @@ mod tests {
    (Some(Q::Low),    Some(Ar::Square),        None,          1,  1),
    (Some(Q::Medium), Some(Ar::Square),        None,          1,  2),
    (Some(Q::High),   Some(Ar::Square),        None,          1,  6),
+    (Some(Q::Auto),   Some(Ar::Square),        None,          1,  6), // auto is priced as high
+    (Some(Q::XHigh),  Some(Ar::Square),        None,          1, 10),
+    (Some(Q::Max),    Some(Ar::Square),        None,          1, 22),
    (Some(Q::High),   Some(Ar::Square),        None,          4, 24),
    (Some(Q::High),   Some(Ar::SquareHd),      None,          1,  9),
    (Some(Q::High),   Some(Ar::Square),        Some(R::TwoK), 1,  9),
@@ -53,6 +53,9 @@ mod tests {
    (Some(Q::Low),    Some(Ar::Square),        None,          1,  1),
    (Some(Q::Medium), Some(Ar::Square),        None,          1,  2),
    (Some(Q::High),   Some(Ar::Square),        None,          1,  6),
+    (Some(Q::Auto),   Some(Ar::Square),        None,          1,  6), // auto is priced as high
+    (Some(Q::XHigh),  Some(Ar::Square),        None,          1, 10),
+    (Some(Q::Max),    Some(Ar::Square),        None,          1, 22),
    (Some(Q::High),   Some(Ar::Square),        None,          4, 24),
    (Some(Q::High),   Some(Ar::SquareHd),      None,          1,  9),
    (Some(Q::High),   Some(Ar::Square),        Some(R::TwoK), 1,  9),
@@ -122,10 +122,14 @@ pub(crate) fn plan_quality(quality: Option<RouterQuality>) -> Option<GenerateMid
  // Kinovi pricing — pass through whatever the caller asked for, and let
  // `None` ride Midjourney's server-side default.
  match quality {
-    None => None,
+    // `auto` has no Midjourney equivalent; leave it to the provider default.
+    None | Some(RouterQuality::Auto) => None,
    Some(RouterQuality::Low) => Some(GenerateMidjourneyV7Quality::Quarter),
    Some(RouterQuality::Medium) => Some(GenerateMidjourneyV7Quality::Half),
-    Some(RouterQuality::High) => Some(GenerateMidjourneyV7Quality::Full),
+    // Midjourney tops out at full quality; the higher GPT Image tiers clamp to it.
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max) => Some(GenerateMidjourneyV7Quality::Full),
  }
 }

@@ -110,10 +110,14 @@ pub(crate) fn plan_aspect_ratio(

 pub(crate) fn plan_quality(quality: Option<RouterQuality>) -> Option<GenerateMidjourneyV7NijiQuality> {
  match quality {
-    None => None,
+    // `auto` has no Midjourney equivalent; leave it to the provider default.
+    None | Some(RouterQuality::Auto) => None,
    Some(RouterQuality::Low) => Some(GenerateMidjourneyV7NijiQuality::Quarter),
    Some(RouterQuality::Medium) => Some(GenerateMidjourneyV7NijiQuality::Half),
-    Some(RouterQuality::High) => Some(GenerateMidjourneyV7NijiQuality::Full),
+    // Midjourney tops out at full quality; the higher GPT Image tiers clamp to it.
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max) => Some(GenerateMidjourneyV7NijiQuality::Full),
  }
 }

@@ -110,10 +110,14 @@ pub(crate) fn plan_aspect_ratio(

 pub(crate) fn plan_quality(quality: Option<RouterQuality>) -> Option<GenerateMidjourneyV8Quality> {
  match quality {
-    None => None,
+    // `auto` has no Midjourney equivalent; leave it to the provider default.
+    None | Some(RouterQuality::Auto) => None,
    Some(RouterQuality::Low) => Some(GenerateMidjourneyV8Quality::Quarter),
    Some(RouterQuality::Medium) => Some(GenerateMidjourneyV8Quality::Half),
-    Some(RouterQuality::High) => Some(GenerateMidjourneyV8Quality::Full),
+    // Midjourney tops out at full quality; the higher GPT Image tiers clamp to it.
+    Some(RouterQuality::High)
+    | Some(RouterQuality::XHigh)
+    | Some(RouterQuality::Max) => Some(GenerateMidjourneyV8Quality::Full),
  }
 }

@@ -1,3 +1,5 @@
+use crate::generate::generate_video::providers::kinovi::wan_3p0::build::build_kinovi_wan_3p0;
+use crate::generate::generate_video::providers::artcraft::wan_3p0::build::build_artcraft_wan_3p0;
 use crate::api::audio_list_ref::AudioListRef;
 use crate::api::character_list_ref::CharacterListRef;
 use crate::api::router_aspect_ratio::RouterAspectRatio;
@@ -142,10 +144,12 @@ pub struct GenerateVideoRequestBuilder {
  /// so it's best to be explicit.
  pub generate_audio: Option<bool>,

-  /// CALCULATION-ONLY (never sent to any provider): the total seconds of
+  /// Local pricing/validation metadata (never sent to a provider): total seconds of
  /// reference video input, summed across all reference videos and rounded
  /// up to whole seconds per file. Models that bill reference-video input
-  /// seconds (e.g. Seedance 2.5) add this to the billed duration.
+  /// seconds (e.g. Seedance 2.5) add this to the billed duration. Wan uses
+  /// the ceiling of the combined measured duration to validate its output
+  /// budget; reference seconds do not affect Wan pricing.
  pub total_reference_video_input_seconds: Option<u16>,

  /// If the request is a mismatch with the (model/provider), how to mitigate it.
@@ -192,6 +196,7 @@ impl GenerateVideoRequestBuilder {
      (RouterProvider::Artcraft, RouterVideoModel::GrokImagineVideo1p5) => build_artcraft_grok_imagine_video_1p5(self),
      (RouterProvider::Artcraft, RouterVideoModel::Flux3) => build_artcraft_flux_3(self),
      (RouterProvider::Artcraft, RouterVideoModel::Flux3Draft) => build_artcraft_flux_3_draft(self),
+      (RouterProvider::Artcraft, RouterVideoModel::Wan3p0 | RouterVideoModel::Wan3p0Prime) => build_artcraft_wan_3p0(self),
      (RouterProvider::Artcraft, RouterVideoModel::HappyHorse1p0) => build_artcraft_happy_horse_1p0(self),
      (RouterProvider::Artcraft, RouterVideoModel::Kling16Pro) => build_artcraft_kling_1_6_pro(self),
      (RouterProvider::Artcraft, RouterVideoModel::Kling21Master) => build_artcraft_kling_2_1_master(self),
@@ -254,6 +259,7 @@ impl GenerateVideoRequestBuilder {
      (RouterProvider::GrokApi, RouterVideoModel::GrokImagineVideo) => build_grok_api_grok_imagine_video(self),
      (RouterProvider::GrokApi, RouterVideoModel::GrokImagineVideo1p5) => build_grok_api_grok_imagine_video_1p5(self),
      // Kinovi
+      (RouterProvider::KinoviWeb, RouterVideoModel::Wan3p0 | RouterVideoModel::Wan3p0Prime) => build_kinovi_wan_3p0(self),
      (RouterProvider::KinoviWeb, RouterVideoModel::HappyHorse1p0) => build_kinovi_happy_horse_1p0(self),
      (RouterProvider::KinoviWeb, RouterVideoModel::Seedance2p0) => build_kinovi_seedance_2p0(self),
      (RouterProvider::KinoviWeb, RouterVideoModel::Seedance2p0Fast) => build_kinovi_seedance_2p0_fast(self),
@@ -45,3 +45,4 @@ pub mod veo_3p1_fast;
 pub mod veo_3p1_lite;
 pub mod vidu_q3;
 pub mod vidu_q3_turbo;
+pub mod wan_3p0;
@@ -0,0 +1,61 @@
+use artcraft_api_defs::omni_gen::cost_and_generate_requests::omni_gen_video_cost_and_generate_request::OmniGenVideoCostAndGenerateRequest;
+use enums::common::generation::common_aspect_ratio::CommonAspectRatio;
+use enums::common::generation::common_resolution::CommonResolution;
+use enums::common::generation::common_video_model::CommonVideoModel;
+use crate::api::router_aspect_ratio::RouterAspectRatio;
+use crate::api::router_resolution::RouterResolution;
+use crate::api::router_video_model::RouterVideoModel;
+use crate::errors::artcraft_router_error::ArtcraftRouterError;
+use crate::generate::generate_video::generate_video_request_builder::GenerateVideoRequestBuilder;
+use crate::generate::generate_video::providers::artcraft::resolve::{resolve_image_ref, resolve_image_list_ref, resolve_video_list_ref, resolve_audio_list_ref};
+use crate::generate::generate_video::providers::artcraft::wan_3p0::request::ArtcraftWan3p0RequestState;
+use crate::generate::generate_video::providers::wan_3p0_common::normalize_wan_3p0_builder;
+use crate::generate::generate_video::video_generation_draft_or_request::VideoGenerationDraftOrRequest;
+use crate::generate::generate_video::video_generation_request::VideoGenerationRequest;
+
+pub fn build_artcraft_wan_3p0(builder: GenerateVideoRequestBuilder) -> Result<VideoGenerationDraftOrRequest, ArtcraftRouterError> {
+  let builder = normalize_wan_3p0_builder(builder)?;
+  let prime = matches!(builder.model, RouterVideoModel::Wan3p0Prime);
+  let aspect = match builder.aspect_ratio.unwrap() {
+    RouterAspectRatio::WideSixteenByNine => CommonAspectRatio::WideSixteenByNine,
+    RouterAspectRatio::TallNineBySixteen => CommonAspectRatio::TallNineBySixteen,
+    RouterAspectRatio::WideFourByThree => CommonAspectRatio::WideFourByThree,
+    RouterAspectRatio::TallThreeByFour => CommonAspectRatio::TallThreeByFour,
+    RouterAspectRatio::Square => CommonAspectRatio::Square,
+    _ => unreachable!("normalized Wan aspect ratio"),
+  };
+  let resolution = match builder.resolution.unwrap() {
+    RouterResolution::FourEightyP => CommonResolution::FourEightyP,
+    RouterResolution::SevenTwentyP => CommonResolution::SevenTwentyP,
+    RouterResolution::TenEightyP => CommonResolution::TenEightyP,
+    _ => unreachable!("normalized Wan resolution"),
+  };
+  let idempotency_token = builder.get_or_generate_idempotency_token();
+  let request = OmniGenVideoCostAndGenerateRequest {
+    model: Some(if prime { CommonVideoModel::Wan3p0Prime } else { CommonVideoModel::Wan3p0 }),
+    idempotency_token: Some(idempotency_token),
+    prompt: builder.prompt,
+    start_frame_image_media_token: resolve_image_ref(builder.start_frame)?,
+    end_frame_image_media_token: resolve_image_ref(builder.end_frame)?,
+    reference_image_media_tokens: resolve_image_list_ref(builder.reference_images)?,
+    reference_video_media_tokens: resolve_video_list_ref(builder.reference_videos)?,
+    reference_audio_media_tokens: resolve_audio_list_ref(builder.reference_audio)?,
+    resolution: Some(resolution),
+    aspect_ratio: Some(aspect),
+    duration_seconds: builder.duration_seconds,
+    video_batch_count: Some(1),
+    generate_audio: builder.generate_audio,
+    reference_character_tokens: None,
+    negative_prompt: None,
+    bitrate: None,
+    maybe_output_format: None,
+    quality: None,
+    estimate_only: None,
+  };
+  let state = ArtcraftWan3p0RequestState { request };
+  Ok(VideoGenerationDraftOrRequest::Request(if prime {
+    VideoGenerationRequest::ArtcraftWan3p0Prime(state)
+  } else {
+    VideoGenerationRequest::ArtcraftWan3p0(state)
+  }))
+}
@@ -0,0 +1,88 @@
+use enums::common::generation::common_resolution::CommonResolution;
+use enums::common::generation::common_video_model::CommonVideoModel;
+use crate::generate::generate_video::providers::artcraft::wan_3p0::request::ArtcraftWan3p0RequestState;
+use crate::generate::generate_video::video_generation_cost_estimate::VideoGenerationCostEstimate;
+
+// ArtCraft USD cents per output second, in 480p/720p/1080p order.
+// Pricing snapshot: 2026-09-18. Review alongside the Wan provider pricing
+// after September 23; see kinovi_web_client/costs_wan_3p0.md.
+const WAN_CENTS_PER_SECOND: [f64; 3] = [4.82858056, 9.65716111, 19.30948396];
+const PRIME_CENTS_PER_SECOND: [f64; 3] = [9.12495283, 18.78695219, 37.57390438];
+
+pub struct ArtcraftWan3p0CostState {
+  pub is_prime: bool,
+  pub resolution: CommonResolution,
+  pub duration_seconds: u16,
+}
+
+impl ArtcraftWan3p0CostState {
+  pub fn from_request(state: &ArtcraftWan3p0RequestState) -> Self {
+    Self {
+      is_prime: matches!(state.request.model, Some(CommonVideoModel::Wan3p0Prime)),
+      resolution: state.request.resolution.unwrap_or(CommonResolution::SevenTwentyP),
+      duration_seconds: state.request.duration_seconds.unwrap_or(5),
+    }
+  }
+
+  pub fn estimate_cost(&self) -> VideoGenerationCostEstimate {
+    let rates = if self.is_prime { PRIME_CENTS_PER_SECOND } else { WAN_CENTS_PER_SECOND };
+    let index = match self.resolution {
+      CommonResolution::FourEightyP => 0,
+      CommonResolution::TenEightyP => 2,
+      _ => 1,
+    };
+    let cents = (rates[index] * f64::from(self.duration_seconds)).ceil() as u64;
+    VideoGenerationCostEstimate {
+      cost_in_credits: Some(cents), cost_in_usd_cents: Some(cents),
+      is_free: false, is_unlimited: false, is_rate_limited: false,
+      has_watermark: false, failures_are_refunded: None,
+    }
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn regular_wan_prices_are_fixed_per_resolution_and_duration() {
+    let expected = [
+      (CommonResolution::FourEightyP, [10, 25, 49]),
+      (CommonResolution::SevenTwentyP, [20, 49, 97]),
+      (CommonResolution::TenEightyP, [39, 97, 194]),
+    ];
+    for (resolution, prices) in expected {
+      for (duration, price) in [(2, prices[0]), (5, prices[1]), (10, prices[2])] {
+        let cost = ArtcraftWan3p0CostState {
+          is_prime: false,
+          resolution,
+          duration_seconds: duration,
+        }
+        .estimate_cost();
+        assert_eq!(cost.cost_in_credits, Some(price));
+        assert_eq!(cost.cost_in_usd_cents, Some(price));
+      }
+    }
+  }
+
+  #[test]
+  fn prime_wan_prices_are_fixed_per_resolution_and_duration() {
+    let expected = [
+      (CommonResolution::FourEightyP, [19, 46, 92]),
+      (CommonResolution::SevenTwentyP, [38, 94, 188]),
+      (CommonResolution::TenEightyP, [76, 188, 376]),
+    ];
+    for (resolution, prices) in expected {
+      for (duration, price) in [(2, prices[0]), (5, prices[1]), (10, prices[2])] {
+        let cost = ArtcraftWan3p0CostState {
+          is_prime: true,
+          resolution,
+          duration_seconds: duration,
+        }
+        .estimate_cost();
+        assert_eq!(cost.cost_in_credits, Some(price));
+        assert_eq!(cost.cost_in_usd_cents, Some(price));
+      }
+    }
+  }
+}
@@ -0,0 +1,3 @@
+pub mod build;
+pub mod cost;
+pub mod request;
@@ -0,0 +1,16 @@
+use artcraft_api_defs::omni_gen::cost_and_generate_requests::omni_gen_video_cost_and_generate_request::OmniGenVideoCostAndGenerateRequest;
+use crate::client::router_artcraft_client::RouterArtcraftClient;
+use crate::errors::artcraft_router_error::ArtcraftRouterError;
+use crate::generate::generate_video::generate_video_response::GenerateVideoResponse;
+use crate::generate::generate_video::providers::artcraft::request_common::send_artcraft_omni_video_request;
+
+#[derive(Clone, Debug)]
+pub struct ArtcraftWan3p0RequestState {
+  pub request: OmniGenVideoCostAndGenerateRequest,
+}
+
+impl ArtcraftWan3p0RequestState {
+  pub async fn send(&self, client: &RouterArtcraftClient) -> Result<GenerateVideoResponse, ArtcraftRouterError> {
+    send_artcraft_omni_video_request(&self.request, client).await
+  }
+}
@@ -6,3 +6,4 @@ pub mod seedance_2p5;
 pub mod seedance_2p5_preview;
 pub(crate) mod resolve;
 pub(crate) mod upload;
+pub mod wan_3p0;
@@ -0,0 +1,18 @@
+use crate::api::router_video_model::RouterVideoModel;
+use crate::errors::artcraft_router_error::ArtcraftRouterError;
+use crate::generate::generate_video::generate_video_request_builder::GenerateVideoRequestBuilder;
+use crate::generate::generate_video::providers::kinovi::wan_3p0::draft::KinoviWan3p0DraftState;
+use crate::generate::generate_video::providers::wan_3p0_common::normalize_wan_3p0_builder;
+use crate::generate::generate_video::video_generation_draft::VideoGenerationDraftRequest;
+use crate::generate::generate_video::video_generation_draft_or_request::VideoGenerationDraftOrRequest;
+
+pub fn build_kinovi_wan_3p0(builder: GenerateVideoRequestBuilder) -> Result<VideoGenerationDraftOrRequest, ArtcraftRouterError> {
+  let builder = normalize_wan_3p0_builder(builder)?;
+  let prime = matches!(builder.model, RouterVideoModel::Wan3p0Prime);
+  let draft = KinoviWan3p0DraftState { builder };
+  Ok(VideoGenerationDraftOrRequest::Draft(if prime {
+    VideoGenerationDraftRequest::KinoviWan3p0Prime(draft)
+  } else {
+    VideoGenerationDraftRequest::KinoviWan3p0(draft)
+  }))
+}
@@ -0,0 +1,29 @@
+use kinovi_web_client::pricing::cost::kinovi_fractional_generation_cost::KinoviFractionalGenerationCost;
+use crate::generate::generate_video::providers::kinovi::wan_3p0::draft::KinoviWan3p0DraftState;
+use crate::generate::generate_video::providers::kinovi::wan_3p0::request::KinoviWan3p0RequestState;
+use crate::generate::generate_video::video_generation_cost_estimate::VideoGenerationCostEstimate;
+
+pub struct KinoviWan3p0CostState {
+  costs: KinoviFractionalGenerationCost,
+}
+
+impl KinoviWan3p0CostState {
+  pub fn from_draft(draft: &KinoviWan3p0DraftState) -> Self {
+    // Media does not affect Wan pricing. Build a pricing-only request without
+    // uploading anything, keeping the planned model, duration and resolution.
+    Self::from_request(&draft.with_resolved_media(None, None, None, None, None))
+  }
+
+  pub fn from_request(request: &KinoviWan3p0RequestState) -> Self {
+    Self { costs: request.request.calculate_enterprise_costs() }
+  }
+
+  pub fn estimate_cost(&self) -> VideoGenerationCostEstimate {
+    VideoGenerationCostEstimate {
+      cost_in_credits: Some(self.costs.kinovi_credits.round() as u64),
+      cost_in_usd_cents: Some(self.costs.usd_cents_rounded_up),
+      is_free: false, is_unlimited: false, is_rate_limited: false,
+      has_watermark: false, failures_are_refunded: None,
+    }
+  }
+}
@@ -0,0 +1,126 @@
+use kinovi_web_client::generate::video::generate_wan_3p0_text_to_video::GenerateWan3p0TextToVideoRequest;
+use kinovi_web_client::generate::video::generate_wan_3p0_image_to_video::GenerateWan3p0ImageToVideoRequest;
+use kinovi_web_client::generate::video::generate_wan_3p0_ref_to_video::GenerateWan3p0RefToVideoRequest;
+use kinovi_web_client::generate::video::generate_wan_3p0_prime_text_to_video::GenerateWan3p0PrimeTextToVideoRequest;
+use kinovi_web_client::generate::video::generate_wan_3p0_prime_image_to_video::GenerateWan3p0PrimeImageToVideoRequest;
+use kinovi_web_client::generate::video::generate_wan_3p0_prime_ref_to_video::GenerateWan3p0PrimeRefToVideoRequest;
+use kinovi_web_client::generate::video::wan_3p0::{KinoviWan3p0AspectRatio, KinoviWan3p0OutputResolution};
+use crate::api::router_aspect_ratio::RouterAspectRatio;
+use crate::api::router_resolution::RouterResolution;
+use crate::api::router_video_model::RouterVideoModel;
+use crate::errors::artcraft_router_error::ArtcraftRouterError;
+use crate::generate::generate_video::generate_video_request_builder::GenerateVideoRequestBuilder;
+use crate::generate::generate_video::providers::kinovi::resolve::{audio_list_ref_into_urls_or_tokens, image_list_ref_into_urls_or_tokens, video_list_ref_into_urls_or_tokens, resolve_and_upload_list, resolve_and_upload_single};
+use crate::generate::generate_video::providers::kinovi::wan_3p0::request::{KinoviWan3p0Request, KinoviWan3p0RequestState};
+use crate::generate::generate_video::providers::wan_3p0_common::{modality, Wan3p0Modality};
+use crate::generate::generate_video::video_generation_draft_context::VideoGenerationDraftContext;
+
+#[derive(Clone, Debug)]
+pub struct KinoviWan3p0DraftState {
+  /// Settings are normalized before this draft is constructed.
+  pub(crate) builder: GenerateVideoRequestBuilder,
+}
+
+impl KinoviWan3p0DraftState {
+  pub async fn to_request(&self, context: &VideoGenerationDraftContext<'_>) -> Result<KinoviWan3p0RequestState, ArtcraftRouterError> {
+    let client = context.get_kinovi_web_client_ref()?;
+    let session = &client.session;
+    let map = context.media_file_to_artcraft_url_map;
+    let paths = context.predownloaded_media_paths;
+    let builder = &self.builder;
+    let start = resolve_and_upload_single(session, builder.start_frame.clone(), map, paths).await?;
+    let end = resolve_and_upload_single(session, builder.end_frame.clone(), map, paths).await?;
+    let images = resolve_and_upload_list(session, builder.reference_images.clone().map(image_list_ref_into_urls_or_tokens), map, paths).await?;
+    let videos = resolve_and_upload_list(session, builder.reference_videos.clone().map(video_list_ref_into_urls_or_tokens), map, paths).await?;
+    let audio = resolve_and_upload_list(session, builder.reference_audio.clone().map(audio_list_ref_into_urls_or_tokens), map, paths).await?;
+    Ok(self.with_resolved_media(start, end, images, videos, audio))
+  }
+
+  pub(crate) fn with_resolved_media(
+    &self,
+    maybe_start: Option<String>,
+    maybe_end: Option<String>,
+    maybe_images: Option<Vec<String>>,
+    maybe_videos: Option<Vec<String>>,
+    maybe_audio: Option<Vec<String>>,
+  ) -> KinoviWan3p0RequestState {
+    let builder = &self.builder;
+    let aspect = match builder.aspect_ratio.unwrap() {
+      RouterAspectRatio::WideSixteenByNine => KinoviWan3p0AspectRatio::Landscape16x9,
+      RouterAspectRatio::TallNineBySixteen => KinoviWan3p0AspectRatio::Portrait9x16,
+      RouterAspectRatio::WideFourByThree => KinoviWan3p0AspectRatio::Landscape4x3,
+      RouterAspectRatio::TallThreeByFour => KinoviWan3p0AspectRatio::Portrait3x4,
+      RouterAspectRatio::Square => KinoviWan3p0AspectRatio::Square1x1,
+      _ => unreachable!("normalized Wan aspect ratio"),
+    };
+    let resolution = match builder.resolution.unwrap() {
+      RouterResolution::FourEightyP => KinoviWan3p0OutputResolution::FourEightyP,
+      RouterResolution::SevenTwentyP => KinoviWan3p0OutputResolution::SevenTwentyP,
+      RouterResolution::TenEightyP => KinoviWan3p0OutputResolution::TenEightyP,
+      _ => unreachable!("normalized Wan resolution"),
+    };
+    let request = match (matches!(builder.model, RouterVideoModel::Wan3p0Prime), modality(builder)) {
+      (false, Wan3p0Modality::Text) => KinoviWan3p0Request::Text(GenerateWan3p0TextToVideoRequest {
+        prompt: builder.prompt.clone().unwrap_or_default(),
+        maybe_aspect_ratio: Some(aspect),
+        maybe_output_resolution: Some(resolution),
+        duration_seconds: builder.duration_seconds.unwrap() as u8,
+        maybe_generate_audio: builder.generate_audio,
+        ..Default::default()
+      }),
+      (false, Wan3p0Modality::Image) => KinoviWan3p0Request::Image(GenerateWan3p0ImageToVideoRequest {
+        prompt: builder.prompt.clone().unwrap_or_default(),
+        maybe_aspect_ratio: Some(aspect),
+        maybe_output_resolution: Some(resolution),
+        duration_seconds: builder.duration_seconds.unwrap() as u8,
+        maybe_generate_audio: builder.generate_audio,
+        maybe_start_frame_url: maybe_start,
+        maybe_end_frame_url: maybe_end,
+        ..Default::default()
+      }),
+      (false, Wan3p0Modality::Reference) => KinoviWan3p0Request::Reference(GenerateWan3p0RefToVideoRequest {
+        prompt: builder.prompt.clone().unwrap_or_default(),
+        maybe_aspect_ratio: Some(aspect),
+        maybe_output_resolution: Some(resolution),
+        duration_seconds: builder.duration_seconds.unwrap() as u8,
+        maybe_generate_audio: builder.generate_audio,
+        maybe_reference_image_urls: maybe_images,
+        maybe_reference_video_urls: maybe_videos,
+        maybe_reference_audio_urls: maybe_audio,
+        maybe_total_reference_video_duration_millis: builder.total_reference_video_input_seconds.map(|seconds| u32::from(seconds) * 1000),
+        ..Default::default()
+      }),
+      (true, Wan3p0Modality::Text) => KinoviWan3p0Request::PrimeText(GenerateWan3p0PrimeTextToVideoRequest {
+        prompt: builder.prompt.clone().unwrap_or_default(),
+        maybe_aspect_ratio: Some(aspect),
+        maybe_output_resolution: Some(resolution),
+        duration_seconds: builder.duration_seconds.unwrap() as u8,
+        maybe_generate_audio: builder.generate_audio,
+        ..Default::default()
+      }),
+      (true, Wan3p0Modality::Image) => KinoviWan3p0Request::PrimeImage(GenerateWan3p0PrimeImageToVideoRequest {
+        prompt: builder.prompt.clone().unwrap_or_default(),
+        maybe_aspect_ratio: Some(aspect),
+        maybe_output_resolution: Some(resolution),
+        duration_seconds: builder.duration_seconds.unwrap() as u8,
+        maybe_generate_audio: builder.generate_audio,
+        maybe_start_frame_url: maybe_start,
+        maybe_end_frame_url: maybe_end,
+        ..Default::default()
+      }),
+      (true, Wan3p0Modality::Reference) => KinoviWan3p0Request::PrimeReference(GenerateWan3p0PrimeRefToVideoRequest {
+        prompt: builder.prompt.clone().unwrap_or_default(),
+        maybe_aspect_ratio: Some(aspect),
+        maybe_output_resolution: Some(resolution),
+        duration_seconds: builder.duration_seconds.unwrap() as u8,
+        maybe_generate_audio: builder.generate_audio,
+        maybe_reference_image_urls: maybe_images,
+        maybe_reference_video_urls: maybe_videos,
+        maybe_reference_audio_urls: maybe_audio,
+        maybe_total_reference_video_duration_millis: builder.total_reference_video_input_seconds.map(|seconds| u32::from(seconds) * 1000),
+        ..Default::default()
+      }),
+    };
+    KinoviWan3p0RequestState { request }
+  }
+}
@@ -0,0 +1,4 @@
+pub mod build;
+pub mod cost;
+pub mod draft;
+pub mod request;
@@ -0,0 +1,61 @@
+use kinovi_web_client::generate::video::generate_wan_3p0_text_to_video::{generate_wan_3p0_text_to_video, GenerateWan3p0TextToVideoArgs, GenerateWan3p0TextToVideoRequest};
+use kinovi_web_client::generate::video::generate_wan_3p0_image_to_video::{generate_wan_3p0_image_to_video, GenerateWan3p0ImageToVideoArgs, GenerateWan3p0ImageToVideoRequest};
+use kinovi_web_client::generate::video::generate_wan_3p0_ref_to_video::{generate_wan_3p0_ref_to_video, GenerateWan3p0RefToVideoArgs, GenerateWan3p0RefToVideoRequest};
+use kinovi_web_client::generate::video::generate_wan_3p0_prime_text_to_video::{generate_wan_3p0_prime_text_to_video, GenerateWan3p0PrimeTextToVideoArgs, GenerateWan3p0PrimeTextToVideoRequest};
+use kinovi_web_client::generate::video::generate_wan_3p0_prime_image_to_video::{generate_wan_3p0_prime_image_to_video, GenerateWan3p0PrimeImageToVideoArgs, GenerateWan3p0PrimeImageToVideoRequest};
+use kinovi_web_client::generate::video::generate_wan_3p0_prime_ref_to_video::{generate_wan_3p0_prime_ref_to_video, GenerateWan3p0PrimeRefToVideoArgs, GenerateWan3p0PrimeRefToVideoRequest};
+use kinovi_web_client::pricing::cost::kinovi_fractional_generation_cost::KinoviFractionalGenerationCost;
+use kinovi_web_client::pricing::kinovi_cost_calculator_trait::KinoviCostCalculatorTrait;
+use crate::client::router_kinovi_web_client::RouterKinoviWebClient;
+use crate::errors::artcraft_router_error::ArtcraftRouterError;
+use crate::errors::provider_error::ProviderError;
+use crate::generate::generate_video::generate_video_response::{GenerateVideoResponse, KinoviWebVideoResponsePayload};
+
+#[derive(Clone, Debug)]
+pub struct KinoviWan3p0RequestState {
+  pub request: KinoviWan3p0Request,
+}
+
+/// Provider bindings selected internally from the two public Wan models.
+#[derive(Clone, Debug)]
+pub enum KinoviWan3p0Request {
+  Text(GenerateWan3p0TextToVideoRequest),
+  Image(GenerateWan3p0ImageToVideoRequest),
+  Reference(GenerateWan3p0RefToVideoRequest),
+  PrimeText(GenerateWan3p0PrimeTextToVideoRequest),
+  PrimeImage(GenerateWan3p0PrimeImageToVideoRequest),
+  PrimeReference(GenerateWan3p0PrimeRefToVideoRequest),
+}
+
+impl KinoviWan3p0RequestState {
+  pub async fn send(&self, client: &RouterKinoviWebClient) -> Result<GenerateVideoResponse, ArtcraftRouterError> {
+    let session = &client.session;
+    let response = match &self.request {
+      KinoviWan3p0Request::Text(request) => generate_wan_3p0_text_to_video(GenerateWan3p0TextToVideoArgs { request: request.clone(), session, maybe_host_override: None }).await,
+      KinoviWan3p0Request::Image(request) => generate_wan_3p0_image_to_video(GenerateWan3p0ImageToVideoArgs { request: request.clone(), session, maybe_host_override: None }).await,
+      KinoviWan3p0Request::Reference(request) => generate_wan_3p0_ref_to_video(GenerateWan3p0RefToVideoArgs { request: request.clone(), session, maybe_host_override: None }).await,
+      KinoviWan3p0Request::PrimeText(request) => generate_wan_3p0_prime_text_to_video(GenerateWan3p0PrimeTextToVideoArgs { request: request.clone(), session, maybe_host_override: None }).await,
+      KinoviWan3p0Request::PrimeImage(request) => generate_wan_3p0_prime_image_to_video(GenerateWan3p0PrimeImageToVideoArgs { request: request.clone(), session, maybe_host_override: None }).await,
+      KinoviWan3p0Request::PrimeReference(request) => generate_wan_3p0_prime_ref_to_video(GenerateWan3p0PrimeRefToVideoArgs { request: request.clone(), session, maybe_host_override: None }).await,
+    }.map_err(|err| ArtcraftRouterError::Provider(ProviderError::KinoviWeb(err)))?;
+    Ok(GenerateVideoResponse::KinoviWeb(KinoviWebVideoResponsePayload {
+      order_id: response.order_id,
+      task_id: response.task_id,
+      maybe_order_ids: response.order_ids,
+      maybe_task_ids: response.task_ids,
+    }))
+  }
+}
+
+impl KinoviWan3p0Request {
+  pub fn calculate_enterprise_costs(&self) -> KinoviFractionalGenerationCost {
+    match self {
+      Self::Text(request) => request.calculate_enterprise_costs(),
+      Self::Image(request) => request.calculate_enterprise_costs(),
+      Self::Reference(request) => request.calculate_enterprise_costs(),
+      Self::PrimeText(request) => request.calculate_enterprise_costs(),
+      Self::PrimeImage(request) => request.calculate_enterprise_costs(),
+      Self::PrimeReference(request) => request.calculate_enterprise_costs(),
+    }
+  }
+}
@@ -3,3 +3,4 @@ pub mod fal;
 pub mod first_party;
 pub mod grok_api;
 pub mod kinovi;
+pub mod wan_3p0_common;
@@ -0,0 +1,213 @@
+//! Request planning shared by the ArtCraft and Kinovi Wan providers.
+
+use crate::api::audio_list_ref::AudioListRef;
+use crate::api::character_list_ref::CharacterListRef;
+use crate::api::image_list_ref::ImageListRef;
+use crate::api::router_aspect_ratio::RouterAspectRatio;
+use crate::api::router_resolution::RouterResolution;
+use crate::api::video_list_ref::VideoListRef;
+use crate::client::request_mismatch_mitigation_strategy::RequestMismatchMitigationStrategy;
+use crate::errors::artcraft_router_error::ArtcraftRouterError;
+use crate::errors::client_error::ClientError;
+use crate::generate::generate_video::generate_video_request_builder::GenerateVideoRequestBuilder;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Wan3p0Modality {
+  Text,
+  Image,
+  Reference,
+}
+
+/// Materialize the same settings for execution and ArtCraft cost estimation.
+pub fn normalize_wan_3p0_builder(
+  mut builder: GenerateVideoRequestBuilder,
+) -> Result<GenerateVideoRequestBuilder, ArtcraftRouterError> {
+  let strict = matches!(builder.request_mismatch_mitigation_strategy, RequestMismatchMitigationStrategy::ErrorOut);
+  builder.reference_images = builder.reference_images.filter(|images| match images {
+    ImageListRef::MediaFileTokens(items) => !items.is_empty(),
+    ImageListRef::Urls(items) => !items.is_empty(),
+  });
+  builder.reference_videos = builder.reference_videos.filter(|videos| match videos {
+    VideoListRef::MediaFileTokens(items) => !items.is_empty(),
+    VideoListRef::Urls(items) => !items.is_empty(),
+  });
+  builder.reference_audio = builder.reference_audio.filter(|audio| match audio {
+    AudioListRef::MediaFileTokens(items) => !items.is_empty(),
+    AudioListRef::Urls(items) => !items.is_empty(),
+  });
+  builder.reference_character_tokens = builder.reference_character_tokens.filter(|characters| match characters {
+    CharacterListRef::CharacterTokens(items) => !items.is_empty(),
+  });
+  let has_keyframes = builder.start_frame.is_some() || builder.end_frame.is_some();
+  if has_keyframes && modality(&builder) == Wan3p0Modality::Reference {
+    return Err(unsupported("reference_images", "Wan cannot combine keyframes with reference media"));
+  }
+  if builder.start_frame.is_none() && builder.end_frame.is_some() {
+    if strict {
+      return Err(unsupported("end_frame", "Wan requires a starting frame"));
+    }
+    // Kinovi requires the first keyframe. With adaptation enabled, use the
+    // only supplied image as that keyframe, preserving image-to-video routing.
+    builder.start_frame = builder.end_frame.take();
+  }
+  if builder.reference_character_tokens.is_some() {
+    return Err(unsupported("reference_character_tokens", "Wan character references are not supported"));
+  }
+  let image_count = builder.reference_images.as_ref().map_or(0, |images| match images {
+    ImageListRef::MediaFileTokens(items) => items.len(),
+    ImageListRef::Urls(items) => items.len(),
+  });
+  let video_count = builder.reference_videos.as_ref().map_or(0, |videos| match videos {
+    VideoListRef::MediaFileTokens(items) => items.len(),
+    VideoListRef::Urls(items) => items.len(),
+  });
+  let audio_count = builder.reference_audio.as_ref().map_or(0, |audio| match audio {
+    AudioListRef::MediaFileTokens(items) => items.len(),
+    AudioListRef::Urls(items) => items.len(),
+  });
+  for (field, count, limit) in [("reference_images", image_count, 10), ("reference_videos", video_count, 5), ("reference_audio", audio_count, 5)] {
+    if count > limit {
+      return Err(unsupported(field, format!("Wan supports at most {limit} references")));
+    }
+  }
+  let duration = builder.duration_seconds.unwrap_or(5);
+  if strict && !(2..=30).contains(&duration) {
+    return Err(unsupported("duration_seconds", "Wan supports 2 through 30 seconds"));
+  }
+  builder.duration_seconds = Some(duration.clamp(2, 30));
+  match builder.video_batch_count.unwrap_or(1) {
+    0 => return Err(ArtcraftRouterError::Client(ClientError::UserRequestedZeroGenerations)),
+    1 => {},
+    _ if strict => return Err(unsupported("video_batch_count", "Wan supports one video per request")),
+    _ => {},
+  }
+  builder.video_batch_count = Some(1);
+  builder.aspect_ratio = Some(match builder.aspect_ratio {
+    None | Some(RouterAspectRatio::Auto | RouterAspectRatio::Auto2k | RouterAspectRatio::Auto3k | RouterAspectRatio::Auto4k | RouterAspectRatio::Wide) => RouterAspectRatio::WideSixteenByNine,
+    Some(RouterAspectRatio::Tall) => RouterAspectRatio::TallNineBySixteen,
+    Some(RouterAspectRatio::SquareHd) => RouterAspectRatio::Square,
+    Some(ratio @ (RouterAspectRatio::WideSixteenByNine | RouterAspectRatio::TallNineBySixteen | RouterAspectRatio::WideFourByThree | RouterAspectRatio::TallThreeByFour | RouterAspectRatio::Square)) => ratio,
+    Some(ratio) if strict => return Err(unsupported("aspect_ratio", format!("{ratio:?}"))),
+    Some(RouterAspectRatio::WideTwentyOneByNine) => RouterAspectRatio::WideSixteenByNine,
+    Some(RouterAspectRatio::WideFiveByFour | RouterAspectRatio::WideThreeByTwo) => RouterAspectRatio::WideFourByThree,
+    Some(RouterAspectRatio::TallFourByFive | RouterAspectRatio::TallTwoByThree) => RouterAspectRatio::TallThreeByFour,
+    Some(RouterAspectRatio::TallNineByTwentyOne) => RouterAspectRatio::TallNineBySixteen,
+  });
+  builder.resolution = Some(match builder.resolution {
+    None => RouterResolution::SevenTwentyP,
+    Some(resolution @ (RouterResolution::FourEightyP | RouterResolution::SevenTwentyP | RouterResolution::TenEightyP)) => resolution,
+    Some(resolution) if strict => return Err(unsupported("resolution", format!("{resolution:?}"))),
+    Some(RouterResolution::HalfK) => match builder.request_mismatch_mitigation_strategy {
+      RequestMismatchMitigationStrategy::PayMoreUpgrade => RouterResolution::SevenTwentyP,
+      _ => RouterResolution::FourEightyP,
+    },
+    Some(RouterResolution::OneK) => match builder.request_mismatch_mitigation_strategy {
+      RequestMismatchMitigationStrategy::PayLessDowngrade => RouterResolution::SevenTwentyP,
+      _ => RouterResolution::TenEightyP,
+    },
+    Some(_) => RouterResolution::TenEightyP,
+  });
+  if video_count > 0 {
+    // Without measurements, each reference still consumes at least one second.
+    let seconds = builder.total_reference_video_input_seconds.unwrap_or(video_count as u16);
+    if seconds < video_count as u16 || seconds > 15 || seconds + builder.duration_seconds.unwrap() > 30 {
+      return Err(unsupported("duration_seconds", "Wan reference videos must total at most 15s, and reference plus output duration must not exceed 30s"));
+    }
+  }
+  Ok(builder)
+}
+
+pub fn modality(builder: &GenerateVideoRequestBuilder) -> Wan3p0Modality {
+  if builder.reference_images.is_some() || builder.reference_videos.is_some() || builder.reference_audio.is_some() {
+    Wan3p0Modality::Reference
+  } else if builder.start_frame.is_some() || builder.end_frame.is_some() {
+    Wan3p0Modality::Image
+  } else {
+    Wan3p0Modality::Text
+  }
+}
+
+fn unsupported(field: &'static str, value: impl Into<String>) -> ArtcraftRouterError {
+  ArtcraftRouterError::Client(ClientError::ModelDoesNotSupportOption { field, value: value.into() })
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use crate::api::image_ref::ImageRef;
+  use crate::api::router_video_model::RouterVideoModel;
+
+  fn builder() -> GenerateVideoRequestBuilder {
+    GenerateVideoRequestBuilder {
+      model: RouterVideoModel::Wan3p0,
+      request_mismatch_mitigation_strategy: RequestMismatchMitigationStrategy::PayMoreUpgrade,
+      ..Default::default()
+    }
+  }
+
+  #[test]
+  fn modality_selects_text_keyframe_or_reference_endpoint() {
+    let text = builder();
+    assert_eq!(modality(&text), Wan3p0Modality::Text);
+
+    let keyframe = GenerateVideoRequestBuilder {
+      start_frame: Some(ImageRef::Url("https://example.com/start.png".to_string())),
+      ..text.clone()
+    };
+    assert_eq!(modality(&keyframe), Wan3p0Modality::Image);
+
+    let reference = GenerateVideoRequestBuilder {
+      reference_images: Some(ImageListRef::Urls(vec!["https://example.com/ref.png".to_string()])),
+      ..text
+    };
+    assert_eq!(modality(&reference), Wan3p0Modality::Reference);
+  }
+
+  #[test]
+  fn normalization_defaults_and_adapts_settings_for_kinovi() {
+    let normalized = normalize_wan_3p0_builder(GenerateVideoRequestBuilder {
+      model: RouterVideoModel::Wan3p0Prime,
+      duration_seconds: Some(99),
+      video_batch_count: Some(4),
+      aspect_ratio: Some(RouterAspectRatio::WideTwentyOneByNine),
+      resolution: Some(RouterResolution::FourK),
+      request_mismatch_mitigation_strategy: RequestMismatchMitigationStrategy::PayMoreUpgrade,
+      ..Default::default()
+    })
+    .unwrap();
+
+    assert_eq!(normalized.duration_seconds, Some(30));
+    assert_eq!(normalized.video_batch_count, Some(1));
+    assert!(matches!(normalized.aspect_ratio, Some(RouterAspectRatio::WideSixteenByNine)));
+    assert!(matches!(normalized.resolution, Some(RouterResolution::TenEightyP)));
+  }
+
+  #[test]
+  fn strict_mode_rejects_unsupported_shape() {
+    let result = normalize_wan_3p0_builder(GenerateVideoRequestBuilder {
+      resolution: Some(RouterResolution::FourK),
+      request_mismatch_mitigation_strategy: RequestMismatchMitigationStrategy::ErrorOut,
+      ..builder()
+    });
+    assert!(result.is_err());
+  }
+
+  #[test]
+  fn reference_video_budget_uses_measured_total_when_available() {
+    let result = normalize_wan_3p0_builder(GenerateVideoRequestBuilder {
+      duration_seconds: Some(20),
+      total_reference_video_input_seconds: Some(11),
+      reference_videos: Some(VideoListRef::Urls(vec!["https://example.com/ref.mp4".to_string()])),
+      ..builder()
+    });
+    assert!(result.is_err());
+
+    let result = normalize_wan_3p0_builder(GenerateVideoRequestBuilder {
+      duration_seconds: Some(20),
+      total_reference_video_input_seconds: Some(10),
+      reference_videos: Some(VideoListRef::Urls(vec!["https://example.com/ref.mp4".to_string()])),
+      ..builder()
+    });
+    assert!(result.is_ok());
+  }
+}
@@ -1,3 +1,5 @@
+use crate::generate::generate_video::providers::kinovi::wan_3p0::cost::KinoviWan3p0CostState;
+use crate::generate::generate_video::providers::kinovi::wan_3p0::draft::KinoviWan3p0DraftState;
 use crate::api::router_provider::RouterProvider;
 use crate::errors::artcraft_router_error::ArtcraftRouterError;
 use crate::generate::generate_video::video_generation_cost_estimate::VideoGenerationCostEstimate;
@@ -21,6 +23,8 @@ use crate::generate::generate_video::video_generation_request::VideoGenerationRe
 */
 #[derive(Clone, Debug)]
 pub enum VideoGenerationDraftRequest {
+  KinoviWan3p0(KinoviWan3p0DraftState),
+  KinoviWan3p0Prime(KinoviWan3p0DraftState),
  KinoviHappyHorse1p0(KinoviHappyHorse1p0DraftState),
  KinoviSeedance2p0(KinoviSeedance2p0DraftState),
  KinoviSeedance2p0Fast(KinoviSeedance2p0FastDraftState),
@@ -33,6 +37,8 @@ impl VideoGenerationDraftRequest {

  pub fn get_provider(&self) -> RouterProvider {
    match self {
+      Self::KinoviWan3p0(_) => RouterProvider::KinoviWeb,
+      Self::KinoviWan3p0Prime(_) => RouterProvider::KinoviWeb,
      Self::KinoviHappyHorse1p0(_) => RouterProvider::KinoviWeb,
      Self::KinoviSeedance2p0(_) => RouterProvider::KinoviWeb,
      Self::KinoviSeedance2p0Fast(_) => RouterProvider::KinoviWeb,
@@ -45,6 +51,8 @@ impl VideoGenerationDraftRequest {
  /// Return a cost estimate to fulfill the request.
  pub fn estimate_cost(&self) -> Result<VideoGenerationCostEstimate, ArtcraftRouterError> {
    match self {
+      VideoGenerationDraftRequest::KinoviWan3p0(state) => Ok(KinoviWan3p0CostState::from_draft(state).estimate_cost()),
+      VideoGenerationDraftRequest::KinoviWan3p0Prime(state) => Ok(KinoviWan3p0CostState::from_draft(state).estimate_cost()),
      VideoGenerationDraftRequest::KinoviHappyHorse1p0(draft) => Ok(KinoviHappyHorse1p0CostState::from_draft(draft).estimate_cost()),
      VideoGenerationDraftRequest::KinoviSeedance2p0(draft) => Ok(KinoviSeedance2p0CostState::from_draft(draft).estimate_cost()),
      VideoGenerationDraftRequest::KinoviSeedance2p0Fast(draft) => Ok(KinoviSeedance2p0FastCostState::from_draft(draft).estimate_cost()),
@@ -58,6 +66,12 @@ impl VideoGenerationDraftRequest {
  /// This may involve uploading media to the provider.
  pub async fn finalize(self, draft_context: VideoGenerationDraftContext<'_>) -> Result<VideoGenerationRequest, ArtcraftRouterError> {
    match self {
+      VideoGenerationDraftRequest::KinoviWan3p0(draft) => {
+        Ok(VideoGenerationRequest::KinoviWan3p0(draft.to_request(&draft_context).await?))
+      },
+      VideoGenerationDraftRequest::KinoviWan3p0Prime(draft) => {
+        Ok(VideoGenerationRequest::KinoviWan3p0Prime(draft.to_request(&draft_context).await?))
+      },
      VideoGenerationDraftRequest::KinoviHappyHorse1p0(mut draft) => {
        let result = draft.to_request(&draft_context).await?;
        Ok(VideoGenerationRequest::KinoviHappyHorse1p0(result))
@@ -1,3 +1,7 @@
+use crate::generate::generate_video::providers::kinovi::wan_3p0::cost::KinoviWan3p0CostState;
+use crate::generate::generate_video::providers::kinovi::wan_3p0::request::KinoviWan3p0RequestState;
+use crate::generate::generate_video::providers::artcraft::wan_3p0::cost::ArtcraftWan3p0CostState;
+use crate::generate::generate_video::providers::artcraft::wan_3p0::request::ArtcraftWan3p0RequestState;
 use crate::api::router_provider::RouterProvider;
 use crate::client::router_client::RouterClient;
 use crate::errors::artcraft_router_error::ArtcraftRouterError;
@@ -148,6 +152,8 @@ pub enum VideoGenerationRequest {
  ArtcraftGrokImagineVideo1p5(ArtcraftGrokImagineVideo1p5RequestState),
  ArtcraftFlux3(ArtcraftFlux3RequestState),
  ArtcraftFlux3Draft(ArtcraftFlux3DraftRequestState),
+  ArtcraftWan3p0(ArtcraftWan3p0RequestState),
+  ArtcraftWan3p0Prime(ArtcraftWan3p0RequestState),
  ArtcraftHappyHorse1p0(ArtcraftHappyHorse1p0RequestState),
  ArtcraftKling16Pro(ArtcraftKling16ProRequestState),
  ArtcraftKling21Master(ArtcraftKling21MasterRequestState),
@@ -207,6 +213,8 @@ pub enum VideoGenerationRequest {
  FalViduQ3Turbo(FalViduQ3TurboRequestState),
  GrokApiGrokImagineVideo(GrokApiGrokImagineVideoRequestState),
  GrokApiGrokImagineVideo1p5(GrokApiGrokImagineVideo1p5RequestState),
+  KinoviWan3p0(KinoviWan3p0RequestState),
+  KinoviWan3p0Prime(KinoviWan3p0RequestState),
  KinoviHappyHorse1p0(KinoviHappyHorse1p0RequestState),
  KinoviSeedance2p0(KinoviSeedance2p0RequestState),
  KinoviSeedance2p0Fast(KinoviSeedance2p0FastRequestState),
@@ -221,6 +229,8 @@ impl VideoGenerationRequest {
    match self {
      Self::ArtcraftGrokImagineVideo(_) => RouterProvider::Artcraft,
      Self::ArtcraftGrokImagineVideo1p5(_) => RouterProvider::Artcraft,
+      Self::ArtcraftWan3p0(_) => RouterProvider::Artcraft,
+      Self::ArtcraftWan3p0Prime(_) => RouterProvider::Artcraft,
      Self::ArtcraftHappyHorse1p0(_) => RouterProvider::Artcraft,
      Self::ArtcraftKling16Pro(_) => RouterProvider::Artcraft,
      Self::ArtcraftKling21Master(_) => RouterProvider::Artcraft,
@@ -282,6 +292,8 @@ impl VideoGenerationRequest {
      Self::FalViduQ3Turbo(_) => RouterProvider::Fal,
      Self::GrokApiGrokImagineVideo(_) => RouterProvider::GrokApi,
      Self::GrokApiGrokImagineVideo1p5(_) => RouterProvider::GrokApi,
+      Self::KinoviWan3p0(_) => RouterProvider::KinoviWeb,
+      Self::KinoviWan3p0Prime(_) => RouterProvider::KinoviWeb,
      Self::KinoviHappyHorse1p0(_) => RouterProvider::KinoviWeb,
      Self::KinoviSeedance2p0(_) => RouterProvider::KinoviWeb,
      Self::KinoviSeedance2p0Fast(_) => RouterProvider::KinoviWeb,
@@ -296,6 +308,8 @@ impl VideoGenerationRequest {
    match self {
      VideoGenerationRequest::ArtcraftGrokImagineVideo(request) => Ok(ArtcraftGrokImagineVideoCostState::from_request(request).estimate_cost()),
      VideoGenerationRequest::ArtcraftGrokImagineVideo1p5(request) => ArtcraftGrokImagineVideo1p5CostState::from_request(request).estimate_cost(),
+      VideoGenerationRequest::ArtcraftWan3p0(state) => Ok(ArtcraftWan3p0CostState::from_request(state).estimate_cost()),
+      VideoGenerationRequest::ArtcraftWan3p0Prime(state) => Ok(ArtcraftWan3p0CostState::from_request(state).estimate_cost()),
      VideoGenerationRequest::ArtcraftHappyHorse1p0(request) => Ok(ArtcraftHappyHorse1p0CostState::from_request(request).estimate_cost()),
      VideoGenerationRequest::ArtcraftKling16Pro(request) => Ok(ArtcraftKling16ProCostState::from_request(request).estimate_cost()),
      VideoGenerationRequest::ArtcraftKling21Master(request) => Ok(ArtcraftKling21MasterCostState::from_request(request).estimate_cost()),
@@ -357,6 +371,8 @@ impl VideoGenerationRequest {
      VideoGenerationRequest::FalViduQ3Turbo(request) => Ok(FalViduQ3TurboCostState::from_request(request).estimate_cost()),
      VideoGenerationRequest::GrokApiGrokImagineVideo(request) => Ok(GrokApiGrokImagineVideoCostState::from_request(request).estimate_cost()),
      VideoGenerationRequest::GrokApiGrokImagineVideo1p5(request) => GrokApiGrokImagineVideo1p5CostState::from_request(request).estimate_cost(),
+      VideoGenerationRequest::KinoviWan3p0(state) => Ok(KinoviWan3p0CostState::from_request(state).estimate_cost()),
+      VideoGenerationRequest::KinoviWan3p0Prime(state) => Ok(KinoviWan3p0CostState::from_request(state).estimate_cost()),
      VideoGenerationRequest::KinoviHappyHorse1p0(request) => Ok(KinoviHappyHorse1p0CostState::from_request(request).estimate_cost()),
      VideoGenerationRequest::KinoviSeedance2p0(request) => Ok(KinoviSeedance2p0CostState::from_request(request).estimate_cost()),
      VideoGenerationRequest::KinoviSeedance2p0Fast(request) => Ok(KinoviSeedance2p0FastCostState::from_request(request).estimate_cost()),
@@ -378,6 +394,12 @@ impl VideoGenerationRequest {
        let client_ref = client.get_artcraft_client_ref()?;
        request.send(client_ref).await
      },
+      VideoGenerationRequest::ArtcraftWan3p0(request) => {
+        request.send(client.get_artcraft_client_ref()?).await
+      },
+      VideoGenerationRequest::ArtcraftWan3p0Prime(request) => {
+        request.send(client.get_artcraft_client_ref()?).await
+      },
      VideoGenerationRequest::ArtcraftHappyHorse1p0(request) => {
        let client_ref = client.get_artcraft_client_ref()?;
        request.send(client_ref).await
@@ -622,6 +644,12 @@ impl VideoGenerationRequest {
        let client_ref = client.get_grok_api_client_ref()?;
        request.send(client_ref).await
      },
+      VideoGenerationRequest::KinoviWan3p0(request) => {
+        request.send(client.get_kinovi_web_client_ref()?).await
+      },
+      VideoGenerationRequest::KinoviWan3p0Prime(request) => {
+        request.send(client.get_kinovi_web_client_ref()?).await
+      },
      VideoGenerationRequest::KinoviHappyHorse1p0(request) => {
        let client_ref = client.get_kinovi_web_client_ref()?;
        request.send(client_ref).await
@@ -243,3 +243,53 @@ pub(super) fn invalid_field(field: &'static str, value: impl ToString, reason: i
  }
  .into()
 }
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  const FLOAT_TOLERANCE: f64 = 1e-9;
+
+  #[test]
+  fn regular_and_prime_credit_prices_match_the_promotion() {
+    let cases: &[(Wan3p0Model, KinoviWan3p0OutputResolution, u8, f64)] = &[
+      (Wan3p0Model::TextToVideo, KinoviWan3p0OutputResolution::FourEightyP, 2, 19.96),
+      (Wan3p0Model::ImageToVideo, KinoviWan3p0OutputResolution::SevenTwentyP, 5, 99.8),
+      (Wan3p0Model::RefToVideo, KinoviWan3p0OutputResolution::TenEightyP, 10, 399.1),
+      (Wan3p0Model::PrimeTextToVideo, KinoviWan3p0OutputResolution::FourEightyP, 2, 37.72),
+      (Wan3p0Model::PrimeImageToVideo, KinoviWan3p0OutputResolution::SevenTwentyP, 5, 194.15),
+      (Wan3p0Model::PrimeRefToVideo, KinoviWan3p0OutputResolution::TenEightyP, 10, 776.6),
+    ];
+    for (model, resolution, duration, credits) in cases {
+      let enterprise = model.calculate_costs(Some(*resolution), *duration, KinoviPricingTier::Enterprise);
+      let consumer = model.calculate_costs(Some(*resolution), *duration, KinoviPricingTier::Consumer);
+      assert!((enterprise.kinovi_credits - credits).abs() < FLOAT_TOLERANCE);
+      assert!((consumer.kinovi_credits - credits).abs() < FLOAT_TOLERANCE);
+      assert!(consumer.usd_cents_fractional > enterprise.usd_cents_fractional);
+    }
+  }
+
+  #[test]
+  fn all_wan_modalities_scale_linearly_with_duration() {
+    for model in [
+      Wan3p0Model::TextToVideo,
+      Wan3p0Model::ImageToVideo,
+      Wan3p0Model::RefToVideo,
+      Wan3p0Model::PrimeTextToVideo,
+      Wan3p0Model::PrimeImageToVideo,
+      Wan3p0Model::PrimeRefToVideo,
+    ] {
+      let two_seconds = model.calculate_costs(
+        Some(KinoviWan3p0OutputResolution::SevenTwentyP),
+        2,
+        KinoviPricingTier::Enterprise,
+      );
+      let ten_seconds = model.calculate_costs(
+        Some(KinoviWan3p0OutputResolution::SevenTwentyP),
+        10,
+        KinoviPricingTier::Enterprise,
+      );
+      assert!((ten_seconds.kinovi_credits - two_seconds.kinovi_credits * 5.0).abs() < FLOAT_TOLERANCE);
+    }
+  }
+}
@@ -13,9 +13,25 @@ cargo run -p support-tool -- kinovi_web generate_video --prompt "A corgi at the

 Requires a `.env-support-tool-secrets` file (or env vars) with:

- `SEEDANCE2PRO_COOKIES` — session cookies for Kinovi/KinoviWeb API auth
+- `SEEDANCE2PRO_VOLCENGINE_COOKIES` — Volcengine cookies (legacy fallback: `SEEDANCE2PRO_COOKIES`)
+- `SEEDANCE2PRO_BYTEPLUS_COOKIES` — BytePlus cookies (legacy fallback: `SEEDANCE2PRO_ALT_COOKIES`)
+- `SEEDANCE2PRO_BYTEPLUS_ULTRA_COOKIES` — BytePlus Ultra cookies
 - `ARTCRAFT_COOKIES` — session cookies for ArtCraft API auth (format: `session=...; visitor=...`)

+All `kinovi_web` commands (also available as `kinovi` / `seedance2pro`) accept
+`--kinovi-account volcengine|byteplus|byteplusultra`, defaulting to `volcengine`.
+Use `--cookies-env ENV_VAR_NAME` to explicitly override that account's cookie
+configuration. The override has no default; when omitted, only the selected
+account's variables and its legacy fallback are checked. Either flag can appear
+before or after the subcommand. CSV account labels default to the resolved cookie
+env var name; `--account` still overrides the output label.
+
+```bash
+support-tool kinovi_web account_info --kinovi-account byteplus
+support-tool seedance2pro find_job --token <order_id> --kinovi-account byteplusultra
+support-tool kinovi_web account_info --kinovi-account byteplus --cookies-env CUSTOM_COOKIES
+```
+
 ## Architecture

 - Entry point: `src/main.rs` → normalizes args (underscores optional) → dispatches
@@ -0,0 +1,20 @@
+use clap::ValueEnum;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, ValueEnum)]
+#[value(rename_all = "lowercase")]
+pub enum KinoviAccount {
+  Volcengine,
+  BytePlus,
+  BytePlusUltra,
+}
+
+impl KinoviAccount {
+  /// Cookie configuration and legacy fallbacks used by seedance2-pro-job.
+  pub fn cookie_env_vars(self) -> &'static [&'static str] {
+    match self {
+      Self::Volcengine => &["SEEDANCE2PRO_VOLCENGINE_COOKIES", "SEEDANCE2PRO_COOKIES"],
+      Self::BytePlus => &["SEEDANCE2PRO_BYTEPLUS_COOKIES", "SEEDANCE2PRO_ALT_COOKIES"],
+      Self::BytePlusUltra => &["SEEDANCE2PRO_BYTEPLUS_ULTRA_COOKIES"],
+    }
+  }
+}
@@ -1,6 +1,6 @@
-use anyhow::anyhow;
-use clap::Subcommand;
+use clap::{Args, Subcommand};

+use super::account::KinoviAccount;
 use super::state::KinoviWebState;
 use super::subcommands;

@@ -16,6 +16,20 @@ pub const SUBCOMMAND_NAMES: &[&str] = &[
  "generate_video",
 ];

+#[derive(Args)]
+pub struct KinoviWebArgs {
+  /// Kinovi account whose cookie configuration to use.
+  #[arg(long, global = true, value_enum, ignore_case = true, default_value = "volcengine")]
+  pub kinovi_account: KinoviAccount,
+
+  /// Read cookies from this env var, overriding --kinovi-account only when supplied.
+  #[arg(long = "cookies-env", global = true, value_name = "ENV_VAR_NAME")]
+  pub maybe_cookies_env: Option<String>,
+
+  #[command(subcommand)]
+  pub command: KinoviWebCommand,
+}
+
 #[derive(Subcommand)]
 #[command(rename_all = "snake_case")]
 pub enum KinoviWebCommand {
@@ -44,13 +58,10 @@ pub enum KinoviWebCommand {
  GenerateVideo(subcommands::generate_video::GenerateVideoArgs),
 }

-pub async fn run(command: KinoviWebCommand) -> anyhow::Result<()> {
-  let cookies = easyenv::get_env_string_required("SEEDANCE2PRO_COOKIES")
-    .map_err(|err| anyhow!("Missing SEEDANCE2PRO_COOKIES env var: {:?}", err))?;
+pub async fn run(args: KinoviWebArgs) -> anyhow::Result<()> {
+  let state = KinoviWebState::from_env(args.kinovi_account, args.maybe_cookies_env.as_deref())?;

-  let state = KinoviWebState { cookies };
-
-  match command {
+  match args.command {
    KinoviWebCommand::AccountInfo(args) => subcommands::account_info::run(&state, args).await,
    KinoviWebCommand::AuditCredits(args) => subcommands::audit_credits::run(&state, args).await,
    KinoviWebCommand::AuditOrders(args) => subcommands::audit_orders::run(&state, args).await,
@@ -60,3 +71,85 @@ pub async fn run(command: KinoviWebCommand) -> anyhow::Result<()> {
    KinoviWebCommand::GenerateVideo(args) => subcommands::generate_video::run(&state, args).await,
  }
 }
+
+#[cfg(test)]
+mod tests {
+  use clap::{error::ErrorKind, Parser};
+
+  use super::*;
+  use crate::commands::run::{all_canonical_names, Cli, TopLevelCommand};
+  use crate::utils::normalize_subcommands::normalize_subcommand_args;
+
+  const COMMANDS: &[&[&str]] = &[
+    &["account_info"],
+    &["audit_credits", "--out", "/tmp/credits.csv"],
+    &["audit_orders", "--out", "/tmp/orders.csv"],
+    &["audit_payments", "--out", "/tmp/payments.csv"],
+    &["find_job", "--token", "test-order"],
+    &["failed_job_histogram"],
+    &["generate_video", "--prompt", "A corgi at the lake"],
+  ];
+
+  mod cli_parsing {
+    use super::*;
+
+    #[test]
+    fn every_command_defaults_to_volcengine_without_a_cookie_override() {
+      for command in COMMANDS {
+        let args = parse_kinovi(command);
+        assert_eq!(args.kinovi_account, KinoviAccount::Volcengine);
+        assert!(args.maybe_cookies_env.is_none());
+      }
+    }
+
+    #[test]
+    fn every_command_accepts_all_accounts_and_cookie_overrides_before_or_after_subcommand() {
+      for (value, account) in [
+        ("volcengine", KinoviAccount::Volcengine),
+        ("byteplus", KinoviAccount::BytePlus),
+        ("byteplusultra", KinoviAccount::BytePlusUltra),
+      ] {
+        for command in COMMANDS {
+          let flags = ["--kinovi-account", value, "--cookies-env", "CUSTOM_COOKIES"];
+          for args in [
+            [flags.as_slice(), *command].concat(),
+            [*command, flags.as_slice()].concat(),
+          ] {
+            let args = parse_kinovi(&args);
+            assert_eq!(args.kinovi_account, account);
+            assert_eq!(args.maybe_cookies_env.as_deref(), Some("CUSTOM_COOKIES"));
+          }
+        }
+      }
+    }
+
+    #[test]
+    fn aliases_and_underscore_normalization_preserve_account_selection() {
+      for alias in ["kinovi_web", "kinoviweb", "kinovi", "seedance2pro", "seedance2_pro"] {
+        let args = ["support-tool", alias, "accountinfo", "--kinovi-account", "BYTEPLUSULTRA"];
+        let args = normalize_subcommand_args(args.map(String::from), &all_canonical_names());
+        let cli = Cli::try_parse_from(args).unwrap();
+        let TopLevelCommand::KinoviWeb(args) = cli.command else {
+          panic!("expected Kinovi command");
+        };
+        assert_eq!(args.kinovi_account, KinoviAccount::BytePlusUltra);
+      }
+    }
+
+    #[test]
+    fn rejects_unknown_accounts() {
+      let err = Cli::try_parse_from([
+        "support-tool", "kinovi_web", "account_info", "--kinovi-account", "unknown",
+      ]).err().expect("unknown accounts should be rejected");
+      assert_eq!(err.kind(), ErrorKind::InvalidValue);
+    }
+  }
+
+  fn parse_kinovi(args: &[&str]) -> KinoviWebArgs {
+    let cli = Cli::try_parse_from([&["support-tool", "kinovi_web"], args].concat()).unwrap();
+    match cli.command {
+      TopLevelCommand::KinoviWeb(args) => args,
+      _ => panic!("expected Kinovi command"),
+    }
+  }
+}
@@ -1,6 +1,7 @@
+mod account;
 pub mod dispatch;
 mod state;
 mod subcommands;

-pub use dispatch::KinoviWebCommand;
+pub use dispatch::KinoviWebArgs;
 pub use dispatch::run;
@@ -1,3 +1,131 @@
+use anyhow::anyhow;
+
+use super::account::KinoviAccount;
+
 pub struct KinoviWebState {
  pub cookies: String,
+  pub cookies_env: String,
+}
+
+impl KinoviWebState {
+  pub fn from_env(account: KinoviAccount, maybe_cookies_env: Option<&str>) -> anyhow::Result<Self> {
+    Self::from_env_lookup(account, maybe_cookies_env, easyenv::get_env_string_optional)
+  }
+
+  fn from_env_lookup(
+    account: KinoviAccount,
+    maybe_cookies_env: Option<&str>,
+    mut lookup: impl FnMut(&str) -> Option<String>,
+  ) -> anyhow::Result<Self> {
+    // An explicit override must resolve on its own, without requiring or falling
+    // back to credentials for the selected account.
+    let override_vars;
+    let cookie_env_vars = match maybe_cookies_env {
+      Some(var) => {
+        override_vars = [var];
+        &override_vars[..]
+      },
+      None => account.cookie_env_vars(),
+    };
+
+    for &var in cookie_env_vars {
+      if let Some(cookies) = lookup(var) {
+        return Ok(Self {
+          cookies,
+          cookies_env: var.to_string(),
+        });
+      }
+    }
+
+    Err(anyhow!("Missing Kinovi cookies: set {}", cookie_env_vars.join(" or ")))
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  const COOKIES: &[(&str, &str)] = &[
+    ("SEEDANCE2PRO_VOLCENGINE_COOKIES", "volcengine-cookies"),
+    ("SEEDANCE2PRO_BYTEPLUS_COOKIES", "byteplus-cookies"),
+    ("SEEDANCE2PRO_BYTEPLUS_ULTRA_COOKIES", "ultra-cookies"),
+    ("SEEDANCE2PRO_COOKIES", "legacy-cookies"),
+    ("SEEDANCE2PRO_ALT_COOKIES", "legacy-alt-cookies"),
+    ("CUSTOM_COOKIES", "override-cookies"),
+  ];
+
+  mod account_selection {
+    use super::*;
+
+    #[test]
+    fn selects_each_account_even_when_legacy_cookies_are_set() {
+      for (account, var, cookies) in [
+        (KinoviAccount::Volcengine, "SEEDANCE2PRO_VOLCENGINE_COOKIES", "volcengine-cookies"),
+        (KinoviAccount::BytePlus, "SEEDANCE2PRO_BYTEPLUS_COOKIES", "byteplus-cookies"),
+        (KinoviAccount::BytePlusUltra, "SEEDANCE2PRO_BYTEPLUS_ULTRA_COOKIES", "ultra-cookies"),
+      ] {
+        for env in [COOKIES, &[(var, cookies)]] {
+          let state = resolve(account, None, env).unwrap();
+          assert_eq!(state.cookies, cookies);
+          assert_eq!(state.cookies_env, var);
+        }
+      }
+    }
+
+    #[test]
+    fn falls_back_to_the_matching_legacy_variable() {
+      let env = &COOKIES[3..5];
+      for (account, var, cookies) in [
+        (KinoviAccount::Volcengine, "SEEDANCE2PRO_COOKIES", "legacy-cookies"),
+        (KinoviAccount::BytePlus, "SEEDANCE2PRO_ALT_COOKIES", "legacy-alt-cookies"),
+      ] {
+        let state = resolve(account, None, env).unwrap();
+        assert_eq!(state.cookies, cookies);
+        assert_eq!(state.cookies_env, var);
+      }
+    }
+
+    #[test]
+    fn missing_account_cookies_never_use_another_accounts_credentials() {
+      for (account, expected_var) in [
+        (KinoviAccount::BytePlus, "SEEDANCE2PRO_BYTEPLUS_COOKIES"),
+        (KinoviAccount::BytePlusUltra, "SEEDANCE2PRO_BYTEPLUS_ULTRA_COOKIES"),
+      ] {
+        let err = resolve(account, None, &COOKIES[3..4]).err().expect("account cookies are missing");
+        assert!(err.to_string().contains(expected_var));
+      }
+    }
+  }
+
+  mod cookie_overrides {
+    use super::*;
+
+    #[test]
+    fn explicit_override_wins_with_or_without_account_cookies() {
+      for account in [KinoviAccount::Volcengine, KinoviAccount::BytePlus, KinoviAccount::BytePlusUltra] {
+        for env in [COOKIES, &COOKIES[5..]] {
+          let state = resolve(account, Some("CUSTOM_COOKIES"), env).unwrap();
+          assert_eq!(state.cookies, "override-cookies");
+          assert_eq!(state.cookies_env, "CUSTOM_COOKIES");
+        }
+      }
+    }
+
+    #[test]
+    fn missing_explicit_override_errors_instead_of_using_account_cookies() {
+      let err = resolve(KinoviAccount::Volcengine, Some("MISSING_COOKIES"), COOKIES)
+        .err().expect("explicit override must exist");
+      assert_eq!(err.to_string(), "Missing Kinovi cookies: set MISSING_COOKIES");
+    }
+  }
+
+  fn resolve(
+    account: KinoviAccount,
+    maybe_override: Option<&str>,
+    env: &[(&str, &str)],
+  ) -> anyhow::Result<KinoviWebState> {
+    KinoviWebState::from_env_lookup(account, maybe_override, |var| {
+      env.iter().find(|(name, _)| *name == var).map(|(_, value)| value.to_string())
+    })
+  }
 }
@@ -11,28 +11,14 @@ use super::super::state::KinoviWebState;
 /// single CSV line: account,email,credits,available_credits.
 #[derive(Args)]
 pub struct AccountInfoArgs {
-  /// Read session cookies from this env var instead of SEEDANCE2PRO_COOKIES.
-  #[arg(long)]
-  pub cookies_env: Option<String>,
-
  /// Account label for the output line. Defaults to the cookies env var name.
  #[arg(long)]
  pub account: Option<String>,
 }

 pub async fn run(state: &KinoviWebState, args: AccountInfoArgs) -> anyhow::Result<()> {
-  let (cookies, account_label) = match &args.cookies_env {
-    Some(var) => (
-      easyenv::get_env_string_required(var)
-        .map_err(|err| anyhow!("Missing {} env var: {:?}", var, err))?,
-      args.account.clone().unwrap_or_else(|| var.clone()),
-    ),
-    None => (
-      state.cookies.clone(),
-      args.account.clone().unwrap_or_else(|| "SEEDANCE2PRO_COOKIES".to_string()),
-    ),
-  };
-  let session = KinoviWebSession::from_cookies_string(cookies);
+  let account_label = args.account.as_deref().unwrap_or(&state.cookies_env);
+  let session = KinoviWebSession::from_cookies_string(state.cookies.clone());

  let details = get_user_auth_details(GetUserAuthDetailsArgs {
    session: &session,
@@ -44,10 +44,6 @@ pub struct AuditCreditsArgs {
  #[arg(long, default_value_t = 250)]
  pub delay_ms: u64,

-  /// Read session cookies from this env var instead of SEEDANCE2PRO_COOKIES.
-  #[arg(long)]
-  pub cookies_env: Option<String>,
-
  /// Account label written into each CSV row. Defaults to the cookies env
  /// var name.
  #[arg(long)]
@@ -55,18 +51,8 @@ pub struct AuditCreditsArgs {
 }

 pub async fn run(state: &KinoviWebState, args: AuditCreditsArgs) -> anyhow::Result<()> {
-  let (cookies, account_label) = match &args.cookies_env {
-    Some(var) => (
-      easyenv::get_env_string_required(var)
-        .map_err(|err| anyhow!("Missing {} env var: {:?}", var, err))?,
-      args.account.clone().unwrap_or_else(|| var.clone()),
-    ),
-    None => (
-      state.cookies.clone(),
-      args.account.clone().unwrap_or_else(|| "SEEDANCE2PRO_COOKIES".to_string()),
-    ),
-  };
-  let session = KinoviWebSession::from_cookies_string(cookies);
+  let account_label = args.account.as_deref().unwrap_or(&state.cookies_env);
+  let session = KinoviWebSession::from_cookies_string(state.cookies.clone());

  let file_is_new = std::fs::metadata(&args.out).map(|m| m.len() == 0).unwrap_or(true);
  let mut out = OpenOptions::new().create(true).append(true).open(&args.out)
@@ -101,7 +87,7 @@ pub async fn run(state: &KinoviWebState, args: AuditCreditsArgs) -> anyhow::Resu
    let oldest_day = page.entries.last().map(|e| day_of(e)).unwrap_or_default();

    for entry in &page.entries {
-      write_entry_row(&mut out, &account_label, entry)?;
+      write_entry_row(&mut out, account_label, entry)?;
      rows += 1;
      let tally = type_tallies.entry(entry.entry_type.as_str().to_string()).or_insert((0, 0));
      tally.0 += 1;
@@ -43,31 +43,15 @@ pub struct AuditOrdersArgs {
  #[arg(long, default_value_t = 250)]
  pub delay_ms: u64,

-  /// Read session cookies from this env var instead of SEEDANCE2PRO_COOKIES
-  /// (e.g. SEEDANCE2PRO_VOLCENGINE_COOKIES / SEEDANCE2PRO_BYTEPLUS_COOKIES /
-  /// SEEDANCE2PRO_BYTEPLUS_ULTRA_COOKIES to audit each Kinovi account).
-  #[arg(long)]
-  pub cookies_env: Option<String>,
-
  /// Account label written into each CSV row. Defaults to the cookies env
-  /// var name (or "SEEDANCE2PRO_COOKIES").
+  /// var name.
  #[arg(long)]
  pub account: Option<String>,
 }

 pub async fn run(state: &KinoviWebState, args: AuditOrdersArgs) -> anyhow::Result<()> {
-  let (cookies, account_label) = match &args.cookies_env {
-    Some(var) => (
-      easyenv::get_env_string_required(var)
-        .map_err(|err| anyhow!("Missing {} env var: {:?}", var, err))?,
-      args.account.clone().unwrap_or_else(|| var.clone()),
-    ),
-    None => (
-      state.cookies.clone(),
-      args.account.clone().unwrap_or_else(|| "SEEDANCE2PRO_COOKIES".to_string()),
-    ),
-  };
-  let session = KinoviWebSession::from_cookies_string(cookies);
+  let account_label = args.account.as_deref().unwrap_or(&state.cookies_env);
+  let session = KinoviWebSession::from_cookies_string(state.cookies.clone());

  let file_is_new = std::fs::metadata(&args.out).map(|m| m.len() == 0).unwrap_or(true);
  let mut out = OpenOptions::new().create(true).append(true).open(&args.out)
@@ -106,7 +90,7 @@ pub async fn run(state: &KinoviWebState, args: AuditOrdersArgs) -> anyhow::Resul
        stats.skipped_before_window += 1;
        continue;
      }
-      write_order_row(&mut out, &account_label, order)?;
+      write_order_row(&mut out, account_label, order)?;
      stats.record(order);
    }
    out.flush()?;
@@ -133,7 +117,7 @@ pub async fn run(state: &KinoviWebState, args: AuditOrdersArgs) -> anyhow::Resul
    tokio::time::sleep(Duration::from_millis(args.delay_ms)).await;
  }

-  stats.print_summary(&account_label, cursor);
+  stats.print_summary(account_label, cursor);
  Ok(())
 }

@@ -29,10 +29,6 @@ pub struct AuditPaymentsArgs {
  #[arg(long, default_value_t = 250)]
  pub delay_ms: u64,

-  /// Read session cookies from this env var instead of SEEDANCE2PRO_COOKIES.
-  #[arg(long)]
-  pub cookies_env: Option<String>,
-
  /// Account label written into each CSV row. Defaults to the cookies env
  /// var name.
  #[arg(long)]
@@ -40,18 +36,8 @@ pub struct AuditPaymentsArgs {
 }

 pub async fn run(state: &KinoviWebState, args: AuditPaymentsArgs) -> anyhow::Result<()> {
-  let (cookies, account_label) = match &args.cookies_env {
-    Some(var) => (
-      easyenv::get_env_string_required(var)
-        .map_err(|err| anyhow!("Missing {} env var: {:?}", var, err))?,
-      args.account.clone().unwrap_or_else(|| var.clone()),
-    ),
-    None => (
-      state.cookies.clone(),
-      args.account.clone().unwrap_or_else(|| "SEEDANCE2PRO_COOKIES".to_string()),
-    ),
-  };
-  let session = KinoviWebSession::from_cookies_string(cookies);
+  let account_label = args.account.as_deref().unwrap_or(&state.cookies_env);
+  let session = KinoviWebSession::from_cookies_string(state.cookies.clone());

  let file_is_new = std::fs::metadata(&args.out).map(|m| m.len() == 0).unwrap_or(true);
  let mut out = OpenOptions::new().create(true).append(true).open(&args.out)
@@ -82,7 +68,7 @@ pub async fn run(state: &KinoviWebState, args: AuditPaymentsArgs) -> anyhow::Res
    }

    for payment in &page.payments {
-      write_payment_row(&mut out, &account_label, payment)?;
+      write_payment_row(&mut out, account_label, payment)?;
      rows += 1;
      total_amount += payment.amount_usd;
      total_credits += payment.credits_earned;
@@ -6,7 +6,7 @@ use super::kinovi_web;
 /// All canonical subcommand names across all modules.
 /// Used by the underscore-insensitive arg normalizer.
 pub fn all_canonical_names() -> Vec<&'static str> {
-  let mut names: Vec<&str> = vec!["kinovi_web", "artcraft"];
+  let mut names: Vec<&str> = vec!["kinovi_web", "kinovi", "seedance2pro", "artcraft"];
  names.extend_from_slice(kinovi_web::dispatch::SUBCOMMAND_NAMES);
  names.extend_from_slice(artcraft::dispatch::SUBCOMMAND_NAMES);
  names
@@ -23,10 +23,8 @@ pub struct Cli {
 #[command(rename_all = "snake_case")]
 pub enum TopLevelCommand {
  /// Seedance2 Pro support commands (direct Kinovi API)
-  KinoviWeb {
-    #[command(subcommand)]
-    command: kinovi_web::KinoviWebCommand,
-  },
+  #[command(visible_aliases = ["kinovi", "seedance2pro"])]
+  KinoviWeb(kinovi_web::KinoviWebArgs),

  /// ArtCraft support commands (omni API)
  Artcraft(artcraft::dispatch::ArtcraftArgs),
@@ -34,8 +32,8 @@ pub enum TopLevelCommand {

 pub async fn run(cli: Cli) -> anyhow::Result<()> {
  match cli.command {
-    TopLevelCommand::KinoviWeb { command } => {
-      kinovi_web::run(command).await
+    TopLevelCommand::KinoviWeb(args) => {
+      kinovi_web::run(args).await
    }
    TopLevelCommand::Artcraft(args) => {
      artcraft::dispatch(args).await
@@ -1,11 +1,11 @@
-use anyhow::bail;
-use log::{error, info};
-use std::io::Write;
+use log::info;
 use std::path::Path;
 use std::process::Command;

 use errors::AnyhowResult;

+use crate::ffmpeg::run_thumbnail_ffmpeg::run_thumbnail_ffmpeg;
+
 pub struct FfmpegVideoFirstFrameToJpgThumbnailArgs<I: AsRef<Path>, O: AsRef<Path>> {
  pub input_video_path: I,
  pub output_jpg_path: O,
@@ -24,26 +24,20 @@ pub fn ffmpeg_video_first_frame_to_jpg_thumbnail<I: AsRef<Path>, O: AsRef<Path>>
  command
      .arg("-nostdin")
      .arg("-y")
+      .arg("-loglevel").arg("error")
+      .arg("-nostats")
+      .arg("-threads").arg("1")
+      .arg("-filter_threads").arg("1")
      .arg("-sseof").arg("-1")
      .arg("-i").arg(args.input_video_path.as_ref())
+      .arg("-threads").arg("1")
      .arg("-vf").arg("scale=320:320:force_original_aspect_ratio=decrease")
      .arg("-vframes").arg("1")
      .arg(args.output_jpg_path.as_ref());

  info!("Calling ffmpeg (jpg thumbnail)...");

-  let output = command.output()?;
-
-  if !output.status.success() {
-    error!("bad exit status: {}", output.status);
-
-    let _r = std::io::stdout().write_all(&output.stdout);
-    let _r = std::io::stderr().write_all(&output.stderr);
-
-    bail!("ffmpeg jpg thumbnail failed: {:?}", output.status.to_string());
-  }
-
-  Ok(())
+  run_thumbnail_ffmpeg(command)
 }

 #[cfg(test)]
@@ -1,11 +1,11 @@
-use anyhow::bail;
-use log::{error, info};
-use std::io::Write;
+use log::info;
 use std::path::Path;
 use std::process::Command;

 use errors::AnyhowResult;

+use crate::ffmpeg::run_thumbnail_ffmpeg::run_thumbnail_ffmpeg;
+
 pub struct FfmpegVideoGifPreviewArgs<I: AsRef<Path>, O: AsRef<Path>> {
  pub input_video_path: I,
  pub output_gif_path: O,
@@ -13,7 +13,7 @@ pub struct FfmpegVideoGifPreviewArgs<I: AsRef<Path>, O: AsRef<Path>> {

 /// Extract a short animated GIF preview from a video file.
 ///
-/// Takes the first 5 seconds, resampled to 10 fps, scaled to 360px wide
+/// Takes the first 5 seconds, resampled to 10 fps, scaled to fit within 360x360
 /// (preserving aspect ratio), with an optimized color palette.
 pub fn ffmpeg_video_gif_preview<I: AsRef<Path>, O: AsRef<Path>>(
  args: FfmpegVideoGifPreviewArgs<I, O>,
@@ -23,27 +23,22 @@ pub fn ffmpeg_video_gif_preview<I: AsRef<Path>, O: AsRef<Path>>(
  command
      .arg("-nostdin")
      .arg("-y")
+      .arg("-loglevel").arg("error")
+      .arg("-nostats")
+      .arg("-threads").arg("1")
+      .arg("-filter_complex_threads").arg("1")
      .arg("-ss").arg("0")
      .arg("-to").arg("5")
      .arg("-i").arg(args.input_video_path.as_ref())
+      .arg("-threads").arg("1")
      .arg("-filter_complex")
-      .arg("fps=10,scale=360:-1[s]; [s]split[a][b]; [a]palettegen[palette]; [b][palette]paletteuse")
+      .arg("fps=10,scale=360:360:force_original_aspect_ratio=decrease[s]; [s]split[a][b]; [a]palettegen[palette]; [b][palette]paletteuse")
+      .arg("-frames:v").arg("50")
      .arg(args.output_gif_path.as_ref());

  info!("Calling ffmpeg (gif preview)...");

-  let output = command.output()?;
-
-  if !output.status.success() {
-    error!("bad exit status: {}", output.status);
-
-    let _r = std::io::stdout().write_all(&output.stdout);
-    let _r = std::io::stderr().write_all(&output.stderr);
-
-    bail!("ffmpeg gif preview failed: {:?}", output.status.to_string());
-  }
-
-  Ok(())
+  run_thumbnail_ffmpeg(command)
 }

 #[cfg(test)]
@@ -69,7 +64,7 @@ mod tests {

    assert!(output_path.exists(), "output gif should exist");

-    // The input video is 640x480. scale=360:-1 should produce 360x270
+    // The input video is 640x480. Fitting within 360x360 should produce 360x270
    // (maintaining 4:3 aspect ratio).
    // Use ffprobe to verify the GIF dimensions.
    let result = ffprobe::ffprobe(&output_path)
@@ -82,4 +77,30 @@ mod tests {
    assert_eq!(video_stream.width, Some(360));
    assert_eq!(video_stream.height, Some(270));
  }
+
+  #[test]
+  fn test_tall_video_preview_has_bounded_dimensions_and_frame_count() {
+    let temp_dir = TempDir::new_in("/tmp", "ffmpeg_tall_gif_test").unwrap();
+    let input = temp_dir.path().join("tall.mp4");
+    let output = temp_dir.path().join("preview.gif");
+    let status = Command::new("ffmpeg")
+      .args(["-nostdin", "-y", "-loglevel", "error", "-f", "lavfi", "-i", "testsrc2=size=32x640:rate=10", "-t", "6", "-threads", "1"])
+      .arg(&input)
+      .status().unwrap();
+    assert!(status.success());
+
+    ffmpeg_video_gif_preview(FfmpegVideoGifPreviewArgs {
+      input_video_path: &input,
+      output_gif_path: &output,
+    }).unwrap();
+    let probe = Command::new("ffprobe")
+      .args(["-v", "error", "-count_frames", "-select_streams", "v:0", "-show_entries", "stream=width,height,nb_read_frames", "-of", "csv=p=0"])
+      .arg(&output)
+      .output().unwrap();
+    assert!(probe.status.success());
+    let values: Vec<u32> = std::str::from_utf8(&probe.stdout).unwrap().trim()
+      .split(',').map(|value| value.parse().unwrap()).collect();
+    assert_eq!(&values[..2], &[18, 360]);
+    assert!(values[2] > 0 && values[2] <= 50);
+  }
 }
@@ -3,3 +3,4 @@ pub mod ffmpeg_transcode_to_mp4;
 pub mod ffmpeg_trim_and_resample;
 pub mod ffmpeg_video_first_frame_to_jpg_thumbnail;
 pub mod ffmpeg_video_gif_preview;
+mod run_thumbnail_ffmpeg;
@@ -0,0 +1,75 @@
+use std::io::{Read, Seek, SeekFrom};
+use std::process::{Child, Command, ExitStatus, Stdio};
+use std::thread;
+use std::time::{Duration, Instant};
+
+use anyhow::bail;
+use log::error;
+
+use errors::AnyhowResult;
+
+const THUMBNAIL_TIMEOUT: Duration = Duration::from_secs(60);
+const MAX_ERROR_LOG_BYTES: u64 = 16 * 1024;
+
+/// Synchronous: callers in async runtimes must use spawn_blocking. A timeout
+/// kills and reaps FFmpeg before returning, so it cannot outlive its job slot.
+pub(super) fn run_thumbnail_ffmpeg(mut command: Command) -> AnyhowResult<()> {
+  // Avoid holding arbitrarily large FFmpeg stderr output in the Rust heap.
+  let mut stderr = tempfile::tempfile()?;
+  let mut child = command.stdout(Stdio::null()).stderr(Stdio::from(stderr.try_clone()?)).spawn()?;
+  let result = wait_for_exit(&mut child, THUMBNAIL_TIMEOUT);
+  if !matches!(&result, Ok(status) if status.success()) {
+    let start = stderr.metadata()?.len().saturating_sub(MAX_ERROR_LOG_BYTES);
+    stderr.seek(SeekFrom::Start(start))?;
+    let mut bytes = Vec::new();
+    stderr.take(MAX_ERROR_LOG_BYTES).read_to_end(&mut bytes)?;
+    error!("Thumbnail FFmpeg failed: {:?}; stderr: {}", result, String::from_utf8_lossy(&bytes));
+  }
+  let status = result?;
+  if !status.success() {
+    bail!("thumbnail FFmpeg failed: {status}");
+  }
+  Ok(())
+}
+
+fn wait_for_exit(child: &mut Child, timeout: Duration) -> AnyhowResult<ExitStatus> {
+  let started_at = Instant::now();
+  loop {
+    match child.try_wait() {
+      Ok(Some(status)) => return Ok(status),
+      Ok(None) => {},
+      Err(err) => {
+        let _ = child.kill();
+        let _ = child.wait();
+        return Err(err.into());
+      }
+    }
+    if started_at.elapsed() >= timeout {
+      let _ = child.kill();
+      child.wait()?;
+      bail!("thumbnail FFmpeg exceeded timeout of {} seconds", timeout.as_secs_f64());
+    }
+    thread::sleep(Duration::from_millis(25));
+  }
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn timed_out_child_is_killed_and_reaped_before_returning() {
+    let mut child = Command::new("sleep").arg("10").spawn().unwrap();
+    let started_at = Instant::now();
+    let result = wait_for_exit(&mut child, Duration::from_millis(50));
+    assert!(result.unwrap_err().to_string().contains("exceeded timeout"));
+    assert!(started_at.elapsed() < Duration::from_secs(3));
+    assert!(!child.try_wait().unwrap().unwrap().success());
+  }
+
+  #[test]
+  fn reports_normal_child_exit_status() {
+    let mut child = Command::new("true").spawn().unwrap();
+    assert!(wait_for_exit(&mut child, Duration::from_secs(3)).unwrap().success());
+  }
+}
@@ -56,24 +56,72 @@ schema metadata. For **new tables**, you may need to:

 - Primary key `id` columns must be `BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT`. Do not use signed IDs.
 - Always create tables with `ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin`.
+- Do not give application-owned state/status/type columns schema defaults. Keep required
+  columns `NOT NULL` without a `DEFAULT`; application code must explicitly bind their
+  initial value on every insert. Keep migrations and materialized schema docs in sync.
+
+### Database enum values
+
+- Use the Rust enums in `enums::by_table` for database state, status, failure, and type
+  values. Do not hardcode their string representations in SQL or Rust business logic.
+- Bind enum values (or their `to_str()` representation) through SQL parameters, including
+  `SET`, `WHERE`, `IN`, and `INSERT` values. For example, bind
+  `UserLoginChallengeStatus::Approved.to_str()` to `status = ?`.
+- Query args and returned rows must use the enum type rather than `String`/`&str` for
+  enum columns. Use SQLx column type overrides and the enum's MySQL decoder on reads;
+  use exhaustive variant matches in application logic. Preserve existing stored values.

 ### Error Types

 New queries should return `Result<T, sqlx::Error>` instead of the legacy `AnyhowResult<T>`.
 The `AnyhowResult` pattern is being phased out.

-### Transaction Support
+### Named arguments and generic transactors

-Use the executor-generic `Args` pattern for queries that need to work inside transactions:
+Every new or refactored query must take a single named `<QueryName>Args` struct containing
+all inputs, including `mysql_executor`. Do not use positional parameter lists, even for
+small queries. Keep the args struct in the same file as its query.
+
+Use a generic transactor `T` bounded by `Executor<'c, Database = MySql>`. Do not constrain
+query functions to `MySqlConnection`, `MySqlPool`, a concrete transaction, or the legacy
+`Transactor` enum. This applies to all queries, not only ones currently used in transactions.
+Put the executor bound on the function; the args struct need not carry executor lifetimes
+or `PhantomData` when it simply stores `T`.

 ```rust
-pub struct MyQueryArgs<'a, 'c: 'a, E>
-  where E: 'a + Executor<'c, Database = MySql>
-{
+use sqlx::{Executor, MySql};
+
+pub struct MyQueryArgs<'a, T> {
  pub field: &'a str,
-  pub mysql_executor: E,
-  pub phantom: PhantomData<&'c E>,
+  pub mysql_executor: T,
+}
+
+pub async fn my_query<'c, T>(args: MyQueryArgs<'_, T>) -> Result<(), sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  sqlx::query!("UPDATE my_table SET name = ?", args.field)
+    .execute(args.mysql_executor)
+    .await?;
+  Ok(())
 }
 ```

-This allows the same query function to accept both `&MySqlPool` and `&mut Transaction`.
+Call with `mysql_executor: &pool` for a pool, or `mysql_executor: &mut *tx` /
+`mysql_executor: &mut *conn` to reborrow the connection held by an owned SQLx transaction /
+pool connection. SQLx transactions do not themselves implement `Executor`; dereference
+them at the call site. Reuse the caller's transaction when atomicity or row locks matter.
+Do not acquire a new connection or begin/commit a transaction inside a query helper.
+
+### One query per file, grouped by table
+
+- Put each query in its own descriptively named `.rs` file under the table's directory
+  module, e.g. `queries/user_login_challenges/decide_challenge.rs` or the existing
+  `queries/users/user_sessions/find_redeemed_session.rs`.
+- Each query file contains one SQL statement/query function, its args struct, and any
+  result type used only by that query. Put shared result types in a separate type file.
+- Keep `mod.rs` for module declarations; do not collect SQL in it or in catch-all files
+  such as `challenge_queries.rs` or `session_queries.rs`.
+- Split multi-query operations into individual query files. Keep transaction sequencing
+  and business decisions in the caller/service layer, with every statement using the
+  same transaction when required.
@@ -27,6 +27,11 @@ pub struct VideoMediaFileWithoutThumbnail {
  pub id: i64,
  pub token: MediaFileToken,
  pub created_at: DateTime<Utc>,
+  /// Database statement-start time, shared by every row in this page.
+  pub database_read_at: DateTime<Utc>,
+  /// Our job's successful finalization time, not the provider's completion time.
+  /// Uploads, legacy records, and jobs still being finalized can have no timestamp.
+  pub maybe_generation_completed_at: Option<DateTime<Utc>>,
  pub maybe_thumbnail_version: Option<u8>,
  pub public_bucket_directory_hash: String,
  pub maybe_public_bucket_prefix: Option<String>,
@@ -51,22 +56,25 @@ pub async fn list_video_media_files_without_thumbnails_for_job<'e, 'c, E>(
    VideoMediaFileWithoutThumbnail,
    r#"
 SELECT
-    id,
-    token as `token: MediaFileToken`,
-    created_at as `created_at: DateTime<Utc>`,
-    maybe_thumbnail_version as `maybe_thumbnail_version: u8`,
-    public_bucket_directory_hash,
-    maybe_public_bucket_prefix,
-    maybe_public_bucket_extension
-FROM media_files
+    media.id,
+    media.token as `token: MediaFileToken`,
+    media.created_at as `created_at: DateTime<Utc>`,
+    NOW(6) as `database_read_at!: DateTime<Utc>`,
+    jobs.successfully_completed_at as `maybe_generation_completed_at?: DateTime<Utc>`,
+    media.maybe_thumbnail_version as `maybe_thumbnail_version: u8`,
+    media.public_bucket_directory_hash,
+    media.maybe_public_bucket_prefix,
+    media.maybe_public_bucket_extension
+FROM media_files AS media
+LEFT JOIN generic_inference_jobs AS jobs ON jobs.token = media.maybe_source_job_token
 WHERE
-    id >= (SELECT COALESCE(MIN(id), 0) FROM media_files WHERE created_at >= NOW() - INTERVAL ? HOUR)
-    AND id < ?
-    AND media_class = ?
-    AND maybe_thumbnail_version IS NULL
-    AND user_deleted_at IS NULL
-    AND mod_deleted_at IS NULL
-ORDER BY id DESC
+    media.id >= (SELECT COALESCE(MIN(id), 0) FROM media_files WHERE created_at >= NOW() - INTERVAL ? HOUR)
+    AND media.id < ?
+    AND media.media_class = ?
+    AND media.maybe_thumbnail_version IS NULL
+    AND media.user_deleted_at IS NULL
+    AND media.mod_deleted_at IS NULL
+ORDER BY media.id DESC
 LIMIT ?
    "#,
    max_lookback_hours,
@@ -41,6 +41,7 @@ pub mod unsubscribe_reason;
 pub mod uploaded_video_notes;
 pub mod uploaded_videos;
 pub mod user_impersonation_requests;
+pub mod user_login_challenges;
 pub mod user_referral_codes;
 pub mod user_referrals;
 pub mod user_daily_spends;
@@ -52,4 +53,4 @@ pub mod voice_conversion;
 pub mod voice_designer;
 pub mod wallet_ledger_entries;
 pub mod wallets;
-pub mod web_referrals;
+pub mod web_referrals;
@@ -0,0 +1,35 @@
+use enums::by_table::user_login_challenges::user_login_challenge_status::UserLoginChallengeStatus;
+use sqlx::{Executor, MySql};
+use tokens::tokens::user_login_challenges::UserLoginChallengeToken;
+
+pub struct CreateChallengeArgs<'a, T> {
+  pub token: &'a UserLoginChallengeToken,
+  pub approval_hash: &'a [u8],
+  pub device_hash: &'a [u8],
+  pub confirmation_code: &'a str,
+  pub ip_address: &'a str,
+  pub status: UserLoginChallengeStatus,
+  pub mysql_executor: T,
+}
+
+pub async fn create_challenge<'c, T>(args: CreateChallengeArgs<'_, T>) -> Result<(), sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  sqlx::query!(
+    r#"
+INSERT INTO user_login_challenges
+  (token, approval_token_sha256, device_token_sha256, confirmation_code, ip_address_creation, status, created_at, expires_at)
+VALUES (?, ?, ?, ?, ?, ?, NOW(), NOW() + INTERVAL 20 MINUTE)
+"#,
+    args.token.as_str(),
+    args.approval_hash,
+    args.device_hash,
+    args.confirmation_code,
+    args.ip_address,
+    args.status.to_str()
+  )
+    .execute(args.mysql_executor)
+    .await?;
+  Ok(())
+}
@@ -0,0 +1,40 @@
+use enums::by_table::user_login_challenges::user_login_challenge_failure_type::UserLoginChallengeFailureType;
+use enums::by_table::user_login_challenges::user_login_challenge_status::UserLoginChallengeStatus;
+use sqlx::{Executor, MySql};
+
+pub struct DecideChallengeArgs<'a, T> {
+  pub challenge_id: u64,
+  pub user_token: &'a str,
+  pub ip_address: &'a str,
+  pub approve: bool,
+  pub mysql_executor: T,
+}
+
+pub async fn decide_challenge<'c, T>(args: DecideChallengeArgs<'_, T>) -> Result<bool, sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  let status = if args.approve { UserLoginChallengeStatus::Approved } else { UserLoginChallengeStatus::Failed };
+  let failure = if args.approve { None } else { Some(UserLoginChallengeFailureType::UserDeclined) };
+  let failure_ip = if args.approve { None } else { Some(args.ip_address) };
+  let affected = sqlx::query!(
+    r#"
+UPDATE user_login_challenges SET status = ?, maybe_deciding_user_token = ?,
+  maybe_ip_address_decision = ?, maybe_decided_at = NOW(), maybe_failure_type = ?,
+  maybe_ip_address_failure = ?, maybe_failed_at = IF(?, NULL, NOW())
+WHERE id = ? AND status = ? AND expires_at > NOW()
+"#,
+    status.to_str(),
+    args.user_token,
+    args.ip_address,
+    failure.map(|value| value.to_str()),
+    failure_ip,
+    args.approve,
+    args.challenge_id,
+    UserLoginChallengeStatus::Pending.to_str()
+  )
+    .execute(args.mysql_executor)
+    .await?
+    .rows_affected();
+  Ok(affected == 1)
+}
@@ -0,0 +1,27 @@
+use enums::by_table::user_login_challenges::user_login_challenge_failure_type::UserLoginChallengeFailureType;
+use enums::by_table::user_login_challenges::user_login_challenge_status::UserLoginChallengeStatus;
+use sqlx::{Executor, MySql};
+
+pub struct ExpireAbandonedChallengesArgs<T> {
+  pub mysql_executor: T,
+}
+
+/// Bounded sweep also audits abandoned attempts that are never polled again.
+pub async fn expire_abandoned_challenges<'c, T>(args: ExpireAbandonedChallengesArgs<T>) -> Result<u64, sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  let result = sqlx::query!(
+    r#"
+UPDATE user_login_challenges SET status = ?, maybe_failure_type = ?, maybe_failed_at = expires_at
+WHERE status IN (?, ?) AND expires_at <= NOW() ORDER BY expires_at LIMIT 1000
+"#,
+    UserLoginChallengeStatus::Failed.to_str(),
+    UserLoginChallengeFailureType::Expired.to_str(),
+    UserLoginChallengeStatus::Pending.to_str(),
+    UserLoginChallengeStatus::Approved.to_str()
+  )
+    .execute(args.mysql_executor)
+    .await?;
+  Ok(result.rows_affected())
+}
@@ -0,0 +1,29 @@
+use enums::by_table::user_login_challenges::user_login_challenge_failure_type::UserLoginChallengeFailureType;
+use enums::by_table::user_login_challenges::user_login_challenge_status::UserLoginChallengeStatus;
+use sqlx::{Executor, MySql};
+
+pub struct ExpireChallengeArgs<T> {
+  pub challenge_id: u64,
+  pub mysql_executor: T,
+}
+
+/// Audit expiration of a pending/approved challenge in the caller's transaction.
+pub async fn expire_challenge<'c, T>(args: ExpireChallengeArgs<T>) -> Result<(), sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  sqlx::query!(
+    r#"
+UPDATE user_login_challenges SET status = ?, maybe_failure_type = ?, maybe_failed_at = expires_at
+WHERE id = ? AND status IN (?, ?) AND expires_at <= NOW()
+"#,
+    UserLoginChallengeStatus::Failed.to_str(),
+    UserLoginChallengeFailureType::Expired.to_str(),
+    args.challenge_id,
+    UserLoginChallengeStatus::Pending.to_str(),
+    UserLoginChallengeStatus::Approved.to_str()
+  )
+    .execute(args.mysql_executor)
+    .await?;
+  Ok(())
+}
@@ -0,0 +1,23 @@
+use sqlx::{Executor, MySql};
+
+pub struct IsChallengeExpiredArgs<T> {
+  pub challenge_id: u64,
+  pub mysql_executor: T,
+}
+
+/// Run AFTER acquiring the row lock: NOW() on the locking statement can precede
+/// time spent waiting for another transaction. Never extend the original deadline.
+pub async fn is_challenge_expired<'c, T>(args: IsChallengeExpiredArgs<T>) -> Result<bool, sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  let result = sqlx::query!(
+    r#"
+SELECT expires_at <= NOW() AS expired FROM user_login_challenges WHERE id = ?
+"#,
+    args.challenge_id
+  )
+    .fetch_one(args.mysql_executor)
+    .await?;
+  Ok(result.expired != 0)
+}
@@ -0,0 +1,29 @@
+use enums::by_table::user_login_challenges::user_login_challenge_failure_type::UserLoginChallengeFailureType;
+use enums::by_table::user_login_challenges::user_login_challenge_status::UserLoginChallengeStatus;
+use sqlx::{Executor, MySql};
+
+use super::login_challenge::LoginChallenge;
+
+pub struct LockByApprovalArgs<'a, T> {
+  pub approval_hash: &'a [u8],
+  pub mysql_executor: T,
+}
+
+/// Use the caller's transaction to retain the row lock for subsequent decisions.
+/// The approval token cannot be used in device lookups.
+pub async fn lock_by_approval<'c, T>(args: LockByApprovalArgs<'_, T>) -> Result<Option<LoginChallenge>, sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  sqlx::query_as!(
+    LoginChallenge,
+    r#"
+SELECT id, confirmation_code, status AS `status: UserLoginChallengeStatus`, maybe_deciding_user_token, maybe_redeemed_user_session_id,
+  maybe_failure_type AS `maybe_failure_type: UserLoginChallengeFailureType`, ip_address_creation, expires_at
+FROM user_login_challenges WHERE approval_token_sha256 = ? FOR UPDATE
+"#,
+    args.approval_hash
+  )
+    .fetch_optional(args.mysql_executor)
+    .await
+}
@@ -0,0 +1,28 @@
+use enums::by_table::user_login_challenges::user_login_challenge_failure_type::UserLoginChallengeFailureType;
+use enums::by_table::user_login_challenges::user_login_challenge_status::UserLoginChallengeStatus;
+use sqlx::{Executor, MySql};
+
+use super::login_challenge::LoginChallenge;
+
+pub struct LockByDeviceArgs<'a, T> {
+  pub device_hash: &'a [u8],
+  pub mysql_executor: T,
+}
+
+/// Use the caller's transaction to retain the row lock throughout redemption.
+pub async fn lock_by_device<'c, T>(args: LockByDeviceArgs<'_, T>) -> Result<Option<LoginChallenge>, sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  sqlx::query_as!(
+    LoginChallenge,
+    r#"
+SELECT id, confirmation_code, status AS `status: UserLoginChallengeStatus`, maybe_deciding_user_token, maybe_redeemed_user_session_id,
+  maybe_failure_type AS `maybe_failure_type: UserLoginChallengeFailureType`, ip_address_creation, expires_at
+FROM user_login_challenges WHERE device_token_sha256 = ? FOR UPDATE
+"#,
+    args.device_hash
+  )
+    .fetch_optional(args.mysql_executor)
+    .await
+}
@@ -0,0 +1,14 @@
+use chrono::{DateTime, Utc};
+use enums::by_table::user_login_challenges::user_login_challenge_failure_type::UserLoginChallengeFailureType;
+use enums::by_table::user_login_challenges::user_login_challenge_status::UserLoginChallengeStatus;
+
+pub struct LoginChallenge {
+  pub id: u64,
+  pub confirmation_code: String,
+  pub status: UserLoginChallengeStatus,
+  pub maybe_deciding_user_token: Option<String>,
+  pub maybe_redeemed_user_session_id: Option<i64>,
+  pub maybe_failure_type: Option<UserLoginChallengeFailureType>,
+  pub ip_address_creation: String,
+  pub expires_at: DateTime<Utc>,
+}
@@ -0,0 +1,31 @@
+use enums::by_table::user_login_challenges::user_login_challenge_status::UserLoginChallengeStatus;
+use sqlx::{Executor, MySql};
+
+pub struct MarkRedeemedArgs<'a, T> {
+  pub challenge_id: u64,
+  pub session_id: i64,
+  pub ip_address: &'a str,
+  pub mysql_executor: T,
+}
+
+pub async fn mark_redeemed<'c, T>(args: MarkRedeemedArgs<'_, T>) -> Result<bool, sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  let affected = sqlx::query!(
+    r#"
+UPDATE user_login_challenges SET status = ?, maybe_redeemed_user_session_id = ?,
+  maybe_ip_address_redemption = ?, maybe_redeemed_at = NOW()
+WHERE id = ? AND status = ? AND expires_at > NOW() AND maybe_redeemed_user_session_id IS NULL
+"#,
+    UserLoginChallengeStatus::Redeemed.to_str(),
+    args.session_id,
+    args.ip_address,
+    args.challenge_id,
+    UserLoginChallengeStatus::Approved.to_str()
+  )
+    .execute(args.mysql_executor)
+    .await?
+    .rows_affected();
+  Ok(affected == 1)
+}
@@ -0,0 +1,9 @@
+pub mod create_challenge;
+pub mod decide_challenge;
+pub mod expire_abandoned_challenges;
+pub mod expire_challenge;
+pub mod is_challenge_expired;
+pub mod lock_by_approval;
+pub mod lock_by_device;
+pub mod login_challenge;
+pub mod mark_redeemed;
@@ -0,0 +1,6 @@
+pub struct BridgeSession {
+  pub id: i64,
+  pub token: String,
+  pub user_token: String,
+  pub username: String,
+}
@@ -0,0 +1,36 @@
+use enums::by_table::user_sessions::user_web_session_creation_type::UserWebSessionCreationType;
+use sqlx::{Executor, MySql};
+use tokens::tokens::user_sessions::UserSessionToken;
+
+pub struct CreateBridgeSessionArgs<'a, T> {
+  pub user_token: &'a str,
+  pub ip_address: &'a str,
+  pub mysql_executor: T,
+}
+
+/// Returns the inserted session ID, or None if the user cannot sign in.
+/// Must share the transaction holding the challenge lock. A failed/expired
+/// redemption rolls back this INSERT; no session is minted when merely approving.
+pub async fn create_bridge_session<'c, T>(args: CreateBridgeSessionArgs<'_, T>) -> Result<Option<i64>, sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  let token = UserSessionToken::generate();
+  let inserted = sqlx::query!(
+    r#"
+INSERT INTO user_sessions (token, user_token, ip_address_creation, maybe_creation_type, expires_at)
+SELECT ?, token, ?, ?, NOW() + INTERVAL 1 YEAR FROM users
+WHERE token = ? AND is_banned = FALSE AND user_deleted_at IS NULL AND mod_deleted_at IS NULL
+"#,
+    token.as_str(),
+    args.ip_address,
+    UserWebSessionCreationType::DeviceApproval.to_str(),
+    args.user_token
+  )
+    .execute(args.mysql_executor)
+    .await?;
+  if inserted.rows_affected() != 1 {
+    return Ok(None);
+  }
+  Ok(Some(inserted.last_insert_id() as i64))
+}
@@ -1,6 +1,7 @@
 use std::marker::PhantomData;

 use chrono::{DateTime, Utc};
+use enums::by_table::user_sessions::user_web_session_creation_type::UserWebSessionCreationType;
 use sqlx::{Executor, MySql};

 use tokens::tokens::user_sessions::UserSessionToken;
@@ -36,14 +37,16 @@ INSERT INTO user_sessions (
  user_token,
  maybe_impersonation_user_token,
  ip_address_creation,
+  maybe_creation_type,
  expires_at
 )
-VALUES (?, ?, ?, ?, ?)
+VALUES (?, ?, ?, ?, ?, ?)
    "#,
    session_token.as_str(),
    args.user_token.as_str(),
    args.impersonator_user_token.as_str(),
    args.ip_address,
+    UserWebSessionCreationType::Impersonation.to_str(),
    args.expires_at,
  )
    .execute(args.mysql_executor)
@@ -1,4 +1,5 @@
 use anyhow::anyhow;
+use enums::by_table::user_sessions::user_web_session_creation_type::UserWebSessionCreationType;
 use log::info;
 use sqlx::MySqlPool;

@@ -17,13 +18,15 @@ INSERT INTO user_sessions (
  token,
  user_token,
  ip_address_creation,
+  maybe_creation_type,
  expires_at
 )
-VALUES ( ?, ?, ?, NOW() + interval 1 year )
+VALUES ( ?, ?, ?, ?, NOW() + interval 1 year )
        "#,
        session_token,
        user_token.to_string(),
        ip_address.to_string(),
+        UserWebSessionCreationType::DirectLogin.to_str(),
    )
    .execute(mysql_pool)
    .await;
@@ -1,3 +1,4 @@
+use enums::by_table::user_sessions::user_web_session_creation_type::UserWebSessionCreationType;
 use log::info;
 use sqlx::{Executor, MySql};
 use tokens::tokens::user_sessions::UserSessionToken;
@@ -19,13 +20,15 @@ INSERT INTO user_sessions (
  token,
  user_token,
  ip_address_creation,
+  maybe_creation_type,
  expires_at
 )
-VALUES ( ?, ?, ?, NOW() + interval 1 year )
+VALUES ( ?, ?, ?, ?, NOW() + interval 1 year )
    "#,
    session_token.as_str(),
    user_token.as_str(),
    ip_address,
+    UserWebSessionCreationType::DirectLogin.to_str(),
  )
    .execute(mysql_executor)
    .await?;
@@ -1,4 +1,5 @@
 use anyhow::anyhow;
+use enums::by_table::user_sessions::user_web_session_creation_type::UserWebSessionCreationType;
 use log::info;
 use sqlx::MySqlPool;

@@ -22,13 +23,15 @@ INSERT INTO user_sessions (
  token,
  user_token,
  ip_address_creation,
+  maybe_creation_type,
  expires_at
 )
-VALUES ( ?, ?, ?, NOW() + interval 1 year )
+VALUES ( ?, ?, ?, ?, NOW() + interval 1 year )
        "#,
        session_token.as_str(),
        user_token.as_str(),
        ip_address,
+        UserWebSessionCreationType::DirectLogin.to_str(),
    );

  let query_result = transactor.execute(query).await;
@@ -0,0 +1,27 @@
+use sqlx::{Executor, MySql};
+
+use super::bridge_session::BridgeSession;
+
+pub struct FindApprovingSessionArgs<'a, T> {
+  pub session_token: &'a str,
+  pub mysql_executor: T,
+}
+
+/// Fresh database lookup, not a cached session. Impersonated sessions cannot consent.
+pub async fn find_approving_session<'c, T>(args: FindApprovingSessionArgs<'_, T>) -> Result<Option<BridgeSession>, sqlx::Error>
+where
+  T: Executor<'c, Database = MySql>,
+{
+  sqlx::query_as!(
+    BridgeSession,
+    r#"
+SELECT s.id, s.token, s.user_token, u.username FROM user_sessions s JOIN users u ON u.token = s.user_token
+WHERE s.token = ? AND s.deleted_at IS NULL AND s.expires_at > NOW()
+  AND s.maybe_impersonation_user_token IS NULL AND u.is_banned = FALSE
+  AND u.user_deleted_at IS NULL AND u.mod_deleted_at IS NULL
+"#,
+    args.session_token
+  )
+    .fetch_optional(args.mysql_executor)
+    .await
+}
Author	SHA1	Message	Date
Brandon Thomas	9169e4d662	add opengraph metadata (social media tags)	2026-09-26 16:30:57 -07:00
Brandon Thomas	4c7af51851	Merge pull request #35 from storytold/bt-media-previews fix media previews in new design	2026-09-26 10:30:44 -07:00
Brandon Thomas	eadfb4f821	Merge origin/main into bt-media-previews Combine the media share implementations, preserving interactive players, social cards, model/provider labels, reference thumbnails, and legacy redirects. Verify with 17 isolated Chrome integration tests, TypeScript checks, and the production build.	2026-09-26 09:58:16 -07:00
Brandon Thomas	0c163d6c19	routes	2026-09-26 09:33:04 -07:00
Brandon Thomas	26484685ee	media previews on website	2026-09-26 09:25:40 -07:00
BFlat	5bceb33801	Website: model/provider names and icons, video reference thumbs on share page (#34 ) Ports the model-list display names and brand marks, shows the Created row as date + time like the webapp lightbox, and uses the still-frame preview for video references.	2026-09-26 21:49:03 +07:00
BFlat	c6e2c4296a	Website: port media share page (/media/[token]) to artcraft-website-next (#33 ) * Website: port the media share page to artcraft-website-next Adds the /media/[token] route with server-side OG metadata, the media viewer with prompt/reference/info details, and legacy ?media= redirects. * no ruler on media share page	2026-09-26 21:36:04 +07:00
Brandon Thomas	8551d58def	fix download version again	2026-09-26 04:32:59 -07:00
Brandon Thomas	807180bf22	Merge pull request #32 from storytold/bt-new-website-downloads new website downloads	2026-09-26 04:24:45 -07:00
Brandon Thomas	f48d2beea7	new website downloads	2026-09-26 04:24:15 -07:00
Brandon Thomas	dc72bbd5e6	Merge pull request #31 from storytold/bt-sso-otp desktop app login bridge	2026-09-26 02:43:00 -07:00
Brandon Thomas	b6a184bcb0	enum variants	2026-09-26 02:36:24 -07:00
Brandon Thomas	d0e1d113fe	break out queries	2026-09-26 02:13:23 -07:00
Brandon Thomas	1facb312dc	tests	2026-09-26 01:57:16 -07:00
Brandon Thomas	f2c8a0390f	final fixes	2026-09-26 00:46:19 -07:00
Brandon Thomas	2e83d39d2b	login challenge on website works	2026-09-26 00:22:45 -07:00
Brandon Thomas	4f1c9134ee	WIP SSO OTP bridge	2026-09-25 23:23:00 -07:00
Brandon Thomas	f0a877c988	Merge pull request #30 from storytold/bt-fix-thumbs thumbnail generation speedup / concurrency	2026-09-20 10:45:32 -04:00
Brandon Thomas	1b2d2f49e5	improve concurrency	2026-09-20 10:44:54 -04:00
Brandon Thomas	3e6d759fe2	fix thumbnail job latency	2026-09-20 10:12:38 -04:00
BFlat	f77f09018a	Landing: wordmark thickness update (#29 )	2026-09-20 20:31:18 +07:00
Brandon Thomas	fc9d727ffc	Merge pull request #28 from storytold/bt-routing re-route request	2026-09-20 08:21:44 -04:00
Brandon Thomas	e2da58b3e5	re-route request	2026-09-20 08:21:08 -04:00
BFlat	681f32b230	Add folder moving and nested sidebar navigation (#27 )	2026-09-19 13:11:02 +07:00
Brandon Thomas	edfa80dde3	Merge pull request #26 from storytold/bt-debug debug tool	2026-09-18 18:55:00 -04:00
Brandon Thomas	cfa8264642	debug tool	2026-09-18 18:54:10 -04:00
Brandon Thomas	fcb567ec3c	Merge pull request #25 from storytold/gpt-image-qualities gpt image 2.5: new qualities	2026-09-18 14:13:57 -04:00
Brandon Thomas	734b757ef9	gpt image 2.5: new qualities	2026-09-18 14:12:34 -04:00
Brandon Thomas	daf401c635	Merge pull request #24 from storytold/bt-regroup group Wan video differently	2026-09-18 14:00:04 -04:00
Brandon Thomas	c0207c61ba	group Wan video differently	2026-09-18 13:59:01 -04:00
Brandon Thomas	0a7b7ae2ac	Merge pull request #23 from storytold/bt-wan-pt2 wan 3.0 + prime	2026-09-18 13:45:58 -04:00
Brandon Thomas	92bc1e24c4	wan 3.0 + prime	2026-09-18 13:40:50 -04:00
Brandon Thomas	6dd7a88a12	Merge pull request #22 from storytold/bt-wan wan 3.0	2026-09-18 12:41:18 -04:00