test: rerun critical coverage verification

## Summary

Adds a **sitewide announcement banner** to the website, rendered above
the navbar on every page. It has a two-layer visibility model:

- **Build-time gate** — a pure, unit-tested `evaluateBannerVisibility()`
decides whether the banner mounts at all (active flag + optional date
window + locale/section targeting), driven by a typed config
(`src/config/banner.ts`). No CMS; copy resolves through i18n.
- **Client-side dismissal** — persisted in `localStorage`, keyed by a
**content hash** so editing the copy re-shows the banner (per-locale, so
an en edit doesn't re-show it for zh-CN).

Current content points the CTA at **Comfy MCP** (`/mcp`).

## Highlights

- **Full-width branded bar** above a now-`sticky` navbar; reuses the
design system (`Button`, gradient tokens, new reusable `IconButton`).
- **Flash-free** on load: an inline pre-hydration script hides an
already-dismissed banner before paint (no pop-in, no layout shift);
`close()` sets the same signal after the leave animation to stay
flash-free across ClientRouter navigations.
- **Open/close transition**: grid-rows height collapse + fade,
respecting `prefers-reduced-motion`.
- **i18n**: copy in `en` + `zh-CN`.

## Where to edit later

- **Copy**: `apps/website/src/i18n/translations.ts` →
`launches.banner.text` / `launches.banner.cta`
- **Link / on-off / dates / targeting**:
`apps/website/src/config/banner.ts` (`bannerConfig`)

## Notes

- On a static site the `startsAt`/`endsAt` window is evaluated at
**build time** (documented in `banner.ts`).
- Changing the copy or link changes the content hash, so
previously-dismissed visitors will see the banner again — by design.

## Test plan

- `pnpm test:unit` — evaluator + version-hash unit tests pass.
- `pnpm typecheck` + lint clean.
- On the preview: banner shows on `/`, `/launches`, and a `zh-CN` page;
CTA -> `/mcp`; dismiss animates and stays dismissed on reload (no
flash); reduced-motion disables the animation.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/actions/find-workflow-run/action.yaml

@@ -8,6 +8,10 @@ inputs:
   head-sha:
     description: The commit SHA to find runs for
     required: true
+  event:
+    description: Optional workflow event to match
+    required: false
+    default: ''
   not-found-status:
     description: Status to output when no run exists
     required: false
@@ -33,6 +37,7 @@ runs:
       env:
         WORKFLOW_ID: ${{ inputs.workflow-id }}
         HEAD_SHA: ${{ inputs.head-sha }}
+        EVENT_NAME: ${{ inputs.event }}
         NOT_FOUND_STATUS: ${{ inputs.not-found-status }}
       with:
         github-token: ${{ inputs.token }}
@@ -42,6 +47,7 @@ runs:
             repo: context.repo.repo,
             workflow_id: process.env.WORKFLOW_ID,
             head_sha: process.env.HEAD_SHA,
+            event: process.env.EVENT_NAME || undefined,
             per_page: 1,
           });
 

.github/workflows/ci-tests-unit.yaml

@@ -38,6 +38,18 @@ jobs:
       - name: Run Vitest tests with coverage
         run: pnpm test:coverage
 
+      - name: Generate critical unit coverage artifact
+        run: pnpm coverage:critical:extract
+
+      - name: Upload critical unit coverage artifact
+        if: github.event_name != 'merge_group'
+        uses: actions/upload-artifact@v6
+        with:
+          name: critical-unit-coverage-${{ github.sha }}
+          path: coverage/critical-unit-coverage.json
+          retention-days: 30
+          if-no-files-found: error
+
       - name: Upload unit coverage artifact
         if: always() && github.event_name == 'push'
         uses: actions/upload-artifact@v6
@@ -55,3 +67,79 @@ jobs:
           flags: unit
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false
+
+  critical-unit-regression:
+    needs: test
+    if: ${{ github.event_name == 'pull_request' && needs.test.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup frontend
+        uses: ./.github/actions/setup-frontend
+
+      - name: Download head critical unit coverage
+        uses: actions/download-artifact@v7
+        with:
+          name: critical-unit-coverage-${{ github.sha }}
+          path: temp/head-critical-coverage
+
+      - name: Find base unit coverage run
+        id: find-base-unit
+        uses: ./.github/actions/find-workflow-run
+        with:
+          workflow-id: ci-tests-unit.yaml
+          head-sha: ${{ github.event.pull_request.base.sha }}
+          event: push
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Require base unit coverage run
+        if: steps.find-base-unit.outputs.status != 'ready'
+        run: |
+          echo "Critical unit baseline artifact unavailable for base ${{ github.event.pull_request.base.sha }}." >> "$GITHUB_STEP_SUMMARY"
+          echo "Status: ${{ steps.find-base-unit.outputs.status }}" >> "$GITHUB_STEP_SUMMARY"
+          exit 1
+
+      - name: Download base critical unit coverage
+        continue-on-error: true
+        uses: dawidd6/action-download-artifact@0bd50d53a6d7fb5cb921e607957e9cc12b4ce392 # v12
+        with:
+          name: critical-unit-coverage-${{ github.event.pull_request.base.sha }}
+          run_id: ${{ steps.find-base-unit.outputs.run-id }}
+          path: temp/base-critical-coverage
+          if_no_artifact_found: warn
+
+      - name: Download base unit LCOV fallback
+        continue-on-error: true
+        uses: dawidd6/action-download-artifact@0bd50d53a6d7fb5cb921e607957e9cc12b4ce392 # v12
+        with:
+          name: unit-coverage
+          run_id: ${{ steps.find-base-unit.outputs.run-id }}
+          path: temp/base-unit-coverage
+          if_no_artifact_found: warn
+
+      - name: Prepare base critical unit coverage fallback
+        run: |
+          if [ -f temp/base-critical-coverage/critical-unit-coverage.json ]; then
+            exit 0
+          fi
+
+          if [ ! -f temp/base-unit-coverage/lcov.info ]; then
+            echo "Critical unit baseline artifact missing for base ${{ github.event.pull_request.base.sha }}." >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+
+          pnpm coverage:critical:extract \
+            --input temp/base-unit-coverage/lcov.info \
+            --output temp/base-critical-coverage/critical-unit-coverage.json \
+            --sha=${{ github.event.pull_request.base.sha }}
+
+      - name: Compare critical unit coverage
+        run: >
+          pnpm coverage:critical:compare
+          --base temp/base-critical-coverage/critical-unit-coverage.json
+          --head temp/head-critical-coverage/critical-unit-coverage.json

.github/workflows/pr-cursor-review.yaml

@@ -29,7 +29,7 @@ jobs:
     # SHA-pinned per zizmor `unpinned-uses: hash-pin`. Bump this SHA to pick up
     # upstream changes; keep `workflows_ref` matching so prompts/scripts load
     # from the same commit as the workflow definition.
-    uses: Comfy-Org/github-workflows/.github/workflows/cursor-review.yml@047ca48febe3a6647608ed2e0c4331b491cb9d6a # github-workflows#9
+    uses: Comfy-Org/github-workflows/.github/workflows/cursor-review.yml@df507e6bae179c567ad3849370f99dae588985dc # github-workflows main (df507e6)
     with:
       # Overriding diff_excludes replaces the reusable default wholesale, so
       # this restates the generated/vendored defaults and adds this repo's heavy
@@ -48,7 +48,7 @@ jobs:
         :!**/*-snapshots/**
         :!src/workbench/extensions/manager/types/generatedManagerTypes.ts
       # Load the prompts/scripts from the same ref as `uses:`.
-      workflows_ref: 047ca48febe3a6647608ed2e0c4331b491cb9d6a
+      workflows_ref: df507e6bae179c567ad3849370f99dae588985dc
     secrets:
       CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
       # Optional — enables start/complete Slack DMs to the triggerer.

apps/website/e2e/cloud.spec.ts

@@ -40,7 +40,7 @@ test.describe('Cloud page @smoke', () => {
     }
   })
 
-  test('AIModelsSection heading and 5 model cards are visible', async ({
+  test('AIModelsSection heading and 6 model cards are visible', async ({
     page
   }) => {
     const heading = page.getByRole('heading', { name: /leading AI models/i })
@@ -49,7 +49,7 @@ test.describe('Cloud page @smoke', () => {
     const section = heading.locator('xpath=ancestor::section')
     const grid = section.locator('.grid')
     const modelCards = grid.locator('a[href="https://comfy.org/workflows"]')
-    await expect(modelCards).toHaveCount(5)
+    await expect(modelCards).toHaveCount(6)
   })
 
   test('AIModelsSection CTA links to workflows', async ({ page }) => {

apps/website/src/components/common/HeaderMain/HeaderMain.vue

@@ -33,7 +33,7 @@ const ctaButtons = [
 
 <template>
   <nav
-    class="fixed inset-x-0 top-0 z-50 flex items-center justify-between gap-4 bg-primary-comfy-ink px-6 py-5 lg:gap-4 lg:px-[clamp(0.25rem,4vw,5rem)] lg:py-8"
+    class="sticky top-0 z-50 flex items-center justify-between gap-4 bg-primary-comfy-ink px-6 py-5 lg:gap-4 lg:px-[clamp(0.25rem,4vw,5rem)] lg:py-8"
     aria-label="Main navigation"
   >
     <a

apps/website/src/components/common/ProductCard.vue

@@ -30,7 +30,12 @@ const { title, description, cta, href, bg } = defineProps<{
       <p class="text-sm text-white/70">
         {{ description }}
       </p>
-      <Button as="span" variant="default" size="sm" class="mt-4">
+      <Button
+        as="span"
+        variant="default"
+        size="sm"
+        class="mt-4 h-auto whitespace-normal"
+      >
         {{ cta }}
       </Button>
     </div>

apps/website/src/components/ui/icon-button/IconButton.vue

@@ -0,0 +1,38 @@
+<script setup lang="ts">
+import type { PrimitiveProps } from 'reka-ui'
+import type { HTMLAttributes } from 'vue'
+import type { IconButtonVariants } from '.'
+import { Primitive } from 'reka-ui'
+import { cn } from '@comfyorg/tailwind-utils'
+import { iconButtonVariants } from '.'
+
+interface Props extends PrimitiveProps {
+  variant?: IconButtonVariants['variant']
+  size?: IconButtonVariants['size']
+  class?: HTMLAttributes['class']
+  disabled?: boolean
+}
+
+const {
+  as = 'button',
+  asChild,
+  variant,
+  size,
+  class: className,
+  disabled
+} = defineProps<Props>()
+</script>
+
+<template>
+  <Primitive
+    data-slot="icon-button"
+    :data-variant="variant"
+    :data-size="size"
+    :as
+    :as-child
+    :disabled
+    :class="cn(iconButtonVariants({ variant, size }), className)"
+  >
+    <slot />
+  </Primitive>
+</template>

apps/website/src/components/ui/icon-button/index.ts

@@ -0,0 +1,28 @@
+import type { VariantProps } from 'class-variance-authority'
+import { cva } from 'class-variance-authority'
+
+export const iconButtonVariants = cva(
+  [
+    'focus-visible:border-primary-comfy-yellow focus-visible:ring-primary-comfy-yellow/50 inline-flex shrink-0 cursor-pointer items-center justify-center rounded-2xl transition-all duration-200 outline-none focus-visible:ring-3 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0'
+  ],
+  {
+    variants: {
+      variant: {
+        ghost:
+          'text-primary-warm-white hover:text-primary-comfy-yellow bg-transparent',
+        outline:
+          'text-primary-comfy-yellow hover:bg-primary-comfy-yellow border-primary-comfy-yellow border-2 bg-primary-comfy-ink hover:text-primary-comfy-ink'
+      },
+      size: {
+        sm: 'size-8',
+        default: 'size-10',
+        lg: 'size-14'
+      }
+    },
+    defaultVariants: {
+      variant: 'ghost',
+      size: 'default'
+    }
+  }
+)
+export type IconButtonVariants = VariantProps<typeof iconButtonVariants>

apps/website/src/composables/useBannerDismissal.ts

@@ -0,0 +1,75 @@
+import { onMounted, ref } from 'vue'
+
+import { BANNER_DISMISS_ATTR, BANNER_STORAGE_KEY } from '../utils/banner'
+
+type ClosedBanners = Record<string, boolean>
+
+function readClosedBanners(): ClosedBanners {
+  try {
+    const raw = localStorage.getItem(BANNER_STORAGE_KEY)
+    return raw ? (JSON.parse(raw) as ClosedBanners) : {}
+  } catch {
+    return {}
+  }
+}
+
+function writeClosedBanners(value: ClosedBanners): void {
+  try {
+    localStorage.setItem(BANNER_STORAGE_KEY, JSON.stringify(value))
+  } catch {
+    // Storage unavailable (private mode / quota) — dismissal just won't persist.
+  }
+}
+
+/** The stable part of a version key (everything before `_v<hash>`). */
+function versionPrefix(version: string): string {
+  const idx = version.lastIndexOf('_v')
+  return idx === -1 ? version : version.slice(0, idx)
+}
+
+/**
+ * Client-side dismissal persisted in localStorage, keyed by a content-aware
+ * `version`. The banner renders visible in the static HTML (so non-dismissers
+ * see no pop-in); an inline pre-hydration script hides an already-dismissed
+ * banner before paint, and this composable then removes it from the DOM on mount.
+ */
+export function useBannerDismissal(version: string) {
+  const isVisible = ref(true)
+
+  onMounted(() => {
+    const stored = readClosedBanners()
+    const prefix = versionPrefix(version)
+
+    // Prune stale versions of THIS banner+locale; keep other banners/locales
+    // and the current version.
+    const cleaned: ClosedBanners = Object.create(null) as ClosedBanners
+    let pruned = false
+    for (const key of Object.keys(stored)) {
+      if (versionPrefix(key) !== prefix || key === version) {
+        cleaned[key] = stored[key]
+      } else {
+        pruned = true
+      }
+    }
+    if (pruned) writeClosedBanners(cleaned)
+
+    isVisible.value = !cleaned[version]
+  })
+
+  function close(): void {
+    isVisible.value = false
+    const stored = readClosedBanners()
+    stored[version] = true
+    writeClosedBanners(stored)
+  }
+
+  // Call once the close transition has finished. Sets the pre-paint hide signal
+  // so the banner doesn't flash back in on a ClientRouter (view-transition)
+  // navigation — where the inline <head> script does not re-run but <html>
+  // persists. Deferred to after the animation so the leave transition can play.
+  function persistHidden(): void {
+    document.documentElement.setAttribute(BANNER_DISMISS_ATTR, '')
+  }
+
+  return { isVisible, close, persistHidden }
+}

apps/website/src/config/banner.ts

@@ -0,0 +1,84 @@
+import type { ButtonVariants } from '../components/ui/button'
+import type { Locale, TranslationKey } from '../i18n/translations'
+
+import { t } from '../i18n/translations'
+import { resolveRel } from '../utils/cta'
+
+// The banner "CMS": a single typed config resolved through i18n at build time.
+// `isActive` is the master on/off switch (supersedes the old SHOW_ANNOUNCEMENT_BANNER).
+// NOTE: on this static site, `startsAt`/`endsAt` are evaluated at BUILD time — the
+// window gates on the last deploy, not the visitor's exact clock.
+
+interface BannerLinkConfig {
+  readonly href: string
+  readonly titleKey: TranslationKey
+  readonly target?: boolean
+  readonly buttonVariant?: NonNullable<ButtonVariants['variant']>
+}
+
+export interface BannerConfig {
+  readonly id: string
+  readonly isActive: boolean
+  readonly startsAt?: string
+  readonly endsAt?: string
+  /** Empty/undefined = all locales. */
+  readonly targetLocales?: readonly Locale[]
+  /** v1 only supports 'sitewide'. */
+  readonly targetSections?: readonly string[]
+  readonly titleKey: TranslationKey
+  readonly descriptionKey?: TranslationKey
+  readonly link?: BannerLinkConfig
+}
+
+interface BannerLinkData {
+  readonly href: string
+  readonly title: string
+  readonly target?: '_blank'
+  readonly rel?: string
+  readonly buttonVariant?: NonNullable<ButtonVariants['variant']>
+}
+
+export interface BannerData {
+  readonly id: string
+  readonly title: string
+  readonly description?: string
+  readonly link?: BannerLinkData
+}
+
+export const bannerConfig: BannerConfig = {
+  id: 'announcement',
+  isActive: true,
+  targetSections: ['sitewide'],
+  titleKey: 'launches.banner.text',
+  link: {
+    href: '/mcp',
+    titleKey: 'launches.banner.cta',
+    buttonVariant: 'underlineLink'
+  }
+}
+
+/** Resolve a config's i18n keys into display strings for the given locale. */
+export function getBannerData(
+  config: BannerConfig,
+  locale: Locale
+): BannerData {
+  const { link } = config
+  const target = link?.target ? '_blank' : undefined
+
+  return {
+    id: config.id,
+    title: t(config.titleKey, locale),
+    description: config.descriptionKey
+      ? t(config.descriptionKey, locale)
+      : undefined,
+    link: link
+      ? {
+          href: link.href,
+          title: t(link.titleKey, locale),
+          target,
+          rel: resolveRel({ target: target ?? '_self' }),
+          buttonVariant: link.buttonVariant
+        }
+      : undefined
+  }
+}

apps/website/src/i18n/translations.ts

@@ -3983,12 +3983,12 @@ const translations = {
   // Launches page (/launches) — subscribe banner
   // zh-CN strings pending native review (see apps/website/.scratch/drops-page/PRD.md)
   'launches.banner.text': {
-    en: 'Join the live stream. Get answers in real time.',
-    'zh-CN': '加入直播，实时获得解答。'
+    en: 'Now turn your agent into a creative technologist.',
+    'zh-CN': '现在，让你的智能体成为创意技术专家。'
   },
   'launches.banner.cta': {
-    en: 'Join livestream',
-    'zh-CN': '加入直播'
+    en: 'Start Comfy MCP',
+    'zh-CN': '启动 Comfy MCP'
   },
 
   // Launches page (/launches) — closing CTA

apps/website/src/layouts/BaseLayout.astro

@@ -5,6 +5,14 @@ import '../styles/global.css'
 import type { Locale } from '../i18n/translations'
 import SiteFooter from '../components/common/SiteFooter.vue'
 import HeaderMain from '../components/common/HeaderMain/HeaderMain.vue'
+import AnnouncementBanner from '../templates/drops/AnnouncementBanner.vue'
+import { bannerConfig, getBannerData } from '../config/banner'
+import {
+  BANNER_DISMISS_ATTR,
+  BANNER_STORAGE_KEY,
+  createBannerVersion,
+  evaluateBannerVisibility
+} from '../utils/banner'
 import { escapeJsonLd } from '../utils/escapeJsonLd'
 import { fetchGitHubStars, formatStarCount } from '../utils/github'
 
@@ -34,6 +42,15 @@ const locale: Locale = rawLocale === 'zh-CN' ? 'zh-CN' : 'en'
 const rawStars = await fetchGitHubStars('Comfy-Org', 'ComfyUI')
 const githubStars = rawStars ? formatStarCount(rawStars) : ''
 
+// Announcement banner — build-time visibility gate + content-hash version key.
+const bannerData = getBannerData(bannerConfig, locale)
+const bannerVisible = evaluateBannerVisibility(bannerConfig, {
+  currentLocale: locale,
+  currentSection: 'sitewide',
+  now: new Date(),
+})
+const bannerVersion = createBannerVersion(bannerData, locale)
+
 const gtmId = 'GTM-NP9JM6K7'
 const gtmEnabled = import.meta.env.PROD
 
@@ -124,6 +141,25 @@ const websiteJsonLd = {
 
     <ClientRouter />
     <slot name="head" />
+
+    <!-- Hide an already-dismissed announcement banner before first paint (no flash/shift). -->
+    {bannerVisible && (
+      <script
+        is:inline
+        define:vars={{
+          bannerVersion,
+          storageKey: BANNER_STORAGE_KEY,
+          dismissAttr: BANNER_DISMISS_ATTR
+        }}
+      >
+        try {
+          const dismissed = JSON.parse(localStorage.getItem(storageKey) || '{}')
+          if (dismissed[bannerVersion]) {
+            document.documentElement.setAttribute(dismissAttr, '')
+          }
+        } catch (e) {}
+      </script>
+    )}
   </head>
   <body class="bg-primary-comfy-ink text-white font-formula antialiased overflow-x-clip">
     {gtmEnabled && (
@@ -137,8 +173,16 @@ const websiteJsonLd = {
       </noscript>
     )}
 
+    {bannerVisible && (
+      <AnnouncementBanner
+        data={bannerData}
+        version={bannerVersion}
+        locale={locale}
+        client:load
+      />
+    )}
     <HeaderMain locale={locale} github-stars={githubStars} client:load />
-    <main class="mt-20 lg:mt-32">
+    <main>
       <slot />
     </main>
     <SiteFooter locale={locale} client:load />

apps/website/src/pages/launches.astro

@@ -3,7 +3,6 @@ import BaseLayout from '../layouts/BaseLayout.astro'
 import CtaSection from '../templates/drops/CtaSection.vue'
 import DropsSection from '../templates/drops/DropsSection.vue'
 import HeroSection from '../templates/drops/HeroSection.vue'
-import SubscribeBanner from '../templates/drops/SubscribeBanner.vue'
 import { t } from '../i18n/translations'
 
 const locale = 'en' as const
@@ -13,7 +12,6 @@ const locale = 'en' as const
   title={t('launches.page.title', locale)}
   description={t('launches.page.description', locale)}
 >
-  <SubscribeBanner locale={locale} client:load />
   <HeroSection locale={locale} client:load />
   <DropsSection locale={locale} />
   <CtaSection locale={locale} />

apps/website/src/pages/zh-CN/launches.astro

@@ -3,7 +3,6 @@ import BaseLayout from '../../layouts/BaseLayout.astro'
 import CtaSection from '../../templates/drops/CtaSection.vue'
 import DropsSection from '../../templates/drops/DropsSection.vue'
 import HeroSection from '../../templates/drops/HeroSection.vue'
-import SubscribeBanner from '../../templates/drops/SubscribeBanner.vue'
 import { t } from '../../i18n/translations'
 
 const locale = 'zh-CN' as const
@@ -13,7 +12,6 @@ const locale = 'zh-CN' as const
   title={t('launches.page.title', locale)}
   description={t('launches.page.description', locale)}
 >
-  <SubscribeBanner locale={locale} client:load />
   <HeroSection locale={locale} client:load />
   <DropsSection locale={locale} />
   <CtaSection locale={locale} />

apps/website/src/styles/global.css

@@ -70,6 +70,7 @@
   --color-secondary-mauve: #4d3762;
   --color-destructive: #f44336;
   --color-primary-comfy-plum: #49378b;
+  --color-secondary-deep-plum: #2b2040;
   --color-secondary-cool-gray: #3c3c3c;
   --color-illustration-forest: #20464c;
   --color-transparency-white-t4: rgb(255 255 255 / 0.04);
@@ -93,6 +94,14 @@
   initial-value: 0deg;
 }
 
+/* Pre-hydration hide for a dismissed announcement banner (set by an inline
+   script in BaseLayout head) — prevents any flash before Vue hydrates.
+   The [data-banner-dismissed] literal is BANNER_DISMISS_ATTR in utils/banner.ts;
+   keep them in sync. */
+[data-banner-dismissed] [data-slot='announcement-banner'] {
+  display: none;
+}
+
 @keyframes border-angle-spin {
   to {
     --border-angle: 360deg;

apps/website/src/templates/drops/AnnouncementBanner.vue

@@ -0,0 +1,107 @@
+<script setup lang="ts">
+import { ArrowRight, X } from '@lucide/vue'
+
+import type { BannerData } from '../../config/banner'
+import type { Locale } from '../../i18n/translations'
+
+import { t } from '../../i18n/translations'
+import Button from '@/components/ui/button/Button.vue'
+import IconButton from '@/components/ui/icon-button/IconButton.vue'
+import { useBannerDismissal } from '../../composables/useBannerDismissal'
+
+const {
+  data,
+  version,
+  locale = 'en'
+} = defineProps<{
+  data: BannerData
+  version: string
+  locale?: Locale
+}>()
+
+const { isVisible, close, persistHidden } = useBannerDismissal(version)
+</script>
+
+<template>
+  <Transition name="banner-collapse" @after-leave="persistHidden">
+    <div v-if="isVisible" class="banner-collapse grid">
+      <div class="min-h-0 overflow-hidden">
+        <div
+          data-slot="announcement-banner"
+          class="after:bg-transparency-white-t4 relative flex items-center gap-x-6 px-6 py-4 after:pointer-events-none after:absolute after:inset-x-0 after:bottom-0 after:h-px sm:px-3.5 sm:before:flex-1"
+          style="
+            background: linear-gradient(
+              90deg,
+              var(--color-primary-comfy-plum) 0%,
+              var(--color-secondary-deep-plum) 53.85%,
+              var(--color-secondary-mauve) 100%
+            );
+          "
+        >
+          <div class="flex flex-wrap items-center gap-x-8 gap-y-2">
+            <p
+              class="text-primary-warm-white ppformula-text-center text-sm md:text-base/6"
+            >
+              {{ data.title }}
+              <span v-if="data.description" class="text-primary-warm-white/80">
+                {{ data.description }}
+              </span>
+            </p>
+            <Button
+              v-if="data.link"
+              as="a"
+              :href="data.link.href"
+              :target="data.link.target"
+              :rel="data.link.rel"
+              :variant="data.link.buttonVariant ?? 'underlineLink'"
+              size="sm"
+            >
+              {{ data.link.title }}
+              <template #append>
+                <ArrowRight class="size-4" />
+              </template>
+            </Button>
+          </div>
+          <div class="flex flex-1 justify-end">
+            <IconButton
+              type="button"
+              :aria-label="t('nav.close', locale)"
+              @click="close"
+            >
+              <X class="size-5" aria-hidden="true" />
+            </IconButton>
+          </div>
+        </div>
+      </div>
+    </div>
+  </Transition>
+</template>
+
+<style scoped>
+/* Collapse the banner's height (grid 1fr → 0fr) so page content below slides
+   up smoothly, with a fade. Enter is defined for symmetry; in practice only the
+   leave (dismiss) runs, since the banner renders present in the static HTML. */
+.banner-collapse {
+  grid-template-rows: 1fr;
+}
+
+.banner-collapse-enter-active,
+.banner-collapse-leave-active {
+  transition:
+    grid-template-rows 300ms ease,
+    opacity 250ms ease;
+}
+
+.banner-collapse-enter-from,
+.banner-collapse-leave-to {
+  grid-template-rows: 0fr;
+  opacity: 0;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .banner-collapse-enter-active,
+  .banner-collapse-leave-active {
+    transition: none;
+  }
+}
+</style>

apps/website/src/templates/drops/SubscribeBanner.vue

@@ -1,61 +0,0 @@
-<script setup lang="ts">
-import { useTimeoutFn } from '@vueuse/core'
-import { onMounted, ref } from 'vue'
-
-import type { Locale } from '../../i18n/translations'
-
-import { t } from '../../i18n/translations'
-import Button from '@/components/ui/button/Button.vue'
-import { resolveRel } from '../../utils/cta'
-import { livestream } from './livestream'
-
-const { locale = 'en' } = defineProps<{ locale?: Locale }>()
-
-const signUpHref = `https://www.youtube.com/watch?v=${livestream.youtubeVideoId}`
-const signUpRel = resolveRel({ target: '_blank' })
-
-// Hide once the livestream window closes — both for visitors arriving after
-// the event and for visitors whose tab is open when it ends.
-const endMs = new Date(livestream.endDateTime).getTime()
-const visible = ref(true)
-
-// useTimeoutFn auto-clears on unmount. Arm it client-side only so SSR never
-// schedules a long-lived server timer.
-const { start } = useTimeoutFn(
-  () => {
-    visible.value = false
-  },
-  () => Math.max(0, endMs - Date.now()),
-  { immediate: false }
-)
-
-onMounted(() => {
-  if (endMs - Date.now() <= 0) {
-    visible.value = false
-  } else {
-    start()
-  }
-})
-</script>
-
-<template>
-  <div v-if="visible" class="px-4">
-    <div
-      class="bg-primary-comfy-plum max-w-8xl rounded-5xl text-primary-warm-white mx-auto flex w-full flex-col items-center justify-center gap-2 px-6 py-5 text-center text-sm sm:flex-row sm:gap-4"
-    >
-      <p class="ppformula-text-center">
-        {{ t('launches.banner.text', locale) }}
-      </p>
-      <Button
-        :href="signUpHref"
-        as="a"
-        variant="underlineLink"
-        size="sm"
-        target="_blank"
-        :rel="signUpRel"
-      >
-        {{ t('launches.banner.cta', locale) }}
-      </Button>
-    </div>
-  </div>
-</template>

apps/website/src/utils/banner.test.ts

@@ -0,0 +1,109 @@
+import { describe, expect, it } from 'vitest'
+
+import type { EvaluableBanner } from './banner'
+
+import { createBannerVersion, evaluateBannerVisibility } from './banner'
+
+const base: EvaluableBanner = {
+  isActive: true,
+  targetSections: ['sitewide']
+}
+
+const ctx = {
+  currentLocale: 'en',
+  currentSection: 'sitewide',
+  now: new Date('2026-07-06T00:00:00Z')
+}
+
+describe('evaluateBannerVisibility', () => {
+  it('shows an active, untargeted, sitewide banner', () => {
+    expect(evaluateBannerVisibility(base, ctx)).toBe(true)
+  })
+
+  it('hides when inactive', () => {
+    expect(evaluateBannerVisibility({ ...base, isActive: false }, ctx)).toBe(
+      false
+    )
+  })
+
+  it('hides before startsAt and shows within the window', () => {
+    expect(
+      evaluateBannerVisibility(
+        { ...base, startsAt: '2026-07-10T00:00:00Z' },
+        ctx
+      )
+    ).toBe(false)
+    expect(
+      evaluateBannerVisibility(
+        { ...base, startsAt: '2026-07-01T00:00:00Z' },
+        ctx
+      )
+    ).toBe(true)
+  })
+
+  it('hides after endsAt', () => {
+    expect(
+      evaluateBannerVisibility({ ...base, endsAt: '2026-07-01T00:00:00Z' }, ctx)
+    ).toBe(false)
+    expect(
+      evaluateBannerVisibility({ ...base, endsAt: '2026-07-10T00:00:00Z' }, ctx)
+    ).toBe(true)
+  })
+
+  it('treats an empty targetLocales as "all locales"', () => {
+    expect(evaluateBannerVisibility({ ...base, targetLocales: [] }, ctx)).toBe(
+      true
+    )
+  })
+
+  it('hides when targetLocales excludes the current locale', () => {
+    expect(
+      evaluateBannerVisibility({ ...base, targetLocales: ['zh-CN'] }, ctx)
+    ).toBe(false)
+    expect(
+      evaluateBannerVisibility({ ...base, targetLocales: ['en', 'zh-CN'] }, ctx)
+    ).toBe(true)
+  })
+
+  it('hides when targetSections does not include the current section', () => {
+    expect(
+      evaluateBannerVisibility({ ...base, targetSections: ['checkout'] }, ctx)
+    ).toBe(false)
+  })
+
+  it('hides when targetSections is absent (nothing to match)', () => {
+    expect(evaluateBannerVisibility({ isActive: true }, ctx)).toBe(false)
+  })
+})
+
+describe('createBannerVersion', () => {
+  const content = {
+    id: 'announcement',
+    title: 'Join the live stream',
+    link: { href: 'https://x', title: 'Join' }
+  }
+
+  it('is deterministic for identical content', () => {
+    expect(createBannerVersion(content, 'en')).toBe(
+      createBannerVersion(content, 'en')
+    )
+  })
+
+  it('encodes the banner id and locale in the key', () => {
+    expect(createBannerVersion(content, 'en')).toMatch(
+      /^announcement_en_v-?\d+$/
+    )
+  })
+
+  it('changes when the copy changes', () => {
+    expect(createBannerVersion(content, 'en')).not.toBe(
+      createBannerVersion({ ...content, title: 'New copy' }, 'en')
+    )
+  })
+
+  it('differs per locale so one locale edit does not re-show another', () => {
+    expect(createBannerVersion(content, 'en')).not.toBe(
+      createBannerVersion(content, 'zh-CN')
+    )
+  })
+})

apps/website/src/utils/banner.ts

@@ -0,0 +1,87 @@
+// Pure, framework-agnostic banner logic — no Vue/Astro/config imports so it stays
+// trivially unit-testable. Locale/section are plain strings on purpose.
+
+// Shared dismissal storage contract. The pre-hydration script in BaseLayout.astro,
+// the useBannerDismissal composable, and the CSS selector in global.css must all
+// agree on these literals — keep them here as the single source of truth.
+export const BANNER_STORAGE_KEY = 'closedBanners'
+export const BANNER_DISMISS_ATTR = 'data-banner-dismissed'
+
+export interface BannerVisibilityContext {
+  currentLocale: string
+  currentSection: string
+  now: Date
+}
+
+export interface EvaluableBanner {
+  isActive: boolean
+  startsAt?: string
+  endsAt?: string
+  targetLocales?: readonly string[]
+  targetSections?: readonly string[]
+}
+
+/**
+ * Server/build-time visibility gate. Returns false on the FIRST failing check,
+ * in order: active flag → start window → end window → locale targeting →
+ * section targeting. An empty/absent `targetLocales` means "all locales".
+ */
+export function evaluateBannerVisibility(
+  banner: EvaluableBanner,
+  ctx: BannerVisibilityContext
+): boolean {
+  if (!banner.isActive) return false
+  if (
+    banner.startsAt &&
+    ctx.now.getTime() < new Date(banner.startsAt).getTime()
+  )
+    return false
+  if (banner.endsAt && ctx.now.getTime() > new Date(banner.endsAt).getTime())
+    return false
+
+  const targetLocales = banner.targetLocales ?? []
+  if (targetLocales.length > 0 && !targetLocales.includes(ctx.currentLocale))
+    return false
+
+  const targetSections = banner.targetSections ?? []
+  if (!targetSections.includes(ctx.currentSection)) return false
+
+  return true
+}
+
+interface BannerLinkContent {
+  href: string
+  title: string
+  target?: string
+  rel?: string
+  buttonVariant?: string
+}
+
+export interface BannerVersionContent {
+  id: string
+  title: string
+  description?: string
+  link?: BannerLinkContent
+}
+
+/**
+ * Content-aware version key. Editing the copy changes the hash, so a previously
+ * dismissed banner re-appears. Keyed per-locale so a zh-CN edit doesn't re-show
+ * the banner for en visitors. Format: `${content.id}_${locale}_v${hash}`.
+ */
+export function createBannerVersion(
+  content: BannerVersionContent,
+  locale: string
+): string {
+  const contentString = JSON.stringify({
+    locale,
+    title: content.title,
+    description: content.description,
+    link: content.link
+  })
+  let hash = 0
+  for (const char of contentString) {
+    hash = Math.imul(hash, 31) + char.charCodeAt(0)
+  }
+  return `${content.id}_${locale}_v${hash}`
+}

package.json

@@ -19,6 +19,8 @@
     "size:collect": "node scripts/size-collect.js",
     "size:report": "node scripts/size-report.js",
     "collect-i18n": "pnpm exec playwright test --config=playwright.i18n.config.ts",
+    "coverage:critical:compare": "tsx scripts/critical-coverage/compareCriticalCoverage.ts",
+    "coverage:critical:extract": "tsx scripts/critical-coverage/extractCriticalCoverage.ts",
     "dev:cloud": "pnpm dev:cloud:test",
     "dev:cloud:test": "cross-env DEV_SERVER_COMFYUI_URL=https://testcloud.comfy.org/ vite --config vite.config.mts",
     "dev:cloud:staging": "cross-env DEV_SERVER_COMFYUI_URL=https://stagingcloud.comfy.org/ vite --config vite.config.mts",

packages/ingest-types/src/index.ts

@@ -12,6 +12,11 @@ export type {
   AddAssetTagsErrors,
   AddAssetTagsResponse,
   AddAssetTagsResponses,
+  AdminDeleteHubWorkflowData,
+  AdminDeleteHubWorkflowError,
+  AdminDeleteHubWorkflowErrors,
+  AdminDeleteHubWorkflowResponse,
+  AdminDeleteHubWorkflowResponses,
   Asset,
   AssetCreated,
   AssetCreatedWritable,
@@ -42,6 +47,11 @@ export type {
   CancelJobErrors,
   CancelJobResponse,
   CancelJobResponses,
+  CancelJobsData,
+  CancelJobsError,
+  CancelJobsErrors,
+  CancelJobsResponse,
+  CancelJobsResponses,
   CancelSubscriptionData,
   CancelSubscriptionError,
   CancelSubscriptionErrors,
@@ -84,6 +94,11 @@ export type {
   CreateDeletionRequestErrors,
   CreateDeletionRequestResponse,
   CreateDeletionRequestResponses,
+  CreateDesktopLoginCodeData,
+  CreateDesktopLoginCodeError,
+  CreateDesktopLoginCodeErrors,
+  CreateDesktopLoginCodeResponse,
+  CreateDesktopLoginCodeResponses,
   CreateHubAssetUploadUrlData,
   CreateHubAssetUploadUrlError,
   CreateHubAssetUploadUrlErrors,
@@ -186,12 +201,31 @@ export type {
   DeleteWorkspaceResponses,
   DeletionRequest,
   DeletionStatus,
+  DesktopLoginCodeCreateRequest,
+  DesktopLoginCodeCreateResponse,
+  DesktopLoginCodeExchangeRequest,
+  DesktopLoginCodeExchangeResponse,
+  DesktopLoginCodeRedeemRequest,
+  DesktopLoginCodeRedeemResponse,
   DownloadExportData,
   DownloadExportError,
   DownloadExportErrors,
   DownloadExportResponse,
   DownloadExportResponses,
+  EnsureWorkspaceBillingLegacySnapshot,
+  EnsureWorkspaceBillingProvisionedData,
+  EnsureWorkspaceBillingProvisionedError,
+  EnsureWorkspaceBillingProvisionedErrors,
+  EnsureWorkspaceBillingProvisionedRequest,
+  EnsureWorkspaceBillingProvisionedResponse,
+  EnsureWorkspaceBillingProvisionedResponse2,
+  EnsureWorkspaceBillingProvisionedResponses,
   ErrorResponse,
+  ExchangeDesktopLoginCodeData,
+  ExchangeDesktopLoginCodeError,
+  ExchangeDesktopLoginCodeErrors,
+  ExchangeDesktopLoginCodeResponse,
+  ExchangeDesktopLoginCodeResponses,
   ExchangeTokenData,
   ExchangeTokenError,
   ExchangeTokenErrors,
@@ -230,6 +264,11 @@ export type {
   GetAssetByIdErrors,
   GetAssetByIdResponse,
   GetAssetByIdResponses,
+  GetAssetContentData,
+  GetAssetContentError,
+  GetAssetContentErrors,
+  GetAssetContentResponse,
+  GetAssetContentResponses,
   GetAssetSeedStatusData,
   GetAssetSeedStatusResponse,
   GetAssetSeedStatusResponses,
@@ -303,6 +342,11 @@ export type {
   GetHistoryData,
   GetHistoryError,
   GetHistoryErrors,
+  GetHistoryEventsData,
+  GetHistoryEventsError,
+  GetHistoryEventsErrors,
+  GetHistoryEventsResponse,
+  GetHistoryEventsResponses,
   GetHistoryForPromptData,
   GetHistoryForPromptError,
   GetHistoryForPromptErrors,
@@ -345,8 +389,6 @@ export type {
   GetJwksData,
   GetJwksResponse,
   GetJwksResponses,
-  GetLegacyAssetContentData,
-  GetLegacyAssetContentErrors,
   GetLegacyHistoryByIdData,
   GetLegacyHistoryByIdErrors,
   GetLegacyHistoryData,
@@ -556,6 +598,7 @@ export type {
   HistoryDetailEntry,
   HistoryDetailResponse,
   HistoryEntry,
+  HistoryEventRequest,
   HistoryManageRequest,
   HistoryResponse,
   HubAssetUploadUrlRequest,
@@ -589,6 +632,8 @@ export type {
   JobCancelResponse,
   JobDetailResponse,
   JobEntry,
+  JobsCancelRequest,
+  JobsCancelResponse,
   JobsListResponse,
   JobStatusResponse,
   JwkKey,
@@ -627,7 +672,19 @@ export type {
   ListJobsErrors,
   ListJobsResponse,
   ListJobsResponses,
+  ListLinkedFirebaseUidsData,
+  ListLinkedFirebaseUidsError,
+  ListLinkedFirebaseUidsErrors,
+  ListLinkedFirebaseUidsRequest,
+  ListLinkedFirebaseUidsResponse,
+  ListLinkedFirebaseUidsResponse2,
+  ListLinkedFirebaseUidsResponses,
   ListMembersResponse,
+  ListSecretProvidersData,
+  ListSecretProvidersError,
+  ListSecretProvidersErrors,
+  ListSecretProvidersResponse,
+  ListSecretProvidersResponses,
   ListSecretsData,
   ListSecretsError,
   ListSecretsErrors,
@@ -775,6 +832,17 @@ export type {
   QueueInfo,
   QueueManageRequest,
   QueueManageResponse,
+  RedeemDesktopLoginCodeData,
+  RedeemDesktopLoginCodeError,
+  RedeemDesktopLoginCodeErrors,
+  RedeemDesktopLoginCodeResponse,
+  RedeemDesktopLoginCodeResponses,
+  ReleaseDeletionHoldData,
+  ReleaseDeletionHoldError,
+  ReleaseDeletionHoldErrors,
+  ReleaseDeletionHoldResponse,
+  ReleaseDeletionHoldResponses,
+  ReleaseHoldResponse,
   RemoveAssetTagsData,
   RemoveAssetTagsError,
   RemoveAssetTagsErrors,
@@ -785,6 +853,11 @@ export type {
   RemoveWorkspaceMemberErrors,
   RemoveWorkspaceMemberResponse,
   RemoveWorkspaceMemberResponses,
+  ReportHistoryEventData,
+  ReportHistoryEventError,
+  ReportHistoryEventErrors,
+  ReportHistoryEventResponse,
+  ReportHistoryEventResponses,
   ReportPartnerUsageData,
   ReportPartnerUsageError,
   ReportPartnerUsageErrors,
@@ -808,6 +881,8 @@ export type {
   RevokeWorkspaceInviteResponse,
   RevokeWorkspaceInviteResponses,
   SecretListResponse,
+  SecretProvider,
+  SecretProvidersResponse,
   SecretResponse,
   SeedAssetsData,
   SeedAssetsResponse,
@@ -819,6 +894,8 @@ export type {
   SetReviewStatusResponse,
   SetReviewStatusResponse2,
   SetReviewStatusResponses,
+  ShortLinkRedirectData,
+  ShortLinkRedirectErrors,
   SubmitFeedbackData,
   SubmitFeedbackError,
   SubmitFeedbackErrors,
@@ -848,6 +925,10 @@ export type {
   TaskEntry,
   TaskResponse,
   TasksListResponse,
+  TeamCreditStop,
+  TeamCreditStopPrice,
+  TeamCreditStops,
+  TeamCreditStopSummary,
   UpdateAssetData,
   UpdateAssetError,
   UpdateAssetErrors,
@@ -865,6 +946,7 @@ export type {
   UpdateHubWorkflowRequest,
   UpdateHubWorkflowResponse,
   UpdateHubWorkflowResponses,
+  UpdateMemberRoleRequest,
   UpdateMultipleSettingsData,
   UpdateMultipleSettingsError,
   UpdateMultipleSettingsErrors,
@@ -895,6 +977,11 @@ export type {
   UpdateWorkspaceData,
   UpdateWorkspaceError,
   UpdateWorkspaceErrors,
+  UpdateWorkspaceMemberRoleData,
+  UpdateWorkspaceMemberRoleError,
+  UpdateWorkspaceMemberRoleErrors,
+  UpdateWorkspaceMemberRoleResponse,
+  UpdateWorkspaceMemberRoleResponses,
   UpdateWorkspaceRequest,
   UpdateWorkspaceResponse,
   UpdateWorkspaceResponses,

packages/ingest-types/src/zod.gen.ts

@@ -465,6 +465,20 @@ export const zCreateWorkflowRequest = z.object({
   forked_from_workflow_version_id: z.string().optional()
 })
 
+/**
+ * Request body for forwarding a comfy-api audit/history event. Identify the target workspace by either user_id (cloud resolves the user's personal workspace via the converged identity, BE-1047) or an explicit workspace_id. At least one must be provided; workspace_id wins when both are set.
+ */
+export const zHistoryEventRequest = z.object({
+  user_id: z.string().optional(),
+  workspace_id: z.string().optional(),
+  event_type: z.string().min(1),
+  event_id: z.string().min(1),
+  params: z.record(z.unknown()).optional(),
+  auth_method: z.enum(['api_key', 'bearer_token']).optional(),
+  customer_ref: z.string().optional(),
+  timestamp: z.string().datetime().optional()
+})
+
 /**
  * Response after recording partner usage data.
  */
@@ -540,11 +554,11 @@ export const zPaymentPortalRequest = z.object({
 })
 
 /**
- * Response after successfully resubscribing to a billing plan.
+ * Response after accepting a resubscribe request.
  */
 export const zResubscribeResponse = z.object({
   billing_op_id: z.string(),
-  status: z.enum(['active']),
+  status: z.enum(['active', 'pending']),
   message: z.string().optional()
 })
 
@@ -585,6 +599,8 @@ export const zSubscribeResponse = z.object({
  */
 export const zSubscribeRequest = z.object({
   plan_slug: z.string(),
+  team_credit_stop_id: z.string().optional(),
+  billing_cycle: z.enum(['monthly', 'yearly']).optional(),
   idempotency_key: z.string().optional(),
   return_url: z.string().optional(),
   cancel_url: z.string().optional()
@@ -626,7 +642,8 @@ export const zSubscriptionTier = z.enum([
   'STANDARD',
   'CREATOR',
   'PRO',
-  'FOUNDERS_EDITION'
+  'FOUNDERS_EDITION',
+  'TEAM'
 ])
 
 /**
@@ -714,6 +731,57 @@ export const zPreviewSubscribeRequest = z.object({
   plan_slug: z.string()
 })
 
+/**
+ * Pre/post-discount price for a team credit stop, in cents.
+ */
+export const zTeamCreditStopPrice = z.object({
+  list_price_cents: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    }),
+  price_cents: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    })
+})
+
+/**
+ * A selectable preset on the team pricing slider. Echoed on subscribe via
+ * team_credit_stop_id; the backend owns the resolved amounts. credits is a
+ * RAW monthly credit count (not cents). Save% is derived by the FE as
+ * (list_price_cents - price_cents) / list_price_cents.
+ *
+ */
+export const zTeamCreditStop = z.object({
+  id: z.string(),
+  credits: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    }),
+  monthly: zTeamCreditStopPrice,
+  yearly: zTeamCreditStopPrice
+})
+
+/**
+ * Credit-stop ladder for the pricing slider (BE-1254). Returned by GET /api/billing/plans for every workspace regardless of the caller's token or workspace type (the personal/team distinction was removed); omitted only when the catalog defines no stops.
+ */
+export const zTeamCreditStops = z.object({
+  default_stop_index: z.number().int(),
+  stops: z.array(zTeamCreditStop)
+})
+
 /**
  * Reason why a plan is unavailable
  */
@@ -773,7 +841,50 @@ export const zPlan = z.object({
  */
 export const zBillingPlansResponse = z.object({
   current_plan_slug: z.string().optional(),
-  plans: z.array(zPlan)
+  plans: z.array(zPlan),
+  team_credit_stops: zTeamCreditStops.optional()
+})
+
+/**
+ * The team credit stop a workspace is currently subscribed to: the
+ * per-workspace slider choice recorded at subscribe time
+ * (workspace_subscriptions.team_credit_stop_id). Amounts are owned by the
+ * catalog, not the subscription row. Returned on GET /api/billing/status
+ * for per-credit Team plans (BE-1254).
+ *
+ */
+export const zTeamCreditStopSummary = z.object({
+  id: z.string(),
+  credits_monthly: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    }),
+  stop_usd: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    })
+})
+
+/**
+ * A provider the user may configure a secret for. The shape is deliberately minimal (identifier only) and reserved for future per-provider fields such as sub-keys.
+ */
+export const zSecretProvider = z.object({
+  id: z.string()
+})
+
+/**
+ * The providers available to the authenticated user in the current workspace.
+ */
+export const zSecretProvidersResponse = z.object({
+  data: z.array(zSecretProvider)
 })
 
 /**
@@ -813,7 +924,7 @@ export const zCreateSecretRequest = z.object({
 })
 
 /**
- * A single billing event such as a charge, credit, or adjustment.
+ * A single history event. The cloud history-events store is the single source of truth for both billing events (charges, credits, adjustments) and user-facing usage events.
  */
 export const zBillingEvent = z.object({
   event_type: z.string(),
@@ -868,7 +979,8 @@ export const zBillingStatusResponse = z.object({
   billing_status: zBillingStatus.optional(),
   has_funds: z.boolean(),
   cancel_at: z.string().datetime().optional(),
-  renewal_date: z.string().datetime().optional()
+  renewal_date: z.string().datetime().optional(),
+  team_credit_stop: zTeamCreditStopSummary.nullable()
 })
 
 /**
@@ -930,6 +1042,7 @@ export const zOAuthConsentChallenge = z.object({
   csrf_token: z.string(),
   client_display_name: z.string(),
   resource_display_name: z.string(),
+  redirect_uri: z.string().url(),
   scopes: z.array(z.string()),
   workspaces: z.array(zOAuthConsentChallengeWorkspace)
 })
@@ -1056,6 +1169,66 @@ export const zSyncApiKeyRequest = z.object({
   customer_id: z.string().min(1)
 })
 
+/**
+ * The personal workspace's provisioned billing identity.
+ */
+export const zEnsureWorkspaceBillingProvisionedResponse = z.object({
+  workspace_id: z.string(),
+  stripe_customer_id: z.string(),
+  metronome_customer_id: z.string(),
+  metronome_contract_id: z.string()
+})
+
+/**
+ * The caller's already-resolved legacy (comfy-api) customer identity. When
+ * present and carrying provider IDs, provisioning ATTACHES this identity to
+ * the personal workspace (sharing the existing balance and subscription)
+ * instead of minting a net-new empty customer. Omit (or send with no
+ * provider IDs) for a free user with nothing to attach — provisioning then
+ * creates net-new. This closes the create-new-before-attach gap: a caller
+ * that already knows the legacy identity hands it over so the very first
+ * provisioning is an attach.
+ *
+ */
+export const zEnsureWorkspaceBillingLegacySnapshot = z.object({
+  stripe_customer_id: z.string().optional(),
+  metronome_customer_id: z.string().optional(),
+  metronome_contract_id: z.string().optional(),
+  has_funds: z.boolean().optional(),
+  subscription_tier: z.string().optional(),
+  legacy_stripe_subscription_id: z.string().optional(),
+  legacy_comfy_user_id: z.string().optional()
+})
+
+/**
+ * Request body for ensuring a user's personal workspace carries a fully
+ * provisioned billing identity. Sent by comfy-api's CreateCustomer (BE-1047)
+ * with the already canonical-resolved user identity.
+ *
+ */
+export const zEnsureWorkspaceBillingProvisionedRequest = z.object({
+  user_id: z.string().min(1),
+  email: z.string().email().min(1),
+  snapshot: zEnsureWorkspaceBillingLegacySnapshot.optional()
+})
+
+/**
+ * Firebase UIDs linked to the canonical comfy_user_id. Empty list when
+ * no mappings exist (not an error — callers can treat empty as "unknown
+ * canonical").
+ *
+ */
+export const zListLinkedFirebaseUidsResponse = z.object({
+  firebase_uids: z.array(z.string())
+})
+
+/**
+ * Request body for reverse-looking-up Firebase UIDs linked to a canonical comfy_user_id.
+ */
+export const zListLinkedFirebaseUidsRequest = z.object({
+  comfy_user_id: z.string().min(1)
+})
+
 /**
  * Response confirming the validity and scope of a workspace API key.
  */
@@ -1172,7 +1345,8 @@ export const zMember = z.object({
   name: z.string(),
   email: z.string().email(),
   role: z.enum(['owner', 'member']),
-  joined_at: z.string().datetime()
+  joined_at: z.string().datetime(),
+  is_original_owner: z.boolean()
 })
 
 /**
@@ -1183,6 +1357,13 @@ export const zListMembersResponse = z.object({
   pagination: zPaginationInfo
 })
 
+/**
+ * Request body for changing a workspace member's role.
+ */
+export const zUpdateMemberRoleRequest = z.object({
+  role: z.enum(['owner', 'member'])
+})
+
 /**
  * Request body for updating an existing workspace's settings.
  */
@@ -1227,6 +1408,60 @@ export const zWorkspace = z.object({
   created_at: z.string().datetime()
 })
 
+/**
+ * Exchange poll result. Pending until the code is redeemed in the browser.
+ */
+export const zDesktopLoginCodeExchangeResponse = z.object({
+  status: z.enum(['pending', 'complete']),
+  custom_token: z.string().optional()
+})
+
+/**
+ * Request to exchange a redeemed login code for a custom token.
+ */
+export const zDesktopLoginCodeExchangeRequest = z.object({
+  code: z.string(),
+  code_verifier: z.string().min(43).max(128)
+})
+
+/**
+ * Result of redeeming a desktop login code.
+ */
+export const zDesktopLoginCodeRedeemResponse = z.object({
+  status: z.enum(['redeemed'])
+})
+
+/**
+ * Request to claim a desktop login code for the authenticated user.
+ */
+export const zDesktopLoginCodeRedeemRequest = z.object({
+  code: z.string()
+})
+
+/**
+ * A freshly minted desktop login code and its polling parameters.
+ */
+export const zDesktopLoginCodeCreateResponse = z.object({
+  code: z.string(),
+  expires_in: z.number().int(),
+  poll_interval: z.number().int()
+})
+
+/**
+ * Request to mint a desktop login code.
+ */
+export const zDesktopLoginCodeCreateRequest = z.object({
+  installation_id: z
+    .string()
+    .min(8)
+    .max(128)
+    .regex(/^[A-Za-z0-9._-]+$/)
+    .optional(),
+  platform: z.string().min(1).max(32),
+  app_version: z.string().min(1).max(64),
+  code_challenge: z.string().min(43).max(128)
+})
+
 /**
  * Abbreviated workspace metadata used in list responses.
  */
@@ -1294,6 +1529,15 @@ export const zTasksListResponse = z.object({
   pagination: zPaginationInfo
 })
 
+/**
+ * Result of authorizing a legal-hold release on a user's deletion.
+ */
+export const zReleaseHoldResponse = z.object({
+  firebase_id: z.string(),
+  released: z.boolean(),
+  message: z.string()
+})
+
 /**
  * Current status of a user data deletion request.
  */
@@ -1363,6 +1607,20 @@ export const zJobDetailResponse = z.object({
   execution_meta: z.record(z.unknown()).optional()
 })
 
+/**
+ * Response for POST /api/jobs/cancel.
+ */
+export const zJobsCancelResponse = z.object({
+  cancelled: z.array(z.string())
+})
+
+/**
+ * Request to cancel multiple jobs by ID.
+ */
+export const zJobsCancelRequest = z.object({
+  job_ids: z.array(z.string().uuid()).min(1).max(100)
+})
+
 /**
  * Response for POST /api/jobs/{job_id}/cancel. Returned on both fresh cancels and idempotent no-ops.
  */
@@ -1529,6 +1787,7 @@ export const zAsset = z.object({
   user_metadata: z.record(z.unknown()).optional(),
   metadata: z.record(z.unknown()).readonly().optional(),
   preview_url: z.string().url().optional(),
+  short_url: z.string().nullish(),
   preview_id: z.string().uuid().nullish(),
   job_id: z.string().uuid().nullish(),
   created_at: z.string().datetime(),
@@ -1624,6 +1883,7 @@ export const zSystemStatsResponse = z.object({
     python_version: z.string(),
     embedded_python: z.boolean(),
     comfyui_version: z.string(),
+    deploy_environment: z.string().optional(),
     comfyui_frontend_version: z.string().optional(),
     workflow_templates_version: z.string().optional(),
     cloud_version: z.string().optional(),
@@ -1962,6 +2222,7 @@ export const zAssetWritable = z.object({
   tags: z.array(z.string()).optional(),
   user_metadata: z.record(z.unknown()).optional(),
   preview_url: z.string().url().optional(),
+  short_url: z.string().nullish(),
   preview_id: z.string().uuid().nullish(),
   job_id: z.string().uuid().nullish(),
   created_at: z.string().datetime(),
@@ -2180,7 +2441,11 @@ export const zGetJobDetailData = z.object({
   path: z.object({
     job_id: z.string().uuid()
   }),
-  query: z.never().optional()
+  query: z
+    .object({
+      short_link: z.enum(['ephemeral_tool_chain', 'default']).optional()
+    })
+    .optional()
 })
 
 /**
@@ -2201,6 +2466,17 @@ export const zCancelJobData = z.object({
  */
 export const zCancelJobResponse = zJobCancelResponse
 
+export const zCancelJobsData = z.object({
+  body: zJobsCancelRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Success - cancel requests dispatched (or jobs were already terminal)
+ */
+export const zCancelJobsResponse = zJobsCancelResponse
+
 export const zViewFileData = z.object({
   body: z.never().optional(),
   path: z.never().optional(),
@@ -2580,6 +2856,17 @@ export const zCreateSecretData = z.object({
  */
 export const zCreateSecretResponse = zSecretResponse
 
+export const zListSecretProvidersData = z.object({
+  body: z.never().optional(),
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Success
+ */
+export const zListSecretProvidersResponse = zSecretProvidersResponse
+
 export const zDeleteSecretData = z.object({
   body: z.never().optional(),
   path: z.object({
@@ -2881,6 +3168,40 @@ export const zExchangeTokenData = z.object({
  */
 export const zExchangeTokenResponse2 = zExchangeTokenResponse
 
+export const zCreateDesktopLoginCodeData = z.object({
+  body: zDesktopLoginCodeCreateRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Login code created
+ */
+export const zCreateDesktopLoginCodeResponse = zDesktopLoginCodeCreateResponse
+
+export const zRedeemDesktopLoginCodeData = z.object({
+  body: zDesktopLoginCodeRedeemRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Code redeemed (or already redeemed by the same user)
+ */
+export const zRedeemDesktopLoginCodeResponse = zDesktopLoginCodeRedeemResponse
+
+export const zExchangeDesktopLoginCodeData = z.object({
+  body: zDesktopLoginCodeExchangeRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Pending (not yet redeemed) or complete with a custom token
+ */
+export const zExchangeDesktopLoginCodeResponse =
+  zDesktopLoginCodeExchangeResponse
+
 export const zGetJwksData = z.object({
   body: z.never().optional(),
   path: z.never().optional(),
@@ -3150,6 +3471,19 @@ export const zRemoveWorkspaceMemberData = z.object({
  */
 export const zRemoveWorkspaceMemberResponse = z.void()
 
+export const zUpdateWorkspaceMemberRoleData = z.object({
+  body: zUpdateMemberRoleRequest,
+  path: z.object({
+    userId: z.string()
+  }),
+  query: z.never().optional()
+})
+
+/**
+ * Member role updated
+ */
+export const zUpdateWorkspaceMemberRoleResponse = zMember
+
 export const zListWorkspaceApiKeysData = z.object({
   body: z.never().optional(),
   path: z.never().optional(),
@@ -3236,6 +3570,19 @@ export const zSetReviewStatusData = z.object({
  */
 export const zSetReviewStatusResponse2 = zSetReviewStatusResponse
 
+export const zAdminDeleteHubWorkflowData = z.object({
+  body: z.never().optional(),
+  path: z.object({
+    share_id: z.string()
+  }),
+  query: z.never().optional()
+})
+
+/**
+ * Successfully deleted
+ */
+export const zAdminDeleteHubWorkflowResponse = z.void()
+
 export const zUpdateHubWorkflowData = z.object({
   body: zUpdateHubWorkflowRequest,
   path: z.object({
@@ -3277,6 +3624,19 @@ export const zCreateDeletionRequestResponse = z.object({
   user_found_in_cloud: z.boolean()
 })
 
+export const zReleaseDeletionHoldData = z.object({
+  body: z.object({
+    firebase_id: z.string()
+  }),
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Release authorized; the deletion workflow will proceed
+ */
+export const zReleaseDeletionHoldResponse = zReleaseHoldResponse
+
 export const zReportPartnerUsageData = z.object({
   body: zPartnerUsageRequest,
   path: z.never().optional(),
@@ -3288,6 +3648,38 @@ export const zReportPartnerUsageData = z.object({
  */
 export const zReportPartnerUsageResponse = zPartnerUsageResponse
 
+export const zGetHistoryEventsData = z.object({
+  body: z.never().optional(),
+  path: z.never().optional(),
+  query: z
+    .object({
+      workspace_id: z.string().optional(),
+      user_id: z.string().optional(),
+      event_type: z.string().optional(),
+      start_date: z.string().datetime().optional(),
+      end_date: z.string().datetime().optional(),
+      page: z.number().int().optional(),
+      limit: z.number().int().optional()
+    })
+    .optional()
+})
+
+/**
+ * Paginated cloud history events for the workspace
+ */
+export const zGetHistoryEventsResponse = zBillingEventsResponse
+
+export const zReportHistoryEventData = z.object({
+  body: zHistoryEventRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * History event recorded successfully
+ */
+export const zReportHistoryEventResponse = zPartnerUsageResponse
+
 export const zUpdateSubscriptionCacheData = z.object({
   body: z.object({
     user_id: z.string(),
@@ -3305,6 +3697,29 @@ export const zUpdateSubscriptionCacheResponse = z.object({
   status: z.string().optional()
 })
 
+export const zListLinkedFirebaseUidsData = z.object({
+  body: zListLinkedFirebaseUidsRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Linked Firebase UIDs (possibly empty list)
+ */
+export const zListLinkedFirebaseUidsResponse2 = zListLinkedFirebaseUidsResponse
+
+export const zEnsureWorkspaceBillingProvisionedData = z.object({
+  body: zEnsureWorkspaceBillingProvisionedRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * The workspace's provisioned billing identity
+ */
+export const zEnsureWorkspaceBillingProvisionedResponse2 =
+  zEnsureWorkspaceBillingProvisionedResponse
+
 export const zInsertDynamicConfigData = z.object({
   body: z.record(z.unknown()),
   path: z.never().optional(),
@@ -4010,6 +4425,14 @@ export const zGetModelPreviewData = z.object({
   query: z.never().optional()
 })
 
+export const zShortLinkRedirectData = z.object({
+  body: z.never().optional(),
+  path: z.object({
+    id: z.string()
+  }),
+  query: z.never().optional()
+})
+
 export const zGetLegacyPromptByIdData = z.object({
   body: z.never().optional(),
   path: z.object({
@@ -4070,14 +4493,23 @@ export const zGetLegacyUserdataV2Data = z.object({
   query: z.never().optional()
 })
 
-export const zGetLegacyAssetContentData = z.object({
+export const zGetAssetContentData = z.object({
   body: z.never().optional(),
   path: z.object({
     id: z.string()
   }),
-  query: z.never().optional()
+  query: z
+    .object({
+      disposition: z.enum(['inline', 'attachment']).optional()
+    })
+    .optional()
 })
 
+/**
+ * Asset content stream (local runtime streams the bytes directly)
+ */
+export const zGetAssetContentResponse = z.string()
+
 export const zGetLegacyViewMetadataData = z.object({
   body: z.never().optional(),
   path: z.object({

packages/ingest-types/tsconfig.json

@@ -4,5 +4,5 @@
     "rootDir": "src",
     "outDir": "dist"
   },
-  "include": ["src/**/*", "*.config.ts"]
+  "include": ["src/**/*"]
 }

packages/object-info-parser/tsconfig.json

@@ -4,5 +4,5 @@
     "rootDir": "src",
     "outDir": "dist"
   },
-  "include": ["src/**/*", "vitest.config.ts"]
+  "include": ["src/**/*"]
 }

scripts/critical-coverage/compareCriticalCoverage.ts

@@ -0,0 +1,120 @@
+import { appendFileSync } from 'node:fs'
+
+import {
+  compareCriticalCoverageReports,
+  readCriticalCoverageReport
+} from './criticalCoverageReport'
+import type { CriticalCoverageComparison } from './criticalCoverageReport'
+
+interface Options {
+  base: string
+  head: string
+}
+
+const options = parseOptions(process.argv.slice(2))
+const base = readCriticalCoverageReport(options.base)
+const head = readCriticalCoverageReport(options.head)
+const comparison = compareCriticalCoverageReports(base, head)
+const summary = formatComparison(comparison)
+
+process.stdout.write(`${summary}\n`)
+
+if (process.env.GITHUB_STEP_SUMMARY) {
+  appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${summary}\n`)
+}
+
+if (comparison.commonBranches === 0) {
+  process.stderr.write('No comparable critical unit branches found.\n')
+  process.exit(1)
+}
+
+if (comparison.coveredBranchDelta < 0) {
+  process.stderr.write(
+    `Critical unit coverage dropped by ${Math.abs(comparison.coveredBranchDelta)} covered branches on the shared branch set.\n`
+  )
+  process.exit(1)
+}
+
+function parseOptions(args: string[]): Options {
+  const options: Partial<Options> = {}
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    const next = args[i + 1]
+
+    if (arg === '--base' && next) {
+      options.base = next
+      i++
+    } else if (arg.startsWith('--base=')) {
+      options.base = arg.slice('--base='.length)
+    } else if (arg === '--head' && next) {
+      options.head = next
+      i++
+    } else if (arg.startsWith('--head=')) {
+      options.head = arg.slice('--head='.length)
+    }
+  }
+
+  if (!options.base || !options.head) {
+    throw new Error(
+      'Usage: compareCriticalCoverage --base <json> --head <json>'
+    )
+  }
+
+  return {
+    base: options.base,
+    head: options.head
+  }
+}
+
+function formatComparison(comparison: CriticalCoverageComparison): string {
+  const passed = comparison.coveredBranchDelta >= 0
+  const lines = [
+    `## Critical Unit Coverage Gate: ${passed ? 'PASS' : 'FAIL'}`,
+    '',
+    `Base tested commit: \`${comparison.baseSha}\``,
+    `PR tested commit: \`${comparison.headSha}\``,
+    '',
+    '| Metric | Count |',
+    '|---|--:|',
+    `| Comparable critical branches | ${comparison.commonBranches} |`,
+    `| Covered in base | ${comparison.commonCoveredBranchesInBase} |`,
+    `| Covered in head | ${comparison.commonCoveredBranchesInHead} |`,
+    `| Covered branch delta | ${formatSignedCount(comparison.coveredBranchDelta)} |`,
+    `| Base-only branches | ${comparison.baseOnlyBranches} |`,
+    `| Head-only branches | ${comparison.headOnlyBranches} |`,
+    `| Covered-to-uncovered branches | ${comparison.regressions.length} |`,
+    ''
+  ]
+
+  if (passed) {
+    lines.push('PASS: Critical branch coverage did not decrease.')
+    return lines.join('\n')
+  }
+
+  lines.push('| File | Line | Branch | Base | Head |')
+  lines.push('|---|--:|---|--:|--:|')
+
+  for (const regression of comparison.regressions.slice(0, 25)) {
+    lines.push(
+      `| \`${regression.file}\` | ${regression.line} | ${regression.block}:${regression.branch} | ${formatTaken(regression.baseTaken)} | ${formatTaken(regression.headTaken)} |`
+    )
+  }
+
+  if (comparison.regressions.length > 25) {
+    lines.push('')
+    lines.push(
+      `${comparison.regressions.length - 25} additional regressions omitted from this summary.`
+    )
+  }
+
+  return lines.join('\n')
+}
+
+function formatTaken(value: number | null): string {
+  return value === null ? '0' : String(value)
+}
+
+function formatSignedCount(value: number): string {
+  return value > 0 ? `+${value}` : String(value)
+}

scripts/critical-coverage/criticalCoverageDirs.ts

@@ -0,0 +1,45 @@
+export const CRITICAL_COVERAGE_DIRS = [
+  'src/base',
+  'src/composables',
+  'src/core',
+  'src/lib/litegraph/src/node',
+  'src/lib/litegraph/src/subgraph',
+  'src/lib/litegraph/src/utils',
+  'src/platform/assets/composables',
+  'src/platform/assets/mappings',
+  'src/platform/assets/schemas',
+  'src/platform/assets/services',
+  'src/platform/assets/utils',
+  'src/platform/errorCatalog',
+  'src/platform/keybindings',
+  'src/platform/missingMedia',
+  'src/platform/missingModel',
+  'src/platform/navigation',
+  'src/platform/nodeReplacement',
+  'src/platform/remote',
+  'src/platform/remoteConfig',
+  'src/platform/secrets',
+  'src/platform/settings',
+  'src/platform/workflow',
+  'src/platform/workspace/api',
+  'src/platform/workspace/auth',
+  'src/platform/workspace/composables',
+  'src/platform/workspace/stores',
+  'src/platform/workspace/utils',
+  'src/schemas',
+  'src/scripts',
+  'src/services',
+  'src/stores',
+  'src/utils',
+  'src/workbench/extensions/manager/composables',
+  'src/workbench/extensions/manager/services',
+  'src/workbench/extensions/manager/stores',
+  'src/workbench/extensions/manager/utils',
+  'src/workbench/utils'
+] as const
+
+export function isCriticalCoveragePath(filePath: string): boolean {
+  return CRITICAL_COVERAGE_DIRS.some(
+    (dir) => filePath === dir || filePath.startsWith(`${dir}/`)
+  )
+}

scripts/critical-coverage/criticalCoverageReport.ts

@@ -0,0 +1,322 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, isAbsolute, relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import {
+  CRITICAL_COVERAGE_DIRS,
+  isCriticalCoveragePath
+} from './criticalCoverageDirs'
+
+export interface CriticalBranchCoverage {
+  key: string
+  file: string
+  line: number
+  block: string
+  branch: string
+  taken: number | null
+  covered: boolean
+}
+
+export interface CriticalCoverageReport {
+  schemaVersion: 1
+  source: 'lcov'
+  sha: string
+  generatedAt: string
+  inputPath: string
+  criticalDirs: readonly string[]
+  totals: {
+    files: number
+    branches: number
+    coveredBranches: number
+  }
+  branches: CriticalBranchCoverage[]
+}
+
+export interface CriticalCoverageRegression extends CriticalBranchCoverage {
+  baseTaken: number | null
+  headTaken: number | null
+}
+
+export interface CriticalCoverageComparison {
+  baseSha: string
+  headSha: string
+  commonBranches: number
+  baseOnlyBranches: number
+  headOnlyBranches: number
+  commonCoveredBranchesInBase: number
+  commonCoveredBranchesInHead: number
+  coveredBranchDelta: number
+  regressions: CriticalCoverageRegression[]
+}
+
+interface CreateReportOptions {
+  inputPath: string
+  sha: string
+  generatedAt?: string
+  cwd?: string
+}
+
+export function createCriticalCoverageReport({
+  inputPath,
+  sha,
+  generatedAt = new Date().toISOString(),
+  cwd = process.cwd()
+}: CreateReportOptions): CriticalCoverageReport {
+  const lcov = readFileSync(inputPath, 'utf-8')
+  const branches = parseCriticalBranches(lcov, cwd)
+  const files = new Set(branches.map((branch) => branch.file))
+  const coveredBranches = branches.filter((branch) => branch.covered).length
+
+  return {
+    schemaVersion: 1,
+    source: 'lcov',
+    sha,
+    generatedAt,
+    inputPath,
+    criticalDirs: CRITICAL_COVERAGE_DIRS,
+    totals: {
+      files: files.size,
+      branches: branches.length,
+      coveredBranches
+    },
+    branches
+  }
+}
+
+export function writeCriticalCoverageReport(
+  report: CriticalCoverageReport,
+  outputPath: string
+): void {
+  mkdirSync(dirname(outputPath), { recursive: true })
+  writeFileSync(outputPath, `${JSON.stringify(report, null, 2)}\n`)
+}
+
+export function readCriticalCoverageReport(
+  inputPath: string
+): CriticalCoverageReport {
+  const parsed: unknown = JSON.parse(readFileSync(inputPath, 'utf-8'))
+
+  if (!isCriticalCoverageReport(parsed)) {
+    throw new Error(`Invalid critical coverage report: ${inputPath}`)
+  }
+
+  return parsed
+}
+
+export function compareCriticalCoverageReports(
+  base: CriticalCoverageReport,
+  head: CriticalCoverageReport
+): CriticalCoverageComparison {
+  const baseBranches = new Map(
+    base.branches.map((branch) => [branch.key, branch])
+  )
+  const headBranches = new Map(
+    head.branches.map((branch) => [branch.key, branch])
+  )
+  const regressions: CriticalCoverageRegression[] = []
+  let commonBranches = 0
+  let commonCoveredBranchesInBase = 0
+  let commonCoveredBranchesInHead = 0
+  let baseOnlyBranches = 0
+
+  for (const [key, baseBranch] of baseBranches) {
+    const headBranch = headBranches.get(key)
+
+    if (!headBranch) {
+      baseOnlyBranches++
+      continue
+    }
+
+    commonBranches++
+
+    if (baseBranch.covered) {
+      commonCoveredBranchesInBase++
+    }
+
+    if (headBranch.covered) {
+      commonCoveredBranchesInHead++
+    }
+
+    if (baseBranch.covered && !headBranch.covered) {
+      regressions.push({
+        ...baseBranch,
+        baseTaken: baseBranch.taken,
+        headTaken: headBranch.taken
+      })
+    }
+  }
+
+  return {
+    baseSha: base.sha,
+    headSha: head.sha,
+    commonBranches,
+    baseOnlyBranches,
+    headOnlyBranches: [...headBranches.keys()].filter(
+      (key) => !baseBranches.has(key)
+    ).length,
+    commonCoveredBranchesInBase,
+    commonCoveredBranchesInHead,
+    coveredBranchDelta:
+      commonCoveredBranchesInHead - commonCoveredBranchesInBase,
+    regressions: regressions.sort(compareBranches)
+  }
+}
+
+function parseCriticalBranches(
+  lcov: string,
+  cwd: string
+): CriticalBranchCoverage[] {
+  let currentFile = ''
+  const branches = new Map<string, CriticalBranchCoverage>()
+
+  for (const line of lcov.split('\n')) {
+    if (line.startsWith('SF:')) {
+      currentFile = normalizeCoveragePath(line.slice(3), cwd)
+      continue
+    }
+
+    if (!line.startsWith('BRDA:') || !isCriticalCoveragePath(currentFile)) {
+      continue
+    }
+
+    const branch = parseBranchData(currentFile, line.slice(5))
+    if (!branch) {
+      continue
+    }
+
+    const existing = branches.get(branch.key)
+    if (!existing) {
+      branches.set(branch.key, branch)
+      continue
+    }
+
+    branches.set(branch.key, mergeBranchCoverage(existing, branch))
+  }
+
+  return [...branches.values()].sort(compareBranches)
+}
+
+function parseBranchData(
+  file: string,
+  data: string
+): CriticalBranchCoverage | null {
+  const [lineValue, block, branch, takenValue] = data.split(',')
+  const line = Number(lineValue)
+
+  if (
+    !Number.isInteger(line) ||
+    !block ||
+    !branch ||
+    takenValue === undefined
+  ) {
+    return null
+  }
+
+  const taken = takenValue === '-' ? null : Number(takenValue)
+  const covered = taken !== null && Number.isFinite(taken) && taken > 0
+  const key = `${file}:${line}:${block}:${branch}`
+
+  return {
+    key,
+    file,
+    line,
+    block,
+    branch,
+    taken: Number.isFinite(taken) ? taken : null,
+    covered
+  }
+}
+
+function mergeBranchCoverage(
+  left: CriticalBranchCoverage,
+  right: CriticalBranchCoverage
+): CriticalBranchCoverage {
+  const taken =
+    left.taken === null || right.taken === null
+      ? null
+      : left.taken + right.taken
+
+  return {
+    ...left,
+    taken,
+    covered: left.covered || right.covered
+  }
+}
+
+function compareBranches(
+  left: CriticalBranchCoverage,
+  right: CriticalBranchCoverage
+): number {
+  return (
+    left.file.localeCompare(right.file) ||
+    left.line - right.line ||
+    left.block.localeCompare(right.block) ||
+    left.branch.localeCompare(right.branch)
+  )
+}
+
+function normalizeCoveragePath(filePath: string, cwd: string): string {
+  const decodedPath = filePath.startsWith('file://')
+    ? fileURLToPath(filePath)
+    : filePath
+
+  const relativePath = isAbsolute(decodedPath)
+    ? relative(cwd, decodedPath)
+    : decodedPath
+
+  const normalizedPath = relativePath.replace(/\\/g, '/').replace(/^\.\//, '')
+
+  if (!normalizedPath.startsWith('../')) {
+    return normalizedPath
+  }
+
+  const srcIndex = normalizedPath.indexOf('/src/')
+  return srcIndex === -1 ? normalizedPath : normalizedPath.slice(srcIndex + 1)
+}
+
+function isCriticalCoverageReport(
+  value: unknown
+): value is CriticalCoverageReport {
+  if (!isRecord(value)) {
+    return false
+  }
+
+  const totals = value.totals
+
+  return (
+    value.schemaVersion === 1 &&
+    value.source === 'lcov' &&
+    typeof value.sha === 'string' &&
+    typeof value.generatedAt === 'string' &&
+    typeof value.inputPath === 'string' &&
+    Array.isArray(value.criticalDirs) &&
+    isRecord(totals) &&
+    typeof totals.files === 'number' &&
+    typeof totals.branches === 'number' &&
+    typeof totals.coveredBranches === 'number' &&
+    Array.isArray(value.branches) &&
+    value.branches.every(isCriticalBranchCoverage)
+  )
+}
+
+function isCriticalBranchCoverage(
+  value: unknown
+): value is CriticalBranchCoverage {
+  if (!isRecord(value)) {
+    return false
+  }
+
+  return (
+    typeof value.key === 'string' &&
+    typeof value.file === 'string' &&
+    typeof value.line === 'number' &&
+    typeof value.block === 'string' &&
+    typeof value.branch === 'string' &&
+    (typeof value.taken === 'number' || value.taken === null) &&
+    typeof value.covered === 'boolean'
+  )
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+}

scripts/critical-coverage/extractCriticalCoverage.ts

@@ -0,0 +1,58 @@
+import {
+  createCriticalCoverageReport,
+  writeCriticalCoverageReport
+} from './criticalCoverageReport'
+
+interface Options {
+  input: string
+  output: string
+  sha: string
+}
+
+const options = parseOptions(process.argv.slice(2))
+const report = createCriticalCoverageReport({
+  inputPath: options.input,
+  sha: options.sha
+})
+
+writeCriticalCoverageReport(report, options.output)
+
+process.stdout.write(
+  [
+    `Critical coverage branches: ${report.totals.coveredBranches}/${report.totals.branches}`,
+    `Critical coverage files: ${report.totals.files}`,
+    `Wrote ${options.output}`
+  ].join('\n') + '\n'
+)
+
+function parseOptions(args: string[]): Options {
+  const options: Options = {
+    input: 'coverage/lcov.info',
+    output: 'coverage/critical-unit-coverage.json',
+    sha: process.env.GITHUB_SHA ?? 'unknown'
+  }
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    const next = args[i + 1]
+
+    if (arg === '--input' && next) {
+      options.input = next
+      i++
+    } else if (arg.startsWith('--input=')) {
+      options.input = arg.slice('--input='.length)
+    } else if (arg === '--output' && next) {
+      options.output = next
+      i++
+    } else if (arg.startsWith('--output=')) {
+      options.output = arg.slice('--output='.length)
+    } else if (arg === '--sha' && next) {
+      options.sha = next
+      i++
+    } else if (arg.startsWith('--sha=')) {
+      options.sha = arg.slice('--sha='.length)
+    }
+  }
+
+  return options
+}

src/base/common/async.test.ts

@@ -0,0 +1,102 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+type IdleCallback = (deadline: {
+  didTimeout: boolean
+  timeRemaining(): number
+}) => void
+
+async function importRunWhenGlobalIdle() {
+  vi.resetModules()
+  return (await import('@/base/common/async')).runWhenGlobalIdle
+}
+
+describe('runWhenGlobalIdle', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.unstubAllGlobals()
+    vi.resetModules()
+  })
+
+  it('uses a timer fallback when idle callbacks are unavailable', async () => {
+    vi.useFakeTimers()
+    vi.stubGlobal('requestIdleCallback', undefined)
+    vi.stubGlobal('cancelIdleCallback', undefined)
+
+    const runWhenGlobalIdle = await importRunWhenGlobalIdle()
+    const callback = vi.fn<IdleCallback>()
+
+    runWhenGlobalIdle(callback)
+
+    expect(callback).not.toHaveBeenCalled()
+
+    vi.runOnlyPendingTimers()
+
+    expect(callback).toHaveBeenCalledOnce()
+
+    const [deadline] = callback.mock.calls[0]
+    expect(deadline.didTimeout).toBe(true)
+    expect(deadline.timeRemaining()).toBeGreaterThanOrEqual(0)
+    expect(Object.isFrozen(deadline)).toBe(true)
+  })
+
+  it('can dispose a fallback callback before the timer runs', async () => {
+    vi.useFakeTimers()
+    vi.stubGlobal('requestIdleCallback', undefined)
+    vi.stubGlobal('cancelIdleCallback', undefined)
+
+    const runWhenGlobalIdle = await importRunWhenGlobalIdle()
+    const callback = vi.fn<IdleCallback>()
+
+    const idleRunner = runWhenGlobalIdle(callback)
+    idleRunner.dispose()
+    idleRunner.dispose()
+
+    vi.runOnlyPendingTimers()
+
+    expect(callback).not.toHaveBeenCalled()
+  })
+
+  it('uses native idle callbacks when available', async () => {
+    let idleCallback: IdleRequestCallback | undefined
+    const requestIdleCallback = vi.fn(
+      (callback: IdleRequestCallback, options?: IdleRequestOptions) => {
+        idleCallback = callback
+        expect(options).toEqual({ timeout: 50 })
+        return 7
+      }
+    )
+    const cancelIdleCallback = vi.fn()
+    vi.stubGlobal('requestIdleCallback', requestIdleCallback)
+    vi.stubGlobal('cancelIdleCallback', cancelIdleCallback)
+
+    const runWhenGlobalIdle = await importRunWhenGlobalIdle()
+    const callback = vi.fn<IdleCallback>()
+
+    const idleRunner = runWhenGlobalIdle(callback, 50)
+    idleCallback?.({ didTimeout: false, timeRemaining: () => 10 })
+    idleRunner.dispose()
+    idleRunner.dispose()
+
+    expect(requestIdleCallback).toHaveBeenCalledOnce()
+    expect(callback).toHaveBeenCalledWith({
+      didTimeout: false,
+      timeRemaining: expect.any(Function)
+    })
+    expect(cancelIdleCallback).toHaveBeenCalledExactlyOnceWith(7)
+  })
+
+  it('omits native idle timeout options when no timeout is provided', async () => {
+    const requestIdleCallback = vi.fn(() => 9)
+    vi.stubGlobal('requestIdleCallback', requestIdleCallback)
+    vi.stubGlobal('cancelIdleCallback', vi.fn())
+
+    const runWhenGlobalIdle = await importRunWhenGlobalIdle()
+
+    runWhenGlobalIdle(vi.fn())
+
+    expect(requestIdleCallback).toHaveBeenCalledWith(
+      expect.any(Function),
+      undefined
+    )
+  })
+})

src/components/LiteGraphCanvasSplitterOverlay.vue

@@ -35,10 +35,10 @@
           :class="
             sidebarLocation === 'left'
               ? cn(
-                  'side-bar-panel pointer-events-auto bg-comfy-menu-bg',
+                  'side-bar-panel pointer-events-auto bg-comfy-menu-bg focus-visible:outline-hidden',
                   sidebarPanelVisible && 'min-w-78'
                 )
-              : 'pointer-events-auto bg-comfy-menu-bg'
+              : 'pointer-events-auto bg-comfy-menu-bg focus-visible:outline-hidden'
           "
           :min-size="
             sidebarLocation === 'left' ? SIDEBAR_MIN_SIZE : BUILDER_MIN_SIZE
@@ -82,7 +82,7 @@
             </SplitterPanel>
             <SplitterPanel
               v-show="bottomPanelVisible && !focusMode"
-              class="bottom-panel pointer-events-auto max-w-full overflow-x-auto rounded-lg border border-(--p-panel-border-color) bg-comfy-menu-bg"
+              class="bottom-panel pointer-events-auto max-w-full overflow-x-auto rounded-lg border border-(--p-panel-border-color) bg-comfy-menu-bg focus-visible:outline-hidden"
             >
               <slot name="bottom-panel" />
             </SplitterPanel>
@@ -95,10 +95,10 @@
           :class="
             sidebarLocation === 'right'
               ? cn(
-                  'side-bar-panel pointer-events-auto bg-comfy-menu-bg',
+                  'side-bar-panel pointer-events-auto bg-comfy-menu-bg focus-visible:outline-hidden',
                   sidebarPanelVisible && 'min-w-78'
                 )
-              : 'pointer-events-auto bg-comfy-menu-bg'
+              : 'pointer-events-auto bg-comfy-menu-bg focus-visible:outline-hidden'
           "
           :min-size="
             sidebarLocation === 'right' ? SIDEBAR_MIN_SIZE : BUILDER_MIN_SIZE

src/components/dialog/content/signin/SignUpForm.test.ts

@@ -7,7 +7,7 @@ import Password from 'primevue/password'
 import PrimeVue from 'primevue/config'
 import ProgressSpinner from 'primevue/progressspinner'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { defineComponent, h, nextTick, ref } from 'vue'
+import { computed, defineComponent, h, nextTick, ref } from 'vue'
 import { createI18n } from 'vue-i18n'
 
 import enMessages from '@/locales/en/main.json' with { type: 'json' }
@@ -38,29 +38,45 @@ vi.mock('@/stores/authStore', () => ({
 }))
 
 const mockTurnstileEnabled = ref(false)
-const mockTurnstileEnforced = ref(false)
+const mockTurnstileToken = ref('')
+const mockTurnstileUnavailable = ref(false)
 const mockReset = vi.fn()
 let emitTurnstileToken: ((token: string) => void) | undefined
+let emitTurnstileUnavailable: ((unavailable: boolean) => void) | undefined
 
+// The reset-on-toggle behavior lives in useTurnstileGate itself (see
+// useTurnstile.test.ts); this fake just wires token/unavailable through to
+// `waiting` the same way so SignUpForm's submit gating can be exercised.
 vi.mock('@/composables/auth/useTurnstile', () => ({
   useTurnstile: () => ({
-    enabled: mockTurnstileEnabled,
-    enforced: mockTurnstileEnforced
+    enabled: mockTurnstileEnabled
+  }),
+  useTurnstileGate: () => ({
+    token: mockTurnstileToken,
+    unavailable: mockTurnstileUnavailable,
+    waiting: computed(
+      () =>
+        mockTurnstileEnabled.value &&
+        !mockTurnstileToken.value &&
+        !mockTurnstileUnavailable.value
+    )
   })
 }))
 
 // Stub the real widget (which loads the external Turnstile script) with one that
-// exposes a spyable reset() and lets a test drive the v-model token the way a
-// solved challenge would.
+// exposes a spyable reset() and lets a test drive the v-model token/unavailable
+// the way a solved challenge (or a broken/slow widget) would.
 vi.mock('./TurnstileWidget.vue', async () => {
   const { defineComponent: defineMock } = await import('vue')
   return {
     default: defineMock({
       name: 'TurnstileWidget',
-      emits: ['update:token'],
+      emits: ['update:token', 'update:unavailable'],
       setup(_, { expose, emit }) {
         expose({ reset: mockReset })
         emitTurnstileToken = (token: string) => emit('update:token', token)
+        emitTurnstileUnavailable = (unavailable: boolean) =>
+          emit('update:unavailable', unavailable)
         return () => null
       }
     })
@@ -92,9 +108,11 @@ describe('SignUpForm', () => {
   beforeEach(() => {
     mockLoadingRef.value = false
     mockTurnstileEnabled.value = false
-    mockTurnstileEnforced.value = false
+    mockTurnstileToken.value = ''
+    mockTurnstileUnavailable.value = false
     mockReset.mockClear()
     emitTurnstileToken = undefined
+    emitTurnstileUnavailable = undefined
   })
 
   afterEach(() => {
@@ -211,43 +229,22 @@ describe('SignUpForm', () => {
     })
   })
 
-  describe('Turnstile token hygiene', () => {
-    it('clears the stale token when Turnstile becomes disabled', async () => {
-      mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = true
-      const { user } = renderComponent()
-      await fillValidSignup(user)
-
-      emitTurnstileToken!('stale-token')
-      await nextTick()
-      expect(
-        screen.getByRole('button', { name: signUpButton })
-      ).not.toBeDisabled()
-
-      mockTurnstileEnabled.value = false
-      await nextTick()
-
-      // re-enable: the stale token must have been cleared so submit is blocked again
-      mockTurnstileEnabled.value = true
-      await nextTick()
-
-      expect(screen.getByRole('button', { name: signUpButton })).toBeDisabled()
-    })
-  })
-
+  // Regression coverage for the shadow-mode race: previously submit was only
+  // gated in 'enforce' mode, so most real signups in 'shadow' mode raced
+  // ahead of the async Cloudflare challenge and reached the backend with an
+  // empty token. Gating now depends only on whether the widget is enabled
+  // (shadow or enforce both render it), so both modes behave identically here.
   describe('Turnstile submit gating', () => {
-    it('disables the submit button in enforce mode until a token is present', async () => {
+    it('disables the submit button until a token is present', async () => {
       mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = true
       renderComponent()
       await nextTick()
 
       expect(screen.getByRole('button', { name: signUpButton })).toBeDisabled()
     })
 
-    it('does not emit submit in enforce mode while the token is empty', async () => {
+    it('does not emit submit while the token is empty', async () => {
       mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = true
       const onSubmit = vi.fn()
       const { user } = renderComponent({ onSubmit })
       await fillValidSignup(user)
@@ -257,9 +254,8 @@ describe('SignUpForm', () => {
       expect(onSubmit).not.toHaveBeenCalled()
     })
 
-    it('emits submit with the token in enforce mode once the challenge is solved', async () => {
+    it('emits submit with the token once the challenge is solved', async () => {
       mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = true
       const onSubmit = vi.fn()
       const { user } = renderComponent({ onSubmit })
       await fillValidSignup(user)
@@ -271,13 +267,14 @@ describe('SignUpForm', () => {
       expect(onSubmit).toHaveBeenCalledWith(expectedValues, 'token-xyz')
     })
 
-    it('emits submit without a token in shadow mode (never blocks)', async () => {
+    it('emits submit without a token once the widget reports itself unavailable (broken/slow load fallback)', async () => {
       mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = false
       const onSubmit = vi.fn()
       const { user } = renderComponent({ onSubmit })
       await fillValidSignup(user)
 
+      emitTurnstileUnavailable!(true)
+      await nextTick()
       await user.click(screen.getByRole('button', { name: signUpButton }))
 
       expect(onSubmit).toHaveBeenCalledWith(expectedValues, undefined)

src/components/dialog/content/signin/SignUpForm.vue

@@ -33,10 +33,11 @@
       v-if="turnstileEnabled"
       ref="turnstileWidget"
       v-model:token="turnstileToken"
+      v-model:unavailable="turnstileUnavailable"
     />
 
     <small
-      v-show="submitBlockedByTurnstile"
+      v-show="waitingForTurnstile"
       id="comfy-org-sign-up-turnstile-hint"
       role="status"
       aria-live="polite"
@@ -51,11 +52,9 @@
       v-else
       type="submit"
       class="mt-4 h-10 font-medium"
-      :disabled="!$form.valid || submitBlockedByTurnstile"
+      :disabled="!$form.valid || waitingForTurnstile"
       :aria-describedby="
-        submitBlockedByTurnstile
-          ? 'comfy-org-sign-up-turnstile-hint'
-          : undefined
+        waitingForTurnstile ? 'comfy-org-sign-up-turnstile-hint' : undefined
       "
     >
       {{ t('auth.signup.signUpButton') }}
@@ -70,11 +69,11 @@ import { zodResolver } from '@primevue/forms/resolvers/zod'
 import { useThrottleFn } from '@vueuse/core'
 import InputText from 'primevue/inputtext'
 import ProgressSpinner from 'primevue/progressspinner'
-import { computed, ref, useTemplateRef, watch } from 'vue'
+import { computed, useTemplateRef } from 'vue'
 import { useI18n } from 'vue-i18n'
 
 import Button from '@/components/ui/button/Button.vue'
-import { useTurnstile } from '@/composables/auth/useTurnstile'
+import { useTurnstile, useTurnstileGate } from '@/composables/auth/useTurnstile'
 import { signUpSchema } from '@/schemas/signInSchema'
 import type { SignUpData } from '@/schemas/signInSchema'
 import { useAuthStore } from '@/stores/authStore'
@@ -86,25 +85,21 @@ const { t } = useI18n()
 const authStore = useAuthStore()
 const loading = computed(() => authStore.loading)
 
-const { enabled: turnstileEnabled, enforced: turnstileEnforced } =
-  useTurnstile()
-const turnstileToken = ref('')
+const { enabled: turnstileEnabled } = useTurnstile()
+const {
+  token: turnstileToken,
+  unavailable: turnstileUnavailable,
+  waiting: waitingForTurnstile
+} = useTurnstileGate(turnstileEnabled)
 const turnstileWidget =
   useTemplateRef<InstanceType<typeof TurnstileWidget>>('turnstileWidget')
-const submitBlockedByTurnstile = computed(
-  () => turnstileEnforced.value && !turnstileToken.value
-)
-
-watch(turnstileEnabled, (on) => {
-  if (!on) turnstileToken.value = ''
-})
 
 const emit = defineEmits<{
   submit: [values: SignUpData, turnstileToken?: string]
 }>()
 
 const onSubmit = useThrottleFn((event: FormSubmitEvent) => {
-  if (event.valid && !submitBlockedByTurnstile.value) {
+  if (event.valid && !waitingForTurnstile.value) {
     emit(
       'submit',
       event.values as SignUpData,

src/components/dialog/content/signin/TurnstileWidget.test.ts

@@ -261,4 +261,138 @@ describe('TurnstileWidget', () => {
 
     expect(api.remove).toHaveBeenCalledWith('widget-id')
   })
+
+  // A widget that never resolves (broken script, ad-blocker, CDN outage, or a
+  // hung challenge) must eventually tell the parent it cannot be relied on,
+  // so submission can fall back instead of blocking a legitimate signup
+  // forever.
+  describe('unavailable fallback', () => {
+    it('reports unavailable when the Turnstile script fails to load', async () => {
+      mockLoadTurnstile.mockRejectedValue(new Error('script failed'))
+
+      const { emitted } = renderWidget()
+      await flush()
+
+      expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+    })
+
+    it('reports unavailable on a challenge error', async () => {
+      const { api, options } = fakeTurnstile()
+      mockLoadTurnstile.mockResolvedValue(api)
+
+      const { emitted } = renderWidget()
+      await flush()
+
+      options()!['error-callback']!()
+      await flush()
+
+      expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+    })
+
+    it('clears the unavailable fallback once a token is solved', async () => {
+      const { api, options } = fakeTurnstile()
+      mockLoadTurnstile.mockResolvedValue(api)
+
+      const { emitted } = renderWidget()
+      await flush()
+
+      options()!['error-callback']!()
+      await flush()
+      expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+
+      options()!.callback!('token-abc')
+      await flush()
+
+      expect(emitted()['update:unavailable']?.at(-1)).toEqual([false])
+    })
+
+    it('falls back once the widget fails to resolve within the load timeout', async () => {
+      vi.useFakeTimers()
+      try {
+        const { api, options } = fakeTurnstile()
+        mockLoadTurnstile.mockResolvedValue(api)
+
+        const { emitted } = renderWidget()
+        // Let the onMounted hook's `await loadTurnstile()` microtask settle
+        // and render() run, without yet advancing to the timeout itself.
+        await vi.advanceTimersByTimeAsync(0)
+        expect(options()).toBeDefined()
+        expect(emitted()['update:unavailable']).toBeUndefined()
+
+        await vi.advanceTimersByTimeAsync(9_000)
+
+        expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('does not fall back once a token arrives before the load timeout', async () => {
+      vi.useFakeTimers()
+      try {
+        const { api, options } = fakeTurnstile()
+        mockLoadTurnstile.mockResolvedValue(api)
+
+        const { emitted } = renderWidget()
+        await vi.advanceTimersByTimeAsync(0)
+
+        options()!.callback!('token-abc')
+        await vi.advanceTimersByTimeAsync(9_000)
+
+        expect(emitted()['update:unavailable']).toBeUndefined()
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('resets the widget to fetch a fresh challenge on token expiry', async () => {
+      const { api, options } = fakeTurnstile()
+      mockLoadTurnstile.mockResolvedValue(api)
+      window.turnstile = api as unknown as NonNullable<Window['turnstile']>
+
+      renderWidget()
+      await flush()
+
+      options()!.callback!('token-abc')
+      options()!['expired-callback']!()
+      await flush()
+
+      expect(api.reset).toHaveBeenCalledWith('widget-id')
+    })
+
+    it('falls back if a post-solve expiry is not followed by a fresh token within the load timeout', async () => {
+      vi.useFakeTimers()
+      try {
+        const { api, options } = fakeTurnstile()
+        mockLoadTurnstile.mockResolvedValue(api)
+        window.turnstile = api as unknown as NonNullable<Window['turnstile']>
+
+        const { emitted } = renderWidget()
+        await vi.advanceTimersByTimeAsync(0)
+
+        // Establish a solved, available widget: an initial error marks it
+        // unavailable, then solving a challenge clears that (the same
+        // transition the existing "clears the unavailable fallback" test
+        // verifies), so the expiry below is the only thing driving fallback.
+        options()!['error-callback']!()
+        options()!.callback!('token-abc')
+        expect(emitted()['update:unavailable']?.at(-1)).toEqual([false])
+
+        // The token later expires (e.g. tab backgrounded past its ~300s
+        // lifetime) without the widget itself erroring.
+        options()!['expired-callback']!()
+        await vi.advanceTimersByTimeAsync(0)
+
+        // A fresh challenge was requested, but nothing solves it before the
+        // re-armed load timeout elapses, so submission must eventually be
+        // unblocked rather than staying stuck forever.
+        expect(emitted()['update:unavailable']?.at(-1)).toEqual([false])
+        await vi.advanceTimersByTimeAsync(9_000)
+
+        expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+  })
 })

src/components/dialog/content/signin/TurnstileWidget.vue

@@ -12,6 +12,7 @@
 </template>
 
 <script setup lang="ts">
+import { useTimeoutFn } from '@vueuse/core'
 import { onBeforeUnmount, onMounted, ref } from 'vue'
 import { useI18n } from 'vue-i18n'
 
@@ -20,6 +21,14 @@ import { getTurnstileSiteKey } from '@/config/turnstile'
 import { useColorPaletteStore } from '@/stores/workspace/colorPaletteStore'
 
 const token = defineModel<string>('token', { default: '' })
+/**
+ * Set true whenever the widget cannot be relied on to ever produce a token:
+ * the Cloudflare script failed to load, the rendered challenge errored out,
+ * or it simply hasn't resolved within `TURNSTILE_LOAD_TIMEOUT_MS`. The parent
+ * uses this to stop waiting on a token so a broken/slow widget (network
+ * issue, ad-blocker, CDN outage) can never permanently block signup.
+ */
+const unavailable = defineModel<boolean>('unavailable', { default: false })
 
 const { t } = useI18n()
 const colorPaletteStore = useColorPaletteStore()
@@ -28,6 +37,16 @@ const containerRef = ref<HTMLDivElement>()
 const errorMessage = ref('')
 let widgetId: string | undefined
 
+/** How long to wait for the widget to resolve before falling back. */
+const TURNSTILE_LOAD_TIMEOUT_MS = 9_000
+const { start: armTimeout, stop: clearLoadTimeout } = useTimeoutFn(
+  () => {
+    unavailable.value = true
+  },
+  TURNSTILE_LOAD_TIMEOUT_MS,
+  { immediate: false }
+)
+
 const clearToken = () => {
   token.value = ''
 }
@@ -46,12 +65,18 @@ const reset = () => {
   errorMessage.value = ''
   if (widgetId && window.turnstile) {
     window.turnstile.reset(widgetId)
+    // A widget that renders can request a fresh challenge, so give it
+    // another chance before falling back again.
+    unavailable.value = false
+    armTimeout()
   }
 }
 
 defineExpose({ reset })
 
 onMounted(async () => {
+  armTimeout()
+
   try {
     const turnstile = await loadTurnstile()
     if (!containerRef.value) return
@@ -64,23 +89,37 @@ onMounted(async () => {
       sitekey: getTurnstileSiteKey(),
       theme,
       callback: (newToken: string) => {
+        clearLoadTimeout()
         errorMessage.value = ''
+        unavailable.value = false
         token.value = newToken
       },
       'expired-callback': () => {
         clearToken()
         errorMessage.value = t('auth.turnstile.expired')
+        if (widgetId && window.turnstile) {
+          window.turnstile.reset(widgetId)
+          // A solved token can expire on its own (e.g. the tab was
+          // backgrounded past the token's ~300s lifetime) without the widget
+          // ever erroring, so proactively request a fresh challenge and
+          // re-arm the load timeout in case it doesn't resolve in time.
+          armTimeout()
+        }
       },
       'error-callback': () => {
         clearToken()
+        clearLoadTimeout()
         console.warn('Turnstile challenge failed')
         errorMessage.value = t('auth.turnstile.failed')
+        unavailable.value = true
         if (widgetId && window.turnstile) window.turnstile.reset(widgetId)
       }
     })
   } catch (error) {
+    clearLoadTimeout()
     console.warn('Turnstile failed to load', error)
     errorMessage.value = t('auth.turnstile.failed')
+    unavailable.value = true
   }
 })
 

src/composables/auth/useTurnstile.test.ts

@@ -1,9 +1,11 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { nextTick, ref } from 'vue'
 
 import {
   isTurnstileEnabled,
   normalizeTurnstileMode,
-  useTurnstile
+  useTurnstile,
+  useTurnstileGate
 } from '@/composables/auth/useTurnstile'
 import { getTurnstileSiteKey } from '@/config/turnstile'
 import { remoteConfig } from '@/platform/remoteConfig/remoteConfig'
@@ -137,3 +139,63 @@ describe('useTurnstile', () => {
     })
   })
 })
+
+describe('useTurnstileGate', () => {
+  it('waits while enabled with no token yet', () => {
+    const { waiting } = useTurnstileGate(ref(true))
+    expect(waiting.value).toBe(true)
+  })
+
+  it('never waits while disabled', () => {
+    const { waiting } = useTurnstileGate(ref(false))
+    expect(waiting.value).toBe(false)
+  })
+
+  it('stops waiting once a token arrives', () => {
+    const { token, waiting } = useTurnstileGate(ref(true))
+
+    token.value = 'token-abc'
+
+    expect(waiting.value).toBe(false)
+  })
+
+  it('stops waiting once the widget reports itself unavailable', () => {
+    const { unavailable, waiting } = useTurnstileGate(ref(true))
+
+    unavailable.value = true
+
+    expect(waiting.value).toBe(false)
+  })
+
+  it('clears stale token/unavailable state when enabled turns off', async () => {
+    const enabled = ref(true)
+    const { token, unavailable } = useTurnstileGate(enabled)
+    token.value = 'stale-token'
+    unavailable.value = true
+
+    enabled.value = false
+    await nextTick()
+
+    expect(token.value).toBe('')
+    expect(unavailable.value).toBe(false)
+  })
+
+  // Regression coverage: the reset used to only run on the enabled->disabled
+  // transition, so state written while the widget was briefly disabled could
+  // survive into the next enabled widget instance.
+  it('clears stale token/unavailable state when enabled turns back on', async () => {
+    const enabled = ref(true)
+    const { token, unavailable } = useTurnstileGate(enabled)
+
+    enabled.value = false
+    await nextTick()
+    token.value = 'stale-token'
+    unavailable.value = true
+
+    enabled.value = true
+    await nextTick()
+
+    expect(token.value).toBe('')
+    expect(unavailable.value).toBe(false)
+  })
+})

src/composables/auth/useTurnstile.ts

@@ -1,4 +1,5 @@
-import { computed } from 'vue'
+import { computed, ref, watch } from 'vue'
+import type { Ref } from 'vue'
 
 import { getTurnstileSiteKey } from '@/config/turnstile'
 import { useFeatureFlags } from '@/composables/useFeatureFlags'
@@ -42,3 +43,31 @@ export function useTurnstile() {
 
   return { mode, siteKey, enabled, enforced }
 }
+
+/**
+ * Submit-gating state for the signup form's Turnstile widget: a token/
+ * unavailable pair, plus `waiting`, which is true while a real token is still
+ * needed. Waits in both shadow and enforce mode (`enabled`), not just
+ * `enforced`, so shadow mode's token can't race the async Cloudflare
+ * challenge; falls back open once the widget reports `unavailable` so a
+ * broken/slow load can never permanently block signup.
+ *
+ * `token`/`unavailable` reset on every `enabled` transition, in either
+ * direction, so state from a previous widget instance can never leak into a
+ * freshly (re-)rendered one.
+ */
+export function useTurnstileGate(enabled: Ref<boolean>) {
+  const token = ref('')
+  const unavailable = ref(false)
+
+  const waiting = computed(
+    () => enabled.value && !token.value && !unavailable.value
+  )
+
+  watch(enabled, () => {
+    token.value = ''
+    unavailable.value = false
+  })
+
+  return { token, unavailable, waiting }
+}

src/lib/litegraph/src/utils/arrange.test.ts

@@ -0,0 +1,102 @@
+import { fromAny } from '@total-typescript/shoehorn'
+import { describe, expect, it, vi } from 'vitest'
+
+import type { LGraphNode } from '../LGraphNode'
+import type { Direction } from '../interfaces'
+import { alignNodes, distributeNodes, getBoundaryNodes } from './arrange'
+
+function createNode(pos: [number, number], size: [number, number]): LGraphNode {
+  const node = {
+    pos: [...pos],
+    size: [...size],
+    setPos: vi.fn((x: number, y: number) => {
+      node.pos = [x, y]
+    })
+  }
+
+  return fromAny<LGraphNode, unknown>(node)
+}
+
+describe('getBoundaryNodes', () => {
+  it('returns null when there are no nodes', () => {
+    expect(getBoundaryNodes([])).toBeNull()
+  })
+
+  it('finds the farthest node in each direction', () => {
+    const top = createNode([20, -10], [10, 10])
+    const right = createNode([80, 10], [30, 10])
+    const bottom = createNode([10, 40], [10, 30])
+    const left = createNode([-15, 0], [10, 10])
+
+    expect(getBoundaryNodes([top, right, bottom, left])).toEqual({
+      top,
+      right,
+      bottom,
+      left
+    })
+  })
+})
+
+describe('distributeNodes', () => {
+  it('returns no positions when fewer than two nodes are provided', () => {
+    expect(distributeNodes([])).toEqual([])
+    expect(distributeNodes([createNode([0, 0], [10, 10])])).toEqual([])
+  })
+
+  it('distributes nodes horizontally by preserving boundary edges', () => {
+    const first = createNode([0, 0], [10, 10])
+    const second = createNode([40, 0], [20, 10])
+    const third = createNode([100, 0], [10, 10])
+
+    const positions = distributeNodes([third, first, second], true)
+
+    expect(positions.map(({ node, newPos }) => [node, newPos.x])).toEqual([
+      [first, 0],
+      [second, 45],
+      [third, 100]
+    ])
+  })
+
+  it('distributes nodes vertically by preserving boundary edges', () => {
+    const first = createNode([0, 0], [10, 10])
+    const second = createNode([0, 30], [10, 20])
+    const third = createNode([0, 90], [10, 10])
+
+    const positions = distributeNodes([third, first, second])
+
+    expect(positions.map(({ node, newPos }) => [node, newPos.y])).toEqual([
+      [first, 0],
+      [second, 40],
+      [third, 90]
+    ])
+  })
+})
+
+describe('alignNodes', () => {
+  it.for([
+    { direction: 'left', expectedPos: [10, 25] },
+    { direction: 'right', expectedPos: [70, 25] },
+    { direction: 'top', expectedPos: [40, 5] },
+    { direction: 'bottom', expectedPos: [40, 45] }
+  ] satisfies Array<{ direction: Direction; expectedPos: [number, number] }>)(
+    'aligns nodes to the $direction boundary',
+    ({ direction, expectedPos }) => {
+      const boundary = createNode([10, 5], [80, 60])
+      const node = createNode([40, 25], [20, 20])
+
+      const [position] = alignNodes([boundary, node], direction)
+
+      expect(position.node).toBe(boundary)
+      expect(node.pos).toEqual(expectedPos)
+    }
+  )
+
+  it('aligns to an explicit target node', () => {
+    const target = createNode([100, 200], [50, 60])
+    const node = createNode([0, 0], [10, 20])
+
+    alignNodes([node], 'bottom', target)
+
+    expect(node.pos).toEqual([0, 240])
+  })
+})

src/platform/telemetry/providers/cloud/PostHogTelemetryProvider.test.ts

@@ -195,6 +195,46 @@ describe('PostHogTelemetryProvider', () => {
     })
   })
 
+  describe('platform axes (client / deployment)', () => {
+    afterEach(() => {
+      delete window.__comfyDesktop2
+    })
+
+    it('registers client=web and deployment=cloud in a plain browser', async () => {
+      createProvider()
+      await vi.dynamicImportSettled()
+
+      expect(hoisted.mockRegister).toHaveBeenCalledWith({
+        client: 'web',
+        deployment: 'cloud'
+      })
+    })
+
+    it('registers client=desktop when the desktop preload bridge is present', async () => {
+      window.__comfyDesktop2 = {
+        isRemote: () => false,
+        Telemetry: { capture: vi.fn() }
+      }
+      createProvider()
+      await vi.dynamicImportSettled()
+
+      expect(hoisted.mockRegister).toHaveBeenCalledWith({
+        client: 'desktop',
+        deployment: 'cloud'
+      })
+    })
+
+    it('registers platform axes before flushing pre-init queued events', async () => {
+      const provider = createProvider()
+      provider.trackSignupOpened()
+      await vi.dynamicImportSettled()
+
+      const registerOrder = hoisted.mockRegister.mock.invocationCallOrder[0]
+      const captureOrder = hoisted.mockCapture.mock.invocationCallOrder[0]
+      expect(registerOrder).toBeLessThan(captureOrder)
+    })
+  })
+
   describe('desktop entry capture', () => {
     function setLocation(search: string): void {
       Object.defineProperty(window.location, 'search', {
@@ -208,12 +248,20 @@ describe('PostHogTelemetryProvider', () => {
       setLocation('')
     })
 
+    // The platform-axes register (client/deployment) always fires, so these
+    // assert no register call carrying desktop-entry attribution props.
+    function desktopEntryRegisterCalls(): unknown[][] {
+      return hoisted.mockRegister.mock.calls.filter(
+        ([props]) => props && 'source_app' in (props as Record<string, unknown>)
+      )
+    }
+
     it('does not register desktop props when utm_source is absent', async () => {
       setLocation('')
       createProvider()
       await vi.dynamicImportSettled()
 
-      expect(hoisted.mockRegister).not.toHaveBeenCalled()
+      expect(desktopEntryRegisterCalls()).toHaveLength(0)
     })
 
     it('does not register desktop props when utm_source is not comfy.desktop', async () => {
@@ -221,7 +269,7 @@ describe('PostHogTelemetryProvider', () => {
       createProvider()
       await vi.dynamicImportSettled()
 
-      expect(hoisted.mockRegister).not.toHaveBeenCalled()
+      expect(desktopEntryRegisterCalls()).toHaveLength(0)
     })
 
     it('registers source_app and desktop_device_id when arriving from desktop', async () => {

src/platform/telemetry/providers/cloud/PostHogTelemetryProvider.ts

@@ -143,6 +143,9 @@ export class PostHogTelemetryProvider implements TelemetryProvider {
               before_send: createPostHogBeforeSend()
             })
             this.isInitialized = true
+            // Before flushEventQueue so pre-init events also carry the
+            // platform super properties.
+            this.registerPlatformProps()
             this.flushEventQueue()
             this.registerDesktopEntryProps()
 
@@ -285,6 +288,18 @@ export class PostHogTelemetryProvider implements TelemetryProvider {
     )
   }
 
+  private registerPlatformProps(): void {
+    if (!this.posthog) return
+    try {
+      this.posthog.register({
+        client: window.__comfyDesktop2 ? 'desktop' : 'web',
+        deployment: 'cloud'
+      })
+    } catch (error) {
+      console.error('Failed to register platform props:', error)
+    }
+  }
+
   private registerDesktopEntryProps(): void {
     if (!this.posthog) return
     const props = readDesktopEntryProps()

src/utils/appMode.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest'
+
+import { getWorkflowMode, isAppModeValue } from '@/utils/appMode'
+
+describe('getWorkflowMode', () => {
+  it('prefers active mode over initial mode', () => {
+    expect(
+      getWorkflowMode({
+        activeMode: 'builder:arrange',
+        initialMode: 'app'
+      })
+    ).toBe('builder:arrange')
+  })
+
+  it('falls back to initial mode', () => {
+    expect(
+      getWorkflowMode({
+        activeMode: null,
+        initialMode: 'builder:inputs'
+      })
+    ).toBe('builder:inputs')
+  })
+
+  it('defaults to graph mode', () => {
+    expect(getWorkflowMode(null)).toBe('graph')
+    expect(
+      getWorkflowMode({
+        activeMode: null,
+        initialMode: undefined
+      })
+    ).toBe('graph')
+  })
+})
+
+describe('isAppModeValue', () => {
+  it('recognizes app-style modes', () => {
+    expect(isAppModeValue('app')).toBe(true)
+    expect(isAppModeValue('builder:arrange')).toBe(true)
+  })
+
+  it('rejects graph and builder panel modes', () => {
+    expect(isAppModeValue('graph')).toBe(false)
+    expect(isAppModeValue('builder:inputs')).toBe(false)
+    expect(isAppModeValue('builder:outputs')).toBe(false)
+  })
+})

src/utils/gridUtil.test.ts

@@ -0,0 +1,51 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { createGridStyle } from '@/utils/gridUtil'
+
+describe('createGridStyle', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('creates an auto-fill grid with default options', () => {
+    expect(createGridStyle()).toEqual({
+      display: 'grid',
+      gridTemplateColumns: 'repeat(auto-fill, minmax(15rem, 1fr))',
+      padding: '0',
+      gap: '1rem'
+    })
+  })
+
+  it('creates an auto-fill grid with custom options', () => {
+    expect(
+      createGridStyle({
+        minWidth: '12rem',
+        maxWidth: '24rem',
+        padding: '2rem',
+        gap: '0.5rem'
+      })
+    ).toEqual({
+      display: 'grid',
+      gridTemplateColumns: 'repeat(auto-fill, minmax(12rem, 24rem))',
+      padding: '2rem',
+      gap: '0.5rem'
+    })
+  })
+
+  it('uses a fixed column count when provided', () => {
+    expect(createGridStyle({ columns: 3 }).gridTemplateColumns).toBe(
+      'repeat(3, 1fr)'
+    )
+  })
+
+  it('warns and clamps negative column counts', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    expect(createGridStyle({ columns: -1 }).gridTemplateColumns).toBe(
+      'repeat(1, 1fr)'
+    )
+    expect(warn).toHaveBeenCalledWith(
+      'createGridStyle: columns must be >= 1, defaulting to 1'
+    )
+  })
+})

src/utils/mouseDownUtil.test.ts

@@ -0,0 +1,38 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { whileMouseDown } from '@/utils/mouseDownUtil'
+
+describe('whileMouseDown', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('runs the callback until mouseup is received on the element', () => {
+    vi.useFakeTimers()
+    const element = document.createElement('button')
+    const callback = vi.fn()
+
+    whileMouseDown(element, callback, 10)
+
+    vi.advanceTimersByTime(25)
+    element.dispatchEvent(new MouseEvent('mouseup'))
+    vi.advanceTimersByTime(30)
+
+    expect(callback.mock.calls.map(([iteration]) => iteration)).toEqual([0, 1])
+  })
+
+  it('accepts an event target and can be disposed directly', () => {
+    vi.useFakeTimers()
+    const element = document.createElement('button')
+    const callback = vi.fn()
+    const event = new MouseEvent('mousedown')
+    Object.defineProperty(event, 'target', { value: element })
+
+    const runner = whileMouseDown(event, callback, 10)
+    vi.advanceTimersByTime(10)
+    runner.dispose()
+    vi.advanceTimersByTime(20)
+
+    expect(callback).toHaveBeenCalledExactlyOnceWith(0)
+  })
+})

src/utils/objectUrlUtil.test.ts

@@ -0,0 +1,56 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import {
+  createSharedObjectUrl,
+  releaseSharedObjectUrl,
+  retainSharedObjectUrl
+} from '@/utils/objectUrlUtil'
+
+describe('shared object URLs', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('revokes a created URL only after all references are released', () => {
+    const createObjectURL = vi
+      .spyOn(URL, 'createObjectURL')
+      .mockReturnValue('blob:test')
+    const revokeObjectURL = vi
+      .spyOn(URL, 'revokeObjectURL')
+      .mockImplementation(() => {})
+
+    const url = createSharedObjectUrl(new Blob(['image']))
+    retainSharedObjectUrl(url)
+    releaseSharedObjectUrl(url)
+
+    expect(createObjectURL).toHaveBeenCalledOnce()
+    expect(revokeObjectURL).not.toHaveBeenCalled()
+
+    releaseSharedObjectUrl(url)
+
+    expect(revokeObjectURL).toHaveBeenCalledExactlyOnceWith(url)
+  })
+
+  it('ignores empty and non-blob URLs', () => {
+    const revokeObjectURL = vi
+      .spyOn(URL, 'revokeObjectURL')
+      .mockImplementation(() => {})
+
+    retainSharedObjectUrl(undefined)
+    retainSharedObjectUrl('https://example.com/image.png')
+    releaseSharedObjectUrl(undefined)
+    releaseSharedObjectUrl('https://example.com/image.png')
+
+    expect(revokeObjectURL).not.toHaveBeenCalled()
+  })
+
+  it('revokes unknown blob URLs immediately', () => {
+    const revokeObjectURL = vi
+      .spyOn(URL, 'revokeObjectURL')
+      .mockImplementation(() => {})
+
+    releaseSharedObjectUrl('blob:external')
+
+    expect(revokeObjectURL).toHaveBeenCalledExactlyOnceWith('blob:external')
+  })
+})

vite.config.mts

@@ -18,6 +18,7 @@ import { createHtmlPlugin } from 'vite-plugin-html'
 import vueDevTools from 'vite-plugin-vue-devtools'
 
 import { comfyAPIPlugin } from './build/plugins'
+import { CRITICAL_COVERAGE_DIRS } from './scripts/critical-coverage/criticalCoverageDirs'
 
 dotenvConfig()
 
@@ -30,46 +31,6 @@ const DISABLE_TEMPLATES_PROXY = process.env.DISABLE_TEMPLATES_PROXY === 'true'
 const GENERATE_SOURCEMAP = process.env.GENERATE_SOURCEMAP !== 'false'
 const IS_STORYBOOK = process.env.npm_lifecycle_event === 'storybook'
 
-const CRITICAL_COVERAGE_DIRS = [
-  'src/base',
-  'src/composables',
-  'src/core',
-  'src/lib/litegraph/src/node',
-  'src/lib/litegraph/src/subgraph',
-  'src/lib/litegraph/src/utils',
-  'src/platform/assets/composables',
-  'src/platform/assets/mappings',
-  'src/platform/assets/schemas',
-  'src/platform/assets/services',
-  'src/platform/assets/utils',
-  'src/platform/errorCatalog',
-  'src/platform/keybindings',
-  'src/platform/missingMedia',
-  'src/platform/missingModel',
-  'src/platform/navigation',
-  'src/platform/nodeReplacement',
-  'src/platform/remote',
-  'src/platform/remoteConfig',
-  'src/platform/secrets',
-  'src/platform/settings',
-  'src/platform/workflow',
-  'src/platform/workspace/api',
-  'src/platform/workspace/auth',
-  'src/platform/workspace/composables',
-  'src/platform/workspace/stores',
-  'src/platform/workspace/utils',
-  'src/schemas',
-  'src/scripts',
-  'src/services',
-  'src/stores',
-  'src/utils',
-  'src/workbench/extensions/manager/composables',
-  'src/workbench/extensions/manager/services',
-  'src/workbench/extensions/manager/stores',
-  'src/workbench/extensions/manager/utils',
-  'src/workbench/utils'
-]
-
 // A single glob key so vitest aggregates all critical dirs into one
 // thresholds bucket instead of one bucket per glob
 const CRITICAL_COVERAGE_GLOB = `{${CRITICAL_COVERAGE_DIRS.join(',')}}/**/*.{ts,vue}`