fix: track social signup auth failures

## Summary

Adds a **sitewide announcement banner** to the website, rendered above
the navbar on every page. It has a two-layer visibility model:

- **Build-time gate** — a pure, unit-tested `evaluateBannerVisibility()`
decides whether the banner mounts at all (active flag + optional date
window + locale/section targeting), driven by a typed config
(`src/config/banner.ts`). No CMS; copy resolves through i18n.
- **Client-side dismissal** — persisted in `localStorage`, keyed by a
**content hash** so editing the copy re-shows the banner (per-locale, so
an en edit doesn't re-show it for zh-CN).

Current content points the CTA at **Comfy MCP** (`/mcp`).

## Highlights

- **Full-width branded bar** above a now-`sticky` navbar; reuses the
design system (`Button`, gradient tokens, new reusable `IconButton`).
- **Flash-free** on load: an inline pre-hydration script hides an
already-dismissed banner before paint (no pop-in, no layout shift);
`close()` sets the same signal after the leave animation to stay
flash-free across ClientRouter navigations.
- **Open/close transition**: grid-rows height collapse + fade,
respecting `prefers-reduced-motion`.
- **i18n**: copy in `en` + `zh-CN`.

## Where to edit later

- **Copy**: `apps/website/src/i18n/translations.ts` →
`launches.banner.text` / `launches.banner.cta`
- **Link / on-off / dates / targeting**:
`apps/website/src/config/banner.ts` (`bannerConfig`)

## Notes

- On a static site the `startsAt`/`endsAt` window is evaluated at
**build time** (documented in `banner.ts`).
- Changing the copy or link changes the content hash, so
previously-dismissed visitors will see the banner again — by design.

## Test plan

- `pnpm test:unit` — evaluator + version-hash unit tests pass.
- `pnpm typecheck` + lint clean.
- On the preview: banner shows on `/`, `/launches`, and a `zh-CN` page;
CTA -> `/mcp`; dismiss animates and stays dismissed on reload (no
flash); reduced-motion disables the animation.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/website/src/components/common/HeaderMain/HeaderMain.vue

@@ -33,7 +33,7 @@ const ctaButtons = [
 
 <template>
   <nav
-    class="fixed inset-x-0 top-0 z-50 flex items-center justify-between gap-4 bg-primary-comfy-ink px-6 py-5 lg:gap-4 lg:px-[clamp(0.25rem,4vw,5rem)] lg:py-8"
+    class="sticky top-0 z-50 flex items-center justify-between gap-4 bg-primary-comfy-ink px-6 py-5 lg:gap-4 lg:px-[clamp(0.25rem,4vw,5rem)] lg:py-8"
     aria-label="Main navigation"
   >
     <a

apps/website/src/components/common/ProductCard.vue

@@ -30,7 +30,12 @@ const { title, description, cta, href, bg } = defineProps<{
       <p class="text-sm text-white/70">
         {{ description }}
       </p>
-      <Button as="span" variant="default" size="sm" class="mt-4">
+      <Button
+        as="span"
+        variant="default"
+        size="sm"
+        class="mt-4 h-auto whitespace-normal"
+      >
         {{ cta }}
       </Button>
     </div>

apps/website/src/components/ui/icon-button/IconButton.vue

@@ -0,0 +1,38 @@
+<script setup lang="ts">
+import type { PrimitiveProps } from 'reka-ui'
+import type { HTMLAttributes } from 'vue'
+import type { IconButtonVariants } from '.'
+import { Primitive } from 'reka-ui'
+import { cn } from '@comfyorg/tailwind-utils'
+import { iconButtonVariants } from '.'
+
+interface Props extends PrimitiveProps {
+  variant?: IconButtonVariants['variant']
+  size?: IconButtonVariants['size']
+  class?: HTMLAttributes['class']
+  disabled?: boolean
+}
+
+const {
+  as = 'button',
+  asChild,
+  variant,
+  size,
+  class: className,
+  disabled
+} = defineProps<Props>()
+</script>
+
+<template>
+  <Primitive
+    data-slot="icon-button"
+    :data-variant="variant"
+    :data-size="size"
+    :as
+    :as-child
+    :disabled
+    :class="cn(iconButtonVariants({ variant, size }), className)"
+  >
+    <slot />
+  </Primitive>
+</template>

apps/website/src/components/ui/icon-button/index.ts

@@ -0,0 +1,28 @@
+import type { VariantProps } from 'class-variance-authority'
+import { cva } from 'class-variance-authority'
+
+export const iconButtonVariants = cva(
+  [
+    'focus-visible:border-primary-comfy-yellow focus-visible:ring-primary-comfy-yellow/50 inline-flex shrink-0 cursor-pointer items-center justify-center rounded-2xl transition-all duration-200 outline-none focus-visible:ring-3 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0'
+  ],
+  {
+    variants: {
+      variant: {
+        ghost:
+          'text-primary-warm-white hover:text-primary-comfy-yellow bg-transparent',
+        outline:
+          'text-primary-comfy-yellow hover:bg-primary-comfy-yellow border-primary-comfy-yellow border-2 bg-primary-comfy-ink hover:text-primary-comfy-ink'
+      },
+      size: {
+        sm: 'size-8',
+        default: 'size-10',
+        lg: 'size-14'
+      }
+    },
+    defaultVariants: {
+      variant: 'ghost',
+      size: 'default'
+    }
+  }
+)
+export type IconButtonVariants = VariantProps<typeof iconButtonVariants>

apps/website/src/composables/useBannerDismissal.ts

@@ -0,0 +1,75 @@
+import { onMounted, ref } from 'vue'
+
+import { BANNER_DISMISS_ATTR, BANNER_STORAGE_KEY } from '../utils/banner'
+
+type ClosedBanners = Record<string, boolean>
+
+function readClosedBanners(): ClosedBanners {
+  try {
+    const raw = localStorage.getItem(BANNER_STORAGE_KEY)
+    return raw ? (JSON.parse(raw) as ClosedBanners) : {}
+  } catch {
+    return {}
+  }
+}
+
+function writeClosedBanners(value: ClosedBanners): void {
+  try {
+    localStorage.setItem(BANNER_STORAGE_KEY, JSON.stringify(value))
+  } catch {
+    // Storage unavailable (private mode / quota) — dismissal just won't persist.
+  }
+}
+
+/** The stable part of a version key (everything before `_v<hash>`). */
+function versionPrefix(version: string): string {
+  const idx = version.lastIndexOf('_v')
+  return idx === -1 ? version : version.slice(0, idx)
+}
+
+/**
+ * Client-side dismissal persisted in localStorage, keyed by a content-aware
+ * `version`. The banner renders visible in the static HTML (so non-dismissers
+ * see no pop-in); an inline pre-hydration script hides an already-dismissed
+ * banner before paint, and this composable then removes it from the DOM on mount.
+ */
+export function useBannerDismissal(version: string) {
+  const isVisible = ref(true)
+
+  onMounted(() => {
+    const stored = readClosedBanners()
+    const prefix = versionPrefix(version)
+
+    // Prune stale versions of THIS banner+locale; keep other banners/locales
+    // and the current version.
+    const cleaned: ClosedBanners = Object.create(null) as ClosedBanners
+    let pruned = false
+    for (const key of Object.keys(stored)) {
+      if (versionPrefix(key) !== prefix || key === version) {
+        cleaned[key] = stored[key]
+      } else {
+        pruned = true
+      }
+    }
+    if (pruned) writeClosedBanners(cleaned)
+
+    isVisible.value = !cleaned[version]
+  })
+
+  function close(): void {
+    isVisible.value = false
+    const stored = readClosedBanners()
+    stored[version] = true
+    writeClosedBanners(stored)
+  }
+
+  // Call once the close transition has finished. Sets the pre-paint hide signal
+  // so the banner doesn't flash back in on a ClientRouter (view-transition)
+  // navigation — where the inline <head> script does not re-run but <html>
+  // persists. Deferred to after the animation so the leave transition can play.
+  function persistHidden(): void {
+    document.documentElement.setAttribute(BANNER_DISMISS_ATTR, '')
+  }
+
+  return { isVisible, close, persistHidden }
+}

apps/website/src/config/banner.ts

@@ -0,0 +1,84 @@
+import type { ButtonVariants } from '../components/ui/button'
+import type { Locale, TranslationKey } from '../i18n/translations'
+
+import { t } from '../i18n/translations'
+import { resolveRel } from '../utils/cta'
+
+// The banner "CMS": a single typed config resolved through i18n at build time.
+// `isActive` is the master on/off switch (supersedes the old SHOW_ANNOUNCEMENT_BANNER).
+// NOTE: on this static site, `startsAt`/`endsAt` are evaluated at BUILD time — the
+// window gates on the last deploy, not the visitor's exact clock.
+
+interface BannerLinkConfig {
+  readonly href: string
+  readonly titleKey: TranslationKey
+  readonly target?: boolean
+  readonly buttonVariant?: NonNullable<ButtonVariants['variant']>
+}
+
+export interface BannerConfig {
+  readonly id: string
+  readonly isActive: boolean
+  readonly startsAt?: string
+  readonly endsAt?: string
+  /** Empty/undefined = all locales. */
+  readonly targetLocales?: readonly Locale[]
+  /** v1 only supports 'sitewide'. */
+  readonly targetSections?: readonly string[]
+  readonly titleKey: TranslationKey
+  readonly descriptionKey?: TranslationKey
+  readonly link?: BannerLinkConfig
+}
+
+interface BannerLinkData {
+  readonly href: string
+  readonly title: string
+  readonly target?: '_blank'
+  readonly rel?: string
+  readonly buttonVariant?: NonNullable<ButtonVariants['variant']>
+}
+
+export interface BannerData {
+  readonly id: string
+  readonly title: string
+  readonly description?: string
+  readonly link?: BannerLinkData
+}
+
+export const bannerConfig: BannerConfig = {
+  id: 'announcement',
+  isActive: true,
+  targetSections: ['sitewide'],
+  titleKey: 'launches.banner.text',
+  link: {
+    href: '/mcp',
+    titleKey: 'launches.banner.cta',
+    buttonVariant: 'underlineLink'
+  }
+}
+
+/** Resolve a config's i18n keys into display strings for the given locale. */
+export function getBannerData(
+  config: BannerConfig,
+  locale: Locale
+): BannerData {
+  const { link } = config
+  const target = link?.target ? '_blank' : undefined
+
+  return {
+    id: config.id,
+    title: t(config.titleKey, locale),
+    description: config.descriptionKey
+      ? t(config.descriptionKey, locale)
+      : undefined,
+    link: link
+      ? {
+          href: link.href,
+          title: t(link.titleKey, locale),
+          target,
+          rel: resolveRel({ target: target ?? '_self' }),
+          buttonVariant: link.buttonVariant
+        }
+      : undefined
+  }
+}

apps/website/src/i18n/translations.ts

@@ -3983,12 +3983,12 @@ const translations = {
   // Launches page (/launches) — subscribe banner
   // zh-CN strings pending native review (see apps/website/.scratch/drops-page/PRD.md)
   'launches.banner.text': {
-    en: 'Join the live stream. Get answers in real time.',
-    'zh-CN': '加入直播，实时获得解答。'
+    en: 'Now turn your agent into a creative technologist.',
+    'zh-CN': '现在，让你的智能体成为创意技术专家。'
   },
   'launches.banner.cta': {
-    en: 'Join livestream',
-    'zh-CN': '加入直播'
+    en: 'Start Comfy MCP',
+    'zh-CN': '启动 Comfy MCP'
   },
 
   // Launches page (/launches) — closing CTA

apps/website/src/layouts/BaseLayout.astro

@@ -5,6 +5,14 @@ import '../styles/global.css'
 import type { Locale } from '../i18n/translations'
 import SiteFooter from '../components/common/SiteFooter.vue'
 import HeaderMain from '../components/common/HeaderMain/HeaderMain.vue'
+import AnnouncementBanner from '../templates/drops/AnnouncementBanner.vue'
+import { bannerConfig, getBannerData } from '../config/banner'
+import {
+  BANNER_DISMISS_ATTR,
+  BANNER_STORAGE_KEY,
+  createBannerVersion,
+  evaluateBannerVisibility
+} from '../utils/banner'
 import { escapeJsonLd } from '../utils/escapeJsonLd'
 import { fetchGitHubStars, formatStarCount } from '../utils/github'
 
@@ -34,6 +42,15 @@ const locale: Locale = rawLocale === 'zh-CN' ? 'zh-CN' : 'en'
 const rawStars = await fetchGitHubStars('Comfy-Org', 'ComfyUI')
 const githubStars = rawStars ? formatStarCount(rawStars) : ''
 
+// Announcement banner — build-time visibility gate + content-hash version key.
+const bannerData = getBannerData(bannerConfig, locale)
+const bannerVisible = evaluateBannerVisibility(bannerConfig, {
+  currentLocale: locale,
+  currentSection: 'sitewide',
+  now: new Date(),
+})
+const bannerVersion = createBannerVersion(bannerData, locale)
+
 const gtmId = 'GTM-NP9JM6K7'
 const gtmEnabled = import.meta.env.PROD
 
@@ -124,6 +141,25 @@ const websiteJsonLd = {
 
     <ClientRouter />
     <slot name="head" />
+
+    <!-- Hide an already-dismissed announcement banner before first paint (no flash/shift). -->
+    {bannerVisible && (
+      <script
+        is:inline
+        define:vars={{
+          bannerVersion,
+          storageKey: BANNER_STORAGE_KEY,
+          dismissAttr: BANNER_DISMISS_ATTR
+        }}
+      >
+        try {
+          const dismissed = JSON.parse(localStorage.getItem(storageKey) || '{}')
+          if (dismissed[bannerVersion]) {
+            document.documentElement.setAttribute(dismissAttr, '')
+          }
+        } catch (e) {}
+      </script>
+    )}
   </head>
   <body class="bg-primary-comfy-ink text-white font-formula antialiased overflow-x-clip">
     {gtmEnabled && (
@@ -137,8 +173,16 @@ const websiteJsonLd = {
       </noscript>
     )}
 
+    {bannerVisible && (
+      <AnnouncementBanner
+        data={bannerData}
+        version={bannerVersion}
+        locale={locale}
+        client:load
+      />
+    )}
     <HeaderMain locale={locale} github-stars={githubStars} client:load />
-    <main class="mt-20 lg:mt-32">
+    <main>
       <slot />
     </main>
     <SiteFooter locale={locale} client:load />

apps/website/src/pages/launches.astro

@@ -3,7 +3,6 @@ import BaseLayout from '../layouts/BaseLayout.astro'
 import CtaSection from '../templates/drops/CtaSection.vue'
 import DropsSection from '../templates/drops/DropsSection.vue'
 import HeroSection from '../templates/drops/HeroSection.vue'
-import SubscribeBanner from '../templates/drops/SubscribeBanner.vue'
 import { t } from '../i18n/translations'
 
 const locale = 'en' as const
@@ -13,7 +12,6 @@ const locale = 'en' as const
   title={t('launches.page.title', locale)}
   description={t('launches.page.description', locale)}
 >
-  <SubscribeBanner locale={locale} client:load />
   <HeroSection locale={locale} client:load />
   <DropsSection locale={locale} />
   <CtaSection locale={locale} />

apps/website/src/pages/zh-CN/launches.astro

@@ -3,7 +3,6 @@ import BaseLayout from '../../layouts/BaseLayout.astro'
 import CtaSection from '../../templates/drops/CtaSection.vue'
 import DropsSection from '../../templates/drops/DropsSection.vue'
 import HeroSection from '../../templates/drops/HeroSection.vue'
-import SubscribeBanner from '../../templates/drops/SubscribeBanner.vue'
 import { t } from '../../i18n/translations'
 
 const locale = 'zh-CN' as const
@@ -13,7 +12,6 @@ const locale = 'zh-CN' as const
   title={t('launches.page.title', locale)}
   description={t('launches.page.description', locale)}
 >
-  <SubscribeBanner locale={locale} client:load />
   <HeroSection locale={locale} client:load />
   <DropsSection locale={locale} />
   <CtaSection locale={locale} />

apps/website/src/styles/global.css

@@ -70,6 +70,7 @@
   --color-secondary-mauve: #4d3762;
   --color-destructive: #f44336;
   --color-primary-comfy-plum: #49378b;
+  --color-secondary-deep-plum: #2b2040;
   --color-secondary-cool-gray: #3c3c3c;
   --color-illustration-forest: #20464c;
   --color-transparency-white-t4: rgb(255 255 255 / 0.04);
@@ -93,6 +94,14 @@
   initial-value: 0deg;
 }
 
+/* Pre-hydration hide for a dismissed announcement banner (set by an inline
+   script in BaseLayout head) — prevents any flash before Vue hydrates.
+   The [data-banner-dismissed] literal is BANNER_DISMISS_ATTR in utils/banner.ts;
+   keep them in sync. */
+[data-banner-dismissed] [data-slot='announcement-banner'] {
+  display: none;
+}
+
 @keyframes border-angle-spin {
   to {
     --border-angle: 360deg;

apps/website/src/templates/drops/AnnouncementBanner.vue

@@ -0,0 +1,107 @@
+<script setup lang="ts">
+import { ArrowRight, X } from '@lucide/vue'
+
+import type { BannerData } from '../../config/banner'
+import type { Locale } from '../../i18n/translations'
+
+import { t } from '../../i18n/translations'
+import Button from '@/components/ui/button/Button.vue'
+import IconButton from '@/components/ui/icon-button/IconButton.vue'
+import { useBannerDismissal } from '../../composables/useBannerDismissal'
+
+const {
+  data,
+  version,
+  locale = 'en'
+} = defineProps<{
+  data: BannerData
+  version: string
+  locale?: Locale
+}>()
+
+const { isVisible, close, persistHidden } = useBannerDismissal(version)
+</script>
+
+<template>
+  <Transition name="banner-collapse" @after-leave="persistHidden">
+    <div v-if="isVisible" class="banner-collapse grid">
+      <div class="min-h-0 overflow-hidden">
+        <div
+          data-slot="announcement-banner"
+          class="after:bg-transparency-white-t4 relative flex items-center gap-x-6 px-6 py-4 after:pointer-events-none after:absolute after:inset-x-0 after:bottom-0 after:h-px sm:px-3.5 sm:before:flex-1"
+          style="
+            background: linear-gradient(
+              90deg,
+              var(--color-primary-comfy-plum) 0%,
+              var(--color-secondary-deep-plum) 53.85%,
+              var(--color-secondary-mauve) 100%
+            );
+          "
+        >
+          <div class="flex flex-wrap items-center gap-x-8 gap-y-2">
+            <p
+              class="text-primary-warm-white ppformula-text-center text-sm md:text-base/6"
+            >
+              {{ data.title }}
+              <span v-if="data.description" class="text-primary-warm-white/80">
+                {{ data.description }}
+              </span>
+            </p>
+            <Button
+              v-if="data.link"
+              as="a"
+              :href="data.link.href"
+              :target="data.link.target"
+              :rel="data.link.rel"
+              :variant="data.link.buttonVariant ?? 'underlineLink'"
+              size="sm"
+            >
+              {{ data.link.title }}
+              <template #append>
+                <ArrowRight class="size-4" />
+              </template>
+            </Button>
+          </div>
+          <div class="flex flex-1 justify-end">
+            <IconButton
+              type="button"
+              :aria-label="t('nav.close', locale)"
+              @click="close"
+            >
+              <X class="size-5" aria-hidden="true" />
+            </IconButton>
+          </div>
+        </div>
+      </div>
+    </div>
+  </Transition>
+</template>
+
+<style scoped>
+/* Collapse the banner's height (grid 1fr → 0fr) so page content below slides
+   up smoothly, with a fade. Enter is defined for symmetry; in practice only the
+   leave (dismiss) runs, since the banner renders present in the static HTML. */
+.banner-collapse {
+  grid-template-rows: 1fr;
+}
+
+.banner-collapse-enter-active,
+.banner-collapse-leave-active {
+  transition:
+    grid-template-rows 300ms ease,
+    opacity 250ms ease;
+}
+
+.banner-collapse-enter-from,
+.banner-collapse-leave-to {
+  grid-template-rows: 0fr;
+  opacity: 0;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .banner-collapse-enter-active,
+  .banner-collapse-leave-active {
+    transition: none;
+  }
+}
+</style>

apps/website/src/templates/drops/SubscribeBanner.vue

@@ -1,61 +0,0 @@
-<script setup lang="ts">
-import { useTimeoutFn } from '@vueuse/core'
-import { onMounted, ref } from 'vue'
-
-import type { Locale } from '../../i18n/translations'
-
-import { t } from '../../i18n/translations'
-import Button from '@/components/ui/button/Button.vue'
-import { resolveRel } from '../../utils/cta'
-import { livestream } from './livestream'
-
-const { locale = 'en' } = defineProps<{ locale?: Locale }>()
-
-const signUpHref = `https://www.youtube.com/watch?v=${livestream.youtubeVideoId}`
-const signUpRel = resolveRel({ target: '_blank' })
-
-// Hide once the livestream window closes — both for visitors arriving after
-// the event and for visitors whose tab is open when it ends.
-const endMs = new Date(livestream.endDateTime).getTime()
-const visible = ref(true)
-
-// useTimeoutFn auto-clears on unmount. Arm it client-side only so SSR never
-// schedules a long-lived server timer.
-const { start } = useTimeoutFn(
-  () => {
-    visible.value = false
-  },
-  () => Math.max(0, endMs - Date.now()),
-  { immediate: false }
-)
-
-onMounted(() => {
-  if (endMs - Date.now() <= 0) {
-    visible.value = false
-  } else {
-    start()
-  }
-})
-</script>
-
-<template>
-  <div v-if="visible" class="px-4">
-    <div
-      class="bg-primary-comfy-plum max-w-8xl rounded-5xl text-primary-warm-white mx-auto flex w-full flex-col items-center justify-center gap-2 px-6 py-5 text-center text-sm sm:flex-row sm:gap-4"
-    >
-      <p class="ppformula-text-center">
-        {{ t('launches.banner.text', locale) }}
-      </p>
-      <Button
-        :href="signUpHref"
-        as="a"
-        variant="underlineLink"
-        size="sm"
-        target="_blank"
-        :rel="signUpRel"
-      >
-        {{ t('launches.banner.cta', locale) }}
-      </Button>
-    </div>
-  </div>
-</template>

apps/website/src/utils/banner.test.ts

@@ -0,0 +1,109 @@
+import { describe, expect, it } from 'vitest'
+
+import type { EvaluableBanner } from './banner'
+
+import { createBannerVersion, evaluateBannerVisibility } from './banner'
+
+const base: EvaluableBanner = {
+  isActive: true,
+  targetSections: ['sitewide']
+}
+
+const ctx = {
+  currentLocale: 'en',
+  currentSection: 'sitewide',
+  now: new Date('2026-07-06T00:00:00Z')
+}
+
+describe('evaluateBannerVisibility', () => {
+  it('shows an active, untargeted, sitewide banner', () => {
+    expect(evaluateBannerVisibility(base, ctx)).toBe(true)
+  })
+
+  it('hides when inactive', () => {
+    expect(evaluateBannerVisibility({ ...base, isActive: false }, ctx)).toBe(
+      false
+    )
+  })
+
+  it('hides before startsAt and shows within the window', () => {
+    expect(
+      evaluateBannerVisibility(
+        { ...base, startsAt: '2026-07-10T00:00:00Z' },
+        ctx
+      )
+    ).toBe(false)
+    expect(
+      evaluateBannerVisibility(
+        { ...base, startsAt: '2026-07-01T00:00:00Z' },
+        ctx
+      )
+    ).toBe(true)
+  })
+
+  it('hides after endsAt', () => {
+    expect(
+      evaluateBannerVisibility({ ...base, endsAt: '2026-07-01T00:00:00Z' }, ctx)
+    ).toBe(false)
+    expect(
+      evaluateBannerVisibility({ ...base, endsAt: '2026-07-10T00:00:00Z' }, ctx)
+    ).toBe(true)
+  })
+
+  it('treats an empty targetLocales as "all locales"', () => {
+    expect(evaluateBannerVisibility({ ...base, targetLocales: [] }, ctx)).toBe(
+      true
+    )
+  })
+
+  it('hides when targetLocales excludes the current locale', () => {
+    expect(
+      evaluateBannerVisibility({ ...base, targetLocales: ['zh-CN'] }, ctx)
+    ).toBe(false)
+    expect(
+      evaluateBannerVisibility({ ...base, targetLocales: ['en', 'zh-CN'] }, ctx)
+    ).toBe(true)
+  })
+
+  it('hides when targetSections does not include the current section', () => {
+    expect(
+      evaluateBannerVisibility({ ...base, targetSections: ['checkout'] }, ctx)
+    ).toBe(false)
+  })
+
+  it('hides when targetSections is absent (nothing to match)', () => {
+    expect(evaluateBannerVisibility({ isActive: true }, ctx)).toBe(false)
+  })
+})
+
+describe('createBannerVersion', () => {
+  const content = {
+    id: 'announcement',
+    title: 'Join the live stream',
+    link: { href: 'https://x', title: 'Join' }
+  }
+
+  it('is deterministic for identical content', () => {
+    expect(createBannerVersion(content, 'en')).toBe(
+      createBannerVersion(content, 'en')
+    )
+  })
+
+  it('encodes the banner id and locale in the key', () => {
+    expect(createBannerVersion(content, 'en')).toMatch(
+      /^announcement_en_v-?\d+$/
+    )
+  })
+
+  it('changes when the copy changes', () => {
+    expect(createBannerVersion(content, 'en')).not.toBe(
+      createBannerVersion({ ...content, title: 'New copy' }, 'en')
+    )
+  })
+
+  it('differs per locale so one locale edit does not re-show another', () => {
+    expect(createBannerVersion(content, 'en')).not.toBe(
+      createBannerVersion(content, 'zh-CN')
+    )
+  })
+})

apps/website/src/utils/banner.ts

@@ -0,0 +1,87 @@
+// Pure, framework-agnostic banner logic — no Vue/Astro/config imports so it stays
+// trivially unit-testable. Locale/section are plain strings on purpose.
+
+// Shared dismissal storage contract. The pre-hydration script in BaseLayout.astro,
+// the useBannerDismissal composable, and the CSS selector in global.css must all
+// agree on these literals — keep them here as the single source of truth.
+export const BANNER_STORAGE_KEY = 'closedBanners'
+export const BANNER_DISMISS_ATTR = 'data-banner-dismissed'
+
+export interface BannerVisibilityContext {
+  currentLocale: string
+  currentSection: string
+  now: Date
+}
+
+export interface EvaluableBanner {
+  isActive: boolean
+  startsAt?: string
+  endsAt?: string
+  targetLocales?: readonly string[]
+  targetSections?: readonly string[]
+}
+
+/**
+ * Server/build-time visibility gate. Returns false on the FIRST failing check,
+ * in order: active flag → start window → end window → locale targeting →
+ * section targeting. An empty/absent `targetLocales` means "all locales".
+ */
+export function evaluateBannerVisibility(
+  banner: EvaluableBanner,
+  ctx: BannerVisibilityContext
+): boolean {
+  if (!banner.isActive) return false
+  if (
+    banner.startsAt &&
+    ctx.now.getTime() < new Date(banner.startsAt).getTime()
+  )
+    return false
+  if (banner.endsAt && ctx.now.getTime() > new Date(banner.endsAt).getTime())
+    return false
+
+  const targetLocales = banner.targetLocales ?? []
+  if (targetLocales.length > 0 && !targetLocales.includes(ctx.currentLocale))
+    return false
+
+  const targetSections = banner.targetSections ?? []
+  if (!targetSections.includes(ctx.currentSection)) return false
+
+  return true
+}
+
+interface BannerLinkContent {
+  href: string
+  title: string
+  target?: string
+  rel?: string
+  buttonVariant?: string
+}
+
+export interface BannerVersionContent {
+  id: string
+  title: string
+  description?: string
+  link?: BannerLinkContent
+}
+
+/**
+ * Content-aware version key. Editing the copy changes the hash, so a previously
+ * dismissed banner re-appears. Keyed per-locale so a zh-CN edit doesn't re-show
+ * the banner for en visitors. Format: `${content.id}_${locale}_v${hash}`.
+ */
+export function createBannerVersion(
+  content: BannerVersionContent,
+  locale: string
+): string {
+  const contentString = JSON.stringify({
+    locale,
+    title: content.title,
+    description: content.description,
+    link: content.link
+  })
+  let hash = 0
+  for (const char of contentString) {
+    hash = Math.imul(hash, 31) + char.charCodeAt(0)
+  }
+  return `${content.id}_${locale}_v${hash}`
+}

packages/ingest-types/src/index.ts

@@ -12,6 +12,11 @@ export type {
   AddAssetTagsErrors,
   AddAssetTagsResponse,
   AddAssetTagsResponses,
+  AdminDeleteHubWorkflowData,
+  AdminDeleteHubWorkflowError,
+  AdminDeleteHubWorkflowErrors,
+  AdminDeleteHubWorkflowResponse,
+  AdminDeleteHubWorkflowResponses,
   Asset,
   AssetCreated,
   AssetCreatedWritable,
@@ -42,6 +47,11 @@ export type {
   CancelJobErrors,
   CancelJobResponse,
   CancelJobResponses,
+  CancelJobsData,
+  CancelJobsError,
+  CancelJobsErrors,
+  CancelJobsResponse,
+  CancelJobsResponses,
   CancelSubscriptionData,
   CancelSubscriptionError,
   CancelSubscriptionErrors,
@@ -84,6 +94,11 @@ export type {
   CreateDeletionRequestErrors,
   CreateDeletionRequestResponse,
   CreateDeletionRequestResponses,
+  CreateDesktopLoginCodeData,
+  CreateDesktopLoginCodeError,
+  CreateDesktopLoginCodeErrors,
+  CreateDesktopLoginCodeResponse,
+  CreateDesktopLoginCodeResponses,
   CreateHubAssetUploadUrlData,
   CreateHubAssetUploadUrlError,
   CreateHubAssetUploadUrlErrors,
@@ -186,12 +201,31 @@ export type {
   DeleteWorkspaceResponses,
   DeletionRequest,
   DeletionStatus,
+  DesktopLoginCodeCreateRequest,
+  DesktopLoginCodeCreateResponse,
+  DesktopLoginCodeExchangeRequest,
+  DesktopLoginCodeExchangeResponse,
+  DesktopLoginCodeRedeemRequest,
+  DesktopLoginCodeRedeemResponse,
   DownloadExportData,
   DownloadExportError,
   DownloadExportErrors,
   DownloadExportResponse,
   DownloadExportResponses,
+  EnsureWorkspaceBillingLegacySnapshot,
+  EnsureWorkspaceBillingProvisionedData,
+  EnsureWorkspaceBillingProvisionedError,
+  EnsureWorkspaceBillingProvisionedErrors,
+  EnsureWorkspaceBillingProvisionedRequest,
+  EnsureWorkspaceBillingProvisionedResponse,
+  EnsureWorkspaceBillingProvisionedResponse2,
+  EnsureWorkspaceBillingProvisionedResponses,
   ErrorResponse,
+  ExchangeDesktopLoginCodeData,
+  ExchangeDesktopLoginCodeError,
+  ExchangeDesktopLoginCodeErrors,
+  ExchangeDesktopLoginCodeResponse,
+  ExchangeDesktopLoginCodeResponses,
   ExchangeTokenData,
   ExchangeTokenError,
   ExchangeTokenErrors,
@@ -230,6 +264,11 @@ export type {
   GetAssetByIdErrors,
   GetAssetByIdResponse,
   GetAssetByIdResponses,
+  GetAssetContentData,
+  GetAssetContentError,
+  GetAssetContentErrors,
+  GetAssetContentResponse,
+  GetAssetContentResponses,
   GetAssetSeedStatusData,
   GetAssetSeedStatusResponse,
   GetAssetSeedStatusResponses,
@@ -303,6 +342,11 @@ export type {
   GetHistoryData,
   GetHistoryError,
   GetHistoryErrors,
+  GetHistoryEventsData,
+  GetHistoryEventsError,
+  GetHistoryEventsErrors,
+  GetHistoryEventsResponse,
+  GetHistoryEventsResponses,
   GetHistoryForPromptData,
   GetHistoryForPromptError,
   GetHistoryForPromptErrors,
@@ -345,8 +389,6 @@ export type {
   GetJwksData,
   GetJwksResponse,
   GetJwksResponses,
-  GetLegacyAssetContentData,
-  GetLegacyAssetContentErrors,
   GetLegacyHistoryByIdData,
   GetLegacyHistoryByIdErrors,
   GetLegacyHistoryData,
@@ -556,6 +598,7 @@ export type {
   HistoryDetailEntry,
   HistoryDetailResponse,
   HistoryEntry,
+  HistoryEventRequest,
   HistoryManageRequest,
   HistoryResponse,
   HubAssetUploadUrlRequest,
@@ -589,6 +632,8 @@ export type {
   JobCancelResponse,
   JobDetailResponse,
   JobEntry,
+  JobsCancelRequest,
+  JobsCancelResponse,
   JobsListResponse,
   JobStatusResponse,
   JwkKey,
@@ -627,7 +672,19 @@ export type {
   ListJobsErrors,
   ListJobsResponse,
   ListJobsResponses,
+  ListLinkedFirebaseUidsData,
+  ListLinkedFirebaseUidsError,
+  ListLinkedFirebaseUidsErrors,
+  ListLinkedFirebaseUidsRequest,
+  ListLinkedFirebaseUidsResponse,
+  ListLinkedFirebaseUidsResponse2,
+  ListLinkedFirebaseUidsResponses,
   ListMembersResponse,
+  ListSecretProvidersData,
+  ListSecretProvidersError,
+  ListSecretProvidersErrors,
+  ListSecretProvidersResponse,
+  ListSecretProvidersResponses,
   ListSecretsData,
   ListSecretsError,
   ListSecretsErrors,
@@ -775,6 +832,17 @@ export type {
   QueueInfo,
   QueueManageRequest,
   QueueManageResponse,
+  RedeemDesktopLoginCodeData,
+  RedeemDesktopLoginCodeError,
+  RedeemDesktopLoginCodeErrors,
+  RedeemDesktopLoginCodeResponse,
+  RedeemDesktopLoginCodeResponses,
+  ReleaseDeletionHoldData,
+  ReleaseDeletionHoldError,
+  ReleaseDeletionHoldErrors,
+  ReleaseDeletionHoldResponse,
+  ReleaseDeletionHoldResponses,
+  ReleaseHoldResponse,
   RemoveAssetTagsData,
   RemoveAssetTagsError,
   RemoveAssetTagsErrors,
@@ -785,6 +853,11 @@ export type {
   RemoveWorkspaceMemberErrors,
   RemoveWorkspaceMemberResponse,
   RemoveWorkspaceMemberResponses,
+  ReportHistoryEventData,
+  ReportHistoryEventError,
+  ReportHistoryEventErrors,
+  ReportHistoryEventResponse,
+  ReportHistoryEventResponses,
   ReportPartnerUsageData,
   ReportPartnerUsageError,
   ReportPartnerUsageErrors,
@@ -808,6 +881,8 @@ export type {
   RevokeWorkspaceInviteResponse,
   RevokeWorkspaceInviteResponses,
   SecretListResponse,
+  SecretProvider,
+  SecretProvidersResponse,
   SecretResponse,
   SeedAssetsData,
   SeedAssetsResponse,
@@ -819,6 +894,8 @@ export type {
   SetReviewStatusResponse,
   SetReviewStatusResponse2,
   SetReviewStatusResponses,
+  ShortLinkRedirectData,
+  ShortLinkRedirectErrors,
   SubmitFeedbackData,
   SubmitFeedbackError,
   SubmitFeedbackErrors,
@@ -848,6 +925,10 @@ export type {
   TaskEntry,
   TaskResponse,
   TasksListResponse,
+  TeamCreditStop,
+  TeamCreditStopPrice,
+  TeamCreditStops,
+  TeamCreditStopSummary,
   UpdateAssetData,
   UpdateAssetError,
   UpdateAssetErrors,
@@ -865,6 +946,7 @@ export type {
   UpdateHubWorkflowRequest,
   UpdateHubWorkflowResponse,
   UpdateHubWorkflowResponses,
+  UpdateMemberRoleRequest,
   UpdateMultipleSettingsData,
   UpdateMultipleSettingsError,
   UpdateMultipleSettingsErrors,
@@ -895,6 +977,11 @@ export type {
   UpdateWorkspaceData,
   UpdateWorkspaceError,
   UpdateWorkspaceErrors,
+  UpdateWorkspaceMemberRoleData,
+  UpdateWorkspaceMemberRoleError,
+  UpdateWorkspaceMemberRoleErrors,
+  UpdateWorkspaceMemberRoleResponse,
+  UpdateWorkspaceMemberRoleResponses,
   UpdateWorkspaceRequest,
   UpdateWorkspaceResponse,
   UpdateWorkspaceResponses,

packages/ingest-types/src/zod.gen.ts

@@ -465,6 +465,20 @@ export const zCreateWorkflowRequest = z.object({
   forked_from_workflow_version_id: z.string().optional()
 })
 
+/**
+ * Request body for forwarding a comfy-api audit/history event. Identify the target workspace by either user_id (cloud resolves the user's personal workspace via the converged identity, BE-1047) or an explicit workspace_id. At least one must be provided; workspace_id wins when both are set.
+ */
+export const zHistoryEventRequest = z.object({
+  user_id: z.string().optional(),
+  workspace_id: z.string().optional(),
+  event_type: z.string().min(1),
+  event_id: z.string().min(1),
+  params: z.record(z.unknown()).optional(),
+  auth_method: z.enum(['api_key', 'bearer_token']).optional(),
+  customer_ref: z.string().optional(),
+  timestamp: z.string().datetime().optional()
+})
+
 /**
  * Response after recording partner usage data.
  */
@@ -540,11 +554,11 @@ export const zPaymentPortalRequest = z.object({
 })
 
 /**
- * Response after successfully resubscribing to a billing plan.
+ * Response after accepting a resubscribe request.
  */
 export const zResubscribeResponse = z.object({
   billing_op_id: z.string(),
-  status: z.enum(['active']),
+  status: z.enum(['active', 'pending']),
   message: z.string().optional()
 })
 
@@ -585,6 +599,8 @@ export const zSubscribeResponse = z.object({
  */
 export const zSubscribeRequest = z.object({
   plan_slug: z.string(),
+  team_credit_stop_id: z.string().optional(),
+  billing_cycle: z.enum(['monthly', 'yearly']).optional(),
   idempotency_key: z.string().optional(),
   return_url: z.string().optional(),
   cancel_url: z.string().optional()
@@ -626,7 +642,8 @@ export const zSubscriptionTier = z.enum([
   'STANDARD',
   'CREATOR',
   'PRO',
-  'FOUNDERS_EDITION'
+  'FOUNDERS_EDITION',
+  'TEAM'
 ])
 
 /**
@@ -714,6 +731,57 @@ export const zPreviewSubscribeRequest = z.object({
   plan_slug: z.string()
 })
 
+/**
+ * Pre/post-discount price for a team credit stop, in cents.
+ */
+export const zTeamCreditStopPrice = z.object({
+  list_price_cents: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    }),
+  price_cents: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    })
+})
+
+/**
+ * A selectable preset on the team pricing slider. Echoed on subscribe via
+ * team_credit_stop_id; the backend owns the resolved amounts. credits is a
+ * RAW monthly credit count (not cents). Save% is derived by the FE as
+ * (list_price_cents - price_cents) / list_price_cents.
+ *
+ */
+export const zTeamCreditStop = z.object({
+  id: z.string(),
+  credits: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    }),
+  monthly: zTeamCreditStopPrice,
+  yearly: zTeamCreditStopPrice
+})
+
+/**
+ * Credit-stop ladder for the pricing slider (BE-1254). Returned by GET /api/billing/plans for every workspace regardless of the caller's token or workspace type (the personal/team distinction was removed); omitted only when the catalog defines no stops.
+ */
+export const zTeamCreditStops = z.object({
+  default_stop_index: z.number().int(),
+  stops: z.array(zTeamCreditStop)
+})
+
 /**
  * Reason why a plan is unavailable
  */
@@ -773,7 +841,50 @@ export const zPlan = z.object({
  */
 export const zBillingPlansResponse = z.object({
   current_plan_slug: z.string().optional(),
-  plans: z.array(zPlan)
+  plans: z.array(zPlan),
+  team_credit_stops: zTeamCreditStops.optional()
+})
+
+/**
+ * The team credit stop a workspace is currently subscribed to: the
+ * per-workspace slider choice recorded at subscribe time
+ * (workspace_subscriptions.team_credit_stop_id). Amounts are owned by the
+ * catalog, not the subscription row. Returned on GET /api/billing/status
+ * for per-credit Team plans (BE-1254).
+ *
+ */
+export const zTeamCreditStopSummary = z.object({
+  id: z.string(),
+  credits_monthly: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    }),
+  stop_usd: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      message: 'Invalid value: Expected int64 to be >= -9223372036854775808'
+    })
+    .max(BigInt('9223372036854775807'), {
+      message: 'Invalid value: Expected int64 to be <= 9223372036854775807'
+    })
+})
+
+/**
+ * A provider the user may configure a secret for. The shape is deliberately minimal (identifier only) and reserved for future per-provider fields such as sub-keys.
+ */
+export const zSecretProvider = z.object({
+  id: z.string()
+})
+
+/**
+ * The providers available to the authenticated user in the current workspace.
+ */
+export const zSecretProvidersResponse = z.object({
+  data: z.array(zSecretProvider)
 })
 
 /**
@@ -813,7 +924,7 @@ export const zCreateSecretRequest = z.object({
 })
 
 /**
- * A single billing event such as a charge, credit, or adjustment.
+ * A single history event. The cloud history-events store is the single source of truth for both billing events (charges, credits, adjustments) and user-facing usage events.
  */
 export const zBillingEvent = z.object({
   event_type: z.string(),
@@ -868,7 +979,8 @@ export const zBillingStatusResponse = z.object({
   billing_status: zBillingStatus.optional(),
   has_funds: z.boolean(),
   cancel_at: z.string().datetime().optional(),
-  renewal_date: z.string().datetime().optional()
+  renewal_date: z.string().datetime().optional(),
+  team_credit_stop: zTeamCreditStopSummary.nullable()
 })
 
 /**
@@ -930,6 +1042,7 @@ export const zOAuthConsentChallenge = z.object({
   csrf_token: z.string(),
   client_display_name: z.string(),
   resource_display_name: z.string(),
+  redirect_uri: z.string().url(),
   scopes: z.array(z.string()),
   workspaces: z.array(zOAuthConsentChallengeWorkspace)
 })
@@ -1056,6 +1169,66 @@ export const zSyncApiKeyRequest = z.object({
   customer_id: z.string().min(1)
 })
 
+/**
+ * The personal workspace's provisioned billing identity.
+ */
+export const zEnsureWorkspaceBillingProvisionedResponse = z.object({
+  workspace_id: z.string(),
+  stripe_customer_id: z.string(),
+  metronome_customer_id: z.string(),
+  metronome_contract_id: z.string()
+})
+
+/**
+ * The caller's already-resolved legacy (comfy-api) customer identity. When
+ * present and carrying provider IDs, provisioning ATTACHES this identity to
+ * the personal workspace (sharing the existing balance and subscription)
+ * instead of minting a net-new empty customer. Omit (or send with no
+ * provider IDs) for a free user with nothing to attach — provisioning then
+ * creates net-new. This closes the create-new-before-attach gap: a caller
+ * that already knows the legacy identity hands it over so the very first
+ * provisioning is an attach.
+ *
+ */
+export const zEnsureWorkspaceBillingLegacySnapshot = z.object({
+  stripe_customer_id: z.string().optional(),
+  metronome_customer_id: z.string().optional(),
+  metronome_contract_id: z.string().optional(),
+  has_funds: z.boolean().optional(),
+  subscription_tier: z.string().optional(),
+  legacy_stripe_subscription_id: z.string().optional(),
+  legacy_comfy_user_id: z.string().optional()
+})
+
+/**
+ * Request body for ensuring a user's personal workspace carries a fully
+ * provisioned billing identity. Sent by comfy-api's CreateCustomer (BE-1047)
+ * with the already canonical-resolved user identity.
+ *
+ */
+export const zEnsureWorkspaceBillingProvisionedRequest = z.object({
+  user_id: z.string().min(1),
+  email: z.string().email().min(1),
+  snapshot: zEnsureWorkspaceBillingLegacySnapshot.optional()
+})
+
+/**
+ * Firebase UIDs linked to the canonical comfy_user_id. Empty list when
+ * no mappings exist (not an error — callers can treat empty as "unknown
+ * canonical").
+ *
+ */
+export const zListLinkedFirebaseUidsResponse = z.object({
+  firebase_uids: z.array(z.string())
+})
+
+/**
+ * Request body for reverse-looking-up Firebase UIDs linked to a canonical comfy_user_id.
+ */
+export const zListLinkedFirebaseUidsRequest = z.object({
+  comfy_user_id: z.string().min(1)
+})
+
 /**
  * Response confirming the validity and scope of a workspace API key.
  */
@@ -1172,7 +1345,8 @@ export const zMember = z.object({
   name: z.string(),
   email: z.string().email(),
   role: z.enum(['owner', 'member']),
-  joined_at: z.string().datetime()
+  joined_at: z.string().datetime(),
+  is_original_owner: z.boolean()
 })
 
 /**
@@ -1183,6 +1357,13 @@ export const zListMembersResponse = z.object({
   pagination: zPaginationInfo
 })
 
+/**
+ * Request body for changing a workspace member's role.
+ */
+export const zUpdateMemberRoleRequest = z.object({
+  role: z.enum(['owner', 'member'])
+})
+
 /**
  * Request body for updating an existing workspace's settings.
  */
@@ -1227,6 +1408,60 @@ export const zWorkspace = z.object({
   created_at: z.string().datetime()
 })
 
+/**
+ * Exchange poll result. Pending until the code is redeemed in the browser.
+ */
+export const zDesktopLoginCodeExchangeResponse = z.object({
+  status: z.enum(['pending', 'complete']),
+  custom_token: z.string().optional()
+})
+
+/**
+ * Request to exchange a redeemed login code for a custom token.
+ */
+export const zDesktopLoginCodeExchangeRequest = z.object({
+  code: z.string(),
+  code_verifier: z.string().min(43).max(128)
+})
+
+/**
+ * Result of redeeming a desktop login code.
+ */
+export const zDesktopLoginCodeRedeemResponse = z.object({
+  status: z.enum(['redeemed'])
+})
+
+/**
+ * Request to claim a desktop login code for the authenticated user.
+ */
+export const zDesktopLoginCodeRedeemRequest = z.object({
+  code: z.string()
+})
+
+/**
+ * A freshly minted desktop login code and its polling parameters.
+ */
+export const zDesktopLoginCodeCreateResponse = z.object({
+  code: z.string(),
+  expires_in: z.number().int(),
+  poll_interval: z.number().int()
+})
+
+/**
+ * Request to mint a desktop login code.
+ */
+export const zDesktopLoginCodeCreateRequest = z.object({
+  installation_id: z
+    .string()
+    .min(8)
+    .max(128)
+    .regex(/^[A-Za-z0-9._-]+$/)
+    .optional(),
+  platform: z.string().min(1).max(32),
+  app_version: z.string().min(1).max(64),
+  code_challenge: z.string().min(43).max(128)
+})
+
 /**
  * Abbreviated workspace metadata used in list responses.
  */
@@ -1294,6 +1529,15 @@ export const zTasksListResponse = z.object({
   pagination: zPaginationInfo
 })
 
+/**
+ * Result of authorizing a legal-hold release on a user's deletion.
+ */
+export const zReleaseHoldResponse = z.object({
+  firebase_id: z.string(),
+  released: z.boolean(),
+  message: z.string()
+})
+
 /**
  * Current status of a user data deletion request.
  */
@@ -1363,6 +1607,20 @@ export const zJobDetailResponse = z.object({
   execution_meta: z.record(z.unknown()).optional()
 })
 
+/**
+ * Response for POST /api/jobs/cancel.
+ */
+export const zJobsCancelResponse = z.object({
+  cancelled: z.array(z.string())
+})
+
+/**
+ * Request to cancel multiple jobs by ID.
+ */
+export const zJobsCancelRequest = z.object({
+  job_ids: z.array(z.string().uuid()).min(1).max(100)
+})
+
 /**
  * Response for POST /api/jobs/{job_id}/cancel. Returned on both fresh cancels and idempotent no-ops.
  */
@@ -1529,6 +1787,7 @@ export const zAsset = z.object({
   user_metadata: z.record(z.unknown()).optional(),
   metadata: z.record(z.unknown()).readonly().optional(),
   preview_url: z.string().url().optional(),
+  short_url: z.string().nullish(),
   preview_id: z.string().uuid().nullish(),
   job_id: z.string().uuid().nullish(),
   created_at: z.string().datetime(),
@@ -1624,6 +1883,7 @@ export const zSystemStatsResponse = z.object({
     python_version: z.string(),
     embedded_python: z.boolean(),
     comfyui_version: z.string(),
+    deploy_environment: z.string().optional(),
     comfyui_frontend_version: z.string().optional(),
     workflow_templates_version: z.string().optional(),
     cloud_version: z.string().optional(),
@@ -1962,6 +2222,7 @@ export const zAssetWritable = z.object({
   tags: z.array(z.string()).optional(),
   user_metadata: z.record(z.unknown()).optional(),
   preview_url: z.string().url().optional(),
+  short_url: z.string().nullish(),
   preview_id: z.string().uuid().nullish(),
   job_id: z.string().uuid().nullish(),
   created_at: z.string().datetime(),
@@ -2180,7 +2441,11 @@ export const zGetJobDetailData = z.object({
   path: z.object({
     job_id: z.string().uuid()
   }),
-  query: z.never().optional()
+  query: z
+    .object({
+      short_link: z.enum(['ephemeral_tool_chain', 'default']).optional()
+    })
+    .optional()
 })
 
 /**
@@ -2201,6 +2466,17 @@ export const zCancelJobData = z.object({
  */
 export const zCancelJobResponse = zJobCancelResponse
 
+export const zCancelJobsData = z.object({
+  body: zJobsCancelRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Success - cancel requests dispatched (or jobs were already terminal)
+ */
+export const zCancelJobsResponse = zJobsCancelResponse
+
 export const zViewFileData = z.object({
   body: z.never().optional(),
   path: z.never().optional(),
@@ -2580,6 +2856,17 @@ export const zCreateSecretData = z.object({
  */
 export const zCreateSecretResponse = zSecretResponse
 
+export const zListSecretProvidersData = z.object({
+  body: z.never().optional(),
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Success
+ */
+export const zListSecretProvidersResponse = zSecretProvidersResponse
+
 export const zDeleteSecretData = z.object({
   body: z.never().optional(),
   path: z.object({
@@ -2881,6 +3168,40 @@ export const zExchangeTokenData = z.object({
  */
 export const zExchangeTokenResponse2 = zExchangeTokenResponse
 
+export const zCreateDesktopLoginCodeData = z.object({
+  body: zDesktopLoginCodeCreateRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Login code created
+ */
+export const zCreateDesktopLoginCodeResponse = zDesktopLoginCodeCreateResponse
+
+export const zRedeemDesktopLoginCodeData = z.object({
+  body: zDesktopLoginCodeRedeemRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Code redeemed (or already redeemed by the same user)
+ */
+export const zRedeemDesktopLoginCodeResponse = zDesktopLoginCodeRedeemResponse
+
+export const zExchangeDesktopLoginCodeData = z.object({
+  body: zDesktopLoginCodeExchangeRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Pending (not yet redeemed) or complete with a custom token
+ */
+export const zExchangeDesktopLoginCodeResponse =
+  zDesktopLoginCodeExchangeResponse
+
 export const zGetJwksData = z.object({
   body: z.never().optional(),
   path: z.never().optional(),
@@ -3150,6 +3471,19 @@ export const zRemoveWorkspaceMemberData = z.object({
  */
 export const zRemoveWorkspaceMemberResponse = z.void()
 
+export const zUpdateWorkspaceMemberRoleData = z.object({
+  body: zUpdateMemberRoleRequest,
+  path: z.object({
+    userId: z.string()
+  }),
+  query: z.never().optional()
+})
+
+/**
+ * Member role updated
+ */
+export const zUpdateWorkspaceMemberRoleResponse = zMember
+
 export const zListWorkspaceApiKeysData = z.object({
   body: z.never().optional(),
   path: z.never().optional(),
@@ -3236,6 +3570,19 @@ export const zSetReviewStatusData = z.object({
  */
 export const zSetReviewStatusResponse2 = zSetReviewStatusResponse
 
+export const zAdminDeleteHubWorkflowData = z.object({
+  body: z.never().optional(),
+  path: z.object({
+    share_id: z.string()
+  }),
+  query: z.never().optional()
+})
+
+/**
+ * Successfully deleted
+ */
+export const zAdminDeleteHubWorkflowResponse = z.void()
+
 export const zUpdateHubWorkflowData = z.object({
   body: zUpdateHubWorkflowRequest,
   path: z.object({
@@ -3277,6 +3624,19 @@ export const zCreateDeletionRequestResponse = z.object({
   user_found_in_cloud: z.boolean()
 })
 
+export const zReleaseDeletionHoldData = z.object({
+  body: z.object({
+    firebase_id: z.string()
+  }),
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Release authorized; the deletion workflow will proceed
+ */
+export const zReleaseDeletionHoldResponse = zReleaseHoldResponse
+
 export const zReportPartnerUsageData = z.object({
   body: zPartnerUsageRequest,
   path: z.never().optional(),
@@ -3288,6 +3648,38 @@ export const zReportPartnerUsageData = z.object({
  */
 export const zReportPartnerUsageResponse = zPartnerUsageResponse
 
+export const zGetHistoryEventsData = z.object({
+  body: z.never().optional(),
+  path: z.never().optional(),
+  query: z
+    .object({
+      workspace_id: z.string().optional(),
+      user_id: z.string().optional(),
+      event_type: z.string().optional(),
+      start_date: z.string().datetime().optional(),
+      end_date: z.string().datetime().optional(),
+      page: z.number().int().optional(),
+      limit: z.number().int().optional()
+    })
+    .optional()
+})
+
+/**
+ * Paginated cloud history events for the workspace
+ */
+export const zGetHistoryEventsResponse = zBillingEventsResponse
+
+export const zReportHistoryEventData = z.object({
+  body: zHistoryEventRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * History event recorded successfully
+ */
+export const zReportHistoryEventResponse = zPartnerUsageResponse
+
 export const zUpdateSubscriptionCacheData = z.object({
   body: z.object({
     user_id: z.string(),
@@ -3305,6 +3697,29 @@ export const zUpdateSubscriptionCacheResponse = z.object({
   status: z.string().optional()
 })
 
+export const zListLinkedFirebaseUidsData = z.object({
+  body: zListLinkedFirebaseUidsRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * Linked Firebase UIDs (possibly empty list)
+ */
+export const zListLinkedFirebaseUidsResponse2 = zListLinkedFirebaseUidsResponse
+
+export const zEnsureWorkspaceBillingProvisionedData = z.object({
+  body: zEnsureWorkspaceBillingProvisionedRequest,
+  path: z.never().optional(),
+  query: z.never().optional()
+})
+
+/**
+ * The workspace's provisioned billing identity
+ */
+export const zEnsureWorkspaceBillingProvisionedResponse2 =
+  zEnsureWorkspaceBillingProvisionedResponse
+
 export const zInsertDynamicConfigData = z.object({
   body: z.record(z.unknown()),
   path: z.never().optional(),
@@ -4010,6 +4425,14 @@ export const zGetModelPreviewData = z.object({
   query: z.never().optional()
 })
 
+export const zShortLinkRedirectData = z.object({
+  body: z.never().optional(),
+  path: z.object({
+    id: z.string()
+  }),
+  query: z.never().optional()
+})
+
 export const zGetLegacyPromptByIdData = z.object({
   body: z.never().optional(),
   path: z.object({
@@ -4070,14 +4493,23 @@ export const zGetLegacyUserdataV2Data = z.object({
   query: z.never().optional()
 })
 
-export const zGetLegacyAssetContentData = z.object({
+export const zGetAssetContentData = z.object({
   body: z.never().optional(),
   path: z.object({
     id: z.string()
   }),
-  query: z.never().optional()
+  query: z
+    .object({
+      disposition: z.enum(['inline', 'attachment']).optional()
+    })
+    .optional()
 })
 
+/**
+ * Asset content stream (local runtime streams the bytes directly)
+ */
+export const zGetAssetContentResponse = z.string()
+
 export const zGetLegacyViewMetadataData = z.object({
   body: z.never().optional(),
   path: z.object({

packages/ingest-types/tsconfig.json

@@ -4,5 +4,5 @@
     "rootDir": "src",
     "outDir": "dist"
   },
-  "include": ["src/**/*", "*.config.ts"]
+  "include": ["src/**/*"]
 }

packages/object-info-parser/tsconfig.json

@@ -4,5 +4,5 @@
     "rootDir": "src",
     "outDir": "dist"
   },
-  "include": ["src/**/*", "vitest.config.ts"]
+  "include": ["src/**/*"]
 }

src/components/LiteGraphCanvasSplitterOverlay.vue

@@ -35,10 +35,10 @@
           :class="
             sidebarLocation === 'left'
               ? cn(
-                  'side-bar-panel pointer-events-auto bg-comfy-menu-bg',
+                  'side-bar-panel pointer-events-auto bg-comfy-menu-bg focus-visible:outline-hidden',
                   sidebarPanelVisible && 'min-w-78'
                 )
-              : 'pointer-events-auto bg-comfy-menu-bg'
+              : 'pointer-events-auto bg-comfy-menu-bg focus-visible:outline-hidden'
           "
           :min-size="
             sidebarLocation === 'left' ? SIDEBAR_MIN_SIZE : BUILDER_MIN_SIZE
@@ -82,7 +82,7 @@
             </SplitterPanel>
             <SplitterPanel
               v-show="bottomPanelVisible && !focusMode"
-              class="bottom-panel pointer-events-auto max-w-full overflow-x-auto rounded-lg border border-(--p-panel-border-color) bg-comfy-menu-bg"
+              class="bottom-panel pointer-events-auto max-w-full overflow-x-auto rounded-lg border border-(--p-panel-border-color) bg-comfy-menu-bg focus-visible:outline-hidden"
             >
               <slot name="bottom-panel" />
             </SplitterPanel>
@@ -95,10 +95,10 @@
           :class="
             sidebarLocation === 'right'
               ? cn(
-                  'side-bar-panel pointer-events-auto bg-comfy-menu-bg',
+                  'side-bar-panel pointer-events-auto bg-comfy-menu-bg focus-visible:outline-hidden',
                   sidebarPanelVisible && 'min-w-78'
                 )
-              : 'pointer-events-auto bg-comfy-menu-bg'
+              : 'pointer-events-auto bg-comfy-menu-bg focus-visible:outline-hidden'
           "
           :min-size="
             sidebarLocation === 'right' ? SIDEBAR_MIN_SIZE : BUILDER_MIN_SIZE

src/components/dialog/content/signin/SignUpForm.test.ts

@@ -7,7 +7,7 @@ import Password from 'primevue/password'
 import PrimeVue from 'primevue/config'
 import ProgressSpinner from 'primevue/progressspinner'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { defineComponent, h, nextTick, ref } from 'vue'
+import { computed, defineComponent, h, nextTick, ref } from 'vue'
 import { createI18n } from 'vue-i18n'
 
 import enMessages from '@/locales/en/main.json' with { type: 'json' }
@@ -38,29 +38,45 @@ vi.mock('@/stores/authStore', () => ({
 }))
 
 const mockTurnstileEnabled = ref(false)
-const mockTurnstileEnforced = ref(false)
+const mockTurnstileToken = ref('')
+const mockTurnstileUnavailable = ref(false)
 const mockReset = vi.fn()
 let emitTurnstileToken: ((token: string) => void) | undefined
+let emitTurnstileUnavailable: ((unavailable: boolean) => void) | undefined
 
+// The reset-on-toggle behavior lives in useTurnstileGate itself (see
+// useTurnstile.test.ts); this fake just wires token/unavailable through to
+// `waiting` the same way so SignUpForm's submit gating can be exercised.
 vi.mock('@/composables/auth/useTurnstile', () => ({
   useTurnstile: () => ({
-    enabled: mockTurnstileEnabled,
-    enforced: mockTurnstileEnforced
+    enabled: mockTurnstileEnabled
+  }),
+  useTurnstileGate: () => ({
+    token: mockTurnstileToken,
+    unavailable: mockTurnstileUnavailable,
+    waiting: computed(
+      () =>
+        mockTurnstileEnabled.value &&
+        !mockTurnstileToken.value &&
+        !mockTurnstileUnavailable.value
+    )
   })
 }))
 
 // Stub the real widget (which loads the external Turnstile script) with one that
-// exposes a spyable reset() and lets a test drive the v-model token the way a
-// solved challenge would.
+// exposes a spyable reset() and lets a test drive the v-model token/unavailable
+// the way a solved challenge (or a broken/slow widget) would.
 vi.mock('./TurnstileWidget.vue', async () => {
   const { defineComponent: defineMock } = await import('vue')
   return {
     default: defineMock({
       name: 'TurnstileWidget',
-      emits: ['update:token'],
+      emits: ['update:token', 'update:unavailable'],
       setup(_, { expose, emit }) {
         expose({ reset: mockReset })
         emitTurnstileToken = (token: string) => emit('update:token', token)
+        emitTurnstileUnavailable = (unavailable: boolean) =>
+          emit('update:unavailable', unavailable)
         return () => null
       }
     })
@@ -92,9 +108,11 @@ describe('SignUpForm', () => {
   beforeEach(() => {
     mockLoadingRef.value = false
     mockTurnstileEnabled.value = false
-    mockTurnstileEnforced.value = false
+    mockTurnstileToken.value = ''
+    mockTurnstileUnavailable.value = false
     mockReset.mockClear()
     emitTurnstileToken = undefined
+    emitTurnstileUnavailable = undefined
   })
 
   afterEach(() => {
@@ -211,43 +229,22 @@ describe('SignUpForm', () => {
     })
   })
 
-  describe('Turnstile token hygiene', () => {
-    it('clears the stale token when Turnstile becomes disabled', async () => {
-      mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = true
-      const { user } = renderComponent()
-      await fillValidSignup(user)
-
-      emitTurnstileToken!('stale-token')
-      await nextTick()
-      expect(
-        screen.getByRole('button', { name: signUpButton })
-      ).not.toBeDisabled()
-
-      mockTurnstileEnabled.value = false
-      await nextTick()
-
-      // re-enable: the stale token must have been cleared so submit is blocked again
-      mockTurnstileEnabled.value = true
-      await nextTick()
-
-      expect(screen.getByRole('button', { name: signUpButton })).toBeDisabled()
-    })
-  })
-
+  // Regression coverage for the shadow-mode race: previously submit was only
+  // gated in 'enforce' mode, so most real signups in 'shadow' mode raced
+  // ahead of the async Cloudflare challenge and reached the backend with an
+  // empty token. Gating now depends only on whether the widget is enabled
+  // (shadow or enforce both render it), so both modes behave identically here.
   describe('Turnstile submit gating', () => {
-    it('disables the submit button in enforce mode until a token is present', async () => {
+    it('disables the submit button until a token is present', async () => {
       mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = true
       renderComponent()
       await nextTick()
 
       expect(screen.getByRole('button', { name: signUpButton })).toBeDisabled()
     })
 
-    it('does not emit submit in enforce mode while the token is empty', async () => {
+    it('does not emit submit while the token is empty', async () => {
       mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = true
       const onSubmit = vi.fn()
       const { user } = renderComponent({ onSubmit })
       await fillValidSignup(user)
@@ -257,9 +254,8 @@ describe('SignUpForm', () => {
       expect(onSubmit).not.toHaveBeenCalled()
     })
 
-    it('emits submit with the token in enforce mode once the challenge is solved', async () => {
+    it('emits submit with the token once the challenge is solved', async () => {
       mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = true
       const onSubmit = vi.fn()
       const { user } = renderComponent({ onSubmit })
       await fillValidSignup(user)
@@ -271,13 +267,14 @@ describe('SignUpForm', () => {
       expect(onSubmit).toHaveBeenCalledWith(expectedValues, 'token-xyz')
     })
 
-    it('emits submit without a token in shadow mode (never blocks)', async () => {
+    it('emits submit without a token once the widget reports itself unavailable (broken/slow load fallback)', async () => {
       mockTurnstileEnabled.value = true
-      mockTurnstileEnforced.value = false
       const onSubmit = vi.fn()
       const { user } = renderComponent({ onSubmit })
       await fillValidSignup(user)
 
+      emitTurnstileUnavailable!(true)
+      await nextTick()
       await user.click(screen.getByRole('button', { name: signUpButton }))
 
       expect(onSubmit).toHaveBeenCalledWith(expectedValues, undefined)

src/components/dialog/content/signin/SignUpForm.vue

@@ -33,10 +33,11 @@
       v-if="turnstileEnabled"
       ref="turnstileWidget"
       v-model:token="turnstileToken"
+      v-model:unavailable="turnstileUnavailable"
     />
 
     <small
-      v-show="submitBlockedByTurnstile"
+      v-show="waitingForTurnstile"
       id="comfy-org-sign-up-turnstile-hint"
       role="status"
       aria-live="polite"
@@ -51,11 +52,9 @@
       v-else
       type="submit"
       class="mt-4 h-10 font-medium"
-      :disabled="!$form.valid || submitBlockedByTurnstile"
+      :disabled="!$form.valid || waitingForTurnstile"
       :aria-describedby="
-        submitBlockedByTurnstile
-          ? 'comfy-org-sign-up-turnstile-hint'
-          : undefined
+        waitingForTurnstile ? 'comfy-org-sign-up-turnstile-hint' : undefined
       "
     >
       {{ t('auth.signup.signUpButton') }}
@@ -70,11 +69,11 @@ import { zodResolver } from '@primevue/forms/resolvers/zod'
 import { useThrottleFn } from '@vueuse/core'
 import InputText from 'primevue/inputtext'
 import ProgressSpinner from 'primevue/progressspinner'
-import { computed, ref, useTemplateRef, watch } from 'vue'
+import { computed, useTemplateRef } from 'vue'
 import { useI18n } from 'vue-i18n'
 
 import Button from '@/components/ui/button/Button.vue'
-import { useTurnstile } from '@/composables/auth/useTurnstile'
+import { useTurnstile, useTurnstileGate } from '@/composables/auth/useTurnstile'
 import { signUpSchema } from '@/schemas/signInSchema'
 import type { SignUpData } from '@/schemas/signInSchema'
 import { useAuthStore } from '@/stores/authStore'
@@ -86,25 +85,21 @@ const { t } = useI18n()
 const authStore = useAuthStore()
 const loading = computed(() => authStore.loading)
 
-const { enabled: turnstileEnabled, enforced: turnstileEnforced } =
-  useTurnstile()
-const turnstileToken = ref('')
+const { enabled: turnstileEnabled } = useTurnstile()
+const {
+  token: turnstileToken,
+  unavailable: turnstileUnavailable,
+  waiting: waitingForTurnstile
+} = useTurnstileGate(turnstileEnabled)
 const turnstileWidget =
   useTemplateRef<InstanceType<typeof TurnstileWidget>>('turnstileWidget')
-const submitBlockedByTurnstile = computed(
-  () => turnstileEnforced.value && !turnstileToken.value
-)
-
-watch(turnstileEnabled, (on) => {
-  if (!on) turnstileToken.value = ''
-})
 
 const emit = defineEmits<{
   submit: [values: SignUpData, turnstileToken?: string]
 }>()
 
 const onSubmit = useThrottleFn((event: FormSubmitEvent) => {
-  if (event.valid && !submitBlockedByTurnstile.value) {
+  if (event.valid && !waitingForTurnstile.value) {
     emit(
       'submit',
       event.values as SignUpData,

src/components/dialog/content/signin/TurnstileWidget.test.ts

@@ -261,4 +261,138 @@ describe('TurnstileWidget', () => {
 
     expect(api.remove).toHaveBeenCalledWith('widget-id')
   })
+
+  // A widget that never resolves (broken script, ad-blocker, CDN outage, or a
+  // hung challenge) must eventually tell the parent it cannot be relied on,
+  // so submission can fall back instead of blocking a legitimate signup
+  // forever.
+  describe('unavailable fallback', () => {
+    it('reports unavailable when the Turnstile script fails to load', async () => {
+      mockLoadTurnstile.mockRejectedValue(new Error('script failed'))
+
+      const { emitted } = renderWidget()
+      await flush()
+
+      expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+    })
+
+    it('reports unavailable on a challenge error', async () => {
+      const { api, options } = fakeTurnstile()
+      mockLoadTurnstile.mockResolvedValue(api)
+
+      const { emitted } = renderWidget()
+      await flush()
+
+      options()!['error-callback']!()
+      await flush()
+
+      expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+    })
+
+    it('clears the unavailable fallback once a token is solved', async () => {
+      const { api, options } = fakeTurnstile()
+      mockLoadTurnstile.mockResolvedValue(api)
+
+      const { emitted } = renderWidget()
+      await flush()
+
+      options()!['error-callback']!()
+      await flush()
+      expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+
+      options()!.callback!('token-abc')
+      await flush()
+
+      expect(emitted()['update:unavailable']?.at(-1)).toEqual([false])
+    })
+
+    it('falls back once the widget fails to resolve within the load timeout', async () => {
+      vi.useFakeTimers()
+      try {
+        const { api, options } = fakeTurnstile()
+        mockLoadTurnstile.mockResolvedValue(api)
+
+        const { emitted } = renderWidget()
+        // Let the onMounted hook's `await loadTurnstile()` microtask settle
+        // and render() run, without yet advancing to the timeout itself.
+        await vi.advanceTimersByTimeAsync(0)
+        expect(options()).toBeDefined()
+        expect(emitted()['update:unavailable']).toBeUndefined()
+
+        await vi.advanceTimersByTimeAsync(9_000)
+
+        expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('does not fall back once a token arrives before the load timeout', async () => {
+      vi.useFakeTimers()
+      try {
+        const { api, options } = fakeTurnstile()
+        mockLoadTurnstile.mockResolvedValue(api)
+
+        const { emitted } = renderWidget()
+        await vi.advanceTimersByTimeAsync(0)
+
+        options()!.callback!('token-abc')
+        await vi.advanceTimersByTimeAsync(9_000)
+
+        expect(emitted()['update:unavailable']).toBeUndefined()
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('resets the widget to fetch a fresh challenge on token expiry', async () => {
+      const { api, options } = fakeTurnstile()
+      mockLoadTurnstile.mockResolvedValue(api)
+      window.turnstile = api as unknown as NonNullable<Window['turnstile']>
+
+      renderWidget()
+      await flush()
+
+      options()!.callback!('token-abc')
+      options()!['expired-callback']!()
+      await flush()
+
+      expect(api.reset).toHaveBeenCalledWith('widget-id')
+    })
+
+    it('falls back if a post-solve expiry is not followed by a fresh token within the load timeout', async () => {
+      vi.useFakeTimers()
+      try {
+        const { api, options } = fakeTurnstile()
+        mockLoadTurnstile.mockResolvedValue(api)
+        window.turnstile = api as unknown as NonNullable<Window['turnstile']>
+
+        const { emitted } = renderWidget()
+        await vi.advanceTimersByTimeAsync(0)
+
+        // Establish a solved, available widget: an initial error marks it
+        // unavailable, then solving a challenge clears that (the same
+        // transition the existing "clears the unavailable fallback" test
+        // verifies), so the expiry below is the only thing driving fallback.
+        options()!['error-callback']!()
+        options()!.callback!('token-abc')
+        expect(emitted()['update:unavailable']?.at(-1)).toEqual([false])
+
+        // The token later expires (e.g. tab backgrounded past its ~300s
+        // lifetime) without the widget itself erroring.
+        options()!['expired-callback']!()
+        await vi.advanceTimersByTimeAsync(0)
+
+        // A fresh challenge was requested, but nothing solves it before the
+        // re-armed load timeout elapses, so submission must eventually be
+        // unblocked rather than staying stuck forever.
+        expect(emitted()['update:unavailable']?.at(-1)).toEqual([false])
+        await vi.advanceTimersByTimeAsync(9_000)
+
+        expect(emitted()['update:unavailable']?.at(-1)).toEqual([true])
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+  })
 })

src/components/dialog/content/signin/TurnstileWidget.vue

@@ -12,6 +12,7 @@
 </template>
 
 <script setup lang="ts">
+import { useTimeoutFn } from '@vueuse/core'
 import { onBeforeUnmount, onMounted, ref } from 'vue'
 import { useI18n } from 'vue-i18n'
 
@@ -20,6 +21,14 @@ import { getTurnstileSiteKey } from '@/config/turnstile'
 import { useColorPaletteStore } from '@/stores/workspace/colorPaletteStore'
 
 const token = defineModel<string>('token', { default: '' })
+/**
+ * Set true whenever the widget cannot be relied on to ever produce a token:
+ * the Cloudflare script failed to load, the rendered challenge errored out,
+ * or it simply hasn't resolved within `TURNSTILE_LOAD_TIMEOUT_MS`. The parent
+ * uses this to stop waiting on a token so a broken/slow widget (network
+ * issue, ad-blocker, CDN outage) can never permanently block signup.
+ */
+const unavailable = defineModel<boolean>('unavailable', { default: false })
 
 const { t } = useI18n()
 const colorPaletteStore = useColorPaletteStore()
@@ -28,6 +37,16 @@ const containerRef = ref<HTMLDivElement>()
 const errorMessage = ref('')
 let widgetId: string | undefined
 
+/** How long to wait for the widget to resolve before falling back. */
+const TURNSTILE_LOAD_TIMEOUT_MS = 9_000
+const { start: armTimeout, stop: clearLoadTimeout } = useTimeoutFn(
+  () => {
+    unavailable.value = true
+  },
+  TURNSTILE_LOAD_TIMEOUT_MS,
+  { immediate: false }
+)
+
 const clearToken = () => {
   token.value = ''
 }
@@ -46,12 +65,18 @@ const reset = () => {
   errorMessage.value = ''
   if (widgetId && window.turnstile) {
     window.turnstile.reset(widgetId)
+    // A widget that renders can request a fresh challenge, so give it
+    // another chance before falling back again.
+    unavailable.value = false
+    armTimeout()
   }
 }
 
 defineExpose({ reset })
 
 onMounted(async () => {
+  armTimeout()
+
   try {
     const turnstile = await loadTurnstile()
     if (!containerRef.value) return
@@ -64,23 +89,37 @@ onMounted(async () => {
       sitekey: getTurnstileSiteKey(),
       theme,
       callback: (newToken: string) => {
+        clearLoadTimeout()
         errorMessage.value = ''
+        unavailable.value = false
         token.value = newToken
       },
       'expired-callback': () => {
         clearToken()
         errorMessage.value = t('auth.turnstile.expired')
+        if (widgetId && window.turnstile) {
+          window.turnstile.reset(widgetId)
+          // A solved token can expire on its own (e.g. the tab was
+          // backgrounded past the token's ~300s lifetime) without the widget
+          // ever erroring, so proactively request a fresh challenge and
+          // re-arm the load timeout in case it doesn't resolve in time.
+          armTimeout()
+        }
       },
       'error-callback': () => {
         clearToken()
+        clearLoadTimeout()
         console.warn('Turnstile challenge failed')
         errorMessage.value = t('auth.turnstile.failed')
+        unavailable.value = true
         if (widgetId && window.turnstile) window.turnstile.reset(widgetId)
       }
     })
   } catch (error) {
+    clearLoadTimeout()
     console.warn('Turnstile failed to load', error)
     errorMessage.value = t('auth.turnstile.failed')
+    unavailable.value = true
   }
 })
 

src/composables/auth/useAuthActions.test.ts

@@ -8,6 +8,10 @@ import type { ComfyWorkflow } from '@/platform/workflow/management/stores/workfl
 type ModifiedWorkflow = Pick<ComfyWorkflow, 'path' | 'isModified'>
 
 const mockAuthStore = vi.hoisted(() => ({
+  login: vi.fn().mockResolvedValue(undefined),
+  loginWithGoogle: vi.fn().mockResolvedValue(undefined),
+  loginWithGithub: vi.fn().mockResolvedValue(undefined),
+  register: vi.fn().mockResolvedValue(undefined),
   logout: vi.fn().mockResolvedValue(undefined)
 }))
 
@@ -28,10 +32,12 @@ const mockDialogService = vi.hoisted(() => ({
 }))
 
 const mockToastErrorHandler = vi.hoisted(() => vi.fn())
+const mockTrackAuthFailed = vi.hoisted(() => vi.fn())
 
 const knownAuthErrorCodes = new Set([
   'auth/invalid-credential',
-  'auth/email-already-in-use'
+  'auth/email-already-in-use',
+  'auth/user-not-found'
 ])
 
 vi.mock('@/i18n', () => ({
@@ -48,7 +54,9 @@ vi.mock('@/platform/distribution/types', () => ({
 }))
 
 vi.mock('@/platform/telemetry', () => ({
-  useTelemetry: vi.fn(() => undefined)
+  useTelemetry: vi.fn(() => ({
+    trackAuthFailed: mockTrackAuthFailed
+  }))
 }))
 
 vi.mock('@/platform/updates/common/toastStore', () => ({
@@ -81,9 +89,19 @@ vi.mock('@/composables/billing/useBillingContext', () => ({
 
 vi.mock('@/composables/useErrorHandling', () => ({
   useErrorHandling: () => ({
-    wrapWithErrorHandlingAsync: <TArgs extends unknown[], TReturn>(
-      action: (...args: TArgs) => Promise<TReturn> | TReturn
-    ) => action,
+    wrapWithErrorHandlingAsync:
+      <TArgs extends unknown[], TReturn>(
+        action: (...args: TArgs) => Promise<TReturn> | TReturn,
+        errorHandler?: (error: unknown) => void
+      ) =>
+      async (...args: TArgs) => {
+        try {
+          return await action(...args)
+        } catch (error) {
+          ;(errorHandler ?? mockToastErrorHandler)(error)
+          return undefined
+        }
+      },
     toastErrorHandler: mockToastErrorHandler
   })
 }))
@@ -156,10 +174,13 @@ describe('useAuthActions.logout', () => {
     )
     const { logout } = useAuthActions()
 
-    await expect(logout()).rejects.toThrow('auth.signOut.saveFailed:a.json')
+    await logout()
 
     expect(mockWorkflowService.saveWorkflow).toHaveBeenCalledTimes(1)
     expect(mockAuthStore.logout).not.toHaveBeenCalled()
+    expect(mockToastErrorHandler).toHaveBeenCalledExactlyOnceWith(
+      new Error('auth.signOut.saveFailed:a.json')
+    )
   })
 
   it('saves every modified workflow before signing out when user picks Save (true)', async () => {
@@ -206,6 +227,85 @@ describe('useAuthActions.logout', () => {
   })
 })
 
+describe('useAuthActions auth flow error telemetry', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    vi.clearAllMocks()
+    mockWorkflowStore.modifiedWorkflows = []
+  })
+
+  it('tracks email sign-in Firebase failures and still shows the error toast', async () => {
+    const error = new FirebaseError('auth/user-not-found', 'msg')
+    mockAuthStore.login.mockRejectedValueOnce(error)
+    const { signInWithEmail } = useAuthActions()
+
+    await expect(
+      signInWithEmail('user@example.com', 'password')
+    ).resolves.toBeUndefined()
+
+    expect(mockTrackAuthFailed).toHaveBeenCalledExactlyOnceWith({
+      error_code: 'auth/user-not-found',
+      auth_action: 'email_sign_in'
+    })
+    expect(mockToastStore.add).toHaveBeenCalledWith({
+      severity: 'error',
+      summary: 'g.error',
+      detail: 'auth.errors.auth/user-not-found'
+    })
+  })
+
+  it('tracks unknown errors for email sign-up failures', async () => {
+    const error = new Error('network failed')
+    mockAuthStore.register.mockRejectedValueOnce(error)
+    const { signUpWithEmail } = useAuthActions()
+
+    await expect(
+      signUpWithEmail('user@example.com', 'password')
+    ).resolves.toBeUndefined()
+
+    expect(mockTrackAuthFailed).toHaveBeenCalledExactlyOnceWith({
+      error_code: 'unknown',
+      auth_action: 'email_sign_up'
+    })
+  })
+
+  it('tracks Google sign-up failures separately from sign-in failures', async () => {
+    const error = new FirebaseError('auth/popup-closed-by-user', 'msg')
+    mockAuthStore.loginWithGoogle.mockRejectedValueOnce(error)
+    const { signInWithGoogle } = useAuthActions()
+
+    await expect(signInWithGoogle({ isNewUser: true })).resolves.toBeUndefined()
+
+    expect(mockTrackAuthFailed).toHaveBeenCalledExactlyOnceWith({
+      error_code: 'auth/popup-closed-by-user',
+      auth_action: 'google_sign_up'
+    })
+  })
+
+  it('tracks GitHub sign-up failures separately from sign-in failures', async () => {
+    const error = new FirebaseError('auth/popup-closed-by-user', 'msg')
+    mockAuthStore.loginWithGithub.mockRejectedValueOnce(error)
+    const { signInWithGithub } = useAuthActions()
+
+    await expect(signInWithGithub({ isNewUser: true })).resolves.toBeUndefined()
+
+    expect(mockTrackAuthFailed).toHaveBeenCalledExactlyOnceWith({
+      error_code: 'auth/popup-closed-by-user',
+      auth_action: 'github_sign_up'
+    })
+  })
+
+  it('does not track auth failures for logout failures', async () => {
+    const error = new FirebaseError('auth/network-request-failed', 'msg')
+    mockAuthStore.logout.mockRejectedValueOnce(error)
+    const { logout } = useAuthActions()
+
+    await logout()
+
+    expect(mockTrackAuthFailed).not.toHaveBeenCalled()
+  })
+})
+
 describe('useAuthActions.reportError', () => {
   beforeEach(() => {
     setActivePinia(createPinia())

src/composables/auth/useAuthActions.ts

@@ -8,6 +8,7 @@ import type { ErrorRecoveryStrategy } from '@/composables/useErrorHandling'
 import { st, t } from '@/i18n'
 import { isCloud } from '@/platform/distribution/types'
 import { useTelemetry } from '@/platform/telemetry'
+import type { AuthFlowAction } from '@/platform/telemetry/types'
 import { useToastStore } from '@/platform/updates/common/toastStore'
 import { useWorkflowService } from '@/platform/workflow/core/services/workflowService'
 import { useWorkflowStore } from '@/platform/workflow/management/stores/workflowStore'
@@ -28,6 +29,15 @@ export const useAuthActions = () => {
 
   const accessError = ref(false)
 
+  const reportAuthFlowError =
+    (authAction: AuthFlowAction) => (error: unknown) => {
+      useTelemetry()?.trackAuthFailed({
+        error_code: error instanceof FirebaseError ? error.code : 'unknown',
+        auth_action: authAction
+      })
+      reportError(error)
+    }
+
   const reportError = (error: unknown) => {
     // Ref: https://firebase.google.com/docs/auth/admin/errors
     if (
@@ -127,7 +137,7 @@ export const useAuthActions = () => {
         life: 5000
       })
     },
-    reportError
+    reportAuthFlowError('password_reset')
   )
 
   const purchaseCredits = wrapWithErrorHandlingAsync(async (amount: number) => {
@@ -177,32 +187,34 @@ export const useAuthActions = () => {
     return result
   }, reportError)
 
-  const signInWithGoogle = wrapWithErrorHandlingAsync(
-    async (options?: { isNewUser?: boolean }) => {
-      return await authStore.loginWithGoogle(options)
-    },
-    reportError
-  )
+  const signInWithGoogle = async (options?: { isNewUser?: boolean }) =>
+    await wrapWithErrorHandlingAsync(
+      async () => await authStore.loginWithGoogle(options),
+      reportAuthFlowError(
+        options?.isNewUser ? 'google_sign_up' : 'google_sign_in'
+      )
+    )()
 
-  const signInWithGithub = wrapWithErrorHandlingAsync(
-    async (options?: { isNewUser?: boolean }) => {
-      return await authStore.loginWithGithub(options)
-    },
-    reportError
-  )
+  const signInWithGithub = async (options?: { isNewUser?: boolean }) =>
+    await wrapWithErrorHandlingAsync(
+      async () => await authStore.loginWithGithub(options),
+      reportAuthFlowError(
+        options?.isNewUser ? 'github_sign_up' : 'github_sign_in'
+      )
+    )()
 
   const signInWithEmail = wrapWithErrorHandlingAsync(
     async (email: string, password: string) => {
       return await authStore.login(email, password)
     },
-    reportError
+    reportAuthFlowError('email_sign_in')
   )
 
   const signUpWithEmail = wrapWithErrorHandlingAsync(
     async (email: string, password: string, turnstileToken?: string) => {
       return await authStore.register(email, password, turnstileToken)
     },
-    reportError
+    reportAuthFlowError('email_sign_up')
   )
 
   /**

src/composables/auth/useTurnstile.test.ts

@@ -1,9 +1,11 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { nextTick, ref } from 'vue'
 
 import {
   isTurnstileEnabled,
   normalizeTurnstileMode,
-  useTurnstile
+  useTurnstile,
+  useTurnstileGate
 } from '@/composables/auth/useTurnstile'
 import { getTurnstileSiteKey } from '@/config/turnstile'
 import { remoteConfig } from '@/platform/remoteConfig/remoteConfig'
@@ -137,3 +139,63 @@ describe('useTurnstile', () => {
     })
   })
 })
+
+describe('useTurnstileGate', () => {
+  it('waits while enabled with no token yet', () => {
+    const { waiting } = useTurnstileGate(ref(true))
+    expect(waiting.value).toBe(true)
+  })
+
+  it('never waits while disabled', () => {
+    const { waiting } = useTurnstileGate(ref(false))
+    expect(waiting.value).toBe(false)
+  })
+
+  it('stops waiting once a token arrives', () => {
+    const { token, waiting } = useTurnstileGate(ref(true))
+
+    token.value = 'token-abc'
+
+    expect(waiting.value).toBe(false)
+  })
+
+  it('stops waiting once the widget reports itself unavailable', () => {
+    const { unavailable, waiting } = useTurnstileGate(ref(true))
+
+    unavailable.value = true
+
+    expect(waiting.value).toBe(false)
+  })
+
+  it('clears stale token/unavailable state when enabled turns off', async () => {
+    const enabled = ref(true)
+    const { token, unavailable } = useTurnstileGate(enabled)
+    token.value = 'stale-token'
+    unavailable.value = true
+
+    enabled.value = false
+    await nextTick()
+
+    expect(token.value).toBe('')
+    expect(unavailable.value).toBe(false)
+  })
+
+  // Regression coverage: the reset used to only run on the enabled->disabled
+  // transition, so state written while the widget was briefly disabled could
+  // survive into the next enabled widget instance.
+  it('clears stale token/unavailable state when enabled turns back on', async () => {
+    const enabled = ref(true)
+    const { token, unavailable } = useTurnstileGate(enabled)
+
+    enabled.value = false
+    await nextTick()
+    token.value = 'stale-token'
+    unavailable.value = true
+
+    enabled.value = true
+    await nextTick()
+
+    expect(token.value).toBe('')
+    expect(unavailable.value).toBe(false)
+  })
+})

src/composables/auth/useTurnstile.ts

@@ -1,4 +1,5 @@
-import { computed } from 'vue'
+import { computed, ref, watch } from 'vue'
+import type { Ref } from 'vue'
 
 import { getTurnstileSiteKey } from '@/config/turnstile'
 import { useFeatureFlags } from '@/composables/useFeatureFlags'
@@ -42,3 +43,31 @@ export function useTurnstile() {
 
   return { mode, siteKey, enabled, enforced }
 }
+
+/**
+ * Submit-gating state for the signup form's Turnstile widget: a token/
+ * unavailable pair, plus `waiting`, which is true while a real token is still
+ * needed. Waits in both shadow and enforce mode (`enabled`), not just
+ * `enforced`, so shadow mode's token can't race the async Cloudflare
+ * challenge; falls back open once the widget reports `unavailable` so a
+ * broken/slow load can never permanently block signup.
+ *
+ * `token`/`unavailable` reset on every `enabled` transition, in either
+ * direction, so state from a previous widget instance can never leak into a
+ * freshly (re-)rendered one.
+ */
+export function useTurnstileGate(enabled: Ref<boolean>) {
+  const token = ref('')
+  const unavailable = ref(false)
+
+  const waiting = computed(
+    () => enabled.value && !token.value && !unavailable.value
+  )
+
+  watch(enabled, () => {
+    token.value = ''
+    unavailable.value = false
+  })
+
+  return { token, unavailable, waiting }
+}

src/platform/telemetry/TelemetryRegistry.test.ts

@@ -49,6 +49,23 @@ describe('TelemetryRegistry', () => {
     expect(a.trackBeginCheckout).toHaveBeenCalledExactlyOnceWith(metadata)
   })
 
+  it('dispatches trackAuthFailed to every registered provider', () => {
+    const a: TelemetryProvider = { trackAuthFailed: vi.fn() }
+    const b: TelemetryProvider = { trackAuthFailed: vi.fn() }
+    const registry = new TelemetryRegistry()
+    registry.registerProvider(a)
+    registry.registerProvider(b)
+
+    const payload = {
+      error_code: 'auth/user-not-found',
+      auth_action: 'email_sign_in' as const
+    }
+    registry.trackAuthFailed(payload)
+
+    expect(a.trackAuthFailed).toHaveBeenCalledExactlyOnceWith(payload)
+    expect(b.trackAuthFailed).toHaveBeenCalledExactlyOnceWith(payload)
+  })
+
   it('dispatches trackAddApiCreditButtonClicked with its source', () => {
     const provider: TelemetryProvider = {
       trackAddApiCreditButtonClicked: vi.fn()

src/platform/telemetry/TelemetryRegistry.ts

@@ -2,6 +2,7 @@ import type { AuditLog } from '@/services/customerEventsService'
 
 import type {
   AddCreditsClickMetadata,
+  AuthErrorMetadata,
   AuthMetadata,
   BeginCheckoutMetadata,
   DefaultViewSetMetadata,
@@ -75,6 +76,10 @@ export class TelemetryRegistry implements TelemetryDispatcher {
     this.dispatch((provider) => provider.trackAuth?.(metadata))
   }
 
+  trackAuthFailed(metadata: AuthErrorMetadata): void {
+    this.dispatch((provider) => provider.trackAuthFailed?.(metadata))
+  }
+
   trackUserLoggedIn(): void {
     this.dispatch((provider) => provider.trackUserLoggedIn?.())
   }

src/platform/telemetry/providers/cloud/PostHogTelemetryProvider.test.ts

@@ -195,6 +195,46 @@ describe('PostHogTelemetryProvider', () => {
     })
   })
 
+  describe('platform axes (client / deployment)', () => {
+    afterEach(() => {
+      delete window.__comfyDesktop2
+    })
+
+    it('registers client=web and deployment=cloud in a plain browser', async () => {
+      createProvider()
+      await vi.dynamicImportSettled()
+
+      expect(hoisted.mockRegister).toHaveBeenCalledWith({
+        client: 'web',
+        deployment: 'cloud'
+      })
+    })
+
+    it('registers client=desktop when the desktop preload bridge is present', async () => {
+      window.__comfyDesktop2 = {
+        isRemote: () => false,
+        Telemetry: { capture: vi.fn() }
+      }
+      createProvider()
+      await vi.dynamicImportSettled()
+
+      expect(hoisted.mockRegister).toHaveBeenCalledWith({
+        client: 'desktop',
+        deployment: 'cloud'
+      })
+    })
+
+    it('registers platform axes before flushing pre-init queued events', async () => {
+      const provider = createProvider()
+      provider.trackSignupOpened()
+      await vi.dynamicImportSettled()
+
+      const registerOrder = hoisted.mockRegister.mock.invocationCallOrder[0]
+      const captureOrder = hoisted.mockCapture.mock.invocationCallOrder[0]
+      expect(registerOrder).toBeLessThan(captureOrder)
+    })
+  })
+
   describe('desktop entry capture', () => {
     function setLocation(search: string): void {
       Object.defineProperty(window.location, 'search', {
@@ -208,12 +248,20 @@ describe('PostHogTelemetryProvider', () => {
       setLocation('')
     })
 
+    // The platform-axes register (client/deployment) always fires, so these
+    // assert no register call carrying desktop-entry attribution props.
+    function desktopEntryRegisterCalls(): unknown[][] {
+      return hoisted.mockRegister.mock.calls.filter(
+        ([props]) => props && 'source_app' in (props as Record<string, unknown>)
+      )
+    }
+
     it('does not register desktop props when utm_source is absent', async () => {
       setLocation('')
       createProvider()
       await vi.dynamicImportSettled()
 
-      expect(hoisted.mockRegister).not.toHaveBeenCalled()
+      expect(desktopEntryRegisterCalls()).toHaveLength(0)
     })
 
     it('does not register desktop props when utm_source is not comfy.desktop', async () => {
@@ -221,7 +269,7 @@ describe('PostHogTelemetryProvider', () => {
       createProvider()
       await vi.dynamicImportSettled()
 
-      expect(hoisted.mockRegister).not.toHaveBeenCalled()
+      expect(desktopEntryRegisterCalls()).toHaveLength(0)
     })
 
     it('registers source_app and desktop_device_id when arriving from desktop', async () => {
@@ -313,6 +361,24 @@ describe('PostHogTelemetryProvider', () => {
       )
     })
 
+    it('captures auth failure events with metadata', async () => {
+      const provider = createProvider()
+      await vi.dynamicImportSettled()
+
+      provider.trackAuthFailed({
+        error_code: 'auth/user-not-found',
+        auth_action: 'email_sign_in'
+      })
+
+      expect(hoisted.mockCapture).toHaveBeenCalledWith(
+        TelemetryEvents.USER_AUTH_FAILED,
+        {
+          error_code: 'auth/user-not-found',
+          auth_action: 'email_sign_in'
+        }
+      )
+    })
+
     it.for([
       ['flow_opened', TelemetryEvents.SUBSCRIPTION_CANCEL_FLOW_OPENED, {}],
       ['confirmed', TelemetryEvents.SUBSCRIPTION_CANCEL_CONFIRMED, {}],

src/platform/telemetry/providers/cloud/PostHogTelemetryProvider.ts

@@ -11,6 +11,7 @@ import type { RemoteConfig } from '@/platform/remoteConfig/types'
 
 import type {
   AddCreditsClickMetadata,
+  AuthErrorMetadata,
   AuthMetadata,
   BeginCheckoutMetadata,
   DefaultViewSetMetadata,
@@ -143,6 +144,9 @@ export class PostHogTelemetryProvider implements TelemetryProvider {
               before_send: createPostHogBeforeSend()
             })
             this.isInitialized = true
+            // Before flushEventQueue so pre-init events also carry the
+            // platform super properties.
+            this.registerPlatformProps()
             this.flushEventQueue()
             this.registerDesktopEntryProps()
 
@@ -285,6 +289,18 @@ export class PostHogTelemetryProvider implements TelemetryProvider {
     )
   }
 
+  private registerPlatformProps(): void {
+    if (!this.posthog) return
+    try {
+      this.posthog.register({
+        client: window.__comfyDesktop2 ? 'desktop' : 'web',
+        deployment: 'cloud'
+      })
+    } catch (error) {
+      console.error('Failed to register platform props:', error)
+    }
+  }
+
   private registerDesktopEntryProps(): void {
     if (!this.posthog) return
     const props = readDesktopEntryProps()
@@ -338,6 +354,10 @@ export class PostHogTelemetryProvider implements TelemetryProvider {
     this.trackEvent(TelemetryEvents.USER_AUTH_COMPLETED, metadata)
   }
 
+  trackAuthFailed(metadata: AuthErrorMetadata): void {
+    this.trackEvent(TelemetryEvents.USER_AUTH_FAILED, metadata)
+  }
+
   trackUserLoggedIn(): void {
     this.trackEvent(TelemetryEvents.USER_LOGGED_IN)
   }

src/platform/telemetry/types.ts

@@ -52,6 +52,23 @@ export interface AuthMetadata {
   utm_campaign?: string
 }
 
+export type AuthFlowAction =
+  | 'email_sign_in'
+  | 'email_sign_up'
+  | 'google_sign_in'
+  | 'google_sign_up'
+  | 'github_sign_in'
+  | 'github_sign_up'
+  | 'password_reset'
+
+/**
+ * Metadata for failed authentication attempts
+ */
+export interface AuthErrorMetadata {
+  error_code: string
+  auth_action: AuthFlowAction
+}
+
 /**
  * Survey response data for user profiling
  * Maps 1-to-1 with actual survey fields
@@ -525,6 +542,7 @@ export interface TelemetryProvider {
   // Authentication flow events
   trackSignupOpened?(): void
   trackAuth?(metadata: AuthMetadata): void
+  trackAuthFailed?(metadata: AuthErrorMetadata): void
   trackUserLoggedIn?(): void
 
   // Subscription flow events
@@ -637,6 +655,7 @@ export const TelemetryEvents = {
   // Authentication Flow
   USER_SIGN_UP_OPENED: 'app:user_sign_up_opened',
   USER_AUTH_COMPLETED: 'app:user_auth_completed',
+  USER_AUTH_FAILED: 'app:user_auth_failed',
   USER_LOGGED_IN: 'app:user_logged_in',
 
   // Subscription Flow
@@ -743,6 +762,7 @@ export type ExecutionTriggerSource =
  */
 export type TelemetryEventProperties =
   | AuthMetadata
+  | AuthErrorMetadata
   | SurveyResponses
   | TemplateMetadata
   | ExecutionContext