Make the data model use Item and List types universally, with nodes authored as rank-polymorphic kernels (#4335)

* Add rank polymorphism node audit classifying all 271 nodes

* Implement StaticType for Item<T>

* Generate Item and mapped List wire variants for nodes declaring an Item<T> primary input

* Migrate nine nodes to Item element-wise kernels, dissolving the blending trait boilerplate

* Document the Item kernel implementation and staging plan

* Route Item<Vector> through TaggedValue::TypeDefault

* Add executor integration tests covering the Item and List wire variants

* Collapse element-wise Item/List wire pairs to the List form for conversion insertion

* Migrate sixteen vector modifier nodes to Item element-wise kernels

* Migrate Sample Image, Extend Image to Bounds, and Dehaze to Item element-wise kernels

* Fix bevel_with_transform test to actually exercise the transform attribute

* Implement From<T> for Item<T>

* Register PromoteNode rank adapters wrapping bare values into Item wires

* Insert PromoteNode adapters for Item/List wire pair fields in the preprocessor

* Define a real promote node backing the PromoteNode registry identifiers

* Zip ranked Item connectors by frame slot in the mapped element-wise variant

* Register ItemToListNode singleton raise adapters

* Resolve Item wires against List connectors by inserting promotion adapters at construction

* Rank the Offset Points distance connector and prove mixed-rank resolution end-to-end

* Implement Clampable for Item and List wires with per-variant clamp bounds

* Rank the Round Corners radius connector, exercising hard bounds on a ranked wire

* Implement ApplyTransform for Item

* Add Item wire implementations to the Transform node, keeping rank-0 chains rank 0

* Detect element-wise nodes by lazy primary connectors declaring Output = Item

* Convert Transform to an Item kernel with ranked parameters, delivering the broadcast milestone

* Rename Apply Transform to Bake Transform, baking item transforms on Vector, DAffine2, and DVec2

* Promote bare wires onto Item connectors at resolution via WrapItemNode adapters

* Rank the numeric, vector, and boolean parameters across the migrated element-wise nodes

* Rank the enum, integer, and seed parameters, registering their rank adapters via a consolidated macro

* Amend the audit with the DashPattern value type resolution

* Migrate the string family to Item element-wise kernels

* Unwrap Item wires into bare legacy connectors at resolution via UnwrapItemNode adapters

* Shadow owned node parameters in bodies instead of mut in signatures

* Migrate the math family and string measure nodes to Item element-wise kernels

* Convert the comparison and clamp nodes to Item kernels, dropping unreachable &str rows

* Flat-map expander kernels returning List under the mapped variant's frame

* Migrate the expander nodes to Item kernels flat-mapping under the frame

* Remove the unused peel_list helper

* Rank the raster adjustment and blending kernels, recontextualizing shader nodes onto an Item stand-in

Migrate the 16 adjustment nodes, Mix, Color Overlay, and Gradient Map from whole-List kernels to rank-0 Item kernels, letting the macro derive the List-mapped (zip) variants. Move the Adjust and Blend per-element seams off List onto the element types (add the Raster<CPU> impls, drop the now-dead List impls).

Shader nodes keep their bodies verbatim: PerPixelAdjust re-emits the identical kernel against a transparent no_std Item stand-in, so every Item<T> connector and .element() call resolves to a zero-cost identity on the GPU while the uniform buffer stays bare repr(C). The macro peels Item off ranked uniform params, wraps the fetched texel and uniforms at the entry point, and unwraps the result. This drops the shader_node/Item incompatibility guard. Register rank adapters for the adjustment enums.

* Update the rank polymorphism roadmap for the landed shader-node and adjustments chunk

* Rename the GPU Item stand-in to ShaderItem, aliased as Item at its shader-node import sites

* Flip the vector shape generators to emit rank-0 Item<Vector>

The shape generators (Rectangle, Circle, Ellipse, Arc, Spiral, Polygon, Star, Arrow, Line, Grid, QR Code) each produced exactly one shape wrapped in a singleton List<Vector>. Emit Item<Vector> directly so they connect to the rank-0 content connector of the migrated Transform node. Downstream List consumers receive the value through the existing Item to List promotion.

Relax the element-wise validation so a `()` (generator) primary may return Item<T> without being element-wise. Adapt the Repeat on Points test, which still takes a List content connector, by raising the generator's Item output through a singleton wrapper node.

* Parse ranked Item<T> parameter defaults against the bare element type

A ranked `Item<T>` parameter's default value is a bare, unranked `T` (promoted to the wire at resolution), but the preprocessor was handed the wrapped `Item<T>` type and could not parse the literal, flooding the console with warnings and dropping the defaults. Key the field's default_type metadata off the peeled element type for concrete ranked parameters, leaving generic `Item<T>` primaries and skip_impl nodes untouched.

* Parse an element-wise primary's scalar default against the bare element type

An element-wise node's primary reports its default_type as the List wire form so an unconnected primary defaults to an empty list. But when the primary carries a scalar `#[default]` (such as Root's radicand), that literal must parse as a bare element, not a List. Key the primary's default_type off the bare element type when it has a Default value source, keeping the List form otherwise.

* Add the DashPattern value type for stroke dash sequences

Introduce a rank-0 DashPattern value type (a Vec<f64> of alternating dash and gap lengths) so a stroke's dash pattern is a single frameable value rather than a rank-1 List<f64>. Register it as an auto-generated TaggedValue variant, parse its default from a comma or space separated string, and register its rank adapters. Not yet wired into the Stroke node.

* Rank the Fill and Stroke nodes element-wise and give Stroke a DashPattern connector

Migrate Fill and Stroke to element-wise Item<V> primaries (over Vector and Graphic element types) via a new element-level VectorItemMut trait, so styling one shape yields one shape and rank is preserved instead of promoting the input to a singleton List and emitting a List. The macro derives the List-mapped variant for genuine collections.

Wire the Stroke dash sequence to the new rank-0 DashPattern value type, collapsing the old content x paint x dash cartesian and dropping the IntoF64Vec trait. Update the stroke properties dash widget, the drawing tool, and graph-operation plumbing to read and write DashPattern, and migrate legacy F64Array, F64, and String dash inputs on document open.

Assign Colors stays a whole-collection node: each element's gradient position depends on its index among all siblings, which the element frame does not expose, so it keeps its List primary and the VectorListIterMut trait.

* Register rank adapters for the ranked Stroke enum parameters

The element-wise Stroke node ranks its align, cap, and paint order parameters as Item<StrokeAlign>, Item<StrokeCap>, and Item<PaintOrder>, but those enums lacked promotion adapters, so a bare default enum value could not be promoted to its Item wire and no Stroke variant resolved ("No construct found for node"). Register their rank adapters alongside StrokeJoin.

* Display Item wires in the Data panel without a List's ID column

Add a TableItemLayout impl for Item<T> and recognize Item wire types when introspecting graph data. An Item holds a single element, so it renders as a one-row table of the element plus its attributes with no leading index column, and it labels as its element type T rather than a List's T[]. Add ItemAttributeValues::get_any for the attribute widget dispatch.

* Register MonitorNode for Item wire types so the Data panel introspects them directly

Graph introspection wraps the inspected output in a generic MonitorNode typed to the wire. Without Item<T> monitor registrations, an Item<Vector> output could only be monitored after an Item to List promotion, so the Data panel captured and displayed a List<Vector> despite the connector being Item<Vector>. Register monitors for the Item types the element-wise nodes emit, and add the matching Data panel downcast entries.

* Color and double Item/List wires and cleave layer-stack connectors in the node graph

* Route wire color and rank through hidden nodes and refresh them on type changes

* Rework the DashPattern connector conversions with element-wise promotion and an explicit reducer node

* Rank the remaining value, context, aggregation, and transform nodes onto Item<T> wires

* Back DashPattern with a List<f64> so the Data panel can introspect its lengths

* Carry a single Item<T> through varargs so the Read context nodes emit Item<T> not List<T>

* Relax rank validation for aggregation shapes, add element adapters, and match variants by fewest promotions

* Rank the remaining bare and unnecessarily-List connectors across the node catalog

* Add Graphic::None and the FillChoice paint value, making colors and gradients plain values

* Rename GradientStops to Gradient and the legacy Gradient/Fill structs to LegacyGradient/LegacyFill

* Restore generator frame-from-params ranking to the roadmap as a planned stage

* Rename the ranked-field adapter identifier from PromoteNode to FieldAdapterNode to reflect its full contract

* Unload only the wires whose displayed style changed when types update

* Peel wire rank in the editor's semantic type checks so rank-0 layers are recognized

* Restore the whole-List Transform variant so rank-1 content wires resolve again

* Register the Item wire forms for the Memoize and Context Modification infrastructure nodes

* Give every ranked connector a field adapter and add numeric cast variants for legacy wires

* Key a ranked param's type default off its Item wire form when no literal default exists

* Inherit the layer's content value when splicing a node into an empty chain

* Migrate stale List-form TypeDefault inputs to the definition's current default

* Generate the mapped wire variant only when the element-wise node has a frame source

* Let a bare wire feed a List connector via a wrap-raise adapter, costed as two rank steps

* Add a zip companion to the whole-List Transform so ranked List parameters pair per slot

* Add the Sum, Average, Minimum, Maximum, Any, and All list reducers

* Convert the measure family to element-wise Item kernels per the audit classification

* Prefer the bare element value over the Item type default so ranked params keep their widgets

* Rename GradientStopsUI to GradientUI

* Split Fill's optional transform into a _has_transform bool and a ranked _transform matrix

* Rename the migration-only OptionalDAffine2 TaggedValue to LegacyOptionalDAffine2

* Flow byte buffers as Item<Resource> instead of List<u8> across the byte nodes

* Macro-generate the list-content wire variant, retiring the hand-written Transform-zip, Area, and Centroid companions

* Let ()-primary generators take ranked params and frame over them via the mapped variant, ranking Circle's radius

* Rank the vector shape generators' params to Item, adding a rank-aware input grab to the introspection harness

* Rank the value, color, and text generator params to Item

* Rank the raster, web-request, and context-reader generator params to Item

* Fix the repeat and brush test wirings left behind by the param-ranking sweeps

* Delete the vestigial Some, Unwrap Option, and Size Of debug nodes

* Delete the Attach Attribute node, folding its role into Write Attribute

* Add the Filter and Sort list companion nodes

* Guard the removed-definition migration swap target with a test

* Add the Box Corners value type in place of the rectangle corner radius list

* Split Text to Vector's per-glyph mode into a Text to Vector Glyphs node

* Rank the Combine Channels node's channel connectors to Item

* Make Map Points an element-wise node

* Delete the deprecated Upload Texture node

* Update the implementation roadmap to reflect the landed stages

* Let monitor introspection read rank-0 wires, locking in the layer coercion promotion path

* Prefer the rank-0 default when disconnecting a rank-capable input

* Make Path Modify an element-wise node

* Wrap node paths in a NodeIdPath newtype so they flow as a single Item

* Give Item<Raster<CPU>> a default so an unconnected Brush background resolves

* Stop the Brush node from setting layer attributes its paint operation doesn't produce

* Present-gate Flatten Path's adopted layer path like its fill and stroke

* Gate carried layer attributes on static column presence, not runtime values

* Give the remaining graphic Item<T> types a default so unconnected primaries resolve

* Dispatch a ranked param's Properties widget from its rank-0 element type

* Make Extract Transform an element-wise node, restoring the Origins to Polyline body

* Rename Flatten Path to Combine Paths

* Stamp Legacy Layer Extend's adopted layer path as a readable NodeIdPath

* Drop the dead List<u8> and List<NodeId> wire rows

* Rank Flatten Graphic's Fully Flatten toggle to Item

* Update the implementation roadmap with the endgame scope

* Make Combine Paths a reducer that collapses the whole frame into one path

* Stop type-converter nodes from carrying the source's unrelated attributes

* Format the Origins to Polyline regression test

* Wrap the Brush node's trace in a BrushTrace newtype so it flows as one value

* Make Switch a framed element-wise select, bundling whole collections

* Widen and align element-type coverage across the list and graphic nodes

* Register the compiler's cache chain pair for every ranked enum and newtype wire

* Fix wire colors for Passthrough outputs, bundled lists, and bools, and widen list wires

* Represent List wire types structurally with Type::List, replacing name-parsed rank promotion

* Treat scope and data fields as environment, rank scope wires as Item, and feed the render boundary through a context vararg

* Delete the vestigial Clone debug node

* Reinstate Upload Texture as an element-wise node and fix the GPU variants' scope executor and rank adapters

* Rename Combine Paths back to Flatten Path, deferring that rename to its own PR

* Deduplicate the promotion adapter registrations into the field adapter macro

* Rank Write Attribute's value connector to Item<AttributeValueDyn>, retiring the UnwrapItem bridge

* Vertical wire styling

* Store the editor layer path attribute as a bare NodeIdPath, not an Item<NodeIdPath>

* Rank Context Modification's features connector to Item<ContextFeatures>, dropping the dead memoize row

* Rank Path Modify's modification parameter to Item<Box<VectorModification>>

* Rename the field adapter node family to input adapter

* Drop the dead bare scalar rows from Context Modification's implementations list

* Move the dynamic executor's test module into its own file

* Drop the registry's unreachable bare rows for Memoize, the cache chain, and ConvertNode

* Materialize stored TaggedValues as ranked Item wires at the source

* Remove the bare-wire promotion and adapter machinery made dead by ranked value materialization

* Plant the input adapter for List-only inputs, composing position conversion from standard rows

* Consolidate Into/Convert conversions into the input adapter umbrella and rename the rank adapter identifiers

* Fix grouped layers gaining a phantom None stack element from the FillChoice default hijacking every List<Graphic> disconnect

* Enforce ranked node inputs in the macro, rejecting bare wire declarations

* Remove the unit Context => () machinery rows, leaving () purely as the no-primary sentinel

* Add a --signatures rank-audit mode to node-docs for the ranked-wire migration

* Remove the node-docs --signatures rank-audit mode now that ranked wires are enforced

* Migrate legacy no-color values on the Black & White, Color Overlay, and Empty Image color inputs

* Rewrite the element-wise accessor wire type at the primary input, not raw index 0

* Register the cache chain for Resource wires, replacing the lone hand-written Monitor row

* Gate the remaining Raster<GPU> registry rows behind the gpu feature

* Let List<DVec2> wires erase to ListDyn for the attribute reader and element counter

* Rename Extract Element to Item at Index, Count Elements to List Length, and Omit Element to Remove at Index

* Store paint picks as plain color/gradient values, removing the FillChoice value type

* Code review restructuring

* Sort by the consumed sort_key attribute or natural element order, adding the Sort Key node

* Remove the new list-combinator and reducer nodes to defer them to a follow-up PR

* Parse Fill and Stroke color defaults through the paint wire's Graphic element

* Emit ranked implementation-row default types structurally so their element TypeIds survive to default-literal parsing

* Exempt the deliberate no-paint choice from the stale List-form TypeDefault migration

* Migrate the legacy 4-input Fill directly to the split has-transform shape

* Upgrade the demo artwork

* Fix the valid AI review findings: Item eq/hash contract, table-era no-paint migration, quantize List rows, and other smaller issues

* Remove the rank polymorphism working documents

* Hash Item attribute values directly instead of debug-formatting them, speeding up cached evaluation

* Replace the data panel's dead bare-wire downcast arms with full coverage of the ranked monitor row types

* Derive PartialEq for Item now that attributes participate in equality

* Extend the data panel's attribute dispatchers with the newly supported scalar and choice enum types

* Add List monitor rows for the framed numeric conversion outputs so inspecting them resolves, with matching data panel arms

.jjconflict-base-0/.github/workflows/build.yml

@@ -0,0 +1,793 @@
+name: "Build"
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - latest-stable
+  workflow_dispatch:
+    inputs:
+      web:
+        description: "Web"
+        type: boolean
+      windows:
+        description: "Windows"
+        type: boolean
+      mac:
+        description: "Mac"
+        type: boolean
+      linux:
+        description: "Linux"
+        type: boolean
+      debug:
+        description: "Debug build"
+        type: boolean
+  workflow_call:
+    inputs:
+      web:
+        type: boolean
+      windows:
+        type: boolean
+      mac:
+        type: boolean
+      linux:
+        type: boolean
+      debug:
+        type: boolean
+      checkout_repo:
+        type: string
+      checkout_ref:
+        type: string
+      pr_number:
+        type: string
+      merge_queue:
+        type: boolean
+
+jobs:
+  web:
+    if: github.event_name == 'push' || inputs.web
+    runs-on: [self-hosted, target/wasm]
+    permissions:
+      contents: write
+      deployments: write
+      pull-requests: write
+      actions: write
+    env:
+      CARGO_TERM_COLOR: always
+      RUSTC_WRAPPER: /usr/bin/sccache
+      CARGO_INCREMENTAL: 0
+      SCCACHE_DIR: /var/lib/github-actions/.cache
+      WASM_BINDGEN_CLI_VERSION: "0.2.121"
+      BINARYEN_VERSION: "130"
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.checkout_repo || github.repository }}
+          ref: ${{ inputs.checkout_ref || '' }}
+
+      - name: 🟢 Install Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          cache: false
+          rustflags: ""
+          target: wasm32-unknown-unknown
+
+      - name: 🚧 Install wasm-bindgen-cli and Binaryen wasm-opt
+        run: |
+          if ! wasm-bindgen --version 2>/dev/null | grep -qF "$WASM_BINDGEN_CLI_VERSION"; then
+            cargo install -f "wasm-bindgen-cli@$WASM_BINDGEN_CLI_VERSION"
+          fi
+
+          BINARYEN_DIR="$HOME/.cache/binaryen-version_$BINARYEN_VERSION"
+          if [ ! -x "$BINARYEN_DIR/bin/wasm-opt" ]; then
+            mkdir -p "$BINARYEN_DIR"
+            curl -sSfL "https://github.com/WebAssembly/binaryen/releases/download/version_$BINARYEN_VERSION/binaryen-version_$BINARYEN_VERSION-x86_64-linux.tar.gz" | tar xz -C "$BINARYEN_DIR" --strip-components=1
+          fi
+          echo "$BINARYEN_DIR/bin" >> "$GITHUB_PATH"
+
+      - name: 🔀 Choose production deployment environment and insert template
+        id: production-env
+        if: github.event_name == 'push'
+        run: |
+          if [[ "${{ github.ref }}" == "refs/tags/latest-stable" ]]; then
+            echo "cf_project=graphite-editor" >> $GITHUB_OUTPUT
+            DOMAIN="editor.graphite.art"
+          else
+            echo "cf_project=graphite-dev" >> $GITHUB_OUTPUT
+            DOMAIN="dev.graphite.art"
+          fi
+          TEMPLATE="<script defer data-domain=\"$DOMAIN\" data-api=\"https://graphite.art/visit/event\" src=\"https://graphite.art/visit/script.hash.js\"></script>"
+          echo "template=$TEMPLATE" >> $GITHUB_OUTPUT
+          sed -i "s|<!-- INDEX_HTML_HEAD_REPLACEMENT -->|$TEMPLATE|" frontend/index.html
+
+      - name: 🌐 Build Graphite web code
+        env:
+          NODE_ENV: production
+          # Split the Wasm binary to fit Cloudflare Pages' file size limit (see `wasmSplitting` in `frontend/vite.config.ts`)
+          SPLIT_WASM: "1"
+        run: mold -run cargo run build web${{ inputs.debug && ' debug' || '' }}
+
+      - name: 📤 Publish to Cloudflare Pages
+        if: inputs.merge_queue == false
+        id: cloudflare
+        continue-on-error: ${{ github.event_name != 'push' }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          if [ -z "$CLOUDFLARE_API_TOKEN" ]; then
+            echo "No Cloudflare API token available (fork PR), skipping deploy."
+            exit 0
+          fi
+
+          if [ "${{ github.event_name }}" = "push" ]; then
+            DEPLOY_BRANCH="master"
+          else
+            DEPLOY_BRANCH="${{ inputs.checkout_ref || github.head_ref || github.ref_name }}"
+            if [ "$DEPLOY_BRANCH" = "master" ] || [ -z "$DEPLOY_BRANCH" ]; then
+              DEPLOY_BRANCH="preview-${{ github.run_id }}"
+            fi
+          fi
+
+          MAX_ATTEMPTS=8
+          DELAY=15
+          for ATTEMPT in $(seq 1 $MAX_ATTEMPTS); do
+            echo "Attempt $ATTEMPT of $MAX_ATTEMPTS..."
+            npx wrangler@3 pages deploy "frontend/dist" --project-name="${{ steps.production-env.outputs.cf_project || 'graphite-dev' }}" --branch="$DEPLOY_BRANCH" --commit-dirty=true 2>&1 | tee /tmp/wrangler_output
+            if [ ${PIPESTATUS[0]} -eq 0 ]; then
+              URL=$(grep -oP 'https://[^\s]+\.pages\.dev' /tmp/wrangler_output | head -1)
+              echo "url=$URL" >> "$GITHUB_OUTPUT"
+              echo "Published successfully: $URL"
+              exit 0
+            fi
+            echo "Attempt $ATTEMPT failed."
+            if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
+              echo "Retrying in ${DELAY}s..."
+              sleep $DELAY
+              DELAY=$((DELAY * 2))
+            fi
+          done
+          echo "All $MAX_ATTEMPTS Cloudflare Pages publish attempts failed."
+          exit 1
+
+      - name: 🚀 Create a GitHub environment deployment
+        if: (inputs.checkout_repo == '' || inputs.checkout_repo == github.repository) && inputs.merge_queue == false
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CF_URL: ${{ steps.cloudflare.outputs.url }}
+        run: |
+          if [ -z "$CF_URL" ]; then
+            echo "No Cloudflare URL available, skipping deployment."
+            exit 0
+          fi
+          if [ "${{ github.ref }}" = "refs/tags/latest-stable" ]; then
+            REF="latest-stable"
+            ENVIRONMENT="graphite-editor (Production)"
+            AUTO_INACTIVE="true"
+            TRANSIENT_ENVIRONMENT="false"
+          elif [ "${{ github.event_name }}" = "push" ]; then
+            REF="master"
+            ENVIRONMENT="graphite-dev (Production)"
+            AUTO_INACTIVE="true"
+            TRANSIENT_ENVIRONMENT="false"
+          else
+            REF="${{ inputs.checkout_ref || github.head_ref || github.ref_name }}"
+            ENVIRONMENT="graphite-dev (Preview)"
+            AUTO_INACTIVE="false"
+            TRANSIENT_ENVIRONMENT="true"
+          fi
+          create_deployment() {
+            gh api \
+              -X POST \
+              -H "Accept: application/vnd.github+json" \
+              repos/${{ github.repository }}/deployments \
+              --input - \
+              --jq '.id' <<EOF
+              {
+                "ref": "$1",
+                "environment": "$ENVIRONMENT",
+                "auto_merge": false,
+                "required_contexts": [],
+                "auto_inactive": $AUTO_INACTIVE,
+                "transient_environment": $TRANSIENT_ENVIRONMENT
+              }
+          EOF
+          }
+          # Try branch name first (needed for GitHub's PR "View deployment" button), fall back to commit SHA if the branch was deleted
+          DEPLOY_ID=$(create_deployment "$REF" 2>/dev/null) || DEPLOY_ID=$(create_deployment "$(git rev-parse HEAD)")
+          gh api \
+            -X POST \
+            -H "Accept: application/vnd.github+json" \
+            repos/${{ github.repository }}/deployments/$DEPLOY_ID/statuses \
+            -f state=success \
+            -f environment_url="$CF_URL" \
+            -f log_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+      - name: 💬 Comment with the build link
+        if: github.event_name != 'pull_request' && inputs.merge_queue == false
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CF_URL: ${{ steps.cloudflare.outputs.url }}
+        run: |
+          if [ -z "$CF_URL" ]; then
+            echo "No Cloudflare URL available, skipping comment."
+            exit 0
+          fi
+
+          size_of() { find frontend/dist/assets "$@" -printf '%s\n' | awk '{s+=$1} END {printf "%.2f MB", s/1048576}'; }
+          WASM_SIZE=$(size_of -name '*.wasm')
+          JS_SIZE=$(size_of -name '*.js')
+          CSS_SIZE=$(size_of -name '*.css')
+          FONT_SIZE=$(size_of \( -name '*.woff2' -o -name '*.woff' -o -name '*.ttf' -o -name '*.otf' \))
+          IMAGE_SIZE=$(size_of \( -name '*.png' -o -name '*.jpg' -o -name '*.svg' \))
+          ALL_SIZE=$(size_of -type f)
+
+          COMMENT_BODY="| 📦 **Web Build Complete for** $(git rev-parse HEAD) |
+          |-|
+          | $CF_URL |
+
+          Wasm: **$WASM_SIZE** — JS: **$JS_SIZE** — CSS: **$CSS_SIZE** — Fonts: **$FONT_SIZE** — Images: **$IMAGE_SIZE** — All Assets: **$ALL_SIZE**"
+
+          if [ "${{ github.ref }}" = "refs/tags/latest-stable" ]; then
+            # Push tag: skip commenting (commit was already commented on master merge)
+            echo "Tag push, skipping comment."
+          elif [ "${{ github.event_name }}" = "push" ]; then
+            # Push master: comment on the commit hash page
+            gh api \
+              -X POST \
+              -H "Accept: application/vnd.github+json" \
+              repos/${{ github.repository }}/commits/$(git rev-parse HEAD)/comments \
+              -f body="$COMMENT_BODY"
+          elif [ "${{ github.event_name }}" != "pull_request" ]; then
+            # Manual trigger (workflow_dispatch, !build): comment on the PR
+            PR_NUMBER="${{ inputs.pr_number }}"
+            if [ -z "$PR_NUMBER" ]; then
+              BRANCH=$(git rev-parse --abbrev-ref HEAD)
+              PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || true)
+            fi
+
+            if [ -n "$PR_NUMBER" ]; then
+              gh pr comment "$PR_NUMBER" --repo ${{ github.repository }} --body "$COMMENT_BODY"
+            else
+              echo "No open PR found, skipping comment."
+            fi
+          fi
+
+      - name: ✂ Strip template from completed build for a clean artifact
+        if: github.event_name == 'push'
+        env:
+          TEMPLATE: ${{ steps.production-env.outputs.template }}
+        run: sed -i "s|$TEMPLATE||" frontend/dist/index.html
+
+      - name: 📦 Upload web bundle artifact
+        if: github.event_name != 'pull_request' && inputs.merge_queue == false
+        uses: actions/upload-artifact@v6
+        with:
+          name: graphite-web-bundle
+          path: frontend/dist
+
+      - name: 👕 Lint Graphite web formatting
+        env:
+          NODE_ENV: production
+        run: |
+          cd frontend
+          npm run check
+
+      - name: 📃 Trigger website rebuild if auto-generated code docs are stale
+        if: github.event_name == 'push' && github.ref != 'refs/tags/latest-stable'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          cargo run -p editor-message-tree -- website/generated
+          TREE=volunteer/guide/codebase-overview/hierarchical-message-system-tree
+          curl -sf "https://graphite.art/$TREE.txt" -o "website/static/$TREE.live.txt" \
+            && diff -q "website/static/$TREE.txt" "website/static/$TREE.live.txt" > /dev/null \
+            || gh workflow run website.yml --ref master
+
+  windows:
+    if: (github.event_name == 'push' && github.ref != 'refs/tags/latest-stable') || inputs.windows
+    runs-on: windows-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    env:
+      WASM_BINDGEN_CLI_VERSION: "0.2.121"
+      BINARYEN_VERSION: "130"
+      CARGO_ABOUT_VERSION: "0.9.0"
+
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.checkout_repo || github.repository }}
+          ref: ${{ inputs.checkout_ref || '' }}
+
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          cache: false
+          rustflags: ""
+          target: wasm32-unknown-unknown
+
+      - name: 💾 Set up Cargo cache
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: 🟢 Install Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            frontend/package-lock.json
+
+      - name: 📦 Install Cargo-binstall
+        uses: cargo-bins/cargo-binstall@main
+
+      - name: 🚧 Install native dependencies
+        shell: pwsh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          BINSTALL_DISABLE_TELEMETRY: "true"
+        run: |
+          winget install --id LLVM.LLVM -e --accept-package-agreements --accept-source-agreements
+          winget install --id Kitware.CMake -e --accept-package-agreements --accept-source-agreements
+          winget install --id OpenSSL.OpenSSL -e --accept-package-agreements --accept-source-agreements
+          winget install --id GnuWin32.PkgConfig -e --accept-package-agreements --accept-source-agreements
+
+          "OPENSSL_DIR=C:\Program Files\OpenSSL-Win64" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "PKG_CONFIG_PATH=C:\Program Files\OpenSSL-Win64\lib\pkgconfig" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+          curl.exe -sSfL -o "$env:RUNNER_TEMP\binaryen.tar.gz" "https://github.com/WebAssembly/binaryen/releases/download/version_$env:BINARYEN_VERSION/binaryen-version_$env:BINARYEN_VERSION-x86_64-windows.tar.gz"
+          tar -xzf "$env:RUNNER_TEMP\binaryen.tar.gz" -C $env:RUNNER_TEMP
+          "$env:RUNNER_TEMP\binaryen-version_$env:BINARYEN_VERSION\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
+
+          cargo binstall --no-confirm --force "cargo-about@$env:CARGO_ABOUT_VERSION"
+          cargo binstall --no-confirm --force "wasm-bindgen-cli@$env:WASM_BINDGEN_CLI_VERSION"
+
+      - name: 🏗 Build Windows bundle
+        shell: bash # `cargo-about` refuses to run in powershell
+        env:
+          CARGO_TERM_COLOR: always
+        run: cargo run build desktop${{ inputs.debug && ' debug' || '' }}
+
+      - name: 📁 Stage artifacts
+        shell: bash
+        run: |
+          PROFILE=${{ inputs.debug && 'debug' || 'release' }}
+          rm -rf target/artifacts
+          mkdir -p target/artifacts
+          cp -R target/$PROFILE/Graphite target/artifacts/Graphite
+
+      - name: 📦 Upload Windows bundle
+        if: github.event_name != 'push'
+        uses: actions/upload-artifact@v6
+        with:
+          name: graphite-windows-bundle
+          path: target/artifacts
+
+      - name: 💬 Comment artifact link on PR
+        if: github.event_name != 'push'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ARTIFACT_ID=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts --jq '.artifacts[] | select(.name == "graphite-windows-bundle") | .id')
+          ARTIFACT_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts/$ARTIFACT_ID"
+          PR_NUMBER="${{ inputs.pr_number }}"
+          if [ -z "$PR_NUMBER" ]; then
+            BRANCH=$(git rev-parse --abbrev-ref HEAD)
+            PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || true)
+          fi
+          if [ -n "$PR_NUMBER" ] && [ -n "$ARTIFACT_ID" ]; then
+            BODY="| 📦 **Windows Build Complete for** $(git rev-parse HEAD) |"$'\n'
+            BODY+="|-|"$'\n'
+            BODY+="| [Download binary]($ARTIFACT_URL) |"
+            gh pr comment "$PR_NUMBER" --repo ${{ github.repository }} --body "$BODY"
+          fi
+
+      - name: 🔑 Azure login
+        if: github.event_name == 'push'
+        uses: azure/login@v1
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          enable-AzPSSession: true
+
+      - name: 🔏 Sign
+        if: github.event_name == 'push'
+        uses: azure/artifact-signing-action@v1
+        with:
+          endpoint: https://eus.codesigning.azure.net/
+          signing-account-name: Graphite
+          certificate-profile-name: Graphite
+          files: |
+            ${{ github.workspace }}\target\artifacts\Graphite\Graphite.exe
+            ${{ github.workspace }}\target\artifacts\Graphite\libcef.dll
+            ${{ github.workspace }}\target\artifacts\Graphite\chrome_elf.dll
+            ${{ github.workspace }}\target\artifacts\Graphite\vulkan-1.dll
+            ${{ github.workspace }}\target\artifacts\Graphite\dxcompiler.dll
+            ${{ github.workspace }}\target\artifacts\Graphite\libEGL.dll
+            ${{ github.workspace }}\target\artifacts\Graphite\libGLESv2.dll
+            ${{ github.workspace }}\target\artifacts\Graphite\vk_swiftshader.dll
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+          correlation-id: ${{ github.sha }}
+
+      - name: ✅ Verify signatures
+        if: github.event_name == 'push'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $TargetDir = "target\artifacts\Graphite"
+
+          if (-not (Test-Path $TargetDir)) {
+              throw "TargetDir not found: $TargetDir"
+          }
+
+          $UnsignedOrBad = @()
+
+          Get-ChildItem -Path $TargetDir -Recurse -File -Include *.exe,*.dll | ForEach-Object {
+              $sig = Get-AuthenticodeSignature -FilePath $_.FullName
+
+              if ($sig.Status -ne 'Valid') {
+                  $UnsignedOrBad += "$($_.FullName) (Status=$($sig.Status))"
+              }
+          }
+
+          if ($UnsignedOrBad.Count -gt 0) {
+              Write-Host "Unsigned or invalid binaries detected:"
+              $UnsignedOrBad | ForEach-Object {
+                  Write-Host "::error::$_"
+              }
+
+              if ($env:GITHUB_STEP_SUMMARY) {
+                  "### ❌ Unsigned or invalid binaries detected" |
+                      Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
+                  "" | Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
+                  $UnsignedOrBad | ForEach-Object {
+                      "* `$_" | Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
+                  }
+              }
+
+              exit 1
+          }
+
+          Write-Host "All binaries are signed and valid."
+
+          if ($env:GITHUB_STEP_SUMMARY) {
+              "### ✅ All binaries are signed and valid" |
+                  Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
+          }
+
+      - name: 📦 Upload signed Windows bundle
+        if: github.event_name == 'push'
+        uses: actions/upload-artifact@v6
+        with:
+          name: graphite-windows-bundle-signed
+          path: target/artifacts
+
+  mac:
+    if: (github.event_name == 'push' && github.ref != 'refs/tags/latest-stable') || inputs.mac
+    runs-on: macos-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    env:
+      WASM_BINDGEN_CLI_VERSION: "0.2.121"
+      BINARYEN_VERSION: "130"
+      CARGO_ABOUT_VERSION: "0.9.0"
+
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.checkout_repo || github.repository }}
+          ref: ${{ inputs.checkout_ref || '' }}
+
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          cache: false
+          rustflags: ""
+          target: wasm32-unknown-unknown
+
+      - name: 💾 Set up Cargo cache
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: 🟢 Install Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            frontend/package-lock.json
+
+      - name: 🚧 Install native dependencies
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          BINSTALL_DISABLE_TELEMETRY: "true"
+        run: |
+          brew update
+          brew install \
+            pkg-config \
+            openssl@3 \
+            llvm \
+            cargo-binstall
+
+          echo "OPENSSL_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
+          echo "PKG_CONFIG_PATH=$(brew --prefix openssl@3)/lib/pkgconfig" >> $GITHUB_ENV
+          echo "$(brew --prefix llvm)/bin" >> $GITHUB_PATH
+
+          BINARYEN_DIR="$HOME/.cache/binaryen-version_$BINARYEN_VERSION"
+          if [ ! -x "$BINARYEN_DIR/bin/wasm-opt" ]; then
+            mkdir -p "$BINARYEN_DIR"
+            curl -sSfL "https://github.com/WebAssembly/binaryen/releases/download/version_$BINARYEN_VERSION/binaryen-version_$BINARYEN_VERSION-arm64-macos.tar.gz" | tar xz -C "$BINARYEN_DIR" --strip-components=1
+          fi
+          echo "$BINARYEN_DIR/bin" >> "$GITHUB_PATH"
+
+          cargo binstall --no-confirm --force "cargo-about@${CARGO_ABOUT_VERSION}"
+          cargo binstall --no-confirm --force "wasm-bindgen-cli@${WASM_BINDGEN_CLI_VERSION}"
+
+      - name: 🏗 Build Mac bundle
+        env:
+          CARGO_TERM_COLOR: always
+        run: cargo run build desktop${{ inputs.debug && ' debug' || '' }}
+
+      - name: 📁 Stage artifacts
+        shell: bash
+        run: |
+          PROFILE=${{ inputs.debug && 'debug' || 'release' }}
+          rm -rf target/artifacts
+          mkdir -p target/artifacts
+          cp -R target/$PROFILE/Graphite.app target/artifacts/Graphite.app
+
+      - name: 📦 Upload Mac bundle
+        if: github.event_name != 'push'
+        uses: actions/upload-artifact@v6
+        with:
+          name: graphite-mac-bundle
+          path: target/artifacts
+
+      - name: 💬 Comment artifact link on PR
+        if: github.event_name != 'push'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ARTIFACT_ID=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts --jq '.artifacts[] | select(.name == "graphite-mac-bundle") | .id')
+          ARTIFACT_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts/$ARTIFACT_ID"
+          PR_NUMBER="${{ inputs.pr_number }}"
+          if [ -z "$PR_NUMBER" ]; then
+            BRANCH=$(git rev-parse --abbrev-ref HEAD)
+            PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || true)
+          fi
+          if [ -n "$PR_NUMBER" ] && [ -n "$ARTIFACT_ID" ]; then
+            BODY="| 📦 **Mac Build Complete for** $(git rev-parse HEAD) |"$'\n'
+            BODY+="|-|"$'\n'
+            BODY+="| [Download binary]($ARTIFACT_URL) |"
+            gh pr comment "$PR_NUMBER" --repo ${{ github.repository }} --body "$BODY"
+          fi
+
+      - name: 🔏 Sign and notarize (preparation)
+        if: github.event_name == 'push'
+        env:
+          APPLE_CERT_BASE64: ${{ secrets.APPLE_CERT_BASE64 }}
+          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
+        run: |
+          mkdir -p .sign
+          echo "$APPLE_CERT_BASE64" | base64 --decode > .sign/certificate.p12
+
+          security create-keychain -p "" .sign/main.keychain
+          security default-keychain -s .sign/main.keychain
+          security unlock-keychain -p "" .sign/main.keychain
+          security set-keychain-settings -t 3600 -u .sign/main.keychain
+
+          security import .sign/certificate.p12 -k .sign/main.keychain -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productsign
+          security set-key-partition-list -S apple-tool:,apple: -s -k "" .sign/main.keychain
+
+          cat > .sign/entitlements.plist <<'EOF'
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <plist version="1.0">
+          <dict>
+              <key>com.apple.security.cs.allow-jit</key>
+              <true/>
+              <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+              <true/>
+              <key>com.apple.security.cs.disable-executable-page-protection</key>
+              <true/>
+              <key>com.apple.security.cs.disable-library-validation</key>
+              <true/>
+          </dict>
+          </plist>
+          EOF
+
+      - name: 🔏 Sign and notarize
+        if: github.event_name == 'push'
+        env:
+          APPLE_EMAIL: ${{ secrets.APPLE_EMAIL }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_CERT_NAME: ${{ secrets.APPLE_CERT_NAME }}
+        run: |
+          CERTIFICATE="$APPLE_CERT_NAME"
+          ENTITLEMENTS=".sign/entitlements.plist"
+          APP_PATH="target/artifacts/Graphite.app"
+          ZIP_PATH=".sign/Graphite.zip"
+
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper.app"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper (GPU).app"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper (Renderer).app"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libcef_sandbox.dylib"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libEGL.dylib"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libGLESv2.dylib"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libvk_swiftshader.dylib"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH" --deep
+
+          codesign --verify --deep --strict --verbose=4 "$APP_PATH"
+
+          ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
+          xcrun notarytool submit "$ZIP_PATH" --wait --apple-id "$APPLE_EMAIL" --team-id "$APPLE_TEAM_ID" --password "$APPLE_PASSWORD"
+          rm "$ZIP_PATH"
+
+          xcrun stapler staple -v "$APP_PATH"
+
+          spctl -a -vv "$APP_PATH"
+
+      - name: 📦 Upload signed Mac bundle
+        if: github.event_name == 'push'
+        uses: actions/upload-artifact@v6
+        with:
+          name: graphite-mac-bundle-signed
+          path: target/artifacts
+
+  linux:
+    if: (github.event_name == 'push' && github.ref != 'refs/tags/latest-stable') || inputs.linux
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.checkout_repo || github.repository }}
+          ref: ${{ inputs.checkout_ref || '' }}
+
+      - name: ❄ Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
+            extra-substituters = https://graphite.cachix.org https://graphite-dev.cachix.org
+            extra-trusted-public-keys = graphite.cachix.org-1:B7Il1yMpkquN/dXM+5GRmz+4Xmu2aaCS1GcWNfFhsOo= graphite-dev.cachix.org-1:RppXYpiV1qO2TYKTkXXGHsAEQDOB5G51b3VlrN9QmbI=
+
+      - name: 🗑 Free disk space
+        run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
+
+      - name: 📦 Build Nix package
+        run: nix build .#graphite${{ inputs.debug && '-dev' || '' }} --no-link --print-out-paths --print-build-logs
+
+      - name: 📤 Push to Nix cache
+        env:
+          NIX_CACHE_AUTH_TOKEN: ${{ (!inputs.debug && github.ref == 'refs/heads/master') && secrets.NIX_CACHE_AUTH_TOKEN || secrets.NIX_CACHE_AUTH_TOKEN_DEV }}
+          NIX_CACHE_NAME: ${{ (!inputs.debug && github.ref == 'refs/heads/master') && 'graphite' || 'graphite-dev' }}
+        run: |
+          nix run nixpkgs#cachix -- authtoken $NIX_CACHE_AUTH_TOKEN
+          nix build .#graphite${{ inputs.debug && '-dev' || '' }} --no-link --print-out-paths | nix run nixpkgs#cachix -- push $NIX_CACHE_NAME
+
+      - name: 📤 Push Dependencies to dev Nix cache
+        env:
+          NIX_CACHE_AUTH_TOKEN: ${{ secrets.NIX_CACHE_AUTH_TOKEN_DEV }}
+          NIX_CACHE_NAME: graphite-dev
+        run: |
+          nix run nixpkgs#cachix -- authtoken $NIX_CACHE_AUTH_TOKEN
+          nix build .#graphite${{ inputs.debug && '-dev' || '' }}.deps --no-link --print-out-paths | nix run nixpkgs#cachix -- push $NIX_CACHE_NAME
+
+      - name: 🏗 Build Linux bundle
+        run: nix build .#graphite-bundle${{ inputs.debug && '-dev' || '' }}.tar.xz && cp ./result ./graphite-linux-bundle.tar.xz
+
+      - name: 📦 Upload Linux bundle
+        uses: actions/upload-artifact@v6
+        with:
+          name: graphite-linux-bundle
+          path: graphite-linux-bundle.tar.xz
+          compression-level: 0
+
+      - name: 💬 Comment artifact link on PR
+        id: linux-comment
+        if: github.event_name != 'push'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ARTIFACT_ID=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts --jq '.artifacts[] | select(.name == "graphite-linux-bundle") | .id')
+          ARTIFACT_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts/$ARTIFACT_ID"
+          PR_NUMBER="${{ inputs.pr_number }}"
+          if [ -z "$PR_NUMBER" ]; then
+            BRANCH=$(git rev-parse --abbrev-ref HEAD)
+            PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || true)
+          fi
+          if [ -n "$PR_NUMBER" ] && [ -n "$ARTIFACT_ID" ]; then
+            BODY="| 📦 **Linux Build Complete for** $(git rev-parse HEAD) |"$'\n'
+            BODY+="|-|"$'\n'
+            BODY+="| [Download binary]($ARTIFACT_URL) |"
+            COMMENT_ID=$(gh api repos/${{ github.repository }}/issues/$PR_NUMBER/comments -f body="$BODY" --jq '.id')
+            echo "comment_id=$COMMENT_ID" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: 🔧 Install Flatpak tooling
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y flatpak flatpak-builder
+          flatpak --user remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+
+      - name: 🏗 Build Flatpak
+        run: |
+          nix build .#graphite-flatpak-manifest${{ inputs.debug && '-dev' || '' }}
+
+          rm -rf .flatpak
+          mkdir -p .flatpak
+
+          cp ./result .flatpak/manifest.json
+
+          cd .flatpak
+          mkdir -p repo
+
+          flatpak-builder --user --force-clean --install-deps-from=flathub --repo=repo build ./manifest.json
+
+          flatpak build-bundle repo Graphite.flatpak art.graphite.Graphite --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo
+
+      - name: 📦 Upload Flatpak package
+        uses: actions/upload-artifact@v6
+        with:
+          name: graphite-flatpak
+          path: .flatpak/Graphite.flatpak
+          compression-level: 0
+
+      - name: 💬 Update PR comment with Flatpak artifact link
+        if: github.event_name != 'push' && steps.linux-comment.outputs.comment_id
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ARTIFACT_ID=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts --jq '.artifacts[] | select(.name == "graphite-flatpak") | .id')
+          ARTIFACT_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts/$ARTIFACT_ID"
+          COMMENT_ID="${{ steps.linux-comment.outputs.comment_id }}"
+          if [ -n "$ARTIFACT_ID" ]; then
+            EXISTING_BODY=$(gh api repos/${{ github.repository }}/issues/comments/$COMMENT_ID --jq '.body')
+            BODY="$EXISTING_BODY"$'\n'
+            BODY+="| [Download Flatpak]($ARTIFACT_URL) |"
+            gh api repos/${{ github.repository }}/issues/comments/$COMMENT_ID -X PATCH -f body="$BODY"
+          fi

.jjconflict-base-0/.github/workflows/cargo-deny.yml

@@ -0,0 +1,26 @@
+name: "Audit Security Advisories"
+
+on:
+  # Run once each week
+  schedule:
+    - cron: "0 0 * * 0"
+
+jobs:
+  cargo-deny:
+    if: github.repository == 'GraphiteEditor/Graphite' # Don't run on forks by default
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+
+      - name: 🔒 Check crate security advisories for root workspace
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories
+
+      - name: 🔒 Check crate security advisories for /libraries/rawkit
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories
+          manifest-path: libraries/rawkit/Cargo.toml

.jjconflict-base-0/.github/workflows/check.yml

@@ -0,0 +1,103 @@
+name: "Check"
+
+on:
+  pull_request: {}
+  merge_group: {}
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # Check if CI can be skipped (for merge queue deduplication)
+  skip-check:
+    runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.check.outputs.skip-check }}
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+
+      - name: 🚦 Check if CI can be skipped
+        id: check
+        uses: cariad-tech/merge-queue-ci-skipper@cf80db21fc70244e36487acc531b3f1118889b0a
+
+  # Build the web app via the shared build workflow
+  build:
+    needs: skip-check
+    if: needs.skip-check.outputs.skip != 'true'
+    uses: ./.github/workflows/build.yml
+    secrets: inherit
+    with:
+      web: true
+      merge_queue: ${{ github.event_name == 'merge_group' }}
+
+  # Run the Rust tests on the self-hosted native runner
+  test:
+    needs: skip-check
+    if: needs.skip-check.outputs.skip != 'true'
+    runs-on: [self-hosted, target/native]
+    env:
+      RUSTC_WRAPPER: /usr/bin/sccache
+      CARGO_INCREMENTAL: 0
+      SCCACHE_DIR: /var/lib/github-actions/.cache
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          cache: false
+          rustflags: ""
+
+      - name: 🦀 Fetch Rust dependencies
+        run: cargo fetch --locked
+
+      - name: 🧪 Run Rust tests
+        env:
+          # `--cfg=web_sys_unstable_apis` mirrors the `[build]` section of `.cargo/config.toml`
+          RUSTFLAGS: "-Dwarnings --cfg=web_sys_unstable_apis"
+        run: mold -run cargo test --all-features
+
+  # Rust format check on GitHub runner
+  rust-fmt:
+    needs: skip-check
+    if: needs.skip-check.outputs.skip != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          cache: false
+          rustflags: ""
+          components: rustfmt
+
+      - name: 🔬 Check Rust formatting
+        run: cargo fmt --all -- --check
+
+  # License compatibility check on GitHub runner
+  check-licenses:
+    needs: skip-check
+    if: needs.skip-check.outputs.skip != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+
+      - name: 📜 Check crate license compatibility for root workspace
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check bans licenses sources
+
+      - name: 📜 Check crate license compatibility for /libraries/rawkit
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check bans licenses sources
+          manifest-path: libraries/rawkit/Cargo.toml

.jjconflict-base-0/.github/workflows/comment-!build-commands.yml

@@ -0,0 +1,137 @@
+# USAGE:
+# After reviewing the code, core team members may comment on a PR with `!build` followed by optional `<target>` and `<profile>` arguments.
+# This matches the syntax of the `cargo run build` CLI command, but allows platforms to be specified.
+#
+# `<target>`: `web` (default), `desktop` (all platforms), or `desktop:<platforms>` (subset of `windows+mac+linux`)
+# `<profile>`: `release` (default) or `debug`
+#
+# Examples:
+# - !build
+# - !build debug
+# - !build desktop
+# - !build desktop:windows+mac
+# - !build desktop:linux debug
+name: "!build PR Command"
+
+on:
+  issue_comment:
+    types:
+      - created
+
+jobs:
+  setup:
+    # Command should be limited to core team members (those in the organization) for security.
+    # From the GitHub Actions docs:
+    # author_association = 'MEMBER': Author is a member of the organization that owns the repository.
+    if: >
+      github.event.issue.pull_request &&
+      github.event.comment.author_association == 'MEMBER' &&
+      startsWith(github.event.comment.body, '!build')
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    outputs:
+      repo: ${{ steps.pr_info.outputs.repo }}
+      ref: ${{ steps.pr_info.outputs.ref }}
+      web: ${{ steps.pr_info.outputs.web }}
+      windows: ${{ steps.pr_info.outputs.windows }}
+      mac: ${{ steps.pr_info.outputs.mac }}
+      linux: ${{ steps.pr_info.outputs.linux }}
+      debug: ${{ steps.pr_info.outputs.debug }}
+
+    steps:
+      - name: 🔎 Parse command, find branch, and set build flags
+        id: pr_info
+        run: |
+          COMMENT="${{ github.event.comment.body }}"
+
+          # Split into space-separated words
+          read -ra WORDS <<< "$COMMENT"
+
+          # First word must be "!build"
+          if [[ "${WORDS[0]}" != "!build" ]]; then
+            echo "::error::Expected comment to start with !build"
+            exit 1
+          fi
+
+          # Initialize build flags (web defaults to true, matching the CLI default target)
+          WEB="true"
+          WINDOWS="false"
+          MAC="false"
+          LINUX="false"
+          DEBUG="false"
+
+          # Parse target (optional, defaults to `web` if omitted)
+          IDX=1
+          case "${WORDS[$IDX]:-}" in
+            # Target: `web` enables just the web build (already the default, but accepted explicitly)
+            "web")
+              ((IDX++)) ;;
+            # Target: `desktop` enables all three desktop platforms
+            "desktop")
+              WEB="false"; WINDOWS="true"; MAC="true"; LINUX="true"; ((IDX++)) ;;
+            # Target: `desktop:<platforms>` enables a subset of desktop platforms, split by `+`
+            desktop:*)
+              WEB="false"
+              PLATFORMS="${WORDS[$IDX]#desktop:}"
+              IFS='+' read -ra PARTS <<< "$PLATFORMS"
+              for PART in "${PARTS[@]}"; do
+                case "$PART" in
+                  "windows") WINDOWS="true" ;;
+                  "mac")     MAC="true" ;;
+                  "linux")   LINUX="true" ;;
+                  *) echo "::error::Unrecognized platform: $PART"; exit 1 ;;
+                esac
+              done
+              ((IDX++))
+              ;;
+          esac
+
+          # Parse profile (optional, defaults to `release` if omitted)
+          case "${WORDS[$IDX]:-}" in
+            "debug")   DEBUG="true"; ((IDX++)) ;;
+            "release") ((IDX++)) ;;
+          esac
+
+          # Reject any unexpected trailing words
+          if [[ $IDX -lt ${#WORDS[@]} ]]; then
+            echo "::error::Unexpected argument: ${WORDS[$IDX]}"
+            exit 1
+          fi
+
+          # Write parsed build flags to job outputs
+          echo "web=$WEB" >> $GITHUB_OUTPUT
+          echo "windows=$WINDOWS" >> $GITHUB_OUTPUT
+          echo "mac=$MAC" >> $GITHUB_OUTPUT
+          echo "linux=$LINUX" >> $GITHUB_OUTPUT
+          echo "debug=$DEBUG" >> $GITHUB_OUTPUT
+
+          # Fetch the PR's head branch and repo (needed for forked PRs where the code lives in another repo)
+          RESPONSE=$(curl -L -H 'Accept: application/vnd.github+json' -H 'X-GitHub-Api-Version: 2022-11-28' https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.issue.number }})
+          echo "repo=$(echo $RESPONSE | jq -r '.head.repo.full_name')" >> $GITHUB_OUTPUT
+          echo "ref=$(echo $RESPONSE | jq -r '.head.ref')" >> $GITHUB_OUTPUT
+
+      - name: 💬 Edit comment with workflow run link
+        uses: actions/github-script@v8
+        with:
+          script: |
+            github.rest.issues.updateComment({
+              comment_id: ${{ github.event.comment.id }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '${{ github.event.comment.body }} ([Run ID ' + context.runId + '](https://github.com/GraphiteEditor/Graphite/actions/runs/' + context.runId + '))'
+            });
+
+  invoke-build:
+    needs: setup
+    uses: ./.github/workflows/build.yml
+    secrets: inherit
+    with:
+      web: ${{ needs.setup.outputs.web == 'true' }}
+      windows: ${{ needs.setup.outputs.windows == 'true' }}
+      mac: ${{ needs.setup.outputs.mac == 'true' }}
+      linux: ${{ needs.setup.outputs.linux == 'true' }}
+      debug: ${{ needs.setup.outputs.debug == 'true' }}
+      checkout_repo: ${{ needs.setup.outputs.repo }}
+      checkout_ref: ${{ needs.setup.outputs.ref }}
+      pr_number: ${{ github.event.issue.number }}

.jjconflict-base-0/.github/workflows/comment-clippy-warnings.yaml

@@ -0,0 +1,103 @@
+name: "Clippy Check"
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+jobs:
+  clippy:
+    name: Run Clippy
+    runs-on: ubuntu-latest
+    # TODO(Keavon): Find a workaround (passing the output text to a separate action with permission to read the secrets?) that allows this to work on fork PRs
+    if: false
+    # if: ${{ !github.event.pull_request.draft && !github.event.pull_request.head.repo.fork }}
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          override: true
+          components: clippy
+
+      - name: Install deps
+        run: |
+          sudo apt update
+          sudo apt install libgtk-3-dev libsoup2.4-dev libjavascriptcoregtk-4.0-dev libwebkit2gtk-4.0-dev
+
+      - name: Run Clippy
+        id: clippy
+        run: |
+          # Run Clippy and filter output for the root workspace
+          CLIPPY_OUTPUT=$(cargo clippy --all-targets --all-features -- -W clippy::all 2>&1 | grep -vE "^(\s*Updating|\s*Download|\s*Compiling|\s*Checking|Finished)")
+
+          # Run Clippy and filter output for /libraries/rawkit
+          cd libraries/rawkit
+          CLIPPY_OUTPUT+=$'\n\n'
+          CLIPPY_OUTPUT+=$(cargo clippy --all-targets --all-features -- -W clippy::all 2>&1 | grep -vE "^(\s*Updating|\s*Download|\s*Compiling|\s*Checking|Finished)")
+          cd ../..
+
+          # Escape special characters for JSON
+          ESCAPED_OUTPUT=$(echo "$CLIPPY_OUTPUT" | jq -sR .)
+          echo "CLIPPY_OUTPUT=$ESCAPED_OUTPUT" >> $GITHUB_OUTPUT
+          if echo "$CLIPPY_OUTPUT" | grep -qE "^(warning|error)"; then
+            echo "CLIPPY_ISSUES_FOUND=true" >> $GITHUB_OUTPUT
+          else
+            echo "CLIPPY_ISSUES_FOUND=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Delete previous comments
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            const { data: comments } = await github.rest.issues.listComments({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            });
+
+            const botComments = comments.filter((comment) =>
+              comment.user.type === 'Bot' && comment.body.includes('Clippy Warnings/Errors')
+            );
+
+            for (const comment of botComments) {
+              await github.rest.issues.deleteComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: comment.id,
+              });
+            }
+
+      - name: Comment PR
+        if: steps.clippy.outputs.CLIPPY_ISSUES_FOUND == 'true'
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            const clippy_output = ${{ steps.clippy.outputs.CLIPPY_OUTPUT }};
+            const output = `
+            <details open>
+
+            <summary>Found Clippy warnings</summary>
+
+            #### Clippy Warnings/Errors
+
+            \`\`\`
+            ${clippy_output}
+            \`\`\`
+
+            </details>
+            `;
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: output
+            })

.jjconflict-base-0/.github/workflows/comment-profiling-changes.yaml

@@ -0,0 +1,336 @@
+name: "Profiling Changes"
+
+on:
+  pull_request:
+    paths:
+      - "node-graph/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  profile:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          # Cache on Cargo.lock file
+          cache-on-failure: true
+
+      - name: Install gungraun-runner and valgrind
+        uses: gungraun/setup-gungraun@v1
+
+      - name: Checkout master branch
+        run: |
+          git fetch origin master:master
+          git checkout master
+
+      - name: Get master commit SHA
+        id: master-sha
+        run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+
+      - name: Get CPU info
+        id: cpu-info
+        run: |
+          # Get CPU model and create a short hash for cache key
+          CPU_MODEL=$(cat /proc/cpuinfo | grep "model name" | head -1 | cut -d: -f2 | xargs)
+          CPU_HASH=$(echo "$CPU_MODEL" | sha256sum | cut -c1-8)
+          echo "cpu-hash=$CPU_HASH" >> $GITHUB_OUTPUT
+          echo "CPU: $CPU_MODEL (hash: $CPU_HASH)"
+
+      - name: Cache benchmark baselines
+        id: cache-benchmark-baselines
+        uses: actions/cache@v5
+        with:
+          path: target/gungraun
+          key: ${{ runner.os }}-${{ runner.arch }}-${{ steps.cpu-info.outputs.cpu-hash }}-gungraun-benchmark-baselines-master-${{ steps.master-sha.outputs.sha }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-${{ steps.cpu-info.outputs.cpu-hash }}-gungraun-benchmark-baselines-master-
+
+      - name: Run baseline benchmarks
+        if: steps.cache-benchmark-baselines.outputs.cache-hit != 'true'
+        run: |
+          # Compile benchmarks
+          cargo bench --bench compile_demo_art_gungraun -- --save-baseline=master
+
+          # Runtime benchmarks
+          cargo bench --bench update_executor_gungraun -- --save-baseline=master
+          cargo bench --bench run_once_gungraun -- --save-baseline=master
+          cargo bench --bench run_cached_gungraun -- --save-baseline=master
+
+      - name: Checkout PR branch
+        run: git checkout ${{ github.event.pull_request.head.sha }}
+
+      - name: Run PR benchmarks
+        run: |
+          # Compile benchmarks
+          cargo bench --bench compile_demo_art_gungraun -- --baseline=master --output-format=json | jq -sc | sed 's/\\"//g' > /tmp/compile_output.json
+
+          # Runtime benchmarks  
+          cargo bench --bench update_executor_gungraun -- --baseline=master --output-format=json | jq -sc | sed 's/\\"//g' > /tmp/update_output.json
+          cargo bench --bench run_once_gungraun -- --baseline=master --output-format=json | jq -sc | sed 's/\\"//g' > /tmp/run_once_output.json
+          cargo bench --bench run_cached_gungraun -- --baseline=master --output-format=json | jq -sc | sed 's/\\"//g' > /tmp/run_cached_output.json
+
+      - name: Make old comments collapsed by default
+        # Only run if we have write permissions (not a fork)
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            const { data: comments } = await github.rest.issues.listComments({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            });
+
+            const botComments = comments.filter((comment) =>
+              comment.user.type === 'Bot' && comment.body.includes('Performance Benchmark Results') && comment.body.includes('<details open>')
+            );
+
+            for (const comment of botComments) {
+              // Edit the comment to remove the "open" attribute from the <details> tag
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: comment.id,
+                body: comment.body.replace('<details open>', '<details>')
+              });
+            }
+
+      - name: Analyze profiling changes
+        id: analyze
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require('fs');
+
+            function isSignificantChange(diffPct, absoluteChange, benchmarkType) {
+              const meetsPercentageThreshold = Math.abs(diffPct) > 5;
+              const meetsAbsoluteThreshold = absoluteChange > 200000;
+              const isCachedExecution = benchmarkType === 'run_cached' ||
+                                        benchmarkType.includes('Cached Execution');
+
+              return isCachedExecution
+                ? (meetsPercentageThreshold && meetsAbsoluteThreshold)
+                : meetsPercentageThreshold;
+            }
+
+            const allOutputs = [
+              JSON.parse(fs.readFileSync('/tmp/compile_output.json', 'utf8')),
+              JSON.parse(fs.readFileSync('/tmp/update_output.json', 'utf8')),
+              JSON.parse(fs.readFileSync('/tmp/run_once_output.json', 'utf8')),
+              JSON.parse(fs.readFileSync('/tmp/run_cached_output.json', 'utf8'))
+            ];
+            const outputNames = ['compile', 'update', 'run_once', 'run_cached'];
+            const sectionTitles = ['Compilation', 'Update', 'Run Once', 'Cached Execution'];
+
+            let hasSignificantChanges = false;
+            let hasRegressions = false;
+            let regressionDetails = [];
+
+            for (let i = 0; i < allOutputs.length; i++) {
+              const benchmarkOutput = allOutputs[i];
+              const outputName = outputNames[i];
+              const sectionTitle = sectionTitles[i];
+
+              for (const benchmark of benchmarkOutput) {
+                if (benchmark.profiles?.[0]?.summaries?.parts?.[0]?.metrics_summary?.Callgrind?.Ir?.diffs?.diff_pct) {
+                  const diffPct = parseFloat(benchmark.profiles[0].summaries.parts[0].metrics_summary.Callgrind.Ir.diffs.diff_pct);
+                  const oldValue = benchmark.profiles[0].summaries.parts[0].metrics_summary.Callgrind.Ir.metrics.Both[1].Int;
+                  const newValue = benchmark.profiles[0].summaries.parts[0].metrics_summary.Callgrind.Ir.metrics.Both[0].Int;
+                  const absoluteChange = Math.abs(newValue - oldValue);
+
+                  if (isSignificantChange(diffPct, absoluteChange, outputName)) {
+                    hasSignificantChanges = true;
+
+                    // Only an increase in instruction count is a regression; improvements must not fail CI.
+                    if (diffPct > 0) {
+                      hasRegressions = true;
+                      regressionDetails.push({
+                        module_path: benchmark.module_path,
+                        id: benchmark.id,
+                        diffPct,
+                        absoluteChange,
+                        sectionTitle
+                      });
+                    }
+                  }
+                }
+              }
+            }
+
+            core.setOutput('has-significant-changes', hasSignificantChanges);
+            core.setOutput('has-regressions', hasRegressions);
+            core.setOutput('regression-details', JSON.stringify(regressionDetails));
+
+      - name: Comment PR
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            const fs = require('fs');
+
+            const compileOutput = JSON.parse(fs.readFileSync('/tmp/compile_output.json', 'utf8'));
+            const updateOutput = JSON.parse(fs.readFileSync('/tmp/update_output.json', 'utf8'));  
+            const runOnceOutput = JSON.parse(fs.readFileSync('/tmp/run_once_output.json', 'utf8'));
+            const runCachedOutput = JSON.parse(fs.readFileSync('/tmp/run_cached_output.json', 'utf8'));
+
+            const hasSignificantChanges = '${{ steps.analyze.outputs.has-significant-changes }}' === 'true';
+            let commentBody = "";
+
+            function formatNumber(num) {
+              return String(num).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+            }
+
+            function formatPercentage(pct) {
+              const sign = pct >= 0 ? '+' : '';
+              return `${sign}${pct.toFixed(2)}%`;
+            }
+
+            function padRight(str, len) {
+              return str.padEnd(len);
+            }
+
+            function padLeft(str, len) {
+              return str.padStart(len);
+            }
+
+            function processBenchmarkOutput(benchmarkOutput, sectionTitle, isLast = false) {
+              let sectionBody = "";
+              let hasResults = false;
+              let hasSignificantChanges = false;
+
+              function isSignificantChange(diffPct, absoluteChange, benchmarkType) {
+                const meetsPercentageThreshold = Math.abs(diffPct) > 5;
+                const meetsAbsoluteThreshold = absoluteChange > 200000;
+                const isCachedExecution = benchmarkType === 'run_cached' ||
+                                          benchmarkType.includes('Cached Execution');
+
+                return isCachedExecution
+                  ? (meetsPercentageThreshold && meetsAbsoluteThreshold)
+                  : meetsPercentageThreshold;
+              }
+              
+              for (const benchmark of benchmarkOutput) {
+                if (benchmark.profiles && benchmark.profiles.length > 0) {
+                  const profile = benchmark.profiles[0];
+                  if (profile.summaries && profile.summaries.parts && profile.summaries.parts.length > 0) {
+                    const part = profile.summaries.parts[0];
+                    if (part.metrics_summary && part.metrics_summary.Callgrind && part.metrics_summary.Callgrind.Ir) {
+                      const irData = part.metrics_summary.Callgrind.Ir;
+                      if (irData.diffs && irData.diffs.diff_pct !== null) {
+                        const irDiff = {
+                          diff_pct: parseFloat(irData.diffs.diff_pct),
+                          old: irData.metrics.Both[1].Int,
+                          new: irData.metrics.Both[0].Int
+                        };
+                    hasResults = true;
+                    const changePercentage = formatPercentage(irDiff.diff_pct);
+                    const color = irDiff.diff_pct > 0 ? "red" : "lime";
+                    
+                    sectionBody += `**${benchmark.module_path} ${benchmark.id}:${benchmark.details}**\n`;
+                    sectionBody += `Instructions: \`${formatNumber(irDiff.old)}\` (master) → \`${formatNumber(irDiff.new)}\` (HEAD) : `;
+                    sectionBody += `$$\\color{${color}}${changePercentage.replace("%", "\\\\%")}$$\n\n`;
+                    
+                    sectionBody += "<details>\n<summary>Detailed metrics</summary>\n\n```\n";
+                    sectionBody += `Baselines:                master|       HEAD\n`;
+                    
+                    for (const [metricName, metricData] of Object.entries(part.metrics_summary.Callgrind)) {
+                      if (metricData.diffs && metricData.diffs.diff_pct !== null) {
+                        const changePercentage = formatPercentage(parseFloat(metricData.diffs.diff_pct));
+                        const oldValue = metricData.metrics.Both[1].Int || metricData.metrics.Both[1].Float;
+                        const newValue = metricData.metrics.Both[0].Int || metricData.metrics.Both[0].Float;
+                        const line = `${padRight(metricName, 20)} ${padLeft(formatNumber(Math.round(oldValue)), 11)}|${padLeft(formatNumber(Math.round(newValue)), 11)} ${padLeft(changePercentage, 15)}`;
+                        sectionBody += `${line}\n`;
+                      }
+                    }
+                    
+                    sectionBody += "```\n</details>\n\n";
+
+                        if (isSignificantChange(irDiff.diff_pct, Math.abs(irDiff.new - irDiff.old), sectionTitle)) {
+                          significantChanges = true;
+                          hasSignificantChanges = true;
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+              
+              if (hasResults) {
+                // Wrap section in collapsible details, open only if there are significant changes
+                const openAttribute = hasSignificantChanges ? " open" : "";
+                const ruler = isLast ? "" : "\n\n---";
+                return `<details${openAttribute}>\n<summary><h2>${sectionTitle}</h2></summary>\n\n${sectionBody}${ruler}\n</details>`;
+              }
+              return "";
+            }
+
+            // Process each benchmark category
+            const sections = [
+              { output: compileOutput, title: "🔧 Graph Compilation" },
+              { output: updateOutput, title: "🔄 Executor Update" },
+              { output: runOnceOutput, title: "🚀 Render: Cold Execution" },
+              { output: runCachedOutput, title: "⚡ Render: Cached Execution" }
+            ];
+
+            // Generate sections and determine which ones have results
+            const generatedSections = sections.map(({ output, title }) => 
+              processBenchmarkOutput(output, title, true) // temporarily mark all as last
+            ).filter(section => section.length > 0);
+
+            // Re-generate with correct isLast flags
+            let sectionIndex = 0;
+            const finalSections = sections.map(({ output, title }) => {
+              const section = processBenchmarkOutput(output, title, true); // check if it has results
+              if (section.length > 0) {
+                const isLast = sectionIndex === generatedSections.length - 1;
+                sectionIndex++;
+                return processBenchmarkOutput(output, title, isLast);
+              }
+              return "";
+            }).filter(section => section.length > 0);
+
+            // Combine all sections
+            commentBody = finalSections.join("\n\n");
+
+            if (commentBody.length > 0) {
+              const output = `<details open>\n<summary>Performance Benchmark Results</summary>\n\n${commentBody}\n</details>`;
+
+              if (hasSignificantChanges) {
+                github.rest.issues.createComment({
+                  issue_number: context.issue.number,
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  body: output
+                });
+              } else {
+                console.log("No significant performance changes detected. Skipping comment.");
+                console.log(output);
+              }
+            } else {
+              console.log("No benchmark results to display.");
+            }
+
+      - name: Fail on significant regressions
+        if: steps.analyze.outputs.has-regressions == 'true'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const regressionDetails = JSON.parse('${{ steps.analyze.outputs.regression-details }}');
+            const firstRegression = regressionDetails[0];
+
+            core.setFailed(`Significant performance regression detected: ${firstRegression.module_path} ${firstRegression.id} increased by ${firstRegression.absoluteChange.toLocaleString()} instructions (${firstRegression.diffPct.toFixed(2)}%)`);

.jjconflict-base-0/.github/workflows/library-rawkit.yml

@@ -0,0 +1,66 @@
+name: "Library: Rawkit"
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - "libraries/rawkit/**"
+  pull_request:
+    paths:
+      - "libraries/rawkit/**"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: "sccache"
+      CARGO_INCREMENTAL: 0
+      SCCACHE_DIR: /var/lib/github-actions/.cache
+
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          cache: false
+          rustflags: ""
+
+      - name: 📦 Run sccache-cache
+        uses: mozilla-actions/sccache-action@v0.0.6
+        continue-on-error: true
+
+      - name: 🔧 Fallback if sccache fails
+        if: failure()
+        run: |
+          echo "sccache failed, disabling it"
+          echo "RUSTC_WRAPPER=" >> $GITHUB_ENV
+
+      - name: 🔬 Check Rust formatting
+        run: |
+          cd libraries/rawkit
+          cargo fmt --all -- --check
+
+      - name: 🦀 Build Rust code
+        run: |
+          cd libraries/rawkit
+          cargo build --release --all-features
+
+      - name: 🧪 Run Rust tests
+        run: |
+          cd libraries/rawkit
+          cargo test --release --all-features
+
+      - name: 📈 Run sccache stat for check
+        shell: bash
+        run: sccache --show-stats || echo "sccache stats unavailable"

.jjconflict-base-0/.github/workflows/nix.yml

@@ -0,0 +1,51 @@
+name: "Nix Housekeeping"
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch: {}
+
+jobs:
+  cache-dev-shell:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.checkout_repo || github.repository }}
+          ref: ${{ inputs.checkout_ref || '' }}
+
+      - name: ❄ Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
+            extra-substituters = https://graphite.cachix.org https://graphite-dev.cachix.org
+            extra-trusted-public-keys = graphite.cachix.org-1:B7Il1yMpkquN/dXM+5GRmz+4Xmu2aaCS1GcWNfFhsOo= graphite-dev.cachix.org-1:RppXYpiV1qO2TYKTkXXGHsAEQDOB5G51b3VlrN9QmbI=
+
+      - name: 🔎 Check whether development shell is already in binary cache
+        id: cache-check
+        run: |
+          out_path="$(nix eval --raw .#devShells.x86_64-linux.default.outPath)"
+          if nix path-info --store https://graphite-dev.cachix.org "$out_path" &>/dev/null; then
+            echo "cached=true" >> "$GITHUB_OUTPUT"
+            echo "Development shell is already cached at $out_path"
+          else
+            echo "cached=false" >> "$GITHUB_OUTPUT"
+            echo "Development shell is not cached"
+          fi
+
+      - name: 📦 Build Nix development shell
+        if: steps.cache-check.outputs.cached == 'false'
+        run: nix build .#devShells.x86_64-linux.default --no-link --print-out-paths
+
+      - name: 📤 Push Nix development shell to binary cache
+        if: steps.cache-check.outputs.cached == 'false'
+        env:
+          NIX_CACHE_AUTH_TOKEN: ${{ secrets.NIX_CACHE_AUTH_TOKEN_DEV }}
+        run: |
+          nix run nixpkgs#cachix -- authtoken $NIX_CACHE_AUTH_TOKEN
+          nix build .#devShells.x86_64-linux.default --no-link --print-out-paths | nix run nixpkgs#cachix -- push graphite-dev

.jjconflict-base-0/.github/workflows/provide-shaders.yml

@@ -0,0 +1,45 @@
+name: "Provide Shaders"
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+
+      - name: ❄ Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
+            extra-substituters = https://graphite.cachix.org https://graphite-dev.cachix.org
+            extra-trusted-public-keys = graphite.cachix.org-1:B7Il1yMpkquN/dXM+5GRmz+4Xmu2aaCS1GcWNfFhsOo= graphite-dev.cachix.org-1:RppXYpiV1qO2TYKTkXXGHsAEQDOB5G51b3VlrN9QmbI=
+
+      - name: 🏗 Build graphene raster nodes shaders
+        run: nix build .#graphite-raster-nodes-shaders && cp result raster_nodes_shaders_entrypoint.wgsl
+
+      - name: 📤 Upload graphene raster nodes shaders to artifacts repository
+        run: |
+          bash .github/workflows/scripts/artifact-upload.bash \
+            ${{ vars.ARTIFACTS_REPO_OWNER }} \
+            ${{ vars.ARTIFACTS_REPO_NAME }} \
+            ${{ vars.ARTIFACTS_REPO_BRANCH }} \
+            rev/${{ github.sha }}/raster_nodes_shaders_entrypoint.wgsl \
+            raster_nodes_shaders_entrypoint.wgsl \
+            "${{ github.sha }} raster_nodes_shaders_entrypoint.wgsl" \
+            ${{ secrets.ARTIFACTS_REPO_TOKEN }}
+
+      - name: 📤 Push shaders to dev Nix cache
+        env:
+          NIX_CACHE_AUTH_TOKEN: ${{ secrets.NIX_CACHE_AUTH_TOKEN_DEV }}
+          NIX_CACHE_NAME: graphite-dev
+        run: |
+          nix run nixpkgs#cachix -- authtoken $NIX_CACHE_AUTH_TOKEN
+          nix build .#graphite-raster-nodes-shaders --no-link --print-out-paths | nix run nixpkgs#cachix -- push $NIX_CACHE_NAME

.jjconflict-base-0/.github/workflows/scripts/artifact-upload.bash

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<EOF
+Usage: $0 <owner> <repo> <branch> <target-path> <artifact-file> <commit-message> <github-token>
+
+Arguments:
+  owner           : GitHub user or organization of the target repo
+  repo            : Target repo name
+  branch          : Branch name (e.g. main)
+  target-path     : Full path (including folders + filename) in the target repo where to upload
+  artifact-file   : Local file path to upload
+  commit-message  : Commit message for creating/updating the file
+  github-token    : GitHub token (PAT or equivalent) with write access to the target repo
+
+This will perform a GitHub API PUT to /repos/{owner}/{repo}/contents/{target-path}.
+If a file already exists at that path, it will auto-detect the SHA and update; otherwise it will create a new one.
+EOF
+  exit 1
+}
+
+if [ $# -ne 7 ]; then
+  usage
+fi
+
+OWNER="$1"
+REPO="$2"
+BRANCH="$3"
+TARGET_PATH="$4"
+ARTIFACT_PATH="$5"
+COMMIT_MSG="$6"
+TOKEN="$7"
+
+if [ ! -f "$ARTIFACT_PATH" ]; then
+  echo "Error: artifact file not found: $ARTIFACT_PATH" >&2
+  exit 1
+fi
+
+LOCAL_SHA=$(git hash-object "$ARTIFACT_PATH")
+echo "Local blob SHA: $LOCAL_SHA"
+
+GET_URL="https://api.github.com/repos/${OWNER}/${REPO}/contents/${TARGET_PATH}?ref=${BRANCH}"
+GET_RESPONSE=$(curl -s -H "Authorization: token ${TOKEN}" "$GET_URL")
+
+REMOTE_SHA=$(echo "$GET_RESPONSE" | jq -r .sha 2>/dev/null || echo "")
+
+if [ "$REMOTE_SHA" != "null" ] && [ -n "$REMOTE_SHA" ]; then
+  echo "Remote blob SHA: $REMOTE_SHA"
+  if [ "$LOCAL_SHA" = "$REMOTE_SHA" ]; then
+    echo "The remote file is identical. Skipping upload."
+    exit 0
+  else
+    echo "Remote file differs. Preparing to upload."
+  fi
+else
+  echo "No existing remote file or no SHA found. Creating."
+fi
+
+CONTENT_TMP_BASE64=$(mktemp)
+if base64 --help 2>&1 | grep -q -- "-w"; then
+  base64 -w 0 "$ARTIFACT_PATH" > "$CONTENT_TMP_BASE64"
+else
+  base64 "$ARTIFACT_PATH" | tr -d '\n' > "$CONTENT_TMP_BASE64"
+fi
+
+PAYLOAD_TMP=$(mktemp)
+jq -n \
+  --arg message "$COMMIT_MSG" \
+  --arg branch "$BRANCH" \
+  --arg sha "$REMOTE_SHA" \
+  --rawfile content "$CONTENT_TMP_BASE64" \
+  '{
+     message: $message,
+     content: $content,
+     branch: $branch
+   } + (if ($sha != "" and $sha != "null") then { sha: $sha } else {} end)' \
+  > "$PAYLOAD_TMP"
+
+UPLOAD_RESPONSE=$(curl -s -X PUT \
+  -H "Authorization: token ${TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d @"$PAYLOAD_TMP" \
+  "https://api.github.com/repos/${OWNER}/${REPO}/contents/${TARGET_PATH}")
+
+echo "Upload Response:"
+echo "$UPLOAD_RESPONSE"
+
+rm -f "$CONTENT_TMP_BASE64" "$PAYLOAD_TMP"

.jjconflict-base-0/.github/workflows/website.yml

@@ -0,0 +1,79 @@
+name: "Website"
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - master
+    paths:
+      - website/**
+  pull_request:
+    paths:
+      - website/**
+env:
+  CARGO_TERM_COLOR: always
+  INDEX_HTML_HEAD_INCLUSION: <script defer data-domain="graphite.art" data-api="/visit/event" src="/visit/script.hash.js"></script>
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      deployments: write
+      pull-requests: write
+
+    steps:
+      - name: 📥 Clone repository
+        uses: actions/checkout@v6
+
+      - name: 🟢 Install Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: 🕸 Install Zola
+        uses: taiki-e/install-action@v2
+        with:
+          tool: zola@0.22.0
+
+      - name: 🔍 Check if `website/other` directory changed
+        uses: dorny/paths-filter@v3
+        id: changes
+        with:
+          filters: |
+            website-other:
+              - "website/other/**"
+
+      - name: ✂ Replace template in <head> of index.html
+        run: |
+          # Remove the INDEX_HTML_HEAD_INCLUSION environment variable for build links (not master deploys)
+          git rev-parse --abbrev-ref HEAD | grep master > /dev/null || export INDEX_HTML_HEAD_INCLUSION=""
+
+      - name: 🦀 Produce auto-generated code docs data
+        run: |
+          rustup update stable
+          cargo run -p crate-hierarchy-viz -- website/generated
+          cargo run -p editor-message-tree -- website/generated
+
+      - name: 🔧 Install website npm dependencies
+        run: |
+          cd website
+          npm ci
+
+      - name: 📃 Generate node catalog documentation
+        run: cargo run -p node-docs -- website/content/learn/node-catalog
+
+      - name: 🌐 Build Graphite website with Zola
+        env:
+          MODE: prod
+        run: |
+          cd website
+          npm run check
+          zola --config config.toml build --minify
+
+      - name: 📤 Publish to Cloudflare Pages
+        continue-on-error: true
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: npx wrangler@3 pages deploy "website/public" --project-name="graphite-website" --commit-dirty=true