From a198ef50ca193f53a259e7d11f16312878cf554a Mon Sep 17 00:00:00 2001
From: Kaspar Bumke <git@kaspar.systems>
Date: Tue, 15 Sep 2026 11:03:01 +0100
Subject: [PATCH 1/3] BUILD: Use ninja to build wasm targets

---
 .gitignore                             |  1 +
 build-targets.json                     | 50 +++++++++++++++++
 build.py                               | 76 ++++++++++++++++++++++++++
 flake.nix                              | 11 +++-
 infrastructure/ninja-target.nix        | 60 ++++++++++++++++++++
 packages/catlog-wasm/default.nix       | 59 --------------------
 packages/catlog-wasm/package.json      |  2 +-
 packages/document-methods/package.json |  2 +-
 packages/document-types/default.nix    | 56 -------------------
 packages/frontend/package.json         |  4 +-
 10 files changed, 199 insertions(+), 122 deletions(-)
 create mode 100644 build-targets.json
 create mode 100755 build.py
 create mode 100644 infrastructure/ninja-target.nix
 delete mode 100644 packages/catlog-wasm/default.nix
 delete mode 100644 packages/document-types/default.nix

diff --git a/.gitignore b/.gitignore
index 873a5132b8..afce5d8dc1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -81,6 +81,7 @@ web_modules/
 .netlify
 /packages/frontend/docs/
 /target/
+/build.ninja
 
 # Sentry files
 instrument.mjs
diff --git a/build-targets.json b/build-targets.json
new file mode 100644
index 0000000000..f4bb7505d4
--- /dev/null
+++ b/build-targets.json
@@ -0,0 +1,50 @@
+{
+    "document-types-wasm": {
+        "crate": "packages/document-types",
+        "command": "wasm-pack build packages/document-types",
+        "inputs": [
+            "Cargo.lock",
+            "Cargo.toml",
+            "rust-toolchain.toml",
+            "packages/document-types/.cargo/config.toml",
+            "packages/document-types/Cargo.toml",
+            "packages/document-types/README.md",
+            "packages/document-types/src"
+        ],
+        "outputs": [
+            "packages/document-types/pkg/package.json",
+            "packages/document-types/pkg/catcolab_document_types.js",
+            "packages/document-types/pkg/catcolab_document_types_bg.js",
+            "packages/document-types/pkg/catcolab_document_types.d.ts",
+            "packages/document-types/pkg/catcolab_document_types_bg.wasm",
+            "packages/document-types/pkg/catcolab_document_types_bg.wasm.d.ts",
+            "packages/document-types/pkg/README.md"
+        ]
+    },
+    "catlog-wasm-browser": {
+        "crate": "packages/catlog-wasm",
+        "command": "wasm-pack build packages/catlog-wasm --target browser -d dist/pkg-browser --debug",
+        "inputs": [
+            "Cargo.lock",
+            "Cargo.toml",
+            "rust-toolchain.toml",
+            "packages/catlog/Cargo.toml",
+            "packages/catlog/examples",
+            "packages/catlog/src",
+            "packages/catlog-wasm/.cargo/config.toml",
+            "packages/catlog-wasm/Cargo.toml",
+            "packages/catlog-wasm/src",
+            "packages/document-types/.cargo/config.toml",
+            "packages/document-types/Cargo.toml",
+            "packages/document-types/src"
+        ],
+        "outputs": [
+            "packages/catlog-wasm/dist/pkg-browser/package.json",
+            "packages/catlog-wasm/dist/pkg-browser/catlog_wasm.js",
+            "packages/catlog-wasm/dist/pkg-browser/catlog_wasm_bg.js",
+            "packages/catlog-wasm/dist/pkg-browser/catlog_wasm.d.ts",
+            "packages/catlog-wasm/dist/pkg-browser/catlog_wasm_bg.wasm",
+            "packages/catlog-wasm/dist/pkg-browser/catlog_wasm_bg.wasm.d.ts"
+        ]
+    }
+}
diff --git a/build.py b/build.py
new file mode 100755
index 0000000000..c75735d5fd
--- /dev/null
+++ b/build.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+
+from io import StringIO
+from pathlib import Path
+import json
+import os
+
+import ninja
+from ninja.ninja_syntax import Writer
+
+
+ROOT = Path(__file__).resolve().parent
+MANIFEST = ROOT / "build-targets.json"
+BUILD_FILE = ROOT / "build.ninja"
+BUILD_DIR = "target/ninja"
+
+# Inputs shared by every target; changing the build definition rebuilds everything.
+COMMON_INPUTS = ["build.py", "build-targets.json"]
+
+
+def expand_inputs(inputs: list[str]) -> list[str]:
+    """Expand directory inputs to the files they contain, as ninja needs files."""
+    files: set[Path] = set()
+    for rel in inputs:
+        path = ROOT / rel
+        if path.is_dir():
+            files.update(p for p in path.rglob("*") if p.is_file())
+        else:
+            files.add(path)
+    return sorted(p.relative_to(ROOT).as_posix() for p in files)
+
+
+targets = json.loads(MANIFEST.read_text())
+
+buffer = StringIO()
+w = Writer(buffer)
+
+w.variable("builddir", BUILD_DIR)
+w.newline()
+
+w.pool("wasm_pool", depth=1)
+w.newline()
+
+w.rule(
+    "wasm_pack",
+    command=f"mkdir -p {BUILD_DIR} && $wasm_pack_command && touch $out",
+    description="WASM-PACK $target_name",
+    pool="wasm_pool",
+    restat=True,
+)
+w.newline()
+
+for name, target in targets.items():
+    stamp = f"{BUILD_DIR}/{name}.stamp"
+    w.build(
+        stamp,
+        "wasm_pack",
+        inputs=expand_inputs(COMMON_INPUTS + target["inputs"]),
+        implicit_outputs=target["outputs"],
+        variables={
+            "wasm_pack_command": target["command"],
+            "target_name": name,
+        },
+    )
+    w.build(name, "phony", stamp)
+    w.newline()
+
+w.build("wasm", "phony", list(targets))
+w.default("wasm")
+
+contents = buffer.getvalue()
+if not BUILD_FILE.exists() or BUILD_FILE.read_text() != contents:
+    BUILD_FILE.write_text(contents)
+
+os.chdir(ROOT)
+ninja.ninja()
diff --git a/flake.nix b/flake.nix
index 5606d923ab..ce4d0dea25 100644
--- a/flake.nix
+++ b/flake.nix
@@ -178,13 +178,14 @@
               esbuild
               lld
               netcat
+              ninja
               nodejs_24
               nix
               openssl
               pkg-config
               pnpm
               postgresql
-              python3
+              (python3.withPackages (ps: [ ps.ninja ]))
               python312Packages.ipykernel
               python312Packages.jupyter-core
               python312Packages.jupyter-server
@@ -286,8 +287,12 @@
             in
             {
               catcolabApi = pkgs.callPackage ./infrastructure/catcolab-api.nix craneArgs;
-              catlog-wasm-browser = pkgs.callPackage ./packages/catlog-wasm/default.nix craneArgs;
-              document-types-wasm = pkgs.callPackage ./packages/document-types/default.nix craneArgs;
+              catlog-wasm-browser = pkgs.callPackage ./infrastructure/ninja-target.nix (
+                craneArgs // { target = "catlog-wasm-browser"; }
+              );
+              document-types-wasm = pkgs.callPackage ./infrastructure/ninja-target.nix (
+                craneArgs // { target = "document-types-wasm"; }
+              );
               frontend = frontendPackage.package;
               frontend-tests = frontendPackage.tests;
             };
diff --git a/infrastructure/ninja-target.nix b/infrastructure/ninja-target.nix
new file mode 100644
index 0000000000..32066d9a4b
--- /dev/null
+++ b/infrastructure/ninja-target.nix
@@ -0,0 +1,60 @@
+# Builds a target from build-targets.json via build.py (ninja). The source
+# fileset is derived from the target's `inputs`, so ninja and nix share one
+# dependency listing.
+{
+  craneLib,
+  cargoArtifacts,
+  pkgs,
+  target,
+}:
+let
+  root = ../.;
+  targets = builtins.fromJSON (builtins.readFile (root + "/build-targets.json"));
+  spec = targets.${target};
+  toPath = rel: root + "/${rel}";
+in
+craneLib.buildPackage {
+  inherit cargoArtifacts;
+  inherit (craneLib.crateNameFromCargoToml { cargoToml = toPath "${spec.crate}/Cargo.toml"; })
+    version
+    pname
+    ;
+  doCheck = false;
+
+  nativeBuildInputs = [
+    (pkgs.python3.withPackages (ps: [ ps.ninja ]))
+    pkgs.wasm-pack
+    pkgs.wasm-bindgen-cli
+    pkgs.binaryen
+    pkgs.nodejs
+  ];
+
+  buildInputs = [
+    pkgs.openssl
+  ];
+
+  src = pkgs.lib.fileset.toSource {
+    inherit root;
+    fileset = pkgs.lib.fileset.unions (
+      map toPath (
+        [
+          "build.py"
+          "build-targets.json"
+        ]
+        ++ spec.inputs
+      )
+    );
+  };
+
+  # wasm-pack expects a wasm-bindgen-cli in the environment matching the version in Cargo.lock;
+  # see the overlay in flake.nix. It also needs a writeable $HOME (https://github.com/ipetkov/crane/issues/362).
+  buildPhase = ''
+    HOME=$(mktemp -d) python3 build.py ${target}
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp ${pkgs.lib.concatStringsSep " " spec.outputs} $out/
+    ls $out/
+  '';
+}
diff --git a/packages/catlog-wasm/default.nix b/packages/catlog-wasm/default.nix
deleted file mode 100644
index b4ff0f2743..0000000000
--- a/packages/catlog-wasm/default.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  craneLib,
-  cargoArtifacts,
-  pkgs,
-}:
-craneLib.buildPackage {
-  inherit cargoArtifacts;
-  inherit (craneLib.crateNameFromCargoToml { cargoToml = ./Cargo.toml; }) version pname;
-  doCheck = false;
-
-  cargoExtraArgs = "-p catlog-wasm";
-
-  nativeBuildInputs = [
-    pkgs.wasm-pack
-    pkgs.wasm-bindgen-cli
-    pkgs.binaryen
-    pkgs.nodejs
-  ];
-
-  buildInputs = [
-    pkgs.openssl
-  ];
-
-  src = pkgs.lib.fileset.toSource {
-    root = ../..;
-    fileset = pkgs.lib.fileset.unions [
-      ../../Cargo.toml
-      ../../Cargo.lock
-      (craneLib.fileset.commonCargoSources ./.)
-      (craneLib.fileset.commonCargoSources ../catlog)
-      (craneLib.fileset.commonCargoSources ../document-types)
-      ./package.json
-    ];
-  };
-
-  # run wasm-pack instead of the default cargo
-  buildPhase = ''
-    cd packages/catlog-wasm
-    # Run the wasm-pack command. wasm-pack will expect to find version of wasm-bindgen-cli in the
-    # environment that must matches the version wasm-bindgen used in the Cargo.toml. The wasm-bindgen-cli
-    # in the nix environment is defined an overlay in flake.nix.
-    #
-    # If the versions do not match there will be a build error when building with nix:
-    # Error: Not able to find or install a local wasm-bindgen.
-    #
-    # With RUST_LOG=debug set there should be a log like indicating the exact problem:
-    # Checking installed `wasm-bindgen` version == expected version: 0.2.105 == 0.2.106
-    # 
-    # wasm-pack needs a writeable $HOME
-    # https://github.com/ipetkov/crane/issues/362
-    HOME=$(mktemp -d) npm run build:browser
-  '';
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r dist/pkg-browser/* $out/
-    ls $out/
-  '';
-}
diff --git a/packages/catlog-wasm/package.json b/packages/catlog-wasm/package.json
index 1a8046b398..fce3f49f75 100644
--- a/packages/catlog-wasm/package.json
+++ b/packages/catlog-wasm/package.json
@@ -5,6 +5,6 @@
     "version": "0.1.0",
     "type": "module",
     "scripts": {
-        "build:browser": "wasm-pack build ./. --target browser -d ./dist/pkg-browser --debug"
+        "build:browser": "../../build.py catlog-wasm-browser"
     }
 }
diff --git a/packages/document-methods/package.json b/packages/document-methods/package.json
index a796f16cac..119670994e 100644
--- a/packages/document-methods/package.json
+++ b/packages/document-methods/package.json
@@ -9,7 +9,7 @@
         "./*": "./src/*"
     },
     "scripts": {
-        "build:wasm": "wasm-pack build ../document-types",
+        "build:wasm": "../../build.py document-types-wasm",
         "format": "oxfmt .",
         "lint": "oxlint --fix && oxfmt .",
         "check": "pnpm run build:wasm && tsc && pnpm run lint",
diff --git a/packages/document-types/default.nix b/packages/document-types/default.nix
deleted file mode 100644
index bb055271bd..0000000000
--- a/packages/document-types/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  craneLib,
-  cargoArtifacts,
-  pkgs,
-}:
-craneLib.buildPackage {
-  inherit cargoArtifacts;
-  inherit (craneLib.crateNameFromCargoToml { cargoToml = ./Cargo.toml; }) version pname;
-  doCheck = false;
-
-  cargoExtraArgs = "-p catcolab-document-types";
-
-  nativeBuildInputs = [
-    pkgs.wasm-pack
-    pkgs.wasm-bindgen-cli
-    pkgs.binaryen
-    pkgs.nodejs
-  ];
-
-  buildInputs = [
-    pkgs.openssl
-  ];
-
-  src = pkgs.lib.fileset.toSource {
-    root = ../..;
-    fileset = pkgs.lib.fileset.unions [
-      ../../Cargo.toml
-      ../../Cargo.lock
-      (craneLib.fileset.commonCargoSources ./.)
-    ];
-  };
-
-  # run wasm-pack instead of the default cargo
-  buildPhase = ''
-    cd packages/document-types
-    # Run the wasm-pack command. wasm-pack will expect to find version of wasm-bindgen-cli in the
-    # environment that must matches the version wasm-bindgen used in the Cargo.toml. The wasm-bindgen-cli
-    # in the nix environment is defined an overlay in flake.nix.
-    #
-    # If the versions do not match there will be a build error when building with nix:
-    # Error: Not able to find or install a local wasm-bindgen.
-    #
-    # With RUST_LOG=debug set there should be a log like indicating the exact problem:
-    # Checking installed `wasm-bindgen` version == expected version: 0.2.105 == 0.2.106
-    # 
-    # wasm-pack needs a writeable $HOME
-    # https://github.com/ipetkov/crane/issues/362
-    HOME=$(mktemp -d) wasm-pack build ./. -d ./pkg
-  '';
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r pkg/* $out/
-    ls $out/
-  '';
-}
diff --git a/packages/frontend/package.json b/packages/frontend/package.json
index fe28573501..e25adfa197 100644
--- a/packages/frontend/package.json
+++ b/packages/frontend/package.json
@@ -5,8 +5,8 @@
     "license": "MIT",
     "type": "module",
     "scripts": {
-        "build:doc-types": "pnpm --prefix ../document-methods run build:wasm",
-        "build:wasm": "pnpm --prefix ../catlog-wasm run build:browser",
+        "build:doc-types": "../../build.py document-types-wasm",
+        "build:wasm": "../../build.py catlog-wasm-browser",
         "build:bindings": "cargo run -p backend -- generate-bindings",
         "build:tcm": "tcm -p 'src/**/*.module.css' . && pnpm --prefix ../ui-components run build:tcm",
         "build:deps": "pnpm run build:doc-types && pnpm run build:wasm && pnpm run build:bindings && pnpm run build:tcm",

From 75f8a255ef298306be722b852794c57fa78af654 Mon Sep 17 00:00:00 2001
From: Kaspar Bumke <git@kaspar.systems>
Date: Tue, 15 Sep 2026 15:17:20 +0100
Subject: [PATCH 2/3] WIP: nixify affected CI jobs

---
 .github/workflows/build.yml | 73 +++++++++++++++++--------------------
 .github/workflows/ci.yml    | 30 +++++++--------
 flake.nix                   | 23 ++++++++++++
 3 files changed, 70 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 56fbc56fff..5a1cc3e018 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -92,38 +92,36 @@ jobs:
             packages/frontend/dist
           key: frontend-build-${{ steps.cache-key.outputs.git-hash }}-${{ github.event_name == 'release' && 'production' || 'staging' }}
 
-      - name: Setup pnpm
-        if: github.event_name == 'release' || steps.cache-frontend-build.outputs.cache-hit != 'true'
-        uses: pnpm/action-setup@v6
-
-      - name: Setup NodeJS
-        if: github.event_name == 'release' || steps.cache-frontend-build.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: "pnpm"
+      - name: Install Nix
+        uses: cachix/install-nix-action@v25
 
-      - name: Install Rust toolchain from file
-        if: github.event_name == 'release' || steps.cache-frontend-build.outputs.cache-hit != 'true'
-        uses: actions-rust-lang/setup-rust-toolchain@v2
+      - name: Configure Cachix
+        uses: cachix/cachix-action@v17
         with:
-          build-warnings: ""
+          name: catcolab-jmoggr
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
       - name: Build for Staging
         if: (github.event_name == 'push' || github.event_name == 'pull_request') && steps.cache-frontend-build.outputs.cache-hit != 'true'
         run: |
-          pnpm install
-          pnpm --filter ./packages/frontend run build:deps
-          # Uses env from packages/frontend/.env.staging
-          pnpm --filter ./packages/frontend run build:staging
+          nix develop .#frontend-build --command bash -c '
+            set -euo pipefail
+            pnpm install
+            pnpm --filter ./packages/frontend run build:deps
+            # Uses env from packages/frontend/.env.staging
+            pnpm --filter ./packages/frontend run build:staging
+          '
 
       - name: Build for Production
         if: github.event_name == 'release'
         run: |
-          pnpm install
-          pnpm --filter ./packages/frontend run build:deps
-          # Uses env from packages/frontend/.env.production
-          pnpm --filter ./packages/frontend run build
+          nix develop .#frontend-build --command bash -c '
+            set -euo pipefail
+            pnpm install
+            pnpm --filter ./packages/frontend run build:deps
+            # Uses env from packages/frontend/.env.production
+            pnpm --filter ./packages/frontend run build
+          '
 
       - name: Report cache status
         run: |
@@ -151,7 +149,7 @@ jobs:
       - name: Build frontend docs
         if: steps.cache-frontend-docs.outputs.cache-hit != 'true'
         run: |
-          pnpm --filter ./packages/frontend run doc
+          nix develop .#frontend-build --command pnpm --filter ./packages/frontend run doc
 
       - name: Report frontend docs cache status
         run: |
@@ -343,29 +341,24 @@ jobs:
           path: packages/gaios/dist
           key: gaios-build-${{ steps.cache-key.outputs.git-hash }}
 
-      - name: Setup pnpm
-        if: steps.cache-gaios-build.outputs.cache-hit != 'true'
-        uses: pnpm/action-setup@v6
-
-      - name: Setup NodeJS
-        if: steps.cache-gaios-build.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: "pnpm"
+      - name: Install Nix
+        uses: cachix/install-nix-action@v25
 
-      - name: Install Rust toolchain from file
-        if: steps.cache-gaios-build.outputs.cache-hit != 'true'
-        uses: actions-rust-lang/setup-rust-toolchain@v2
+      - name: Configure Cachix
+        uses: cachix/cachix-action@v17
         with:
-          build-warnings: ""
+          name: catcolab-jmoggr
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
       - name: Build gaios plugin
         if: steps.cache-gaios-build.outputs.cache-hit != 'true'
         run: |
-          pnpm install
-          pnpm --filter ./packages/gaios run build-deps
-          pnpm --filter ./packages/gaios run build
+          nix develop .#frontend-build --command bash -c '
+            set -euo pipefail
+            pnpm install
+            pnpm --filter ./packages/gaios run build-deps
+            pnpm --filter ./packages/gaios run build
+          '
 
       - name: Report cache status
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2998f21e68..27c1da2b0f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -92,36 +92,34 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+      - name: Install Nix
+        uses: cachix/install-nix-action@v25
 
-      - name: Setup NodeJS
-        uses: actions/setup-node@v7
+      - name: Configure Cachix
+        uses: cachix/cachix-action@v17
         with:
-          node-version: 24
-          cache: "pnpm"
+          name: catcolab-jmoggr
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
       - name: Install NodeJS dependencies
         run: |
-          pnpm install
-
-      - name: Install Rust toolchain from file
-        uses: actions-rust-lang/setup-rust-toolchain@v2
-        with:
-          build-warnings: ""
+          nix develop .#frontend-build --command pnpm install
 
       - name: Format/linting/import sorting
         run: |
-          pnpm --filter "./packages/*" run build:deps
-          pnpm --filter "./packages/*" run ci
+          nix develop .#frontend-build --command bash -c '
+            set -euo pipefail
+            pnpm --filter "./packages/*" run build:deps
+            pnpm --filter "./packages/*" run ci
+          '
 
       - name: Typescript documents package tests
         run: |
-          pnpm --filter catcolab-documents test
+          nix develop .#frontend-build --command pnpm --filter catcolab-documents test
 
       - name: Typescript logic package tests
         run: |
-          pnpm --filter catcolab-logics test
+          nix develop .#frontend-build --command pnpm --filter catcolab-logics test
 
   build_nixos_system:
     name: build NixOS system
diff --git a/flake.nix b/flake.nix
index ce4d0dea25..1afa69d7bf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -150,6 +150,28 @@
           PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";
         };
 
+      frontendBuildShellForSystem =
+        system:
+        let
+          pkgs = nixpkgsFor system;
+        in
+        pkgs.mkShell {
+          name = "catcolab-frontend-build";
+
+          packages = [
+            pkgs.binaryen
+            pkgs.lld
+            pkgs.nodejs_24
+            pkgs.openssl
+            pkgs.pkg-config
+            pkgs.pnpm
+            (pkgs.python3.withPackages (ps: [ ps.ninja ]))
+            (rustToolchainFor system)
+            pkgs.wasm-bindgen-cli
+            pkgs.wasm-pack
+          ];
+        };
+
       # Generate devShells for each system
       devShellForSystem =
         system:
@@ -254,6 +276,7 @@
           name = system;
           value = {
             default = devShellForSystem system;
+            frontend-build = frontendBuildShellForSystem system;
             ui-components-tests = uiComponentsTestsShellForSystem system;
           };
         }) devShellSystems

From e07f4b1d78228d29562093d06f9d3aa77e6921bb Mon Sep 17 00:00:00 2001
From: Kaspar Bumke <git@kaspar.systems>
Date: Wed, 16 Sep 2026 12:42:53 +0100
Subject: [PATCH 3/3] WIP

---
 .../actions/prepare-frontend-deps/action.yml  |  26 +++++
 .github/workflows/build.yml                   | 107 ++++++++++++------
 .github/workflows/ci.yml                      |   9 +-
 flake.nix                                     |   8 --
 4 files changed, 104 insertions(+), 46 deletions(-)
 create mode 100644 .github/actions/prepare-frontend-deps/action.yml

diff --git a/.github/actions/prepare-frontend-deps/action.yml b/.github/actions/prepare-frontend-deps/action.yml
new file mode 100644
index 0000000000..0721297f80
--- /dev/null
+++ b/.github/actions/prepare-frontend-deps/action.yml
@@ -0,0 +1,26 @@
+name: Prepare frontend dependencies
+description: Build and stage generated dependencies needed by frontend packages
+
+runs:
+  using: composite
+  steps:
+    - name: Build generated dependencies
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        document_types=$(nix build .#document-types-wasm --no-link --print-out-paths)
+        catlog_wasm=$(nix build .#catlog-wasm-browser --no-link --print-out-paths)
+        api=$(nix build .#catcolabApi --no-link --print-out-paths)
+
+        rm -rf packages/document-types/pkg
+        mkdir -p packages/document-types/pkg
+        cp -R "$document_types"/. packages/document-types/pkg/
+
+        rm -rf packages/catlog-wasm/dist/pkg-browser
+        mkdir -p packages/catlog-wasm/dist/pkg-browser
+        cp -R "$catlog_wasm"/. packages/catlog-wasm/dist/pkg-browser/
+
+        rm -rf packages/backend/pkg/src
+        mkdir -p packages/backend/pkg/src
+        cp -R "$api"/src/. packages/backend/pkg/src/
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5a1cc3e018..63cd4f108b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -78,7 +78,7 @@ jobs:
         id: cache-key
         run: |
           # Get git hash of the most recent commit affecting frontend or any of its dependencies
-          hash=$(git log -1 --format="%H" -- packages/frontend packages/backend/pkg packages/catlog packages/catlog-wasm packages/document-types packages/document-methods packages/ui-components Cargo.toml Cargo.lock)
+          hash=$(git log -1 --format="%H" -- .github/actions/prepare-frontend-deps .npmrc patches pnpm-lock.yaml pnpm-workspace.yaml build.py build-targets.json flake.nix flake.lock infrastructure/catcolab-api.nix infrastructure/ninja-target.nix packages/backend packages/catlog packages/catlog-wasm packages/document-methods packages/document-types packages/documents packages/frontend packages/logics packages/migrator packages/ui-components tools/oxlint-plugin-catcolab tools/vite-plugin-monorepo-dedupe Cargo.toml Cargo.lock rust-toolchain.toml)
           echo "git-hash=${hash}" >> $GITHUB_OUTPUT
           echo "Frontend git hash: ${git_hash}"
 
@@ -93,35 +93,39 @@ jobs:
           key: frontend-build-${{ steps.cache-key.outputs.git-hash }}-${{ github.event_name == 'release' && 'production' || 'staging' }}
 
       - name: Install Nix
+        if: github.event_name == 'release' || steps.cache-frontend-build.outputs.cache-hit != 'true'
         uses: cachix/install-nix-action@v25
 
       - name: Configure Cachix
+        if: github.event_name == 'release' || steps.cache-frontend-build.outputs.cache-hit != 'true'
         uses: cachix/cachix-action@v17
         with:
           name: catcolab-jmoggr
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
+      - name: Install NodeJS dependencies
+        if: github.event_name == 'release' || steps.cache-frontend-build.outputs.cache-hit != 'true'
+        run: nix develop .#frontend-build --command pnpm install
+
+      - name: Prepare frontend dependencies
+        if: github.event_name == 'release' || steps.cache-frontend-build.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-frontend-deps
+
+      - name: Generate CSS module declarations
+        if: github.event_name == 'release' || steps.cache-frontend-build.outputs.cache-hit != 'true'
+        run: nix develop .#frontend-build --command pnpm --filter ./packages/frontend run build:tcm
+
       - name: Build for Staging
         if: (github.event_name == 'push' || github.event_name == 'pull_request') && steps.cache-frontend-build.outputs.cache-hit != 'true'
         run: |
-          nix develop .#frontend-build --command bash -c '
-            set -euo pipefail
-            pnpm install
-            pnpm --filter ./packages/frontend run build:deps
-            # Uses env from packages/frontend/.env.staging
-            pnpm --filter ./packages/frontend run build:staging
-          '
+          # Uses env from packages/frontend/.env.staging
+          nix develop .#frontend-build --command pnpm --filter ./packages/frontend run build:staging
 
       - name: Build for Production
         if: github.event_name == 'release'
         run: |
-          nix develop .#frontend-build --command bash -c '
-            set -euo pipefail
-            pnpm install
-            pnpm --filter ./packages/frontend run build:deps
-            # Uses env from packages/frontend/.env.production
-            pnpm --filter ./packages/frontend run build
-          '
+          # Uses env from packages/frontend/.env.production
+          nix develop .#frontend-build --command pnpm --filter ./packages/frontend run build
 
       - name: Report cache status
         run: |
@@ -139,6 +143,21 @@ jobs:
           name: app
           path: packages/frontend/dist
 
+  build_frontend_docs:
+    name: Build frontend docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Compute cache key
+        id: cache-key
+        run: |
+          hash=$(git log -1 --format="%H" -- .github/actions/prepare-frontend-deps .npmrc patches pnpm-lock.yaml pnpm-workspace.yaml build.py build-targets.json flake.nix flake.lock infrastructure/catcolab-api.nix infrastructure/ninja-target.nix packages/backend packages/catlog packages/catlog-wasm packages/document-methods packages/document-types packages/documents packages/frontend packages/logics packages/migrator packages/ui-components tools/oxlint-plugin-catcolab tools/vite-plugin-monorepo-dedupe Cargo.toml Cargo.lock rust-toolchain.toml)
+          echo "git-hash=${hash}" >> "$GITHUB_OUTPUT"
+
       - name: Cache frontend docs build
         id: cache-frontend-docs
         uses: actions/cache@v6
@@ -146,18 +165,32 @@ jobs:
           path: packages/frontend/docs
           key: frontend-docs-${{ steps.cache-key.outputs.git-hash }}
 
-      - name: Build frontend docs
+      - name: Install Nix
         if: steps.cache-frontend-docs.outputs.cache-hit != 'true'
-        run: |
-          nix develop .#frontend-build --command pnpm --filter ./packages/frontend run doc
+        uses: cachix/install-nix-action@v25
 
-      - name: Report frontend docs cache status
-        run: |
-          if [ "${{ steps.cache-frontend-docs.outputs.cache-hit }}" = "true" ]; then
-            echo "✅ Frontend docs restored from cache"
-          else
-            echo "🔨 Frontend docs built and cached"
-          fi
+      - name: Configure Cachix
+        if: steps.cache-frontend-docs.outputs.cache-hit != 'true'
+        uses: cachix/cachix-action@v17
+        with:
+          name: catcolab-jmoggr
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Install NodeJS dependencies
+        if: steps.cache-frontend-docs.outputs.cache-hit != 'true'
+        run: nix develop .#frontend-build --command pnpm install
+
+      - name: Prepare frontend dependencies
+        if: steps.cache-frontend-docs.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-frontend-deps
+
+      - name: Generate CSS module declarations
+        if: steps.cache-frontend-docs.outputs.cache-hit != 'true'
+        run: nix develop .#frontend-build --command pnpm --filter ./packages/frontend run build:tcm
+
+      - name: Build frontend docs
+        if: steps.cache-frontend-docs.outputs.cache-hit != 'true'
+        run: nix develop .#frontend-build --command pnpm --filter ./packages/frontend run doc
 
       - name: Upload frontend docs
         uses: actions/upload-artifact@v7
@@ -330,7 +363,7 @@ jobs:
         id: cache-key
         run: |
           # Get git hash of the most recent commit affecting gaios or any of its dependencies
-          hash=$(git log -1 --format="%H" -- packages/gaios packages/frontend packages/backend/pkg packages/catlog packages/catlog-wasm packages/document-types packages/document-methods packages/ui-components Cargo.toml Cargo.lock)
+          hash=$(git log -1 --format="%H" -- .github/actions/prepare-frontend-deps .npmrc patches pnpm-lock.yaml pnpm-workspace.yaml build.py build-targets.json flake.nix flake.lock infrastructure/catcolab-api.nix infrastructure/ninja-target.nix packages/backend packages/catlog packages/catlog-wasm packages/document-methods packages/document-types packages/documents packages/frontend packages/gaios packages/logics packages/migrator packages/ui-components tools/oxlint-plugin-catcolab tools/vite-plugin-monorepo-dedupe Cargo.toml Cargo.lock rust-toolchain.toml)
           echo "git-hash=${hash}" >> $GITHUB_OUTPUT
           echo "Gaios git hash: ${hash}"
 
@@ -342,23 +375,31 @@ jobs:
           key: gaios-build-${{ steps.cache-key.outputs.git-hash }}
 
       - name: Install Nix
+        if: steps.cache-gaios-build.outputs.cache-hit != 'true'
         uses: cachix/install-nix-action@v25
 
       - name: Configure Cachix
+        if: steps.cache-gaios-build.outputs.cache-hit != 'true'
         uses: cachix/cachix-action@v17
         with:
           name: catcolab-jmoggr
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
+      - name: Install NodeJS dependencies
+        if: steps.cache-gaios-build.outputs.cache-hit != 'true'
+        run: nix develop .#frontend-build --command pnpm install
+
+      - name: Prepare frontend dependencies
+        if: steps.cache-gaios-build.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-frontend-deps
+
+      - name: Generate CSS module declarations
+        if: steps.cache-gaios-build.outputs.cache-hit != 'true'
+        run: nix develop .#frontend-build --command pnpm --filter ./packages/frontend run build:tcm
+
       - name: Build gaios plugin
         if: steps.cache-gaios-build.outputs.cache-hit != 'true'
-        run: |
-          nix develop .#frontend-build --command bash -c '
-            set -euo pipefail
-            pnpm install
-            pnpm --filter ./packages/gaios run build-deps
-            pnpm --filter ./packages/gaios run build
-          '
+        run: nix develop .#frontend-build --command pnpm --filter ./packages/gaios run build
 
       - name: Report cache status
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27c1da2b0f..a927ffcbf2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,13 +105,12 @@ jobs:
         run: |
           nix develop .#frontend-build --command pnpm install
 
+      - name: Prepare frontend dependencies
+        uses: ./.github/actions/prepare-frontend-deps
+
       - name: Format/linting/import sorting
         run: |
-          nix develop .#frontend-build --command bash -c '
-            set -euo pipefail
-            pnpm --filter "./packages/*" run build:deps
-            pnpm --filter "./packages/*" run ci
-          '
+          nix develop .#frontend-build --command pnpm --filter "./packages/*" run ci
 
       - name: Typescript documents package tests
         run: |
diff --git a/flake.nix b/flake.nix
index 1afa69d7bf..caa58f285c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -159,16 +159,8 @@
           name = "catcolab-frontend-build";
 
           packages = [
-            pkgs.binaryen
-            pkgs.lld
             pkgs.nodejs_24
-            pkgs.openssl
-            pkgs.pkg-config
             pkgs.pnpm
-            (pkgs.python3.withPackages (ps: [ ps.ninja ]))
-            (rustToolchainFor system)
-            pkgs.wasm-bindgen-cli
-            pkgs.wasm-pack
           ];
         };