@unbrained/pm-web 2026.6.14 → 2026.7.11

package/dist/server.js

@@ -1,64 +1,8 @@
-import express from "express";
-import cookieParser from "cookie-parser";
-import path from "node:path";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
 import { initSchema, assertDbConfigured } from "./db.js";
-import { authRouter } from "./routes/auth.js";
-import { projectsRouter } from "./routes/projects.js";
-import { pmRouter } from "./routes/pm.js";
-import { groupsRouter } from "./routes/groups.js";
-import { sharesRouter, sharedWithMeRouter } from "./routes/sharing.js";
-import { githubRouter } from "./routes/github.js";
-import { adminRouter } from "./routes/admin.js";
+import { createApp } from "./app.js";
 import { cleanupStaleClients } from "./services/sse.js";
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PORT = parseInt(process.env.PORT || "4000", 10);
-const PUBLIC_DIR = path.resolve(__dirname, "..", "public");
-const app = express();
-app.use(express.json({ limit: "1mb" }));
-app.use(cookieParser());
-app.get("/sw.js", (_req, res) => {
-    res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
-    res.setHeader("Pragma", "no-cache");
-    res.setHeader("Expires", "0");
-    res.sendFile(path.join(PUBLIC_DIR, "sw.js"));
-});
-app.use(express.static(PUBLIC_DIR, {
-    maxAge: process.env.NODE_ENV === "production" ? "1h" : 0,
-}));
-// Security headers
-app.use((_req, res, next) => {
-    res.setHeader("X-Content-Type-Options", "nosniff");
-    res.setHeader("X-Frame-Options", "SAMEORIGIN");
-    res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
-    next();
-});
-// Health check — includes the running pm-web version so `pm web status` can
-// report it. Version is resolved once at boot from package.json (best-effort).
-const PM_WEB_VERSION = (() => {
-    try {
-        const pkg = JSON.parse(readFileSync(path.resolve(__dirname, "..", "package.json"), "utf8"));
-        return pkg.version ?? "unknown";
-    }
-    catch {
-        return "unknown";
-    }
-})();
-app.get("/healthz", (_req, res) => res.json({ ok: true, version: PM_WEB_VERSION }));
-// API routes
-app.use("/api/auth", authRouter);
-app.use("/api/projects", projectsRouter);
-app.use("/api/projects/:projectId/pm", pmRouter);
-app.use("/api/groups", groupsRouter);
-app.use("/api/projects/:id/shares", sharesRouter);
-app.use("/api/shared", sharedWithMeRouter);
-app.use("/api/projects/:id/github", githubRouter);
-app.use("/api/admin", adminRouter);
-// SPA fallback — serve index.html for all non-API routes
-app.get("/{*splat}", (_req, res) => {
-    res.sendFile(path.join(PUBLIC_DIR, "index.html"));
-});
+const app = createApp();
 // Validate configuration before doing anything that needs the database, so a
 // missing DATABASE_URL fails fast with a clear message instead of hanging on a
 // DNS/connection timeout.

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AAEtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACxC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;AAExB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC9B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;IACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC9B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;IACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CACzD,CAAC,CACH,CAAC;AAEF,mBAAmB;AACnB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC1B,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IACpE,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC5C,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AACL,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;AAEpF,aAAa;AACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AACjC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;AACzC,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;AACjD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AACrC,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;AAClD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAC3C,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;AAClD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AAEnC,yDAAyD;AACzD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACjC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,+EAA+E;AAC/E,0BAA0B;AAC1B,IAAI,CAAC;IACH,kBAAkB,EAAE,CAAC;AACvB,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,oCAAoC;AACpC,UAAU,EAAE;KACT,IAAI,CAAC,GAAG,EAAE;IACT,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mCAAmC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE;QAC9C,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAChC,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,wCAAwC;IACxC,WAAW,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;AAExB,6EAA6E;AAC7E,+EAA+E;AAC/E,0BAA0B;AAC1B,IAAI,CAAC;IACH,kBAAkB,EAAE,CAAC;AACvB,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,oCAAoC;AACpC,UAAU,EAAE;KACT,IAAI,CAAC,GAAG,EAAE;IACT,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mCAAmC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE;QAC9C,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAChC,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,wCAAwC;IACxC,WAAW,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/services/pm-runner.d.ts

@@ -0,0 +1,25 @@
+export declare function getProjectDir(userId: string, slug: string): string;
+export declare function initProject(userId: string, slug: string, prefix: string): void;
+export declare function projectExists(userId: string, slug: string): boolean;
+export interface PmRunOptions {
+    args: string[];
+    userId: string;
+    slug: string;
+    input?: string;
+    jsonOutput?: boolean;
+}
+export interface PmRunResult {
+    stdout: string;
+    stderr: string;
+    ok: boolean;
+    parsed?: unknown;
+}
+export interface EnsureGraphExtensionResult {
+    ok: boolean;
+    installed: boolean;
+    active: boolean;
+    error?: string;
+}
+export declare function ensureGraphExtension(userId: string, slug: string): EnsureGraphExtensionResult;
+export declare function runPm(opts: PmRunOptions): PmRunResult;
+export declare function deleteProjectDir(userId: string, slug: string): void;

package/dist/services/sse.d.ts

@@ -0,0 +1,28 @@
+import type { Response } from "express";
+export interface SSEClient {
+    id: string;
+    projectId: string;
+    userId: string;
+    displayName: string;
+    currentView: string;
+    res: Response;
+    connectedAt: Date;
+}
+export interface PresenceUser {
+    userId: string;
+    displayName: string;
+    currentView: string;
+    connectedAt: string;
+}
+export declare function addSSEClient(client: SSEClient): () => void;
+export declare function broadcastProjectEvent(projectId: string, event: SSEEvent): void;
+export declare function broadcastPresence(projectId: string): void;
+export declare function updateClientView(clientId: string, currentView: string): void;
+export declare function getProjectPresence(projectId: string): PresenceUser[];
+export declare function setupSSEHeaders(res: Response): void;
+export declare function getSSEClientCount(): number;
+export declare function cleanupStaleClients(): void;
+export interface SSEEvent {
+    type: string;
+    data: unknown;
+}

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-web",
-  "version": "2026.6.14",
+  "version": "2026.7.11",
   "description": "Full web UI for pm-cli — browse, create, update, search and manage pm projects in the browser. Self-hosted via Docker or Node.js.",
   "author": "@unbraind",
   "entry": "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-web",
-  "version": "2026.6.14",
+  "version": "2026.7.11",
   "description": "Full web UI for pm-cli — browse, create, update, search and manage pm projects in the browser. Self-hosted via Docker or Node.js.",
   "type": "module",
   "files": [
@@ -46,15 +46,15 @@
     "uuid": "^14.0.0"
   },
   "devDependencies": {
-    "@types/bcryptjs": "^2.4.6",
+    "@types/bcryptjs": "^3.0.0",
     "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.6",
     "@types/jsonwebtoken": "^9.0.9",
     "@types/node": "^25.9.2",
     "@types/pg": "^8.11.11",
     "@types/uuid": "^10.0.0",
-    "@unbrained/pm-cli": "^2026.6.9",
-    "pm-changelog": "^2026.6.13",
+    "@unbrained/pm-cli": "^2026.7.5",
+    "pm-changelog": "^2026.6.30",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3"
   },
@@ -69,7 +69,7 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.18.0"
   },
   "author": "@unbraind",
   "license": "MIT",

package/public/cookie-consent.css

@@ -0,0 +1,50 @@
+/* Cookie consent banner — shared by the SPA (index.html) and legal pages.
+   Legal pages get these rules via legal-common.css; keep both in sync. */
+
+.cookie-consent {
+  position: fixed;
+  left: 24px;
+  right: 24px;
+  bottom: 24px;
+  z-index: 3000;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 18px;
+  max-width: 1040px;
+  margin: 0 auto;
+  padding: 16px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: rgba(15, 23, 42, 0.96);
+  box-shadow: 0 12px 48px rgba(0,0,0,0.35);
+}
+
+.cookie-consent[hidden] {
+  display: none;
+}
+
+.cookie-consent-text {
+  display: grid;
+  gap: 4px;
+  color: var(--text-secondary);
+}
+
+.cookie-consent-text strong {
+  color: var(--text-primary);
+}
+
+.cookie-consent-actions {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+
+.cookie-consent {
+    left: 12px;
+    right: 12px;
+    bottom: 12px;
+    align-items: stretch;
+    flex-direction: column;
+  }

package/public/cookie-consent.js

@@ -0,0 +1,43 @@
+(function () {
+  var storageKey = "pm_cookie_preferences_v1";
+  var banner = document.getElementById("cookie-consent");
+  var links = document.querySelectorAll("[data-cookie-settings]");
+
+  function save(choice) {
+    try {
+      localStorage.setItem(storageKey, JSON.stringify({ necessary: true, optional: false, choice: choice, savedAt: new Date().toISOString() }));
+    } catch (_) {
+      /* ignore unavailable storage */
+    }
+  }
+
+  function hasChoice() {
+    try {
+      return Boolean(localStorage.getItem(storageKey));
+    } catch (_) {
+      return false;
+    }
+  }
+
+  function show(event) {
+    if (event) event.preventDefault();
+    if (banner) banner.hidden = false;
+  }
+
+  function hide() {
+    if (banner) banner.hidden = true;
+  }
+
+  links.forEach(function (link) {
+    link.addEventListener("click", show);
+  });
+
+  document.querySelectorAll("[data-cookie-accept], [data-cookie-decline]").forEach(function (button) {
+    button.addEventListener("click", function () {
+      save(button.hasAttribute("data-cookie-accept") ? "acknowledged" : "necessary");
+      hide();
+    });
+  });
+
+  if (!hasChoice()) show();
+})();

package/public/cookie-settings.html

@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html lang="de" data-theme="auto">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="description" content="Cookie- und Speicherinformationen fuer pm-web.">
+<title>Cookie Settings - pm-web</title>
+<link rel="stylesheet" href="/styles.css?v=20">
+<link rel="stylesheet" href="/legal-common.css?v=1">
+</head>
+<body class="legal-shell">
+<nav class="legal-nav"><a class="legal-brand" href="/">pm-web</a><div class="legal-links"><a href="/legal-notice">Legal Notice</a><a href="/privacy-policy">Privacy Policy</a><a href="/terms">Terms</a></div></nav>
+<main class="legal-main">
+  <p class="legal-kicker">Legal</p>
+  <h1>Cookie Settings</h1>
+  <p class="legal-updated">Stand: 26. Juni 2026</p>
+  <section class="legal-section"><h2>Aktuelle Einstellung</h2><p>pm-web verwendet keine optionalen Tracking- oder Marketing-Cookies. Technisch notwendige Speicherung kann fuer Anmeldung, Sicherheit, Darstellung und Consent-Status erforderlich sein.</p><button type="button" class="btn btn-primary" data-cookie-settings>Open Cookie Settings</button></section>
+  <section class="legal-section"><h2>Notwendige Speicherung</h2><p><code>pm_token</code> speichert die angemeldete Sitzung als HTTP-only Cookie. Lokale Einstellungen wie Theme, PWA-Installationshinweise und Cookie-Status werden im Browser gespeichert.</p></section>
+  <section class="legal-section"><h2>Optionale Cookies</h2><p>Derzeit werden keine optionalen Cookies gesetzt. Sollten Analyse- oder Marketingdienste spaeter aktiviert werden, werden sie erst nach ausdruecklicher Einwilligung geladen.</p></section>
+</main>
+<div class="cookie-consent" id="cookie-consent" hidden><div class="cookie-consent-text"><strong>Cookie Settings</strong><span>We only use technically necessary storage for sign-in, security, and preferences. No optional tracking cookies.</span></div><div class="cookie-consent-actions"><a href="/privacy-policy">Privacy Policy</a><button type="button" class="btn btn-secondary btn-sm" data-cookie-decline>Necessary only</button><button type="button" class="btn btn-primary btn-sm" data-cookie-accept>Got it</button></div></div>
+<script src="/cookie-consent.js?v=1"></script>
+</body>
+</html>

package/public/index.html

@@ -13,10 +13,8 @@
 <link rel="manifest" href="/manifest.json">
 <link rel="apple-touch-icon" href="/icons/icon-192.png">
 <link rel="apple-touch-icon" sizes="512x512" href="/icons/icon-512.png">
-<link rel="preconnect" href="https://fonts.googleapis.com">
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
-<link rel="stylesheet" href="/styles.css?v=19">
+<link rel="stylesheet" href="/styles.css?v=20">
+<link rel="stylesheet" href="/cookie-consent.css?v=1">
 </head>
 <body>
 <a href="#main-content" class="skip-link">Skip to main content</a>
@@ -262,5 +260,7 @@
 </nav>
 
 <script type="module" src="/src/app.js?v=9"></script>
+<div class="cookie-consent" id="cookie-consent" hidden><div class="cookie-consent-text"><strong>Cookie Settings</strong><span>We only use technically necessary storage for sign-in, security, and preferences. No optional tracking cookies.</span></div><div class="cookie-consent-actions"><a href="/privacy-policy">Privacy Policy</a><button type="button" class="btn btn-secondary btn-sm" data-cookie-decline>Necessary only</button><button type="button" class="btn btn-primary btn-sm" data-cookie-accept>Got it</button></div></div>
+<script src="/cookie-consent.js?v=1"></script>
 </body>
 </html>

package/public/legal-common.css

@@ -0,0 +1,150 @@
+.legal-shell {
+  min-height: 100vh;
+  background: var(--bg-base);
+  color: var(--text-primary);
+}
+
+.legal-nav {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  padding: 18px 28px;
+  border-bottom: 1px solid var(--border);
+  background: var(--bg-sidebar);
+}
+
+.legal-brand {
+  color: var(--accent);
+  font-family: 'SFMono-Regular', Monaco, 'Cascadia Code', 'Liberation Mono', monospace;
+  font-size: 18px;
+  font-weight: 600;
+  text-decoration: none;
+}
+
+.legal-links {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  flex-wrap: wrap;
+}
+
+.legal-links a {
+  color: var(--text-secondary);
+  text-decoration: none;
+}
+
+.legal-links a:hover {
+  color: var(--accent);
+}
+
+.legal-main {
+  max-width: 880px;
+  margin: 0 auto;
+  padding: 64px 24px 96px;
+}
+
+.legal-kicker,
+.legal-updated {
+  color: var(--text-secondary);
+  font-family: 'SFMono-Regular', Monaco, 'Cascadia Code', 'Liberation Mono', monospace;
+  font-size: 12px;
+}
+
+.legal-kicker {
+  color: var(--accent);
+  margin-bottom: 10px;
+  text-transform: uppercase;
+}
+
+.legal-main h1 {
+  font-size: clamp(32px, 7vw, 56px);
+  line-height: 1.05;
+}
+
+.legal-updated {
+  margin: 14px 0 36px;
+}
+
+.legal-section {
+  border-top: 1px solid var(--border);
+  padding: 28px 0;
+}
+
+.legal-section h2 {
+  font-size: 18px;
+  margin-bottom: 12px;
+}
+
+.legal-section p,
+.legal-section li {
+  color: var(--text-secondary);
+  margin-bottom: 12px;
+}
+
+.legal-section code {
+  color: var(--accent);
+}
+
+.cookie-consent {
+  position: fixed;
+  left: 24px;
+  right: 24px;
+  bottom: 24px;
+  z-index: 3000;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 18px;
+  max-width: 1040px;
+  margin: 0 auto;
+  padding: 16px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: rgba(15, 23, 42, 0.96);
+  box-shadow: 0 12px 48px rgba(0,0,0,0.35);
+}
+
+.cookie-consent[hidden] {
+  display: none;
+}
+
+.cookie-consent-text {
+  display: grid;
+  gap: 4px;
+  color: var(--text-secondary);
+}
+
+.cookie-consent-text strong {
+  color: var(--text-primary);
+}
+
+.cookie-consent-actions {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+
+.legal-footer {
+  display: flex;
+  gap: 12px;
+  flex-wrap: wrap;
+  padding-top: 24px;
+  border-top: 1px solid var(--border);
+}
+
+@media (max-width: 720px) {
+  .legal-nav {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
+  .cookie-consent {
+    left: 12px;
+    right: 12px;
+    bottom: 12px;
+    align-items: stretch;
+    flex-direction: column;
+  }
+}

package/public/legal-notice.html

@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html lang="de" data-theme="auto">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="description" content="Legal notice and provider information for pm-web.">
+<title>Legal Notice - pm-web</title>
+<link rel="stylesheet" href="/styles.css?v=20">
+<link rel="stylesheet" href="/legal-common.css?v=1">
+</head>
+<body class="legal-shell">
+<nav class="legal-nav"><a class="legal-brand" href="/">pm-web</a><div class="legal-links"><a href="/privacy-policy">Privacy Policy</a><a href="/terms">Terms</a><a href="/cookie-settings">Cookies</a><a href="https://pm-cli.unbrained.dev/legal-notice">pm-cli Legal Notice</a></div></nav>
+<main class="legal-main">
+  <p class="legal-kicker">Legal</p>
+  <h1>Legal Notice</h1>
+  <p class="legal-updated">Stand: 26. Juni 2026</p>
+  <section class="legal-section">
+    <h2>Angaben gemaess ECG und MedienG</h2>
+    <p><strong>Stefan Preu</strong><br>Steinbruch 5<br>3250 Wieselburg<br>Oesterreich</p>
+    <p>E-Mail: <a href="mailto:stefan@preu.at">stefan@preu.at</a></p>
+    <p>Verantwortlich fuer den Inhalt dieser Website: Stefan Preu.</p>
+  </section>
+  <section class="legal-section">
+    <h2>Online-Angebot</h2>
+    <p>Dieses Impressum gilt fuer <a href="https://pm-web.unbrained.dev/">pm-web.unbrained.dev</a>. pm-web ist eine webbasierte Oberflaeche fuer pm-cli.</p>
+  </section>
+  <section class="legal-section">
+    <h2>Haftung und externe Links</h2>
+    <p>Die Inhalte werden sorgfaeltig gepflegt. Fuer externe Links wird keine Verantwortung fuer fremde Inhalte uebernommen; fuer diese sind ausschliesslich deren Betreiber verantwortlich.</p>
+  </section>
+</main>
+<div class="cookie-consent" id="cookie-consent" hidden><div class="cookie-consent-text"><strong>Cookie Settings</strong><span>We only use technically necessary storage for sign-in, security, and preferences. No optional tracking cookies.</span></div><div class="cookie-consent-actions"><a href="/privacy-policy">Privacy Policy</a><button type="button" class="btn btn-secondary btn-sm" data-cookie-decline>Necessary only</button><button type="button" class="btn btn-primary btn-sm" data-cookie-accept>Got it</button></div></div>
+<script src="/cookie-consent.js?v=1"></script>
+</body>
+</html>

package/public/privacy-policy.html

@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html lang="de" data-theme="auto">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="description" content="Privacy policy for pm-web.">
+<title>Privacy Policy - pm-web</title>
+<link rel="stylesheet" href="/styles.css?v=20">
+<link rel="stylesheet" href="/legal-common.css?v=1">
+</head>
+<body class="legal-shell">
+<nav class="legal-nav"><a class="legal-brand" href="/">pm-web</a><div class="legal-links"><a href="/legal-notice">Legal Notice</a><a href="/terms">Terms</a><a href="/cookie-settings">Cookies</a><a href="https://pm-cli.unbrained.dev/privacy-policy">pm-cli Privacy Policy</a></div></nav>
+<main class="legal-main">
+  <p class="legal-kicker">Legal</p>
+  <h1>Privacy Policy</h1>
+  <p class="legal-updated">Stand: 26. Juni 2026</p>
+  <section class="legal-section">
+    <h2>Verantwortlicher</h2>
+    <p>Stefan Preu, Steinbruch 5, 3250 Wieselburg, Oesterreich, <a href="mailto:stefan@preu.at">stefan@preu.at</a>.</p>
+  </section>
+  <section class="legal-section">
+    <h2>Verarbeitete Daten</h2>
+    <p>Beim Besuch werden technisch notwendige Serverdaten verarbeitet, insbesondere IP-Adresse, Zeitpunkt, angefragte URL, HTTP-Status, User-Agent und Referrer.</p>
+    <p>Bei Registrierung und Nutzung verarbeitet pm-web Konto- und Nutzungsdaten: E-Mail-Adresse, Anzeigename, Passwort-Hash, Projekt- und Gruppendaten, Freigaben, optionale GitHub-Verknuepfungsdaten sowie technische Sitzungsdaten.</p>
+  </section>
+  <section class="legal-section">
+    <h2>Zwecke und Rechtsgrundlagen</h2>
+    <p>Die Verarbeitung erfolgt zur Bereitstellung der Anwendung, Authentifizierung, Projektverwaltung, Zusammenarbeit, Sicherheit, Missbrauchsschutz und Fehleranalyse. Rechtsgrundlagen sind Art. 6 Abs. 1 lit. b, lit. f und, soweit einschlaegig, lit. c DSGVO.</p>
+  </section>
+  <section class="legal-section">
+    <h2>Cookies und lokale Speicherung</h2>
+    <p>pm-web verwendet ein technisch notwendiges HTTP-only Authentifizierungs-Cookie (<code>pm_token</code>). Lokale Browser-Speicherung kann fuer Theme, Installationshinweise und Cookie-Status genutzt werden. Es werden keine optionalen Tracking- oder Marketing-Cookies gesetzt.</p>
+  </section>
+  <section class="legal-section">
+    <h2>Drittanbieter</h2>
+    <p>Schriftarten werden lokal beziehungsweise ueber Systemschriftarten dargestellt. GitHub-Funktionen werden nur genutzt, wenn Nutzer diese aktiv verwenden oder entsprechende Links oeffnen.</p>
+  </section>
+  <section class="legal-section">
+    <h2>Speicherdauer</h2>
+    <p>Konto- und Projektdaten bleiben gespeichert, bis sie geloescht werden oder gesetzliche Pflichten entgegenstehen. Server- und Sicherheitslogs werden nur so lange gespeichert, wie sie fuer Betrieb, Sicherheit und Fehleranalyse erforderlich sind.</p>
+  </section>
+  <section class="legal-section">
+    <h2>Betroffenenrechte</h2>
+    <p>Betroffene Personen haben Rechte auf Auskunft, Berichtigung, Loeschung, Einschraenkung, Datenuebertragbarkeit, Widerspruch und Beschwerde bei einer Aufsichtsbehoerde. Anfragen bitte an <a href="mailto:stefan@preu.at">stefan@preu.at</a>.</p>
+    <p>Zustaendige oesterreichische Aufsichtsbehoerde: Datenschutzbehoerde, Barichgasse 40-42, 1030 Wien, <a href="https://www.dsb.gv.at/" target="_blank" rel="noopener">dsb.gv.at</a>.</p>
+  </section>
+</main>
+<div class="cookie-consent" id="cookie-consent" hidden><div class="cookie-consent-text"><strong>Cookie Settings</strong><span>We only use technically necessary storage for sign-in, security, and preferences. No optional tracking cookies.</span></div><div class="cookie-consent-actions"><a href="/privacy-policy">Privacy Policy</a><button type="button" class="btn btn-secondary btn-sm" data-cookie-decline>Necessary only</button><button type="button" class="btn btn-primary btn-sm" data-cookie-accept>Got it</button></div></div>
+<script src="/cookie-consent.js?v=1"></script>
+</body>
+</html>