@unbrained/pm-web 2026.7.10 → 2026.7.13

package/dist/services/sse.js

@@ -1,23 +1,81 @@
-const clients = [];
+// Clients are indexed two ways so that per-event work scales with the number of
+// clients on the *affected project*, not the total number of connected clients.
+// This is what lets a single project sustain many concurrent viewers without an
+// O(total-clients) scan on every event, presence update, and disconnect.
+const byId = new Map();
+const byProject = new Map();
+const presenceTimers = new Map();
+let projectEventPublisher = null;
+export function configureProjectEventPublisher(publisher) {
+    projectEventPublisher = publisher;
+}
+function removeClient(client) {
+    if (byId.get(client.id) === client)
+        byId.delete(client.id);
+    const set = byProject.get(client.projectId);
+    if (set) {
+        set.delete(client);
+        if (set.size === 0)
+            byProject.delete(client.projectId);
+    }
+}
+function presenceUsers(set) {
+    if (!set || set.size === 0)
+        return [];
+    // Deduplicate by userId — keep most recent connection per user
+    const byUser = new Map();
+    for (const c of set) {
+        const existing = byUser.get(c.userId);
+        if (!existing || c.connectedAt > existing.connectedAt)
+            byUser.set(c.userId, c);
+    }
+    return [...byUser.values()].map((c) => ({
+        userId: c.userId,
+        displayName: c.displayName,
+        currentView: c.currentView,
+        connectedAt: c.connectedAt.toISOString(),
+    }));
+}
+function schedulePresence(projectId) {
+    const active = presenceTimers.get(projectId);
+    if (active)
+        clearTimeout(active);
+    presenceTimers.set(projectId, setTimeout(() => {
+        presenceTimers.delete(projectId);
+        broadcastPresence(projectId);
+    }, 75));
+}
 export function addSSEClient(client) {
-    clients.push(client);
+    byId.set(client.id, client);
+    let set = byProject.get(client.projectId);
+    if (!set) {
+        set = new Set();
+        byProject.set(client.projectId, set);
+    }
+    set.add(client);
     // Send initial connection confirmation
     client.res.write(`event: connected\ndata: ${JSON.stringify({ ok: true, clientId: client.id })}\n\n`);
     // Broadcast presence update to all project viewers
-    broadcastPresence(client.projectId);
+    schedulePresence(client.projectId);
     // Return unsubscribe function
     return () => {
-        const idx = clients.indexOf(client);
-        if (idx !== -1)
-            clients.splice(idx, 1);
+        removeClient(client);
         // Broadcast updated presence after disconnect
-        broadcastPresence(client.projectId);
+        schedulePresence(client.projectId);
     };
 }
 export function broadcastProjectEvent(projectId, event) {
+    deliverProjectEvent(projectId, event);
+    if (projectEventPublisher) {
+        void projectEventPublisher(projectId, event).catch(() => undefined);
+    }
+}
+export function deliverProjectEvent(projectId, event) {
+    const set = byProject.get(projectId);
+    if (!set || set.size === 0)
+        return;
     const payload = `event: ${event.type}\ndata: ${JSON.stringify(event.data)}\n\n`;
-    const recipients = clients.filter((c) => c.projectId === projectId);
-    for (const client of recipients) {
+    for (const client of set) {
         try {
             client.res.write(payload);
         }
@@ -27,23 +85,12 @@ export function broadcastProjectEvent(projectId, event) {
     }
 }
 export function broadcastPresence(projectId) {
-    const projectClients = clients.filter((c) => c.projectId === projectId);
-    // Deduplicate by userId — keep most recent connection per user
-    const byUser = new Map();
-    for (const c of projectClients) {
-        const existing = byUser.get(c.userId);
-        if (!existing || c.connectedAt > existing.connectedAt) {
-            byUser.set(c.userId, c);
-        }
-    }
-    const users = [...byUser.values()].map((c) => ({
-        userId: c.userId,
-        displayName: c.displayName,
-        currentView: c.currentView,
-        connectedAt: c.connectedAt.toISOString(),
-    }));
+    const set = byProject.get(projectId);
+    if (!set || set.size === 0)
+        return;
+    const users = presenceUsers(set);
     const payload = `event: presence\ndata: ${JSON.stringify({ users })}\n\n`;
-    for (const client of projectClients) {
+    for (const client of set) {
         try {
             client.res.write(payload);
         }
@@ -52,28 +99,17 @@ export function broadcastPresence(projectId) {
         }
     }
 }
-export function updateClientView(clientId, currentView) {
-    const client = clients.find((c) => c.id === clientId);
-    if (client) {
+export function updateClientView(clientId, userId, projectId, currentView) {
+    const client = byId.get(clientId);
+    if (client && client.userId === userId && client.projectId === projectId) {
         client.currentView = currentView;
-        broadcastPresence(client.projectId);
+        schedulePresence(client.projectId);
+        return true;
     }
+    return false;
 }
 export function getProjectPresence(projectId) {
-    const projectClients = clients.filter((c) => c.projectId === projectId);
-    const byUser = new Map();
-    for (const c of projectClients) {
-        const existing = byUser.get(c.userId);
-        if (!existing || c.connectedAt > existing.connectedAt) {
-            byUser.set(c.userId, c);
-        }
-    }
-    return [...byUser.values()].map((c) => ({
-        userId: c.userId,
-        displayName: c.displayName,
-        currentView: c.currentView,
-        connectedAt: c.connectedAt.toISOString(),
-    }));
+    return presenceUsers(byProject.get(projectId));
 }
 export function setupSSEHeaders(res) {
     res.writeHead(200, {
@@ -84,13 +120,12 @@ export function setupSSEHeaders(res) {
     });
 }
 export function getSSEClientCount() {
-    return clients.length;
+    return byId.size;
 }
 export function cleanupStaleClients() {
     const now = Date.now();
     const staleProjectIds = new Set();
-    for (let i = clients.length - 1; i >= 0; i--) {
-        const client = clients[i];
+    for (const client of [...byId.values()]) {
         // If client connection has been open > 12 hours, close it
         if (now - client.connectedAt.getTime() > 12 * 60 * 60 * 1000) {
             try {
@@ -99,13 +134,13 @@ export function cleanupStaleClients() {
             catch {
                 // Already closed
             }
+            removeClient(client);
             staleProjectIds.add(client.projectId);
-            clients.splice(i, 1);
         }
     }
     // Broadcast updated presence for affected projects
     for (const projectId of staleProjectIds) {
-        broadcastPresence(projectId);
+        schedulePresence(projectId);
     }
 }
 //# sourceMappingURL=sse.js.map

package/dist/services/sse.js.map

@@ -1 +1 @@
-{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../src/services/sse.ts"],"names":[],"mappings":"AAmBA,MAAM,OAAO,GAAgB,EAAE,CAAC;AAEhC,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErB,uCAAuC;IACvC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAErG,mDAAmD;IACnD,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEpC,8BAA8B;IAC9B,OAAO,GAAG,EAAE;QACV,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvC,8CAA8C;QAC9C,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,KAAe;IACtE,MAAM,OAAO,GAAG,UAAU,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACpE,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAExE,+DAA+D;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAmB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;KACzC,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,0BAA0B,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,WAAmB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;QACjC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;KACzC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,mBAAmB;QACnC,eAAe,EAAE,UAAU;QAC3B,UAAU,EAAE,YAAY;QACxB,mBAAmB,EAAE,IAAI,EAAE,0BAA0B;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,0DAA0D;QAC1D,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,mDAAmD;IACnD,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;QACxC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../src/services/sse.ts"],"names":[],"mappings":"AAmBA,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,yEAAyE;AACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;AAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;AACzD,IAAI,qBAAqB,GAAmE,IAAI,CAAC;AAEjG,MAAM,UAAU,8BAA8B,CAC5C,SAAyE;IAEzE,qBAAqB,GAAG,SAAS,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,MAAiB;IACrC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,MAAM;QAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;YAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAA+B;IACpD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,+DAA+D;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;KACzC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5C,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACV,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;QAC3B,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhB,uCAAuC;IACvC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAErG,mDAAmD;IACnD,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEnC,8BAA8B;IAC9B,OAAO,GAAG,EAAE;QACV,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,8CAA8C;QAC9C,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,KAAe;IACtE,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,KAAK,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,KAAe;IACpE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACnC,MAAM,OAAO,GAAG,UAAU,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;IAChF,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACnC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,0BAA0B,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAE,SAAiB,EAAE,WAAmB;IACvG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;QACjC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,mBAAmB;QACnC,eAAe,EAAE,UAAU;QAC3B,UAAU,EAAE,YAAY;QACxB,mBAAmB,EAAE,IAAI,EAAE,0BAA0B;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACxC,0DAA0D;QAC1D,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,YAAY,CAAC,MAAM,CAAC,CAAC;YACrB,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,mDAAmD;IACnD,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;QACxC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-web",
-  "version": "2026.7.10",
+  "version": "2026.7.13",
   "description": "Full web UI for pm-cli — browse, create, update, search and manage pm projects in the browser. Self-hosted via Docker or Node.js.",
   "author": "@unbraind",
   "entry": "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-web",
-  "version": "2026.7.10",
+  "version": "2026.7.13",
   "description": "Full web UI for pm-cli — browse, create, update, search and manage pm projects in the browser. Self-hosted via Docker or Node.js.",
   "type": "module",
   "files": [
@@ -20,11 +20,11 @@
     "typecheck": "npm run typecheck:graph && npm run typecheck:server && npm run typecheck:frontend",
     "typecheck:graph": "cd extensions/pm-graph && npm run typecheck",
     "typecheck:server": "tsc --noEmit",
-    "typecheck:frontend": "cd public && npx tsc --noEmit",
-    "build:frontend": "cd public && npx tsc",
+    "typecheck:frontend": "cd public && tsc --noEmit && tsc -p tsconfig.sw.json --noEmit && tsc -p tsconfig.scripts.json --noEmit",
+    "build:frontend": "cd public && tsc && tsc -p tsconfig.sw.json && tsc -p tsconfig.scripts.json",
     "build:all": "npm run build",
     "check": "npm run typecheck",
-    "audit:prod": "npm audit --omit=dev",
+    "audit:prod": "env -u npm_config_allow_scripts npm audit --omit=dev --ignore-scripts",
     "pack:dry-run": "npm pack --dry-run",
     "changelog": "pm-changelog --pm-root .agents/pm --mode prepend --output CHANGELOG.md --release-version-from-package --since-previous-tag --until-release-tag --item-url-base https://github.com/unbraind/pm-web/blob/main/.agents/pm",
     "changelog:full": "pm-changelog --pm-root .agents/pm --mode replace --output CHANGELOG.md --all-release-tags --release-version-from-package --item-url-base https://github.com/unbraind/pm-web/blob/main/.agents/pm",
@@ -37,26 +37,26 @@
     "prepublishOnly": "npm run release:check"
   },
   "dependencies": {
+    "@unbrained/pm-cli": "^2026.7.12",
     "bcryptjs": "^3.0.3",
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "jsonwebtoken": "^9.0.2",
-    "neo4j-driver": "^6.1.0",
+    "neo4j-driver": "^6.2.0",
+    "openid-client": "6.8.4",
     "pg": "^8.21.0",
     "uuid": "^14.0.0"
   },
   "devDependencies": {
-    "@types/bcryptjs": "^2.4.6",
     "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.6",
     "@types/jsonwebtoken": "^9.0.9",
-    "@types/node": "^25.9.2",
+    "@types/node": "^26.1.1",
     "@types/pg": "^8.11.11",
     "@types/uuid": "^10.0.0",
-    "@unbrained/pm-cli": "^2026.7.5",
-    "pm-changelog": "^2026.6.30",
-    "tsx": "^4.22.4",
-    "typescript": "^6.0.3"
+    "pm-changelog": "^2026.7.12",
+    "tsx": "^4.23.0",
+    "typescript": "^7.0.2"
   },
   "repository": {
     "type": "git",

package/public/cookie-consent.js

@@ -1,43 +1,58 @@
-(function () {
-  var storageKey = "pm_cookie_preferences_v1";
-  var banner = document.getElementById("cookie-consent");
-  var links = document.querySelectorAll("[data-cookie-settings]");
-
-  function save(choice) {
-    try {
-      localStorage.setItem(storageKey, JSON.stringify({ necessary: true, optional: false, choice: choice, savedAt: new Date().toISOString() }));
-    } catch (_) {
-      /* ignore unavailable storage */
+"use strict";
+// ═══════════════════════════════════════════════════════════════
+// COOKIE CONSENT BANNER — pm-web
+//
+// This is the TypeScript source for /cookie-consent.js. It is compiled
+// with the `DOM` lib (see public/tsconfig.scripts.json) and emitted as
+// a classic browser script (no import/export) so it can be loaded via
+// `<script src="/cookie-consent.js">` without a module loader. The IIFE
+// keeps the global scope clean.
+// ═══════════════════════════════════════════════════════════════
+(() => {
+    const STORAGE_KEY = 'pm_cookie_preferences_v1';
+    const banner = document.getElementById('cookie-consent');
+    const links = document.querySelectorAll('[data-cookie-settings]');
+    function save(choice) {
+        const preferences = {
+            necessary: true,
+            optional: false,
+            choice,
+            savedAt: new Date().toISOString(),
+        };
+        try {
+            localStorage.setItem(STORAGE_KEY, JSON.stringify(preferences));
+        }
+        catch {
+            /* ignore unavailable storage */
+        }
     }
-  }
-
-  function hasChoice() {
-    try {
-      return Boolean(localStorage.getItem(storageKey));
-    } catch (_) {
-      return false;
+    function hasChoice() {
+        try {
+            return Boolean(localStorage.getItem(STORAGE_KEY));
+        }
+        catch {
+            return false;
+        }
     }
-  }
-
-  function show(event) {
-    if (event) event.preventDefault();
-    if (banner) banner.hidden = false;
-  }
-
-  function hide() {
-    if (banner) banner.hidden = true;
-  }
-
-  links.forEach(function (link) {
-    link.addEventListener("click", show);
-  });
-
-  document.querySelectorAll("[data-cookie-accept], [data-cookie-decline]").forEach(function (button) {
-    button.addEventListener("click", function () {
-      save(button.hasAttribute("data-cookie-accept") ? "acknowledged" : "necessary");
-      hide();
+    function show(event) {
+        if (event)
+            event.preventDefault();
+        if (banner)
+            banner.hidden = false;
+    }
+    function hide() {
+        if (banner)
+            banner.hidden = true;
+    }
+    links.forEach((link) => {
+        link.addEventListener('click', show);
+    });
+    document.querySelectorAll('[data-cookie-accept], [data-cookie-decline]').forEach((button) => {
+        button.addEventListener('click', () => {
+            save(button.hasAttribute('data-cookie-accept') ? 'acknowledged' : 'necessary');
+            hide();
+        });
     });
-  });
-
-  if (!hasChoice()) show();
+    if (!hasChoice())
+        show();
 })();

package/public/cookie-settings.html

@@ -1,9 +1,9 @@
 <!DOCTYPE html>
-<html lang="de" data-theme="auto">
+<html lang="en" data-theme="auto" data-package-legal-template>
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<meta name="description" content="Cookie- und Speicherinformationen fuer pm-web.">
+<meta name="description" content="Package template for pm-web browser-storage disclosures.">
 <title>Cookie Settings - pm-web</title>
 <link rel="stylesheet" href="/styles.css?v=20">
 <link rel="stylesheet" href="/legal-common.css?v=1">
@@ -11,12 +11,12 @@
 <body class="legal-shell">
 <nav class="legal-nav"><a class="legal-brand" href="/">pm-web</a><div class="legal-links"><a href="/legal-notice">Legal Notice</a><a href="/privacy-policy">Privacy Policy</a><a href="/terms">Terms</a></div></nav>
 <main class="legal-main">
-  <p class="legal-kicker">Legal</p>
+  <p class="legal-kicker">Operator template — verify the deployed application</p>
   <h1>Cookie Settings</h1>
-  <p class="legal-updated">Stand: 26. Juni 2026</p>
-  <section class="legal-section"><h2>Aktuelle Einstellung</h2><p>pm-web verwendet keine optionalen Tracking- oder Marketing-Cookies. Technisch notwendige Speicherung kann fuer Anmeldung, Sicherheit, Darstellung und Consent-Status erforderlich sein.</p><button type="button" class="btn btn-primary" data-cookie-settings>Open Cookie Settings</button></section>
-  <section class="legal-section"><h2>Notwendige Speicherung</h2><p><code>pm_token</code> speichert die angemeldete Sitzung als HTTP-only Cookie. Lokale Einstellungen wie Theme, PWA-Installationshinweise und Cookie-Status werden im Browser gespeichert.</p></section>
-  <section class="legal-section"><h2>Optionale Cookies</h2><p>Derzeit werden keine optionalen Cookies gesetzt. Sollten Analyse- oder Marketingdienste spaeter aktiviert werden, werden sie erst nach ausdruecklicher Einwilligung geladen.</p></section>
+  <p class="legal-updated">This page describes package capabilities, not an operator's full deployment.</p>
+  <section class="legal-section"><h2>Package defaults</h2><p>pm-web can use an HTTP-only <code>pm_token</code> session cookie, short-lived OIDC flow state when configured, and local browser preferences such as theme, PWA prompts, and this banner choice.</p><button type="button" class="btn btn-primary" data-cookie-settings>Open Cookie Settings</button></section>
+  <section class="legal-section"><h2>Operator verification required</h2><p>Reverse proxies, identity providers, analytics, embeds, support tools, and other deployment components may add cookies or storage. Inventory the running service and replace this page with a reviewed disclosure.</p></section>
+  <section class="legal-section"><h2>No package-level consent claim</h2><p>The reusable package cannot decide which storage is necessary, optional, or consent-based for an unknown deployment and jurisdiction.</p></section>
 </main>
 <div class="cookie-consent" id="cookie-consent" hidden><div class="cookie-consent-text"><strong>Cookie Settings</strong><span>We only use technically necessary storage for sign-in, security, and preferences. No optional tracking cookies.</span></div><div class="cookie-consent-actions"><a href="/privacy-policy">Privacy Policy</a><button type="button" class="btn btn-secondary btn-sm" data-cookie-decline>Necessary only</button><button type="button" class="btn btn-primary btn-sm" data-cookie-accept>Got it</button></div></div>
 <script src="/cookie-consent.js?v=1"></script>

package/public/index.html

@@ -58,6 +58,8 @@
           <span id="auth-btn-text">Sign In</span>
         </button>
       </form>
+      <div id="oidc-divider" class="auth-form-sub" style="margin:18px 0 10px;text-align:center" hidden>or</div>
+      <button id="oidc-login" type="button" class="btn btn-secondary btn-full btn-lg" hidden onclick="window.__app.startOidcLogin()">Continue with OpenID Connect</button>
     </div>
   </div>
 

package/public/legal-notice.html

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="de" data-theme="auto">
+<html lang="en" data-theme="auto" data-package-legal-template>
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
@@ -9,24 +9,22 @@
 <link rel="stylesheet" href="/legal-common.css?v=1">
 </head>
 <body class="legal-shell">
-<nav class="legal-nav"><a class="legal-brand" href="/">pm-web</a><div class="legal-links"><a href="/privacy-policy">Privacy Policy</a><a href="/terms">Terms</a><a href="/cookie-settings">Cookies</a><a href="https://pm-cli.unbrained.dev/legal-notice">pm-cli Legal Notice</a></div></nav>
+<nav class="legal-nav"><a class="legal-brand" href="/">pm-web</a><div class="legal-links"><a href="/privacy-policy">Privacy Policy</a><a href="/terms">Terms</a><a href="/cookie-settings">Cookies</a></div></nav>
 <main class="legal-main">
-  <p class="legal-kicker">Legal</p>
+  <p class="legal-kicker">Operator template — not a legal notice</p>
   <h1>Legal Notice</h1>
-  <p class="legal-updated">Stand: 26. Juni 2026</p>
+  <p class="legal-updated">The pm-web package does not know who operates this deployment.</p>
   <section class="legal-section">
-    <h2>Angaben gemaess ECG und MedienG</h2>
-    <p><strong>Stefan Preu</strong><br>Steinbruch 5<br>3250 Wieselburg<br>Oesterreich</p>
-    <p>E-Mail: <a href="mailto:stefan@preu.at">stefan@preu.at</a></p>
-    <p>Verantwortlich fuer den Inhalt dieser Website: Stefan Preu.</p>
+    <h2>Operator action required</h2>
+    <p>This placeholder is part of a reusable open-source package. It is not valid for a real service and must be replaced with an operator-reviewed notice before public deployment.</p>
   </section>
   <section class="legal-section">
-    <h2>Online-Angebot</h2>
-    <p>Dieses Impressum gilt fuer <a href="https://pm-web.unbrained.dev/">pm-web.unbrained.dev</a>. pm-web ist eine webbasierte Oberflaeche fuer pm-cli.</p>
+    <h2>Information to provide</h2>
+    <p>Identify the responsible operator, service address, monitored contact channel, persons responsible for content, applicable registrations, and any jurisdiction-specific disclosures.</p>
   </section>
   <section class="legal-section">
-    <h2>Haftung und externe Links</h2>
-    <p>Die Inhalte werden sorgfaeltig gepflegt. Fuer externe Links wird keine Verantwortung fuer fremde Inhalte uebernommen; fuer diese sind ausschliesslich deren Betreiber verantwortlich.</p>
+    <h2>Deployment</h2>
+    <p>Mount a complete private legal-page overlay with <code>PM_WEB_LEGAL_DIR</code>. pm-web rejects incomplete, unreadable, symlinked, or path-escaping overlays.</p>
   </section>
 </main>
 <div class="cookie-consent" id="cookie-consent" hidden><div class="cookie-consent-text"><strong>Cookie Settings</strong><span>We only use technically necessary storage for sign-in, security, and preferences. No optional tracking cookies.</span></div><div class="cookie-consent-actions"><a href="/privacy-policy">Privacy Policy</a><button type="button" class="btn btn-secondary btn-sm" data-cookie-decline>Necessary only</button><button type="button" class="btn btn-primary btn-sm" data-cookie-accept>Got it</button></div></div>

package/public/privacy-policy.html

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="de" data-theme="auto">
+<html lang="en" data-theme="auto" data-package-legal-template>
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
@@ -9,40 +9,30 @@
 <link rel="stylesheet" href="/legal-common.css?v=1">
 </head>
 <body class="legal-shell">
-<nav class="legal-nav"><a class="legal-brand" href="/">pm-web</a><div class="legal-links"><a href="/legal-notice">Legal Notice</a><a href="/terms">Terms</a><a href="/cookie-settings">Cookies</a><a href="https://pm-cli.unbrained.dev/privacy-policy">pm-cli Privacy Policy</a></div></nav>
+<nav class="legal-nav"><a class="legal-brand" href="/">pm-web</a><div class="legal-links"><a href="/legal-notice">Legal Notice</a><a href="/terms">Terms</a><a href="/cookie-settings">Cookies</a></div></nav>
 <main class="legal-main">
-  <p class="legal-kicker">Legal</p>
+  <p class="legal-kicker">Operator template — not a privacy notice</p>
   <h1>Privacy Policy</h1>
-  <p class="legal-updated">Stand: 26. Juni 2026</p>
+  <p class="legal-updated">A package cannot describe an unknown operator's actual processing.</p>
   <section class="legal-section">
-    <h2>Verantwortlicher</h2>
-    <p>Stefan Preu, Steinbruch 5, 3250 Wieselburg, Oesterreich, <a href="mailto:stefan@preu.at">stefan@preu.at</a>.</p>
+    <h2>Operator action required</h2>
+    <p>Replace this entire page with a reviewed notice for the real deployment. Do not rely on package defaults as legal or compliance advice.</p>
   </section>
   <section class="legal-section">
-    <h2>Verarbeitete Daten</h2>
-    <p>Beim Besuch werden technisch notwendige Serverdaten verarbeitet, insbesondere IP-Adresse, Zeitpunkt, angefragte URL, HTTP-Status, User-Agent und Referrer.</p>
-    <p>Bei Registrierung und Nutzung verarbeitet pm-web Konto- und Nutzungsdaten: E-Mail-Adresse, Anzeigename, Passwort-Hash, Projekt- und Gruppendaten, Freigaben, optionale GitHub-Verknuepfungsdaten sowie technische Sitzungsdaten.</p>
+    <h2>Inventory the deployment</h2>
+    <p>Document the actual operator, contacts, account and project data, authentication methods, collaboration and sharing, browser storage, server and security logs, backups, retention, deletion, exports, and user rights.</p>
   </section>
   <section class="legal-section">
-    <h2>Zwecke und Rechtsgrundlagen</h2>
-    <p>Die Verarbeitung erfolgt zur Bereitstellung der Anwendung, Authentifizierung, Projektverwaltung, Zusammenarbeit, Sicherheit, Missbrauchsschutz und Fehleranalyse. Rechtsgrundlagen sind Art. 6 Abs. 1 lit. b, lit. f und, soweit einschlaegig, lit. c DSGVO.</p>
+    <h2>Enabled integrations</h2>
+    <p>Describe only services actually enabled by the operator, including identity providers, Git hosting, databases, graph/search systems, email, proxies, analytics, observability, and support tooling.</p>
   </section>
   <section class="legal-section">
-    <h2>Cookies und lokale Speicherung</h2>
-    <p>pm-web verwendet ein technisch notwendiges HTTP-only Authentifizierungs-Cookie (<code>pm_token</code>). Lokale Browser-Speicherung kann fuer Theme, Installationshinweise und Cookie-Status genutzt werden. Es werden keine optionalen Tracking- oder Marketing-Cookies gesetzt.</p>
+    <h2>Legal review</h2>
+    <p>Have qualified counsel determine applicable purposes, legal bases, recipients, transfers, retention periods, notices, consent requirements, and supervisory contacts for the deployment.</p>
   </section>
   <section class="legal-section">
-    <h2>Drittanbieter</h2>
-    <p>Schriftarten werden lokal beziehungsweise ueber Systemschriftarten dargestellt. GitHub-Funktionen werden nur genutzt, wenn Nutzer diese aktiv verwenden oder entsprechende Links oeffnen.</p>
-  </section>
-  <section class="legal-section">
-    <h2>Speicherdauer</h2>
-    <p>Konto- und Projektdaten bleiben gespeichert, bis sie geloescht werden oder gesetzliche Pflichten entgegenstehen. Server- und Sicherheitslogs werden nur so lange gespeichert, wie sie fuer Betrieb, Sicherheit und Fehleranalyse erforderlich sind.</p>
-  </section>
-  <section class="legal-section">
-    <h2>Betroffenenrechte</h2>
-    <p>Betroffene Personen haben Rechte auf Auskunft, Berichtigung, Loeschung, Einschraenkung, Datenuebertragbarkeit, Widerspruch und Beschwerde bei einer Aufsichtsbehoerde. Anfragen bitte an <a href="mailto:stefan@preu.at">stefan@preu.at</a>.</p>
-    <p>Zustaendige oesterreichische Aufsichtsbehoerde: Datenschutzbehoerde, Barichgasse 40-42, 1030 Wien, <a href="https://www.dsb.gv.at/" target="_blank" rel="noopener">dsb.gv.at</a>.</p>
+    <h2>Private overlay</h2>
+    <p>Provide all four reviewed pages through <code>PM_WEB_LEGAL_DIR</code>; partial overlays fail at startup.</p>
   </section>
 </main>
 <div class="cookie-consent" id="cookie-consent" hidden><div class="cookie-consent-text"><strong>Cookie Settings</strong><span>We only use technically necessary storage for sign-in, security, and preferences. No optional tracking cookies.</span></div><div class="cookie-consent-actions"><a href="/privacy-policy">Privacy Policy</a><button type="button" class="btn btn-secondary btn-sm" data-cookie-decline>Necessary only</button><button type="button" class="btn btn-primary btn-sm" data-cookie-accept>Got it</button></div></div>

package/public/src/app.js

@@ -39,7 +39,7 @@ import { renderCommentsAuditView } from './views/comments-audit.js';
 import { renderConfigView, configAddArrayItem, configRemoveArrayItem, configSaveArray, configSaveSimple, configSaveObject, addSchemaType } from './views/config.js';
 import { renderGuideView } from './views/guide.js';
 import { renderAdminView, setAdminRole, adminSwitchTab, adminDeleteUser, adminDeleteProject, adminDeleteGroup, adminFilterUsers, adminFilterProjects, adminFilterAudit, adminSetPage, adminCreateGroup } from './views/admin.js';
-import { switchAuthTab, submitAuth, logout, showAuth } from './views/auth.js';
+import { switchAuthTab, submitAuth, logout, showAuth, startOidcLogin } from './views/auth.js';
 import { initPlanView, openPlanDetail, openCreatePlanModal, submitCreatePlan, openAddStepModal, submitAddStep, planCompleteStep, planBlockStepPrompt, submitBlockStep, planRemoveStep, planApprove, planMaterializePrompt, submitMaterializePlan, copyPlanAgentBrief, copyPlanNextStepPrompt, planEditPrompt, submitEditPlan, planDeletePrompt } from './views/plan.js';
 import { showModal, hideModal, createModal } from './components/modals.js';
 import { toast } from './components/toast.js';
@@ -225,6 +225,7 @@ window.__app = {
     // Auth
     switchAuthTab,
     submitAuth,
+    startOidcLogin,
     logout,
     // Projects
     onProjectSelect,
@@ -456,10 +457,8 @@ function connectSSE(projectId, attempt = 0) {
     disconnectSSE();
     sseCurrentProjectId = projectId;
     setSseStatus(attempt > 0 ? 'reconnecting' : 'disconnected');
-    const u = state.user;
-    const displayName = encodeURIComponent(u?.display_name || u?.email || '');
     const currentView = encodeURIComponent(state.currentView || 'items');
-    const url = `/api/projects/${encodeURIComponent(projectId)}/pm/events?dn=${displayName}&view=${currentView}`;
+    const url = `/api/projects/${encodeURIComponent(projectId)}/pm/events?view=${currentView}`;
     try {
         const source = new EventSource(url);
         sseSource = source;
@@ -578,6 +577,7 @@ function connectSSE(projectId, attempt = 0) {
         source.addEventListener('graph-sync-failed', graphSyncFailed);
         source.addEventListener('graph_sync_failed', graphSyncFailed);
         source.addEventListener('update', refreshView);
+        source.addEventListener('workspace-changed', refreshGraphData);
         source.onerror = () => {
             setSseStatus('reconnecting');
             source.close();