npm - @unbrained/pm-web - Versions diffs - 2026.7.11 → 2026.7.13 - Mend

@unbrained/pm-web 2026.7.11 → 2026.7.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (63) hide show

package/CHANGELOG.md +13 -0
package/README.md +26 -0
package/dist/app.d.ts +1 -0
package/dist/app.js +38 -2
package/dist/app.js.map +1 -1
package/dist/auth.d.ts +2 -1
package/dist/auth.js +10 -0
package/dist/auth.js.map +1 -1
package/dist/db.js +17 -1
package/dist/db.js.map +1 -1
package/dist/ical.js.map +1 -1
package/dist/index.d.ts +1 -22
package/dist/index.js +2 -3
package/dist/index.js.map +1 -1
package/dist/oidc.d.ts +89 -0
package/dist/oidc.js +305 -0
package/dist/oidc.js.map +1 -0
package/dist/routes/auth.js +3 -15
package/dist/routes/auth.js.map +1 -1
package/dist/routes/github.js +3 -3
package/dist/routes/github.js.map +1 -1
package/dist/routes/oidc.d.ts +4 -0
package/dist/routes/oidc.js +147 -0
package/dist/routes/oidc.js.map +1 -0
package/dist/routes/pm.js +121 -107
package/dist/routes/pm.js.map +1 -1
package/dist/routes/projects.js +9 -2
package/dist/routes/projects.js.map +1 -1
package/dist/server.js +7 -2
package/dist/server.js.map +1 -1
package/dist/services/pm-runner.d.ts +11 -3
package/dist/services/pm-runner.js +167 -54
package/dist/services/pm-runner.js.map +1 -1
package/dist/services/realtime-bus.d.ts +1 -0
package/dist/services/realtime-bus.js +148 -0
package/dist/services/realtime-bus.js.map +1 -0
package/dist/services/sse.d.ts +3 -1
package/dist/services/sse.js +83 -48
package/dist/services/sse.js.map +1 -1
package/manifest.json +1 -1
package/package.json +11 -11
package/public/cookie-consent.js +54 -39
package/public/cookie-settings.html +7 -7
package/public/index.html +2 -0
package/public/legal-notice.html +10 -12
package/public/privacy-policy.html +14 -24
package/public/src/app.js +4 -4
package/public/src/app.js.map +1 -1
package/public/src/app.ts +4 -4
package/public/src/components/toast.js.map +1 -1
package/public/src/cookie-consent.ts +68 -0
package/public/src/sw.ts +443 -0
package/public/src/views/auth.js +22 -0
package/public/src/views/auth.js.map +1 -1
package/public/src/views/auth.ts +20 -0
package/public/src/views/graph.js.map +1 -1
package/public/styles.css +2 -0
package/public/sw.js +320 -256
package/public/terms.html +7 -9
package/public/tsconfig.json +1 -1
package/public/tsconfig.scripts.json +18 -0
package/public/tsconfig.sw.json +18 -0
package/sql/schema.sql +16 -0

package/public/sw.js CHANGED Viewed

@@ -1,58 +1,74 @@
+"use strict";
 // ═══════════════════════════════════════════════════════════════
 // SERVICE WORKER — pm-web PWA
 // Cache versioning: auto-bust based on build timestamp
 // Offline fallback page, mutation queue via IndexedDB
+//
+// This is the TypeScript source for /sw.js. It is compiled with the
+// `WebWorker` lib (see public/tsconfig.sw.json) so the ServiceWorker
+// global scope (`ServiceWorkerGlobalScope`, `caches`, `clients`,
+// `skipWaiting`, IndexedDB, fetch) is fully typed. The emitted
+// `public/sw.js` is plain JavaScript served at the same URL.
 // ═══════════════════════════════════════════════════════════════
+// `self` is the ServiceWorkerGlobalScope inside a service worker. The
+// `WebWorker` lib types the ambient `self` as the generic WorkerGlobalScope,
+// so narrow it once at the top via a `unknown` cast (no `any`).
+const sw = self;
+// `__BUILD_TIME__` is an optional build-time substitution placeholder.
+// No substitution is performed by the default build, so the literal is
+// retained verbatim and the cache name falls back to a runtime stamp.
+// Kept as a widened `string` so the placeholder comparison stays a
+// runtime check and the emitted output is deterministic.
 const BUILD_TIMESTAMP = '__BUILD_TIME__';
 const CACHE_NAME = 'pm-web-' + (BUILD_TIMESTAMP !== '__BUILD_TIME__' ? BUILD_TIMESTAMP : Date.now().toString(36));
 const MUTATION_DB = 'pm-web-offline';
 const MUTATION_STORE = 'mutations';
 const STATIC_ASSETS = [
-  '/',
-  '/styles.css',
-  '/manifest.json',
-  '/icons/icon-192.png',
-  '/icons/icon-512.png',
-  '/src/api.js',
-  '/src/app.js',
-  '/src/components/modals.js',
-  '/src/components/toast.js',
-  '/src/constants.js',
-  '/src/state.js',
-  '/src/types.js',
-  '/src/utils.js',
-  '/src/views/activity.js',
-  '/src/views/admin.js',
-  '/src/views/auth.js',
-  '/src/views/calendar.js',
-  '/src/views/comments-audit.js',
-  '/src/views/config.js',
-  '/src/views/context.js',
-  '/src/views/create.js',
-  '/src/views/dedupe.js',
-  '/src/views/export.js',
-  '/src/views/github.js',
-  '/src/views/graph-canvas.js',
-  '/src/views/graph.js',
-  '/src/views/groups.js',
-  '/src/views/guide.js',
-  '/src/views/health.js',
-  '/src/views/items.js',
-  '/src/views/normalize.js',
-  '/src/views/projects.js',
-  '/src/views/router.js',
-  '/src/views/search.js',
-  '/src/views/settings.js',
-  '/src/views/shared.js',
-  '/src/views/sharing.js',
-  '/src/views/stats.js',
-  '/src/views/templates.js',
-  '/src/views/validate.js',
-  '/src/views/plan.js',
+    '/',
+    '/styles.css',
+    '/manifest.json',
+    '/icons/icon-192.png',
+    '/icons/icon-512.png',
+    '/src/api.js',
+    '/src/app.js',
+    '/src/components/modals.js',
+    '/src/components/toast.js',
+    '/src/constants.js',
+    '/src/filters.js',
+    '/src/state.js',
+    '/src/theme.js',
+    '/src/types.js',
+    '/src/utils.js',
+    '/src/views/activity.js',
+    '/src/views/admin.js',
+    '/src/views/auth.js',
+    '/src/views/calendar.js',
+    '/src/views/comments-audit.js',
+    '/src/views/config.js',
+    '/src/views/context.js',
+    '/src/views/create.js',
+    '/src/views/dedupe.js',
+    '/src/views/export.js',
+    '/src/views/github.js',
+    '/src/views/graph-canvas.js',
+    '/src/views/graph.js',
+    '/src/views/groups.js',
+    '/src/views/guide.js',
+    '/src/views/health.js',
+    '/src/views/items.js',
+    '/src/views/normalize.js',
+    '/src/views/plan.js',
+    '/src/views/plan-execution.js',
+    '/src/views/projects.js',
+    '/src/views/router.js',
+    '/src/views/search.js',
+    '/src/views/settings.js',
+    '/src/views/shared.js',
+    '/src/views/sharing.js',
+    '/src/views/stats.js',
+    '/src/views/templates.js',
+    '/src/views/validate.js',
 ];
 // ── Offline fallback page ──
 const OFFLINE_HTML = `<!DOCTYPE html>
 <html lang="en">
@@ -79,240 +95,288 @@ const OFFLINE_HTML = `<!DOCTYPE html>
   </div>
 </body>
 </html>`;
-// ── IndexedDB Mutation Queue ──
-function openMutationDB(): Promise<IDBDatabase> {
-  return new Promise((resolve, reject) => {
-    const request = indexedDB.open(MUTATION_DB, 1);
-    request.onupgradeneeded = () => {
-      const db = request.result;
-      if (!db.objectStoreNames.contains(MUTATION_STORE)) {
-        const store = db.createObjectStore(MUTATION_STORE, { keyPath: 'id', autoIncrement: true });
-        store.createIndex('timestamp', 'timestamp', { unique: false });
-      }
-    };
-    request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(request.error);
-  });
-}
-async function queueMutation(method: string, path: string, body: unknown): Promise<void> {
-  try {
-    const db = await openMutationDB();
-    const tx = db.transaction(MUTATION_STORE, 'readwrite');
-    const store = tx.objectStore(MUTATION_STORE);
-    store.add({
-      method,
-      path,
-      body: body !== undefined ? JSON.stringify(body) : null,
-      timestamp: Date.now(),
+function openMutationDB() {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open(MUTATION_DB, 1);
+        request.onupgradeneeded = () => {
+            const db = request.result;
+            if (!db.objectStoreNames.contains(MUTATION_STORE)) {
+                const store = db.createObjectStore(MUTATION_STORE, { keyPath: 'id', autoIncrement: true });
+                store.createIndex('timestamp', 'timestamp', { unique: false });
+            }
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
     });
-  } catch (e) {
-    // If IndexedDB fails, mutations are lost — graceful degradation
-    console.warn('Failed to queue mutation for offline:', e);
-  }
 }
-async function getQueuedMutations(): Promise<Array<{ id: number; method: string; path: string; body: string | null; timestamp: number }>> {
-  try {
-    const db = await openMutationDB();
-    const tx = db.transaction(MUTATION_STORE, 'readonly');
-    const store = tx.objectStore(MUTATION_STORE);
+/**
+ * Resolve when an IDB transaction has durably committed; reject on abort or
+ * error so callers can never mistake a half-applied (or never-applied) write
+ * for a persisted mutation. The transaction auto-commits once all queued
+ * requests settle, so awaiting this is sufficient to know the write is durable.
+ */
+function transactionDone(tx) {
     return new Promise((resolve, reject) => {
-      const request = store.getAll();
-      request.onsuccess = () => resolve(request.result);
-      request.onerror = () => reject(request.error);
+        tx.oncomplete = () => resolve();
+        tx.onabort = () => reject(tx.error ?? new Error('IDB transaction aborted'));
+        tx.onerror = () => reject(tx.error ?? new Error('IDB transaction error'));
     });
-  } catch {
-    return [];
-  }
 }
-async function clearMutation(id: number): Promise<void> {
-  try {
-    const db = await openMutationDB();
-    const tx = db.transaction(MUTATION_STORE, 'readwrite');
-    tx.objectStore(MUTATION_STORE).delete(id);
-  } catch { /* ignore */ }
+/**
+ * Queue a mutation for later replay. Returns `true` only when the mutation has
+ * been durably persisted to IndexedDB; `false` when persistence failed so the
+ * caller can respond with an explicit error instead of claiming it was queued.
+ */
+async function queueMutation(method, path, body) {
+    try {
+        const db = await openMutationDB();
+        const tx = db.transaction(MUTATION_STORE, 'readwrite');
+        const store = tx.objectStore(MUTATION_STORE);
+        const record = {
+            method,
+            path,
+            body: body !== undefined ? JSON.stringify(body) : null,
+            timestamp: Date.now(),
+        };
+        store.add(record);
+        // Await the transaction commit (not just the request dispatch) so the
+        // promise only resolves after the mutation is durably persisted. A request
+        // error triggers a transaction abort, surfaced via `transactionDone`.
+        await transactionDone(tx);
+        return true;
+    }
+    catch (e) {
+        // Persistence failed — do NOT claim the mutation was queued.
+        console.warn('Failed to queue mutation for offline:', e);
+        return false;
+    }
 }
-async function flushMutationQueue(): Promise<void> {
-  const mutations = await getQueuedMutations();
-  if (mutations.length === 0) return;
-  for (const mut of mutations) {
+async function getQueuedMutations() {
     try {
-      const opts: RequestInit = {
-        method: mut.method,
-        headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
-      };
-      if (mut.body !== null) opts.body = mut.body;
-      const res = await fetch('/api' + mut.path, opts);
-      if (res.ok) {
-        await clearMutation(mut.id);
-      } else {
-        console.warn('Offline mutation failed:', mut.method, mut.path, res.status);
-        // Stop processing on first failure — try again later
-        break;
-      }
-    } catch {
-      // Network failed again — stop processing
-      break;
+        const db = await openMutationDB();
+        const tx = db.transaction(MUTATION_STORE, 'readonly');
+        const store = tx.objectStore(MUTATION_STORE);
+        return await new Promise((resolve, reject) => {
+            const request = store.getAll();
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(request.error);
+        });
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Remove a replayed mutation from the queue. Returns `true` only when the
+ * deletion has committed, so the caller can stop replay on a persistence
+ * failure instead of silently leaving duplicate entries to be retried.
+ */
+async function clearMutation(id) {
+    try {
+        const db = await openMutationDB();
+        const tx = db.transaction(MUTATION_STORE, 'readwrite');
+        tx.objectStore(MUTATION_STORE).delete(id);
+        await transactionDone(tx);
+        return true;
+    }
+    catch (e) {
+        console.warn('Failed to clear queued mutation:', e);
+        return false;
+    }
+}
+async function flushMutationQueue() {
+    const mutations = await getQueuedMutations();
+    if (mutations.length === 0)
+        return;
+    for (const mut of mutations) {
+        try {
+            const opts = {
+                method: mut.method,
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+            };
+            if (mut.body !== null)
+                opts.body = mut.body;
+            const res = await fetch('/api' + mut.path, opts);
+            if (res.ok) {
+                const cleared = await clearMutation(mut.id);
+                if (!cleared) {
+                    // Could not remove the replayed mutation from the queue — stop to
+                    // avoid duplicate replays on the next flush; it will retry later.
+                    break;
+                }
+            }
+            else {
+                console.warn('Offline mutation failed:', mut.method, mut.path, res.status);
+                // Stop processing on first failure — try again later
+                break;
+            }
+        }
+        catch {
+            // Network failed again — stop processing
+            break;
+        }
+    }
+    // Notify clients about replayed mutations
+    const remaining = await getQueuedMutations();
+    const clients = await sw.clients.matchAll();
+    if (remaining.length === 0 && mutations.length > 0) {
+        clients.forEach((client) => {
+            client.postMessage({ type: 'MUTATIONS_REPLAYED', count: mutations.length });
+        });
+    }
+    else if (remaining.length > 0) {
+        clients.forEach((client) => {
+            client.postMessage({
+                type: 'MUTATIONS_PARTIAL',
+                replayed: mutations.length - remaining.length,
+                remaining: remaining.length,
+            });
+        });
     }
-  }
-  // Notify clients about replayed mutations
-  const remaining = await getQueuedMutations();
-  if (remaining.length === 0 && mutations.length > 0) {
-    const clients = await self.clients.matchAll();
-    clients.forEach(client => {
-      client.postMessage({ type: 'MUTATIONS_REPLAYED', count: mutations.length });
-    });
-  } else if (remaining.length > 0) {
-    const clients = await self.clients.matchAll();
-    clients.forEach(client => {
-      client.postMessage({ type: 'MUTATIONS_PARTIAL', replayed: mutations.length - remaining.length, remaining: remaining.length });
-    });
-  }
 }
 // ── Install ──
-self.addEventListener('install', (event) => {
-  event.waitUntil(
-    caches.open(CACHE_NAME).then((cache) =>
-      Promise.all(STATIC_ASSETS.map((asset) => cache.add(asset).catch(() => null)))
-    )
-  );
-  self.skipWaiting();
+sw.addEventListener('install', (event) => {
+    event.waitUntil(caches.open(CACHE_NAME).then((cache) => Promise.all(STATIC_ASSETS.map((asset) => cache.add(asset).catch(() => null)))));
+    sw.skipWaiting();
 });
 // ── Activate ──
-self.addEventListener('activate', (event) => {
-  event.waitUntil(
-    caches.keys().then((keys) =>
-      Promise.all(keys.filter((k) => k !== CACHE_NAME).map((k) => caches.delete(k)))
-    )
-  );
-  self.clients.claim();
+sw.addEventListener('activate', (event) => {
+    event.waitUntil(caches.keys().then((keys) => Promise.all(keys.filter((k) => k !== CACHE_NAME).map((k) => caches.delete(k)))));
+    sw.clients.claim();
 });
 // ── Fetch strategy ──
-self.addEventListener('fetch', (event) => {
-  const url = new URL(event.request.url);
-  // API calls: try network, queue mutations if offline
-  if (url.pathname.startsWith('/api/') || url.pathname.startsWith('/healthz')) {
-    // Queue write operations (POST, PUT, PATCH, DELETE) when offline
-    if (event.request.method !== 'GET' && event.request.method !== 'HEAD') {
-      event.respondWith(
-        fetch(event.request).catch(async () => {
-          // Network failed — queue the mutation for later
-          let body: unknown = undefined;
-          try {
-            body = await event.request.clone().json();
-          } catch { /* no body */ }
-          await queueMutation(event.request.method, url.pathname.replace('/api', ''), body);
-          return new Response(JSON.stringify({ queued: true, message: 'Request queued for when you are back online' }), {
-            status: 202,
+sw.addEventListener('fetch', (event) => {
+    const url = new URL(event.request.url);
+    // API calls: try network, queue mutations if offline
+    if (url.pathname.startsWith('/api/') || url.pathname.startsWith('/healthz')) {
+        // Queue write operations (POST, PUT, PATCH, DELETE) when offline
+        if (event.request.method !== 'GET' && event.request.method !== 'HEAD') {
+            event.respondWith(fetch(event.request).catch(async () => {
+                // Network failed — queue the mutation for later.
+                let body = undefined;
+                try {
+                    body = await event.request.clone().json();
+                }
+                catch { /* no body */ }
+                const queued = await queueMutation(event.request.method, url.pathname.replace('/api', ''), body);
+                if (queued) {
+                    return new Response(JSON.stringify({ queued: true, message: 'Request queued for when you are back online' }), { status: 202, headers: { 'Content-Type': 'application/json' } });
+                }
+                // Persistence failed — do not claim the mutation was queued.
+                return new Response(JSON.stringify({ error: 'Offline and unable to queue mutation', queued: false }), { status: 503, headers: { 'Content-Type': 'application/json' } });
+            }));
+            return;
+        }
+        // GET/HEAD API calls: network-only, return offline JSON error
+        event.respondWith(fetch(event.request)
+            .catch(() => new Response(JSON.stringify({ error: 'Offline — check your connection', queued: 0 }), {
+            status: 503,
             headers: { 'Content-Type': 'application/json' },
-          });
-        })
-      );
-      return;
+        })));
+        return;
     }
-    // GET/HEAD API calls: network-only, return offline JSON error
-    event.respondWith(
-      fetch(event.request)
-        .catch(() => new Response(JSON.stringify({ error: 'Offline — check your connection', queued: 0 }), {
-          status: 503,
-          headers: { 'Content-Type': 'application/json' },
-        }))
-    );
-    return;
-  }
-  // Navigation (SPA shell): network-first, cache fallback, offline page fallback
-  if (event.request.mode === 'navigate') {
-    event.respondWith(
-      fetch(event.request)
-        .then((res) => {
-          if (res.ok) {
-            const clone = res.clone();
-            caches.open(CACHE_NAME).then((c) => c.put('/', clone));
-          }
-          return res;
-        })
-        .catch(async () => {
-          // Try cached shell first
-          const cached = await caches.match('/');
-          if (cached) return cached;
-          // Return offline fallback page
-          return new Response(OFFLINE_HTML, {
-            status: 503,
-            headers: { 'Content-Type': 'text/html; charset=utf-8' },
-          });
-        })
-    );
-    return;
-  }
-  // Static assets: stale-while-revalidate
-  if (
-    url.pathname.endsWith('.css') ||
-    url.pathname.endsWith('.js') ||
-    url.pathname.endsWith('.json') ||
-    url.pathname.endsWith('.png') ||
-    url.pathname.endsWith('.svg') ||
-    url.pathname.endsWith('.ico') ||
-    url.pathname.endsWith('.woff2') ||
-    url.hostname.includes('fonts.googleapis.com') ||
-    url.hostname.includes('fonts.gstatic.com')
-  ) {
-    event.respondWith(
-      caches.open(CACHE_NAME).then((cache) =>
-        cache.match(event.request).then((cached) => {
-          const fetched = fetch(event.request).then((res) => {
-            if (res.ok) cache.put(event.request, res.clone());
+    // Navigation (SPA shell): network-first, cache fallback, offline page fallback
+    if (event.request.mode === 'navigate') {
+        event.respondWith(fetch(event.request)
+            .then((res) => {
+            if (res.ok) {
+                const clone = res.clone();
+                caches.open(CACHE_NAME).then((c) => c.put('/', clone));
+            }
             return res;
-          }).catch(() => cached);
-          return cached || fetched;
         })
-      )
-    );
-    return;
-  }
-  // Default: network, fallback to cache
-  event.respondWith(
-    fetch(event.request)
-      .catch(() => caches.match(event.request))
-  );
+            .catch(async () => {
+            // Try cached shell first
+            const cached = await caches.match('/');
+            if (cached)
+                return cached;
+            // Return offline fallback page
+            return new Response(OFFLINE_HTML, {
+                status: 503,
+                headers: { 'Content-Type': 'text/html; charset=utf-8' },
+            });
+        }));
+        return;
+    }
+    // Static assets: stale-while-revalidate
+    if (url.pathname.endsWith('.css') ||
+        url.pathname.endsWith('.js') ||
+        url.pathname.endsWith('.json') ||
+        url.pathname.endsWith('.png') ||
+        url.pathname.endsWith('.svg') ||
+        url.pathname.endsWith('.ico') ||
+        url.pathname.endsWith('.woff2') ||
+        url.hostname.includes('fonts.googleapis.com') ||
+        url.hostname.includes('fonts.gstatic.com')) {
+        event.respondWith((async () => {
+            const cache = await caches.open(CACHE_NAME);
+            const cached = await cache.match(event.request);
+            // Kick off revalidation in the background. The network promise resolves
+            // to `undefined` on failure (no unsafe cast — the type is explicit).
+            const network = fetch(event.request)
+                .then((res) => {
+                if (res.ok)
+                    void cache.put(event.request, res.clone());
+                return res;
+            })
+                .catch(() => undefined);
+            // Stale-while-revalidate: serve cached immediately when present.
+            if (cached) {
+                void network;
+                return cached;
+            }
+            // No cached entry — must wait for the network.
+            const res = await network;
+            if (res)
+                return res;
+            return new Response('Unavailable offline', {
+                status: 503,
+                headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+            });
+        })());
+        return;
+    }
+    // Default: network, fallback to cache, then explicit 503.
+    event.respondWith((async () => {
+        try {
+            return await fetch(event.request);
+        }
+        catch {
+            const cached = await caches.match(event.request);
+            if (cached)
+                return cached;
+            return new Response('Unavailable offline', {
+                status: 503,
+                headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+            });
+        }
+    })());
 });
 // ── Messages ──
-self.addEventListener('message', (event) => {
-  if (event.data && event.data.type === 'SKIP_WAITING') {
-    self.skipWaiting();
-  }
-  if (event.data && event.data.type === 'CACHE_URLS') {
-    const urls = event.data.urls || [];
-    caches.open(CACHE_NAME).then((cache) => cache.addAll(urls).catch(() => {}));
-  }
-  if (event.data && event.data.type === 'FLUSH_QUEUE') {
-    flushMutationQueue();
-  }
+sw.addEventListener('message', (event) => {
+    const data = event.data;
+    if (data && data.type === 'SKIP_WAITING') {
+        sw.skipWaiting();
+    }
+    if (data && data.type === 'CACHE_URLS') {
+        const urls = data.urls ?? [];
+        caches.open(CACHE_NAME).then((cache) => cache.addAll(urls).catch(() => { }));
+    }
+    if (data && data.type === 'FLUSH_QUEUE') {
+        void flushMutationQueue();
+    }
 });
 // ── Background sync ──
-self.addEventListener('sync', (event) => {
-  if (event.tag === 'pm-sync') {
-    event.waitUntil(flushMutationQueue());
-  }
+// The `WebWorker` lib has no `SyncEvent`, so receive the generic Event and
+// narrow to our minimal SyncEvent interface (no `any`).
+sw.addEventListener('sync', (event) => {
+    const syncEvent = event;
+    if (syncEvent.tag === 'pm-sync') {
+        syncEvent.waitUntil(flushMutationQueue());
+    }
 });
 // ── Online event: flush queue when connectivity returns ──
-self.addEventListener('online', () => {
-  flushMutationQueue();
+sw.addEventListener('online', () => {
+    void flushMutationQueue();
 });