hanoman 0.1.22 → 0.1.24

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.22",
-  "sha": "c3a0a34",
-  "builtAt": "2026-08-08T07:24:55.380Z"
+  "version": "0.1.24",
+  "sha": "3024ec0",
+  "builtAt": "2026-08-10T03:28:41.335Z"
 }

package/dist/cli.js

@@ -4986,7 +4986,7 @@ var init_prd_status = __esm({
 });
 
 // ../shared/src/dto.ts
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, zLogin, zSignup, zChangePassword, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5400,12 +5400,24 @@ var init_dto = __esm({
       password: external_exports.string().min(1)
       // SPEC-165 · diisi = bootstrap ulang
     }).partial();
+    USER_ROLES = ["admin", "client"];
+    zUserRole = external_exports.enum(USER_ROLES);
     zLogin = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(1) });
     zSignup = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(8) });
     zChangePassword = external_exports.object({
       currentPassword: external_exports.string().min(1),
       newPassword: external_exports.string().min(8)
     });
+    zCreateClientAccount = external_exports.object({
+      email: external_exports.string().email(),
+      password: external_exports.string().min(8),
+      projects: external_exports.array(external_exports.string().min(1)).default([])
+    });
+    zUpdateClientAccount = external_exports.object({
+      projects: external_exports.array(external_exports.string().min(1)),
+      disabled: external_exports.boolean(),
+      password: external_exports.string().min(8)
+    }).partial();
     zVpsCheck = external_exports.object({
       check: external_exports.string(),
       status: external_exports.enum(["pass", "fail", "warn", "na"]),
@@ -5741,6 +5753,14 @@ var init_ticket_status = __esm({
   }
 });
 
+// ../shared/src/portal.ts
+var init_portal = __esm({
+  "../shared/src/portal.ts"() {
+    "use strict";
+    init_ticket_status();
+  }
+});
+
 // ../shared/src/session-kind.ts
 var SESSION_KINDS, zSessionKind;
 var init_session_kind = __esm({
@@ -7022,6 +7042,7 @@ var init_src = __esm({
     init_api();
     init_coverage();
     init_ticket_status();
+    init_portal();
     init_prd_status();
     init_session_kind();
     init_config();
@@ -28591,7 +28612,9 @@ var init_migrate_pg = __esm({
       // SPEC-516 · ADR-0105 · Changelog sesudah Project (FK projectId). Tabel ini LOCAL-only dan
       // lazimnya TIDAK ada di sumber Postgres lama — jalur 42P01 memperlakukannya sebagai nol baris.
       "Changelog",
+      // SPEC-617 · ADR-0110 · ClientProjectAccess sesudah User DAN Project (FK ke keduanya).
       "User",
+      "ClientProjectAccess",
       "Session",
       "DeviceToken",
       "AgentToken",

package/dist/server.js

@@ -5237,7 +5237,7 @@ var init_prd_status = __esm({
 function flowForSource(source) {
   return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "goal" ? "goal" : "feature";
 }
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, zLogin, zSignup, zChangePassword, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5651,12 +5651,24 @@ var init_dto = __esm({
       password: external_exports.string().min(1)
       // SPEC-165 · diisi = bootstrap ulang
     }).partial();
+    USER_ROLES = ["admin", "client"];
+    zUserRole = external_exports.enum(USER_ROLES);
     zLogin = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(1) });
     zSignup = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(8) });
     zChangePassword = external_exports.object({
       currentPassword: external_exports.string().min(1),
       newPassword: external_exports.string().min(8)
     });
+    zCreateClientAccount = external_exports.object({
+      email: external_exports.string().email(),
+      password: external_exports.string().min(8),
+      projects: external_exports.array(external_exports.string().min(1)).default([])
+    });
+    zUpdateClientAccount = external_exports.object({
+      projects: external_exports.array(external_exports.string().min(1)),
+      disabled: external_exports.boolean(),
+      password: external_exports.string().min(8)
+    }).partial();
     zVpsCheck = external_exports.object({
       check: external_exports.string(),
       status: external_exports.enum(["pass", "fail", "warn", "na"]),
@@ -6002,6 +6014,44 @@ var init_ticket_status = __esm({
   }
 });
 
+// ../shared/src/portal.ts
+function toPortalProject(p) {
+  return { id: p.id, name: p.name };
+}
+function toPortalSpec(s2) {
+  return {
+    id: s2.id,
+    title: s2.title,
+    priority: s2.priority,
+    stage: s2.stage,
+    objective: s2.objective,
+    createdAt: iso(s2.createdAt),
+    startedAt: iso(s2.startedAt),
+    doneAt: iso(s2.doneAt)
+  };
+}
+function toPortalTicket(t, specStage) {
+  return {
+    id: t.id,
+    number: t.number,
+    category: t.category,
+    title: t.title,
+    status: publicStatus(t.status, specStage),
+    createdAt: iso(t.createdAt)
+  };
+}
+function toPortalTicketDetail(t, specStage) {
+  return { ...toPortalTicket(t, specStage), detail: t.detail };
+}
+var iso;
+var init_portal = __esm({
+  "../shared/src/portal.ts"() {
+    "use strict";
+    init_ticket_status();
+    iso = (d) => d == null ? null : typeof d === "string" ? d : d.toISOString();
+  }
+});
+
 // ../shared/src/session-kind.ts
 var SESSION_KINDS, zSessionKind;
 var init_session_kind = __esm({
@@ -6315,14 +6365,14 @@ function matchesEvent(subscribed, type) {
 }
 function projectRow(def2, row) {
   const out3 = {};
-  for (const f of def2.fields) if (f in row) out3[f] = iso(row[f]);
+  for (const f of def2.fields) if (f in row) out3[f] = iso2(row[f]);
   return out3;
 }
 function diffFields(def2, before, after) {
   const out3 = [];
   for (const f of def2.fields) {
     if (IGNORED_FIELDS.has(f)) continue;
-    if (JSON.stringify(iso(before[f]) ?? null) !== JSON.stringify(iso(after[f]) ?? null)) out3.push(f);
+    if (JSON.stringify(iso2(before[f]) ?? null) !== JSON.stringify(iso2(after[f]) ?? null)) out3.push(f);
   }
   return out3;
 }
@@ -6361,7 +6411,7 @@ function clampEnvelope(env) {
   }
   return { ...env, truncated: true, truncatedFields: fields };
 }
-var WEBHOOK_SPEC_VERSION, WEBHOOK_BACKOFF_SEC, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_FAIL_LIMIT, WEBHOOK_QUEUE_CAP, WEBHOOK_HISTORY_KEEP, WEBHOOK_MAX_BYTES, WEBHOOK_FIELD_MAX_CHARS, WEBHOOK_TIMEOUT_MS, WEBHOOK_DEFAULT_PER_MINUTE, WEBHOOK_PING_TYPE, WEBHOOK_USER_AGENT, WEBHOOK_HEADERS, SYSTEM_ACTOR, IGNORED_FIELDS, WEBHOOK_ENTITIES, BY_MODEL, WEBHOOK_EVENTS, webhookEventTypes, iso, zCreateWebhookEndpoint, zUpdateWebhookEndpoint;
+var WEBHOOK_SPEC_VERSION, WEBHOOK_BACKOFF_SEC, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_FAIL_LIMIT, WEBHOOK_QUEUE_CAP, WEBHOOK_HISTORY_KEEP, WEBHOOK_MAX_BYTES, WEBHOOK_FIELD_MAX_CHARS, WEBHOOK_TIMEOUT_MS, WEBHOOK_DEFAULT_PER_MINUTE, WEBHOOK_PING_TYPE, WEBHOOK_USER_AGENT, WEBHOOK_HEADERS, SYSTEM_ACTOR, IGNORED_FIELDS, WEBHOOK_ENTITIES, BY_MODEL, WEBHOOK_EVENTS, webhookEventTypes, iso2, zCreateWebhookEndpoint, zUpdateWebhookEndpoint;
 var init_webhook = __esm({
   "../shared/src/webhook.ts"() {
     "use strict";
@@ -6718,7 +6768,7 @@ var init_webhook = __esm({
       }
     ];
     webhookEventTypes = () => WEBHOOK_EVENTS.map((e) => e.type);
-    iso = (v) => v instanceof Date ? v.toISOString() : v;
+    iso2 = (v) => v instanceof Date ? v.toISOString() : v;
     zCreateWebhookEndpoint = external_exports.object({
       name: external_exports.string().trim().min(1).max(80),
       url: external_exports.string().trim().min(1).max(2e3),
@@ -7381,6 +7431,7 @@ var init_src = __esm({
     init_api();
     init_coverage();
     init_ticket_status();
+    init_portal();
     init_prd_status();
     init_session_kind();
     init_config();
@@ -29986,10 +30037,85 @@ async function webhooks_default(app2) {
   });
 }
 
-// src/app.ts
-var import_multipart = __toESM(require_multipart2(), 1);
+// src/routes/portal.ts
+init_src();
+init_db();
 
-// src/routes/auth.ts
+// src/services/client-access.ts
+init_db();
+var segments = (path) => path.replace(/^\/api\/?/, "").replace(/\/+$/, "").split("/").filter(Boolean);
+function clientRouteAllowed(method, path) {
+  const seg = segments(path);
+  if (seg.includes("..")) return false;
+  const top = seg[0] ?? "";
+  const read = method === "GET" || method === "HEAD";
+  if (top === "portal") return read;
+  if (top === "help") return true;
+  if (top === "auth") {
+    const sub = seg[1] ?? "";
+    return method === "POST" && (sub === "logout" || sub === "change-password");
+  }
+  return false;
+}
+async function clientProjectIds(userId) {
+  const rows = await prisma.clientProjectAccess.findMany({
+    where: { userId },
+    select: { projectId: true },
+    orderBy: { projectId: "asc" }
+  });
+  return rows.map((r) => r.projectId);
+}
+async function hasProjectAccess(userId, projectId) {
+  return await prisma.clientProjectAccess.count({ where: { userId, projectId } }) > 0;
+}
+
+// src/routes/portal.ts
+var NOT_FOUND = { error: "not found" };
+async function specStages(ids) {
+  const wanted = [...new Set(ids.filter((v) => !!v))];
+  if (!wanted.length) return /* @__PURE__ */ new Map();
+  const rows = await prisma.spec.findMany({ where: { id: { in: wanted } }, select: { id: true, stage: true } });
+  return new Map(rows.map((r) => [r.id, r.stage]));
+}
+async function portal_default(app2) {
+  app2.get("/portal/projects", async (req) => {
+    const ids = await clientProjectIds(req.user.id);
+    const rows = await prisma.project.findMany({ where: { id: { in: ids } }, orderBy: { name: "asc" } });
+    return { items: rows.map(toPortalProject) };
+  });
+  app2.get("/portal/projects/:id/backlog", async (req, reply) => {
+    const { id } = req.params;
+    if (!await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    const { page, limit } = req.query;
+    const specs = await liveSpecs({ project: id });
+    return paginate(specs.map(toPortalSpec), page, limit);
+  });
+  app2.get("/portal/projects/:id/backlog/:specId", async (req, reply) => {
+    const { id, specId } = req.params;
+    if (!await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    const spec = (await liveSpecs({ project: id })).find((s2) => s2.id === specId);
+    if (!spec) return reply.code(404).send(NOT_FOUND);
+    return toPortalSpec(spec);
+  });
+  app2.get("/portal/projects/:id/tickets", async (req, reply) => {
+    const { id } = req.params;
+    if (!await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    const { page, limit } = req.query;
+    const rows = await prisma.ticket.findMany({ where: { projectId: id }, orderBy: { createdAt: "desc" } });
+    const stages = await specStages(rows.map((t) => t.specId));
+    return paginate(rows.map((t) => toPortalTicket(t, stages.get(t.specId ?? "") ?? null)), page, limit);
+  });
+  app2.get("/portal/projects/:id/tickets/:ticketId", async (req, reply) => {
+    const { id, ticketId } = req.params;
+    if (!await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    const t = await prisma.ticket.findUnique({ where: { id: ticketId } });
+    if (!t || t.projectId !== id) return reply.code(404).send(NOT_FOUND);
+    const stages = await specStages([t.specId]);
+    return toPortalTicketDetail(t, stages.get(t.specId ?? "") ?? null);
+  });
+}
+
+// src/routes/client-accounts.ts
 init_src();
 init_db();
 
@@ -30029,7 +30155,13 @@ async function lookupSession(token) {
     });
     return null;
   }
-  return { id: s2.user.id, email: s2.user.email, createdAt: s2.user.createdAt.toISOString() };
+  if (s2.user.disabled) return null;
+  return {
+    id: s2.user.id,
+    email: s2.user.email,
+    role: s2.user.role,
+    createdAt: s2.user.createdAt.toISOString()
+  };
 }
 async function deleteSession(token) {
   await prisma.session.deleteMany({ where: { id: sessionId(token) } });
@@ -30066,8 +30198,83 @@ function cookieOpts() {
   };
 }
 
+// src/routes/client-accounts.ts
+var view9 = (u) => ({
+  id: u.id,
+  email: u.email,
+  disabled: u.disabled,
+  createdAt: u.createdAt.toISOString(),
+  projects: u.projectAccess.map((a) => a.projectId).sort()
+});
+var load = (id) => prisma.user.findFirst({
+  where: { id, role: "client" },
+  include: { projectAccess: { select: { projectId: true } } }
+});
+async function setAccess(userId, projects) {
+  const ids = [...new Set(projects)];
+  const known = await prisma.project.findMany({ where: { id: { in: ids } }, select: { id: true } });
+  if (known.length !== ids.length) return null;
+  await prisma.clientProjectAccess.deleteMany({ where: { userId, projectId: { notIn: ids } } });
+  for (const projectId of ids)
+    await prisma.clientProjectAccess.upsert({
+      where: { userId_projectId: { userId, projectId } },
+      update: {},
+      create: { userId, projectId }
+    });
+  return ids;
+}
+async function client_accounts_default(app2) {
+  app2.get("/client-accounts", async () => {
+    const rows = await prisma.user.findMany({
+      where: { role: "client" },
+      orderBy: { createdAt: "asc" },
+      include: { projectAccess: { select: { projectId: true } } }
+    });
+    return { items: rows.map(view9) };
+  });
+  app2.post("/client-accounts", async (req, reply) => {
+    const p = zCreateClientAccount.safeParse(req.body);
+    if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
+    if (await prisma.user.findUnique({ where: { email: p.data.email } }))
+      return reply.code(409).send({ error: "email dipakai" });
+    const user = await prisma.user.create({
+      data: { email: p.data.email, passwordHash: await hashPassword(p.data.password), role: "client" }
+    });
+    if (await setAccess(user.id, p.data.projects) === null) {
+      await prisma.user.delete({ where: { id: user.id } });
+      return reply.code(400).send({ error: "ada project yang tidak dikenal" });
+    }
+    return reply.code(201).send(view9(await load(user.id)));
+  });
+  app2.patch("/client-accounts/:id", async (req, reply) => {
+    const { id } = req.params;
+    const p = zUpdateClientAccount.safeParse(req.body);
+    if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
+    if (!await load(id)) return reply.code(404).send({ error: "not found" });
+    if (p.data.projects && await setAccess(id, p.data.projects) === null)
+      return reply.code(400).send({ error: "ada project yang tidak dikenal" });
+    if (p.data.disabled !== void 0)
+      await prisma.user.update({ where: { id }, data: { disabled: p.data.disabled } });
+    if (p.data.password)
+      await prisma.user.update({ where: { id }, data: { passwordHash: await hashPassword(p.data.password) } });
+    if (p.data.disabled || p.data.password) await deleteUserSessions(id);
+    return view9(await load(id));
+  });
+  app2.delete("/client-accounts/:id", async (req, reply) => {
+    const { id } = req.params;
+    if (!await load(id)) return reply.code(404).send({ error: "not found" });
+    await prisma.user.delete({ where: { id } });
+    return reply.code(204).send();
+  });
+}
+
+// src/app.ts
+var import_multipart = __toESM(require_multipart2(), 1);
+
 // src/routes/auth.ts
-var view9 = (u) => ({ id: u.id, email: u.email, createdAt: u.createdAt.toISOString() });
+init_src();
+init_db();
+var view10 = (u) => ({ id: u.id, email: u.email, role: u.role, createdAt: u.createdAt.toISOString() });
 async function issue(reply, userId) {
   const token = await createSession2(userId);
   reply.setCookie(COOKIE_NAME, token, cookieOpts());
@@ -30085,20 +30292,20 @@ async function auth_default(app2) {
       data: { email: p.data.email, passwordHash: await hashPassword(p.data.password) }
     });
     await issue(reply, user.id);
-    return { user: view9(user) };
+    return { user: view10(user) };
   });
   app2.post("/auth/login", async (req, reply) => {
     if (loginThrottle(req.ip).blocked) return reply.code(429).send({ error: "too many attempts" });
     const p = zLogin.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
     const user = await prisma.user.findUnique({ where: { email: p.data.email } });
-    if (!user || !await verifyPassword(p.data.password, user.passwordHash)) {
+    if (!user || user.disabled || !await verifyPassword(p.data.password, user.passwordHash)) {
       noteLoginFail(req.ip);
       return reply.code(401).send({ error: "email atau password salah" });
     }
     clearLoginFails(req.ip);
     await issue(reply, user.id);
-    return { user: view9(user) };
+    return { user: view10(user) };
   });
   app2.post("/auth/logout", async (req, reply) => {
     const token = req.cookies?.[COOKIE_NAME];
@@ -30106,19 +30313,24 @@ async function auth_default(app2) {
     reply.clearCookie(COOKIE_NAME, { path: "/" });
     return reply.code(204).send();
   });
-  app2.get("/auth/users", async () => (await prisma.user.findMany({ orderBy: { createdAt: "asc" } })).map(view9));
+  app2.get("/auth/users", async () => (await prisma.user.findMany({ orderBy: { createdAt: "asc" } })).map(view10));
   app2.post("/auth/users", async (req, reply) => {
     const p = zSignup.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
     if (await prisma.user.findUnique({ where: { email: p.data.email } }))
       return reply.code(409).send({ error: "email dipakai" });
     const user = await prisma.user.create({
-      data: { email: p.data.email, passwordHash: await hashPassword(p.data.password) }
+      // SPEC-617 · pintu ini melahirkan OPERATOR. Akun klien punya pintunya sendiri
+      // (/api/client-accounts) supaya "undang rekan" dan "beri akses klien" tak pernah tertukar.
+      data: { email: p.data.email, passwordHash: await hashPassword(p.data.password), role: "admin" }
     });
-    return view9(user);
+    return view10(user);
   });
   app2.delete("/auth/users/:id", async (req, reply) => {
-    if (await prisma.user.count() <= 1) return reply.code(400).send({ error: "tak bisa hapus user terakhir" });
+    const target2 = await prisma.user.findUnique({ where: { id: req.params.id } });
+    if (!target2) return reply.code(204).send();
+    if (target2.role === "admin" && await prisma.user.count({ where: { role: "admin" } }) <= 1)
+      return reply.code(400).send({ error: "tak bisa hapus admin terakhir" });
     await prisma.user.deleteMany({ where: { id: req.params.id } });
     return reply.code(204).send();
   });
@@ -30135,7 +30347,7 @@ async function auth_default(app2) {
     });
     await deleteUserSessions(user.id);
     await issue(reply, user.id);
-    return { user: view9(user) };
+    return { user: view10(user) };
   });
 }
 
@@ -30148,15 +30360,15 @@ async function agent_tokens_default(app2) {
   app2.post("/agent-tokens", async (req, reply) => {
     const p = zAgentTokenCreate.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
-    const { view: view10, token } = await issueAgentToken({ ...p.data, createdBy: req.user?.id });
-    return reply.code(201).send({ ...view10, token });
+    const { view: view11, token } = await issueAgentToken({ ...p.data, createdBy: req.user?.id });
+    return reply.code(201).send({ ...view11, token });
   });
   app2.patch("/agent-tokens/:id", async (req, reply) => {
     const p = zAgentTokenPatch.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
     const { id } = req.params;
-    const view10 = await patchAgentToken(id, p.data);
-    return view10 ? reply.send(view10) : reply.code(404).send({ error: "not found" });
+    const view11 = await patchAgentToken(id, p.data);
+    return view11 ? reply.send(view11) : reply.code(404).send({ error: "not found" });
   });
   app2.delete("/agent-tokens/:id", async (req, reply) => {
     const { id } = req.params;
@@ -30201,7 +30413,7 @@ function capabilityForRoute(method, path) {
   const rw = (d) => `${d}:${read ? "read" : "write"}`;
   const seg = path.replace(/^\/api\/?/, "").replace(/\/+$/, "").split("/").filter(Boolean);
   const top = seg[0] ?? "";
-  if (top === "auth" || top === "agent-tokens" || top === "device-tokens" || top === "sync") return "COOKIE_ONLY";
+  if (top === "auth" || top === "agent-tokens" || top === "device-tokens" || top === "sync" || top === "portal" || top === "client-accounts") return "COOKIE_ONLY";
   if (top === "limits" || top === "update" || top === "events" || top === "fs" || top === "health")
     return read ? "GLOBAL_READ" : "COOKIE_ONLY";
   if (top === "scheduler") return rw("settings");
@@ -30400,6 +30612,8 @@ function buildApp({ requireAuth = true, agentDocFile } = {}) {
         if (user) req.user = user;
         const path = req.url.split("?")[0] ?? req.url;
         if (PUBLIC.has(`${req.method} ${path}`)) return;
+        if (user?.role === "client" && !clientRouteAllowed(req.method, path))
+          return reply.code(403).send({ error: "portal klien: baca-saja" });
         if (path.startsWith("/api/sync") && path !== "/api/sync/now" && !path.startsWith("/api/sync/conflicts")) return;
         if (path.startsWith("/api/help")) return;
         if (user) return;
@@ -30455,6 +30669,8 @@ function buildApp({ requireAuth = true, agentDocFile } = {}) {
     await api.register(telegramRoutes);
     await api.register(webhooks_default);
     await api.register(changelog_default);
+    await api.register(portal_default);
+    await api.register(client_accounts_default);
   }, { prefix: "/api" });
   if (process.env.NODE_ENV === "production") {
     const dist = pickWebDir(dirname13(fileURLToPath4(import.meta.url)), process.env, existsSync13);

package/docs/agent-integration.md

@@ -145,6 +145,10 @@ token selalu **403**, apa pun capability-nya, dan tak ada capability yang bisa m
   mengalir keluar (ADR-0100)
 - `/api/telegram/settings`, `/api/telegram/test`, `/api/telegram/credentials` — permukaan
   **kredensial** (bot token & agent token), beda dari sisa `/api/telegram*` (ADR-0097)
+- `/api/portal*` — portal klien: isinya ditentukan **akun yang login** (`ClientProjectAccess`), jadi
+  tak ada capability yang bisa berarti apa pun di sana. Backlog & tiket yang sama tersedia lewat
+  `/api/specs` dan `/api/tickets` dengan capability `backlog`/`support` (ADR-0110)
+- `/api/client-accounts*` — membuat & mencabut akun klien beserta password awalnya (ADR-0110)
 - `POST /api/update/apply` dan tulis lain di bawah prefix status (`/api/limits`, `/api/update`,
   `/api/events`, `/api/fs`, `/api/health`) — **baca**-nya terbuka untuk token mana pun, **tulis**-nya
   cookie-only

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanoman",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Orchestrator + dashboard workflow docs-driven untuk sesi Claude Code / Codex",
   "type": "module",
   "repository": {

package/prisma/migrations/20260810000000_client_portal_access/migration.sql

@@ -0,0 +1,15 @@
+-- SPEC-617 · ADR-0110 · peran user + pemetaan akun klien → project.
+-- Additif & aman untuk DB yang sudah berjalan: user lama mendapat role 'admin' lewat DEFAULT,
+-- jadi tak ada akses yang putus. (SQLite hanya melarang DEFAULT CURRENT_TIMESTAMP.)
+ALTER TABLE "User" ADD COLUMN "role" TEXT NOT NULL DEFAULT 'admin';
+ALTER TABLE "User" ADD COLUMN "disabled" BOOLEAN NOT NULL DEFAULT false;
+
+CREATE TABLE "ClientProjectAccess" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "userId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "ClientProjectAccess_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "ClientProjectAccess_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+CREATE UNIQUE INDEX "ClientProjectAccess_userId_projectId_key" ON "ClientProjectAccess"("userId", "projectId");

package/prisma/schema.prisma

@@ -29,6 +29,7 @@ model Project {
   customAgents CustomAgent[] // SPEC-450 · ADR-0094 · custom agent milik project ini
   githubIssues GithubIssue[] // SPEC-471 · ADR-0095 · cermin issue repo GitHub project ini
   changelogs   Changelog[]   // SPEC-516 · ADR-0105 · changelog tersimpan project ini
+  clientAccess ClientProjectAccess[] // SPEC-617 · ADR-0110 · akun klien yang boleh melihat project ini
 }
 
 model Spec {
@@ -188,14 +189,37 @@ model Notification {
   readAt    DateTime?
 }
 
-// SPEC-169 · auth. passwordHash = scrypt "<saltHex>:<hashHex>". Tak ada RBAC — semua user setara.
+// SPEC-169 · auth. passwordHash = scrypt "<saltHex>:<hashHex>".
+// SPEC-617 · ADR-0110 · dua peran: `admin` (operator, akses penuh seperti sebelumnya) dan
+// `client` (portal baca-saja ber-scope project). Default `"admin"` DISENGAJA: itulah yang
+// membuat migrasi aman untuk instance yang sudah berjalan — setiap baris lama otomatis admin,
+// tak ada akses yang putus dan tak ada backfill manual.
 model User {
   id           String    @id @default(cuid())
   email        String    @unique
   passwordHash String
+  role         String    @default("admin")
+  // SPEC-617 · nonaktif ditolak di login DAN di lookupSession; hanya menutup login berarti
+  // cookie yang sudah terbit tetap hidup sampai 7 hari (pencabutan yang tak mencabut).
+  disabled     Boolean   @default(false)
   createdAt    DateTime  @default(now())
   sessions     Session[]
   deviceTokens DeviceToken[]
+  projectAccess ClientProjectAccess[]
+}
+
+// SPEC-617 · ADR-0110 · project yang boleh dilihat sebuah akun klien. Tabel join, bukan kolom
+// Json: SQLite melarang scalar list, dan relasi memberi cascade delete gratis di kedua sisi.
+// LOCAL-only — cermin User/Session/AgentToken, tak pernah masuk SYNCED (services/sync.ts).
+model ClientProjectAccess {
+  id        String   @id @default(cuid())
+  userId    String
+  projectId String
+  createdAt DateTime @default(now())
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  project   Project  @relation(fields: [projectId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, projectId])
 }
 
 // SPEC-169 · sesi opaque revocable. id = sha256(token); token asli hanya ada di cookie httpOnly.

package/web/assets/{index-BXg9KRmB.css → index-CnAQHtuX.css}

@@ -1,4 +1,4 @@
-@import"https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:ital,wght@0,400;0,500;0,600;0,700;1,400&family=IBM+Plex+Serif:ital,wght@0,400;0,500;0,600;0,700;1,400&family=IBM+Plex+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap";:root{--ink-900: #17130c;--ink-800: #241d13;--ink-700: #3a3125;--ink-600: #574b3a;--ink-500: #6f6250;--ink-400: #90826c;--ink-300: #b3a794;--ink-200: #d6ccb9;--bone-000: #fffdf8;--bone-100: #faf6ec;--bone-200: #f2ebdc;--bone-300: #e8dfcc;--bone-400: #dccfb6;--brass-700: #7a5417;--brass-600: #97671f;--brass-500: #b8863b;--brass-400: #cf9d55;--brass-300: #e3c988;--brass-100: #f3e6c4;--brass-050: #faf2df;--wind-700: #2f5560;--wind-600: #3f6e7a;--wind-500: #517f8c;--wind-100: #dbe7ea;--wind-050: #eef4f5;--leaf-600: #4d6b30;--leaf-500: #5f8340;--leaf-100: #e6eed7;--amber-600: #b3771a;--amber-500: #cf8f28;--amber-100: #f7e9c9;--clay-600: #a23b2e;--clay-500: #bd4a3a;--clay-100: #f5dcd6;--term-bg: #1c1810;--term-fg: #e9e0cd;--term-dim: #8f8467;--term-line: #2c2618;--surface-page: var(--bone-100);--surface-panel: var(--bone-200);--surface-card: var(--bone-000);--surface-sunken: var(--bone-200);--surface-inverse: var(--ink-900);--surface-code: var(--term-bg);--text-strong: var(--ink-900);--text-body: var(--ink-700);--text-muted: var(--ink-500);--text-subtle: var(--ink-400);--text-on-brass: var(--ink-900);--text-on-dark: var(--term-fg);--text-link: var(--wind-600);--border-hair: var(--bone-300);--border-strong: var(--bone-400);--border-focus: var(--brass-500);--accent: var(--brass-500);--accent-hover: var(--brass-600);--accent-press: var(--brass-700);--accent-tint: var(--brass-100);--accent-on: var(--ink-900);--info: var(--wind-600);--info-tint: var(--wind-100);--status-ok: var(--leaf-600);--status-ok-tint: var(--leaf-100);--status-warn: var(--amber-600);--status-warn-tint: var(--amber-100);--status-err: var(--clay-600);--status-err-tint: var(--clay-100);--ring: 0 0 0 3px color-mix(in srgb, var(--brass-500) 45%, transparent)}:root{--font-serif: "IBM Plex Serif", Georgia, "Times New Roman", serif;--font-sans: "IBM Plex Sans", ui-sans-serif, system-ui, -apple-system, sans-serif;--font-mono: "IBM Plex Mono", ui-monospace, "SF Mono", Menlo, monospace;--font-display: var(--font-serif);--font-body: var(--font-sans);--font-ui: var(--font-sans);--font-code: var(--font-mono);--text-2xs: 11px;--text-xs: 12px;--text-sm: 13px;--text-md: 14px;--text-base:16px;--text-lg: 18px;--text-xl: 20px;--text-2xl: 24px;--text-3xl: 30px;--text-4xl: 38px;--text-5xl: 48px;--text-6xl: 62px;--weight-regular: 400;--weight-medium: 500;--weight-semibold: 600;--weight-bold: 700;--leading-tight: 1.12;--leading-snug: 1.3;--leading-normal: 1.5;--leading-relaxed:1.65;--tracking-tight: -.02em;--tracking-normal: 0;--tracking-wide: .02em;--tracking-caps: .14em}:root{--space-0: 0;--space-1: 4px;--space-2: 8px;--space-3: 12px;--space-4: 16px;--space-5: 20px;--space-6: 24px;--space-7: 32px;--space-8: 40px;--space-9: 48px;--space-10: 64px;--space-11: 80px;--space-12: 96px;--radius-xs: 3px;--radius-sm: 5px;--radius-md: 8px;--radius-lg: 12px;--radius-xl: 16px;--radius-pill: 999px;--border-thin: 1px;--border-med: 1.5px;--border-thick:2px;--content-max: 1200px;--sidebar-w: 248px;--topbar-h: 56px}:root{--shadow-xs: 0 1px 1px rgba(35, 27, 15, .05);--shadow-sm: 0 1px 2px rgba(35, 27, 15, .06), 0 1px 1px rgba(35, 27, 15, .04);--shadow-md: 0 2px 4px rgba(35, 27, 15, .07), 0 4px 12px rgba(35, 27, 15, .06);--shadow-lg: 0 8px 24px rgba(35, 27, 15, .1), 0 2px 6px rgba(35, 27, 15, .06);--shadow-xl: 0 20px 48px rgba(35, 27, 15, .16), 0 4px 12px rgba(35, 27, 15, .08);--shadow-inset: inset 0 1px 2px rgba(35, 27, 15, .08);--shadow-gild: 0 1px 0 rgba(255, 253, 248, .6) inset, 0 0 0 1px var(--brass-300);--elevation-flat: none;--elevation-raised: var(--shadow-sm);--elevation-float: var(--shadow-md);--elevation-overlay:var(--shadow-lg);--elevation-modal: var(--shadow-xl);--ease-out: cubic-bezier(.22, .61, .36, 1);--ease-inout: cubic-bezier(.65, 0, .35, 1);--dur-fast: .12s;--dur-base: .18s;--dur-slow: .28s;--transition-base: all var(--dur-base) var(--ease-out);--transition-fast: all var(--dur-fast) var(--ease-out)}*,*:before,*:after{box-sizing:border-box}body{margin:0;background:var(--surface-page);color:var(--text-body);font-family:var(--font-body);font-size:var(--text-base);line-height:var(--leading-normal);-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}h1,h2,h3,h4{font-family:var(--font-display);color:var(--text-strong);line-height:var(--leading-tight);letter-spacing:var(--tracking-tight);font-weight:var(--weight-semibold);margin:0 0 var(--space-3)}p{margin:0 0 var(--space-3)}a{color:var(--text-link);text-decoration:none;border-bottom:1px solid color-mix(in srgb,var(--text-link) 35%,transparent);transition:var(--transition-fast)}a:hover{color:var(--wind-700);border-bottom-color:var(--wind-700)}code,kbd,samp,pre{font-family:var(--font-code);font-size:.92em}.hn-eyebrow{font-family:var(--font-mono);font-size:var(--text-2xs);font-weight:var(--weight-medium);letter-spacing:var(--tracking-caps);text-transform:uppercase;color:var(--text-muted)}::selection{background:var(--brass-100);color:var(--ink-900)}html,body{margin:0;height:100%;background:var(--surface-page)}#root{height:100vh;overflow:hidden}button{--accent-on: #fff}a{color:var(--text-link);text-decoration:none}a:hover{color:var(--wind-700);text-decoration:underline}.hn-md{color:var(--text-body);font-family:var(--font-sans);font-size:15px;line-height:1.72;overflow-wrap:anywhere}.hn-md>:first-child{margin-top:8px}.hn-md h1,.hn-md h2,.hn-md h3,.hn-md h4{font-family:var(--font-display);font-weight:600;letter-spacing:-.02em;color:var(--ink-900);line-height:1.2;margin:1.6em 0 .5em}.hn-md h1{font-size:30px;margin-top:.4em;padding-bottom:.34em;border-bottom:1px solid var(--border-hair)}.hn-md h2{font-size:22px}.hn-md h3{font-size:18px}.hn-md h4{font-size:15px}.hn-md p{margin:.7em 0}.hn-md ul,.hn-md ol{margin:.6em 0;padding-left:1.5em}.hn-md li{margin:.28em 0}.hn-md li::marker{color:var(--brass-500)}.hn-md ul.contains-task-list,.hn-md li.task-list-item{list-style:none}.hn-md li.task-list-item{padding-left:0}.hn-md input[type=checkbox]{accent-color:var(--brass-500);margin-right:8px;transform:translateY(1px)}.hn-md strong{font-weight:600;color:var(--ink-900)}.hn-md em{color:var(--text-muted)}.hn-md a{color:var(--text-link)}.hn-md hr{border:none;border-top:1px solid var(--border-hair);margin:1.6em 0}.hn-md code{font-family:var(--font-mono);font-size:.86em;background:var(--bone-200);color:var(--ink-800);padding:1.5px 5px;border-radius:var(--radius-xs);border:1px solid var(--border-hair)}.hn-md pre{background:var(--surface-code);border:1px solid var(--term-line);border-radius:var(--radius-lg);padding:14px 16px;overflow:auto;margin:1em 0;white-space:pre-wrap;overflow-wrap:anywhere}.hn-md pre code{background:transparent;border:none;padding:0;color:var(--term-fg);font-size:12.5px;line-height:1.7}.hn-md blockquote{margin:1em 0;padding:4px 16px;border-left:3px solid var(--brass-500);background:var(--brass-050);color:var(--text-body);border-radius:0 var(--radius-sm) var(--radius-sm) 0}.hn-md blockquote p{margin:.4em 0}.hn-md table{border-collapse:collapse;width:100%;margin:1em 0;font-size:14px;table-layout:fixed}.hn-md th,.hn-md td{overflow-wrap:anywhere}.hn-md th{font-family:var(--font-mono);font-size:11px;text-transform:uppercase;letter-spacing:.08em;color:var(--text-muted);text-align:left;padding:8px 12px;background:var(--bone-100);border:1px solid var(--border-hair)}.hn-md td{padding:8px 12px;border:1px solid var(--border-hair);color:var(--text-body)}.hn-md td code{font-size:.82em}.hn-md img{max-width:100%;border-radius:var(--radius-sm)}@keyframes hn-fade-in{0%{opacity:0}to{opacity:1}}@keyframes hn-modal-in{0%{opacity:0;transform:translateY(8px) scale(.99)}to{opacity:1;transform:none}}@keyframes hn-toast-in{0%{opacity:0;transform:translate(-50%,10px)}to{opacity:1;transform:translate(-50%)}}/**
+@import"https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:ital,wght@0,400;0,500;0,600;0,700;1,400&family=IBM+Plex+Serif:ital,wght@0,400;0,500;0,600;0,700;1,400&family=IBM+Plex+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap";:root{--ink-900: #17130c;--ink-800: #241d13;--ink-700: #3a3125;--ink-600: #574b3a;--ink-500: #6f6250;--ink-400: #90826c;--ink-300: #b3a794;--ink-200: #d6ccb9;--bone-000: #fffdf8;--bone-100: #faf6ec;--bone-200: #f2ebdc;--bone-300: #e8dfcc;--bone-400: #dccfb6;--brass-700: #7a5417;--brass-600: #97671f;--brass-500: #b8863b;--brass-400: #cf9d55;--brass-300: #e3c988;--brass-100: #f3e6c4;--brass-050: #faf2df;--wind-700: #2f5560;--wind-600: #3f6e7a;--wind-500: #517f8c;--wind-100: #dbe7ea;--wind-050: #eef4f5;--leaf-600: #4d6b30;--leaf-500: #5f8340;--leaf-100: #e6eed7;--amber-600: #b3771a;--amber-500: #cf8f28;--amber-100: #f7e9c9;--clay-600: #a23b2e;--clay-500: #bd4a3a;--clay-100: #f5dcd6;--term-bg: #1c1810;--term-fg: #e9e0cd;--term-dim: #8f8467;--term-line: #2c2618;--surface-page: var(--bone-100);--surface-panel: var(--bone-200);--surface-card: var(--bone-000);--surface-sunken: var(--bone-200);--surface-inverse: var(--ink-900);--surface-code: var(--term-bg);--text-strong: var(--ink-900);--text-body: var(--ink-700);--text-muted: var(--ink-500);--text-subtle: var(--ink-400);--text-on-brass: var(--ink-900);--text-on-dark: var(--term-fg);--text-link: var(--wind-600);--border-hair: var(--bone-300);--border-strong: var(--bone-400);--border-focus: var(--brass-500);--accent: var(--brass-500);--accent-hover: var(--brass-600);--accent-press: var(--brass-700);--accent-tint: var(--brass-100);--accent-on: var(--ink-900);--info: var(--wind-600);--info-tint: var(--wind-100);--status-ok: var(--leaf-600);--status-ok-tint: var(--leaf-100);--status-warn: var(--amber-600);--status-warn-tint: var(--amber-100);--status-err: var(--clay-600);--status-err-tint: var(--clay-100);--ring: 0 0 0 3px color-mix(in srgb, var(--brass-500) 45%, transparent)}:root{--font-serif: "IBM Plex Serif", Georgia, "Times New Roman", serif;--font-sans: "IBM Plex Sans", ui-sans-serif, system-ui, -apple-system, sans-serif;--font-mono: "IBM Plex Mono", ui-monospace, "SF Mono", Menlo, monospace;--font-display: var(--font-serif);--font-body: var(--font-sans);--font-ui: var(--font-sans);--font-code: var(--font-mono);--text-2xs: 11px;--text-xs: 12px;--text-sm: 13px;--text-md: 14px;--text-base:16px;--text-lg: 18px;--text-xl: 20px;--text-2xl: 24px;--text-3xl: 30px;--text-4xl: 38px;--text-5xl: 48px;--text-6xl: 62px;--weight-regular: 400;--weight-medium: 500;--weight-semibold: 600;--weight-bold: 700;--leading-tight: 1.12;--leading-snug: 1.3;--leading-normal: 1.5;--leading-relaxed:1.65;--tracking-tight: -.02em;--tracking-normal: 0;--tracking-wide: .02em;--tracking-caps: .14em}:root{--space-0: 0;--space-1: 4px;--space-2: 8px;--space-3: 12px;--space-4: 16px;--space-5: 20px;--space-6: 24px;--space-7: 32px;--space-8: 40px;--space-9: 48px;--space-10: 64px;--space-11: 80px;--space-12: 96px;--radius-xs: 3px;--radius-sm: 5px;--radius-md: 8px;--radius-lg: 12px;--radius-xl: 16px;--radius-pill: 999px;--border-thin: 1px;--border-med: 1.5px;--border-thick:2px;--content-max: 1200px;--sidebar-w: 248px;--topbar-h: 56px}:root{--shadow-xs: 0 1px 1px rgba(35, 27, 15, .05);--shadow-sm: 0 1px 2px rgba(35, 27, 15, .06), 0 1px 1px rgba(35, 27, 15, .04);--shadow-md: 0 2px 4px rgba(35, 27, 15, .07), 0 4px 12px rgba(35, 27, 15, .06);--shadow-lg: 0 8px 24px rgba(35, 27, 15, .1), 0 2px 6px rgba(35, 27, 15, .06);--shadow-xl: 0 20px 48px rgba(35, 27, 15, .16), 0 4px 12px rgba(35, 27, 15, .08);--shadow-inset: inset 0 1px 2px rgba(35, 27, 15, .08);--shadow-gild: 0 1px 0 rgba(255, 253, 248, .6) inset, 0 0 0 1px var(--brass-300);--elevation-flat: none;--elevation-raised: var(--shadow-sm);--elevation-float: var(--shadow-md);--elevation-overlay:var(--shadow-lg);--elevation-modal: var(--shadow-xl);--ease-out: cubic-bezier(.22, .61, .36, 1);--ease-inout: cubic-bezier(.65, 0, .35, 1);--dur-fast: .12s;--dur-base: .18s;--dur-slow: .28s;--transition-base: all var(--dur-base) var(--ease-out);--transition-fast: all var(--dur-fast) var(--ease-out)}*,*:before,*:after{box-sizing:border-box}body{margin:0;background:var(--surface-page);color:var(--text-body);font-family:var(--font-body);font-size:var(--text-base);line-height:var(--leading-normal);-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}h1,h2,h3,h4{font-family:var(--font-display);color:var(--text-strong);line-height:var(--leading-tight);letter-spacing:var(--tracking-tight);font-weight:var(--weight-semibold);margin:0 0 var(--space-3)}p{margin:0 0 var(--space-3)}a{color:var(--text-link);text-decoration:none;border-bottom:1px solid color-mix(in srgb,var(--text-link) 35%,transparent);transition:var(--transition-fast)}a:hover{color:var(--wind-700);border-bottom-color:var(--wind-700)}code,kbd,samp,pre{font-family:var(--font-code);font-size:.92em}.hn-eyebrow{font-family:var(--font-mono);font-size:var(--text-2xs);font-weight:var(--weight-medium);letter-spacing:var(--tracking-caps);text-transform:uppercase;color:var(--text-muted)}::selection{background:var(--brass-100);color:var(--ink-900)}html,body{margin:0;height:100%;background:var(--surface-page)}#root{height:100vh;overflow:hidden}button{--accent-on: #fff}a{color:var(--text-link);text-decoration:none}a:hover{color:var(--wind-700);text-decoration:underline}.hn-md{color:var(--text-body);font-family:var(--font-sans);font-size:15px;line-height:1.72;overflow-wrap:anywhere}.hn-md>:first-child{margin-top:8px}.hn-md h1,.hn-md h2,.hn-md h3,.hn-md h4{font-family:var(--font-display);font-weight:600;letter-spacing:-.02em;color:var(--ink-900);line-height:1.2;margin:1.6em 0 .5em}.hn-md h1{font-size:30px;margin-top:.4em;padding-bottom:.34em;border-bottom:1px solid var(--border-hair)}.hn-md h2{font-size:22px}.hn-md h3{font-size:18px}.hn-md h4{font-size:15px}.hn-md p{margin:.7em 0}.hn-md ul,.hn-md ol{margin:.6em 0;padding-left:1.5em}.hn-md li{margin:.28em 0}.hn-md li::marker{color:var(--brass-500)}.hn-md ul.contains-task-list,.hn-md li.task-list-item{list-style:none}.hn-md li.task-list-item{padding-left:0}.hn-md input[type=checkbox]{accent-color:var(--brass-500);margin-right:8px;transform:translateY(1px)}.hn-md strong{font-weight:600;color:var(--ink-900)}.hn-md em{color:var(--text-muted)}.hn-md a{color:var(--text-link)}.hn-md hr{border:none;border-top:1px solid var(--border-hair);margin:1.6em 0}.hn-md code{font-family:var(--font-mono);font-size:.86em;background:var(--bone-200);color:var(--ink-800);padding:1.5px 5px;border-radius:var(--radius-xs);border:1px solid var(--border-hair)}.hn-md pre{background:var(--surface-code);border:1px solid var(--term-line);border-radius:var(--radius-lg);padding:14px 16px;overflow:auto;margin:1em 0;white-space:pre-wrap;overflow-wrap:anywhere}.hn-md pre code{background:transparent;border:none;padding:0;color:var(--term-fg);font-size:12.5px;line-height:1.7}.hn-md blockquote{margin:1em 0;padding:4px 16px;border-left:3px solid var(--brass-500);background:var(--brass-050);color:var(--text-body);border-radius:0 var(--radius-sm) var(--radius-sm) 0}.hn-md blockquote p{margin:.4em 0}.hn-md table{border-collapse:collapse;width:100%;margin:1em 0;font-size:14px;table-layout:fixed}.hn-md th,.hn-md td{overflow-wrap:anywhere}.hn-md th{font-family:var(--font-mono);font-size:11px;text-transform:uppercase;letter-spacing:.08em;color:var(--text-muted);text-align:left;padding:8px 12px;background:var(--bone-100);border:1px solid var(--border-hair)}.hn-md td{padding:8px 12px;border:1px solid var(--border-hair);color:var(--text-body)}.hn-md td code{font-size:.82em}.hn-md img{max-width:100%;border-radius:var(--radius-sm)}@keyframes hn-fade-in{0%{opacity:0}to{opacity:1}}@keyframes hn-modal-in{0%{opacity:0;transform:translateY(8px) scale(.99)}to{opacity:1;transform:none}}@keyframes hn-toast-in{0%{opacity:0;transform:translate(-50%,10px)}to{opacity:1;transform:translate(-50%)}}@keyframes hn-pet-breathe{0%{transform:translateY(0) scale(1)}to{transform:translateY(-3px) scale(1.025)}}/**
  * Copyright (c) 2014 The xterm.js authors. All rights reserved.
  * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
  * https://github.com/chjj/term.js