hanoman 0.1.23 → 0.1.25

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.23",
-  "sha": "eea3d70",
-  "builtAt": "2026-08-08T09:16:09.486Z"
+  "version": "0.1.25",
+  "sha": "53d6464",
+  "builtAt": "2026-08-10T04:26:46.836Z"
 }

package/dist/cli.js

@@ -4986,7 +4986,7 @@ var init_prd_status = __esm({
 });
 
 // ../shared/src/dto.ts
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, zLogin, zSignup, zChangePassword, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5400,12 +5400,24 @@ var init_dto = __esm({
       password: external_exports.string().min(1)
       // SPEC-165 · diisi = bootstrap ulang
     }).partial();
+    USER_ROLES = ["admin", "client"];
+    zUserRole = external_exports.enum(USER_ROLES);
     zLogin = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(1) });
     zSignup = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(8) });
     zChangePassword = external_exports.object({
       currentPassword: external_exports.string().min(1),
       newPassword: external_exports.string().min(8)
     });
+    zCreateClientAccount = external_exports.object({
+      email: external_exports.string().email(),
+      password: external_exports.string().min(8),
+      projects: external_exports.array(external_exports.string().min(1)).default([])
+    });
+    zUpdateClientAccount = external_exports.object({
+      projects: external_exports.array(external_exports.string().min(1)),
+      disabled: external_exports.boolean(),
+      password: external_exports.string().min(8)
+    }).partial();
     zVpsCheck = external_exports.object({
       check: external_exports.string(),
       status: external_exports.enum(["pass", "fail", "warn", "na"]),
@@ -5741,6 +5753,14 @@ var init_ticket_status = __esm({
   }
 });
 
+// ../shared/src/portal.ts
+var init_portal = __esm({
+  "../shared/src/portal.ts"() {
+    "use strict";
+    init_ticket_status();
+  }
+});
+
 // ../shared/src/session-kind.ts
 var SESSION_KINDS, zSessionKind;
 var init_session_kind = __esm({
@@ -7022,6 +7042,7 @@ var init_src = __esm({
     init_api();
     init_coverage();
     init_ticket_status();
+    init_portal();
     init_prd_status();
     init_session_kind();
     init_config();
@@ -28591,7 +28612,9 @@ var init_migrate_pg = __esm({
       // SPEC-516 · ADR-0105 · Changelog sesudah Project (FK projectId). Tabel ini LOCAL-only dan
       // lazimnya TIDAK ada di sumber Postgres lama — jalur 42P01 memperlakukannya sebagai nol baris.
       "Changelog",
+      // SPEC-617 · ADR-0110 · ClientProjectAccess sesudah User DAN Project (FK ke keduanya).
       "User",
+      "ClientProjectAccess",
       "Session",
       "DeviceToken",
       "AgentToken",

package/dist/server.js

@@ -5237,7 +5237,7 @@ var init_prd_status = __esm({
 function flowForSource(source) {
   return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "goal" ? "goal" : "feature";
 }
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, zLogin, zSignup, zChangePassword, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5651,12 +5651,24 @@ var init_dto = __esm({
       password: external_exports.string().min(1)
       // SPEC-165 · diisi = bootstrap ulang
     }).partial();
+    USER_ROLES = ["admin", "client"];
+    zUserRole = external_exports.enum(USER_ROLES);
     zLogin = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(1) });
     zSignup = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(8) });
     zChangePassword = external_exports.object({
       currentPassword: external_exports.string().min(1),
       newPassword: external_exports.string().min(8)
     });
+    zCreateClientAccount = external_exports.object({
+      email: external_exports.string().email(),
+      password: external_exports.string().min(8),
+      projects: external_exports.array(external_exports.string().min(1)).default([])
+    });
+    zUpdateClientAccount = external_exports.object({
+      projects: external_exports.array(external_exports.string().min(1)),
+      disabled: external_exports.boolean(),
+      password: external_exports.string().min(8)
+    }).partial();
     zVpsCheck = external_exports.object({
       check: external_exports.string(),
       status: external_exports.enum(["pass", "fail", "warn", "na"]),
@@ -6002,6 +6014,44 @@ var init_ticket_status = __esm({
   }
 });
 
+// ../shared/src/portal.ts
+function toPortalProject(p) {
+  return { id: p.id, name: p.name };
+}
+function toPortalSpec(s2) {
+  return {
+    id: s2.id,
+    title: s2.title,
+    priority: s2.priority,
+    stage: s2.stage,
+    objective: s2.objective,
+    createdAt: iso(s2.createdAt),
+    startedAt: iso(s2.startedAt),
+    doneAt: iso(s2.doneAt)
+  };
+}
+function toPortalTicket(t, specStage) {
+  return {
+    id: t.id,
+    number: t.number,
+    category: t.category,
+    title: t.title,
+    status: publicStatus(t.status, specStage),
+    createdAt: iso(t.createdAt)
+  };
+}
+function toPortalTicketDetail(t, specStage) {
+  return { ...toPortalTicket(t, specStage), detail: t.detail };
+}
+var iso;
+var init_portal = __esm({
+  "../shared/src/portal.ts"() {
+    "use strict";
+    init_ticket_status();
+    iso = (d) => d == null ? null : typeof d === "string" ? d : d.toISOString();
+  }
+});
+
 // ../shared/src/session-kind.ts
 var SESSION_KINDS, zSessionKind;
 var init_session_kind = __esm({
@@ -6315,14 +6365,14 @@ function matchesEvent(subscribed, type) {
 }
 function projectRow(def2, row) {
   const out3 = {};
-  for (const f of def2.fields) if (f in row) out3[f] = iso(row[f]);
+  for (const f of def2.fields) if (f in row) out3[f] = iso2(row[f]);
   return out3;
 }
 function diffFields(def2, before, after) {
   const out3 = [];
   for (const f of def2.fields) {
     if (IGNORED_FIELDS.has(f)) continue;
-    if (JSON.stringify(iso(before[f]) ?? null) !== JSON.stringify(iso(after[f]) ?? null)) out3.push(f);
+    if (JSON.stringify(iso2(before[f]) ?? null) !== JSON.stringify(iso2(after[f]) ?? null)) out3.push(f);
   }
   return out3;
 }
@@ -6361,7 +6411,7 @@ function clampEnvelope(env) {
   }
   return { ...env, truncated: true, truncatedFields: fields };
 }
-var WEBHOOK_SPEC_VERSION, WEBHOOK_BACKOFF_SEC, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_FAIL_LIMIT, WEBHOOK_QUEUE_CAP, WEBHOOK_HISTORY_KEEP, WEBHOOK_MAX_BYTES, WEBHOOK_FIELD_MAX_CHARS, WEBHOOK_TIMEOUT_MS, WEBHOOK_DEFAULT_PER_MINUTE, WEBHOOK_PING_TYPE, WEBHOOK_USER_AGENT, WEBHOOK_HEADERS, SYSTEM_ACTOR, IGNORED_FIELDS, WEBHOOK_ENTITIES, BY_MODEL, WEBHOOK_EVENTS, webhookEventTypes, iso, zCreateWebhookEndpoint, zUpdateWebhookEndpoint;
+var WEBHOOK_SPEC_VERSION, WEBHOOK_BACKOFF_SEC, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_FAIL_LIMIT, WEBHOOK_QUEUE_CAP, WEBHOOK_HISTORY_KEEP, WEBHOOK_MAX_BYTES, WEBHOOK_FIELD_MAX_CHARS, WEBHOOK_TIMEOUT_MS, WEBHOOK_DEFAULT_PER_MINUTE, WEBHOOK_PING_TYPE, WEBHOOK_USER_AGENT, WEBHOOK_HEADERS, SYSTEM_ACTOR, IGNORED_FIELDS, WEBHOOK_ENTITIES, BY_MODEL, WEBHOOK_EVENTS, webhookEventTypes, iso2, zCreateWebhookEndpoint, zUpdateWebhookEndpoint;
 var init_webhook = __esm({
   "../shared/src/webhook.ts"() {
     "use strict";
@@ -6718,7 +6768,7 @@ var init_webhook = __esm({
       }
     ];
     webhookEventTypes = () => WEBHOOK_EVENTS.map((e) => e.type);
-    iso = (v) => v instanceof Date ? v.toISOString() : v;
+    iso2 = (v) => v instanceof Date ? v.toISOString() : v;
     zCreateWebhookEndpoint = external_exports.object({
       name: external_exports.string().trim().min(1).max(80),
       url: external_exports.string().trim().min(1).max(2e3),
@@ -7381,6 +7431,7 @@ var init_src = __esm({
     init_api();
     init_coverage();
     init_ticket_status();
+    init_portal();
     init_prd_status();
     init_session_kind();
     init_config();
@@ -26043,10 +26094,64 @@ async function pruneOldTickets(now = Date.now()) {
   }
 }
 
+// src/services/ticket-intake.ts
+init_db();
+var TICKET_UPLOAD = {
+  MAX_FILES: 3,
+  MAX_BYTES: 5 * 1024 * 1024,
+  OK_MIME: /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"])
+};
+async function parseTicketUpload(req) {
+  const fields = {};
+  const files = [];
+  try {
+    for await (const part of req.parts()) {
+      if (part.type === "file") {
+        const buf = await part.toBuffer();
+        if (part.file?.truncated || !TICKET_UPLOAD.OK_MIME.has(part.mimetype) || files.length >= TICKET_UPLOAD.MAX_FILES) continue;
+        files.push({ buf, mime: part.mimetype, name: String(part.filename ?? "gambar") });
+      } else {
+        fields[part.fieldname] = String(part.value ?? "");
+      }
+    }
+  } catch {
+    return null;
+  }
+  return { fields, files };
+}
+async function intakeTicket(input) {
+  const { ticket, key } = await createTicket({
+    projectId: input.projectId,
+    category: input.category,
+    title: input.title,
+    detail: input.detail,
+    reporterEmail: input.reporterEmail
+  });
+  await notifySynced("ticket", ticket.id);
+  for (const f of input.files) {
+    const { storageKey, size } = await saveUpload(f.buf, f.mime);
+    const att = await prisma.ticketAttachment.create({
+      data: {
+        ticketId: ticket.id,
+        projectId: input.projectId,
+        filename: f.name.slice(0, 200),
+        mimeType: f.mime,
+        size,
+        storageKey
+      }
+    });
+    await notifySynced("ticketAttachment", att.id);
+  }
+  await recordNewTicket(ticket.id, input.projectId, input.projectName, input.category, input.title);
+  void pruneOldTickets();
+  return { ticket, key };
+}
+
 // src/services/help-ratelimit.ts
 init_config2();
 var ipBuckets = /* @__PURE__ */ new Map();
 var projBuckets = /* @__PURE__ */ new Map();
+var acctBuckets = /* @__PURE__ */ new Map();
 function take(map, k, cap, now) {
   const b = map.get(k) ?? { tokens: cap, ts: now };
   b.tokens = Math.min(cap, b.tokens + (now - b.ts) * cap / 6e4);
@@ -26064,13 +26169,15 @@ function helpRateOk(projectId, ip, now = Date.now()) {
   const projCap = effectiveInt("HANOMAN_HELP_RATE_PER_MIN_PROJECT") ?? 20;
   return take(ipBuckets, ip, ipCap, now) && take(projBuckets, projectId, projCap, now);
 }
+function portalTicketRateOk(userId, projectId, now = Date.now()) {
+  const acctCap = effectiveInt("HANOMAN_PORTAL_TICKET_RATE_PER_MIN") ?? 5;
+  const projCap = effectiveInt("HANOMAN_HELP_RATE_PER_MIN_PROJECT") ?? 20;
+  return take(acctBuckets, userId, acctCap, now) && take(projBuckets, projectId, projCap, now);
+}
 
 // src/routes/help.ts
 var CATEGORIES = ["bug", "fitur", "pertanyaan", "lainnya"];
 var HONEYPOT_FIELD = "hc_trap";
-var OK_MIME = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"]);
-var MAX_FILES2 = 3;
-var MAX_BYTES = 5 * 1024 * 1024;
 var zField = external_exports.object({
   category: zTicketCategory,
   title: external_exports.string().min(1).max(200),
@@ -26090,21 +26197,9 @@ async function help_default(app2) {
     if (!p || !p.helpEnabled) return reply.code(404).send({ error: "not found" });
     if (!helpRateOk(slug, req.ip)) return reply.code(429).send({ error: "terlalu banyak permintaan" });
     if (!req.isMultipart?.()) return reply.code(400).send({ error: "butuh multipart/form-data" });
-    const fields = {};
-    const files = [];
-    try {
-      for await (const part of req.parts()) {
-        if (part.type === "file") {
-          const buf = await part.toBuffer();
-          if (part.file?.truncated || !OK_MIME.has(part.mimetype) || files.length >= MAX_FILES2) continue;
-          files.push({ buf, mime: part.mimetype, name: String(part.filename ?? "gambar") });
-        } else {
-          fields[part.fieldname] = String(part.value ?? "");
-        }
-      }
-    } catch {
-      return reply.code(400).send({ error: "unggahan tak valid" });
-    }
+    const upload = await parseTicketUpload(req);
+    if (!upload) return reply.code(400).send({ error: "unggahan tak valid" });
+    const { fields, files } = upload;
     if (fields[HONEYPOT_FIELD]) {
       console.warn(`help: honeypot terpicu \xB7 project=${slug} ip=${req.ip}`);
       return reply.code(200).send({ ok: true });
@@ -26116,23 +26211,15 @@ async function help_default(app2) {
       email: fields.email
     });
     if (!parsed.success) return reply.code(400).send({ error: "field wajib tak lengkap / tak valid" });
-    const { ticket, key } = await createTicket({
+    const { ticket, key } = await intakeTicket({
       projectId: slug,
+      projectName: p.name,
       category: parsed.data.category,
       title: parsed.data.title,
       detail: parsed.data.detail,
-      reporterEmail: parsed.data.email
+      reporterEmail: parsed.data.email,
+      files
     });
-    await notifySynced("ticket", ticket.id);
-    for (const f of files) {
-      const { storageKey, size } = await saveUpload(f.buf, f.mime);
-      const att = await prisma.ticketAttachment.create({
-        data: { ticketId: ticket.id, projectId: slug, filename: f.name.slice(0, 200), mimeType: f.mime, size, storageKey }
-      });
-      await notifySynced("ticketAttachment", att.id);
-    }
-    await recordNewTicket(ticket.id, slug, p.name, parsed.data.category, parsed.data.title);
-    void pruneOldTickets();
     const statusPath = `/help/${encodeURIComponent(slug)}/status/${encodeURIComponent(key)}`;
     return reply.code(201).send({ number: ticket.number, key, statusPath });
   });
@@ -29986,10 +30073,117 @@ async function webhooks_default(app2) {
   });
 }
 
-// src/app.ts
-var import_multipart = __toESM(require_multipart2(), 1);
+// src/routes/portal.ts
+init_zod();
+init_src();
+init_db();
 
-// src/routes/auth.ts
+// src/services/client-access.ts
+init_db();
+var segments = (path) => path.replace(/^\/api\/?/, "").replace(/\/+$/, "").split("/").filter(Boolean);
+var isPortalTicketSubmit = (method, seg) => method === "POST" && seg.length === 4 && seg[1] === "projects" && seg[3] === "tickets";
+function clientRouteAllowed(method, path) {
+  const seg = segments(path);
+  if (seg.includes("..")) return false;
+  const top = seg[0] ?? "";
+  const read = method === "GET" || method === "HEAD";
+  if (top === "portal") return read || isPortalTicketSubmit(method, seg);
+  if (top === "help") return true;
+  if (top === "auth") {
+    const sub = seg[1] ?? "";
+    return method === "POST" && (sub === "logout" || sub === "change-password");
+  }
+  return false;
+}
+async function clientProjectIds(userId) {
+  const rows = await prisma.clientProjectAccess.findMany({
+    where: { userId },
+    select: { projectId: true },
+    orderBy: { projectId: "asc" }
+  });
+  return rows.map((r) => r.projectId);
+}
+async function hasProjectAccess(userId, projectId) {
+  return await prisma.clientProjectAccess.count({ where: { userId, projectId } }) > 0;
+}
+
+// src/routes/portal.ts
+var NOT_FOUND = { error: "not found" };
+var zPortalTicket = external_exports.object({
+  category: zTicketCategory,
+  title: external_exports.string().min(1).max(200),
+  detail: external_exports.string().min(1).max(1e4)
+});
+async function specStages(ids) {
+  const wanted = [...new Set(ids.filter((v) => !!v))];
+  if (!wanted.length) return /* @__PURE__ */ new Map();
+  const rows = await prisma.spec.findMany({ where: { id: { in: wanted } }, select: { id: true, stage: true } });
+  return new Map(rows.map((r) => [r.id, r.stage]));
+}
+async function portal_default(app2) {
+  app2.get("/portal/projects", async (req) => {
+    const ids = await clientProjectIds(req.user.id);
+    const rows = await prisma.project.findMany({ where: { id: { in: ids } }, orderBy: { name: "asc" } });
+    return { items: rows.map(toPortalProject) };
+  });
+  app2.get("/portal/projects/:id/backlog", async (req, reply) => {
+    const { id } = req.params;
+    if (!await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    const { page, limit } = req.query;
+    const specs = await liveSpecs({ project: id });
+    return paginate(specs.map(toPortalSpec), page, limit);
+  });
+  app2.get("/portal/projects/:id/backlog/:specId", async (req, reply) => {
+    const { id, specId } = req.params;
+    if (!await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    const spec = (await liveSpecs({ project: id })).find((s2) => s2.id === specId);
+    if (!spec) return reply.code(404).send(NOT_FOUND);
+    return toPortalSpec(spec);
+  });
+  app2.get("/portal/projects/:id/tickets", async (req, reply) => {
+    const { id } = req.params;
+    if (!await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    const { page, limit } = req.query;
+    const rows = await prisma.ticket.findMany({ where: { projectId: id }, orderBy: { createdAt: "desc" } });
+    const stages = await specStages(rows.map((t) => t.specId));
+    return paginate(rows.map((t) => toPortalTicket(t, stages.get(t.specId ?? "") ?? null)), page, limit);
+  });
+  app2.get("/portal/projects/:id/tickets/:ticketId", async (req, reply) => {
+    const { id, ticketId } = req.params;
+    if (!await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    const t = await prisma.ticket.findUnique({ where: { id: ticketId } });
+    if (!t || t.projectId !== id) return reply.code(404).send(NOT_FOUND);
+    const stages = await specStages([t.specId]);
+    return toPortalTicketDetail(t, stages.get(t.specId ?? "") ?? null);
+  });
+  app2.post("/portal/projects/:id/tickets", async (req, reply) => {
+    const { id } = req.params;
+    const p = await prisma.project.findUnique({ where: { id } });
+    if (!p || !await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    if (!portalTicketRateOk(req.user.id, id)) return reply.code(429).send({ error: "terlalu banyak permintaan" });
+    if (!req.isMultipart?.()) return reply.code(400).send({ error: "butuh multipart/form-data" });
+    const upload = await parseTicketUpload(req);
+    if (!upload) return reply.code(400).send({ error: "unggahan tak valid" });
+    const parsed = zPortalTicket.safeParse({
+      category: upload.fields.category,
+      title: upload.fields.title,
+      detail: upload.fields.detail
+    });
+    if (!parsed.success) return reply.code(400).send({ error: "field wajib tak lengkap / tak valid" });
+    const { ticket } = await intakeTicket({
+      projectId: id,
+      projectName: p.name,
+      category: parsed.data.category,
+      title: parsed.data.title,
+      detail: parsed.data.detail,
+      reporterEmail: req.user.email,
+      files: upload.files
+    });
+    return reply.code(201).send(toPortalTicket(ticket, null));
+  });
+}
+
+// src/routes/client-accounts.ts
 init_src();
 init_db();
 
@@ -30029,7 +30223,13 @@ async function lookupSession(token) {
     });
     return null;
   }
-  return { id: s2.user.id, email: s2.user.email, createdAt: s2.user.createdAt.toISOString() };
+  if (s2.user.disabled) return null;
+  return {
+    id: s2.user.id,
+    email: s2.user.email,
+    role: s2.user.role,
+    createdAt: s2.user.createdAt.toISOString()
+  };
 }
 async function deleteSession(token) {
   await prisma.session.deleteMany({ where: { id: sessionId(token) } });
@@ -30066,8 +30266,83 @@ function cookieOpts() {
   };
 }
 
+// src/routes/client-accounts.ts
+var view9 = (u) => ({
+  id: u.id,
+  email: u.email,
+  disabled: u.disabled,
+  createdAt: u.createdAt.toISOString(),
+  projects: u.projectAccess.map((a) => a.projectId).sort()
+});
+var load = (id) => prisma.user.findFirst({
+  where: { id, role: "client" },
+  include: { projectAccess: { select: { projectId: true } } }
+});
+async function setAccess(userId, projects) {
+  const ids = [...new Set(projects)];
+  const known = await prisma.project.findMany({ where: { id: { in: ids } }, select: { id: true } });
+  if (known.length !== ids.length) return null;
+  await prisma.clientProjectAccess.deleteMany({ where: { userId, projectId: { notIn: ids } } });
+  for (const projectId of ids)
+    await prisma.clientProjectAccess.upsert({
+      where: { userId_projectId: { userId, projectId } },
+      update: {},
+      create: { userId, projectId }
+    });
+  return ids;
+}
+async function client_accounts_default(app2) {
+  app2.get("/client-accounts", async () => {
+    const rows = await prisma.user.findMany({
+      where: { role: "client" },
+      orderBy: { createdAt: "asc" },
+      include: { projectAccess: { select: { projectId: true } } }
+    });
+    return { items: rows.map(view9) };
+  });
+  app2.post("/client-accounts", async (req, reply) => {
+    const p = zCreateClientAccount.safeParse(req.body);
+    if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
+    if (await prisma.user.findUnique({ where: { email: p.data.email } }))
+      return reply.code(409).send({ error: "email dipakai" });
+    const user = await prisma.user.create({
+      data: { email: p.data.email, passwordHash: await hashPassword(p.data.password), role: "client" }
+    });
+    if (await setAccess(user.id, p.data.projects) === null) {
+      await prisma.user.delete({ where: { id: user.id } });
+      return reply.code(400).send({ error: "ada project yang tidak dikenal" });
+    }
+    return reply.code(201).send(view9(await load(user.id)));
+  });
+  app2.patch("/client-accounts/:id", async (req, reply) => {
+    const { id } = req.params;
+    const p = zUpdateClientAccount.safeParse(req.body);
+    if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
+    if (!await load(id)) return reply.code(404).send({ error: "not found" });
+    if (p.data.projects && await setAccess(id, p.data.projects) === null)
+      return reply.code(400).send({ error: "ada project yang tidak dikenal" });
+    if (p.data.disabled !== void 0)
+      await prisma.user.update({ where: { id }, data: { disabled: p.data.disabled } });
+    if (p.data.password)
+      await prisma.user.update({ where: { id }, data: { passwordHash: await hashPassword(p.data.password) } });
+    if (p.data.disabled || p.data.password) await deleteUserSessions(id);
+    return view9(await load(id));
+  });
+  app2.delete("/client-accounts/:id", async (req, reply) => {
+    const { id } = req.params;
+    if (!await load(id)) return reply.code(404).send({ error: "not found" });
+    await prisma.user.delete({ where: { id } });
+    return reply.code(204).send();
+  });
+}
+
+// src/app.ts
+var import_multipart = __toESM(require_multipart2(), 1);
+
 // src/routes/auth.ts
-var view9 = (u) => ({ id: u.id, email: u.email, createdAt: u.createdAt.toISOString() });
+init_src();
+init_db();
+var view10 = (u) => ({ id: u.id, email: u.email, role: u.role, createdAt: u.createdAt.toISOString() });
 async function issue(reply, userId) {
   const token = await createSession2(userId);
   reply.setCookie(COOKIE_NAME, token, cookieOpts());
@@ -30085,20 +30360,20 @@ async function auth_default(app2) {
       data: { email: p.data.email, passwordHash: await hashPassword(p.data.password) }
     });
     await issue(reply, user.id);
-    return { user: view9(user) };
+    return { user: view10(user) };
   });
   app2.post("/auth/login", async (req, reply) => {
     if (loginThrottle(req.ip).blocked) return reply.code(429).send({ error: "too many attempts" });
     const p = zLogin.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
     const user = await prisma.user.findUnique({ where: { email: p.data.email } });
-    if (!user || !await verifyPassword(p.data.password, user.passwordHash)) {
+    if (!user || user.disabled || !await verifyPassword(p.data.password, user.passwordHash)) {
       noteLoginFail(req.ip);
       return reply.code(401).send({ error: "email atau password salah" });
     }
     clearLoginFails(req.ip);
     await issue(reply, user.id);
-    return { user: view9(user) };
+    return { user: view10(user) };
   });
   app2.post("/auth/logout", async (req, reply) => {
     const token = req.cookies?.[COOKIE_NAME];
@@ -30106,19 +30381,24 @@ async function auth_default(app2) {
     reply.clearCookie(COOKIE_NAME, { path: "/" });
     return reply.code(204).send();
   });
-  app2.get("/auth/users", async () => (await prisma.user.findMany({ orderBy: { createdAt: "asc" } })).map(view9));
+  app2.get("/auth/users", async () => (await prisma.user.findMany({ orderBy: { createdAt: "asc" } })).map(view10));
   app2.post("/auth/users", async (req, reply) => {
     const p = zSignup.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
     if (await prisma.user.findUnique({ where: { email: p.data.email } }))
       return reply.code(409).send({ error: "email dipakai" });
     const user = await prisma.user.create({
-      data: { email: p.data.email, passwordHash: await hashPassword(p.data.password) }
+      // SPEC-617 · pintu ini melahirkan OPERATOR. Akun klien punya pintunya sendiri
+      // (/api/client-accounts) supaya "undang rekan" dan "beri akses klien" tak pernah tertukar.
+      data: { email: p.data.email, passwordHash: await hashPassword(p.data.password), role: "admin" }
     });
-    return view9(user);
+    return view10(user);
   });
   app2.delete("/auth/users/:id", async (req, reply) => {
-    if (await prisma.user.count() <= 1) return reply.code(400).send({ error: "tak bisa hapus user terakhir" });
+    const target2 = await prisma.user.findUnique({ where: { id: req.params.id } });
+    if (!target2) return reply.code(204).send();
+    if (target2.role === "admin" && await prisma.user.count({ where: { role: "admin" } }) <= 1)
+      return reply.code(400).send({ error: "tak bisa hapus admin terakhir" });
     await prisma.user.deleteMany({ where: { id: req.params.id } });
     return reply.code(204).send();
   });
@@ -30135,7 +30415,7 @@ async function auth_default(app2) {
     });
     await deleteUserSessions(user.id);
     await issue(reply, user.id);
-    return { user: view9(user) };
+    return { user: view10(user) };
   });
 }
 
@@ -30148,15 +30428,15 @@ async function agent_tokens_default(app2) {
   app2.post("/agent-tokens", async (req, reply) => {
     const p = zAgentTokenCreate.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
-    const { view: view10, token } = await issueAgentToken({ ...p.data, createdBy: req.user?.id });
-    return reply.code(201).send({ ...view10, token });
+    const { view: view11, token } = await issueAgentToken({ ...p.data, createdBy: req.user?.id });
+    return reply.code(201).send({ ...view11, token });
   });
   app2.patch("/agent-tokens/:id", async (req, reply) => {
     const p = zAgentTokenPatch.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
     const { id } = req.params;
-    const view10 = await patchAgentToken(id, p.data);
-    return view10 ? reply.send(view10) : reply.code(404).send({ error: "not found" });
+    const view11 = await patchAgentToken(id, p.data);
+    return view11 ? reply.send(view11) : reply.code(404).send({ error: "not found" });
   });
   app2.delete("/agent-tokens/:id", async (req, reply) => {
     const { id } = req.params;
@@ -30201,7 +30481,7 @@ function capabilityForRoute(method, path) {
   const rw = (d) => `${d}:${read ? "read" : "write"}`;
   const seg = path.replace(/^\/api\/?/, "").replace(/\/+$/, "").split("/").filter(Boolean);
   const top = seg[0] ?? "";
-  if (top === "auth" || top === "agent-tokens" || top === "device-tokens" || top === "sync") return "COOKIE_ONLY";
+  if (top === "auth" || top === "agent-tokens" || top === "device-tokens" || top === "sync" || top === "portal" || top === "client-accounts") return "COOKIE_ONLY";
   if (top === "limits" || top === "update" || top === "events" || top === "fs" || top === "health")
     return read ? "GLOBAL_READ" : "COOKIE_ONLY";
   if (top === "scheduler") return rw("settings");
@@ -30400,6 +30680,8 @@ function buildApp({ requireAuth = true, agentDocFile } = {}) {
         if (user) req.user = user;
         const path = req.url.split("?")[0] ?? req.url;
         if (PUBLIC.has(`${req.method} ${path}`)) return;
+        if (user?.role === "client" && !clientRouteAllowed(req.method, path))
+          return reply.code(403).send({ error: "portal klien: baca-saja" });
         if (path.startsWith("/api/sync") && path !== "/api/sync/now" && !path.startsWith("/api/sync/conflicts")) return;
         if (path.startsWith("/api/help")) return;
         if (user) return;
@@ -30455,6 +30737,8 @@ function buildApp({ requireAuth = true, agentDocFile } = {}) {
     await api.register(telegramRoutes);
     await api.register(webhooks_default);
     await api.register(changelog_default);
+    await api.register(portal_default);
+    await api.register(client_accounts_default);
   }, { prefix: "/api" });
   if (process.env.NODE_ENV === "production") {
     const dist = pickWebDir(dirname13(fileURLToPath4(import.meta.url)), process.env, existsSync13);