hanoman 0.1.46 → 0.1.50

package/README.md

@@ -84,13 +84,55 @@ Sesudah `hanoman update`, instance yang berjalan perlu di-restart (mis. `systemc
 
 | Env | Default | Untuk apa |
 |---|---|---|
-| `HANOMAN_HOME` | `~/.hanoman` | DB SQLite, key SSH, transkrip sesi |
+| `HANOMAN_HOME` | `~/.hanoman` | akar seluruh state hanoman — lihat [Isi `$HANOMAN_HOME`](#isi-hanoman_home) |
 | `HANOMAN_DATABASE_URL` | — | berkas DB khusus hanoman; hanya URL `file:` (nilai lain **melempar**) |
 | `DATABASE_URL` | `file:$HANOMAN_HOME/hanoman.db` | dipakai bila ber-`file:`; nilai lain **diabaikan** dengan peringatan |
+| `HANOMAN_TRANSCRIPT_DIR` | `$HANOMAN_HOME/transcripts` | transkrip sesi yang sudah ditutup |
+| `HANOMAN_UPLOAD_DIR` | `$HANOMAN_HOME/uploads` | lampiran tiket & lampiran gambar sesi terminal |
+| `HANOMAN_SSH_KEY_DIR` | `$HANOMAN_HOME` | keypair identitas hanoman untuk VPS |
 | `PORT` / `HOST` | `8787` / `127.0.0.1` | alamat bind |
 | `HANOMAN_CLAUDE_BIN` / `HANOMAN_CODEX_BIN` | `claude` / `codex` | biner agen |
 | `HANOMAN_TMUX_SOCKET` | `hanoman` | socket tmux terpisah dari milikmu |
 
+<a id="isi-hanoman_home"></a>
+
+## Isi `$HANOMAN_HOME` — satu batas backup/restore
+
+Tanpa override, **seluruh** state hanoman hidup di bawah satu direktori. Itulah batas yang harus
+disalin: memindahkan DB saja meninggalkan metadata yang menunjuk byte yang tak ada (SPEC-846).
+
+| Path | Isi | Hilang berarti |
+|---|---|---|
+| `hanoman.db` (+ `-wal`/`-shm`) | seluruh state aplikasi | semuanya |
+| `secret.key` | kunci AES untuk RuntimeConfig & webhook secret | credential terenkripsi tak bisa dibuka |
+| `id_ed25519` + `.pub` | identitas SSH hanoman ke VPS | akses VPS mati; `authorized_keys` tak lagi cocok |
+| `transcripts/` | transkrip sesi yang ditutup | `hasTranscript` benar, isinya tak terbaca |
+| `uploads/` | lampiran tiket, byte source-map lama | lampiran 404 walau metadata utuh |
+| `uploads/terminal/<sessionId>/` | lampiran gambar sesi terminal | path di prompt agen menunjuk berkas hilang |
+| `setup.token` | token bootstrap admin pertama (one-time, 15 menit) | hanya relevan sebelum admin pertama |
+| `agent-token` | agent token yang dibaca `hanoman mcp` | klien MCP lokal kehilangan autentikasi |
+
+```bash
+# Backup — SQLite disalin konsisten, sisanya berkas biasa.
+sqlite3 "$HANOMAN_HOME/hanoman.db" ".backup '/backup/hanoman.db'"
+tar -C "$HANOMAN_HOME" -czf /backup/hanoman-files.tgz \
+  secret.key id_ed25519 id_ed25519.pub transcripts uploads
+
+# Restore di host lain — umask dulu, isinya memuat kunci privat.
+umask 077
+install -d -m 0700 "$HANOMAN_HOME"
+cp /backup/hanoman.db "$HANOMAN_HOME/hanoman.db"
+tar -C "$HANOMAN_HOME" -xzf /backup/hanoman-files.tgz
+hanoman doctor          # memverifikasi tiap path data efektif + izin tulisnya
+```
+
+`setup.token` dan `agent-token` sengaja **tidak** ikut: yang pertama one-time dan lahir ulang
+sendiri bila DB belum punya user, yang kedua sebaiknya diterbitkan ulang di host baru.
+
+Mengeset `HANOMAN_TRANSCRIPT_DIR`, `HANOMAN_UPLOAD_DIR`, atau `HANOMAN_SSH_KEY_DIR` memindahkan
+bagian itu ke luar batas ini — sah, tapi backup-nya menjadi tanggung jawabmu. `hanoman doctor`
+mencetak path efektifnya supaya tak perlu ditebak.
+
 ## Bind & TLS
 
 Default `127.0.0.1:8787`. hanoman punya auth, tapi cookie sesinya `Secure` — set

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.46",
-  "sha": "03155cdb",
-  "builtAt": "2026-08-18T01:48:20.610Z"
+  "version": "0.1.50",
+  "sha": "30fe53e3",
+  "builtAt": "2026-08-20T04:25:22.099Z"
 }

package/dist/cli.js

@@ -5022,7 +5022,7 @@ var init_cron_expr = __esm({
 });
 
 // ../shared/src/dto.ts
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zSpecAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5064,6 +5064,10 @@ var init_dto = __esm({
       cwd: external_exports.string(),
       startedAt: external_exports.string(),
       endedAt: external_exports.string().nullable(),
+      // SPEC-844 · ADR-0125 · `string` longgar, bukan enum: baris lama null dan nilai asing dari
+      // instance lebih baru tak boleh melempar di boundary — `sessionOutcome()` yang menafsirkannya.
+      endedReason: external_exports.string().nullable(),
+      reconciledAt: external_exports.string().nullable(),
       exitCode: external_exports.number().nullable(),
       transcriptBytes: external_exports.number().nullable()
     });
@@ -5505,6 +5509,13 @@ var init_dto = __esm({
       mimeType: external_exports.string(),
       size: external_exports.number().int()
     });
+    zSpecAttachmentView = external_exports.object({
+      id: external_exports.string(),
+      filename: external_exports.string(),
+      mimeType: external_exports.string(),
+      size: external_exports.number().int(),
+      createdAt: external_exports.string()
+    });
     zTicketDetail = zTicketView.extend({
       detail: external_exports.string(),
       attachments: external_exports.array(zTicketAttachmentView),
@@ -5606,6 +5617,9 @@ var init_api = __esm({
       specSource: (id) => `${API}/specs/${id}/source`,
       // SPEC-804 · ADR-0120 · tandai item selesai manual (operasi khusus, bukan field PATCH).
       specDone: (id) => `${API}/specs/${id}/done`,
+      // SPEC-843 · ADR-0124 · lampiran backlog item (multi-berkas per request).
+      specAttachments: (id) => `${API}/specs/${id}/attachments`,
+      specAttachment: (id, attId) => `${API}/specs/${id}/attachments/${attId}`,
       specReview: (id) => `${API}/specs/${id}/review`,
       specReviewFile: (id, path) => `${API}/specs/${id}/review/${path}`,
       settings: `${API}/settings`,
@@ -5908,6 +5922,13 @@ var init_session_kind = __esm({
   }
 });
 
+// ../shared/src/session-end.ts
+var init_session_end = __esm({
+  "../shared/src/session-end.ts"() {
+    "use strict";
+  }
+});
+
 // ../shared/src/config.ts
 var zHanomanConfig;
 var init_config = __esm({
@@ -6281,6 +6302,8 @@ var init_webhook = __esm({
           "branch",
           "startedAt",
           "endedAt",
+          "endedReason",
+          "reconciledAt",
           "exitCode"
         ],
         projectIdField: "projectId",
@@ -6289,9 +6312,9 @@ var init_webhook = __esm({
         },
         derived: [{
           type: "session.ended",
-          label: "Sesi selesai atau gagal",
+          label: "Sesi selesai, gagal, atau terputus",
           changed: ["endedAt"],
-          when: "Sesi ditutup dan endedAt terisi. exitCode bukan 0 berarti pane mati gagal; null berarti tak terbaca, misalnya tmux mati di luar hanoman."
+          when: 'Sesi berakhir dan endedAt terisi. endedReason memberi tahu CARANYA: "closed" = hanoman menutupnya, jadi exitCode berlaku (null = agen masih hidup saat ditutup, 0 = keluar bersih, selain itu gagal); "reconciled" = panenya sudah lenyap saat hanoman menyala lagi (reboot, kill-server, host mati) sehingga hasilnya TAK DIKETAHUI, exitCode selalu null, dan reconciledAt menyebut kapan hanoman menemukannya \u2014 endedAt di kasus itu batas BAWAH, bukan waktu berakhir sebenarnya. null = baris lahir sebelum SPEC-844.'
         }],
         sample: {
           id: "6f0c1c1e-1a2b-4c3d-8e9f-0a1b2c3d4e5f",
@@ -6307,6 +6330,8 @@ var init_webhook = __esm({
           branch: "hanoman/spec-481",
           startedAt: "2026-08-01T02:12:31.000Z",
           endedAt: "2026-08-01T09:44:02.000Z",
+          endedReason: "closed",
+          reconciledAt: null,
           exitCode: 0
         }
       },
@@ -7241,6 +7266,7 @@ var init_src = __esm({
     init_portal();
     init_prd_status();
     init_session_kind();
+    init_session_end();
     init_config();
     init_config_registry();
     init_semver();
@@ -7433,6 +7459,16 @@ function resolveHome(env = process.env, home = homedir()) {
   const v = env.HANOMAN_HOME?.trim();
   return v ? v : join(home, ".hanoman");
 }
+function resolveDataDirs(env = process.env, home = homedir()) {
+  const root = resolveHome(env, home);
+  const dir = (key, name) => env[key]?.trim() || join(root, name);
+  return {
+    home: root,
+    transcripts: dir("HANOMAN_TRANSCRIPT_DIR", "transcripts"),
+    uploads: dir("HANOMAN_UPLOAD_DIR", "uploads"),
+    sshKeys: env.HANOMAN_SSH_KEY_DIR?.trim() || root
+  };
+}
 function schemeOf(raw) {
   return raw.split("://")[0] ?? "?";
 }
@@ -7691,10 +7727,10 @@ function ensureSpawnHelpersExecutable(paths2, ops) {
   }
   return fixed;
 }
-function repairSpawnHelper(resolve4, notify) {
+function repairSpawnHelper(resolve5, notify) {
   let ptyDir;
   try {
-    ptyDir = dirname3(resolve4("node-pty/package.json"));
+    ptyDir = dirname3(resolve5("node-pty/package.json"));
   } catch {
     return [];
   }
@@ -8096,7 +8132,7 @@ __export(doctor_exports, {
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { accessSync, constants, existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { dirname as dirname5, resolve as resolve4 } from "node:path";
 function doctorReport(p) {
   const major = Number(/^v?(\d+)/.exec(p.node)?.[1] ?? 0);
   const rows = [
@@ -8111,7 +8147,13 @@ function doctorReport(p) {
       text: p.gh ? `gh ${p.gh}` : "gh \u2014 tak ada (tarik issue akan lewat HTTP + GITHUB_TOKEN)",
       fatal: false
     },
-    { mark: p.homeWritable ? "\u2713" : "\u2717", text: `data dir ${p.homeWritable ? "bisa ditulis" : "TAK bisa ditulis"}`, fatal: !p.homeWritable },
+    // Direktori turunan lahir saat dipakai, jadi izin tulis yang belum ada di situ adalah
+    // peringatan — bukan alasan menyatakan hanoman tak bisa menjalankan sesi. Home tetap fatal.
+    ...p.dirs.map((d) => ({
+      mark: d.writable ? "\u2713" : d.fatal ? "\u2717" : "!",
+      text: `${d.label} ${d.path}${d.writable ? "" : " \u2014 TAK bisa ditulis"}`,
+      fatal: d.fatal && !d.writable
+    })),
     { mark: p.web ? "\u2713" : "!", text: p.web ? "aset dashboard ada" : "aset dashboard tak ada \u2014 API jalan, dashboard tidak", fatal: false },
     { mark: "\xB7", text: `db ${p.db}`, fatal: false },
     {
@@ -8134,6 +8176,21 @@ function doctorReport(p) {
   }
   return { lines: rows.map((r) => `  ${r.mark} ${r.text}`), ok: !rows.some((r) => r.fatal) };
 }
+function writable(path) {
+  for (let p = resolve4(path); ; ) {
+    if (existsSync4(p)) {
+      try {
+        accessSync(p, constants.W_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    const up = dirname5(p);
+    if (up === p) return false;
+    p = up;
+  }
+}
 function version(bin, args) {
   try {
     return execFileSync3(bin, args, { encoding: "utf8", timeout: 1e4, stdio: ["ignore", "pipe", "ignore"] }).trim().split("\n")[0] ?? null;
@@ -8152,13 +8209,13 @@ async function doctor(_argv, ctx) {
 `);
     return 1;
   }
-  const home = resolveHome(ctx.env);
-  let homeWritable = false;
-  try {
-    accessSync(existsSync4(home) ? home : dirname5(home), constants.W_OK);
-    homeWritable = true;
-  } catch {
-  }
+  const d = resolveDataDirs(ctx.env);
+  const dirs = [
+    { label: "data dir", path: d.home, writable: writable(d.home), fatal: true },
+    { label: "transkrip", path: d.transcripts, writable: writable(d.transcripts), fatal: false },
+    { label: "upload", path: d.uploads, writable: writable(d.uploads), fatal: false },
+    { label: "key SSH", path: d.sshKeys, writable: writable(d.sshKeys), fatal: false }
+  ];
   const claude = version(ctx.env.HANOMAN_CLAUDE_BIN ?? "claude", ["--version"]);
   const codex = version(ctx.env.HANOMAN_CODEX_BIN ?? "codex", ["--version"]);
   const method = METHODS[DEFAULT_METHOD];
@@ -8188,7 +8245,7 @@ async function doctor(_argv, ctx) {
     claude,
     codex,
     gh: version(ctx.env.HANOMAN_GH_BIN ?? "gh", ["--version"]),
-    homeWritable,
+    dirs,
     web: layout.web !== null,
     db,
     methods,
@@ -17578,14 +17635,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve4();
+      resolve5();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -19396,7 +19453,7 @@ var init_src_CX2iR2pK = __esm({
         const flowStartedAt = Date.now();
         let onAbort;
         let cleanupMessageId;
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           const earlyReject = (error2) => {
             reject(error2);
           };
@@ -19464,7 +19521,7 @@ var init_src_CX2iR2pK = __esm({
             }
             if (decoded.kind === "invalid") return reject(decoded.error);
             if (decoded.kind === "input_required") {
-              if (options?.allowInputRequired === true) return resolve4(manualInputRequiredValue(decoded));
+              if (options?.allowInputRequired === true) return resolve5(manualInputRequiredValue(decoded));
               const flow = {
                 codec,
                 request,
@@ -19476,11 +19533,11 @@ var init_src_CX2iR2pK = __esm({
                   params
                 }, resultSchema, legOptions)
               };
-              return resolve4(this._resolveNonCompleteResult(decoded, flow));
+              return resolve5(this._resolveNonCompleteResult(decoded, flow));
             }
             const result = decoded.result;
             validateStandardSchema(resultSchema, result).then((parseResult) => {
-              if (parseResult.success) resolve4(parseResult.data);
+              if (parseResult.success) resolve5(parseResult.data);
               else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
             }, reject);
           });
@@ -22296,7 +22353,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
         const schOrFunc = root.refs[ref];
         if (schOrFunc) return schOrFunc;
-        let _sch = resolve4.call(this, root, ref);
+        let _sch = resolve5.call(this, root, ref);
         if (_sch === void 0) {
           const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
           const { schemaId } = this.opts;
@@ -22322,7 +22379,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       function sameSchemaEnv(s1, s2) {
         return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
       }
-      function resolve4(root, ref) {
+      function resolve5(root, ref) {
         let sch;
         while (typeof (sch = this.refs[ref]) == "string") ref = sch;
         return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -22772,7 +22829,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         else if (typeof uri === "object") uri = parse4(serialize(uri, options), options);
         return uri;
       }
-      function resolve4(baseURI, relativeURI, options) {
+      function resolve5(baseURI, relativeURI, options) {
         const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
         const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
         schemelessOptions.skipEscape = true;
@@ -22946,7 +23003,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       const fastUri = {
         SCHEMES,
         normalize,
-        resolve: resolve4,
+        resolve: resolve5,
         resolveComponent,
         equal,
         serialize,
@@ -28638,7 +28695,7 @@ var init_stdio = __esm({
       }
       send(message) {
         if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           const json = serializeMessage(message);
           let settled = false;
           const onError = (error2) => {
@@ -28653,14 +28710,14 @@ var init_stdio = __esm({
             settled = true;
             this._stdout.off("error", onError);
             this._stdout.off("drain", onDrain);
-            resolve4();
+            resolve5();
           };
           this._stdout.once("error", onError);
           if (this._stdout.write(json)) {
             if (settled) return;
             settled = true;
             this._stdout.off("error", onError);
-            resolve4();
+            resolve5();
           } else if (!settled) this._stdout.once("drain", onDrain);
         });
       }
@@ -28714,14 +28771,14 @@ var init_stdio = __esm({
       */
       async whenRequestsAnswered(timeoutMs) {
         if (this._closed || this._pendingRequests.size === 0) return true;
-        return await new Promise((resolve4) => {
+        return await new Promise((resolve5) => {
           const waiter = () => {
             clearTimeout(timer);
-            resolve4(true);
+            resolve5(true);
           };
           const timer = setTimeout(() => {
             this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-            resolve4(false);
+            resolve5(false);
           }, timeoutMs);
           this._drainWaiters.push(waiter);
         });
@@ -28998,10 +29055,10 @@ var init_server = __esm({
 // src/commands/mcp.ts
 var mcp_exports = {};
 __export(mcp_exports, {
+  agentTokenPath: () => agentTokenPath,
   default: () => mcp
 });
 import { readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
 import { join as join6 } from "node:path";
 async function mcp(argv, ctx) {
   const cfg = resolveMcpConfig(argv, ctx.env, () => tokenFile(ctx.env));
@@ -29016,26 +29073,27 @@ async function mcp(argv, ctx) {
     await handle.close();
     return 0;
   }
-  await new Promise((resolve4) => {
-    process.stdin.once("close", resolve4);
-    process.stdin.once("end", resolve4);
+  await new Promise((resolve5) => {
+    process.stdin.once("close", resolve5);
+    process.stdin.once("end", resolve5);
   });
   return 0;
 }
-var tokenFile;
+var agentTokenPath, tokenFile;
 var init_mcp2 = __esm({
   "src/commands/mcp.ts"() {
     "use strict";
+    init_src2();
     init_stdio();
     init_router();
     init_config2();
     init_client();
     init_server();
     init_redact();
+    agentTokenPath = (env) => join6(resolveHome(env), "agent-token");
     tokenFile = (env) => {
-      const home = env.HANOMAN_HOME ?? join6(homedir3(), ".hanoman");
       try {
-        return readFileSync2(join6(home, "agent-token"), "utf8");
+        return readFileSync2(agentTokenPath(env), "utf8");
       } catch {
         return null;
       }
@@ -29249,6 +29307,10 @@ var init_migrate_pg = __esm({
       "TelegramAudit",
       "Ticket",
       "TicketAttachment",
+      // SPEC-843 · ADR-0124 · SpecAttachment WAJIB sesudah Spec (FK specId, cascade). Tabel ini
+      // LOCAL-only dan lazimnya TIDAK ada di sumber Postgres lama — jalur 42P01 memperlakukannya
+      // sebagai nol baris, cermin Changelog.
+      "SpecAttachment",
       // SPEC-471 · ADR-0095 · GithubIssue sesudah Project (FK projectId) DAN sesudah Spec: `specId`
       // memang tanpa FK, tapi memindahkannya lebih awal membuat urutan tabel tak lagi mencerminkan
       // arah tautannya bagi pembaca berikutnya.