@ojokesusu/lintasai 1.1.2

package/.github/workflows/publish-npm.yml

@@ -0,0 +1,40 @@
+name: Publish to NPM on tag
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Verify version (tag mode) atau skip (manual dispatch)
+        run: |
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          echo "Package version: $PKG_VERSION"
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            TAG_VERSION="${GITHUB_REF#refs/tags/v}"
+            echo "Tag version: $TAG_VERSION"
+            if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+              echo "ERROR: Tag version ($TAG_VERSION) does not match package.json ($PKG_VERSION)"
+              exit 1
+            fi
+            echo "OK: tag matches package.json"
+          else
+            echo "Not a tag trigger (GITHUB_REF=$GITHUB_REF). Skipping version match check."
+            echo "Will publish package.json version: $PKG_VERSION"
+          fi
+
+      - name: Publish to npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/validate.yml

@@ -0,0 +1,93 @@
+name: lintasAI validate
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch: {}
+
+jobs:
+  ps-parse:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Parse all PowerShell scripts
+        shell: pwsh
+        run: |
+          $files = Get-ChildItem -Path . -Filter *.ps1 -Recurse | Where-Object { $_.FullName -notmatch '\\.bak' }
+          $failed = @()
+          foreach ($f in $files) {
+            $errors = $null
+            $null = [System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$errors)
+            if ($errors.Count -gt 0) {
+              Write-Host "PARSE FAIL: $($f.Name)"
+              $errors | Format-List
+              $failed += $f.Name
+            } else { Write-Host "ok: $($f.Name)" }
+          }
+          if ($failed.Count -gt 0) { exit 1 }
+
+  smoke-setup:
+    runs-on: windows-latest
+    needs: ps-parse
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: 'kit-source'
+      - name: Smoke test setup-pola-b in temp project
+        shell: pwsh
+        env:
+          CI: 'true'
+        run: |
+          $proj = Join-Path $env:RUNNER_TEMP "fake-proj"
+          New-Item -ItemType Directory -Force $proj | Out-Null
+          Copy-Item -Recurse kit-source "$proj\.claude-kit"
+          Push-Location $proj
+          try {
+            & .\.claude-kit\setup-pola-b.ps1
+            if ($LASTEXITCODE -ne 0) { throw "setup failed" }
+            & .\.claude-kit\kit.ps1 doctor
+            if ($LASTEXITCODE -ne 0) { throw "doctor failed" }
+            Write-Host "smoke OK"
+          } finally { Pop-Location }
+
+  yaml-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: YAML structure
+        run: |
+          for f in .github/workflows/*.yml; do python -c "import yaml,sys; yaml.safe_load(open('$f'))"; done
+
+  pester-tests:
+    runs-on: windows-latest
+    needs: ps-parse
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Pester
+        shell: pwsh
+        run: Install-Module -Name Pester -MinimumVersion 5.0 -Force -SkipPublisherCheck
+      - name: Run tests
+        shell: pwsh
+        run: |
+          cd $env:GITHUB_WORKSPACE
+          .\tests\Run-Tests.ps1
+
+  pssa-lint:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install PSScriptAnalyzer
+        shell: pwsh
+        run: Install-Module -Name PSScriptAnalyzer -Force -SkipPublisherCheck -Scope CurrentUser
+      - name: Run PSScriptAnalyzer
+        shell: pwsh
+        run: |
+          $results = Invoke-ScriptAnalyzer -Path . -Recurse -Severity Error,Warning -ExcludeRule PSAvoidUsingWriteHost,PSUseShouldProcessForStateChangingFunctions
+          if ($results) {
+              $results | Format-Table -AutoSize
+              Write-Error "PSScriptAnalyzer found $($results.Count) issues"
+              exit 1
+          }
+          Write-Host "PSScriptAnalyzer: clean"

package/AUDIT_POST_SETUP_PROMPT_v1.md

@@ -0,0 +1,280 @@
+Tolong jalankan AUDIT KOMPREHENSIF di proyek ini, dengan ANALOGI NON-PROGRAMMER di setiap finding (biar staff IT non-programmer paham). Paste prompt ini = implicit consent untuk audit READ-ONLY (scan multi-dimensional, tidak ada file proyek yang diubah). User confirm dulu sebelum execute fix apapun.
+
+> Cocok dijalankan SETELAH `JALANKAN_KIT.md` selesai (bulk-bootstrap docs sudah jadi → AI sudah load context lengkap → audit hasilnya akurat). Bisa juga standalone kapan saja setelah setup awal.
+
+---
+
+## Filosofi audit ini
+
+1. **READ-ONLY by default** — audit cuma SCAN + LAPORAN. Tidak ada `Edit`, `Write`, atau `Bash` destruktif. User pegang kontrol penuh "mau fix yang mana".
+2. **Multi-dimensional** — bukan cuma "refactor code". Cek 8 dimensi: Refactor / Security / QA-Test / Database / DevOps / Performance / Docs gap / Onboarding readiness.
+3. **Ranked low → high risk** — staff non-programmer butuh tahu "mana yang aman dikerjakan dulu". Quick wins yang risk merusak system = LOW jadi prioritas. HIGH RISK (auth/encryption/data migration) di-defer sampai test foundation siap.
+4. **Analogi non-programmer di SETIAP finding** — istilah programming (N+1, race condition, IDOR, transaction) WAJIB punya analogi sehari-hari (kantor, lemari arsip, ATM, tukang pos, brankas). Lihat `docs/GLOSSARY_NON_PROGRAMMER.md` untuk style guide.
+5. **Adversarial verify per finding** — default `is_real=false` kalau tidak 100% yakin. Cegah halusinasi inflate jumlah finding.
+
+---
+
+## WORKFLOW (lakukan otomatis tanpa konfirmasi tambahan AI-side, kecuali Popup #1 + Popup #2 di akhir)
+
+### Bagian 1 — Pre-audit verification
+
+1. Verify project sudah di-setup pakai lintasAI:
+   - `AGENTS.md` ada di root proyek
+   - `docs/architecture_auto.md` ada (registry TOC)
+   - `.claude-kit/` folder ada di root
+2. Read `AGENTS.md` + relevant section `CLAUDE_universal_v1.md` (terutama section 4.4 Audit Post-Setup Pattern + 13 Glossary).
+3. Read `docs/architecture.md` + `docs/architecture_auto.md` (READ-MINIMAL — paham landscape, BUKAN baca semua `.md`).
+4. Cek memory snapshot relevan (project-* memories) untuk konteks yang AI dulu pelajari.
+
+### Bagian 2 — Multi-Dimensional Audit (paralel via Workflow tool)
+
+5. **Jalankan Workflow tool** dengan 8 paralel auditor (1 per dimensi):
+
+| Dimensi | Fokus utama |
+|---|---|
+| 🧹 **Refactor** | File >300 baris yang bisa dipecah, duplicate logic 3+ tempat, helper opportunity, magic numbers, type safety, unused exports |
+| 🔒 **Security** | Missing rate-limit di endpoint sensitive, IDOR risk, missing authz check post-auth, audit log gap, secret handling, input validation, session hijack, OWASP Top 10 |
+| ✅ **QA/Test** | HIGH RISK files tanpa test, hot path tanpa test, edge case yang ada di docs tapi tanpa test, regression risk untuk refactor candidate |
+| 🗄️ **Database** | N+1 query patterns, missing indexes, cascade behavior risk, multi-tenant isolation, transaction missing, hot path query inefficiency |
+| ☁️ **DevOps** | Backup strategy adequacy, monitoring/alerting, cost optimization, deployment safety, cron dependency risk, env var drift, CI/CD gap |
+| ⚡ **Performance** | Bundle size, serverless cold start, DB query perf, cache strategy gap, image optimization, API response time |
+| 📚 **Docs gap** | File CRITICAL belum ter-cover bulk-bootstrap, ADR yang harus ditulis, architecture.md `[TBD]` fields, glossary domain terms missing |
+| 🎓 **Onboarding** | PostgreSQL role per-staff, env var sharing flow, GitHub access policy, ANTHROPIC_API_KEY, Claude Code install panduan, "good first issue" backlog, eskalasi tree |
+
+Setiap auditor lapor 5-15 finding dengan struktur:
+
+```json
+{
+  "dimension": "string",
+  "title": "<teknis singkat>",
+  "severity": "critical|high|medium|low|info",
+  "file": "<path>",
+  "line": "<approximate range>",
+  "description": "<apa masalahnya>",
+  "why_problem": "<kenapa ini masalah>",
+  "impact": "<konsekuensi kalau dibiarkan>",
+  "fix_steps": ["step 1", "step 2", ...],
+  "fix_effort": "5min|30min|2hr|8hr+|multi-day",
+  "blast_radius": "single-file|module|cross-module|system-wide",
+  "risk_of_introducing_bug": "low|medium|high",
+  "verify_strategy": ["lint", "build", "test ...", "manual smoke test ..."],
+  "rollback": "<perintah rollback>"
+}
+```
+
+6. **Adversarial verify per finding** (Workflow phase 2):
+   - Untuk SETIAP finding, spawn 1 verifier agent dengan default `is_real=false`.
+   - Verifier baca file yang dimaksud, konfirmasi finding nyata (bukan halusinasi).
+   - Cek severity tepat (jangan inflate/deflate).
+   - Cek `fix_steps` reasonable + `risk_of_introducing_bug` akurat.
+
+7. **Synthesize ranked output** (Workflow phase 3):
+   - **Tier 1 LOW RISK first**: findings dengan `risk_of_introducing_bug=low`, sort by effort ascending. Ini quick wins yang aman dikerjakan duluan.
+   - **Tier 2 MEDIUM RISK after Tier 1**: findings dengan `risk_of_introducing_bug=medium`. Butuh test foundation Tier 1 dulu.
+   - **Tier 3 HIGH RISK hold merge**: findings dengan `risk_of_introducing_bug=high`. Branch protection ON, paired review, smoke test prod 5+ menit.
+
+### Bagian 3 — Translate findings ke ANALOGI non-programmer
+
+8. **WAJIB**: tiap finding di-augment dengan format ini (Bahasa Indonesia ramah, junior-friendly):
+
+```markdown
+**[N] <Title teknis singkat>**
+- 📖 **Analogi**: <bahasa sehari-hari, pakai contoh kantor/Excel/lemari arsip/ATM/tukang pos/brankas>
+- 🎯 **Kenapa penting**: <1-2 kalimat awam, no jargon>
+- 🛠 **Fix**: <pointer cepat, sebut file/line dan langkah kasar>
+- ⏱ <effort> · 🚦 <severity> · ⚠ Risk <risk_of_bug>
+```
+
+**Sumber analogi**: `docs/ANALOGI_LIBRARY.md` berisi 30 jargon × 3 layer analogi (sehari-hari + tools digital populer + contoh konkret). Tabel ringkas + style guide tools digital di `CLAUDE_universal_v1.md` section 4.4.
+
+**3 layer analogi WAJIB per finding** (TIDAK CUKUP 1 analogi):
+1. **🏢 Sehari-hari**: kantor / dapur / lemari arsip / loket bank (universal)
+2. **📱 Tools digital populer**: Tokopedia / Gojek / WhatsApp / BCA mobile / Excel / Google Drive / Notion / Discord / dll. (Indonesia-context)
+3. **🎯 Contoh konkret**: kapan situasi muncul di proyek user (1 kalimat)
+
+Contoh quick reference (lihat `docs/ANALOGI_LIBRARY.md` untuk 30 jargon lengkap):
+
+| Jargon | 🏢 Sehari-hari | 📱 Tools digital |
+|---|---|---|
+| N+1 query | Tukang pos antar 30 surat satu-satu padahal punya 30 motor | **Tokopedia** checkout 20 barang satu-satu vs masukin keranjang |
+| Missing rate-limit | Loket bank tanpa antrian, 1 orang spam 1000x/menit | **BCA mobile** pencet kirim OTP unlimited → spam SMS korban |
+| Race condition | 2 orang nyamber stapler bersama di detik sama | **Shopee flash sale** stok 1, 2 orang klik "Beli" detik sama |
+| IDOR | Loker arsip nomor urut, ganti #47→#48 buka loker bos | **Tokopedia** ganti `invoice=12345`→`12346` muncul invoice orang lain |
+| God Component | Staff serabutan urus semua (kasir + telepon + gudang + laporan) | **Excel** 1 workbook isi stok+gaji+absensi+pivot semua tumpuk |
+| Memory leak | Staff dapur ambil piring kotor gak pernah cuci, dapur penuh | **WhatsApp** chat masuk dengan foto/video gak dihapus, storage penuh |
+| HOLD MERGE | Laporan keuangan rapi tapi belum boleh masuk arsip sebelum bos cap | **BCA mobile** transfer di atas limit → tunggu OTP |
+
+Untuk istilah BARU yang belum di `docs/ANALOGI_LIBRARY.md`, AI bikin 3-layer analogi konsisten + suggest tambah ke library via LAZY-GENERATE.
+
+### Bagian 4 — Generate Sprint Execution Plan
+
+9. Group findings jadi Sprint berdasarkan urgency + dependencies:
+
+- **Sprint 0 — URGENCY** (~30 menit): finding dengan severity=critical DAN risk_of_bug=low DAN fix_effort=5min. "Stop bleeding" priorities (backup broken, secret leak, dst.)
+- **Sprint 1 — Quick Wins** (1-2 hari): semua Tier 1 dengan fix_effort ≤ 30min, behavior unchanged
+- **Sprint 2 — Test Foundation** (3-5 hari): semua test gap untuk HIGH RISK files + docs polish. **WAJIB sebelum Sprint 3.**
+- **Sprint 3 — Tier 2 Medium + Onboarding Prep** (1-2 minggu): touch behavior, cross-module refactor, onboarding setup
+- **Sprint 4+ — Tier 3 HIGH RISK** (1-2 minggu per finding): paired review, HOLD MERGE, branch protection
+
+### Bagian 5 — Popup #1: Pilih tier (READONLY preview)
+
+10. **AI WAJIB tanya user** dengan `AskUserQuestion` (atau format teks setara di IDE lain). Posisi: setelah Workflow synthesize selesai, sebelum tampil detail.
+
+```
+POPUP READONLY: <N> finding audit siap di-tampilkan dengan analogi non-programmer.
+Status sekarang: READONLY (cuma preview, belum ada file proyek yang berubah).
+
+Pilih tier mana yang mau dilihat detailnya?
+
+(1) Tier 1 - Mudah (<X> item, ~<E1> jam total kerja)
+    → Perbaikan ringan: <sample categories>
+    → Risk merusak system: LOW
+
+(2) Tier 2 - Sedang (<Y> item, ~<E2> hari)
+    → Refactor cross-module: <sample categories>
+    → Risk: MEDIUM. Wajib test foundation Sprint 2 dulu.
+
+(3) Tier 3 - Hati-hati (<Z> item, ~<E3> hari per finding)
+    → Refactor auth/encryption/schema: <sample>
+    → Risk: HIGH. HOLD MERGE. Setelah Sprint 1-2 stable.
+
+(4) Semua tier + execution plan terstruktur ⭐ DEFAULT
+    → Output paling panjang tapi paling lengkap.
+    → Cocok untuk di-track sebagai master TODO di docs/decisions/.
+
+Default (kosong/Enter) → (4) Semua tier.
+```
+
+11. Tunggu jawaban user:
+   - **"1"** → tampilkan Tier 1 dengan analogi (group per dimensi).
+   - **"2"** → tampilkan Tier 2.
+   - **"3"** → tampilkan Tier 3.
+   - **"4" / Enter / kosong** ⭐ DEFAULT → tampilkan SEMUA tier + Sprint execution plan.
+
+### Bagian 6 — Display findings dengan analogi non-programmer
+
+12. **Group per dimensi** dalam tiap tier (mudah di-skim):
+
+```markdown
+## 🟢 TIER 1 — MUDAH (X item, ~Y jam total)
+
+### 🗄️ Database (N item)
+[1] Title teknis
+- 📖 Analogi: ...
+- 🎯 Kenapa penting: ...
+- 🛠 Fix: edit `path/file.ts` line N, ...
+- ⏱ 5min · 🚦 Medium · ⚠ Risk LOW
+
+[2] Title teknis
+- ...
+
+### 🔒 Security (N item)
+[N] ...
+
+### 🧹 Refactor (N item)
+...
+
+### ✅ QA/Test (N item)
+...
+
+[dst. per dimensi]
+```
+
+13. Setelah display semua tier, tutup dengan Sprint execution plan:
+
+```markdown
+## 📋 EXECUTION PLAN
+
+### 🔥 Sprint 0 — URGENCY (30 menit)
+1. Item #<X> — <judul> (5min)
+2. ...
+
+### 🟢 Sprint 1 — Quick Wins (1-2 hari)
+| Hari | Item | Effort |
+|---|---|---|
+| Pagi 1 | #<...> | 3 jam |
+| ...
+
+[Sprint 2, 3, 4+]
+```
+
+### Bagian 7 — Popup #2: Mau lanjut apa?
+
+14. **AI WAJIB tanya user** lagi setelah display findings:
+
+```
+Status: READONLY preview selesai. Tidak ada file yang diubah, tidak ada commit, tidak ada push.
+
+Mau lanjut ke step berikutnya?
+
+(1) 🔥 Eksekusi Sprint 0 (URGENCY, ~30 menit)
+    → AI kerjakan item Sprint 0 langsung, lapor per item.
+    → BACA dulu yang akan dikerjakan, AI baru execute setelah konfirm.
+
+(2) 📝 Tulis full report ke docs/decisions/<YYYY-MM-DD>-audit-findings.md
+    → Semua finding + analogi + execution plan jadi 1 file Markdown.
+    → Owner bisa di-track via git, share ke staff, reference untuk Sprint planning.
+
+(3) 🎯 Pick 1 finding spesifik untuk fix detail
+    → Kasih nomor (mis. "fix #1 dulu") → AI kerjakan dengan safety net penuh.
+    → Branch baru + commit kecil + verify lint/build/test + rollback siap.
+
+(4) ⏸ Stop, owner review dulu
+    → Output preview siap. Owner review, kasih instruksi spesifik nanti di sesi baru.
+```
+
+15. Tunggu jawaban:
+   - **"1"** → run Sprint 0 dengan branch terpisah + commit per item + smoke test (untuk akses: cek backup workflow, revoke cross-tenant role, dst.)
+   - **"2"** → tulis file `docs/decisions/<YYYY-MM-DD>-audit-findings.md` lengkap, lapor lokasi file
+   - **"3"** → tanya nomor finding, lalu execute dengan safety net pattern (lihat Bagian 8)
+   - **"4"** → tutup: *"Preview siap. Sesi berikutnya tinggal brief 'lanjut Sprint 0' atau 'fix item #X' kapan saja."*
+
+### Bagian 8 — Safety Net Pattern (kalau owner pilih execute)
+
+Untuk SETIAP refactor yang AI eksekusi (Sprint 0 atau pick spesifik):
+
+1. **Branch terpisah**: `git checkout -b fix/audit-<short-slug>`
+2. **Read existing test** (kalau ada vitest di area yang akan disentuh) untuk paham contract
+3. **List intended behavior PRESERVED** sebelum touch code (kontrak before/after) — tulis ke commit message body
+4. **Per refactor = 1 atomic commit kecil** (reversible via `git revert HEAD`)
+5. **Verify**: `pnpm lint && pnpm build && pnpm test` lulus
+6. **Smoke test alur kritis manual** (untuk fix yang touch auth/DB/payment): list 3 alur untuk owner verify
+7. **HIGH RISK (Tier 3)** = HOLD MERGE, owner approve dulu
+8. **Lapor per item**: "✅ Item #<N> selesai. Commit: <sha>. Test pass. Smoke test: <list>. Rollback: `git revert <sha>`."
+
+### Aturan AI selama workflow ini
+
+- **READ-ONLY default**: Bagian 2-6 = scan + report. Tidak ada `Edit`/`Write`/`Bash destruktif`. Pakai Workflow tool untuk parallel scan.
+- **Implicit consent dari user paste prompt** = setuju AI lakukan audit read-only sampai Popup #1.
+- **Popup #1 + Popup #2 WAJIB** — tunggu user pilih tier + lanjutan.
+- **ANALOGI non-programmer WAJIB** di tiap finding (Bagian 3 style guide). Kalau istilah belum ada di `docs/GLOSSARY_NON_PROGRAMMER.md`, AI bikin analogi konsisten + suggest tambah ke glossary.
+- **Adversarial verify WAJIB** — cegah halusinasi. Default `is_real=false`.
+- **Sprint plan = guidance, BUKAN auto-execute**. Owner pegang kontrol final.
+- **Multi-Divisi review WAJIB** di akhir (per CLAUDE_universal_v1.md section 4.1).
+- Semua respons AI dalam **Bahasa Indonesia** ramah, junior-friendly.
+
+---
+
+## Untuk Staff Baru (Day 0 Pertama Kali Audit)
+
+Kalau staff IT non-programmer pertama kali pakai audit ini di proyek (mereka belum tahu codebase), AI WAJIB:
+
+1. **Phase 1** — Foundation reading: pastikan staff sudah baca `docs/GLOSSARY_NON_PROGRAMMER.md` + `docs/SECURITY_INCIDENT_PLAYBOOK.md`
+2. **Phase 2** — Project context: brief staff tentang stack + domain + status sebelum audit (auto via Guided Step-by-Step Pattern di `CLAUDE_universal_v1.md` section 4.3)
+3. **Phase 3** — Audit dengan extra hand-holding: di Popup #2, default ke option (4) Stop supaya staff baru tidak langsung execute fix tanpa supervisor approval
+
+---
+
+## Konteks tambahan untuk Workflow tool
+
+- Setiap auditor dimensi WAJIB read minimal:
+  - `docs/architecture_auto.md` (TOC paham landscape)
+  - `prisma/schema.prisma` (kalau ada Prisma)
+  - 1-2 file CRITICAL di area yang di-audit (dari dim-specific hint)
+- JANGAN baca semua `docs/*.md` di awal (boros token, lawan dari section 7.3 READ-MINIMAL)
+- Output schema STRUCTURED supaya synthesize gampang (lihat Bagian 2 step 5)
+- Concurrency cap 16 = aman untuk 8 auditor + adversarial verify per finding
+
+---
+
+Mulai dari langkah 1 sekarang.

package/BOOTSTRAP_PROJECT_DOCS_PROMPT_v1.md

@@ -0,0 +1,3 @@
+# DEPRECATED (lintasAI v1.0.0 republish 2026-06-04)
+
+-> Pakai [PROJECT_LIFECYCLE_PROMPT_v1.md](PROJECT_LIFECYCLE_PROMPT_v1.md), jump ke "Stage B: Bootstrap Docs"