codehava-agent-kit 1.0.0

package/templates/docs/05-DEPLOYMENT.md

@@ -0,0 +1,363 @@
+# 05 — Deployment Guide
+> Panduan lengkap setup VPS Biznet Gio + Coolify + CI/CD.
+
+---
+
+## 1. Arsitektur Deployment
+
+```
+GitHub (push to main)
+    │
+    ▼ GitHub Actions (lint + build check)
+    │
+    ▼ Coolify Webhook (auto-deploy)
+    │
+    ▼ Docker Build
+    │
+    ▼ Traefik (reverse proxy + SSL)
+    │
+    ▼ https://[domain].com
+```
+
+---
+
+## 2. Setup Awal VPS Biznet Gio
+
+### Spesifikasi Minimum
+
+| Resource | MVP | Scaling |
+|----------|-----|---------|
+| CPU | 2 vCPU | 4–8 vCPU |
+| RAM | 4 GB | 8–16 GB |
+| Storage | 60 GB SSD | 100 GB SSD |
+| OS | Ubuntu 22.04 LTS | Ubuntu 22.04 LTS |
+
+> ⚠️ **Production:** Pisahkan VPS database dari VPS app. PostgreSQL dan Next.js di server yang sama akan menyebabkan resource contention saat traffic tinggi.
+
+### Initial Server Setup
+```bash
+# Update system
+sudo apt update && sudo apt upgrade -y
+sudo apt install -y curl git ufw
+
+# Firewall
+sudo ufw allow 22     # SSH
+sudo ufw allow 80     # HTTP
+sudo ufw allow 443    # HTTPS
+sudo ufw allow 8000   # Coolify (setup awal)
+sudo ufw enable
+
+# Install Docker
+curl -fsSL https://get.docker.com | sh
+sudo usermod -aG docker $USER
+newgrp docker
+
+# Install Coolify
+curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash
+```
+
+Setelah install: buka `http://[IP-VPS]:8000`, buat akun admin.
+
+---
+
+## 3. Coolify Configuration
+
+### Services yang Di-deploy via Coolify
+
+| Service | Port | Type |
+|---------|------|------|
+| Next.js Web | 3000 | Dockerfile |
+| Socket.io + Worker | 3001 | Dockerfile |
+| PostgreSQL | 5432 | Database |
+| Redis | 6379 | Database |
+
+### Setup Aplikasi di Coolify
+1. New Resource → Application
+2. Source: GitHub → pilih repo
+3. Branch: `main`
+4. Build Pack: `Dockerfile`
+5. Port: sesuai service
+6. Domain: `[domain].com`
+7. SSL: Enable (auto via Let's Encrypt / Traefik)
+
+### Environment Variables di Coolify
+Masukkan semua env vars production di Coolify UI — **JANGAN** di `.env` yang ter-commit:
+```
+DATABASE_URL=postgresql://user:pass@postgres:5432/myapp_prod
+REDIS_URL=redis://redis:6379
+BETTER_AUTH_SECRET=[generate baru untuk prod]
+BETTER_AUTH_URL=https://[domain].com
+XENDIT_SECRET_KEY=xnd_production_...
+XENDIT_CALLBACK_TOKEN=[random string panjang]
+XENDIT_FEE_RULE_ID=
+NEO_ENDPOINT=https://nos.wjv-1.neo.id
+NEO_ACCESS_KEY=
+NEO_SECRET_KEY=
+NEO_BUCKET_NAME=myapp-prod
+RESEND_API_KEY=
+NEXT_PUBLIC_APP_URL=https://[domain].com
+NODE_ENV=production
+```
+
+---
+
+## 4. Dockerfile
+
+### Next.js (`apps/web/Dockerfile`)
+```dockerfile
+FROM node:22-alpine AS base
+RUN apk add --no-cache libc6-compat
+
+FROM base AS deps
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+
+FROM base AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN npx prisma generate
+RUN npm run build
+
+FROM base AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nextjs
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+COPY --from=builder /app/public ./public
+USER nextjs
+EXPOSE 3000
+CMD ["node", "server.js"]
+```
+
+### Socket.io + Worker (`apps/worker/Dockerfile`)
+```dockerfile
+FROM node:22-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --only=production
+COPY . .
+EXPOSE 3001
+CMD ["node", "server.js"]
+```
+
+---
+
+## 5. GitHub Actions CI/CD
+
+### `.github/workflows/deploy.yml`
+```yaml
+name: Deploy Production
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run type-check
+      - run: npm run lint
+
+  deploy:
+    needs: check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Coolify Deploy
+        run: |
+          curl -X POST \
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}" \
+            "https://[IP-VPS]:8000/api/v1/deploy?uuid=${{ secrets.COOLIFY_APP_UUID }}"
+```
+
+### GitHub Secrets yang Diperlukan
+Di: Settings → Secrets → Actions
+```
+COOLIFY_TOKEN       → dari Coolify: Settings → API Keys
+COOLIFY_APP_UUID    → UUID aplikasi di Coolify
+```
+
+---
+
+## 6. Database Migration (Production)
+
+```bash
+# Jalankan migration di production via Coolify terminal atau SSH
+cd /app
+npx prisma migrate deploy
+
+# Jangan pernah pakai migrate dev di production!
+# migrate dev = reset + seed (bahaya di prod)
+# migrate deploy = apply pending migrations saja
+```
+
+### Supabase CLI untuk manage migrations
+```bash
+npm install -g prisma
+# Generate migration baru (di local)
+npx prisma migrate dev --name [nama_migration]
+# Push ke production
+npx prisma migrate deploy
+```
+
+---
+
+## 7. NEO Object Storage Setup
+
+### Buat Bucket di Portal Biznet Gio
+1. Login ke https://portal.biznetgio.com
+2. NEO Object Storage → Create Bucket
+3. Nama bucket: `myapp-prod`
+4. ACL: Private (akses via presigned URL)
+5. Salin Access Key + Secret Key → masukkan ke env vars Coolify
+
+### Konfigurasi CORS (untuk upload langsung dari browser)
+```json
+{
+  "CORSRules": [{
+    "AllowedOrigins": ["https://[domain].com"],
+    "AllowedMethods": ["GET", "PUT", "POST"],
+    "AllowedHeaders": ["*"],
+    "MaxAgeSeconds": 3000
+  }]
+}
+```
+
+---
+
+## 8. Backup Strategy
+
+### Backup PostgreSQL Harian ke NEO Object Storage
+```bash
+#!/bin/bash
+# /home/ubuntu/backup-db.sh
+
+DATE=$(date +%Y%m%d_%H%M%S)
+BACKUP_FILE="backup_${DATE}.sql.gz"
+BUCKET="myapp-backups"
+
+# Dump database
+docker exec postgres pg_dump -U produser myapp_prod | gzip > /tmp/${BACKUP_FILE}
+
+# Upload ke NEO Object Storage
+s3cmd put /tmp/${BACKUP_FILE} s3://${BUCKET}/${BACKUP_FILE} \
+  --host=nos.wjv-1.neo.id \
+  --host-bucket="%(bucket)s.nos.wjv-1.neo.id" \
+  --access_key=${NEO_ACCESS_KEY} \
+  --secret_key=${NEO_SECRET_KEY}
+
+# Hapus backup lokal
+rm /tmp/${BACKUP_FILE}
+
+# Hapus backup lebih dari 7 hari
+s3cmd ls s3://${BUCKET}/ | grep backup_ | sort | head -n -7 | \
+  awk '{print $4}' | xargs -I{} s3cmd del {}
+```
+
+### Setup Cron
+```bash
+# Jalankan backup setiap hari jam 02:00 WIB
+crontab -e
+0 19 * * * /home/ubuntu/backup-db.sh >> /var/log/backup.log 2>&1
+```
+
+---
+
+## 9. DNS & Domain Setup
+
+### Cloudflare DNS Records
+```
+A     @       [IP-VPS]        # apex domain
+A     www     [IP-VPS]        # www
+A     api     [IP-VPS]        # API subdomain (jika terpisah)
+A     ws      [IP-VPS]        # Socket.io (jika butuh subdomain)
+```
+
+### Cloudflare Settings
+- **SSL/TLS:** Full (strict)
+- **Auto HTTPS Redirect:** On
+- **WebSocket:** On (untuk Socket.io)
+- **Cache Level:** Standard
+
+### ⚠️ Wajib: Accept Cloudflare DPA
+Setelah domain aktif di Cloudflare, accept Data Processing Addendum:
+1. Login Cloudflare → klik nama akun kanan atas
+2. **My Profile → Privacy → Data Processing Addendum**
+3. Klik "Accept DPA"
+
+Ini menjadikan Cloudflare sub-processor sah sesuai UU PDP. Tanpa ini, IP address pengguna yang diproses Cloudflare tidak memiliki mekanisme transfer lintas negara yang sah.
+
+> ⚠️ Socket.io butuh WebSocket support — pastikan Cloudflare proxy diaktifkan dengan setting WebSocket = On, atau bypass proxy untuk subdomain Socket.io.
+
+---
+
+## 10. Deployment Checklist
+
+### Sebelum Deploy ke Production
+- [ ] `npm run build` sukses tanpa error di local
+- [ ] `npm run lint` bersih
+- [ ] `npx prisma migrate deploy` sudah dijalankan
+- [ ] Semua env vars sudah diset di Coolify
+- [ ] Xendit callback URL sudah diupdate ke domain production
+- [ ] Firebase project sudah switch ke production — **hanya FCM yang diaktifkan** (Analytics/Crashlytics/Performance = OFF)
+- [ ] Backup database terakhir tersimpan
+- [ ] Test manual di staging (jika ada)
+
+### UU PDP Compliance (sekali saja, sebelum go-live pertama)
+- [ ] **Cloudflare DPA** sudah di-accept → Dashboard → My Profile → Privacy → Data Processing Addendum
+- [ ] **Firebase Data Processing Terms** sudah di-accept → Firebase Console → Project Settings → Usage and billing
+- [ ] Privacy Policy mencantumkan Cloudflare, Firebase, Resend sebagai **sub-processor**
+- [ ] Halaman Privacy Policy & Terms of Service tersedia dalam Bahasa Indonesia di app
+- [ ] Consent flow saat registrasi aktif (checkbox **tidak** pre-checked)
+- [ ] Tabel `consent_records` ada di database dan berfungsi
+- [ ] Fitur **hapus akun** tersedia di settings pengguna
+- [ ] Fitur **unduh data saya** tersedia di settings pengguna
+
+### Setelah Deploy
+- [ ] Aplikasi bisa diakses via domain
+- [ ] SSL certificate valid (https berjalan)
+- [ ] Login berhasil
+- [ ] Test pembayaran Xendit (mode production)
+- [ ] Cek logs tidak ada error critical di Coolify
+- [ ] Uptime Kuma mendeteksi service UP
+- [ ] Monitor resource VPS 15 menit pertama
+
+---
+
+## 11. Troubleshooting
+
+### Container tidak mau start
+```bash
+# Cek logs di Coolify UI atau via SSH
+docker logs [container-name] --tail 100 -f
+docker ps -a   # lihat status semua container
+```
+
+### Database connection error
+```bash
+# Test koneksi PostgreSQL
+docker exec postgres psql -U produser -d myapp_prod -c "SELECT 1"
+# Cek env DATABASE_URL sudah benar
+```
+
+### Xendit webhook tidak masuk
+1. Cek Xendit Dashboard → Settings → Webhooks
+2. Pastikan URL sudah benar dan HTTPS
+3. Test dengan Xendit webhook tester
+4. Cek logs di Coolify untuk error
+5. Pastikan `XENDIT_CALLBACK_TOKEN` sama antara Xendit dan env vars
+
+### Socket.io tidak connect
+1. Pastikan port 3001 tidak diblok firewall
+2. Pastikan Cloudflare WebSocket = On
+3. Cek CORS origin di Socket.io server sudah include domain production

package/templates/docs/06-DEVELOPMENT-LOG.md

@@ -0,0 +1,78 @@
+# 06 — Development Log
+> File ini **append-only** — JANGAN edit entry lama, hanya tambah di bawah.
+> Catat setiap keputusan teknis, perubahan arsitektur, dan lesson learned.
+> AI membaca ini untuk memahami kenapa sebuah keputusan dibuat.
+
+---
+
+## Cara Menambah Entry
+
+```
+## YYYY-MM-DD
+
+### [KEPUTUSAN] Judul singkat
+**Konteks:** Apa situasinya?
+**Keputusan:** Apa yang dipilih?
+**Alasan:** Kenapa ini dipilih vs alternatif lain?
+**Dampak:** Apa konsekuensinya?
+```
+
+**Kategori:** `[KEPUTUSAN]` `[PERUBAHAN]` `[PROBLEM]` `[RISET]` `[REGULASI]` `[DEPLOY]`
+
+---
+
+## Maret 2026
+
+### [KEPUTUSAN] Stack teknologi final
+**Konteks:** Memilih stack untuk aplikasi multi-platform (Web + Mobile + Marketplace).
+**Keputusan:** Next.js 16.1 + Flutter 3.41.2 + PostgreSQL 17 + Prisma 7 + Better Auth 1.5 + Coolify di Biznet Gio VPS.
+**Alasan:** Next.js 16 App Router terbaik untuk SSR/SSG. Flutter untuk single codebase Android+iOS. Biznet Gio untuk data residency Indonesia. Coolify untuk self-hosted PaaS tanpa vendor lock-in.
+**Dampak:** Semua developer wajib familiar dengan App Router, async params, dan async headers() di Next.js 16.
+
+### [KEPUTUSAN] Data fetching: Server Components default + TanStack Query client
+**Konteks:** Memilih strategi data fetching untuk Next.js 16.
+**Keputusan:** Server Components (default, sebagian besar data) + TanStack Query (client mutations/optimistic UI/realtime).
+**Alasan:** Server Components = zero bundle, SEO, langsung query Prisma. TanStack Query (12.3M weekly downloads) lebih powerful dari SWR.
+**Dampak:** Default fetch di server — TanStack Query hanya untuk client interaktif.
+
+### [KEPUTUSAN] Arsitektur: Modular Monolith
+**Konteks:** Memilih arsitektur untuk tim 2–3 orang.
+**Keputusan:** Modular Monolith — 1 Next.js app + 1 BullMQ Worker container.
+**Alasan:** Di bawah 10 developer monolith selalu lebih produktif. Expert consensus 2025: microservices di tahap ini = "trading a cluttered closet for a burning warehouse".
+**Dampak:** Kode per domain (auth/, payment/, orders/). Extract microservice hanya jika ada bottleneck teridentifikasi.
+
+### [KEPUTUSAN] CDN: Cloudflare Free + NEO Object Storage
+**Konteks:** Strategi CDN dan file storage.
+**Keputusan:** Cloudflare Free (DNS/DDoS/proxy) + NEO Object Storage Biznet Gio.
+**Alasan:** Cloudflare + VPS Indonesia cukup untuk user lokal. NEO sudah di stack, data di Indonesia (comply UU PDP). Catatan: November 2025 Kominfo ancam blokir Cloudflare — Bunny.net bisa jadi backup.
+**Dampak:** Wajib accept Cloudflare DPA. NEO bucket = private, akses via presigned URL.
+
+### [KEPUTUSAN] Push Notifications: Firebase FCM only
+**Konteks:** Provider push notif untuk Flutter.
+**Keputusan:** Firebase FCM — hanya `firebase_messaging`.
+**Alasan:** Gratis, unlimited, official Google SDK Flutter. Android dari Play Store wajib FCM. OneSignal tetap pakai FCM di balik layar.
+**Dampak:** JANGAN aktifkan Firebase Analytics/Crashlytics/Performance — pakai Sentry. Accept Firebase Data Processing Terms di Console.
+
+### [KEPUTUSAN] Payment Gateway: Xendit
+**Konteks:** Perlu split payment native untuk marketplace.
+**Keputusan:** Xendit.
+**Alasan:** Satu-satunya gateway Indonesia dengan native split payment API. Terdaftar OJK. Fee: VA Rp 4.000, QRIS 0.7%, CC 2.9%+Rp2.000.
+**Dampak:** Platform tidak pernah tampung dana. Hanya install di app yang ada transaksi keuangan.
+
+### [REGULASI] UU PDP — Cloudflare DPA + Firebase DPT
+**Konteks:** UU PDP No. 27/2022 berlaku efektif Oktober 2024.
+**Keputusan:** Accept Cloudflare DPA + Firebase Data Processing Terms.
+**Alasan:** UU PDP tidak wajibkan semua data di Indonesia — yang wajib adalah mekanisme transfer sah. DPA/DPT memenuhi syarat. PostgreSQL tetap di Biznet Gio.
+**Dampak:** Privacy Policy wajib cantumkan Cloudflare, Firebase, Resend sebagai sub-processor. Data breach: lapor Komdigi + user dalam 72 jam.
+
+### [KEPUTUSAN] Antigravity: Rules + 8 Skills + 6 Workflows + MCP
+**Konteks:** Standarisasi cara kerja AI agent.
+**Keputusan:** Rules + 8 Skills + 6 Workflows + MCP servers (Context7, GitHub, PostgreSQL, Playwright, Sentry, Docker).
+**Alasan:** Rules = selalu aktif. Skills = pengetahuan stack on-demand. Workflows = automation. Context7 kritis untuk Prisma 7 + Next.js 16 yang sering breaking change.
+**Dampak:** Developer baru langsung dapat config yang sama. Wajib `use context7` saat coding Prisma/Next.js.
+
+### [PERUBAHAN] Next.js 16: `headers()` harus di-await
+**Konteks:** Setelah setup ditemukan Next.js 16 membuat `headers()` juga async.
+**Perubahan:** Semua `headers()` harus `await` — termasuk di Better Auth `getSession()` dan Xendit webhook.
+**Kenapa:** Breaking change Next.js 16.
+**Dampak:** Pattern baru: `await auth.api.getSession({ headers: await headers() })` dan `(await headers()).get('x-callback-token')`. Ditambahkan ke rules dan semua code examples.

package/templates/specs/README.md

@@ -0,0 +1,54 @@
+# specs/ — Feature Spec Files
+
+Folder ini berisi spec singkat per fitur **sebelum** AI mulai coding.
+Konsep dari KhazP/vibe-coding-prompt-template — "agent handoff artifacts".
+
+## Kenapa Perlu Ini?
+
+Antigravity agent bekerja terbaik dengan konteks yang terfokus.
+Daripada langsung bilang "buat fitur checkout", tulis spec dulu di sini —
+agent punya blueprint yang jelas dan tidak akan salah arah.
+
+## Format File
+
+Nama file: `NNN-nama-fitur.md` (contoh: `001-checkout.md`, `002-profile-edit.md`)
+
+```markdown
+# [NNN] Nama Fitur
+
+**Status:** Draft / Ready / In Progress / Done
+**Sprint:** [nomor sprint]
+**Assignee:** [nama atau "AI"]
+**Estimasi:** S / M / L
+
+## Tujuan
+[1-2 kalimat: kenapa fitur ini dibangun]
+
+## Acceptance Criteria
+- [ ] [kriteria 1 — testable, konkret]
+- [ ] [kriteria 2]
+- [ ] [kriteria 3]
+
+## File yang Akan Diubah
+- `app/(dashboard)/[path]/page.tsx`
+- `lib/[module]/index.ts`
+- `prisma/schema.prisma` (jika ada perubahan DB)
+
+## API / Data yang Dibutuhkan
+- `GET /api/[resource]` — [deskripsi]
+- `POST /api/[resource]` — [deskripsi]
+
+## Constraint
+- Jangan ubah: [komponen/file yang tidak boleh diubah]
+- Dependensi: [fitur lain yang harus selesai dulu]
+
+## Catatan Tambahan
+[hal-hal penting lainnya]
+```
+
+## Cara Pakai di Antigravity
+
+```
+Baca specs/001-checkout.md, lalu implementasikan sesuai acceptance criteria.
+Jangan ubah file selain yang tercantum di "File yang Akan Diubah".
+```