vibes-plug 1.0.0 → 2.11.0

package/skills/desktop-electron-expert/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: desktop-electron-expert
+description: "Expert guide for Electron 33+ desktop application development — Electron Forge, context isolation, IPC security, native menus, auto-updates, and multi-window management / Panduan ahli pengembangan desktop Electron 33+."
+author: "Roedy Rustam"
+---
+
+# Desktop Electron Expert (2026 Edition)
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Orchestration & Integration
+- **`tauri-expert`**: Comparing Electron vs. Tauri architectures for desktop targets.
+- **`senior-frontend`**: React/Vue frontend architecture inside Electron renderers.
+- **`ci-cd-devops-architect`**: Multi-platform desktop packaging (Windows MSI/EXE, macOS DMG, Linux AppImage).
+- **`error-resilience-expert`**: Crash reporting and main/renderer crash recovery.
+
+### Description
+Production guide for engineering secure, high-performance cross-platform desktop applications using Electron 33+. Covers secure IPC communication via `contextBridge`, mandatory Context Isolation and Sandbox modes, native system integrations (tray, notifications, menus, global shortcuts), auto-updates with `electron-updater`, and build automation with Electron Forge / electron-builder.
+
+### Trigger Conditions
+- Building desktop apps with web technologies using Electron.
+- Hardening Electron security (Context Isolation, Preload scripts, CSP, nodeIntegration: false).
+- Implementing typed IPC communication between Main and Renderer processes.
+- Setting up auto-update workflows and multi-OS code signing.
+
+---
+
+### Core Security & Architecture Patterns
+
+#### 1. Secure Main Process (`main.ts`)
+```typescript
+import { app, BrowserWindow, ipcMain } from 'electron';
+import path from 'path';
+
+let mainWindow: BrowserWindow | null = null;
+
+function createWindow() {
+  mainWindow = new BrowserWindow({
+    width: 1200,
+    height: 800,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload.js'),
+      contextIsolation: true,       // MANDATORY for security
+      nodeIntegration: false,        // NEVER enable in renderer
+      sandbox: true,                 // Enable OS-level sandbox
+      webSecurity: true,
+    },
+  });
+
+  if (process.env.NODE_ENV === 'development') {
+    mainWindow.loadURL('http://localhost:5173');
+  } else {
+    mainWindow.loadFile(path.join(__dirname, '../dist/index.html'));
+  }
+}
+
+app.whenReady().then(() => {
+  createWindow();
+
+  // Typed IPC Handlers
+  ipcMain.handle('app:get-version', () => app.getVersion());
+  ipcMain.handle('file:read-config', async (_event, configName: string) => {
+    // Validate arguments safely
+    return { name: configName, loaded: true };
+  });
+});
+```
+
+#### 2. Type-Safe Preload Script (`preload.ts`)
+```typescript
+import { contextBridge, ipcRenderer } from 'electron';
+
+export interface ElectronAPI {
+  getVersion: () => Promise<string>;
+  readConfig: (name: string) => Promise<any>;
+}
+
+const api: ElectronAPI = {
+  getVersion: () => ipcRenderer.invoke('app:get-version'),
+  readConfig: (name: string) => ipcRenderer.invoke('file:read-config', name),
+};
+
+contextBridge.exposeInMainWorld('electronAPI', api);
+```
+
+#### 3. Renderer Consumer (`renderer.tsx`)
+```tsx
+declare global {
+  interface Window {
+    electronAPI: ElectronAPI;
+  }
+}
+
+import React, { useEffect, useState } from 'react';
+
+export function AppInfo() {
+  const [version, setVersion] = useState<string>('');
+
+  useEffect(() => {
+    window.electronAPI.getVersion().then(setVersion);
+  }, []);
+
+  return <div>App Version: {version}</div>;
+}
+```
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Integrasi Orkestrasi
+- **`tauri-expert`**: Pemilihan dan perbandingan antara Electron dan Tauri untuk aplikasi desktop.
+- **`senior-frontend`**: Integrasi framework frontend (React/Vue) di dalam renderer Electron.
+- **`ci-cd-devops-architect`**: Otomasi build installer cross-platform (.exe, .dmg, .AppImage).
+
+### Deskripsi
+Panduan produksi untuk membangun aplikasi desktop cross-platform yang aman dan efisien menggunakan Electron 33+. Mengutamakan keamanan IPC dengan Context Isolation, isolasi proses renderer, integrasi sistem natif (system tray, menu, notifikasi), dan alur auto-update otomatis.
+
+### Kondisi Pemicu
+- Membangun aplikasi desktop menggunakan teknologi web berbasis Electron.
+- Memperketat keamanan Electron (Context Isolation, Sandbox, sanitasi IPC).
+- Mengonfigurasi auto-updater dan packaging multi-OS.

package/skills/documentation-site-expert/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: documentation-site-expert
+description: "Expert guide for technical documentation sites (Mintlify, Docusaurus, Storybook, VitePress) and component documentation / Panduan ahli situs dokumentasi teknis (Mintlify, Docusaurus, Storybook, VitePress) dan dokumentasi komponen."
+author: "Roedy Rustam"
+---
+
+# Documentation Site Expert (2026 Edition)
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Orchestration & Integration
+- **`openapi-swagger-codegen-expert`**: Auto-generated API documentation.
+- **`design-system-architect`**: Component documentation with Storybook.
+- **`astro-framework-expert`**: Astro Starlight for docs sites.
+- **`seo`**: Documentation site SEO and discoverability.
+
+### Description
+Expert guide for building technical documentation sites and component libraries. Covers Mintlify (AI-native docs), Docusaurus 3 (React-powered), Storybook 8 (component playground), VitePress (Vue-powered), Astro Starlight (Astro-powered), and MDX authoring. Includes API reference generation, versioning, search integration, and interactive code playgrounds.
+
+### Trigger Conditions
+- Creating documentation sites for APIs, libraries, or products.
+- Setting up Storybook for component documentation.
+- Choosing a documentation framework.
+- Generating API reference docs from OpenAPI specs.
+
+---
+
+### Framework Selection
+
+| Framework | Stack | Search | Versioning | Best For |
+|-----------|-------|--------|------------|----------|
+| Mintlify | React/MDX | ✅ Built-in AI | ✅ | SaaS API docs |
+| Docusaurus 3 | React/MDX | ✅ Algolia | ✅ | OSS project docs |
+| Storybook 8 | Any framework | ❌ | ❌ | Component docs/playground |
+| VitePress | Vue/Markdown | ✅ Built-in | ❌ | Vue ecosystem docs |
+| Starlight | Astro/MDX | ✅ Pagefind | ✅ | Content-heavy docs |
+
+**Recommendation:** Use **Mintlify** for SaaS API docs. Use **Docusaurus** for open-source projects. Use **Storybook** for component libraries.
+
+## Orchestration & Integration
+- `openapi-swagger-codegen-expert`, `design-system-architect`, `seo`
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Panduan ahli untuk membangun situs dokumentasi teknis dan library komponen. Mencakup Mintlify, Docusaurus 3, Storybook 8, VitePress, dan Astro Starlight.
+
+### Kondisi Pemicu
+- Membuat situs dokumentasi untuk API, library, atau produk.
+- Menyiapkan Storybook untuk dokumentasi komponen.
+- Memilih framework dokumentasi.

package/skills/doku-mcp-server/SKILL.md

@@ -0,0 +1,257 @@
+---
+name: doku-mcp-server
+description: "Expert guide for DOKU Model Context Protocol (MCP) Server integration. Enables AI Agentic Commerce with tools for payment links, Virtual Accounts, QRIS, transaction status checks, and client configuration (Claude Desktop, Cursor, AGY) / Panduan ahli DOKU MCP Server untuk AI Agentic Commerce."
+author: "Roedy Rustam"
+---
+
+# DOKU MCP Server / Server Model Context Protocol DOKU
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Orchestration & Integration
+Connects and orchestrates with relevant domain skills like `brainstorming`, `zero-to-prod-orchestrator`, and `project-context-mapper` to ensure cohesive execution.
+
+### Description
+Expert guide for integrating and building Model Context Protocol (MCP) servers with DOKU Payment Gateway based on [DOKU Developers Documentation](https://developers.doku.com/). Enables AI Agents (Claude Desktop, Antigravity, Cursor, n8n, LangChain) to execute payment tasks autonomously using Agentic Commerce capabilities (generating payment links, issuing Virtual Account numbers, generating QRIS codes, querying transaction statuses).
+
+### Trigger Conditions
+Activate this skill when the user is:
+- Setting up or configuring DOKU MCP server for Claude Desktop, Antigravity (AGY), Cursor, or LLM agents.
+- Implementing AI Agentic Commerce or autonomous AI-driven checkout workflows using DOKU.
+- Building a custom TypeScript or Python MCP server wrapping DOKU Jokul API.
+- Defining MCP tools and resources for payment generation and status verification.
+
+---
+
+### Key Capabilities & Tools
+
+| MCP Tool Name | Description | Key Input Parameters |
+|---|---|---|
+| `create_checkout_payment` | Generates a DOKU Checkout URL / Payment Link for host-managed payment page | `amount`, `invoice_number`, `customer_name`, `customer_email` |
+| `create_virtual_account` | Generates a specific bank Virtual Account number (BCA, Mandiri, BRI, BNI, Permata, DOKU) | `bank_code`, `amount`, `invoice_number`, `customer_name` |
+| `create_qris_payment` | Generates a dynamic QRIS string/image for instant wallet payments | `amount`, `invoice_number`, `store_name` |
+| `check_transaction_status` | Queries real-time transaction payment status | `invoice_number` or `transaction_id` |
+
+---
+
+### Client Configuration
+
+#### 1. Antigravity & Gemini Configuration (`mcp.json`)
+
+**Location:**
+- **Global:** `~/.gemini/config/mcp.json` (Windows: `%USERPROFILE%\.gemini\config\mcp.json`)
+- **Workspace:** `.agents/mcp.json` (in your project root)
+
+```json
+{
+  "mcpServers": {
+    "doku-payment": {
+      "command": "node",
+      "args": ["/path/to/doku-mcp-server/dist/index.js"],
+      "env": {
+        "DOKU_CLIENT_ID": "YOUR_SANDBOX_OR_PROD_CLIENT_ID",
+        "DOKU_SECRET_KEY": "YOUR_SANDBOX_OR_PROD_SECRET_KEY",
+        "DOKU_IS_PRODUCTION": "false"
+      }
+    }
+  }
+}
+```
+
+#### 2. Claude Desktop Configuration (`claude_desktop_config.json`)
+
+**Location:**
+- **Windows:** `%APPDATA%\Claude\claude_desktop_config.json`
+- **macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`
+
+```json
+{
+  "mcpServers": {
+    "doku-payment": {
+      "command": "node",
+      "args": ["/path/to/doku-mcp-server/dist/index.js"],
+      "env": {
+        "DOKU_CLIENT_ID": "YOUR_SANDBOX_OR_PROD_CLIENT_ID",
+        "DOKU_SECRET_KEY": "YOUR_SANDBOX_OR_PROD_SECRET_KEY",
+        "DOKU_IS_PRODUCTION": "false"
+      }
+    }
+  }
+}
+```
+
+#### 3. Environment Variables & Authentication
+DOKU API authentication requires API Key credentials. When using standard HTTP header authentication:
+- API Keys are configured in your environment or encoded as Base64 for the MCP `Authorization` header.
+- Use Sandbox (`https://api-sandbox.doku.com`) during development and testing.
+
+---
+
+### Building a Custom TypeScript MCP Server for DOKU
+
+```typescript
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import crypto from 'crypto';
+
+const CLIENT_ID = process.env.DOKU_CLIENT_ID || '';
+const SECRET_KEY = process.env.DOKU_SECRET_KEY || '';
+const BASE_URL = process.env.DOKU_IS_PRODUCTION === 'true' 
+  ? 'https://api.doku.com' 
+  : 'https://api-sandbox.doku.com';
+
+function generateHeaders(targetPath: string, payload: object) {
+  const requestId = crypto.randomUUID();
+  const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
+  const jsonBody = JSON.stringify(payload);
+  const digest = crypto.createHash('sha256').update(jsonBody, 'utf8').digest('base64');
+
+  const component = `Client-Id:${CLIENT_ID}\nRequest-Id:${requestId}\nRequest-Timestamp:${timestamp}\nRequest-Target:${targetPath}\nDigest:${digest}`;
+  const signature = 'HMACSHA256=' + crypto.createHmac('sha256', SECRET_KEY).update(component).digest('base64');
+
+  return {
+    'Content-Type': 'application/json',
+    'Client-Id': CLIENT_ID,
+    'Request-Id': requestId,
+    'Request-Timestamp': timestamp,
+    'Request-Target': targetPath,
+    'Digest': digest,
+    'Signature': signature
+  };
+}
+
+const server = new Server(
+  { name: 'doku-mcp-server', version: '1.0.0' },
+  { capabilities: { tools: {} } }
+);
+
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+  tools: [
+    {
+      name: 'create_checkout_payment',
+      description: 'Generate a DOKU payment checkout URL for customer order',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          amount: { type: 'number', description: 'Total payment amount in IDR' },
+          invoice_number: { type: 'string', description: 'Unique order invoice number' },
+          customer_name: { type: 'string', description: 'Customer full name' },
+          customer_email: { type: 'string', description: 'Customer email address' }
+        },
+        required: ['amount', 'invoice_number', 'customer_name', 'customer_email']
+      }
+    },
+    {
+      name: 'check_transaction_status',
+      description: 'Check payment status of a transaction',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          invoice_number: { type: 'string', description: 'Invoice number to query' }
+        },
+        required: ['invoice_number']
+      }
+    }
+  ]
+}));
+
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+  const { name, arguments: args } = request.params;
+
+  if (name === 'create_checkout_payment') {
+    const targetPath = '/checkout/v1/payment';
+    const body = {
+      order: { amount: args?.amount, invoice_number: args?.invoice_number },
+      customer: { name: args?.customer_name, email: args?.customer_email }
+    };
+
+    const response = await fetch(`${BASE_URL}${targetPath}`, {
+      method: 'POST',
+      headers: generateHeaders(targetPath, body),
+      body: JSON.stringify(body)
+    });
+
+    const data = await response.json();
+    return {
+      content: [{ type: 'text', text: JSON.stringify(data, null, 2) }]
+    };
+  }
+
+  throw new Error(`Tool not found: ${name}`);
+});
+
+async function main() {
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+main().catch(console.error);
+```
+
+---
+
+### Common Pitfalls to Avoid
+
+| Anti-Pattern | Issue | Solution |
+|---|---|---|
+| Hardcoding Merchant Secrets | Security vulnerability | Always load `DOKU_CLIENT_ID` and `DOKU_SECRET_KEY` from environment variables. |
+| Incomplete Tool Schema Descriptions | AI Agent misinterprets tool usage | Provide clear parameter descriptions and strict `required` fields in JSON schema. |
+| Returning Raw Errors | Unfriendly LLM agent experience | Catch API errors and return structured error JSON response in MCP tool text output. |
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Integrasi Orkestrasi
+Terhubung dan mengorkestrasi skill domain yang relevan seperti `brainstorming`, `zero-to-prod-orchestrator`, dan `project-context-mapper` untuk memastikan eksekusi yang kohesif.
+
+### Deskripsi
+Panduan ahli untuk mengintegrasikan dan membuat server Model Context Protocol (MCP) dengan DOKU Payment Gateway berdasarkan dokumentasi resmi [DOKU Developers Documentation](https://developers.doku.com/). Memungkinkan Agen AI (Claude Desktop, Antigravity, Cursor, n8n, LangChain) menjalankan transaksi pembayaran secara otonom dalam alur Agentic Commerce (membuat link pembayaran, membuat nomor Virtual Account, membuat kode QRIS, dan memeriksa status transaksi).
+
+### Kondisi Pemicu
+Aktifkan skill ini ketika pengguna sedang:
+- Mengatur atau mengonfigurasi server DOKU MCP untuk Claude Desktop, Antigravity (AGY), Cursor, atau agen LLM.
+- Mengimplementasikan alur kerja checkout otonom berbasis AI (AI Agentic Commerce) menggunakan DOKU.
+- Membangun server MCP TypeScript atau Python kustom yang membungkus DOKU Jokul API.
+- Mendefinisikan tool dan resource MCP untuk pembuatan dan verifikasi status pembayaran.
+
+### Konfigurasi Client untuk Antigravity & Gemini
+
+**Lokasi File Konfigurasi (`mcp.json`):**
+- **Global:** `~/.gemini/config/mcp.json` (Windows: `%USERPROFILE%\.gemini\config\mcp.json`)
+- **Workspace:** `.agents/mcp.json` (di dalam folder proyek)
+
+```json
+{
+  "mcpServers": {
+    "doku-payment": {
+      "command": "node",
+      "args": ["/path/to/doku-mcp-server/dist/index.js"],
+      "env": {
+        "DOKU_CLIENT_ID": "CLIENT_ID_SANDBOX_ATAU_PROD",
+        "DOKU_SECRET_KEY": "SECRET_KEY_SANDBOX_ATAU_PROD",
+        "DOKU_IS_PRODUCTION": "false"
+      }
+    }
+  }
+}
+```
+
+### Integrasi dengan Skill Lain
+- `mcp-server-architect` — Untuk arsitektur dan pengamanan server MCP tingkat lanjut.
+- `doku-payment-gateway` — Untuk rumus signature HMAC-SHA256 dan API spesifik DOKU.
+- `multi-agent-orchestration` — Untuk mengaitkan DOKU MCP Server dengan swarm agen AI otonom.
+
+---
+### 🚨 SNAP Integration Mandate (CRITICAL)
+**MANDATORY**: The AI Agent MUST automatically apply the SNAP API v1.0 standard (Standard Nasional Open API Pembayaran) for all DOKU integrations, instead of the legacy Jokul API v2, unless the user explicitly requests otherwise. All generated signatures, headers, and endpoints MUST follow the SNAP BI standard.
+
+### 🧪 DOKU Sandbox Simulator
+**MANDATORY**: When testing in Sandbox mode and needing to access the Payment Simulator, the AI Agent MUST use this exact URL: `https://sandbox.doku.com/gtw-config-v2/simulator`.

package/skills/doku-payment-gateway/SKILL.md

@@ -0,0 +1,233 @@
+---
+name: doku-payment-gateway
+description: "Expert guide for integrating DOKU Payment Gateway (Jokul API v2). Covers HMAC-SHA256 header signature calculation, Checkout & Direct APIs (VA, QRIS, E-Wallet, Credit Card), webhook notification verification, and sandbox/production setup / Panduan ahli integrasi DOKU Payment Gateway."
+author: "Roedy Rustam"
+---
+
+# DOKU Payment Gateway Integration / Integrasi Payment Gateway DOKU
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Orchestration & Integration
+Connects and orchestrates with relevant domain skills like `brainstorming`, `zero-to-prod-orchestrator`, and `project-context-mapper` to ensure cohesive execution.
+
+### Description
+Expert guide for implementing DOKU Payment Gateway (Jokul API v2) integrations based on official [DOKU Developers Documentation](https://developers.doku.com/). Covers authentication headers, SHA-256 Digest generation, HMAC-SHA256 request signature construction, Webhook notification verification, Checkout Payment Links, Direct Payments (Virtual Account, QRIS, E-Wallet, Credit Card), error handling, and sandbox/production deployment.
+
+### Trigger Conditions
+Activate this skill when the user is:
+- Building or refactoring DOKU Payment Gateway integration in Node.js, TypeScript, Python, Go, PHP, or Java.
+- Implementing HMAC-SHA256 signature calculations or notification signature verification for DOKU API.
+- Setting up DOKU Virtual Account (BCA, Mandiri, BRI, BNI, Permata, DOKU VA), QRIS, E-Wallet (OVO, ShopeePay, DANA, LinkAja), or Credit Card APIs.
+- Debugging DOKU API authorization errors (e.g., `Authorization Failed`, invalid signature, incorrect timestamp format).
+
+---
+
+### Core Architecture & Credentials
+
+#### Environment Gateways
+| Environment | Base URL | Dashboard Portal |
+|---|---|---|
+| **Sandbox** | `https://api-sandbox.doku.com` | `https://sandbox.doku.com` |
+| **Production** | `https://api.doku.com` | `https://dashboard.doku.com` |
+
+#### Mandatory Headers
+Every request sent to DOKU API requires the following headers:
+- `Client-Id`: Merchant Client ID from DOKU Back Office.
+- `Request-Id`: Unique random string generated for each request (e.g., UUID v4).
+- `Request-Timestamp`: UTC ISO8601 timestamp string (e.g., `2026-08-07T13:00:00Z`).
+- `Request-Target`: Target API endpoint path (e.g., `/checkout/v1/payment` or `/doku-virtual-account/v2/payment-code`).
+- `Digest`: Base64 encoded SHA-256 hash of the JSON payload string (Omitted for `GET` requests).
+- `Signature`: Format `HMACSHA256=<base64-signature>`.
+
+---
+
+### Signature Calculation Formula
+
+#### 1. Digest Calculation (POST / PUT / PATCH)
+```text
+Raw Body -> SHA-256 Hash -> Base64 Encode -> Digest String
+```
+
+#### 2. Signature Component String
+The components MUST be concatenated with newline `\n` without extra whitespace:
+```text
+Client-Id:<CLIENT_ID>\nRequest-Id:<REQUEST_ID>\nRequest-Timestamp:<TIMESTAMP>\nRequest-Target:<TARGET_PATH>\nDigest:<DIGEST_STRING>
+```
+*Note: For GET requests, omit `\nDigest:<DIGEST_STRING>`.*
+
+#### 3. HMAC-SHA256 Signing
+```text
+Raw String + Secret Key -> HMAC-SHA256 Hash -> Base64 Encode -> Prepend "HMACSHA256="
+```
+
+---
+
+### TypeScript / Node.js Implementation Example
+
+```typescript
+import crypto from 'crypto';
+
+interface DokuConfig {
+  clientId: string;
+  secretKey: string;
+  isProduction: boolean;
+}
+
+export class DokuService {
+  private clientId: string;
+  private secretKey: string;
+  private baseUrl: string;
+
+  constructor(config: DokuConfig) {
+    this.clientId = config.clientId;
+    this.secretKey = config.secretKey;
+    this.baseUrl = config.isProduction
+      ? 'https://api.doku.com'
+      : 'https://api-sandbox.doku.com';
+  }
+
+  private generateDigest(body: object): string {
+    const jsonBody = JSON.stringify(body);
+    return crypto.createHash('sha256').update(jsonBody, 'utf8').digest('base64');
+  }
+
+  private generateSignature(
+    requestId: string,
+    timestamp: string,
+    targetPath: string,
+    digest?: string
+  ): string {
+    let rawComponent = `Client-Id:${this.clientId}\nRequest-Id:${requestId}\nRequest-Timestamp:${timestamp}\nRequest-Target:${targetPath}`;
+    
+    if (digest) {
+      rawComponent += `\nDigest:${digest}`;
+    }
+
+    const hmac = crypto.createHmac('sha256', this.secretKey);
+    hmac.update(rawComponent);
+    const base64Hmac = hmac.digest('base64');
+
+    return `HMACSHA256=${base64Hmac}`;
+  }
+
+  public async createCheckoutPayment(payload: {
+    order: { amount: number; invoice_number: string };
+    payment: { payment_due_date?: number };
+    customer: { name: string; email: string };
+  }) {
+    const targetPath = '/checkout/v1/payment';
+    const requestId = crypto.randomUUID();
+    const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
+    const digest = this.generateDigest(payload);
+    const signature = this.generateSignature(requestId, timestamp, targetPath, digest);
+
+    const response = await fetch(`${this.baseUrl}${targetPath}`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Client-Id': this.clientId,
+        'Request-Id': requestId,
+        'Request-Timestamp': timestamp,
+        'Request-Target': targetPath,
+        'Digest': digest,
+        'Signature': signature,
+      },
+      body: JSON.stringify(payload),
+    });
+
+    return await response.json();
+  }
+}
+```
+
+---
+
+### Webhook / Notification Signature Verification
+
+When DOKU sends a payment status notification to your webhook URL, you MUST verify its signature before processing.
+
+```typescript
+import crypto from 'crypto';
+import { Request, Response } from 'express';
+
+export function verifyDokuWebhook(req: Request, secretKey: string): boolean {
+  const clientId = req.headers['client-id'] as string;
+  const requestId = req.headers['request-id'] as string;
+  const timestamp = req.headers['request-timestamp'] as string;
+  const targetPath = req.originalUrl || req.url;
+  const receivedSignature = req.headers['signature'] as string;
+
+  const rawBody = JSON.stringify(req.body);
+  const digest = crypto.createHash('sha256').update(rawBody, 'utf8').digest('base64');
+
+  const component = `Client-Id:${clientId}\nRequest-Id:${requestId}\nRequest-Timestamp:${timestamp}\nRequest-Target:${targetPath}\nDigest:${digest}`;
+  
+  const calculatedHmac = crypto
+    .createHmac('sha256', secretKey)
+    .update(component)
+    .digest('base64');
+  
+  const expectedSignature = `HMACSHA256=${calculatedHmac}`;
+
+  return crypto.timingSafeEqual(
+    Buffer.from(receivedSignature),
+    Buffer.from(expectedSignature)
+  );
+}
+```
+
+
+---
+
+### Common Pitfalls to Avoid
+
+| Anti-Pattern | Issue | Solution |
+|---|---|---|
+| Extra trailing newline in component string | Signature validation fails (`Authorization Failed`) | Do not add `\n` at the end of the raw component string. |
+| Non-UTC ISO8601 timestamp | Timestamp mismatch error | Always format timestamp with UTC Z timezone (e.g. `2026-08-07T13:00:00Z`). |
+| Including Digest on `GET` requests | Signature mismatch | Omit `Digest` line completely when calculating signature for `GET` endpoints. |
+| Unsorted JSON body in digest calculation | Body hash mismatch | Pass exact raw stringified JSON body used in HTTP POST. |
+| Missing Idempotency Check | Duplicate processing on webhooks | Save `invoice_number` / `transaction_id` status in DB before executing state changes. |
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Integrasi Orkestrasi
+Terhubung dan mengorkestrasi skill domain yang relevan seperti `brainstorming`, `zero-to-prod-orchestrator`, dan `project-context-mapper` untuk memastikan eksekusi yang kohesif.
+
+### Deskripsi
+Panduan ahli untuk mengintegrasikan DOKU Payment Gateway (Jokul API v2) sesuai standar dokumentasi resmi [DOKU Developers Portal](https://developers.doku.com/). Mencakup header autentikasi, pembuatan Digest SHA-256, pembuatan Signature HMAC-SHA256, verifikasi Webhook/Notifikasi, Checkout Payment Link, Direct Payment (Virtual Account, QRIS, E-Wallet, Kartu Kredit), penanganan error, dan migrasi Sandbox ke Production.
+
+### Kondisi Pemicu
+Aktifkan skill ini ketika pengguna sedang:
+- Membangun atau merefaktor integrasi DOKU Payment Gateway di Node.js, TypeScript, Python, Go, PHP, atau Java.
+- Mengimplementasikan kalkulasi signature HMAC-SHA256 atau verifikasi signature notifikasi webhook DOKU.
+- Mengatur API Virtual Account (BCA, Mandiri, BRI, BNI, Permata, DOKU VA), QRIS, E-Wallet (OVO, ShopeePay, DANA, LinkAja), atau Kartu Kredit.
+- Melakukan debugging error otorisasi DOKU API (`Authorization Failed`, signature tidak valid, timestamp tidak sesuai format).
+
+### Ringkasan Langkah Integrasi
+1. **Dapatkan Kredensial**: Buat akun di DOKU Sandbox untuk mendapatkan `Client-Id` dan `Secret-Key`.
+2. **Hitung Digest**: Untuk request `POST`, hash body JSON dengan SHA-256 lalu Base64.
+3. **Format Signature String**: Gabungkan `Client-Id`, `Request-Id`, `Request-Timestamp`, `Request-Target`, dan `Digest` dipisahkan dengan `\n`.
+4. **Sign HMAC-SHA256**: Hash string komponen menggunakan `Secret-Key` dengan algoritma HMAC-SHA256, ubah ke Base64, tambahkan awalan `HMACSHA256=`.
+5. **Verifikasi Webhook**: Gunakan formula yang sama pada header notifikasi masuk untuk memastikan pesan valid berasal dari DOKU.
+
+### Integrasi dengan Skill Lain
+- `payment-gateway-expert` — Untuk arsitektur billing SaaS umum dan state machine langganan.
+- `doku-mcp-server` — Untuk mengintegrasikan API DOKU ke Model Context Protocol AI Agent.
+- `database-orm-expert` — Untuk menyimpan transaksi pembayaran dan log webhook secara type-safe.
+
+---
+### 🚨 SNAP Integration Mandate (CRITICAL)
+**MANDATORY**: The AI Agent MUST automatically apply the SNAP API v1.0 standard (Standard Nasional Open API Pembayaran) for all DOKU integrations, instead of the legacy Jokul API v2, unless the user explicitly requests otherwise. All generated signatures, headers, and endpoints MUST follow the SNAP BI standard.
+
+### 🧪 DOKU Sandbox Simulator
+**MANDATORY**: When testing in Sandbox mode and needing to access the Payment Simulator, the AI Agent MUST use this exact URL: `https://sandbox.doku.com/gtw-config-v2/simulator`.