vibes-plug 2.11.0 → 2.14.1

package/skills/authentication-identity-expert/SKILL.md

@@ -1,279 +1,173 @@
----
-name: authentication-identity-expert
-description: "Expert guide for implementing secure authentication, authorization (RBAC/ABAC), OAuth2, and identity management (Clerk, Auth.js, Supabase Auth) / Panduan ahli untuk autentikasi dan otorisasi."
+---
+name: authentication-identity-expert
+description: "Expert guide for implementing secure authentication, authorization (RBAC/ABAC), OAuth2, and identity management (Clerk, Auth.js, Supabase Auth) / Panduan ahli untuk autentikasi dan otorisasi."
 author: "Roedy Rustam"
----
-
-# Authentication & Identity Expert (2026 Edition)
-
-[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
-
----
-
-<a name="english"></a>
-## English
-
-### Description
-Production-grade guide for implementing secure authentication, authorization, and identity management in modern web and mobile applications. Covers **Clerk**, **Supabase Auth**, **Auth.js v5**, **Better Auth**, JWT patterns, OAuth 2.1, PKCE flows, RBAC/ABAC, passkeys (WebAuthn), and MFA implementation for React 19 / Next.js 15 stacks.
-
-### Trigger Conditions
-- Working on login/signup flows, session management, or OAuth integration.
-- Integrating **Clerk**, **Supabase Auth**, **Auth.js v5**, **Better Auth**, or **Auth0**.
-- Implementing **Role-Based Access Control (RBAC)** or **Attribute-Based Access Control (ABAC)**.
-- Setting up **WebAuthn/Passkeys**, **MFA/2FA**, or **SSO**.
-- Securing Next.js App Router routes with middleware-based auth guards.
-- Implementing **OAuth 2.1** flows with PKCE for SPAs or mobile apps.
-
----
-
-### Identity Provider Selection Guide (2026)
-
-| Provider | Best For | Key Strength |
-|---|---|---|
-| **Clerk** | SaaS, B2B apps | Built-in organizations, roles, MFA, UI components |
-| **Supabase Auth** | Supabase-powered apps | RLS integration, social login, SSO |
-| **Auth.js v5** | Next.js self-hosted | Flexible adapters, edge-compatible |
-| **Better Auth** | TypeScript-first self-hosted | Modern DX, built-in 2FA, org management |
-| **Auth0** | Enterprise, compliance | Enterprise SSO, compliance (SOC2, HIPAA) |
-
-**Recommendation**: Use **Clerk** for most new SaaS apps (best DX). Use **Supabase Auth** if you're already using Supabase. Use **Better Auth** for full control without vendor lock-in.
-
----
-
-### Core Security Principles
-
-#### 1. Never Roll Your Own Crypto
-- Use `argon2id` (preferred) or `bcrypt` for password hashing — **never MD5, SHA1, or plain SHA256**.
-- Use battle-tested libraries: `@node-rs/argon2`, `bcryptjs`.
-- Minimum: bcrypt cost factor ≥12, argon2id memory ≥64MB.
-
-#### 2. JWT Best Practices
-```typescript
-// ✅ Short-lived access tokens + HttpOnly refresh tokens
-const ACCESS_TOKEN_EXPIRY = '15m';   // 15 minutes
-const REFRESH_TOKEN_EXPIRY = '7d';   // 7 days
-
-// ✅ Store refresh tokens in HttpOnly, Secure, SameSite=Strict cookies
-res.cookie('refresh_token', token, {
-  httpOnly: true,
-  secure: true,
-  sameSite: 'strict',
-  maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days in ms
-});
-
-// ❌ Never store tokens in localStorage (XSS vulnerable)
-// ❌ Never put sensitive data in JWT payload (it's base64 decoded, not encrypted)
-```
-
-#### 3. OAuth 2.1 + PKCE (For SPAs & Mobile)
-```typescript
-// PKCE flow — required for public clients in OAuth 2.1
-import { generateCodeVerifier, generateCodeChallenge } from 'oslo/oauth2';
-
-const codeVerifier = generateCodeVerifier(); // 43-128 char random string
-const codeChallenge = await generateCodeChallenge(codeVerifier); // SHA-256 hash
-
-// Store codeVerifier in sessionStorage (NOT localStorage) during redirect
-sessionStorage.setItem('pkce_verifier', codeVerifier);
-
-// Auth URL includes challenge
-const authUrl = new URL('https://provider.com/oauth/authorize');
-authUrl.searchParams.set('code_challenge', codeChallenge);
-authUrl.searchParams.set('code_challenge_method', 'S256');
-authUrl.searchParams.set('state', cryptoRandomState); // CSRF protection
-```
-
-#### 4. Clerk — Next.js 15 Integration
-```typescript
-// middleware.ts — protect routes at the edge
-import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server';
-
-const isPublicRoute = createRouteMatcher([
-  '/', '/sign-in(.*)', '/sign-up(.*)', '/api/webhooks(.*)',
-]);
-
-export default clerkMiddleware(async (auth, req) => {
-  if (!isPublicRoute(req)) {
-    await auth.protect(); // Redirects to sign-in if unauthenticated
-  }
-});
-
-export const config = {
-  matcher: ['/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)', '/(api|trpc)(.*)'],
-};
-```
-
-```typescript
-// Server Component — get user on the server
-import { auth, currentUser } from '@clerk/nextjs/server';
-
-export default async function DashboardPage() {
-  const { userId, orgId, orgRole } = await auth();
-  if (!userId) redirect('/sign-in');
-
-  const user = await currentUser();
-  return <div>Welcome, {user?.firstName}!</div>;
-}
-```
-
-#### 5. Supabase Auth — RLS Integration
-```typescript
-// Create Supabase client with user session
-import { createServerClient } from '@supabase/ssr';
-
-export async function createSupabaseServerClient(cookieStore: ReadonlyRequestCookies) {
-  return createServerClient(
-    process.env.NEXT_PUBLIC_SUPABASE_URL!,
-    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
-    {
-      cookies: {
-        getAll: () => cookieStore.getAll(),
-        setAll: (cookies) => cookies.forEach(({ name, value, options }) =>
-          cookieStore.set(name, value, options)
-        ),
-      },
-    }
-  );
-}
-
-// RLS in PostgreSQL — users can only access their own rows
--- CREATE POLICY "Users can only see own data" ON profiles
--- FOR ALL USING (auth.uid() = user_id);
-```
-
-#### 6. Auth.js v5 (Next.js App Router)
-```typescript
-// auth.ts
-import NextAuth from 'next-auth';
-import GitHub from 'next-auth/providers/github';
-import { DrizzleAdapter } from '@auth/drizzle-adapter';
-import { db } from '@/db';
-
-export const { handlers, auth, signIn, signOut } = NextAuth({
-  adapter: DrizzleAdapter(db),
-  providers: [
-    GitHub,
-    // Add more providers...
-  ],
-  session: { strategy: 'database' }, // or 'jwt'
-  callbacks: {
-    authorized({ auth, request: { nextUrl } }) {
-      const isLoggedIn = !!auth?.user;
-      const isProtected = nextUrl.pathname.startsWith('/dashboard');
-      if (isProtected && !isLoggedIn) return false;
-      return true;
-    },
-  },
-});
-```
-
-#### 7. RBAC — Role-Based Access Control (Server-Side)
-```typescript
-// ✅ Always enforce roles server-side — never rely on client UI alone
-type Role = 'viewer' | 'editor' | 'admin' | 'super_admin';
-
-const permissions: Record<Role, string[]> = {
-  viewer: ['read:posts'],
-  editor: ['read:posts', 'write:posts', 'delete:own_posts'],
-  admin: ['read:posts', 'write:posts', 'delete:any_post', 'manage:users'],
-  super_admin: ['*'], // All permissions
-};
-
-function hasPermission(userRole: Role, required: string): boolean {
-  const allowed = permissions[userRole];
-  return allowed.includes('*') || allowed.includes(required);
-}
-
-// In Server Action / API Route
-const { userId } = await auth();
-const user = await db.query.users.findFirst({ where: eq(users.id, userId) });
-
-if (!hasPermission(user.role, 'delete:any_post')) {
-  throw new Error('Forbidden');
-}
-```
-
-#### 8. WebAuthn / Passkeys (2026 Standard)
-```typescript
-// Using SimpleWebAuthn library
-import { generateRegistrationOptions, verifyRegistrationResponse } from '@simplewebauthn/server';
-
-// Registration — generate challenge
-const options = await generateRegistrationOptions({
-  rpName: 'My App',
-  rpID: 'myapp.com',
-  userName: user.email,
-  attestationType: 'none',
-  authenticatorSelection: {
-    residentKey: 'preferred',   // Enables passkeys
-    userVerification: 'preferred',
-  },
-});
-
-// Store challenge in session, send options to client
-await redis.setex(`webauthn:${userId}`, 60, JSON.stringify(options.challenge));
-```
-
-### Security Checklist
-- [ ] Passwords hashed with argon2id (cost ≥64MB) or bcrypt (cost ≥12).
-- [ ] JWT access tokens expire in ≤15 minutes; refresh in HttpOnly cookies.
-- [ ] OAuth state parameter validated on callback (CSRF protection).
-- [ ] PKCE enforced for all public OAuth clients.
-- [ ] All authorization checks enforced server-side (not UI-only).
-- [ ] Admin routes protected by both auth middleware AND role check.
-- [ ] MFA offered (TOTP/WebAuthn) for privileged accounts.
-- [ ] Refresh token rotation on every use (detect theft).
-- [ ] Rate limiting on login/signup endpoints (prevent brute force).
-- [ ] Account lockout after N failed attempts.
-
----
-
-<a name="bahasa-indonesia"></a>
-## Bahasa Indonesia
-
-### Integrasi Orkestrasi
-Terhubung dan mengorkestrasi skill domain yang relevan seperti `brainstorming`, `zero-to-prod-orchestrator`, dan `project-context-mapper` untuk memastikan eksekusi yang kohesif.
-
-### Deskripsi
-Panduan tingkat produksi untuk mengimplementasikan autentikasi, otorisasi, dan manajemen identitas yang aman pada aplikasi web dan mobile modern. Mencakup **Clerk**, **Supabase Auth**, **Auth.js v5**, **Better Auth**, pola JWT, OAuth 2.1, alur PKCE, RBAC/ABAC, passkey (WebAuthn), dan implementasi MFA untuk stack React 19 / Next.js 15.
-
-### Kondisi Pemicu
-- Mengerjakan alur login/signup, manajemen sesi, atau integrasi OAuth.
-- Mengintegrasikan Clerk, Supabase Auth, Auth.js v5, Better Auth, atau Auth0.
-- Mengimplementasikan RBAC (Role-Based Access Control) atau ABAC.
-- Menyiapkan WebAuthn/Passkeys, MFA/2FA, atau SSO.
-- Mengamankan rute Next.js App Router dengan auth guard berbasis middleware.
-
-### Panduan Teknis
-
-#### 1. Prinsip Keamanan Inti
-- **Jangan buat kriptografi sendiri**: Gunakan `argon2id` atau `bcrypt` untuk hashing password.
-- **JWT berumur pendek**: Access token ≤15 menit, refresh token di HttpOnly cookie.
-- **PKCE wajib** untuk semua public OAuth client (SPA, mobile).
-- **Validasi state OAuth** di callback untuk proteksi CSRF.
-
-#### 2. Pemilihan Identity Provider
-- **Clerk**: Terbaik untuk SaaS baru — DX terbaik, komponen UI siap pakai, manajemen organisasi.
-- **Supabase Auth**: Ideal jika sudah pakai Supabase — integrasi langsung dengan RLS.
-- **Auth.js v5**: Self-hosted, fleksibel, edge-compatible untuk Next.js.
-- **Better Auth**: TypeScript-first, kontrol penuh tanpa vendor lock-in.
-
-#### 3. RBAC di Sisi Server
-Selalu terapkan pengecekan role di server (Server Action, API route, middleware) — **jangan hanya di UI**. Gunakan tabel permission yang memetakan setiap role ke daftar aksi yang diizinkan.
-
-#### 4. WebAuthn / Passkeys
-Gunakan library `@simplewebauthn/server` untuk registrasi dan verifikasi passkey. Simpan challenge di Redis dengan TTL pendek (60 detik) untuk mencegah replay attack.
-
-#### 5. Checklist Keamanan
-- Password di-hash dengan argon2id atau bcrypt.
-- JWT access token expire ≤15 menit; refresh di HttpOnly cookie.
-- State OAuth divalidasi saat callback.
-- PKCE diterapkan untuk semua klien publik OAuth.
-- Pengecekan otorisasi dilakukan di server, bukan hanya UI.
-- MFA ditawarkan untuk akun privileged.
-- Rate limiting di endpoint login/signup.
-- Rotasi refresh token setiap kali digunakan.
-
-
-## Orchestration & Integration
-- Connects to other backend skills as part of the orchestration flow.
+---
+
+# Authentication & Identity Expert (2026 Edition)
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Description
+Production-grade guide for implementing secure authentication, authorization, and identity management in modern web and mobile applications. Covers **Clerk**, **Supabase Auth**, **Auth.js v5**, **Better Auth**, JWT patterns, OAuth 2.1, PKCE flows, RBAC/ABAC, passkeys (WebAuthn), and MFA implementations for React 19 / Next.js 15 stacks.
+
+### Trigger Conditions
+- Working on login/signup flows, session management, or OAuth integrations.
+- Integrating Clerk, Supabase Auth, Auth.js v5, Better Auth, or Auth0.
+- Implementing RBAC (Role-Based Access Control) or ABAC.
+- Setting up WebAuthn/Passkeys, MFA/2FA, or SSO.
+- Securing Next.js App Router routes with middleware-based auth guards.
+
+---
+
+### Identity Provider Selection Guide
+
+| Provider | Best For | Key Strength | Pricing Model |
+|---|---|---|---|
+| **Clerk** | New SaaS products | Best developer DX, prebuilt UI components, orgs/teams out-of-the-box | Per MAU (free up to 10k) |
+| **Supabase Auth** | Existing Supabase apps | Native RLS integration, multi-provider OAuth, generous free tier | Included with Supabase |
+| **Auth.js v5** | Self-hosted control | Full data ownership, zero vendor lock-in, Edge-compatible | 100% Free / OSS |
+| **Better Auth** | Modern TS-first apps | Comprehensive TypeScript plugin ecosystem, 2FA, passkeys | 100% Free / OSS |
+
+---
+
+### Technical Guidelines & Recipes
+
+#### 1. Password Hashing Standards
+```typescript
+import argon2 from 'argon2';
+
+export async function hashPassword(password: string): Promise<string> {
+  return argon2.hash(password, {
+    type: argon2.argon2id,
+    memoryCost: 65536, // 64 MB
+    timeCost: 3,
+    parallelism: 4,
+  });
+}
+```
+
+#### 2. Short-Lived JWT + Refresh Token Rotation
+```typescript
+// Access token: 15 minutes, in memory
+// Refresh token: 7-30 days, HttpOnly, Secure, SameSite=Strict cookie
+```
+
+#### 3. OAuth 2.1 + PKCE
+```typescript
+import { generateCodeVerifier, generateCodeChallenge } from 'oslo/oauth2';
+
+const codeVerifier = generateCodeVerifier();
+const codeChallenge = await generateCodeChallenge(codeVerifier);
+sessionStorage.setItem('pkce_verifier', codeVerifier);
+
+const authUrl = new URL('https://provider.com/oauth/authorize');
+authUrl.searchParams.set('code_challenge', codeChallenge);
+authUrl.searchParams.set('code_challenge_method', 'S256');
+authUrl.searchParams.set('state', cryptoRandomState);
+```
+
+#### 4. Clerk — Next.js 15 Integration
+```typescript
+// middleware.ts
+import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server';
+
+const isPublicRoute = createRouteMatcher(['/', '/sign-in(.*)', '/sign-up(.*)', '/api/webhooks(.*)']);
+
+export default clerkMiddleware(async (auth, req) => {
+  if (!isPublicRoute(req)) await auth.protect();
+});
+
+export const config = {
+  matcher: ['/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)', '/(api|trpc)(.*)'],
+};
+```
+
+#### 5. Supabase Auth — RLS Integration
+> For detailed Supabase Auth SSR setup, PKCE session cookie handling, and PostgreSQL Row-Level Security (RLS) policies, delegate directly to `supabase-security-expert`.
+
+#### 6. Auth.js v5 (Next.js App Router)
+```typescript
+import NextAuth from 'next-auth';
+import GitHub from 'next-auth/providers/github';
+import { DrizzleAdapter } from '@auth/drizzle-adapter';
+import { db } from '@/db';
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+  adapter: DrizzleAdapter(db),
+  providers: [GitHub],
+  session: { strategy: 'database' },
+});
+```
+
+#### 7. RBAC — Role-Based Access Control (Server-Side)
+```typescript
+type Role = 'viewer' | 'editor' | 'admin' | 'super_admin';
+
+const permissions: Record<Role, string[]> = {
+  viewer: ['read:posts'],
+  editor: ['read:posts', 'write:posts', 'delete:own_posts'],
+  admin: ['read:posts', 'write:posts', 'delete:any_post', 'manage:users'],
+  super_admin: ['*'],
+};
+
+export function hasPermission(userRole: Role, required: string): boolean {
+  const allowed = permissions[userRole] || [];
+  return allowed.includes('*') || allowed.includes(required);
+}
+```
+
+#### 8. WebAuthn / Passkeys (2026 Standard)
+```typescript
+import { generateRegistrationOptions, verifyRegistrationResponse } from '@simplewebauthn/server';
+
+export async function getPasskeyRegistrationOptions(userId: string, userEmail: string) {
+  return generateRegistrationOptions({
+    rpName: 'My App',
+    rpID: 'myapp.com',
+    userID: new TextEncoder().encode(userId),
+    userName: userEmail,
+    attestationType: 'none',
+    authenticatorSelection: { residentKey: 'preferred', userVerification: 'preferred' },
+  });
+}
+```
+
+### Production Security Checklist
+- [ ] Passwords hashed with argon2id or bcrypt (cost >= 12).
+- [ ] JWT access token expires in <= 15 minutes; refresh token in HttpOnly cookie.
+- [ ] PKCE enforced for all public OAuth clients.
+- [ ] Authorization enforced on server actions and API routes (never UI only).
+- [ ] Rate limiting on login and signup endpoints.
+
+## Orchestration & Integration
+- Connects with `supabase-security-expert`, `saas-architect`, `js-backend-expert`, `firebase-security-expert`, and `production-ready-hardener`.
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Panduan tingkat produksi untuk autentikasi, otorisasi, dan manajemen identitas modern (Clerk, Supabase Auth, Auth.js v5, Better Auth, OAuth 2.1 PKCE, RBAC, dan Passkeys).
+
+### Rekomendasi Identity Provider
+- **Clerk**: Terbaik untuk SaaS baru (UI bawaan, manajemen tim/organisasi).
+- **Supabase Auth**: Terbaik jika memakai database Supabase (integrasi native RLS).
+- **Auth.js v5**: Self-hosted, kontrol penuh tanpa vendor lock-in.
+- **Better Auth**: TypeScript-first, fitur 2FA dan passkey bawaan.
+
+### Poin Kunci Keamanan
+1. **Password Hashing**: Gunakan `argon2id` atau `bcrypt` (cost >= 12).
+2. **Token Berumur Pendek**: Access token <= 15 menit, refresh token di cookie HttpOnly dengan rotasi token.
+3. **PKCE Wajib**: Terapkan PKCE untuk semua klien publik OAuth.
+4. **Otorisasi Server-Side**: Wajibkan verifikasi hak akses di server (bukan hanya UI).
+5. **Supabase Auth**: Untuk setup SSR dan RLS mendalam, delegasikan ke `supabase-security-expert`.
+
+## Integrasi Orkestrasi
+- Terhubung dengan `supabase-security-expert`, `saas-architect`, `js-backend-expert`, `firebase-security-expert`, dan `production-ready-hardener`.

package/skills/brainstorming/SKILL.md

@@ -38,24 +38,24 @@ During brainstorming, consult, reference, and orchestrate the following speciali
 
 | Domain / Phase | Orchestrated Skills | Trigger & Delegation Context |
 | :--- | :--- | :--- |
-| **Discovery & Audit** | `prd-architect`, `app-analyzer-optimizer`, `web-scraper`, `website-design-cloner`, `browser-automation-expert`, `dependency-upgrade-migrator`, `project-context-mapper`, `proactive-background-watcher`, `self-evolving-memory-graph`, `documentation-site-expert`, `headless-cms-expert`, `wordpress-headless-expert` | Formulate formal PRD, ERD, and Documentation, audit existing codebases, cross-project episodic memory, reverse-engineer website URL designs 1:1, scrape reference products, headless CMS/WP architecture discovery, docs site setup, execute autonomous Playwright/Browser-Use web agents, or audit dependency health. |
-| **UI/UX & Design Systems** | `design-system-architect`, `website-design-cloner`, `hig`, `monday-design-aesthetic`, `ui-ux-pro-max`, `tailwind-expert`, `bootstrap-to-modern`, `ui-components-expert`, `svg-animation-motion-expert`, `web-3d-graphics-expert`, `glsl-shader-expert`, `webxr-ar-vr-expert`, `visual-qa-vision-agent`, `data-visualization-expert`, `rich-text-editor-expert`, `modern-css-native-expert` | Reverse-engineer website designs & templates directly from target URL, design tokens (OKLCH), Tailwind CSS v4, native CSS 2026 anchor positioning, Apple HIG principles, layout hierarchy, production-quality UI components, rich text editors (Tiptap/Lexical), data viz & charts (Recharts/Tremor/D3), modernizing legacy Bootstrap apps, WebGL 3D (Three.js/Babylon.js), custom GLSL shaders, WebXR AR/VR. |
-| **Frontend Frameworks** | `senior-frontend`, `vue-frontend-expert`, `astro-framework-expert`, `svelte-sveltekit-expert`, `solidjs-expert`, `angular-expert`, `tanstack-query-expert`, `global-a11y-i18n-expert`, `state-management-expert`, `form-validation-expert`, `apple-ecosystem-expert`, `blockchain-web3-expert`, `pwa-offline-first-expert` | React 19 / Next.js 15 App Router, Vue 3 / Nuxt 3, Astro 5+ Islands, Svelte 5 Runes / SvelteKit 2, SolidJS 2 / SolidStart, Angular 19+ Signals & Standalone, Web3 dApp integrations (wagmi/viem), async state management (Zustand/Jotai/Pinia), WCAG 2.2 a11y, multi-language i18n, complex forms with React Hook Form + Zod, Local-First offline architectures (RxDB/PowerSync). |
-| **Mobile & Desktop** | `mobile-expo-expert`, `apple-ecosystem-expert`, `tauri-expert`, `desktop-electron-expert`, `mobile-push-notification-expert`, `pwa-offline-first-expert` | Cross-platform React Native / Expo Router v4, Apple ecosystem (iOS PWA & Safari), iOS Live Activities, push notifications (FCM/APNs), Rust-powered Tauri v2, Electron 33+ desktop apps, or PWA app store distribution (PWABuilder). |
-| **Backend & Runtimes** | `nextjs-app-router-expert`, `database-migration-versioning-expert`, `js-backend-expert`, `python-programming-expert`, `go-programming-expert`, `rust-programming-expert`, `bun-runtime-expert`, `mvc-expert`, `domain-driven-design-expert`, `fullstack-expert`, `async-queue-temporal-expert`, `background-jobs-queue-expert`, `cron-scheduler-expert`, `legacy-code-translator`, `api-gateway-proxy-expert`, `wasm-edge-computing-expert`, `n8n-automation-expert`, `chatbot-messaging-expert`, `pdf-document-generation-expert` | API design, Node.js 24, Bun 1.2+, FastAPI, Go microservices, Rust Axum, API Gateways, Edge computing WASM, durable workflows (Temporal/Trigger.dev/BullMQ), dedicated background jobs queues, scheduled tasks, n8n workflow automation, WhatsApp/Telegram/Discord bots, PDF & document pipelines. |
+| **Discovery & Audit** | `prd-architect`, `deep-research-analyst`, `app-analyzer-optimizer`, `web-scraper`, `website-design-cloner`, `browser-automation-expert`, `dependency-upgrade-migrator`, `session-memory-manager`, `proactive-background-watcher`, `documentation-site-expert`, `headless-cms-expert`, `wordpress-headless-expert` | Formulate formal PRD, ERD, and Documentation, autonomous deep web research & evidence triangulation, audit existing codebases, cross-project memory, reverse-engineer website URL designs 1:1, scrape reference products, headless CMS/WP architecture discovery, docs site setup, execute autonomous Playwright/Browser-Use web agents, or audit dependency health. |
+| **UI/UX & Design Systems** | `design-system-architect`, `website-design-cloner`, `hig`, `ui-ux-pro-max`, `tailwind-expert`, `bootstrap-to-modern`, `svg-animation-motion-expert`, `web-3d-graphics-expert`, `glsl-shader-expert`, `webxr-ar-vr-expert`, `visual-qa-vision-agent`, `data-visualization-expert`, `rich-text-editor-expert`, `modern-css-native-expert` | Reverse-engineer website designs & templates directly from target URL, design tokens (OKLCH), Tailwind CSS v4, native CSS 2026 anchor positioning, Apple HIG principles, layout hierarchy, production-quality UI components, rich text editors (Tiptap/Lexical), data viz & charts (Recharts/Tremor/D3), modernizing legacy Bootstrap apps, WebGPU & WebGL 3D (Three.js WebGPU/TSL, Babylon.js, PlayCanvas), custom GLSL/WGSL shaders, WebXR AR/VR. |
+| **Frontend Frameworks** | `senior-frontend`, `vercel-ai-sdk-expert`, `vue-frontend-expert`, `astro-framework-expert`, `svelte-sveltekit-expert`, `solidjs-expert`, `angular-expert`, `tanstack-query-expert`, `global-a11y-i18n-expert`, `state-management-expert`, `form-validation-expert`, `apple-ecosystem-expert`, `blockchain-web3-expert`, `pwa-offline-first-expert` | React 19 / Next.js 15 App Router, Vercel AI SDK Core/UI streaming, Vue 3 / Nuxt 3, Astro 5+ Islands, Svelte 5 Runes / SvelteKit 2, SolidJS 2 / SolidStart, Angular 19+ Signals & Standalone, Web3 dApp integrations (wagmi/viem), async state management (Zustand/Jotai/Pinia), WCAG 2.2 a11y, multi-language i18n, complex forms with React Hook Form + Zod, Local-First offline architectures (RxDB/PowerSync). |
+| **Mobile & Desktop** | `mobile-expo-expert`, `apple-ecosystem-expert`, `tauri-expert`, `desktop-electron-expert`, `email-notification-expert`, `pwa-offline-first-expert` | Cross-platform React Native / Expo Router v4, Apple ecosystem (iOS PWA & Safari), iOS Live Activities, push notifications (FCM/APNs), Rust-powered Tauri v2, Electron 33+ desktop apps, or PWA app store distribution (PWABuilder). |
+| **Backend & Runtimes** | `nextjs-app-router-expert`, `database-orm-expert`, `js-backend-expert`, `python-programming-expert`, `pydantic-ai-expert`, `go-programming-expert`, `rust-programming-expert`, `bun-runtime-expert`, `mvc-expert`, `domain-driven-design-expert`, `fullstack-expert`, `async-queue-temporal-expert`, `cron-scheduler-expert`, `legacy-code-translator`, `api-gateway-proxy-expert`, `wasm-edge-computing-expert`, `n8n-automation-expert`, `chatbot-messaging-expert`, `pdf-document-generation-expert` | API design, Node.js 24, Bun 1.2+, FastAPI, Pydantic AI type-safe agents, Go microservices, Rust Axum, API Gateways, Edge computing WASM, durable workflows (Temporal/Trigger.dev/BullMQ), scheduled tasks, n8n workflow automation, WhatsApp/Telegram/Discord bots, PDF & document pipelines. |
 | **API Design & Contracts** | `api-design-expert`, `openapi-swagger-codegen-expert`, `typescript-expert`, `rate-limit-abuse-prevention`, `graphql-apollo-expert` | REST best practices, GraphQL schema (Apollo/NestJS), gRPC/protobuf, tRPC end-to-end type safety, OpenAPI 3.1 documentation & codegen, rate limiting, API key management, idempotency, versioning strategy. |
-| **Database, ORM & Data** | `database-orm-expert`, `supabase-migration`, `vector-db-rag-expert`, `edge-serverless-db-expert`, `supabase-security-expert`, `firebase-security-expert`, `secure-fuzz-testing`, `data-pipeline-etl-expert`, `search-engine-expert`, `geospatial-maps-expert`, `graph-rag-knowledge-expert` | Prisma 6 / Drizzle ORM, Data pipelines (dbt/Dagster), pgvector HNSW RAG indexing, Knowledge Graphs (Neo4j/Microsoft GraphRAG), full-text search (Typesense/Meilisearch/Elasticsearch), geospatial queries (PostGIS/GeoJSON/Mapbox), serverless DBs (Neon/D1/Turso), Supabase RLS, Firebase security rules. |
-| **Architecture & Scale** | `monorepo-architect`, `event-driven-architect`, `multiple-entry-points`, `mpa-orchestrator`, `spa-orchestrator`, `scalability-clean-code`, `micro-frontend-architect`, `web-game-engine-expert`, `biome-linter-formatter-expert` | Monorepos (Turborepo/pnpm), Biome v2 linter/formatter, microservices, event queues, multi-entry apps, MPA & SPA setups, clean code principles, micro-frontends (Webpack/Vite Federation), WebGL ECS & Physics engines. |
-| **AI & LLM Integration** | `ai-llm-integration-expert`, `ai-prompt-engineering-expert`, `ai-media-generation-expert`, `vector-db-rag-expert`, `mcp-server-architect`, `multi-agent-orchestration`, `gemini-agent-booster`, `ai-cost-token-optimizer`, `mcp-client-orchestrator`, `doku-mcp-server`, `local-slm-edge-ai-expert`, `ai-evals-benchmark-expert`, `voice-ai-realtime-agent`, `graph-rag-knowledge-expert` | RAG pipelines, GraphRAG & Knowledge Graphs, real-time conversational voice AI (<300ms WebRTC/WebSocket), MCP Server v1.x (FastMCP/Streamable HTTP), AI media generation, LangGraph multi-agent workflows, Gemini Agent long-context reasoning, local SLMs in-browser (WebGPU/WebLLM), automated AI evals & benchmarks (Promptfoo/DeepEval), LLM FinOps. |
-| **SaaS & Multi-Tenancy** | `saas-mvp-launcher`, `saas-transformer`, `saas-multi-tenant`, `saas-billing`, `feature-flag-analytics-expert`, `payment-gateway-expert`, `ecommerce-expert`, `doku-payment-gateway`, `email-notification-expert` | SaaS MVP roadmap, e-commerce architectures (Shopify/Medusa/Saleor), RLS tenant isolation, Stripe/DOKU billing, feature flags (PostHog/LaunchDarkly), progressive rollout, transactional email & notification pipelines. |
-| **Testing & Security** | `e2e-testing-expert`, `accessibility-testing-expert`, `browser-automation-expert`, `zero-trust-secret-vault`, `vibe-code-gardener`, `coderabbit`, `authentication-identity-expert`, `rate-limit-abuse-prevention`, `autonomous-tdd-debugger`, `autonomous-red-teamer`, `post-quantum-crypto-migrator`, `compliance-gdpr-privacy-expert`, `ai-evals-benchmark-expert` | Playwright E2E suites, automated WCAG 2.2 accessibility testing (axe-core/Pa11y), dynamic security fuzzing & adversarial attacks, automated AI evals & benchmarks (Promptfoo/DeepEval/Ragas), GDPR/PDPA compliance, post-quantum crypto migration, Zero-Trust secrets, automated code review, auth, brute-force & DDoS prevention, autonomous TDD debugging. |
-| **Error Handling & Resilience** | `error-resilience-expert`, `logging-error-tracking-expert`, `autonomous-chaos-monkey` | Chaos engineering, React Error Boundaries, API error standards (RFC 9457), retry patterns, circuit breakers, graceful degradation, structured logging (Pino), Sentry integration. |
-| **Communication & Notifications** | `email-notification-expert`, `mobile-push-notification-expert`, `realtime-collaboration-expert`, `sse-websocket-streaming-expert`, `chatbot-messaging-expert`, `voice-ai-realtime-agent` | Transactional email (Resend/Postmark), conversational voice agents (OpenAI Realtime/Gemini Live), React Email templates, in-app notifications, messaging bots (WhatsApp/Telegram/Discord/Slack), push notifications, streaming responses (SSE/WebSocket), real-time collaboration. |
+| **Database, ORM & Data** | `database-orm-expert`, `vector-db-rag-expert`, `supabase-security-expert`, `firebase-security-expert`, `secure-fuzz-testing`, `data-pipeline-etl-expert`, `search-engine-expert`, `geospatial-maps-expert`, `graph-rag-knowledge-expert` | Prisma 6 / Drizzle ORM, zero-downtime migrations, serverless DBs (Neon/D1/Turso), Data pipelines (dbt/Dagster), pgvector HNSW RAG indexing, Knowledge Graphs (Neo4j/Microsoft GraphRAG), full-text search (Typesense/Meilisearch/Elasticsearch), geospatial queries (PostGIS/GeoJSON/Mapbox), Supabase RLS, Firebase security rules. |
+| **Architecture & Scale** | `monorepo-architect`, `event-driven-architect`, `multiple-entry-points`, `mpa-orchestrator`, `spa-orchestrator`, `scalability-clean-code`, `micro-frontend-architect`, `web-game-engine-expert`, `biome-linter-formatter-expert` | Monorepos (Turborepo/pnpm), Biome v2 linter/formatter, microservices, event queues, multi-entry apps, MPA & SPA setups, clean code principles, micro-frontends (Webpack/Vite Federation), Web game engines (PlayCanvas, Havok/Jolt/Rapier WASM physics, Fixed-Timestep ECS loops, WebTransport netcode). |
+| **AI & LLM Integration** | `ai-llm-integration-expert`, `deep-research-analyst`, `vercel-ai-sdk-expert`, `pydantic-ai-expert`, `synthetic-data-finetuning-expert`, `ai-prompt-engineering-expert`, `ai-media-generation-expert`, `vector-db-rag-expert`, `mcp-server-architect`, `multi-agent-orchestration`, `gemini-agent-booster`, `doku-mcp-server`, `local-slm-edge-ai-expert`, `voice-ai-realtime-agent`, `graph-rag-knowledge-expert` | Autonomous deep research & citation verification, Vercel AI SDK Core/UI streaming, Pydantic AI type-safe agents, synthetic data generation & QLoRA fine-tuning (Unsloth), RAG pipelines, GraphRAG & Knowledge Graphs, real-time conversational voice AI (<300ms WebRTC/WebSocket), MCP Server v1.x (FastMCP/Streamable HTTP/Client tool discovery), AI media generation, LangGraph multi-agent workflows, Gemini Agent long-context reasoning, local SLMs in-browser (WebGPU/WebLLM), automated AI evals & benchmarks (Promptfoo/DeepEval), LLM FinOps. |
+| **SaaS & Multi-Tenancy** | `saas-architect`, `saas-multi-tenant`, `saas-billing`, `feature-flag-analytics-expert`, `payment-gateway-expert`, `ecommerce-expert`, `doku-payment-gateway`, `email-notification-expert` | Master SaaS lifecycle (MVP launch 0-to-1 & transformation 1-to-N), e-commerce architectures (Shopify/Medusa/Saleor), RLS tenant isolation, Stripe/DOKU billing, feature flags (PostHog/LaunchDarkly), progressive rollout, transactional email & notification pipelines. |
+| **Testing & Security** | `e2e-testing-expert`, `accessibility-testing-expert`, `browser-automation-expert`, `zero-trust-secret-vault`, `anti-slop`, `coderabbit`, `authentication-identity-expert`, `rate-limit-abuse-prevention`, `autonomous-tdd-debugger`, `autonomous-red-teamer`, `post-quantum-crypto-migrator`, `compliance-gdpr-privacy-expert`, `ai-prompt-engineering-expert` | Playwright E2E suites, automated WCAG 2.2 accessibility testing (axe-core/Pa11y), dynamic security fuzzing & adversarial attacks, automated AI evals & benchmarks (Promptfoo/DeepEval/Ragas), GDPR/PDPA compliance, post-quantum crypto migration, Zero-Trust secrets, automated code review, zero-slop code quality gates, auth, brute-force & DDoS prevention, autonomous TDD debugging. |
+| **Error Handling & Resilience** | `error-resilience-expert`, `logging-error-tracking-expert` | Chaos engineering, automated failure injection, React Error Boundaries, API error standards (RFC 9457), retry patterns, circuit breakers, graceful degradation, structured logging (Pino), Sentry integration. |
+| **Communication & Notifications** | `email-notification-expert`, `realtime-collaboration-expert`, `sse-websocket-streaming-expert`, `chatbot-messaging-expert`, `voice-ai-realtime-agent` | Transactional email (Resend/Postmark), push notifications (Expo Push/FCM/APNs), conversational voice agents (OpenAI Realtime/Gemini Live), React Email templates, in-app notifications, messaging bots (WhatsApp/Telegram/Discord/Slack), streaming responses (SSE/WebSocket), real-time collaboration. |
 | **File & Media** | `file-upload-media-expert`, `ai-media-generation-expert`, `pdf-document-generation-expert` | Presigned URL uploads (S3/R2), image optimization (Sharp), video transcoding (Mux), AI media generation, PDF generation (React PDF/Puppeteer), CDN configuration, drag-and-drop UI, file validation & security. |
 | **Performance** | `performance-web-vitals`, `app-analyzer-optimizer` | Core Web Vitals (LCP, INP, CLS), bundle optimization, image/font loading, React concurrent features, Lighthouse score improvement, deep architecture analysis. |
 | **SEO, GEO & Telemetry** | `seo`, `data-telemetry-expert` | Technical SEO audits, Generative Engine Optimization (AI Overviews, `/llms.txt`), AEO landing pages, OpenTelemetry/PostHog analytics. |
 | **DevOps & CI/CD** | `ci-cd-devops-architect`, `cloud-hosting-expert`, `dependency-upgrade-migrator`, `self-healing-cloud-orchestrator`, `biome-linter-formatter-expert` | GitHub Actions, Biome lint/format checks, Docker, Kubernetes, Terraform, Vercel/Cloudflare deployment, self-healing cloud operations, Renovate Bot, dependency health. |
-| **Execution Handoff** | `zero-to-prod-orchestrator`, `production-ready-hardener`, `auto-doc-updater`, `session-handoff-resume`, `session-context-loader`, `token-saver`, `asisten-ramah`, `skill-baru` | Handing off validated designs to 8-phase production pipeline, pre-launch hardening, continuous docs logging (`CHANGELOG.md`), loading context on new sessions, token efficiency, friendly conversational persona, and new skill scaffolding template. |
+| **Execution Handoff** | `zero-to-prod-orchestrator`, `production-ready-hardener`, `prd-architect`, `session-memory-manager`, `anti-slop` | Handing off validated designs to 8-phase production pipeline, pre-launch hardening, continuous docs logging (`CHANGELOG.md`), loading context on new sessions, ultra-compact handoff checkpoints, token efficiency, zero AI slop enforcement. |
 
 ---
 
@@ -219,24 +219,24 @@ Selama proses brainstorming, konsultasikan, rujuk, dan orkestrasikan skill-skill
 
 | Domain / Fase | Skill yang Diorkestrasikan | Konteks Pemicu & Delegasi |
 | :--- | :--- | :--- |
-| **Penemuan & Audit** | `prd-architect`, `app-analyzer-optimizer`, `web-scraper`, `website-design-cloner`, `browser-automation-expert`, `dependency-upgrade-migrator`, `project-context-mapper`, `proactive-background-watcher`, `self-evolving-memory-graph`, `documentation-site-expert`, `headless-cms-expert`, `wordpress-headless-expert` | Menyusun PRD, ERD, dan Dokumentasi formal, memori episodik lintas proyek, mengaudit codebase yang ada, mendokumentasikan fitur kompetitor, reverse-engineer desain website, arsitektur headless CMS/WP, atau audit kesehatan dependensi. |
-| **UI/UX & Design System** | `design-system-architect`, `website-design-cloner`, `hig`, `monday-design-aesthetic`, `ui-ux-pro-max`, `tailwind-expert`, `bootstrap-to-modern`, `ui-components-expert`, `svg-animation-motion-expert`, `web-3d-graphics-expert`, `glsl-shader-expert`, `webxr-ar-vr-expert`, `visual-qa-vision-agent`, `data-visualization-expert`, `rich-text-editor-expert`, `modern-css-native-expert` | Token desain (OKLCH), Tailwind CSS v4, fitur native CSS 2026 (Anchor Positioning, @starting-style), prinsip Apple HIG, tata letak antarmuka, komponen UI berkualitas produksi, editor rich text (Tiptap/Lexical), visualisasi data & chart (Recharts/Tremor/D3), migrasi aplikasi Bootstrap lama, WebGL 3D, kustomisasi shader GLSL, dan WebXR AR/VR. |
-| **Framework Frontend** | `senior-frontend`, `vue-frontend-expert`, `astro-framework-expert`, `svelte-sveltekit-expert`, `solidjs-expert`, `angular-expert`, `tanstack-query-expert`, `global-a11y-i18n-expert`, `state-management-expert`, `form-validation-expert`, `apple-ecosystem-expert`, `blockchain-web3-expert`, `pwa-offline-first-expert` | React 19 / Next.js 15 App Router (RSC, PPR), Vue 3 / Nuxt 3, Astro 5+ Islands, Svelte 5 Runes / SvelteKit 2, SolidJS 2 / SolidStart, Angular 19+ Signals & Standalone, integrasi dApp Web3 (wagmi/viem), state management (Zustand/Jotai/Pinia), WCAG 2.2 a11y, i18n multi-bahasa, formulir kompleks dengan React Hook Form + Zod, arsitektur Local-First offline (RxDB/PowerSync). |
-| **Mobile & Desktop** | `mobile-expo-expert`, `apple-ecosystem-expert`, `tauri-expert`, `desktop-electron-expert`, `mobile-push-notification-expert`, `pwa-offline-first-expert` | Aplikasi mobile cross-platform React Native / Expo Router v4, Apple ecosystem (iOS PWA & Safari), iOS Live Activities, push notification (FCM/APNs), aplikasi desktop Tauri v2 berbasis Rust, Electron 33+, atau distribusi app store PWA (PWABuilder). |
-| **Backend & Runtime** | `nextjs-app-router-expert`, `database-migration-versioning-expert`, `js-backend-expert`, `python-programming-expert`, `go-programming-expert`, `rust-programming-expert`, `bun-runtime-expert`, `mvc-expert`, `domain-driven-design-expert`, `fullstack-expert`, `async-queue-temporal-expert`, `background-jobs-queue-expert`, `cron-scheduler-expert`, `legacy-code-translator`, `api-gateway-proxy-expert`, `wasm-edge-computing-expert`, `n8n-automation-expert`, `chatbot-messaging-expert`, `pdf-document-generation-expert` | Desain API, Node.js 24, Bun 1.2+, FastAPI 0.115+, microservices Go 1.25+, Rust Axum, API Gateways, Edge computing WASM, otomasi alur kerja n8n, bot WhatsApp/Telegram/Discord, pipeline dokumen PDF, antrean background jobs khusus, tugas terjadwal & cron job. |
+| **Penemuan & Audit** | `prd-architect`, `deep-research-analyst`, `app-analyzer-optimizer`, `web-scraper`, `website-design-cloner`, `browser-automation-expert`, `dependency-upgrade-migrator`, `session-memory-manager`, `proactive-background-watcher`, `documentation-site-expert`, `headless-cms-expert`, `wordpress-headless-expert` | Menyusun PRD, ERD, dan Dokumentasi formal, memori episodik lintas proyek, mengaudit codebase yang ada, mendokumentasikan fitur kompetitor, reverse-engineer desain website, arsitektur headless CMS/WP, atau audit kesehatan dependensi. |
+| **UI/UX & Design System** | `design-system-architect`, `website-design-cloner`, `hig`, `ui-ux-pro-max`, `tailwind-expert`, `bootstrap-to-modern`, `svg-animation-motion-expert`, `web-3d-graphics-expert`, `glsl-shader-expert`, `webxr-ar-vr-expert`, `visual-qa-vision-agent`, `data-visualization-expert`, `rich-text-editor-expert`, `modern-css-native-expert` | Token desain (OKLCH), Tailwind CSS v4, fitur native CSS 2026 (Anchor Positioning, @starting-style), prinsip Apple HIG, tata letak antarmuka, komponen UI berkualitas produksi, editor rich text (Tiptap/Lexical), visualisasi data & chart (Recharts/Tremor/D3), migrasi aplikasi Bootstrap lama, WebGPU & WebGL 3D (Three.js WebGPU/TSL, Babylon.js, PlayCanvas), kustomisasi shader GLSL/WGSL, dan WebXR AR/VR. |
+| **Framework Frontend** | `senior-frontend`, `vercel-ai-sdk-expert`, `vue-frontend-expert`, `astro-framework-expert`, `svelte-sveltekit-expert`, `solidjs-expert`, `angular-expert`, `tanstack-query-expert`, `global-a11y-i18n-expert`, `state-management-expert`, `form-validation-expert`, `apple-ecosystem-expert`, `blockchain-web3-expert`, `pwa-offline-first-expert` | React 19 / Next.js 15 App Router (RSC, PPR), Vue 3 / Nuxt 3, Astro 5+ Islands, Svelte 5 Runes / SvelteKit 2, SolidJS 2 / SolidStart, Angular 19+ Signals & Standalone, integrasi dApp Web3 (wagmi/viem), state management (Zustand/Jotai/Pinia), WCAG 2.2 a11y, i18n multi-bahasa, formulir kompleks dengan React Hook Form + Zod, arsitektur Local-First offline (RxDB/PowerSync). |
+| **Mobile & Desktop** | `mobile-expo-expert`, `apple-ecosystem-expert`, `tauri-expert`, `desktop-electron-expert`, `email-notification-expert`, `pwa-offline-first-expert` | Aplikasi mobile cross-platform React Native / Expo Router v4, Apple ecosystem (iOS PWA & Safari), iOS Live Activities, push notification (FCM/APNs), aplikasi desktop Tauri v2 berbasis Rust, Electron 33+, atau distribusi app store PWA (PWABuilder). |
+| **Backend & Runtime** | `nextjs-app-router-expert`, `database-orm-expert`, `js-backend-expert`, `python-programming-expert`, `pydantic-ai-expert`, `go-programming-expert`, `rust-programming-expert`, `bun-runtime-expert`, `mvc-expert`, `domain-driven-design-expert`, `fullstack-expert`, `async-queue-temporal-expert`, `cron-scheduler-expert`, `legacy-code-translator`, `api-gateway-proxy-expert`, `wasm-edge-computing-expert`, `n8n-automation-expert`, `chatbot-messaging-expert`, `pdf-document-generation-expert` | Desain API, Node.js 24, Bun 1.2+, FastAPI 0.115+, agen type-safe Pydantic AI, microservices Go 1.25+, Rust Axum, API Gateways, Edge computing WASM, alur tahan-gagal (Temporal/Trigger.dev/BullMQ), otomasi alur kerja n8n, bot WhatsApp/Telegram/Discord, pipeline dokumen PDF, tugas terjadwal & cron job. |
 | **Desain API & Kontrak** | `api-design-expert`, `openapi-swagger-codegen-expert`, `typescript-expert`, `rate-limit-abuse-prevention`, `graphql-apollo-expert` | Praktik terbaik REST, skema GraphQL (Apollo/NestJS), gRPC/protobuf, tRPC end-to-end type safety, dokumentasi OpenAPI 3.1 & codegen, rate limiting, manajemen API key, idempotency, strategi versioning. |
-| **Database, ORM & Data** | `database-orm-expert`, `supabase-migration`, `vector-db-rag-expert`, `edge-serverless-db-expert`, `supabase-security-expert`, `firebase-security-expert`, `secure-fuzz-testing`, `data-pipeline-etl-expert`, `search-engine-expert`, `geospatial-maps-expert`, `graph-rag-knowledge-expert` | Desain skema Prisma 6 / Drizzle ORM, Data pipelines (dbt/Dagster), pgvector HNSW RAG, Knowledge Graph (Neo4j/Microsoft GraphRAG), mesin pencari full-text (Typesense/Meilisearch/Elasticsearch), data geospasial & peta (PostGIS/Mapbox/Leaflet), database serverless (Neon/D1/Turso), Supabase RLS, Firebase security rules. |
-| **Arsitektur & Skala** | `monorepo-architect`, `event-driven-architect`, `multiple-entry-points`, `mpa-orchestrator`, `spa-orchestrator`, `scalability-clean-code`, `micro-frontend-architect`, `web-game-engine-expert`, `biome-linter-formatter-expert` | Monorepo (Turborepo/pnpm), Biome v2 linter/formatter, microservices, antrean pesan, aplikasi multi-entry, skema MPA & SPA, prinsip clean code, micro-frontends (Webpack/Vite Federation), arsitektur ECS & Physics WebGL. |
-| **Integrasi AI & LLM** | `ai-llm-integration-expert`, `ai-prompt-engineering-expert`, `ai-media-generation-expert`, `vector-db-rag-expert`, `mcp-server-architect`, `multi-agent-orchestration`, `gemini-agent-booster`, `ai-cost-token-optimizer`, `mcp-client-orchestrator`, `doku-mcp-server`, `local-slm-edge-ai-expert`, `ai-evals-benchmark-expert`, `voice-ai-realtime-agent`, `graph-rag-knowledge-expert` | Alur RAG, GraphRAG & Knowledge Graph, conversational voice AI real-time (<300ms WebRTC/WebSocket), MCP Server v1.x (FastMCP/Streamable HTTP), generasi AI gambar/suara/video (Flux/ElevenLabs/Whisper/Sora), workflow multi-agent LangGraph, eksekusi SLM lokal di browser (WebGPU/WebLLM), evaluasi otomatis & benchmark AI (Promptfoo/DeepEval), pemikiran long-context Gemini, FinOps LLM. |
-| **SaaS & Multi-Tenancy** | `saas-mvp-launcher`, `saas-transformer`, `saas-multi-tenant`, `saas-billing`, `feature-flag-analytics-expert`, `payment-gateway-expert`, `ecommerce-expert`, `doku-payment-gateway`, `email-notification-expert` | Roadmap SaaS MVP, arsitektur e-commerce (Shopify/Medusa/Saleor), isolasi tenant RLS, billing Stripe/DOKU, feature flags, progressive rollout, email transaksional & pipeline notifikasi. |
-| **Testing & Keamanan** | `e2e-testing-expert`, `accessibility-testing-expert`, `browser-automation-expert`, `zero-trust-secret-vault`, `vibe-code-gardener`, `coderabbit`, `authentication-identity-expert`, `rate-limit-abuse-prevention`, `autonomous-tdd-debugger`, `autonomous-red-teamer`, `post-quantum-crypto-migrator`, `compliance-gdpr-privacy-expert`, `ai-evals-benchmark-expert` | Testing E2E Playwright, evaluasi otomatis & benchmark AI (Promptfoo/DeepEval/Ragas), pengujian aksesibilitas otomatis WCAG 2.2 (axe-core/Pa11y), dynamic security fuzzing & serangan adversarial, kepatuhan GDPR/PDPA, migrasi post-quantum crypto, rahasia Zero-Trust, code review otomatis, pencegahan brute-force & DDoS, debugging TDD otonom. |
-| **Penanganan Error & Ketahanan** | `error-resilience-expert`, `logging-error-tracking-expert`, `autonomous-chaos-monkey` | Chaos engineering, React Error Boundaries, standar error API (RFC 9457), pola retry, circuit breaker, degradasi anggun, logging terstruktur (Pino), Sentry integrasi. |
-| **Komunikasi & Notifikasi** | `email-notification-expert`, `mobile-push-notification-expert`, `realtime-collaboration-expert`, `sse-websocket-streaming-expert`, `chatbot-messaging-expert`, `voice-ai-realtime-agent` | Email transaksional (Resend/Postmark), agen percakapan suara real-time (OpenAI Realtime/Gemini Live), template React Email, notifikasi in-app, bot perpesanan (WhatsApp/Telegram/Discord/Slack), push notification, streaming respons (SSE/WebSocket), kolaborasi real-time. |
+| **Database, ORM & Data** | `database-orm-expert`, `vector-db-rag-expert`, `supabase-security-expert`, `firebase-security-expert`, `secure-fuzz-testing`, `data-pipeline-etl-expert`, `search-engine-expert`, `geospatial-maps-expert`, `graph-rag-knowledge-expert` | Desain skema Prisma 6 / Drizzle ORM, migrasi tanpa downtime, database serverless (Neon/D1/Turso), Data pipelines (dbt/Dagster), pgvector HNSW RAG, Knowledge Graph (Neo4j/Microsoft GraphRAG), mesin pencari full-text (Typesense/Meilisearch/Elasticsearch), data geospasial & peta (PostGIS/Mapbox/Leaflet), Supabase RLS, Firebase security rules. |
+| **Arsitektur & Skala** | `monorepo-architect`, `event-driven-architect`, `multiple-entry-points`, `mpa-orchestrator`, `spa-orchestrator`, `scalability-clean-code`, `micro-frontend-architect`, `web-game-engine-expert`, `biome-linter-formatter-expert` | Monorepo (Turborepo/pnpm), Biome v2 linter/formatter, microservices, antrean pesan, aplikasi multi-entry, skema MPA & SPA, prinsip clean code, micro-frontends (Webpack/Vite Federation), Web game engine (PlayCanvas, fisika WASM Havok/Jolt/Rapier, loop ECS Fixed-Timestep, netcode WebTransport). |
+| **Integrasi AI & LLM** | `ai-llm-integration-expert`, `deep-research-analyst`, `vercel-ai-sdk-expert`, `pydantic-ai-expert`, `synthetic-data-finetuning-expert`, `ai-prompt-engineering-expert`, `ai-media-generation-expert`, `vector-db-rag-expert`, `mcp-server-architect`, `multi-agent-orchestration`, `gemini-agent-booster`, `doku-mcp-server`, `local-slm-edge-ai-expert`, `voice-ai-realtime-agent`, `graph-rag-knowledge-expert` | Alur RAG, GraphRAG & Knowledge Graph, conversational voice AI real-time (<300ms WebRTC/WebSocket), MCP Server v1.x (FastMCP/Streamable HTTP/Client discovery), generasi AI gambar/suara/video (Flux/ElevenLabs/Whisper/Sora), workflow multi-agent LangGraph, eksekusi SLM lokal di browser (WebGPU/WebLLM), evaluasi otomatis & benchmark AI (Promptfoo/DeepEval), pemikiran long-context Gemini, FinOps LLM. |
+| **SaaS & Multi-Tenancy** | `saas-architect`, `saas-multi-tenant`, `saas-billing`, `feature-flag-analytics-expert`, `payment-gateway-expert`, `ecommerce-expert`, `doku-payment-gateway`, `email-notification-expert` | Master siklus hidup SaaS (peluncuran MVP 0 ke 1 & transformasi 1 ke N), arsitektur e-commerce (Shopify/Medusa/Saleor), isolasi tenant RLS, billing Stripe/DOKU, feature flags, progressive rollout, email transaksional & pipeline notifikasi. |
+| **Testing & Keamanan** | `e2e-testing-expert`, `accessibility-testing-expert`, `browser-automation-expert`, `zero-trust-secret-vault`, `anti-slop`, `coderabbit`, `authentication-identity-expert`, `rate-limit-abuse-prevention`, `autonomous-tdd-debugger`, `autonomous-red-teamer`, `post-quantum-crypto-migrator`, `compliance-gdpr-privacy-expert`, `ai-prompt-engineering-expert` | Testing E2E Playwright, evaluasi otomatis & benchmark AI (Promptfoo/DeepEval/Ragas), pengujian aksesibilitas otomatis WCAG 2.2 (axe-core/Pa11y), dynamic security fuzzing & serangan adversarial, kepatuhan GDPR/PDPA, migrasi post-quantum crypto, rahasia Zero-Trust, code review otomatis, penegakan zero-slop tanpa placeholder, pencegahan brute-force & DDoS, debugging TDD otonom. |
+| **Penanganan Error & Ketahanan** | `error-resilience-expert`, `logging-error-tracking-expert` | Chaos engineering, simulasi kegagalan otomatis, React Error Boundaries, standar error API (RFC 9457), pola retry, circuit breaker, degradasi anggun, logging terstruktur (Pino), Sentry integrasi. |
+| **Komunikasi & Notifikasi** | `email-notification-expert`, `realtime-collaboration-expert`, `sse-websocket-streaming-expert`, `chatbot-messaging-expert`, `voice-ai-realtime-agent` | Email transaksional (Resend/Postmark), notifikasi push (Expo Push/FCM/APNs), agen percakapan suara real-time (OpenAI Realtime/Gemini Live), template React Email, notifikasi in-app, bot perpesanan (WhatsApp/Telegram/Discord/Slack), streaming respons (SSE/WebSocket), kolaborasi real-time. |
 | **File & Media** | `file-upload-media-expert`, `ai-media-generation-expert`, `pdf-document-generation-expert` | Upload presigned URL (S3/R2), optimasi gambar (Sharp), transcoding video (Mux), generasi media AI, pembuatan dokumen PDF (React PDF/Puppeteer), konfigurasi CDN, UI drag-and-drop, validasi & keamanan file. |
 | **Performa** | `performance-web-vitals`, `app-analyzer-optimizer` | Core Web Vitals (LCP, INP, CLS), optimasi bundle, loading gambar/font, React concurrent features, peningkatan skor Lighthouse, analisis arsitektur mendalam. |
 | **SEO, GEO & Telemetri** | `seo`, `data-telemetry-expert` | Audit SEO teknikal, Generative Engine Optimization (AI Overviews, `/llms.txt`), landing page AEO, analitik OpenTelemetry/PostHog. |
 | **DevOps & CI/CD** | `ci-cd-devops-architect`, `cloud-hosting-expert`, `dependency-upgrade-migrator`, `self-healing-cloud-orchestrator`, `biome-linter-formatter-expert` | GitHub Actions, Biome linter/formatter, Docker, Kubernetes, Terraform, deployment Vercel/Cloudflare, self-healing cloud operations, Renovate Bot, kesehatan dependensi. |
-| **Serah Terima Eksekusi** | `zero-to-prod-orchestrator`, `production-ready-hardener`, `auto-doc-updater`, `session-handoff-resume`, `session-context-loader`, `token-saver`, `asisten-ramah`, `skill-baru` | Serah terima desain tervalidasi ke pipeline produksi 8-fase, pengerasan pra-rilis, pembaruan dokumentasi otomatis (`CHANGELOG.md`), pemuatan konteks otomatis, efisiensi token, manajemen gaya ramah asisten, dan pembuatan perancah skill baru. |
+| **Serah Terima Eksekusi** | `zero-to-prod-orchestrator`, `production-ready-hardener`, `prd-architect`, `session-memory-manager`, `anti-slop` | Serah terima desain tervalidasi ke pipeline produksi 8-fase, pengerasan pra-rilis, pembaruan dokumentasi otomatis (`CHANGELOG.md`), pemuatan konteks otomatis, checkpoint ringkas, efisiensi token, eliminasi AI slop. |
 
 ---