vibes-plug 2.5.0 → 2.11.0

package/skills/chatbot-messaging-expert/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: chatbot-messaging-expert
+description: "Expert guide for chatbot and messaging platform integration (WhatsApp Business, Telegram Bot, Discord.js, Slack Bolt) and conversational AI / Panduan ahli integrasi chatbot dan platform messaging (WhatsApp Business, Telegram Bot, Discord.js, Slack Bolt) dan AI percakapan."
+author: "Roedy Rustam"
+---
+
+# Chatbot & Messaging Expert (2026 Edition)
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Orchestration & Integration
+- **`ai-llm-integration-expert`**: LLM-powered conversational AI and tool calling.
+- **`sse-websocket-streaming-expert`**: Real-time messaging protocols.
+- **`webhook-receiver`**: Secure webhook endpoints for messaging platforms.
+- **`async-queue-temporal-expert`**: Message queue processing for high-volume bots.
+
+### Description
+Expert guide for building chatbots and integrating messaging platforms into applications. Covers WhatsApp Business API (Cloud API), Telegram Bot API, Discord.js v14, Slack Bolt, LINE Messaging API, and conversational AI patterns. Includes webhook verification, message handlers, interactive components (buttons, carousels), media handling, and AI-powered response generation.
+
+### Trigger Conditions
+- Building a chatbot for WhatsApp, Telegram, Discord, or Slack.
+- Integrating messaging platform APIs into existing applications.
+- Creating AI-powered conversational agents on messaging platforms.
+- Implementing webhook handlers for messaging notifications.
+
+---
+
+### Platform Quick Reference
+
+| Platform | API Type | Auth | Message Types | Webhook |
+|----------|----------|------|---------------|---------|
+| WhatsApp Business | REST (Cloud API) | Bearer Token | Text, Image, Template, Interactive | ✅ Verify token |
+| Telegram | REST (Bot API) | Bot Token | Text, Photo, Inline Keyboard, Callback | ✅ setWebhook |
+| Discord | Gateway + REST | Bot Token | Text, Embed, Components, Slash Commands | Gateway events |
+| Slack | Events API + REST | OAuth + Signing Secret | Blocks, Modals, Slash Commands | ✅ Request signing |
+
+### Core Patterns
+
+#### WhatsApp Business Cloud API
+```typescript
+// Webhook verification + message handler
+import { Hono } from 'hono';
+const app = new Hono();
+
+app.get('/webhook/whatsapp', (c) => {
+  const mode = c.req.query('hub.mode');
+  const token = c.req.query('hub.verify_token');
+  const challenge = c.req.query('hub.challenge');
+  if (mode === 'subscribe' && token === process.env.WA_VERIFY_TOKEN) {
+    return c.text(challenge!);
+  }
+  return c.text('Forbidden', 403);
+});
+
+app.post('/webhook/whatsapp', async (c) => {
+  const body = await c.req.json();
+  const message = body.entry?.[0]?.changes?.[0]?.value?.messages?.[0];
+  if (message?.type === 'text') {
+    await sendWhatsAppReply(message.from, `Echo: ${message.text.body}`);
+  }
+  return c.text('OK');
+});
+
+async function sendWhatsAppReply(to: string, text: string) {
+  await fetch(`https://graph.facebook.com/v21.0/${process.env.WA_PHONE_ID}/messages`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${process.env.WA_ACCESS_TOKEN}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ messaging_product: 'whatsapp', to, type: 'text', text: { body: text } }),
+  });
+}
+```
+
+#### Telegram Bot
+```typescript
+import { Bot, InlineKeyboard } from 'grammy';
+
+const bot = new Bot(process.env.TELEGRAM_BOT_TOKEN!);
+
+bot.command('start', (ctx) => ctx.reply('Welcome! How can I help?'));
+bot.on('message:text', async (ctx) => {
+  const aiResponse = await generateAIResponse(ctx.message.text);
+  const keyboard = new InlineKeyboard()
+    .text('👍 Helpful', 'feedback_good')
+    .text('👎 Not helpful', 'feedback_bad');
+  await ctx.reply(aiResponse, { reply_markup: keyboard });
+});
+
+bot.callbackQuery('feedback_good', (ctx) => ctx.answerCallbackQuery('Thanks!'));
+bot.start();
+```
+
+## Orchestration & Integration
+- `ai-llm-integration-expert`, `webhook-receiver`, `async-queue-temporal-expert`
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Panduan ahli untuk membangun chatbot dan mengintegrasikan platform messaging ke dalam aplikasi. Mencakup WhatsApp Business API, Telegram Bot API, Discord.js v14, Slack Bolt, dan pola AI percakapan.
+
+### Kondisi Pemicu
+- Membangun chatbot untuk WhatsApp, Telegram, Discord, atau Slack.
+- Mengintegrasikan API platform messaging ke aplikasi yang sudah ada.
+- Membuat agen percakapan berbasis AI di platform messaging.

package/skills/ci-cd-devops-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ci-cd-devops-architect
 description: "Expert guide for continuous integration, deployment pipelines, Docker, Kubernetes, and Infrastructure as Code (IaC) / Panduan ahli untuk CI/CD dan infrastruktur."
-author: "Antigravity"
+author: "Roedy Rustam"
 ---
 
 # CI/CD & DevOps Architect / Arsitek CI/CD & DevOps
@@ -14,59 +14,68 @@ author: "Antigravity"
 ## English
 
 ### Description
-Expert-level skill for designing and maintaining CI/CD pipelines (GitHub Actions, GitLab CI) and managing infrastructure using Docker, Kubernetes, and Terraform.
+Design and maintain CI/CD pipelines (GitHub Actions, GitLab CI, Buildkite) and manage infrastructure using Docker, Kubernetes (1.30+), and Terraform/OpenTofu.
 
-### Key CI/CD Workflows & Patterns
-
-- **Automate Everything**: Ensure tests, linting, formatting, and security scans run on every PR. Block merges if pipelines fail.
-- **Dependency Update Bot**: Configure Renovate Bot or Dependabot for automated patch/minor updates (`dependency-upgrade-migrator`).
-- **Source Maps Upload**: Automatically upload Sentry source maps during the build phase (`logging-error-tracking-expert`).
-- **Immutable Artifacts**: Build a Docker image once and deploy the exact same image to Staging and Production. Pass environment variables dynamically at runtime, not build time.
-- **Infrastructure as Code**: Keep all infrastructure configurations (Terraform, K8s manifests) in version control. Avoid manual changes via the cloud provider's web console.
-- **Zero-Trust Secrets**: Never commit secrets to the repository. Use Infisical, GitHub Secrets, or HashiCorp Vault (`zero-trust-secret-vault`).
-- **Zero-Downtime Deployments**: Utilize deployment strategies like rolling updates or blue-green deployments to ensure availability.
-
-### Trigger Conditions
-Active whenever the user is creating GitHub Actions, configuring Dockerfiles, writing Terraform scripts, setting up Renovate Bot, or configuring deployment pipelines.
-
----
-
-### Integration with Other Skills (MANDATORY)
-
-This skill works best when combined with:
+## Orchestration & Integration
+Connect with these skills to orchestrate complete workflows:
 - `cloud-hosting-expert` — Deployment targets (Vercel, Cloudflare, AWS, Railway)
-- `dependency-upgrade-migrator` — Renovate Bot & Dependabot configuration in CI/CD
+- `dependency-upgrade-migrator` — Renovate Bot configuration in CI/CD
+- `self-healing-cloud-orchestrator` — Auto-remediation and rollback pipelines
 - `logging-error-tracking-expert` — Sentry source map upload step in build pipeline
 - `e2e-testing-expert` — Automated Playwright & Vitest test steps in CI
 - `zero-trust-secret-vault` — CI/CD secret management and injection
 - `production-ready-hardener` — Pre-deployment security scanning in CI
 
+### Key CI/CD Workflows & Patterns
+- **Automate Everything**: Enforce tests, linting, formatting, and security scans on every PR. Block merges on pipeline failure.
+- **Dependency Update Bot**: Configure Renovate Bot for automated patch/minor updates (`dependency-upgrade-migrator`).
+- **Source Maps Upload**: Upload Sentry source maps during build phase (`logging-error-tracking-expert`).
+- **Immutable Artifacts**: Build Docker image once, deploy identical image to Staging and Production. Inject environment variables dynamically at runtime.
+- **Infrastructure as Code**: Store all infrastructure configurations (Terraform/OpenTofu, K8s manifests) in version control. No manual web console changes.
+- **Zero-Trust Secrets**: Never commit secrets. Use Infisical, GitHub OIDC, or HashiCorp Vault (`zero-trust-secret-vault`).
+- **Zero-Downtime Deployments**: Utilize rolling updates or blue-green deployments.
+
+### Implementation Checklist
+- [ ] Configure branch protection (require passing status checks before merge).
+- [ ] Set up multi-stage Docker builds to reduce image size and attack surface.
+- [ ] Implement caching for package managers (pnpm, bun, cargo, go mod) in CI.
+- [ ] Scan container images for vulnerabilities before registry push.
+
+### Trigger Conditions
+Trigger when creating GitHub Actions, configuring Dockerfiles, writing Terraform/OpenTofu scripts, setting up Renovate Bot, or configuring deployment pipelines.
+
 ---
 
 <a name="bahasa-indonesia"></a>
 ## Bahasa Indonesia
 
 ### Deskripsi
-Skill tingkat ahli untuk merancang dan memelihara *pipeline* CI/CD (GitHub Actions, GitLab CI) dan mengelola infrastruktur menggunakan Docker, Kubernetes, dan Terraform.
-
-### Alur Kerja & Pola CI/CD Utama
-- **Otomatisasi Semuanya**: Pastikan pengujian (tests), *linting*, pemformatan, dan pemindaian keamanan berjalan di setiap *Pull Request* (PR). Blokir penggabungan kode (merge) jika *pipeline* gagal.
-- **Bot Pembaruan Dependensi**: Konfigurasi Renovate Bot atau Dependabot untuk update otomatis patch/minor (`dependency-upgrade-migrator`).
-- **Upload Source Maps**: Upload otomatis source maps Sentry pada fase build (`logging-error-tracking-expert`).
-- **Artifak Imutabel**: Build *image* Docker satu kali dan *deploy* image yang sama persis ke Staging dan Produksi.
-- **Infrastructure as Code (IaC)**: Simpan semua konfigurasi infrastruktur (Terraform, manifes K8s) di kontrol versi.
-- **Manajemen Rahasia (Secrets)**: Gunakan *vault* yang aman seperti GitHub Secrets, Infisical, atau HashiCorp Vault (`zero-trust-secret-vault`).
-- **Deployment Tanpa Downtime**: Manfaatkan strategi *deployment* seperti pembaruan bergulir (*rolling updates*) atau *blue-green deployments*.
-
-### Integrasi dengan Skill Lain (WAJIB)
+Rancang dan pelihara *pipeline* CI/CD (GitHub Actions, GitLab CI, Buildkite) dan kelola infrastruktur menggunakan Docker, Kubernetes (1.30+), dan Terraform/OpenTofu.
 
-Skill ini bekerja paling baik dikombinasikan dengan:
+## Integrasi Orkestrasi
+Hubungkan dengan skill berikut untuk mengorkestrasi alur kerja:
 - `cloud-hosting-expert` — Target deployment (Vercel, Cloudflare, AWS, Railway)
-- `dependency-upgrade-migrator` — Konfigurasi Renovate Bot & Dependabot di CI/CD
+- `dependency-upgrade-migrator` — Konfigurasi Renovate Bot di CI/CD
+- `self-healing-cloud-orchestrator` — Pipeline auto-remediasi dan rollback
 - `logging-error-tracking-expert` — Langkah upload source map Sentry di pipeline build
 - `e2e-testing-expert` — Langkah pengujian otomatis Playwright & Vitest di CI
 - `zero-trust-secret-vault` — Manajemen dan injeksi rahasia CI/CD
 - `production-ready-hardener` — Pemindaian keamanan pra-deployment di CI
 
+### Alur Kerja & Pola CI/CD Utama
+- **Otomatisasi Semuanya**: Wajibkan pengujian, *linting*, pemformatan, dan pemindaian keamanan di setiap PR. Blokir merge jika *pipeline* gagal.
+- **Bot Pembaruan Dependensi**: Konfigurasi Renovate Bot untuk update otomatis patch/minor (`dependency-upgrade-migrator`).
+- **Upload Source Maps**: Upload source maps Sentry pada fase build (`logging-error-tracking-expert`).
+- **Artifak Imutabel**: Build *image* Docker sekali, *deploy* image yang persis sama ke Staging dan Produksi. Injeksi variabel lingkungan saat runtime.
+- **Infrastructure as Code (IaC)**: Simpan semua konfigurasi infrastruktur (Terraform/OpenTofu, manifes K8s) di kontrol versi. Jangan ubah manual via konsol web.
+- **Manajemen Rahasia (Secrets)**: Jangan komit rahasia. Gunakan GitHub OIDC, Infisical, atau HashiCorp Vault (`zero-trust-secret-vault`).
+- **Deployment Tanpa Downtime**: Manfaatkan pembaruan bergulir (*rolling updates*) atau *blue-green deployments*.
+
+### Checklist Implementasi
+- [ ] Konfigurasi perlindungan cabang (wajib lulus status check sebelum merge).
+- [ ] Siapkan multi-stage Docker builds untuk mengurangi ukuran image dan permukaan serangan.
+- [ ] Implementasikan caching untuk package managers (pnpm, bun, cargo, go mod) di workflow CI.
+- [ ] Pindai image kontainer untuk kerentanan sebelum push ke registry.
+
 ### Kondisi Pemicu
-Aktif setiap kali pengguna sedang membuat GitHub Actions, mengkonfigurasi Dockerfile, menulis skrip Terraform, mengatur Renovate Bot, atau mengatur *pipeline deployment*.
+Picu saat membuat GitHub Actions, mengkonfigurasi Dockerfile, menulis skrip Terraform/OpenTofu, mengatur Renovate Bot, atau mengatur *pipeline deployment*.

package/skills/cloud-hosting-expert/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-hosting-expert
 description: "Expert guide for deploying SaaS applications with multiple entry points on modern edge and serverless platforms like Vercel and Cloudflare / Panduan ahli untuk mendeploy aplikasi SaaS dengan multiple entry points di platform edge dan serverless modern seperti Vercel dan Cloudflare."
-author: "Roedy Rustam"
+author: "Roedy Rustam"
 ---
 
 # Cloud Hosting Expert (2026 Edition)
@@ -13,6 +13,9 @@ author: "Roedy Rustam"
 <a name="english"></a>
 ## English
 
+### Orchestration & Integration
+Connects and orchestrates with relevant domain skills like `brainstorming`, `zero-to-prod-orchestrator`, and `project-context-mapper` to ensure cohesive execution.
+
 ### Description
 Expert guide for deploying SaaS applications and their multiple entry points (landing page, app, super admin subdomain) on modern edge and serverless platforms. Covers Vercel, Cloudflare Workers & Pages, Railway, Fly.io, and **Cloudflare Workers AI** for AI-powered edge workloads.
 
@@ -208,6 +211,9 @@ if (cached) return cached;
 <a name="bahasa-indonesia"></a>
 ## Bahasa Indonesia
 
+### Integrasi Orkestrasi
+Terhubung dan mengorkestrasi skill domain yang relevan seperti `brainstorming`, `zero-to-prod-orchestrator`, dan `project-context-mapper` untuk memastikan eksekusi yang kohesif.
+
 ### Deskripsi
 Panduan ahli untuk men-deploy aplikasi SaaS dan multiple entry points-nya (landing page, aplikasi, subdomain super admin) di platform edge dan serverless modern. Mencakup Vercel, Cloudflare Workers & Pages, Railway, Fly.io, dan **Cloudflare Workers AI** untuk workload AI di edge.
 

package/skills/coderabbit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: coderabbit
 description: "AI-powered automated code review, PR summarization, and interactive developer feedback / Review kode otomatis berbasis AI, ringkasan PR, dan umpan balik developer interaktif."
-author: "Roedy Rustam"
+author: "Roedy Rustam"
 ---
 
 # CodeRabbit (2026 Edition — CodeRabbit 2.x)
@@ -13,6 +13,9 @@ author: "Roedy Rustam"
 <a name="english"></a>
 ## English
 
+### Orchestration & Integration
+Connects and orchestrates with relevant domain skills like `brainstorming`, `zero-to-prod-orchestrator`, and `project-context-mapper` to ensure cohesive execution.
+
 ### Description
 Expert guide for configuring and leveraging **CodeRabbit 2.x** — AI-powered automated code review, pull request summarization, and interactive developer feedback. Covers configuration, custom review rules, integration with CI/CD, and agentic review mode.
 
@@ -151,6 +154,9 @@ jobs:
 <a name="bahasa-indonesia"></a>
 ## Bahasa Indonesia
 
+### Integrasi Orkestrasi
+Terhubung dan mengorkestrasi skill domain yang relevan seperti `brainstorming`, `zero-to-prod-orchestrator`, dan `project-context-mapper` untuk memastikan eksekusi yang kohesif.
+
 ### Deskripsi
 Panduan ahli untuk mengonfigurasi dan memanfaatkan **CodeRabbit 2.x** — review kode otomatis bertenaga AI, ringkasan pull request, dan umpan balik developer interaktif. Mencakup konfigurasi, aturan review kustom, integrasi dengan CI/CD, dan mode review agentik.
 

package/skills/compliance-gdpr-privacy-expert/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: compliance-gdpr-privacy-expert
+description: "Expert guide for Data Privacy, GDPR, CCPA, and PDPA compliance. Covers consent management, data retention, privacy-by-design, and audit trails / Panduan kepatuhan Privasi Data, GDPR, dan PDPA."
+author: "Roedy Rustam"
+---
+
+# Data Privacy & Compliance Expert
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Description
+A crucial guide for engineering teams building SaaS applications that handle PII (Personally Identifiable Information). Covers technical implementation patterns for privacy regulations like GDPR (Europe), CCPA (California), and PDPA/UU PDP (Indonesia), including data mapping, consent management, Right to be Forgotten (data erasure), and secure audit trails.
+
+### Trigger Conditions
+- When architecting user database schemas that store PII (names, emails, phone numbers, IP addresses).
+- When implementing cookie consent banners and tracking scripts.
+- When the user asks about "GDPR compliance", "data retention", or "account deletion".
+- When building admin dashboards that require secure audit logging.
+
+### Core Architectural Guidelines
+
+#### 1. Privacy by Design (Data Minimization)
+Do not collect data you do not explicitly need.
+- **Hashing/Encryption**: Hash sensitive data (like passwords) and encrypt PII at rest (AES-256) and in transit (TLS 1.3).
+- **IP Addresses**: IP addresses are considered PII under GDPR. Anonymize IP logs (e.g., masking the last octet `192.168.1.0`) if used for analytics.
+
+#### 2. The Right to be Forgotten (Soft vs Hard Deletion)
+Users must be able to delete their accounts easily.
+- **Soft Deletion**: Flagging a user as `deleted_at = NOW()` is useful for immediate UI removal, but it is **not compliant** with GDPR erasure requests if the data stays indefinitely.
+- **Hard Deletion / Scrubbing**: You must implement a background worker that permanently deletes or fully anonymizes soft-deleted records after a grace period (e.g., 30 days).
+
+#### 3. Consent Management
+- **Cookies**: Do not load analytical or marketing scripts (Google Analytics, Meta Pixel) until the user has explicitly clicked "Accept".
+- **Database**: Store the timestamp and version of the Terms of Service/Privacy Policy the user agreed to during registration.
+
+#### 4. Audit Trails
+For financial or health data, maintain an append-only audit log of *who* accessed *what* PII and *when*.
+- Never log actual PII in plain text application logs (e.g., avoid `console.log(user)`).
+
+## Orchestration & Integration
+- Enhances `database-orm-expert` with schema guidelines for soft-deletion and PII encryption.
+- Works with `logging-error-tracking-expert` to ensure logs are sanitized of PII.
+- Complements `authentication-identity-expert` for secure user lifecycle management.
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Panduan krusial bagi tim engineering yang membangun aplikasi SaaS yang menangani PII (Data Pribadi). Mencakup pola implementasi teknis untuk regulasi privasi seperti GDPR (Eropa) dan UU PDP (Pelindungan Data Pribadi Indonesia). Meliputi manajemen persetujuan (consent), hak untuk dilupakan (penghapusan data), dan rekam jejak audit (audit trails).
+
+### Kondisi Pemicu
+- Saat merancang skema database yang menyimpan data pribadi (nama, email, nomor telepon).
+- Saat mengimplementasikan banner persetujuan cookie (cookie consent).
+- Saat merancang fitur penghapusan akun pengguna.
+- Saat melakukan logging data sensitif.
+
+### Panduan Arsitektur Inti
+
+#### 1. Privasi sejak Desain (Privacy by Design)
+Kumpulkan hanya data yang benar-benar dibutuhkan.
+- **Enkripsi**: Enkripsi PII saat diam (at rest) dan bergerak (in transit).
+- **Alamat IP**: IP adalah data pribadi. Anomimkan log IP jika hanya digunakan untuk analitik umum.
+
+#### 2. Hak untuk Dihapus (Right to be Forgotten)
+Pengguna harus memiliki tombol yang mudah diakses untuk menghapus akun mereka.
+- **Soft Delete vs Hard Delete**: Mengubah status menjadi `deleted_at` tidak cukup untuk kepatuhan hukum jika data dibiarkan selamanya. Anda harus membuat *cron job* yang secara permanen menghapus atau menganonimkan data (mengubah nama menjadi "Deleted User") setelah masa tenggang (misal: 30 hari).
+
+#### 3. Manajemen Persetujuan (Consent)
+- Jangan memuat skrip pelacakan pihak ketiga (seperti Facebook Pixel atau Google Analytics) sebelum pengguna memberikan izin eksplisit (Opt-In).
+- Simpan rekaman kapan pengguna menyetujui Kebijakan Privasi Anda di database.
+
+#### 4. Pembersihan Log (Log Sanitization)
+Pastikan sistem logging aplikasi Anda (Pino, Winston) secara otomatis menyensor (redact) informasi sensitif seperti password, token kartu kredit, dan nomor telepon sebelum mengirimkannya ke sistem agregasi log seperti Datadog atau Sentry.
+
+## Integrasi Orkestrasi
+- Memperkuat `database-orm-expert` terkait skema enkripsi dan penghapusan data.
+- Bekerja sama dengan `logging-error-tracking-expert` untuk pedoman sanitasi log.
+- Melengkapi `authentication-identity-expert` dalam manajemen siklus hidup pengguna.