vibes-plug 2.5.0 → 2.14.1

package/skills/saas-transformer/references/billing_integration_guide.md

@@ -1,401 +0,0 @@
-# Billing & Payment Gateway Integration Guide
-
-A comprehensive guide to setting up subscription billing, payment gateways, and Merchant of Record (MoR) systems. This guide covers Stripe, Midtrans, PayPal, Paddle, and FastSpring, detailing database structures and webhook verification in a multi-tenant SaaS application.
-
----
-
-## 1. Gateway Type: Payment Gateway vs. Merchant of Record (MoR)
-
-Before choosing a billing system, it is vital to understand the two main categories of billing platforms:
-
-| Feature | Payment Gateway (Stripe, Midtrans, PayPal) | Merchant of Record (Paddle, FastSpring) |
-|---|---|---|
-| **Definition** | Processes payments but places legal/financial responsibilities on you. | Acts as the reseller of your software; handles transactions and compliance. |
-| **Sales Tax / VAT** | You must calculate, collect, and file taxes globally (using tools like Stripe Tax). | Automatically handles global taxes, compliance, and invoicing. |
-| **Chargeback Liability**| You manage chargeback disputes directly. | The MoR platform handles chargeback disputes. |
-| **Integration Complexity**| Highly customizable APIs, but requires more backend logic for compliance. | Simple to configure; checkout UI is managed by the MoR. |
-
----
-
-## 2. Generic Multi-Gateway Database Schema
-
-To support multiple payment gateways, use a generic subscription schema.
-
-### Prisma Schema (`prisma/schema.prisma`)
-```prisma
-model Subscription {
-  id                 String   @id @default(cuid())
-  workspaceId        String   @unique
-  workspace          Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
-  gateway            String   // "stripe", "midtrans", "paypal", "paddle", "fastspring"
-  gatewayCustomerId  String?  @unique
-  gatewaySubscriptionId String? @unique
-  gatewayPriceId     String?
-  status             String   // "active", "trialing", "past_due", "canceled", "unpaid"
-  currentPeriodEnd   DateTime
-  cancelAtPeriodEnd  Boolean  @default(false)
-  createdAt          DateTime @default(now())
-  updatedAt          DateTime @updatedAt
-}
-```
-
-### Drizzle ORM Schema (`lib/db/schema.ts`)
-```typescript
-import { pgTable, text, timestamp, boolean } from 'drizzle-orm/pg-core';
-
-export const subscriptions = pgTable('subscriptions', {
-  id: text('id').primaryKey(),
-  workspaceId: text('workspace_id').notNull().unique(),
-  gateway: text('gateway').notNull(), // "stripe", "midtrans", "paypal", "paddle", "fastspring"
-  gatewayCustomerId: text('gateway_customer_id').unique(),
-  gatewaySubscriptionId: text('gateway_subscription_id').unique(),
-  gatewayPriceId: text('gateway_price_id'),
-  status: text('status').notNull(),
-  currentPeriodEnd: timestamp('current_period_end').notNull(),
-  cancelAtPeriodEnd: boolean('cancel_at_period_end').default(false).notNull(),
-  createdAt: timestamp('created_at').defaultNow().notNull(),
-  updatedAt: timestamp('updated_at').defaultNow().notNull(),
-});
-```
-
----
-
-## 3. Webhook Implementations
-
-Webhooks are crucial to keep your SaaS database in sync with payment updates. Below are the implementation templates for Next.js 15 (App Router).
-
-### A. Stripe Integration
-Processes subscriptions and invoices. Verified via the Stripe SDK.
-
-```typescript
-import { NextResponse } from 'next/server';
-import Stripe from 'stripe';
-import { db } from '@/lib/db';
-import { subscriptions } from '@/lib/db/schema';
-import { eq } from 'drizzle-orm';
-
-const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, { apiVersion: '2025-01-01' as any });
-
-export async function POST(req: Request) {
-  const body = await req.text();
-  const signature = req.headers.get('Stripe-Signature')!;
-
-  let event: Stripe.Event;
-  try {
-    event = stripe.webhooks.constructEvent(body, signature, process.env.STRIPE_WEBHOOK_SECRET!);
-  } catch (err: any) {
-    return NextResponse.json({ error: `Signature verification failed: ${err.message}` }, { status: 400 });
-  }
-
-  switch (event.type) {
-    case 'checkout.session.completed': {
-      const session = event.data.object as Stripe.Checkout.Session;
-      const workspaceId = session.metadata?.workspaceId;
-      if (!workspaceId) break;
-
-      const subscription = await stripe.subscriptions.retrieve(session.subscription as string);
-      await db.insert(subscriptions).values({
-        id: subscription.id,
-        workspaceId,
-        gateway: 'stripe',
-        gatewayCustomerId: session.customer as string,
-        gatewaySubscriptionId: subscription.id,
-        gatewayPriceId: subscription.items.data[0].price.id,
-        status: subscription.status,
-        currentPeriodEnd: new Date(subscription.current_period_end * 1000),
-      });
-      break;
-    }
-    case 'invoice.payment_succeeded': {
-      const invoice = event.data.object as Stripe.Invoice;
-      if (!invoice.subscription) break;
-      const subscription = await stripe.subscriptions.retrieve(invoice.subscription as string);
-      await db.update(subscriptions)
-        .set({
-          status: subscription.status,
-          currentPeriodEnd: new Date(subscription.current_period_end * 1000),
-        })
-        .where(eq(subscriptions.gatewaySubscriptionId, subscription.id));
-      break;
-    }
-    case 'customer.subscription.deleted': {
-      const subscription = event.data.object as Stripe.Subscription;
-      await db.update(subscriptions)
-        .set({ status: 'canceled' })
-        .where(eq(subscriptions.gatewaySubscriptionId, subscription.id));
-      break;
-    }
-  }
-  return NextResponse.json({ received: true });
-}
-```
-
-### B. Midtrans Integration
-Southeast Asia's popular payment gateway. Verified via SHA512 signature key matching.
-
-```typescript
-import { NextResponse } from 'next/server';
-import crypto from 'crypto';
-import { db } from '@/lib/db';
-import { subscriptions } from '@/lib/db/schema';
-import { eq } from 'drizzle-orm';
-
-export async function POST(req: Request) {
-  const body = await req.json();
-  const { order_id, status_code, gross_amount, signature_key, transaction_status, fraud_status } = body;
-
-  // Verify signature key: sha512(order_id + status_code + gross_amount + server_key)
-  const serverKey = process.env.MIDTRANS_SERVER_KEY!;
-  const hashed = crypto
-    .createHash('sha512')
-    .update(order_id + status_code + gross_amount + serverKey)
-    .digest('hex');
-
-  if (hashed !== signature_key) {
-    return NextResponse.json({ error: 'Invalid Midtrans signature' }, { status: 400 });
-  }
-
-  // Update subscription/payment state based on transaction_status
-  if (transaction_status === 'capture' || transaction_status === 'settlement') {
-    if (fraud_status === 'challenge') {
-      await db.update(subscriptions).set({ status: 'unpaid' }).where(eq(subscriptions.id, order_id));
-    } else {
-      await db.update(subscriptions)
-        .set({ status: 'active', currentPeriodEnd: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) })
-        .where(eq(subscriptions.id, order_id));
-    }
-  } else if (['cancel', 'deny', 'expire'].includes(transaction_status)) {
-    await db.update(subscriptions).set({ status: 'canceled' }).where(eq(subscriptions.id, order_id));
-  } else if (transaction_status === 'pending') {
-    await db.update(subscriptions).set({ status: 'unpaid' }).where(eq(subscriptions.id, order_id));
-  }
-
-  return NextResponse.json({ success: true });
-}
-```
-
-### C. PayPal Integration
-Global subscription billing. Verified via PayPal API request validation.
-
-```typescript
-import { NextResponse } from 'next/server';
-import { db } from '@/lib/db';
-import { subscriptions } from '@/lib/db/schema';
-import { eq } from 'drizzle-orm';
-
-async function verifyPayPalSignature(headers: Headers, rawBody: string, webhookId: string) {
-  // Call PayPal API to verify signature authenticity
-  const endpoint = process.env.PAYPAL_MODE === 'live' 
-    ? 'https://api-m.paypal.com' 
-    : 'https://api-m.sandbox.paypal.com';
-
-  const authHeader = headers.get('authorization');
-  if (!authHeader) return false;
-
-  const response = await fetch(`${endpoint}/v1/notifications/verify-webhook-signature`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'Authorization': authHeader,
-    },
-    body: JSON.stringify({
-      auth_algo: headers.get('paypal-auth-algo'),
-      cert_url: headers.get('paypal-cert-url'),
-      transmission_id: headers.get('paypal-transmission-id'),
-      transmission_sig: headers.get('paypal-transmission-sig'),
-      transmission_time: headers.get('paypal-transmission-time'),
-      webhook_id: webhookId,
-      webhook_event: JSON.parse(rawBody),
-    }),
-  });
-
-  const verification = await response.json();
-  return verification.verification_status === 'SUCCESS';
-}
-
-export async function POST(req: Request) {
-  const rawBody = await req.text();
-  const webhookId = process.env.PAYPAL_WEBHOOK_ID!;
-
-  const isValid = await verifyPayPalSignature(req.headers, rawBody, webhookId);
-  if (!isValid) {
-    return NextResponse.json({ error: 'PayPal signature invalid' }, { status: 400 });
-  }
-
-  const event = JSON.parse(rawBody);
-
-  switch (event.event_type) {
-    case 'BILLING.SUBSCRIPTION.CREATED': {
-      const sub = event.resource;
-      const workspaceId = sub.custom_id; // Pass workspace ID in custom_id
-      if (!workspaceId) break;
-
-      await db.insert(subscriptions).values({
-        id: sub.id,
-        workspaceId,
-        gateway: 'paypal',
-        gatewayCustomerId: sub.subscriber.payer_id,
-        gatewaySubscriptionId: sub.id,
-        gatewayPriceId: sub.plan_id,
-        status: 'active',
-        currentPeriodEnd: new Date(sub.billing_info.next_billing_time),
-      });
-      break;
-    }
-    case 'BILLING.SUBSCRIPTION.CANCELLED': {
-      const sub = event.resource;
-      await db.update(subscriptions)
-        .set({ status: 'canceled' })
-        .where(eq(subscriptions.gatewaySubscriptionId, sub.id));
-      break;
-    }
-  }
-
-  return NextResponse.json({ received: true });
-}
-```
-
-### D. Paddle Integration (Paddle Billing v2)
-Merchant of Record. Verified locally using an HMAC-SHA256 signature key verification.
-
-```typescript
-import { NextResponse } from 'next/server';
-import crypto from 'crypto';
-import { db } from '@/lib/db';
-import { subscriptions } from '@/lib/db/schema';
-import { eq } from 'drizzle-orm';
-
-function verifyPaddleSignature(body: string, signatureHeader: string, secret: string): boolean {
-  const parts = signatureHeader.split(';');
-  const tsPart = parts.find(p => p.startsWith('ts='));
-  const h1Part = parts.find(p => p.startsWith('h1='));
-  if (!tsPart || !h1Part) return false;
-
-  const ts = tsPart.split('=')[1];
-  const h1 = h1Part.split('=')[1];
-
-  const payload = `${ts}:${body}`;
-  const computedHash = crypto.createHmac('sha256', secret).update(payload).digest('hex');
-  return computedHash === h1;
-}
-
-export async function POST(req: Request) {
-  const rawBody = await req.text();
-  const signature = req.headers.get('Paddle-Signature')!;
-  const secret = process.env.PADDLE_WEBHOOK_SECRET!;
-
-  if (!verifyPaddleSignature(rawBody, signature, secret)) {
-    return NextResponse.json({ error: 'Invalid Paddle signature' }, { status: 400 });
-  }
-
-  const event = JSON.parse(rawBody);
-  const eventType = event.event_type;
-  const data = event.data;
-
-  switch (eventType) {
-    case 'subscription.created':
-    case 'subscription.updated': {
-      const workspaceId = data.custom_data?.workspaceId;
-      if (!workspaceId) break;
-
-      await db.insert(subscriptions).values({
-        id: data.id,
-        workspaceId,
-        gateway: 'paddle',
-        gatewayCustomerId: data.customer_id,
-        gatewaySubscriptionId: data.id,
-        gatewayPriceId: data.items[0].price.id,
-        status: data.status, // active, trialing, paused
-        currentPeriodEnd: new Date(data.current_billing_period.ends_at),
-      }).onConflictDoUpdate({
-        target: subscriptions.workspaceId,
-        set: {
-          status: data.status,
-          currentPeriodEnd: new Date(data.current_billing_period.ends_at),
-          gatewayPriceId: data.items[0].price.id,
-        }
-      });
-      break;
-    }
-    case 'subscription.canceled': {
-      await db.update(subscriptions)
-        .set({ status: 'canceled' })
-        .where(eq(subscriptions.gatewaySubscriptionId, data.id));
-      break;
-    }
-  }
-
-  return NextResponse.json({ received: true });
-}
-```
-
-### E. FastSpring Integration
-Merchant of Record. Verified via an HMAC-SHA256 signature key verification.
-
-```typescript
-import { NextResponse } from 'next/server';
-import crypto from 'crypto';
-import { db } from '@/lib/db';
-import { subscriptions } from '@/lib/db/schema';
-import { eq } from 'drizzle-orm';
-
-function verifyFastSpringSignature(body: string, signature: string, secretKey: string): boolean {
-  const hash = crypto.createHmac('sha256', secretKey).update(body).digest('base64');
-  return hash === signature;
-}
-
-export async function POST(req: Request) {
-  const rawBody = await req.text();
-  const signature = req.headers.get('X-FS-Signature')!;
-  const secretKey = process.env.FASTSPRING_SHARED_SECRET!;
-
-  if (!verifyFastSpringSignature(rawBody, signature, secretKey)) {
-    return NextResponse.json({ error: 'Invalid FastSpring signature' }, { status: 400 });
-  }
-
-  const payload = JSON.parse(rawBody);
-
-  for (const event of payload.events) {
-    switch (event.type) {
-      case 'subscription.activated': {
-        const sub = event.data;
-        const workspaceId = sub.tags?.workspaceId;
-        if (!workspaceId) break;
-
-        await db.insert(subscriptions).values({
-          id: sub.id,
-          workspaceId,
-          gateway: 'fastspring',
-          gatewayCustomerId: sub.account,
-          gatewaySubscriptionId: sub.id,
-          gatewayPriceId: sub.product,
-          status: 'active',
-          currentPeriodEnd: new Date(sub.nextSession),
-        });
-        break;
-      }
-      case 'subscription.canceled': {
-        const sub = event.data;
-        await db.update(subscriptions)
-          .set({ status: 'canceled' })
-          .where(eq(subscriptions.gatewaySubscriptionId, sub.id));
-        break;
-      }
-    }
-  }
-
-  return NextResponse.json({ received: true });
-}
-```
-
----
-
-## 4. Best Practices for Webhook Handlers
-
-1. **Webhook Idempotency**: Payment gateways can redeliver webhooks. Always store a list of processed event IDs in your database to prevent duplicate actions:
-   ```typescript
-   const processed = await db.query.processedEvents.findFirst({ where: eq(processedEvents.id, eventId) });
-   if (processed) return NextResponse.json({ received: true });
-   ```
-2. **Handle Async Work Gracefully**: Send a fast response (`200 OK`) back to the gateway first, then process any heavy logic asynchronously (or via queue systems like BullMQ) if necessary, to avoid gateway timeouts.
-3. **Database Locks**: Run your update queries inside clean transactions to avoid concurrency anomalies.

package/skills/self-evolving-memory-graph/SKILL.md

@@ -1,75 +0,0 @@
----
-name: self-evolving-memory-graph
-description: "Grants the AI long-term episodic memory. The agent autonomously documents the user's coding preferences, past mistakes to avoid, and architectural decisions into a persistent learning graph."
-author: "Roedy Rustam"
----
-
-# Self-Evolving Memory Graph (Episodic Memory)
-
-[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
-
----
-
-<a name="english"></a>
-## English
-
-### Description
-Claude forgets everything once a chat is cleared, and its "Project Knowledge" requires manual human updating. This skill gives Antigravity the "superpower" of continuous, autonomous self-improvement. The agent actively listens for user corrections, stylistic preferences, and hard-learned debugging lessons, writing them into a persistent `LEARNING_GRAPH.md` (or `.agents/LEARNING.md`) file. The agent gets smarter and more aligned with the user over time.
-
-### Trigger Conditions
-Activate this skill when:
-- The user corrects your code (e.g., "Don't use `any`, use `unknown`", or "Always use Arrow functions").
-- You just spent a long time fixing a very complex bug.
-- The user says "Remember this for the future."
-
-### Core Concepts
-
-#### 1. Memory Encoding
-Whenever a hard lesson is learned or a strong user preference is stated, do not just say "I will remember that." You must physically write it down.
-Use the `multi_replace_file_content` or `write_to_file` tool to append the lesson to the memory file.
-
-#### 2. Memory Format (`LEARNING_GRAPH.md`)
-```markdown
-# 🧠 Self-Evolving Memory Graph
-
-## User Stylistic Preferences
-- [2026-08-12] Always use `Tailwind v4 @theme` variables instead of arbitrary values like `text-[#ff0000]`.
-- [2026-08-12] Prefer functional components with `const` over `function` declarations.
-
-## Hard-Learned Lessons (Avoid these mistakes)
-- [2026-08-11] Supabase RLS policies: Never use `auth.uid()` in a `FOR ALL` policy without checking role claims. It caused an infinite recursion bug in `users` table.
-
-## Architectural Decisions
-- [2026-08-10] State Management: We exclusively use `Zustand` for global state. Do not suggest Redux.
-```
-
-#### 3. Memory Retrieval
-Ensure `session-context-loader` is configured to read this memory file at the start of every new chat session. 
-
----
-
-### Integration with Other Skills (MANDATORY)
-- `session-context-loader` — Essential for loading the `LEARNING_GRAPH.md` when a new session starts.
-- `project-context-mapper` — The context map tracks *where* things are; the memory graph tracks *how* and *why* things are built.
-
-### Referenced By Orchestrators (MANDATORY)
-- `brainstorming` — Add to "Discovery & Audit".
-- `zero-to-prod-orchestrator` — Phase 1 (Discovery & Architecture).
-
----
-
-<a name="bahasa-indonesia"></a>
-## Bahasa Indonesia
-
-### Deskripsi
-Claude melupakan segalanya saat sesi chat baru dimulai. Skill ini memberi Anda "kekuatan super" berupa *Ingatan Jangka Panjang* yang berevolusi sendiri. Agen secara aktif mencatat preferensi koding pengguna, pelajaran dari *bug* yang sulit dipecahkan, dan keputusan arsitektur ke dalam file persisten `LEARNING_GRAPH.md`. 
-
-### Kondisi Pemicu
-- Saat pengguna mengoreksi gaya koding Anda (misal: "Gunakan bahasa Indonesia baku", "Jangan pakai `var`").
-- Setelah Anda berhasil memecahkan *bug* yang menghabiskan waktu lama.
-- Saat pengguna berkata "Ingat ini untuk proyek ke depannya."
-
-### Panduan Singkat
-- **Jangan Hanya Berjanji:** Jika pengguna mengoreksi Anda, jangan sekadar menjawab "Baik, saya akan ingat." LLM tidak punya ingatan bawaan antar-sesi. Anda **wajib** menulis koreksi tersebut ke dalam file `LEARNING_GRAPH.md` di folder `.agents/` atau direktori *root*.
-- **Kategorisasi Ingatan:** Pisahkan ingatan menjadi: Preferensi Gaya (*Style*), Pelajaran Berharga (*Lessons Learned*), dan Keputusan Arsitektur (*Decisions*).
-- **Semakin Lama Semakin Pintar:** Dengan membaca file ini di awal setiap percakapan, Anda tidak akan pernah mengulangi kesalahan yang sama dua kali.

package/skills/senior-fullstack/SKILL.md

@@ -1,167 +0,0 @@
----
-name: senior-fullstack
-description: "Complete toolkit for senior fullstack with modern tools and best practices / Perangkat instruksi lengkap untuk pengembang fullstack tingkat senior dengan alat-alat dan best practices termutakhir."
-author: "Roedy Rustam"
----
-
-# Senior Fullstack Developer (2026 Edition)
-
-[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
-
----
-
-<a name="english"></a>
-## English
-
-### Description
-Complete guidelines for senior fullstack developers building production-grade applications in 2026. Covers the modern AI-native stack, architecture decision-making, API design, frontend/backend integration, and team-level best practices.
-
-### Trigger Conditions
-- Making fullstack architecture decisions across frontend and backend.
-- Designing API contracts between React 19/Next.js 15 frontend and Node.js/Go/Python backend.
-- Integrating AI features (LLM, agents, RAG) into a fullstack application.
-- Setting up a monorepo with shared types between frontend and backend.
-- Reviewing and improving overall application architecture and code quality.
-
-### Modern 2026 Fullstack Stack
-
-#### Recommended Stacks by Use Case
-
-| Use Case | Frontend | Backend | Database | AI Layer |
-|---|---|---|---|---|
-| **SaaS App (default)** | Next.js 15 (App Router) | Hono / Fastify 5 | Postgres + Drizzle | Vercel AI SDK 5.x |
-| **AI-First App** | Next.js 15 + RSC streaming | Mastra.ai / LangGraph | pgvector + Supabase | Anthropic / OpenAI |
-| **Decoupled SPA** | TanStack Start + React 19 | Hono RPC | Postgres + Drizzle | Vercel AI SDK |
-| **Content Site** | Astro 5 + MDX | N/A (static) | Sanity / Contentful | — |
-| **Mobile** | Expo SDK 53 + React Native 0.79 | Hono / Fastify | SQLite (Expo) + Postgres | Vercel AI SDK |
-
-#### AI-Native Fullstack Patterns
-In 2026, AI is a first-class citizen in fullstack applications:
-- **Streaming AI Responses**: Use Next.js RSC + Vercel AI SDK `streamUI` to stream LLM responses as React components from the server.
-- **Server Actions as AI Triggers**: Use React 19 `useActionState` with Server Actions to invoke LLM calls without an API layer.
-- **Background AI Jobs**: Offload long LLM tasks to BullMQ + Redis workers; stream results via WebSockets or SSE.
-- **Structured AI Output**: Always use `zodResponseFormat` or Pydantic schemas for LLM responses — never parse free-form JSON.
-
-### API Design Principles (2026)
-
-#### Type-Safe Communication
-Choose one approach and be consistent:
-- **Hono RPC**: If backend is Hono — zero codegen, end-to-end types.
-- **tRPC**: If using React Query with Next.js — excellent DX with RSC support.
-- **OpenAPI + codegen**: If you have multiple consumers (mobile, third parties).
-
-#### API Versioning
-- Use URL versioning: `/api/v1/users`.
-- Pin major version in URL, minor versions are backward-compatible.
-- Deprecate with `Deprecation` and `Sunset` headers.
-
-#### Error Response Standard (RFC 9457 Problem Details)
-```typescript
-// Consistent error format across all endpoints
-interface ProblemDetail {
-  type: string;       // URI identifying the error type
-  title: string;      // Human-readable summary
-  status: number;     // HTTP status code
-  detail: string;     // Specific explanation
-  instance?: string;  // URI of the specific occurrence
-}
-```
-
-### SPA vs SSR vs Static — Decision Guide
-```
-SEO-critical + mostly read? → Next.js SSR / Astro 5 (static)
-Highly interactive dashboard? → SPA (TanStack Start / Vite + TanStack Router)
-   → see spa-orchestrator skill for architecture details
-Mixed (marketing + app)?    → Next.js 15 with hybrid routing
-Real-time data?             → SSR + WebSocket or SSE streaming
-```
-
-### Monorepo with Shared Types
-```typescript
-// packages/types/src/index.ts — single source of truth
-export interface User {
-  id: string;
-  email: string;
-  name: string;
-  plan: 'free' | 'pro' | 'enterprise';
-  isSuperAdmin: boolean;
-}
-
-export interface ApiResponse<T> {
-  data: T;
-  meta?: { page: number; total: number };
-}
-
-// apps/api — uses the type
-// apps/web — uses the same type
-// apps/admin — uses the same type
-import type { User } from '@myapp/types';
-```
-
-### Security Checklist (Fullstack)
-- [ ] All user inputs validated with Zod on the server (never trust the client).
-- [ ] JWT secrets rotated every 90 days; use short expiry + refresh tokens.
-- [ ] CSP headers configured (no `unsafe-inline` in production).
-- [ ] All DB queries use parameterized queries — no string concatenation.
-- [ ] File uploads validated for MIME type and scanned before storage.
-- [ ] Rate limiting on all public API endpoints.
-- [ ] Super Admin routes restricted to `admin.domain.com` with `isSuperAdmin` check.
-
-### Code Review Standards
-- Functions < 30 lines; files < 300 lines.
-- No business logic in UI components.
-- Every PR includes relevant tests (unit or E2E).
-- No `any` types in TypeScript production code.
-- Dependencies audited with `pnpm audit` on every PR.
-
----
-
-<a name="bahasa-indonesia"></a>
-## Bahasa Indonesia
-
-### Deskripsi
-Panduan lengkap untuk pengembang fullstack senior yang membangun aplikasi tingkat produksi di 2026. Mencakup stack AI-native modern, pengambilan keputusan arsitektur, desain API, integrasi frontend/backend, dan best practices tingkat tim.
-
-### Kondisi Pemicu
-- Membuat keputusan arsitektur fullstack di frontend dan backend.
-- Merancang kontrak API antara frontend React 19/Next.js 15 dan backend Node.js/Go/Python.
-- Mengintegrasikan fitur AI (LLM, agen, RAG) ke dalam aplikasi fullstack.
-- Menyiapkan monorepo dengan shared types antara frontend dan backend.
-- Meninjau dan meningkatkan arsitektur dan kualitas kode aplikasi secara keseluruhan.
-
-### Stack Fullstack Modern 2026
-
-Rekomendasi stack berdasarkan use case:
-- **SaaS App**: Next.js 15 + Hono/Fastify + Postgres + Drizzle + Vercel AI SDK.
-- **AI-First App**: Next.js 15 RSC streaming + Mastra.ai/LangGraph + pgvector.
-- **SPA Terpisah**: TanStack Start + Hono RPC + Postgres — lihat `spa-orchestrator`.
-- **Situs Konten**: Astro 5 + MDX.
-- **Mobile**: Expo SDK 53 + Hono + SQLite.
-
-### Pola Fullstack AI-Native (2026)
-AI adalah warga kelas satu di aplikasi fullstack 2026:
-- **Streaming RSC**: Alirkan respons LLM sebagai komponen React dari server menggunakan `streamUI` Vercel AI SDK 5.x.
-- **Server Actions sebagai Pemicu AI**: Panggil LLM dari Server Actions React 19 tanpa lapisan API terpisah.
-- **Background AI Jobs**: Offload tugas LLM panjang ke BullMQ + Redis; stream hasil via WebSocket atau SSE.
-- **Output AI Terstruktur**: Selalu gunakan `zodResponseFormat` atau skema Pydantic — jangan pernah parse JSON bebas dari LLM.
-
-### Prinsip Desain API (2026)
-- **Hono RPC**: Zero codegen, end-to-end type-safe jika backend adalah Hono.
-- **tRPC**: Untuk React Query + Next.js dengan dukungan RSC.
-- **OpenAPI + codegen**: Jika memiliki banyak konsumen (mobile, pihak ketiga).
-- **Format Error RFC 9457**: Respons error yang konsisten dengan `type`, `title`, `status`, `detail`.
-
-### SPA vs SSR vs Static
-Gunakan SSR/Astro untuk situs kritis SEO dan banyak baca. Gunakan SPA (TanStack Start) untuk dashboard yang sangat interaktif. Gunakan Next.js 15 dengan routing hybrid untuk aplikasi campuran (marketing + app).
-
-### Monorepo dengan Shared Types
-Definisikan interface dan tipe bersama di `packages/types` — digunakan oleh semua app (web, admin, api, mobile) sebagai single source of truth.
-
-### Checklist Keamanan
-- Input pengguna divalidasi Zod di server.
-- JWT rotasi 90 hari; expiry pendek + refresh token.
-- Header CSP dikonfigurasi.
-- Semua query DB menggunakan parameterized query.
-- Upload file divalidasi MIME type.
-- Rate limiting di semua endpoint publik.
-- Rute Super Admin dibatasi di `admin.domain.com` dengan cek `isSuperAdmin`.