# AGENTS.md

Repo-specific guidance for AI agents. The `<laravel-boost-guidelines>` block below is generated by Laravel Boost — keep it intact and add project notes above it.

## What this is

WebTopup — an Indonesian PPOB / digital top-up platform. Laravel 12 + Inertia v2 + Vue 3 + Tailwind v4, MySQL 8 + Redis. Two surfaces: public storefront/checkout and a permission-gated `cms` admin. Integrations: Midtrans (payments), Digiflazz + API Games (suppliers), plus Voda / game-proxy services.

## Commands

- Dev loop: `composer run dev` (runs `artisan serve`, `queue:listen`, `pail`, and Vite together). `npm run dev` alone only starts Vite.
- Build assets (required before Inertia pages render in tests/manual checks): `npm run build`.
- Tests: `php artisan test --compact`; single file/filter: `php artisan test --compact tests/Feature/Foo.php` or `--filter=name`. `composer test` clears config first.
- PHP format: `vendor/bin/pint --dirty --format agent`. Frontend: `npm run format` (prettier, writes `resources/`) then `npm run lint` (eslint `--fix`). CI runs Pint + `npm run format` + `npm run lint` on `develop`/`main`.
- There is no `typecheck` npm script (`vue-tsc` is installed but unscripted).
- Docker: `./docker-run.sh setup|up|down|shell|artisan|composer|test|pint|logs|reset` (bash — use Git Bash/WSL on Windows). App at http://localhost.

## Backend conventions (follow these)

- **Routes are split**, not monolithic. `routes/web.php` requires `routes/web/{settings,cms,main}.php`; `routes/api.php` requires `routes/api/v1.php`, which **only** loads `routes/api/v1/callback.php` (Midtrans/Digiflazz webhooks). `routes/api/v1/{auth,role,user}.php` exist but are **not wired up** — require them in `v1.php` if you need them. Add routes to the matching file. The `routes/web/cms.php` group auto-applies prefix `cms`, name `cms.`, and middleware `auth,verified,role:superadmin|admin`; it further requires `routes/web/cms/{web,ppob,order,setting,management}.php`.
- **Request → Controller → Action → Model.** Controllers stay thin; write single-purpose Action classes per operation (`StoreXAction`, `UpdateXAction`, `DeleteXAction`, `HandleXCallbackAction`) exposing a `handle()` method. Actions live under `app/Actions/{Cms,Api,Main,Fortify}/...` mirroring `app/Http/Controllers/...`; Form Requests under `app/Http/Requests/...`. Copy an existing triad before inventing a new pattern.
- **Models are grouped by domain subnamespace**: `App\Models\PPOB\PPOBProduct`, `App\Models\Order\Order`, `App\Models\Menu\Menu`, `App\Models\Web\Faq`, `App\Models\Voucher\Voucher`. There is no flat `App\Models\Product`.
- **Authorization uses Spatie permissions named `{prefix}{FQCN}`** — controllers set `protected string $resource = Model::class;` then `Gate::authorize('view'.$this->resource)`. Prefixes: view/show/create/update/delete/restore/forceDelete/export/import/validate. `PermissionSeeder` auto-discovers every class in `app/Models`; **after adding a model run `php artisan db:seed --class=PermissionSeeder`** or the permission won't exist. Guard is `api` (`User::$guard_name`). Roles: `superadmin`, `admin`, `user`. Seeded logins (password `password`): superadmin@superadmin.com, admin@admin.com, user@user.com.
- **Index/list endpoints** use `App\Traits\WithGetFilterData::getDataWithFilter()` (pagination via `fastPaginate`) and pass `order/orderBy/paginate/search/searchBySpecific` back to the Vue page.
- **Global helpers** in `app/helpers.php` (autoloaded): `getSetting($key)` (cached `Cache::flexible('global:settings', [60,120])`), `numberToCurrency`, `currencyToNumber`, `transactionUrl($order)`, `transactionUpdateUrl($order)` (both produce signed URLs using named routes `transaction.show` / `transaction.update`). Use `getSetting()` rather than querying `Setting`.
- Scheduled job `App\Jobs\ExpirePayments` runs hourly (`routes/console.php`). Integration configs: `config/{digiflazz,midtrans,game,gamepro,voda}.php`; env keys in `.env.example` / `.env.docker`.

## Frontend conventions

- Inertia pages live in `resources/js/pages`; names are lowercase/kebab and mirror the backend path (`resources/js/pages/cms/management/menu/Index.vue` → `inertia('cms/management/menu/Index')`).
- **Wayfinder-generated TS route helpers** live in `resources/js/actions` and `resources/js/routes` (both gitignored) and are emitted by the Vite plugin during `npm run dev`/`build` — never hand-edit them. Import from `@/actions/App/Http/Controllers/...` and `@/routes/...`. Re-run Vite after route changes.
- Alias `@/*` → `resources/js/*`. UI is shadcn-style on `reka-ui` under `resources/js/components/ui`; style with Tailwind v4 + `cn`/`cva`/`clsx`. Prettier enforces 80 cols, 4-space tabs, and sorts imports + Tailwind classes.
- Inertia v2 + `@inertiaui/modal-vue` (modal/slideover config in `resources/js/app.ts`), plus `@tanstack/vue-query`. SSR is enabled in `config/inertia.php`; `composer run dev:ssr` runs the SSR server.

## Tests

- Pest 4. `tests/Feature` auto-applies `RefreshDatabase` (`tests/Pest.php`); `tests/Unit` does not — DB-touching Unit tests opt in via `uses(TestCase::class, RefreshDatabase::class)` (see `tests/Unit/Actions/...`). `tests/Pest.php` also defines a `makeTestOrder()` helper. The suite runs on SQLite `:memory:` with array/sync drivers (`phpunit.xml`) — no MySQL/Redis required.
- The test workflow is disabled (`.github/workflows/tests.yml.disable`); only lint CI is active.

## Skills & Boost

- Activate the matching domain skill before starting: `wayfinder-development`, `pest-testing`, `inertia-vue-development`, `tailwindcss-development`, `fortify-development`, `laravel-best-practices`, `medialibrary-development`, `debug-using-debugbar` (in `.agents/skills`, mirrored to `.cursor`/`.claude`/`.github`).
- Boost MCP is wired in `.mcp.json` (runs via WSL). Prefer `search-docs` before code changes and `database-query`/`database-schema` over raw SQL. The full generated rules also live in `.cursor/rules/laravel-boost.mdc`.

<laravel-boost-guidelines>
=== foundation rules ===

# Laravel Boost Guidelines

The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.

## Foundational Context

This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.

- php - 8.4
- inertiajs/inertia-laravel (INERTIA_LARAVEL) - v2
- laravel/fortify (FORTIFY) - v1
- laravel/framework (LARAVEL) - v12
- laravel/prompts (PROMPTS) - v0
- laravel/sanctum (SANCTUM) - v4
- laravel/wayfinder (WAYFINDER) - v0
- laravel/boost (BOOST) - v2
- laravel/mcp (MCP) - v0
- laravel/pail (PAIL) - v1
- laravel/pint (PINT) - v1
- laravel/sail (SAIL) - v1
- pestphp/pest (PEST) - v4
- phpunit/phpunit (PHPUNIT) - v12
- @inertiajs/vue3 (INERTIA_VUE) - v2
- tailwindcss (TAILWINDCSS) - v4
- vue (VUE) - v3
- @laravel/vite-plugin-wayfinder (WAYFINDER_VITE) - v0
- eslint (ESLINT) - v9
- prettier (PRETTIER) - v3

## Skills Activation

This project has domain-specific skills available in `**/skills/**`. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.

## Conventions

- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
- Check for existing components to reuse before writing a new one.

## Verification Scripts

- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.

## Application Structure & Architecture

- Stick to existing directory structure; don't create new base folders without approval.
- Do not change the application's dependencies without approval.

## Frontend Bundling

- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.

## Documentation Files

- You must only create documentation files if explicitly requested by the user.

## Replies

- Be concise in your explanations - focus on what's important rather than explaining obvious details.

=== boost rules ===

# Laravel Boost

## Tools

- Laravel Boost is an MCP server with tools designed specifically for this application. Prefer Boost tools over manual alternatives like shell commands or file reads.
- Use `database-query` to run read-only queries against the database instead of writing raw SQL in tinker.
- Use `database-schema` to inspect table structure before writing migrations or models.
- Use `get-absolute-url` to resolve the correct scheme, domain, and port for project URLs. Always use this before sharing a URL with the user.
- Use `browser-logs` to read browser logs, errors, and exceptions. Only recent logs are useful, ignore old entries.

## Searching Documentation (IMPORTANT)

- Always use `search-docs` before making code changes. Do not skip this step. It returns version-specific docs based on installed packages automatically.
- Pass a `packages` array to scope results when you know which packages are relevant.
- Use multiple broad, topic-based queries: `['rate limiting', 'routing rate limiting', 'routing']`. Expect the most relevant results first.
- Do not add package names to queries because package info is already shared. Use `test resource table`, not `filament 4 test resource table`.

### Search Syntax

1. Use words for auto-stemmed AND logic: `rate limit` matches both "rate" AND "limit".
2. Use `"quoted phrases"` for exact position matching: `"infinite scroll"` requires adjacent words in order.
3. Combine words and phrases for mixed queries: `middleware "rate limit"`.
4. Use multiple queries for OR logic: `queries=["authentication", "middleware"]`.

## Artisan

- Run Artisan commands directly via the command line (e.g., `php artisan route:list`). Use `php artisan list` to discover available commands and `php artisan [command] --help` to check parameters.
- Inspect routes with `php artisan route:list`. Filter with: `--method=GET`, `--name=users`, `--path=api`, `--except-vendor`, `--only-vendor`.
- Read configuration values using dot notation: `php artisan config:show app.name`, `php artisan config:show database.default`. Or read config files directly from the `config/` directory.

## Tinker

- Execute PHP in app context for debugging and testing code. Do not create models without user approval, prefer tests with factories instead. Prefer existing Artisan commands over custom tinker code.
- Always use single quotes to prevent shell expansion: `php artisan tinker --execute 'Your::code();'`
  - Double quotes for PHP strings inside: `php artisan tinker --execute 'User::where("active", true)->count();'`

=== php rules ===

# PHP

- Always use curly braces for control structures, even for single-line bodies.
- Use PHP 8 constructor property promotion: `public function __construct(public GitHub $github) { }`. Do not leave empty zero-parameter `__construct()` methods unless the constructor is private.
- Use explicit return type declarations and type hints for all method parameters: `function isAccessible(User $user, ?string $path = null): bool`
- Follow existing application Enum naming conventions.
- Prefer PHPDoc blocks over inline comments. Only add inline comments for exceptionally complex logic.
- Use array shape type definitions in PHPDoc blocks.

=== deployments rules ===

# Deployment

- Laravel can be deployed using [Laravel Cloud](https://cloud.laravel.com/), which is the fastest way to deploy and scale production Laravel applications.

=== tests rules ===

# Test Enforcement

- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter.

=== inertia-laravel/core rules ===

# Inertia

- Inertia creates fully client-side rendered SPAs without modern SPA complexity, leveraging existing server-side patterns.
- Components live in `resources/js/pages` (unless specified in `vite.config.js`). Use `Inertia::render()` for server-side routing instead of Blade views.
- ALWAYS use `search-docs` tool for version-specific Inertia documentation and updated code examples.
- IMPORTANT: Activate `inertia-vue-development` when working with Inertia Vue client-side patterns.

# Inertia v2

- Use all Inertia features from v1 and v2. Check the documentation before making changes to ensure the correct approach.
- New features: deferred props, infinite scroll, merging props, polling, prefetching, once props, flash data.
- When using deferred props, add an empty state with a pulsing or animated skeleton.

=== laravel/core rules ===

# Do Things the Laravel Way

- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using `php artisan list` and check their parameters with `php artisan [command] --help`.
- If you're creating a generic PHP class, use `php artisan make:class`.
- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.

### Model Creation

- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `php artisan make:model --help` to check the available options.

## APIs & Eloquent Resources

- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.

## URL Generation

- When generating links to other pages, prefer named routes and the `route()` function.

## Testing

- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.

## Vite Error

- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.

=== laravel/v12 rules ===

# Laravel 12

- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
- Since Laravel 11, Laravel has a new streamlined file structure which this project uses.

## Laravel 12 Structure

- In Laravel 12, middleware are no longer registered in `app/Http/Kernel.php`.
- Middleware are configured declaratively in `bootstrap/app.php` using `Application::configure()->withMiddleware()`.
- `bootstrap/app.php` is the file to register middleware, exceptions, and routing files.
- `bootstrap/providers.php` contains application specific service providers.
- The `app/Console/Kernel.php` file no longer exists; use `bootstrap/app.php` or `routes/console.php` for console configuration.
- Console commands in `app/Console/Commands/` are automatically available and do not require manual registration.

## Database

- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.

### Models

- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.

=== wayfinder/core rules ===

# Laravel Wayfinder

Use Wayfinder to generate TypeScript functions for Laravel routes. Import from `@/actions/` (controllers) or `@/routes/` (named routes).

=== pint/core rules ===

# Laravel Pint Code Formatter

- If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.

=== pest/core rules ===

## Pest

- This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`.
- The `{name}` argument should not include the test suite directory. Use `php artisan make:test --pest SomeFeatureTest` instead of `php artisan make:test --pest Feature/SomeFeatureTest`.
- Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`.
- Do NOT delete tests without approval.

=== inertia-vue/core rules ===

# Inertia + Vue

Vue components must have a single root element.
- IMPORTANT: Activate `inertia-vue-development` when working with Inertia Vue client-side patterns.

=== spatie/laravel-medialibrary rules ===

## Media Library

- `spatie/laravel-medialibrary` associates files with Eloquent models, with support for collections, conversions, and responsive images.
- Always activate the `medialibrary-development` skill when working with media uploads, conversions, collections, responsive images, or any code that uses the `HasMedia` interface or `InteractsWithMedia` trait.

</laravel-boost-guidelines>