feat: deliver merchant-facing multi-product Midtrans CLI

.superpowers/sdd/2026-07-26-midtrans-cli-multi-product-parity/task-1-report.md

@@ -0,0 +1,63 @@
+## Task 1 Report
+
+### Scope delivered
+
+- Replaced the old Snap-only experimental manifest with the clean public hybrid schema in Go and JSON schema form.
+- Reset `midtrans init` output to a neutral sandbox-only manifest with empty `credential_sets`, `integrations`, `routing`, and `verification.required`.
+- Updated `midtrans setup`, readiness/status paths, Snap pack evaluation, and local verification helpers to read the new manifest shape directly without migration compatibility.
+- Converted direct fixtures and tests to the clean manifest constructors and updated merchant fixture manifests to the new public shape.
+
+### TDD evidence
+
+1. Added `TestLoadHybridManifest` and `TestCleanManifest` in `internal/manifest/manifest_test.go`.
+2. Verified RED with:
+
+   ```sh
+   go test ./internal/manifest ./internal/app -run 'TestLoadHybridManifest|TestCleanManifest' -count=1
+   ```
+
+   Initial failure: the old `manifest.Manifest` lacked `Routing`, `Integrations`, and `IntegrationFor`.
+3. Implemented the clean schema and dependent refactors.
+4. Verified GREEN with the same focused command.
+
+### Verification
+
+```sh
+go test ./internal/manifest ./internal/app -count=1
+go test ./internal/readiness ./packs/snap -count=1
+go test ./... -count=1
+```
+
+All commands passed on July 27, 2026.
+
+### Notes
+
+- No migration shim was retained for the removed Snap-only manifest shape.
+- Remote webhook allowlists were not reintroduced into the clean public manifest; replay remains constrained by the existing policy layer until a later task defines that product-pack surface explicitly.
+
+## Fix Round 1
+
+### Review items addressed
+
+- Tightened `file:./...` credential-reference validation to reject traversal-like and malformed project-relative paths such as `file:./../outside-secret`, absolute paths, and empty path segments, without implementing Task 2 runtime file resolution.
+- Required supported non-empty credential-set types and sandbox environment values, and enforced type-appropriate required references for `classic` and `bisnap` consistently in Go validation and JSON schema.
+- Required `application.payment_state.paid` and `application.payment_state.terminal` to contain at least one unique non-empty state in both Go validation and JSON schema.
+
+### Added or adjusted tests
+
+- Expanded `TestCleanManifest` with malformed `file:` reference cases.
+- Added `TestValidateRejectsInvalidCredentialSetDefinitions`.
+- Added `TestValidateRejectsEmptyPaymentStateArrays`.
+- Added `TestManifestSchemaRequiresCredentialSetTypeAndPaymentStates`.
+
+### Commands run
+
+```sh
+go test ./internal/manifest ./internal/app -count=1
+go test ./... -count=1
+```
+
+### Results
+
+- `go test ./internal/manifest ./internal/app -count=1` passed on July 27, 2026.
+- `go test ./... -count=1` passed on July 27, 2026.

.superpowers/sdd/2026-07-26-midtrans-cli-multi-product-parity/task-10-report.md

@@ -0,0 +1,133 @@
+# Task 10 Report
+
+Date: 2026-07-27
+
+## Outcome
+
+Implemented the new `gopay-tokenization` pack and registered it in the CLI.
+The pack now covers:
+
+- `gopay-tokenization.account-linking`
+- `gopay-tokenization.binding-inquiry`
+- `gopay-tokenization.wallet-payment`
+- `gopay-tokenization.paylater`
+- `gopay-tokenization.unlink`
+
+## What Changed
+
+- Added `packs/gopaytokenization/pack.go` with descriptor, capabilities, journeys, sandbox hosts, sensitive keys, and public-source declarations.
+- Added `packs/gopaytokenization/client.go` with BI-SNAP-backed signing/access-token infrastructure and request builders for:
+  - GET auth code on `merchants-app.sbx.midtrans.com`
+  - POST `/v1.0/registration-account-binding`
+  - POST `/v1.0/registration-account-inquiry`
+  - POST `/v1.0/registration-account-unbinding`
+  - POST `/v1.0/debit/payment-host-to-host`
+- Added `packs/gopaytokenization/journey.go` with:
+  - account-link planning and resume gating via state hash plus auth-code reference
+  - binding inquiry
+  - tokenized wallet and GoPayLater payment flows
+  - active payment-option selection in memory only
+  - inquiry immediately before payment with rotated customer token use
+  - unlink flow with merchant-state-clearing evidence requirement
+- Added `packs/gopaytokenization/seamless.go` for `/v1.0/registration-account/notify` route metadata and signature verification wiring.
+- Registered the pack in [cmd/midtrans/main.go](/Users/salis/Goto/Code/midtrans/codex/midtrans-cli-merchant-experience/cmd/midtrans/main.go).
+- Updated [contracts/capabilities-v1.json](/Users/salis/Goto/Code/midtrans/codex/midtrans-cli-merchant-experience/contracts/capabilities-v1.json), [contracts/public-sources-v1.json](/Users/salis/Goto/Code/midtrans/codex/midtrans-cli-merchant-experience/contracts/public-sources-v1.json), and [internal/sourceprovenance/catalog.go](/Users/salis/Goto/Code/midtrans/codex/midtrans-cli-merchant-experience/internal/sourceprovenance/catalog.go).
+- Updated [internal/app/app_test.go](/Users/salis/Goto/Code/midtrans/codex/midtrans-cli-merchant-experience/internal/app/app_test.go) so the runtime capability contract tests include the new pack.
+
+## Validation
+
+RED checkpoint:
+
+```sh
+go test ./packs/gopaytokenization -count=1
+```
+
+Initial result: failed because the package had only tests and no production Go files.
+
+Focused validation:
+
+```sh
+go test ./packs/gopaytokenization ./packs/bisnap ./internal/app -count=1
+go test ./internal/sourceprovenance ./internal/app ./packs/gopaytokenization -count=1
+```
+
+Result: passed.
+
+## Fix Round 2
+
+Addressed the remaining critical Get Auth Code and source-provenance corrections:
+
+- Added mandatory `state` query binding equal to the generated state hash.
+- Switched `seamlessData` from compact JSON to deterministic URL-form encoding:
+  - `mobileNumber=<resolved number>&paymentType=gopay`
+- Switched `seamlessSign` from client-secret HMAC to Base64 `SHA256withRSA` over the exact raw `seamlessData` string using the configured merchant private key.
+- Added GoPay signature helper coverage with a fixed vector for PKCS#8 private-key signing.
+- Added typed `journey.Input.MobileNumberReference` and CLI `--mobile-number-reference` on merchant and agent journey surfaces.
+- Required `mobile_number_reference` for GoPay account-link planning and execution.
+- Ensured the mobile number reference and resolved mobile number never enter SafeData, operation storage, or evidence.
+- Corrected GoPay source URLs to the exact working official slugs:
+  - `get-auth-code-api`
+  - `binding-api`
+  - `binding-inquiry-api`
+  - `direct-debit-api-gopay-tokenization`
+  - `unbind-api`
+  - `account-linking-unlinking-notification`
+- Regenerated the public-source baseline so the GoPay entries now carry non-empty valid SHA-256 digests.
+
+Fix-round validation:
+
+```sh
+go test ./packs/gopaytokenization ./internal/app ./internal/manifest ./internal/sourceprovenance -count=1
+go test ./... -count=1
+```
+
+Result: passed.
+
+Full validation:
+
+```sh
+go test ./... -count=1
+```
+
+Result: passed.
+
+## Behavioral Guarantees Now Covered
+
+- Auth-code flow uses the merchant-app sandbox host.
+- Binding, inquiry, unbinding, and tokenized payment hit the required BI-SNAP paths.
+- Tokenized payment sends `Authorization-Customer`; one-time access-token exchange does not.
+- Inquiry runs immediately before payment.
+- Rotated active option/customer token data is used in-memory for payment only.
+- GoPayLater requires an active `PAY_LATER` option.
+- Account-link persistence stores only safe state references.
+- Auth code, customer authorization token, payment-option token, and authorization references are not persisted or rendered in safe data.
+
+## Commit
+
+Planned commit message: `feat: add GoPay tokenization journeys`
+
+## Fix Round 1
+
+Addressed the official-contract corrections from reviewer follow-up:
+
+- Corrected Get Auth Code to `GET https://merchants-app.sbx.midtrans.com/v1.0/get-auth-code`.
+- Switched binding, inquiry, unbind, and payment to `https://merchants.sbx.midtrans.com`.
+- Added a distinct manifest credential reference `merchant_id` for GoPay tokenization credential sets.
+- Bound account-link state through deterministic compact `seamlessData` JSON plus `seamlessSign`.
+- Corrected binding body to include `merchantId`, `authCode`, and `grantType: AUTHORIZATION_CODE`.
+- Corrected binding response parsing to `accessTokenInfo.accessToken`.
+- Corrected inquiry response parsing to `additionalInfo.accessToken` and `additionalInfo.paymentOptions[] {name, active, token}`.
+- Corrected tokenized payment body to include `chargeToken`, `urlParams`, and `payOptionDetails[]` with nested `additionalInfo.paymentOptionToken`.
+- Removed credential references from GoPay SafeData and persisted operation records.
+- Required exact `auth_code_reference_hash` plus `state_hash` proof binding for account-link resume.
+- Added unlink fallback inquiry handling for ambiguous unbind attempts.
+- Replaced GoPay public-source URLs with the reviewer-specified official page set.
+
+Fix-round validation:
+
+```sh
+go test ./packs/gopaytokenization ./packs/bisnap ./internal/app ./internal/manifest ./internal/sourceprovenance -count=1
+go test ./... -count=1
+```
+
+Result: passed.