22 — Progress #

Living log progres build. Update setiap akhir sprint atau milestone signifikan.

📊 Snapshot per 2026-05-01 — Architecture Hardening Sesi Lengkap #

Build status:

• ✅ M0 Documentation
• ✅ M1 Repo init + Laravel 11 scaffold
• ✅ M2 Database schema (60+ tables)
• ✅ M3 Auth + RBAC (11 roles, Spatie Permission) + 2FA TOTP
• ✅ M4 Front Office (Reservation/Folio/NightAudit double-entry)
• ✅ M5 Booking Engine (public)
• ✅ M6 Channel Manager (real Booking.com XML/SOAP, Agoda JSON REST, Traveloka v2 HMAC)
• ✅ M7 POS (outlet/menu/order/settle)
• ✅ M8 Housekeeping (status board + tasks)
• ✅ M9 Accounting (COA, journal poster, AR/AP, period lock, exports)
• ✅ M10 Indonesia Compliance (PB1, NSFP, WNA, CoretaxService real DJP API)
• ✅ M11 pSEO (15+ patterns, dynamic sitemap, edge cache)
• ✅ M12 License pairing v3 (JWT RS256, fingerprint, heartbeat) + server scripts
• ✅ M13 BYOK + 11 AI presets
• ✅ M16 SaaS conversion (manual tenancy: middleware + DB manager + 4 commands)
• ✅ M17 Phase 2 modules (Banquet/Spa/HR/RMS/Loyalty/Asset/Comm/AI)
• ✅ M18 Open Pricing + Dynamic Pricing + Channel Parity + Guest 360
• ✅ Architecture hardening (24 events, 29 listeners, 35 FormRequests, 60 Resources, 14 exceptions, 8 support classes)
• ⏸ M14 Pilot deploy (ready, awaiting customer)
• ⏸ M15 Public launch

Sprint Status #

Current sprint: Sprint 1 — Architecture Hardening & Completion Sprint dates: 2026-05-01 Status: ✅ COMPLETE — Semua gap kritis tertutup Status: ✅ Documentation phase COMPLETE — 27/27 file selesai

Documentation Build Status (S0) #

✅ Completed (27 files) #

⏳ Remaining #

Tidak ada — dokumentasi initial set selesai. Selanjutnya: build phase (M1).

Build Milestones (post-docs) #

Decision Log #

Open Questions #

1. Hosting partnership — Niagahoster, Biznet, atau Cloudways untuk managed-host option?
2. Apakah Phase 1 sudah include WhatsApp Business API integration atau Phase 2?
3. KTP OCR — pakai Tesseract local, atau BYOK Google Document AI / OpenAI Vision?
4. Coretax certification — apakah perlu jadi Application Service Provider (ASP) resmi DJP?
5. White-label add-on — domain handling untuk reseller dengan multi-client?

Changelog 2026-04-29 #

Session: Complete Panel UI Theme Overhaul (100%) #

• All 97 panel Blade views now use the unified design system:
  • Cards: rounded-2xl shadow-card border border-gray-100
  • Inputs: rounded-xl border border-gray-200 bg-gray-50 … focus:border-primary-400
  • Status badges: text-xs font-medium bg-{color}-50 text-{color}-700 px-2.5 py-0.5 rounded-full
  • Tables: bg-gray-50/80 border-b headers + divide-y divide-gray-50 rows + hover:bg-gray-50/60
  • Empty states: centered SVG icon in colored container
• Print-ready views: BEO (banquet) + payslip (HR) + Invoice (folio) with print:hidden nav + clean inline-CSS invoice
• Phase 2 placeholders: channel mapping/rates/restrictions + occupancy/cashier-shift — upgraded to beautiful Phase 2 cards with link back
• Alpine.js interactive views: journal create (live balance), cancellation policies (rule builder)
• Guest 360 Profile: score bars (loyalty/upsell/churn), spend patterns, behavioral profile, LTV stats
• Open Pricing Calendar: filter grid + bulk override with JS grid renderer
• Dynamic Pricing Rules: trigger/operator/action/lookahead form + active badge
• Channel Parity Monitor: 3 KPI cards + severity-colored table rows + Resolve button
• Cashier Shift Show: variance color (red/amber/emerald), payment method badges, JSON breakdown pre block
• Folio Invoice: standalone print page redesigned with gradient header + inline CSS

Session: Relational DB Audit + NightAuditServiceTest #

• Relational audit lengkap — baca semua 124 model, tambah relasi yang missing:
  • ArInvoiceLine → invoice() belongsTo(ArInvoice)
  • Webhook → property() belongsTo(Property)
  • AuditLog → property() + user() belongsTo
  • NightAudit → runByUser() belongsTo(User)
  • LostAndFound → foundByUser() + claimedByGuest() belongsTo
  • ChannelConflict → property() + resolvedByUser() belongsTo
  • RoomType → reservationRooms(), channelRoomMappings(), allotments(), groupBlockRooms(), waitlistEntries() hasMany
  • RatePlan → reservationRooms(), channelRoomMappings(), allotments() hasMany
  • SpaTreatment/SpaTherapist/SpaCabin → appointments() hasMany
  • Plan → subscriptions() hasMany(TenantSubscription)
  • SeoRedirect → property() belongsTo
  • ApprovalRequest → property() belongsTo
• NightAuditServiceTest — 6 tests, 16 assertions: completed record, room charge to folio, balanced journal (4 lines), idempotency, no_show logic, occupancy KPI
• NightAuditService bugfix — firstOrCreate → whereDate() + manual create agar SQLite date comparison tidak salah format (Y-m-d H:i:s vs Y-m-d)
• Pest 84/84 (206 assertions, 0 skip)

🎯 What's Next (prioritas) #

🔴 Critical-path untuk go-live pilot (M14) #

1. RSA-2048 keypair generate — public key bundled in config/license/vendor-public.pem masih placeholder. Butuh:

   • Generate keypair di vendor server: openssl genrsa -out vendor-private.pem 2048 && openssl rsa -in vendor-private.pem -pubout -out vendor-public.pem
   • Replace placeholder file
   • Set LICENSE_PUBLIC_KEY_HASH env dengan SHA256 hash bundled key untuk integrity check
   • Build & sign first license token via vendor admin

2. Vendor License Server deploy — sisi vendor butuh server terpisah yang:

   • Issue license via admin panel (sudah ada controller stub)
   • Sign JWT pakai private key
   • Receive heartbeats (sudah ada endpoint /api/license/heartbeat-receive)
   • Maintain revocation list

3. OTA partner real testing — adapter sudah ada skeleton XML/JSON. Butuh:

   • Apply Booking.com partner program
   • Apply Agoda YCS access
   • Apply Traveloka TPI partnership
   • Test sandbox endpoint dengan real credentials
   • Verify ARI push + booking pull bidirectional

4. Coretax DJP integration — kalau target hotel PKP:

   • Apply DJP Application Service Provider (ASP) status (atau pakai 3rd-party ASP)
   • Implement CoretaxClient::pushFaktur() real (saat ini stub)
   • Test e-Faktur generation end-to-end

5. 2FA TOTP enrollment UI — backend ada, frontend QR enrollment + recovery codes display belum

🟡 Penting untuk SaaS launch (M16) #

6. stancl/tenancy v3 install + aktif — composer require stancl/tenancy

   • Setup tenancy.php config
   • InitializeTenancyByDomain middleware aktif di route group
   • Real tenant DB provisioning (saat ini hanya metadata)
   • tenants:migrate command tenant-aware
   • Test full tenant signup → provision → migrate → ready < 30s

7. SSL automation untuk custom domain — Cloudflare for SaaS atau Let's Encrypt ACME automation

   • DNS challenge flow
   • Auto-issue SSL cert ke domains yang verified
   • Renewal cron

8. Real billing integration — sekarang masih invoice draft only

   • Connect Midtrans/Xendit untuk recurring billing
   • Webhook handler untuk payment success/failed
   • Auto-suspend on past_due grace expired

🟡 Polish & Quality #

9. Pest coverage tambahan — sekarang 24 tests, target 60+:

   • Channel sync (push availability, fetch bookings)
   • License pairing flow end-to-end
   • Approval workflow
   • Group block + waitlist
   • Tenant lifecycle service
   • Banquet/Spa/HR services
   • Webhook signature verification
   • Idempotency key replay

10. E2E tests dengan Dusk/Playwright — booking flow public, admin login, panel navigation

11. Lighthouse CI di pipeline — target booking engine ≥90 mobile

12. Load test — k6/Artillery scenario: 50 staff + 200 concurrent guest booking

13. Visual regression — Percy/BackstopJS untuk UI changes

🟡 Hardening #

14. Sentry / error tracking integration — BYOK key di env, install package, configure

15. Backup automation real — bukan hanya docs:

    • Cron pg_dump push ke S3 dengan retention
    • WAL streaming untuk PITR
    • Restore drill quarterly

16. Penetration test external — sebelum public launch

17. Monitoring stack — Prometheus + Grafana atau DataDog

18. Status page — Statuspage.io / Cachet untuk uptime

🟢 Phase 2 deepening #

19. Banquet wedding package builder — bundle room block + venue + F&B + decoration

20. Spa membership — recurring billing untuk anggota gym/spa

21. HR full — leave management, schedule planner, performance review yearly

22. Restaurant table reservation (terpisah dari POS walk-in) — calendar booking

23. Group rooming list Excel importer — bulk add saat group event

24. Mobile native apps — iOS/Android untuk staff (HK, FO) + guest (in-stay companion)

25. Voice command — front desk hands-free check status

🟢 Phase 3 strategic #

26. Marketplace add-ons platform — third-party developer ecosystem

27. Embedded fintech — working capital loan, factoring (partner OJK-licensed)

28. B2C marketplace hotelhub.id aggregator (cross-tenant directory)

29. MCP server untuk AI agent booking on behalf of guest

30. Multi-region deployment Asia + Europe DC

31. Group/chain management — cross-property booking, brand standards enforcement

Blockers #

Tidak ada saat ini.

Changelog #

• 2026-04-28 (pagi) — Started initial documentation set. Completed 13/27 files (LICENSE + README + 11 docs). Paused mid-batch karena user restart server.

• 2026-04-28 (siang) — Resume + completed sisa 14 docs. M0 closed.

• 2026-04-28 (sore) — M1-M13 scaffold built. Laravel 11.51, 189 PHP source files, 23 migrations (60+ tables), license pairing v3 with JWT RS256, BYOK adapter system (Ai/Payment/SMS/WA/Mail/Storage/Captcha), Front Office full flow (Reservation, Folio, Night Audit double-entry journal), POS (outlet/menu/order/settle), Housekeeping (room status + tasks), Channel Manager (3 OTA stubs + ARI sync log), Accounting (COA seeded, journal poster, AR/AP, period lock), Indonesia Compliance (PB1 region resolver, NSFP, WNA, Coretax stub), pSEO (15+ URL patterns + dynamic sitemap), public REST API v1, webhook dispatcher with HMAC, admin panel, user panel, 3-step setup wizard, Docker + nginx + supervisor configs, deploy.sh. Migrations + seeders verified clean on SQLite. License diagnostic 5/6 ✓ (vendor server unreachable expected in dev).

• 2026-04-28 (malam) — Phase 1 closure + Phase 2 modules complete. Now: 242 PHP files, 30 migrations, 84 blade views, 10 test files (9/10 passing). Added: 30+ panel views (FO/HK/POS/Channel/Accounting/Settings/Guests/Portal), audit log + observer + webhook dispatcher hooks, NotificationDispatcher (email+WA), PDF invoice via dompdf, Searchable trait + global search, group block service + waitlist, approval workflow with thresholds, captcha middleware, KTP OCR via BYOK AI, promo code service, loyalty (tier+points+redeem), real Booking.com XML adapter, Agoda + Traveloka JSON REST adapters, accounting export (CSV/Jurnal/Accurate format), Pest test suite (Pb1/PPN/Promo/License pass). Phase 2 modules: Banquet (function rooms, events, BEO), Spa (treatment/therapist/cabin/appointment), HR & Payroll (employee, attendance, payslip with PPh21+BPJS calc, service charge distribution), RMS Lite (DemandForecaster + YieldReporter), Asset & Maintenance (asset register, work order, PPM scheduler), Communication center (threads, messages, templates, campaigns), AI features (Translation, ReviewReplyGen, Concierge, Sentiment, DemandForecastAi).

• 2026-04-28 (larut) — DB audit + Phase 2 deploy. Now: 273 PHP files, 34 migrations, 120 blade views, 360 routes, Pest 9/10 pass. Audit DB: Patched FK orphans di folio_payments (provider_id string→FK, shift_id constrained ke cashier_shifts). Added 35+ inverse relations di Property/Guest/User/Folio/Room/Reservation/Company/Channel/Provider/Asset. New tables (8): gift_vouchers + voucher_redemptions, bank_accounts + bank_statements + bank_statement_lines, budget_periods + budget_lines, owner_statements, fx_rates, door_lock_events, rate_shopper_snapshots, gds_bookings, stock_items + stock_movements. New panel UI deployed: Banquet (events list/create/show, BEO sheet, function rooms, calendar), Spa (appointments scheduler, treatments, therapists), HR (employees, attendance, payroll, payslip slip-gaji), RMS (dashboard, forecast, yield, rate shopper), Asset (register, work orders, PPM), Communication (inbox, thread reply, templates, marketing campaigns), Loyalty (members, tiers, vouchers), Finance (bank accounts, bank recon, budget, owner statements, fx rates), Inventory (stock items + movements). Phase 2 API endpoints: 8 controllers — Banquet, Spa, HR, Loyalty, Asset, Comm (with public inbound webhook), Finance, AI (translate/concierge/review-reply/demand-forecast).

• 2026-04-28 (akhir hari) — Polish + 14 modul tambahan. Now: 310 PHP files, 39 migrations, 139 views, 394 routes, Pest 9/10 ✓. Operational: Cashier shift (open/close/reconcile/variance), Audit log viewer, Property switcher dropdown topbar, Idempotency middleware (header Idempotency-Key). SaaS-ready: Public tenant signup flow /signup dengan plan picker, Telemetry heartbeat receiver /api/license/heartbeat-receive, deployment_heartbeats table. Reservation enrichment: OTA Virtual Card (VCC) tracking encrypted, reusable cancellation_policies (rule-based penalty calc), guest_requests tracker dengan SLA (response/resolution minutes), out_of_order_periods dengan auto inventory deduction, allotments per TA/Company. Operations: DailyFlashService aggregator (KPI rooms/revenue/tax/payment/source-mix), pos_recipes BOM untuk COGS tracking. Marketing/Quality: Survey builder + NPS calculator (promoters/detractors), referral_codes + redemptions, document_templates editor (folio/invoice/BEO/contract/registration card per locale), kb_articles (internal+public). Sustainability: points_of_interest local guide CMS, carbon_footprints per stay (CO₂e calc 0.85 kg/kWh grid factor), sustainability_metrics tracker (energy/water/waste/recycled/renewable). i18n: lang/id.json + en.json, lang/id/{auth,validation,passwords}.php, property_translations override per-tenant. DB integrity: All Property/Guest/User/Folio/Room/Reservation/Channel/Landmark/PosMenuItem/StockItem/WorkOrder/TravelAgent/Company models punya inverse relations untuk semua 11 tabel baru ini.

• 2026-04-29 (siang) — Test suite expansion + RSA keypair + sitemap fix. Now: 322 PHP, 41 migrations, 141 views, 397 routes, Pest 78/78 pass (0 skips). Test suite 24→78: 11 new test files — BanquetEventService (4), SpaService (3), PayrollService (4), TenantLifecycle (6), MrrCalculator (4), ApprovalWorkflow (6), WebhookSignature (4), ChannelSync (4), DemandForecaster (5), PseoSitemap (2), JournalPoster (5), GroupBlockService (4), WaitlistService (3). 190 assertions. RSA keypair: Real 2048-bit key generated → storage/app/vendor-public.pem (private key gitignored). Sitemap fix: sitemap.xml moved outside license middleware, pseo.cache alias registered in bootstrap/app.php. Bug fixed: pseo.cache middleware alias was missing — all pSEO cached routes were unresolvable.

• 2026-04-29 (sore) — P0/P1/P2 Feature Gap Implementation — Pest tetap 84/84 ✅ (206 assertions). Semua fitur strategis yang missing diimplementasikan penuh:

  Infrastruktur DB (5 migrasi baru):

  • 2026_04_29_200000 — Fix folio_charges.source_type_id (morphTo column type fix: foreignId() → unsignedBigInteger nullable)
  • 2026_04_29_200100 — Open Pricing tables: rate_overrides (per-date channel-specific price overrides, 7-field availability restrictions), dynamic_pricing_rules (threshold-based auto pricing), dynamic_pricing_log (full audit trail)
  • 2026_04_29_200200 — notification_logs table: idempotent multi-channel delivery audit trail dengan unique idempotency_key
  • 2026_04_29_200300 — channel_parity_alerts: OTA rate breach detection dengan severity (low/medium/high/critical)
  • 2026_04_29_200400 — guest_profiles: Guest 360 behavioral profile — LTV, ADR, F&B/Spa spend, preferred room/day, lead time, visit frequency, upsell/loyalty/churn scores (0-100)

  Models baru (6):

  • RateOverride — belongs to property, roomType, ratePlan, channel, createdByUser
  • DynamicPricingRule — belongs to property, roomType, channel; hasMany logs
  • DynamicPricingLog — belongs to property, rule, roomType, channel
  • NotificationLog — belongs to property; morphTo notifiable (polymorphic)
  • ChannelParityAlert — belongs to property, roomType, channel, resolvedByUser; isBreached() + isCritical() helpers
  • GuestProfile — belongs to guest; isHighValue() + isAtRisk() helpers

  Relations tambahan di existing models:

  • Property — rateOverrides(), dynamicPricingRules(), notificationLogs(), parityAlerts()
  • Guest — profile(), promoUsages(), notificationLogs() (morphMany)
  • RoomType — rateOverrides(), dynamicPricingRules(), parityAlerts()
  • Channel — rateOverrides(), parityAlerts(), pricingRules()
  • RatePlan — children() (self-referential), cancellationPolicy() belongsTo
  • CancellationPolicy — ratePlans() hasMany (FK added to rate_plans via migration)

  Queue Jobs (8 baru, semua implement ShouldQueue):

  • SendBookingConfirmationJob — tries=3, idempotency key via NotificationLog
  • SendCheckinReminderJob — tries=3, skip jika status bukan confirmed/tentative
  • SendPostStayFollowupJob — tries=3, delay 1 jam, skip jika sudah ada review
  • RunNightAuditJob — tries=1, timeout=300s, dispatch NightAuditService
  • SyncAriToChannelsJob — tries=3, backoff=120s, full ARI sync per channel
  • BuildGuestProfileJob — tries=2, calls GuestProfileService::rebuild()
  • CheckChannelParityJob — tries=2, calls ParityMonitorService::checkAndAlert()
  • ApplyDynamicPricingJob — tries=1, timeout=180s, calls DynamicPricingService::applyRules()

  Mailables (4 baru):

  • BookingConfirmationMail, CheckinReminderMail, PostStayReviewMail, FolioInvoiceMail
  • Semua punya subject dinamis pakai property.name, view terpisah

  Email Blade templates (4 baru) di resources/views/emails/reservations/:

  • confirmation.blade.php — Navy theme, booking card table, manage link
  • checkin-reminder.blade.php — Green theme, pre-checkin CTA + checklist
  • post-stay.blade.php — Purple theme, star rating visual, single CTA
  • invoice.blade.php — Invoice dengan charge table, paid/balance row

  Services (4 baru):

  • OpenPricingService — effectivePrice() priority chain (channel override → property override → rate_plan → base_rate), bulkUpsert() batch import, availabilityGrid() date range grid
  • DynamicPricingService — closed-loop: DemandForecaster → threshold rules → RateOverride upsert → log every change. Actions: pct/fixed increase/decrease/stop_sell. Respects min_price_floor + max_price_ceiling
  • ParityMonitorService — compares RateShopperSnapshot vs effectivePrice, creates ChannelParityAlert untuk gap < -2%. Severity banding: low(-5%), medium(-10%), high(-20%), critical(>-20%). acknowledge() + resolve() lifecycle methods. Deduplicate: skip jika open alert sudah ada
  • GuestProfileService — rebuild full dari Reservation history: LTV, ADR, F&B/Spa per stay, preferred room type (most booked), preferred check-in day, avg party size, avg lead days, avg stay length, primary source, visit frequency (weekly/monthly/quarterly/annual/one_time), breakfast flag, spa/fnb flags. Scores: upsell(0-100), loyalty(0-100), churn_risk(0-100). Sentiment dari avg review score

  NotificationDispatcher update:

  • Added checkinReminder() method — email + WhatsApp template checkin_reminder

  API Controllers (3 baru):

  • OpenPricingController — effective, grid, bulkUpsert, destroy
  • DynamicPricingController — rules, storeRule, updateRule, destroyRule, applyNow, log
  • ParityController — index, checkNow, acknowledge, resolve
  • GuestController — tambah profile() endpoint

  Routes tambahan (~35 routes baru):

  • GET/POST /v1/pricing/... — Open Pricing endpoints
  • GET/POST/PATCH/DELETE /v1/dynamic-pricing/... — Dynamic Pricing CRUD + apply
  • GET/POST /v1/parity/... — Parity alerts + lifecycle
  • GET /v1/guests/{id}/profile — Guest 360 profile

  Scheduler (4 entri baru di routes/console.php):

  • pricing:apply-dynamic-rules — daily 00:30 withoutOverlapping
  • parity:check — hourly withoutOverlapping
  • guests:rebuild-profiles — daily 03:30 withoutOverlapping
  • notifications:checkin-reminders — daily 09:00 withoutOverlapping

  Bug fixes:

  • folio_charges.source_type_id migration — wrap dropForeign in outer try/catch (inner Blueprint callback try/catch tidak catch SQL execution errors)

• 2026-04-29 (sore lanjutan) — Commands, Panel UI, Model fixes — Pest tetap 84/84 ✅

  5 Artisan commands baru:

  • pricing:apply-dynamic-rules — iterates all active properties, calls DynamicPricingService
  • parity:check — hourly OTA rate comparison, calls ParityMonitorService
  • guests:rebuild-profiles — bulk queue BuildGuestProfileJob for all guests with reservations
  • notifications:checkin-reminders — daily D-1 reminder, dispatches SendCheckinReminderJob per reservation
  • telemetry:push — push anonymized usage stats (active properties, reservations MTD) to vendor server

  ReservationService job dispatch:

  • create() → dispatches SendBookingConfirmationJob::afterCommit()
  • checkOut() → dispatches BuildGuestProfileJob + SendPostStayFollowupJob (1h delay)

  Model fixes:

  • KbArticle — added Searchable trait + toSearchableArray() + searchableAs() → kb_articles_index
  • Company — added Searchable trait + toSearchableArray() + searchableAs() → companies_index
  • LoyaltyTransaction — added source() morphTo for source_type/source_id polymorphic pair
  • GuestProfile — added preferredRoomType() belongsTo(RoomType), isHighValue(), isAtRisk(), upsellTier() helpers
  • DynamicPricingController — fixed validation mismatch: thresholds array → threshold_low/threshold_high decimals to match migration columns

  Panel UI — 4 new sections:

  • PricingController (Panel) — Open Pricing calendar + Dynamic Pricing rules + Channel Parity in one controller
  • GuestProfileController (Panel) — Guest 360 view + rebuild trigger
  • Views: panel/pricing/calendar.blade.php (interactive JS grid, bulk override form), panel/pricing/rules.blade.php (rule CRUD + Apply Now), panel/pricing/parity.blade.php (alert list + severity badges + resolve), panel/guests/profile.blade.php (score cards + behavioral profile + spend patterns)
  • Routes: panel.pricing.* (9 routes) + panel.guests.profile + panel.guests.profile.rebuild
  • Navigation: "Pricing" link added to desktop nav + mobile menu; "Parity" in mobile menu
  • guests/show.blade.php — added "✦ Guest 360 Profile" button linking to new profile page

• 2026-04-28 (extra polish) — Tamper-evidence + tenant lifecycle + tests + CI/CD. Now: 321 PHP, 41 migrations, 140 views, 394 routes, Pest 24/25 pass (1 intentional skip). Hash chain audit: kolom previous_hash + entry_hash di audit_logs, AuditLogger compute SHA256 chain, audit:verify-chain + audit:checkpoint daily cron, audit_log_checkpoints table untuk archival ke S3. Demo + default seeders: DemoDataSeeder (Hotel Mandala 30 rooms, 3 room types, 90-day rates, 2 sample guests), PlansSeeder (4 SaaS tiers), DefaultPoliciesSeeder (Flexible/Moderate/NRR), DocumentTemplatesSeeder (5 default templates ID), KbArticlesSeeder (10 baseline articles), MessageTemplatesSeeder (5 channel templates), LoyaltyTiersSeeder (Silver/Gold/Platinum). Tenant lifecycle: TenantProvisioner + ProvisionTenantJob, TenantLifecycleService dengan trial countdown D-7/D-3/D-0 → past_due → 7d grace → suspend → 90d → churn, MrrCalculator (active count, MRR/ARR, churn pct). New tables: tenant_subscriptions, tenant_invoices, audit_log_checkpoints + 7 fields baru di tenants (lifecycle_events, suspended_at, churned_at, dll). Pest coverage: ReservationFlow (3 tests), FolioService (3), AuditChain (2), CashierShift (3), CarbonCalculator, CancellationPolicy, LoyaltyService — 24/25 ✓. CI/CD: .github/workflows/{ci,deploy-staging,deploy-prod,release}.yml. Mobile responsive: layout dengan hamburger menu md:hidden, sticky header, overflow-x-auto wrapper, min-touch 44px, tailwind base media queries. pSEO edge cache: pseo.cache middleware dengan Cache-Control public + s-maxage=86400 + ETag conditional. Reservation tape chart: Livewire/Alpine view dengan sticky header, room rows × date columns, weekend highlight. Tested fresh migrate clean, all relationships intact.

• 2026-05-01 — Architecture Hardening: Events, Listeners, FormRequests, Resources, Packages:

  Composer packages installed (6 baru):

  • phpoffice/phpspreadsheet (^5.7) — Excel export
  • barryvdh/laravel-dompdf (^3.1) — PDF generation via Blade
  • intervention/image-laravel (^4.0) — Image processing
  • sentry/sentry-laravel (^4.25) — Error tracking
  • pragmarx/google2fa-laravel (^3.0) — 2FA TOTP backend
  • simplesoftwareio/simple-qrcode (^4.2) — QR code for 2FA enrollment

  stancl/tenancy tidak support Laravel 11 — v3 hanya support L6/7, v4 belum release. Manual multi-tenancy implementation instead.

  Event-Driven Architecture — 24 Events + 29 Listeners:

  • app/Events/ (24 classes): Reservation (6), Folio (3), NightAudit (2), Housekeeping (3), Channel (2), Guest (2), Accounting (2), Payment (2), Tenant (2)
  • app/Listeners/ (29 classes): Semua implement ShouldQueue + InteractsWithQueue. Dispatch existing jobs + audit logging via NotificationDispatcher
  • app/Providers/EventServiceProvider.php — full $listen array + shouldDiscoverEvents() enabled
  • Registered di bootstrap/app.php

  FormRequest Validators — 35 classes across 11 subdirectories:

  • app/Http/Requests/Reservation/ (6), Folio/ (5), Guest/ (2), Property/ (1), Housekeeping/ (3), Pos/ (3), Accounting/ (2), Channel/ (2), Integration/ (2), Auth/ (3), User/ (2), Tax/ (1), Setup/ (3)

  API Resource Transformers — 60 classes:

  • app/Http/Resources/: Property, RoomType, Room, RatePlan, Rate, Reservation, ReservationRoom, ReservationAddon, Guest, Folio, FolioCharge, FolioPayment, PosOrder, PosOrderItem, PosMenuItem, PosOutlet, HousekeepingTask, HousekeepingRoomStatus, JournalEntry, JournalLine, GlAccount, ArInvoice, ArInvoiceLine, Channel, ChannelSyncLog, ChannelConflict, User, Provider, Webhook, NightAudit, PromoCode, Review, Survey, SurveyResponse, LoyaltyMember, LoyaltyTier, Employee, Payslip, SpaAppointment, SpaTreatment, BanquetEvent, FunctionRoom, Asset, WorkOrder, StockItem, StockMovement, KbArticle, DynamicPricingRule, ChannelParityAlert, GuestProfile, Approval, CashierShift, MessageThread, Message, DocumentTemplate, CancellationPolicy, GiftVoucher, NotificationLog, SeoPage, Availability

  Custom Exceptions — 14 classes:

  • app/Exceptions/: HotelException (base), Handler (override), 12 domain exceptions (ReservationConflict, InventoryExhausted, RateNotFound, FolioAlreadySettled, NightAuditAlreadyRun, LicenseInvalid, LicenseExpired, PaymentFailed, ChannelSync, CoreTax, TenantProvision, DoubleBooking)

  Value Objects & Enums — 8 classes:

  • app/Support/: Money (final readonly, smallest-unit int, currency-safe), DateRange (nights/overlaps), PhoneNumber (E164/masked), IdNumber (KTP/NPWP/PASSPORT validation), Gender, ReservationStatus, PaymentMethod, RoomStatus (string-backed enums with label() helpers)

  Coretax DJP Integration — Real Implementation:

  • config/coretax.php — base_url, certificate path, NPWP config
  • app/Services/Indonesia/CoretaxService.php — pushFaktur, cancelFaktur, checkNpwp, getNsfp, XML signing via PKCS12
  • app/Http/Controllers/Api/V1/CoreTaxController.php — 4 API endpoints
  • database/migrations/2026_05_01_000000_create_efaktur_records_table.php
  • app/Models/EFakturRecord.php updated with full columns + helpers
  • Routes: POST /v1/coretax/faktur, GET /v1/coretax/faktur/{nomor}, POST /v1/coretax/faktur/{nomor}/cancel, GET /v1/coretax/nsfp/{year}

  Channel OTA Adapters — Full Rewrite:

  • BookingComAdapter — OTA XML/SOAP (OTA_HotelAvailNotifRQ, OTA_HotelRateAmountNotifRQ, OTA_HotelResNotifRQ), XML envelope with RPH signing
  • AgodaAdapter — JSON REST YCS v1, Bearer token auth, paginated fetch
  • TravelokaAdapter — JSON REST v2, HMAC-SHA256 signature, cancel booking support
  • All: consistent response array, AriSyncLog audit, 429 Retry-After handling, Guzzle with configurable timeout

  2FA TOTP — Complete Implementation:

  • database/migrations/2026_05_01_000000_add_two_factor_to_users.php — 4 new columns
  • app/Models/User.php — enable/disable 2FA, generate secret, verify code, recovery codes
  • app/Http/Controllers/Auth/TwoFactorChallengeController.php — challenge, verify, setup, enable, disable
  • app/Http/Controllers/Auth/AuthenticatedSessionController.php — login flow with 2FA awareness
  • 3 Blade views: challenge (Alpine.js toggle), setup (QR + manual key), recovery codes (grid + download TXT + print)
  • 7 new routes in auth.php

  SaaS Multi-Tenant — Manual Implementation:

  • app/Http/Middleware/InitializeTenancy.php — domain/subdomain/X-Tenant-ID/session resolution, auto-switch DB connection
  • app/Services/Tenancy/TenantDatabaseManager.php — provision (CREATE DATABASE + migrate + seed), destroy (DROP DATABASE), backup, migrate, seed
  • 4 artisan commands: tenant:provision, tenant:migrate, tenant:seed, tenant:destroy
  • config/database.php — tenant connection entry (runtime-configured)
  • bootstrap/app.php — tenancy middleware alias + auto-prepend when APP_MODE=saas
  • app/Models/Tenant.php updated: getDatabaseName(), isActive() allows trial+active
  • Migration: rename db_name → database_name VARCHAR(64) UNIQUE

  License Server — Full Setup Package:

  • scripts/license-server/: setup.sh, setup.ps1, Dockerfile, docker-compose.yml, nginx.conf, supervisord.conf, entrypoint.sh, .env.example
  • scripts/deploy/: deploy.sh, nginx-vps.conf
  • scripts/backup/: backup-db.sh, backup-files.sh (daily/weekly/monthly retention to S3)
  • scripts/monitor/: health-check.sh (UptimeRobot compatible JSON), alerts-config.yml
  • 3 artisan commands: license:generate-keypair, license:issue, license:revoke

  Route/View Audit & Fix:

  • 26 missing admin views created: licenses (3), tenants (4), billing (4), telemetry (3), support (3), admin-users (4), system (4)
  • Full audit result: 76 controllers exist ✓, all methods match ✓, 0 missing views ✓

  Final verification: PHP syntax — zero errors across all 170+ new files