Lombakita

Indonesia-first student opportunities platform (competitions-first MVP). Next.js 16 + TypeScript, PostgreSQL + Drizzle ORM, Auth.js, Meilisearch, Redis + BullMQ, Cloudflare R2, Resend, Sentry.

The nightly badge reports the concurrency race scripts and the contrast auditor self-test, which the unit suite structurally cannot check. It is here because fourteen nightly-failure notifications were delivered in two weeks and thirteen were never opened: a badge is read where a notification is not. Its state is also reported by /close-step, so a red night is seen at the moment a work unit closes.

Project instructions and the durable truth files live in CLAUDE.md and docs/.

Local development

npm install
cp .env.example .env.local   # fill in values
npm run db:migrate:guarded   # apply migrations (always use the guarded script)
npm run dev

Useful scripts: npm run lint, npm run typecheck, npm run test, npm run build, npm run env:check, npm run connectors:status.

Cloudflare R2 (file storage)

R2 backs competition submission uploads (activated at Step 4.6). Files are uploaded directly from the browser to R2 via short-lived presigned PUT URLs; the app stores only file metadata.

Required environment variables (see .env.example):

Variable	Purpose
R2_ENDPOINT	https://<account-id>.r2.cloudflarestorage.com — encodes the Cloudflare account id
R2_BUCKET	Bucket name
R2_ACCESS_KEY_ID	R2 access key id
R2_SECRET_ACCESS_KEY	R2 secret access key
R2_REGION	Optional; defaults to auto

Graceful degradation. The submission upload-URL endpoint (POST /api/v1/competitions/[competitionId]/registrations/[registrationId]/submission/upload-url) checks isR2Available() before signing. When any of the four credentials above is missing it returns HTTP 503 submission_upload_unavailable (never an uncaught 500), so the app remains usable without R2 configured — only the upload step is unavailable. This mirrors the Meilisearch degradation model (isMeilisearchAvailable()).

Security note (MVP boundary): submission file keys are server-generated as submissions/{registrationId}/{uuid} and the metadata-record endpoint validates the key prefix before any DB write. The app does not verify the object actually exists in R2 — key-prefix validation is the MVP security boundary. Presigned download (GET) is deferred to a later step.