@kensaurus/skills 0.0.0-stage → 2.1.0

package/skills/plan-uiux-unification/references/preservation-contract.md

@@ -0,0 +1,24 @@
+# Preservation Contract
+
+Applies to **every phase**. Read before auditing or proposing anything.
+
+## Never do in this pass
+
+- **Remove** features, routes, screens, states, props, or handlers. Redundant-looking code → list as a *proposal for approval*, never delete unilaterally.
+- **Fabricate** data, content, copy, API fields, endpoints, or assets. No lorem ipsum, fake names/numbers/avatars. Missing content → tag `[NEEDS REAL CONTENT]`, leave existing values untouched.
+- **Guess** codebase facts. Ground every claim in a file you read; cite path (and line when useful). Can't verify → say so.
+- **Change I/O or business logic** silently: data contracts, API shapes, state, error handling, auth, side-effects, analytics, i18n keys, feature flags, a11y behavior stay functionally identical unless explicitly proposed + approved.
+- **Break** public APIs, props, or routes without flagging as breaking + migration note.
+- **Rewrite UI** in this pass. Visual/UX changes are **proposals**, not faits accomplis.
+
+## Before any file change proposal
+
+State in one line **what currently works there that must keep working** (forces verification → fewer breakages).
+
+## Three finding buckets
+
+Keep separate in the violation log:
+
+1. **Violates a documented rule** (token lint, STYLEGUIDE, CONTRIBUTING)
+2. **Subjective improvement** (better hierarchy, clearer copy — preserve meaning)
+3. **Needs design-system enhancement** (missing semantic token, no elevation scale)

package/skills/protocol-browser-anti-stall/SKILL.md

@@ -0,0 +1,211 @@
+---
+name: protocol-browser-anti-stall
+description: >
+  Guardrail for Playwright CLI sessions: headed, named, isolated; prevents
+  parallel collisions and recovers stalls without scripted shortcuts. Read
+  before browser work or when automation freezes.
+license: MIT
+user-invocable: false
+---
+
+# Browser Anti-Stall Protocol (playwright-cli)
+
+**Degree of freedom: LOW.** Almost every step is exact. Only "why it
+stalled" and the next hypothesis are `[HIGH freedom]`.
+
+This repo drives browsers with **`playwright-cli`**, not the Playwright MCP. The MCP exposes one
+browser per server and a persistent profile can only be locked by one process at a time, so
+parallel agents on the same repo fight over tabs and profile locks. The CLI gives every agent its
+own isolated browser via `-s=<session>`, costs far fewer tokens (no tool schemas or verbose trees
+loaded into context), and runs natively in parallel shells.
+
+**Read `references/mcp-to-cli-map.md`** if you encounter old `browser_*` MCP tool calls — it maps
+every tool to its CLI command. **Read `references/playwright-session-coordination.md`** before your
+first command — session naming, persistent logins (incl. the Google/CDP block), and cleanup.
+
+## How to reason
+
+1. **Observe** — snapshot, screenshot, console, requests, and the session name
+2. **Interpret** — stale ref, SPA hydration, pending request, or a real blocker
+3. **Classify** — one new-hypothesis retry / 2s sleep-cycle / BLOCKER report
+4. **Recover** — one real user action, then look; never `eval` to click
+
+## Worked example
+
+> **Observe:** checkout `click`; URL still `/cart`; console hydration warning; `POST /api/checkout` pending; session `-s=qa-checkout`.
+> **Interpret:** SPA not ready + possibly a stale ref — not "the button is missing".
+> **Classify:** attempt 2 — `find`/`waitFor` a landmark, fresh `snapshot`, then click. Not `run-code` to submit.
+> **Stop at 4:** still stuck → BLOCKER with console + requests + screenshot.
+
+## Self-critique before reporting
+
+- **Headed + `-s=`** — every call; never a shared session name
+- **Inspection-only eval** — `eval` / `run-code` never click, type, or submit
+- **Evidence before retry** — max 4 attempts, then BLOCKER
+- **Right owner** — product QA behavior stays with the calling test/audit skill
+
+---
+
+## Invocation — always this form  [LOW freedom — run exactly]
+
+```bash
+PW="npx --yes @playwright/cli@latest"     # portable; survives fnm/nvm version switches
+$PW -s=<session> <command> [args]
+```
+
+- **`-s=<session>` is mandatory on every call.** Name it after your task or branch
+  (`-s=qa-checkout`, `-s=audit-ux-home`). Two agents must never share a session name.
+- **Do not rely on a global `npm i -g` install.** Under `fnm`/`nvm` the global prefix is
+  per-shell and disappears; `npx` always resolves.
+- `--json` / `--raw` are available when you need machine-readable output.
+
+## 0. Manual & headed — never scripted (read first)  [LOW freedom — run exactly]
+
+You are driving a **real, visible browser** to feel what a user feels. A green script proves
+nothing about UX — *see the screen* and *watch the logs*.
+
+1. **Headed, always.** The CLI defaults to **headless** — you MUST pass `--headed` on `open`.
+   If you cannot see the window, say so rather than proceeding blind.
+2. **One real action at a time.** `click`, `type`, `fill`, `select`, `hover`, `press`, `drag`
+   exactly as a user would. Never chain a whole flow into one code snippet.
+3. **`eval` / `run-code` are inspection-only.** Use them ONLY to *read* state (DOM, computed
+   styles, storage, perf) or to wait for an element — never to click, type, navigate, or submit.
+   Driving the UI through code bypasses real events and hides the bug you are hunting.
+4. **No test files, no runner.** Do not write `*.spec.ts`, run `npx playwright test`, or use
+   codegen. You are here to *experience* the flow, not automate past it.
+5. **Look after every action.** Fresh `snapshot` + `screenshot` + `console` + `requests`, plus the
+   dev-server terminal. Real pain surfaces on screen and in logs, not in an assertion.
+
+## 1. Session lifecycle  [LOW freedom — run exactly]
+
+```bash
+$PW -s=qa-checkout open --headed http://localhost:3000    # start (once)
+$PW -s=qa-checkout goto http://localhost:3000/cart        # navigate within the session
+$PW -s=qa-checkout snapshot                               # get refs
+$PW -s=qa-checkout close                                  # end YOUR session when done
+$PW list                                                  # see all sessions (status, profile, headed)
+$PW close-all                                             # only when you own every session
+$PW kill-all                                              # last resort: stale/zombie processes
+```
+
+- `open` starts a browser; `goto` navigates an already-open one. Calling `open` twice on the same
+  session is wasteful — use `goto`.
+- **Close only your own session.** Never `close-all` while another agent may be mid-test.
+- Add `--browser chrome|firefox|webkit|msedge`, `--device "iphone 15"`, or `--mobile` on `open`
+  when the task calls for it.
+
+## 2. Navigation guard  [LOW freedom — run exactly]
+
+After every `open` / `goto` / `reload`:
+
+1. `snapshot` — confirm the URL changed and the page has content.
+2. If blank or unchanged → `sleep 2` → `snapshot` again.
+3. **Max 3 cycles (~6s).** Still not loaded → report a blocker (§8) and move on.
+
+Never assume navigation succeeded without a snapshot to confirm it.
+
+## 3. Waiting — there is no `wait` command  [LOW freedom — run exactly]
+
+Playwright **auto-waits** for actionability on `click`/`fill`/`select`, so most explicit waits are
+unnecessary. When you genuinely must wait:
+
+| Need | Do this |
+|---|---|
+| Fixed short pause | `sleep 2` in the shell — **never more than 3s per pause** |
+| Wait for text/element | `run-code "async (page) => { await page.getByText('Dashboard').first().waitFor({ timeout: 5000 }); return 'ready'; }"` |
+| Wait for something to disappear | `...waitFor({ state: 'hidden', timeout: 5000 })` |
+| Poll for content | `find "<text>"` → if no match, `sleep 2` → retry (max 3) |
+
+**Always set an explicit `timeout`** (milliseconds) in `waitFor` — the default 30s is far too long.
+Use the incremental pattern instead of one long block:
+
+```
+sleep 2 → snapshot → check ↓ not ready
+sleep 2 → snapshot → check ↓ not ready
+sleep 2 → snapshot → check ↓ still not ready
+STOP → report blocker with evidence
+```
+
+This handles cold starts, SPA hydration, and slow APIs without ever blocking blindly.
+
+## 4. SPA-specific rules  [LOW freedom — run exactly]
+
+SPAs (React, Next.js, Vue) fire `load` before hydration completes — never trust load events.
+
+- Wait for a **specific UI landmark** that proves the app rendered (`run-code` + `waitFor`, or `find`).
+- If a spinner is showing, wait for it to reach `state: 'hidden'` rather than sleeping.
+
+## 5. Anti-loop: max 4 attempts per goal  [LOW freedom — run exactly]
+
+| Attempt | Action |
+|---|---|
+| 1 | Try the action normally |
+| 2 | Alternative approach — re-`snapshot` for a fresh ref, try a CSS selector instead, scroll into view, or `find` the element |
+| 3 | Gather evidence: `console` + `requests` |
+| 4 | **STOP.** Report what blocked progress, with evidence. |
+
+Never repeat the exact same failing action without new evidence.
+
+**Fresh refs after every state change.** Refs from a stale `snapshot` are invalid after any
+navigate/click/fill/hover/key press. Re-`snapshot` before the next interaction. `click` also accepts
+a unique CSS selector, which survives state changes better than a ref.
+
+## 6. Evidence before retry  [LOW freedom — run exactly]
+
+When something is not working, gather evidence FIRST, then form a hypothesis:
+
+1. `console` — JS errors, warnings (`console error` to filter by level)
+2. `requests` — pending/failed calls; `request <n>` / `response-body <n>` for detail
+3. `snapshot` — the actual DOM state, not what you assume
+4. `screenshot --filename .playwright-mcp/<name>.png` — visual state
+
+Only retry once you have a new hypothesis grounded in that evidence.
+
+## 7. Timeout budget  [LOW freedom — run exactly]
+
+| Scope | Max time |
+|---|---|
+| Single interaction (click, fill, select) | 15 seconds |
+| Navigation + verification | 30 seconds |
+| Multi-page flow | 5 minutes |
+| Full session | 15 minutes |
+
+Exceeded? **Skip it** and log `[TIMEOUT] skipped: <step>`. One stuck step must not kill the session.
+
+## 8. Blocker reporting format  [LOW freedom — this shape]
+
+```
+BLOCKER:
+- Session: [-s= name]
+- Page: [current URL]
+- Goal: [what I was trying to do]
+- Blocked by: [what prevented it]
+- Evidence: [console errors / failed requests / screenshot observation]
+- Suggestion: [most likely next step or manual action needed]
+```
+
+Actionable information beats a silent freeze.
+
+## 9. Artifacts  [LOW freedom — run exactly]
+
+- Screenshots, snapshots, and logs go under **`.playwright-mcp/`** (gitignored):
+  `screenshot --filename .playwright-mcp/home-390.png`. Name by route + viewport/step.
+- The CLI also auto-writes snapshot `.yml` files to `.playwright-cli/` in the working directory —
+  also gitignored, never committed.
+- Sweep any stray root-level `*.png` / `*.log` into `.playwright-mcp/` before ending the session.
+
+## 10. Parallel agents  [LOW freedom — run exactly]
+
+Each agent gets its own browser through session isolation:
+
+```bash
+# agent A                                  # agent B (simultaneously, no conflict)
+$PW -s=audit-ux open --headed …            $PW -s=qa-checkout open --headed …
+```
+
+- Never reuse another agent's session name; never `close`/`kill-all` sessions you did not open.
+- `list` shows every session with its status, profile, and headed flag — check it before assuming.
+- Within one session, multiple tabs are still available (`tab-list`, `tab-new`, `tab-select`,
+  `tab-close`); the fresh-refs rule applies after every tab switch.
+- Signed-in state is shared through **persistent profiles**, not shared tabs — see
+  `references/playwright-session-coordination.md`.

package/skills/protocol-browser-anti-stall/references/mcp-to-cli-map.md

@@ -0,0 +1,113 @@
+# Playwright MCP → playwright-cli command map
+
+This repo migrated off the Playwright **MCP** (one browser per server, single profile lock, heavy
+tool schemas in context) to the **CLI** (`npx --yes @playwright/cli@latest`), which gives every
+agent its own isolated browser via `-s=<session>`.
+
+Every command below assumes:
+
+```bash
+PW="npx --yes @playwright/cli@latest"
+$PW -s=<session> <command> [args]
+```
+
+Verified against `@playwright/cli@0.1.17`.
+
+---
+
+## Core actions
+
+| Old MCP tool | CLI command | Notes |
+|---|---|---|
+| `browser_navigate({ url })` | `open --headed <url>` (first) / `goto <url>` (after) | CLI is **headless by default** — pass `--headed` on `open` |
+| `browser_navigate_back` | `go-back` | also `go-forward`, `reload` |
+| `browser_snapshot` | `snapshot [target]` | returns refs; auto-saves a `.yml` under `.playwright-cli/` |
+| `browser_find` | `find "<text>"` | `--regex` for patterns; returns matching nodes with refs |
+| `browser_click({ ref })` | `click <target> [button]` | `<target>` = ref **or a unique CSS selector**; `--modifiers` supported |
+| `browser_type({ text })` | `type <text>` | types into the focused editable element |
+| `browser_fill_form` | `fill <target> <text>` | one field at a time (matches "one real action" rule) |
+| `browser_select_option` | `select <target> <value>` | |
+| `browser_hover` | `hover <target>` | |
+| `browser_press_key` | `press <key>` | e.g. `press enter`, `press arrowleft`; also `keydown`/`keyup` |
+| `browser_drag` | `drag <startTarget> <endTarget>` | |
+| `browser_drop` | `drop <target>` | |
+| `browser_file_upload` | `upload <file>` | |
+| `browser_handle_dialog` | `dialog-accept [prompt]` / `dialog-dismiss` | |
+| `browser_resize` | `resize <w> <h>` | or `open --device "iphone 15"` / `--mobile` |
+| `browser_close` | `close` | closes **your** session only |
+| *(no equivalent)* | `check` / `uncheck` | checkbox and radio helpers |
+| *(no equivalent)* | `dblclick` | |
+
+## Waiting
+
+| Old MCP tool | CLI replacement |
+|---|---|
+| `browser_wait_for({ time: 2 })` | `sleep 2` in the shell (**≤3s per pause**) |
+| `browser_wait_for({ text, timeout })` | `run-code "async (page) => { await page.getByText('<text>').first().waitFor({ timeout: 5000 }); return 'ready'; }"` |
+| `browser_wait_for({ textGone, timeout })` | same, with `waitFor({ state: 'hidden', timeout: 5000 })` |
+
+There is **no `wait` command**. Playwright auto-waits for actionability on `click`/`fill`/`select`,
+so most explicit waits are unnecessary. Always set an explicit `timeout` when you do wait.
+
+## Evidence & inspection
+
+| Old MCP tool | CLI command | Notes |
+|---|---|---|
+| `browser_console_messages` | `console [min-level]` | e.g. `console error` |
+| `browser_network_requests` | `requests` | numbered list |
+| `browser_network_request` | `request <index>` | plus `request-headers`, `request-body`, `response-headers`, `response-body` |
+| `browser_take_screenshot({ filename })` | `screenshot --filename .playwright-mcp/<name>.png` | `--full-page`, `--hires` available |
+| `browser_evaluate` | `eval <func> [target]` | **read-only** per the protocol |
+| `browser_run_code_unsafe` | `run-code "<code>"` | **read-only / waits only** per the protocol |
+| *(no equivalent)* | `pdf` | save page as PDF |
+
+## Tabs
+
+| Old MCP tool | CLI command |
+|---|---|
+| `browser_tabs({ action: "list" })` | `tab-list` |
+| `browser_tabs({ action: "new" })` | `tab-new [url]` |
+| `browser_tabs({ action: "select", index })` | `tab-select <index>` |
+| `browser_tabs({ action: "close", index })` | `tab-close [index]` |
+
+## Storage, auth & network control
+
+| Need | CLI command |
+|---|---|
+| Save auth state | `state-save [filename]` |
+| Restore auth state | `state-load <filename>` |
+| Cookies | `cookie-list`, `cookie-get`, `cookie-set`, `cookie-delete`, `cookie-clear` |
+| localStorage | `localstorage-list/get/set/delete/clear` |
+| sessionStorage | `sessionstorage-list/get/set/delete/clear` |
+| Mock a request | `route <pattern>`, `route-list`, `unroute [pattern]` |
+| Offline testing | `network-state-set offline` (or `online`) |
+
+## Session management (the parallelism fix)
+
+| Need | CLI command |
+|---|---|
+| Isolated browser per agent | `-s=<unique-name>` on every call |
+| See all sessions | `list` (`--all` across workspaces) |
+| Close every session | `close-all` — only when you own them all |
+| Kill zombies | `kill-all` |
+| Persistent login profile | `open --persistent --profile <dir>` |
+| Visual dashboard of live sessions | `show` |
+| Attach to an already-running browser | `attach [name]` / `detach` |
+
+## Concepts that no longer apply
+
+| Old concept | Why it's gone |
+|---|---|
+| `browser_lock` / unlock (cursor-ide-browser MCP) | No shared browser to lock — sessions are isolated |
+| Tab-claiming etiquette across agents | Each agent opens its own session instead |
+| `session.json` auth-tab pointer | Auth lives in a persistent **profile directory** |
+| `--isolated` storage-state injection dance | Persistent profiles are the default path for auth |
+| Headed-by-default assumption | CLI is headless by default — pass `--headed` explicitly |
+
+## Gotchas
+
+- **`npm i -g` is unreliable under `fnm`/`nvm`** (per-shell global prefix). Always use `npx --yes @playwright/cli@latest`.
+- **Never log into Google from a Playwright-launched browser** — it is blocked at the CDP layer.
+  See `playwright-session-coordination.md` for the real-Chrome workaround.
+- Snapshot `.yml` artifacts land in `.playwright-cli/`; screenshots should be directed to
+  `.playwright-mcp/` with `--filename`. Both are gitignored.

package/skills/protocol-browser-anti-stall/references/playwright-session-coordination.md

@@ -0,0 +1,170 @@
+# playwright-cli sessions, parallel agents & persisted logins
+
+How to run many agents against browsers at once without collisions, and how to stay signed in
+across turns — including the Google sign-in wall that blocks every Playwright-launched browser.
+
+```bash
+PW="npx --yes @playwright/cli@latest"
+```
+
+---
+
+## 1. One session per agent
+
+`-s=<name>` is the whole parallelism story. Each name gets its own browser process and its own
+storage, so two agents never share tabs, cookies, or a profile lock.
+
+```bash
+# agent A                                     # agent B — simultaneously, zero conflict
+$PW -s=audit-ux-home open --headed …          $PW -s=qa-checkout open --headed …
+```
+
+**Naming:** use the task or branch (`qa-checkout`, `audit-ux-home`, `feat-login-fix`). Never a
+generic name like `test` or `default` — that is how two agents collide.
+
+**Rules**
+
+- Never issue commands against a session name you did not open.
+- Never `close-all` / `kill-all` while another agent may be working — close only your own session.
+- `$PW list` shows every session with status, `user-data-dir`, and headed flag. Check it before
+  assuming a session exists.
+- `$PW show` opens a dashboard to watch/control live sessions — useful when agents run in the
+  background.
+
+**Defaults worth knowing** (verified on `@playwright/cli@0.1.17`):
+
+| Default | Value | Implication |
+|---|---|---|
+| `user-data-dir` | `<in-memory>` | Nothing persists unless you pass `--persistent --profile` |
+| headed | `false` | Pass `--headed` — this repo's protocol requires a visible browser |
+| browser | detected Chrome | Override with `--browser chrome\|firefox\|webkit\|msedge` |
+
+---
+
+## 2. Persistent profiles = persisted logins
+
+Sessions are ephemeral by default. To stay signed in across turns and restarts, give the session a
+profile directory on disk:
+
+```bash
+$PW -s=work open --headed --browser chrome \
+    --persistent --profile "$HOME/.playwright-cli-profiles/<account>" \
+    https://app.example.com
+```
+
+Everything a real browser stores (cookies, localStorage, device trust) survives `close` and
+reopening with the same `--profile`.
+
+**Convention:** one directory per account/environment under
+`~/.playwright-cli-profiles/<account-or-env>`. Keep profiles **outside the repo** so every project
+reuses one login, and so session cookies never land near version control.
+
+**Never point `--profile` at your everyday Chrome profile**
+(`%LOCALAPPDATA%\Google\Chrome\User Data`) — it causes lock conflicts, crashes, and policy errors.
+Always use a dedicated automation directory.
+
+### Storage-state files (lighter alternative)
+
+For simple cookie/localStorage auth, skip profiles and use state files:
+
+```bash
+$PW -s=qa state-save .playwright-mcp/auth/localhost-3000.json   # after logging in
+$PW -s=qa state-load .playwright-mcp/auth/localhost-3000.json   # next run
+```
+
+Good for local/staging app logins. Weaker than a profile against modern anti-bot checks, and it
+does not carry device-trust signals. Treat these files as secrets — `.playwright-mcp/` is gitignored.
+
+---
+
+## 3. Google sign-in: the one case that needs real Chrome
+
+**You cannot log into a Google account from a Playwright-launched browser.** Google detects that
+the browser is driven over the Chrome DevTools Protocol and returns:
+
+> This browser or app may not be secure.
+
+There is no user-agent, header, stealth plugin, or flag that gets past it. Do not waste attempts.
+
+### The working sequence (one time per account)
+
+**Step 1 — log in with real Chrome, no automation, no CDP flags:**
+
+```bash
+"/c/Program Files/Google/Chrome/Application/chrome.exe" \
+  --user-data-dir="C:\Users\<you>\.playwright-cli-profiles\<account>" \
+  --no-first-run --no-default-browser-check \
+  "https://accounts.google.com/"
+```
+
+The **user** signs in by hand, including 2FA. Never ask for or type their password — hand them the
+window. Then close Chrome completely so the profile is unlocked and flushed to disk.
+
+**Step 2 — reuse that profile from playwright-cli forever after:**
+
+```bash
+$PW -s=gmail open --headed --browser chrome \
+    --persistent --profile "$HOME/.playwright-cli-profiles/<account>" \
+    https://mail.google.com
+$PW -s=gmail snapshot        # already signed in
+```
+
+### Rules
+
+- Omit `--remote-debugging-port` during Step 1 — an active CDP endpoint is the thing Google detects.
+- Chrome must be **fully closed** before Step 2; two processes cannot hold one profile.
+- Re-run Step 1 only if the session actually expires (rare — it persists for months).
+- Same pattern works for any provider with aggressive bot detection, not just Google.
+
+---
+
+## 4. Reusing an app login (non-Google)
+
+Goal: sign in once, by hand, and reuse it across `test-playwright`, `test-qa`, `test-red-team`,
+`test-exploratory` (authed session only), and audit skills.
+
+1. **Check first.** Open the session on a **protected route** (`/dashboard`, not `/login`) and
+   `snapshot`. Already signed in? Skip the rest.
+2. **Log in like a user** in the headed window — click, type, submit. Credentials come from
+   `.env.test` / README; never paste secrets into chat.
+3. **Persist it** — with `--persistent --profile` you are already done. Otherwise `state-save` to
+   `.playwright-mcp/auth/<host>.json`.
+4. **Do not log out** at the end of a QA/audit run unless logout is the flow under test.
+
+**Production URLs:** ask before saving auth state to disk; default to localhost/staging.
+
+---
+
+## 5. Cleanup & recovery
+
+```bash
+$PW -s=<mine> close     # end of your turn — always
+$PW list                # what is still running?
+$PW close-all           # only if you own every session
+$PW kill-all            # stale/zombie processes that `close` will not clear
+```
+
+**If a session misbehaves:**
+
+1. `$PW list` — confirm it exists and check `user-data-dir` / headed flag.
+2. `snapshot` — see the real state before assuming.
+3. Still wedged → `close` that one session and reopen it (cheap, since profiles persist).
+4. Zombie processes after a crash → `kill-all`, then reopen.
+
+**If auth is unexpectedly lost:** confirm you passed the same `--profile` path (a typo silently
+creates a fresh in-memory session), then re-run the §4 interactive login (step 2) once.
+
+---
+
+## 6. Dual-identity exploratory sessions (`test-exploratory`)
+
+Guest and authed must never share storage. Use three names, three browsers:
+
+| Session | Storage | Do |
+|:--------|:--------|:---|
+| `-s=explore-guest` | default in-memory — **no** `--profile`, **no** `state-load` | anonymous wander |
+| `-s=explore-authed` | `state-load` or dedicated `--profile` under `~/.playwright-cli-profiles/` | seeded test account |
+| `-s=explore-post-logout` | fresh in-memory | prove logout cleared cookies / `localStorage` / `sessionStorage` |
+
+`storageState` does **not** persist `sessionStorage` — inspect it in the page after logout. Never
+open the guest session with a persistent profile.