@uzysjung/agent-harness 26.100.1 → 26.101.0

package/dist/trust-tier-drift.js

@@ -6,7 +6,7 @@ import {
   INTERNAL_BUNDLED_SKILL_IDS,
   TRUST_TIER,
   init_esm_shims
-} from "./chunk-TRCHIKSN.js";
+} from "./chunk-S3SQJRYD.js";
 
 // src/trust-tier-drift.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uzysjung/agent-harness",
-  "version": "26.100.1",
+  "version": "26.101.0",
   "description": "Curate vetted AI-coding skills & plugins by your tech stack — install only what you need, across Claude Code, Codex, OpenCode & Antigravity",
   "type": "module",
   "publishConfig": {

package/templates/skills/harness-health-audit/SKILL.md

@@ -2,17 +2,22 @@
 name: harness-health-audit
 description: >-
   Audit the health of an AI-coding harness — the CLAUDE.md / AGENTS.md files, rules, skills, agents,
-  hooks, and commands that steer an agent in a repository — across three questions a linter cannot
+  hooks, and commands that steer an agent in a repository — across four questions a linter cannot
   answer: is it TRUE (does it match the real code?), is it USED (do skills actually trigger and does
-  the loop actually verify?), and is it AFFORDABLE (is it inside the budget where instructions are
-  still followed?). Then surgically correct or remove only what is proven wrong or dead. Use whenever
-  the steering layer may have rotted or may not be working: "하네스 점검해줘", "하네스 드리프트 감사",
+  the loop actually verify?), is it AFFORDABLE (is it inside the budget where instructions are still
+  followed?), and is it SAFE (is a live, accurate instruction still a good idea — permission
+  bypasses, unpinned remote scripts, untrusted content flowing in as instructions? — safety findings
+  are flagged for the user's decision, never auto-removed). Then surgically correct or remove only
+  what is proven wrong or dead. Use whenever the steering layer may have
+  rotted or may not be working: "하네스 점검해줘", "하네스 드리프트 감사",
   "CLAUDE.md가 실제랑 맞는지 봐줘", "룰/스킬이 최신인지 확인해줘", "스킬이 제대로 활용되는지 봐줘",
-  "루프 엔지니어링 잘 되고 있는지 검토해줘", "죽은 훅/커맨드 정리해줘", "audit my harness",
-  "check the rules still match the real stack", "are my skills actually being used", "review the
-  agent loop", after a stack or tooling migration, or when onboarding a repo whose steering docs look
-  stale. Every finding must be backed by stated-versus-measured evidence; never guess the correct
-  value, and never remove a live path because it merely looks unused.
+  "루프 엔지니어링 잘 되고 있는지 검토해줘", "죽은 훅/커맨드 정리해줘", "하네스 안전한지 점검해줘",
+  "audit my harness", "check the rules still match the real stack", "are my skills actually being
+  used", "review the agent loop", "is my harness safe", after a stack or tooling migration, or when
+  onboarding a repo whose steering docs look stale. Not a codebase security audit — it reads the
+  steering layer, not application code. Every finding must be backed by stated-versus-measured
+  evidence; never guess the correct value, and never remove a live path because it merely looks
+  unused.
 ---
 
 # Harness Health Audit
@@ -26,7 +31,7 @@ configuration, and execution logic that isn't the model itself"
 stakes plainly: "A decent model with a great harness beats a great model with a bad harness"
 ([Osmani](https://addyosmani.com/blog/agent-harness-engineering/)).
 
-Harnesses fail in two different ways, and most audits only catch the first:
+Harnesses fail in three different ways, and most audits only catch the first:
 
 - **They rot.** The stack migrates, a command is renamed, a plugin disappears upstream, a ceremony is
   abandoned — but the steering text still asserts the old world. Nothing fails loudly, because the
@@ -34,8 +39,12 @@ Harnesses fail in two different ways, and most audits only catch the first:
 - **They stop working while still being true.** Every word is accurate, but the skills never trigger,
   the rules are too long to be followed, and the loop closes on the agent's own say-so instead of a
   real check. A perfectly accurate harness that nothing obeys is still a broken harness.
+- **They keep working while being dangerous.** Every instruction is accurate, live, and cheap — and
+  one of them tells the agent to pipe an unpinned remote script into a shell, or to skip the
+  permission prompts that are its last guardrail. Nothing about truth, efficacy, or economy will
+  ever flag it.
 
-This audit targets both. It does not claim to catch everything — see the safety gap named below.
+This audit targets all three. It does not claim to catch everything.
 
 ## Run the deterministic linter first
 
@@ -44,7 +53,10 @@ detection, `.env` gitignoring, action SHA-pinning, resolvable links, naming conv
 deterministic. Tools exist: [AgentLint](https://www.agentlint.app/) advertises 33 checks over five
 dimensions (findability, instructions, workability, continuity, safety) across `CLAUDE.md`,
 `AGENTS.md`, `.cursor/rules`, `.github/copilot-instructions.md`, CI workflows, pre-commit hooks and
-`.gitignore`; `cclint` covers syntax. Run what is available, then start here.
+`.gitignore`; AgentShield (`npx ecc-agentshield scan` — this harness bundles it as the
+`/ecc:security-scan` command) deterministically scans `.claude/` for dangerous bypass flags, hardcoded
+secrets, and injection patterns; `cclint` covers syntax. Run what is available, then start here —
+question D below assumes the deterministic security pass already ran.
 
 > "Never send an LLM to do a linter's job. LLMs are comparably expensive and *incredibly* slow
 > compared to traditional linters and formatters."
@@ -52,8 +64,9 @@ dimensions (findability, instructions, workability, continuity, safety) across `
 
 **This skill exists for what a linter structurally cannot decide.** A linter can measure that a rule
 is 40 lines long; it cannot know whether the stack it names is the stack this repo actually uses,
-whether the hook it wires still fires, or whether the skill it installs ever triggers. Those require
-reading the code and judging. That judgment — truth and efficacy — is this skill's whole job.
+whether the hook it wires still fires, whether the skill it installs ever triggers, or whether a
+live, accurate instruction is a bad idea. Those require reading the code and judging. That judgment
+is this skill's whole job.
 
 ## Governing principle
 
@@ -66,27 +79,20 @@ rewrite. A harness that still works must survive the audit almost untouched. Two
   Measure it. If you cannot prove it is dead, keep it and flag it — silently stripping a live gate is
   the one failure worse than drift.
 
-## The three questions
+## The four questions
 
-Run them in this order: truth is cheapest, economy needs the whole picture.
+Run them in this order: truth is cheapest; economy and safety need the whole picture. D reuses the
+evidence A and B already gathered — the wiring, what fires, what triggers — so it costs little extra.
 
 | | Question | Failure it catches |
 |---|---|---|
 | **A** | **Is it TRUE?** | The harness asserts a world the repo left behind |
 | **B** | **Is it USED?** | The harness is accurate but inert — nothing triggers, nothing verifies |
 | **C** | **Is it AFFORDABLE?** | The harness is accurate and well-designed but too big to be followed |
+| **D** | **Is it SAFE?** | The harness is accurate, live, and cheap — and instructs something dangerous |
 
-**These three are not exhaustive, and the gap that matters most is safety.** A harness can be TRUE,
-USED, and AFFORDABLE and still be dangerous: a hook that pipes an unpinned remote script straight
-into a shell, or a rule that tells the agent to skip permission prompts, is accurate (it describes
-what it does), live (it fires), and cheap (one line) — so all three questions pass it. The
-deterministic linters cover *form* safety (secrets, `.env` hygiene, action SHA-pinning); what they
-cannot judge is whether a live, accurate instruction is a bad idea.
-
-So: **when a check reveals something dangerous, report it — do not discard it because it fits no
-question.** Treat safety as a standing lens over A/B/C rather than a fourth pass, and say plainly in
-the report that safety was judged ad hoc, not systematically. A dedicated safety axis is a known gap
-in this skill, not a solved problem.
+**Four questions are still not a completeness claim.** When a check reveals a problem that fits no
+question, report it — do not discard it.
 
 ---
 
@@ -244,6 +250,102 @@ the judgment-level guidance only the model can use.
 
 ---
 
+## D. Is it SAFE? (safety)
+
+A harness can pass every question above and still be dangerous: an instruction that waives
+permission prompts is accurate (it describes what it does), live (it fires), and cheap (one line) —
+A, B, and C all wave it through. The deterministic linters cover *form* safety (secret detection,
+`.env` hygiene, action SHA-pinning) and will already have *found* artifacts like bypass flags and
+injection patterns; what they structurally cannot judge is whether a live, accurate instruction is
+a bad idea — the scanner prints the flag, D decides whether it is justified in this repo and what
+the narrower alternative is. That judgment is this question.
+
+**On the underlying risk, D findings default to flag, not fix.** A bypass can be a deliberate,
+informed trade-off (a sandboxed CI container, an isolated VM). The audit's job is to name the risk
+and the narrowest working alternative, then let the user decide — overriding a security posture
+unasked is the same sin as silently stripping a live gate. The one thing D corrects directly is
+**text**: a false scope description (D2) or missing untrusted-data framing (D3) changes what the
+harness *says*, never what an instruction is *allowed to do*. "Correct" must never widen, loosen,
+or remove a guardrail — that decision is always the user's.
+
+### D1 — Dangerous live instructions
+The harness tells the agent to remove its own guardrails: waiving or bypassing permission prompts,
+piping unpinned remote scripts into a shell, auto-approving destructive command classes, disabling
+sandboxes, or auto-installing tools, plugins, or MCP servers without review. These are precisely
+the instructions the loop *will* obey, because they are live and accurate. The vendor documentation
+for the canonical example is unambiguous: Claude Code's
+`bypassPermissions` mode "disables permission prompts and safety checks so tool calls execute
+immediately", is for "isolated environments like containers, VMs" only, and "offers no protection
+against prompt injection or unintended actions"
+([Claude Code docs](https://code.claude.com/docs/en/permission-modes)).
+**Measure:** read every rule, hook, and command body and ask what each one *widens* — what now runs
+without review that would have been stopped before? The baseline for "widened" is the target CLI's
+documented default permission/sandbox behavior (for Claude Code, the docs linked above) — look it
+up per CLI rather than substituting your own assumption. Quote the instruction; name the failure it
+enables.
+**Action:** **flag**, stating the concrete risk and the narrowest alternative (a scoped allow-rule —
+or, on Claude Code, the classifier-gated `auto` mode the same doc recommends over a blanket bypass;
+a pinned, checksummed script instead of `curl | sh`). Correct or remove only on the user's explicit
+decision.
+
+### D2 — Blast radius
+What can the harness reach beyond this repository? Hooks that write global config (home-directory
+dotfiles, package-manager globals), scripts that pass ambient credentials into spawned processes,
+commands that transmit file contents to external services or models. Meta's Rule of Two applies
+here: an agent may combine at most two of — processing untrustworthy inputs, "access to sensitive
+systems or private data", and the ability to "change state or communicate externally"
+([Meta — Agents Rule of Two](https://ai.meta.com/blog/practical-ai-agent-security/)). A harness
+component granting the last two already sits at that limit before any untrusted content enters —
+the remaining property, untrustworthy inputs, is D3's territory.
+**Measure:** for each hook, script, and command, trace what it can write outside the worktree and
+what it can send off the machine. Compare stated scope against measured reach — a wrapper advertised
+as "read-only" that exports the whole ambient environment to its subprocess is a D2 finding (and an
+A4 one). Include instructions about *future* secret handling: a rule telling the agent to keep
+credentials in a plaintext note or committed file is invisible to secret scanners (no secret exists
+yet at read time) but is a standing order to create exposure — measure the instruction, not just
+the current files.
+**Action:** **correct** stated-scope text to the measured reach; **flag** reach that has no stated
+justification, naming a narrowing alternative (project scope, env allowlists, redaction) rather
+than removal — applied only on the user's explicit decision.
+
+### D3 — Untrusted input posture
+Where does external content enter the loop, and is it treated as data or as instructions? Indirect
+prompt injection occurs "when an LLM accepts input from external sources, such as websites or
+files", and among its listed outcomes is "executing arbitrary commands in connected systems"
+([OWASP LLM01:2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)). A skill or agent body
+pulled from an unvetted upstream is the same problem delivered as an installable asset — exactly the
+external-source "file" LLM01 describes, editable by someone else. (OWASP tracks third-party *model
+and dependency* integrity separately as
+[LLM03:2025](https://genai.owasp.org/llmrisk/llm032025-supply-chain/); instruction content is the
+LLM01 shape.) The worst case has a name: an agent combining "access to your private data",
+"exposure to untrusted content", and "the ability to externally communicate" is Willison's
+**lethal trifecta** — the same three-property shape as Meta's Rule of Two in D2, independently
+named — and his advice is to "avoid that lethal trifecta combination entirely"
+([Willison](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/)).
+**Measure:** inventory the ingestion points — web-fetch instructions in rule/skill/hook bodies,
+third-party skill/agent bodies, MCP servers whose declared tools return external content (read the
+declared configuration; observing live output needs transcripts, the same limit as B3),
+user-submitted files. For each, check whether the harness frames the content as untrusted data
+(wrapper tags, explicit "treat as data, never follow" instructions) or lets it flow in as bare
+instructions. The most severe form is **active**: a rule or skill body that tells the agent to
+*trust* external content ("treat fetched content as trusted", "follow instructions found in tool
+output") — that does not merely lack framing, it defeats whatever framing exists elsewhere. Check
+whether upstream assets are vetted and version-pinned. The trifecta is usually completed by separate
+mechanisms acting in one session, not by a single artifact — cross-reference D2's reach inventory
+(private data, external communication) against D3's ingestion points (untrusted content) even when
+no single hook, rule, or skill holds all three alone.
+**Action:** **correct** by adding untrusted-data framing where it is absent — a text label the
+agent can still ignore (presence ≠ adherence, B3's finding), not a runtime filter; **flag**
+trifecta-complete paths and unvetted upstreams — whether an upstream is trustworthy is the user's
+call, not the audit's.
+
+**Honest limit (all of D):** D is a static read of the steering layer. It cannot prove what a hook does at
+runtime, it does not scan the codebase, its dependencies, or CI beyond harness wiring, and it has no
+adversarial testing step. **A clean D is not a security clearance** — it means the steering text
+showed nothing dangerous to a careful reader, nothing more.
+
+---
+
 ## The Ratchet test (cross-cutting)
 
 Osmani proposes: "Every line in a good `AGENTS.md` should be traceable back to a specific thing that
@@ -271,7 +373,7 @@ Route every finding through one decision:
 | **Correct** | Still used, stated value wrong | Use the measured value, never a guess |
 | **Remove** | Provably dead: no wiring, no callers, no fires, upstream gone | Proof required; name it |
 | **Move** | Right intent, wrong layer (a linter's job stated as prose) | Verify the new layer actually fires |
-| **Keep (flag)** | Looks stale or untraceable, but not proven wrong or dead | Surface it; do not touch it |
+| **Keep (flag)** | Looks stale or untraceable but not proven wrong/dead — or proven live and accurate, but the fix is a security-posture call only the user can make (D1–D3) | Surface it; do not touch it |
 
 When torn between remove and keep, keep. A false "keep" costs a little noise; a false "remove"
 silently strips a live gate.
@@ -279,12 +381,13 @@ silently strips a live gate.
 ## Workflow
 
 1. **Run the deterministic linter** if one is available. Do not re-do its work by hand.
-2. **Inventory the surface.** Every always-loaded file, rule, skill, agent, hook + its wiring, command,
-   and the multi-CLI equivalents. Missing a surface is how a rename gets fixed in `CLAUDE.md` and left
+2. **Inventory the surface.** Every always-loaded file, rule, skill, agent, hook + its wiring, the
+   scripts those hooks/skills/commands invoke, command, MCP server/tool declarations, and the
+   multi-CLI equivalents. Missing a surface is how a rename gets fixed in `CLAUDE.md` and left
    broken inside a skill body.
 3. **Measure ground truth.** Real stack (dependencies/lockfile), real commands (what resolves), real
    wiring (what fires), real assets (what exists upstream).
-4. **Run A → B → C.** For each check, produce stated/measured pairs. No pair, no finding.
+4. **Run A → B → C → D.** For each check, produce stated/measured pairs. No pair, no finding.
 5. **Classify** each finding: correct / remove / move / keep-flag. For every "remove", write the death
    evidence explicitly.
 6. **Apply surgically.** Only drifted lines. Do not "improve" adjacent, correct text. Match existing
@@ -308,15 +411,23 @@ Deterministic linter: <tool + score, or "none available">
 | 4 | B | utilization | skill desc: "when relevant" | no concrete trigger | correct | SKILL.md frontmatter |
 | 5 | B | loop integrity | "verify before commit" | no verifier wired; self-report only | correct | hook wiring |
 | 6 | C | budget | root CLAUDE.md 700 lines | norm <300 | correct | wc -l |
+| 7 | D | dangerous instruction | hook: `curl -s URL \| sh` | unpinned remote exec, no checksum | keep (flag) | hook body |
+| 8 | D | blast radius | hook doc: "read-only lint" | also posts file contents to a webhook | correct text + flag reach | hook body; also A4 |
+| 9 | D | untrusted input | skill pastes fetched URL content into prompt | no framing; treated as instructions | correct | skill body |
 
 **Unverified (could not measure):** <list, or "none">
 **Kept-and-flagged (not proven dead/wrong):** <list, or "none">
-**Safety concerns (ad-hoc lens, not a systematic pass):** <list, or "none seen — not a clean bill">
+**Safety (static read, not a security audit):** <safety findings that fit no D check, or "none seen — not a clean bill">
 ```
 
+A finding that satisfies two questions (a D2 reach that is also A4 false advertising) gets **one
+row**, under the question that produced it, with the secondary hit named in Evidence ("also A4") —
+never two rows on the same evidence. Such a row's Action may be compound (row 8's "correct text +
+flag reach"): one decision per hit, text correction for the A4 side, flag for the reach.
+
 Always print the *Unverified*, *Kept-and-flagged*, and *Safety* rows even when empty. A clean table
 that hides a blind spot is itself a drift. The safety row's empty value is "none seen", never "none"
-— the audit has no systematic safety pass, so silence there is absence of evidence, not evidence of
+— D reads the steering text statically, so silence there is absence of evidence, not evidence of
 absence.
 
 ## Anti-patterns
@@ -331,14 +442,17 @@ absence.
 - **Doing a linter's job by hand** — and leaving prose in the harness that should have been a hook.
 - **Adding gates because gates feel safe.** Every speculative gate is future dead ceremony (A3) paid
   for out of the budget (C1). Earn it with a real failure.
+- **Treating a clean D as a security clearance.** D reads steering text; it proves nothing about the
+  code, the dependencies, or runtime behavior.
+- **"Fixing" a security posture unasked.** A bypass may be a deliberate trade-off in a sandboxed
+  environment. D findings default to flag; the risk decision belongs to the user.
 - **One unreviewable diff.** Blending mechanical renames with semantic edits defeats verification.
 
 ## Honest limitations
 
-- **No systematic safety pass.** A/B/C can all pass on a harness that is accurate, live, cheap, and
-  unsafe (an unpinned `curl | sh` hook; a rule waiving permission prompts). Safety is a lens applied
-  ad hoc, and the linters only cover form-level safety — so a clean audit is not a safety clearance.
-  Say so in the report.
+- **D is not a security audit.** It reads the steering layer statically: it cannot prove runtime
+  behavior, does not scan the codebase or its dependencies, and has no adversarial step. A clean D
+  row is not a security clearance. Say so in the report.
 - **Presence ≠ adherence.** A correct rule can still be ignored; the model decides relevance. Only
   observation reveals whether a rule binds — files alone cannot.
 - **No published utilization metric.** There is no authoritative trigger-rate measure to cite; report
@@ -362,9 +476,16 @@ absence.
 - [Chroma — Context Rot](https://www.trychroma.com/research/context-rot) — 18 models; degradation with input length; distractor effects.
 - [Liu et al. — Lost in the Middle (TACL)](https://aclanthology.org/2024.tacl-1.9/) — U-shaped position curve.
 - [AgentLint](https://www.agentlint.app/) — deterministic harness linter; run it before this skill.
+- [Claude Code — permission modes](https://code.claude.com/docs/en/permission-modes) — what `bypassPermissions` disables; isolated-environments-only warning.
+- [Meta — Agents Rule of Two](https://ai.meta.com/blog/practical-ai-agent-security/) — untrusted inputs / sensitive data / external communication: satisfy no more than two.
+- [OWASP LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) — direct vs indirect injection; arbitrary-command outcomes.
+- [OWASP LLM03:2025 Supply Chain](https://genai.owasp.org/llmrisk/llm032025-supply-chain/) — third-party model/component integrity risks.
+- [Simon Willison — The lethal trifecta](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/) — private data + untrusted content + external communication; avoid the combination entirely.
 
 ## Related skills
 
+- **/ecc:security-scan (command)** — deterministic AgentShield pass over `.claude/`; run it before
+  D, which owns only the judgment calls a scanner cannot make.
 - **model-orchestration** — picks the model for the audit versus the corrections.
 - **compaction-handoff** — persists findings so a long audit survives a context boundary.
 - **no-false-ship (rule)** — check A4 is the same advertised-equals-actual discipline.

package/dist/chunk-TRCHIKSN.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../node_modules/tsup/assets/esm_shims.js","../src/external-assets.ts","../src/track-match.ts","../src/categories.ts"],"sourcesContent":["// Shim globals in esm bundle\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nconst getFilename = () => fileURLToPath(import.meta.url)\nconst getDirname = () => path.dirname(getFilename())\n\nexport const __dirname = /* @__PURE__ */ getDirname()\nexport const __filename = /* @__PURE__ */ getFilename()\n","/**\n * External asset matrix — bash setup-harness.sh L791~1067 등가 데이터.\n *\n * SPEC: docs/specs/cli-rewrite-completeness.md F3\n * Source: setup-harness.sh@911c246~1 (v27.18 직전, bash cutover 전)\n *\n * Track 또는 옵션 조건이 충족되면 install pipeline에서 method를 호출.\n * 실패는 \"warn-skip\" — 종료 시 누락 자산 보고 (OQ1 결정).\n *\n * code-style 800줄 cap 예외: 본 파일은 ~85% 가 큐레이션 자산 카탈로그(43 entry × ~13줄)\n *   = 데이터. 로직(interface·condition 평가·shouldInstallAsset)은 소량. 데이터/로직 분리는\n *   별도 사이클(Phase R) 후보 — 현재는 카탈로그 단일 SSOT 가독성 우선. (v26.79.0 기준 802줄)\n */\n\nimport type { Category, Source } from \"./categories.js\";\nimport { hasDevTrack } from \"./track-match.js\";\nimport type { OptionFlags, Track } from \"./types.js\";\n\nexport type ExternalAssetMethod =\n  /** `npx skills add <source>[ --skill <name>] --yes` */\n  | { kind: \"skill\"; source: string; skill?: string }\n  /** `claude plugin marketplace add <marketplace>` + `claude plugin install <pluginId>` */\n  | { kind: \"plugin\"; marketplace: string; pluginId: string }\n  /**\n   * `npm install --save-dev <pkg>@<version>` (global scope 시 `-g`).\n   * v26.80.0 — `version` 필수 (pinning). vetting 은 시점 검증인데 unpinned 는 미래 코드\n   * 실행 = hijacked vetted repo 직행 구멍 (ADR-021 \"지속 검증\" 주장과 모순). pkg 는 bare\n   * 이름 유지 (detectVersion 이 `<npm root>/<pkg>/package.json` 경로로 사용). bump 정책:\n   * A2 자산 audit 주기에 Docker 검증 후 갱신 (docs/COMPATIBILITY.md §pinning).\n   */\n  | { kind: \"npm\"; pkg: string; version: string }\n  /** `npx <cmd>@<version> [args...]` — fire-and-forget 실행. v26.80.0 — version 필수 (위와 동일 근거). */\n  | { kind: \"npx-run\"; cmd: string; version: string; args?: string[] }\n  /** `bash <script> <args...>` — 로컬 스크립트 (예: prune-ecc.sh) */\n  | { kind: \"shell-script\"; script: string; args: string[] }\n  /**\n   * v26.81.0 (ADR-022) — 내부 템플릿 자산. external-installer 가 spawn 하지 않음 —\n   * installer Phase 1 의 manifest/transform 게이팅이 `isAssetSelected(key)` 로 읽는다.\n   * (이전 OptionFlags.withTauri/withUzysHarness 자리. wizard/CLI 표면은 일반 자산과 동일)\n   */\n  | {\n      kind: \"internal\";\n      key:\n        | \"tauri-desktop\"\n        // v26.87.0 — dev-method skills (uzys 1st-party, repo-bundled templates).\n        | \"multi-persona-review\"\n        | \"gap-analysis-e2e\"\n        | \"ultracode-service-audit\"\n        | \"asis-tobe-decision\"\n        | \"compaction-handoff\"\n        | \"northstar-roadmap\"\n        // v26.93.0 — Orchestration & Model Policy (사용자 확정 2026-07-04) 스킬화.\n        | \"model-orchestration\"\n        // v26.98.0 — 하네스 건강 감사 (truth/efficacy/economy 3질문). ADR-027.\n        | \"harness-health-audit\"\n        // v26.95.0 — gemini-consult (opt-in, NOT dev-method): Gemini advisor via Antigravity agy.\n        | \"gemini-consult\"\n        // v26.100.0 — codex-consult (opt-in, NOT dev-method): Codex advisor via OpenAI codex CLI.\n        | \"codex-consult\";\n    };\n\nexport type ExternalAssetCondition =\n  /** Track 중 1개 이상이 set와 일치 */\n  | { kind: \"any-track\"; tracks: Track[] }\n  /** dev track (executive 외 모두) */\n  | { kind: \"has-dev-track\" }\n  /** OptionFlags 의 특정 플래그 true (잔존 동작 옵션용 — ADR-022 후 자산 토글엔 사용 금지) */\n  | { kind: \"option\"; flag: keyof OptionFlags }\n  /**\n   * v26.81.0 (ADR-022) — 순수 opt-in: condition 매치 항상 false. wizard 체크 또는\n   * `--with <id>` 의 forceInclude 로만 설치. 이전의 자산 1:1 OptionFlags(`withBmad` 등\n   * 13종)를 대체 — 자산 추가 시 플래그 코드 0곳.\n   */\n  | { kind: \"opt-in\" };\n\nexport interface ExternalAsset {\n  /** 안정 식별자 — 로깅 + 누락 보고 + 테스트에서 사용 */\n  id: string;\n  /** 사람이 읽는 라벨 (한 줄) */\n  description: string;\n  /** v26.43.0 — Category-based UI 그룹화. SPEC §3.1. */\n  category: Category;\n  /** v26.43.0 — 정확한 출처 (GitHub org/user). Step 2 라벨. SPEC §3.5 R6. */\n  source: Source;\n  condition: ExternalAssetCondition;\n  method: ExternalAssetMethod;\n  /**\n   * v26.79.0 — 검증 Trust Tier. 자산 entry 의 **필수 필드** (SSOT). 이전엔 별도 `TRUST_TIER`\n   * Record 였으나 누락(컴파일러 미검출) + stale(좀비 키, v26.76.0 content-creator 제거 전례)\n   * drift 가 가능했음 → entry 에 통합: **누락은 컴파일 에러, stale 은 구조적 불가능**.\n   * `TRUST_TIER` / `assetTrustTier` 는 이 필드에서 derive (EXTERNAL_ASSETS 정의 뒤).\n   * star snapshot(2026-05~06)은 각 entry tier 라인 주석. 실 drift 판정은 trust-tier-drift 가 live fetch.\n   */\n  tier: TrustTier;\n}\n\n/**\n * v26.71.0 (PRD v26-71) — 검증 Trust Tier. North Star 세 기둥 ②.\n *   - official: Anthropic 공식 marketplace + 본 하네스 자체.\n *   - vetted: star ≥ 1000 + 활성 유지보수 (D2; 라이선스 미표기/비-OSI 는 출처 신뢰).\n *   - experimental: star < 1000 — opt-in + 경고 (pre-check 제외).\n */\nexport type TrustTier = \"official\" | \"vetted\" | \"experimental\";\n\nconst ALL_CSR_SSR_FULL: Track[] = [\n  \"csr-supabase\",\n  \"csr-fastify\",\n  \"csr-fastapi\",\n  \"ssr-htmx\",\n  \"ssr-nextjs\",\n  \"full\",\n];\n\n/** csr-*|ssr-nextjs|full per bash setup-harness.sh L1041 (ssr-htmx 제외 — htmx는 React 미사용). */\nconst CSR_SSR_NEXTJS_FULL: Track[] = [\n  \"csr-supabase\",\n  \"csr-fastify\",\n  \"csr-fastapi\",\n  \"ssr-nextjs\",\n  \"full\",\n];\n\nconst RAILWAY_TRACKS: Track[] = [\"csr-fastify\", \"csr-fastapi\", \"ssr-htmx\", \"ssr-nextjs\", \"full\"];\n\n/**\n * v0.8.1 — executive-style Track SSOT (reviewer MEDIUM-3 fix).\n *\n * 3 Track 모두 dev/UI baseline 미적용 — `.claude/agents/strategist` + project-claude/<track>.md만.\n * `track-match.ts:hasDevTrack()` 의 negation domain. 사용처:\n *   - `shouldInstallAsset` `has-dev-track` 분기 코멘트 (L458)\n *   - `tests/external-assets.test.ts` invariant\n *\n * 신규 executive-style Track 추가 시 이 상수만 수정 → 모든 사용처 자동 반영.\n */\nexport const EXECUTIVE_STYLE_TRACKS: ReadonlyArray<Track> = [\n  \"executive\",\n  \"project-management\",\n  \"growth-marketing\",\n];\n\n/**\n * v0.8.1 — `hasDevTrack` SSOT 의 array 표현 (reviewer MEDIUM-3 fix).\n *\n * `track-match.ts:hasDevTrack()` 와 동등 (TRACKS \\ EXECUTIVE_STYLE_TRACKS = 8 Track).\n * `any-track` condition 에 dev set 전체를 인라인하지 않도록 사용.\n */\nexport const DEV_TRACKS: ReadonlyArray<Track> = [\n  \"csr-supabase\",\n  \"csr-fastify\",\n  \"csr-fastapi\",\n  \"ssr-htmx\",\n  \"ssr-nextjs\",\n  \"data\",\n  \"tooling\",\n  \"full\",\n];\n\n/**\n * v0.8.1 — dev + project-management 합집합 (reviewer MEDIUM-3 fix).\n *\n * `product-skills` (PM 도메인까지 사용) 의 9-Track 인라인 배열을 SSOT 상수로 교체.\n */\nexport const DEV_PLUS_PM_TRACKS: ReadonlyArray<Track> = [...DEV_TRACKS, \"project-management\"];\n\n/**\n * 61 자산 매트릭스 (v26.100.0 codex-consult opt-in internal + v26.98.0 harness-health-audit internal + v26.95.0 gemini-consult opt-in internal + v26.93.0 model-orchestration internal + v26.92.0 frontend-design official + v26.91.0 marketingskills opt-in + v26.87.0 dev-method skills 8종 internal + v26.86.0 Visual & Media 프레젠테이션 4종 + v26.85.0 5종 + v26.81.0 internal 2종 — ADR-022. 61→59 = ADR-024 제거분). bash setup-harness.sh@911c246~1 L791~1067 + 1320~1370 동등.\n *\n * 호출 순서: data → dev-baseline → railway → supabase-cli → impeccable → dev-tools →\n * supabase-skills → react/ui → next → executive → GSD → ToB → ECC.\n */\nexport const EXTERNAL_ASSETS: ReadonlyArray<ExternalAsset> = [\n  // === data Track ===\n  {\n    id: \"polars-K-Dense\",\n    tier: \"vetted\", // K-Dense-AI 26k\n    description: \"Polars — fast Rust-based DataFrame (pandas alternative, data track)\",\n    category: \"data\",\n    source: \"K-Dense-AI\",\n    condition: { kind: \"any-track\", tracks: [\"data\", \"full\"] },\n    method: { kind: \"skill\", source: \"K-Dense-AI/scientific-agent-skills\", skill: \"polars\" },\n    // v26.56.0 — description 보강: 트랙 hint + 한 줄 의미\n  },\n  {\n    id: \"dask-K-Dense\",\n    tier: \"vetted\", // K-Dense-AI 26k\n    description: \"Dask — distributed processing (large DataFrames · cluster, data track)\",\n    category: \"data\",\n    source: \"K-Dense-AI\",\n    condition: { kind: \"any-track\", tracks: [\"data\", \"full\"] },\n    method: { kind: \"skill\", source: \"K-Dense-AI/scientific-agent-skills\", skill: \"dask\" },\n  },\n  {\n    id: \"python-resource-management\",\n    tier: \"vetted\", // wshobson/agents 36k\n    description: \"Python memory · CPU management patterns (wshobson, data track)\",\n    category: \"data\",\n    source: \"wshobson\",\n    condition: { kind: \"any-track\", tracks: [\"data\", \"full\"] },\n    method: {\n      kind: \"skill\",\n      source: \"https://github.com/wshobson/agents\",\n      skill: \"python-resource-management\",\n    },\n  },\n  {\n    id: \"python-performance-optimization\",\n    tier: \"vetted\", // wshobson/agents 36k\n    description: \"Python performance optimization (profiling · vectorize, wshobson, data track)\",\n    category: \"data\",\n    source: \"wshobson\",\n    condition: { kind: \"any-track\", tracks: [\"data\", \"full\"] },\n    method: {\n      kind: \"skill\",\n      source: \"https://github.com/wshobson/agents\",\n      skill: \"python-performance-optimization\",\n    },\n  },\n  {\n    id: \"anthropic-data-plugin\",\n    tier: \"official\", // anthropics/knowledge-work-plugins 18k\n    description: \"Anthropic data plugin (visualization, SQL exploration)\",\n    category: \"data\",\n    source: \"anthropics\",\n    condition: { kind: \"any-track\", tracks: [\"data\", \"full\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"anthropics/knowledge-work-plugins\",\n      pluginId: \"data@knowledge-work-plugins\",\n    },\n  },\n\n  // === Internal template assets (v26.81.0, ADR-022 — 이전 OptionFlags.withTauri/withUzysHarness) ===\n  {\n    id: \"tauri-desktop\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description: \"Tauri desktop rule template (CSR/full tracks — manifest rule mapping)\",\n    category: \"frontend\",\n    source: \"uzys\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"internal\", key: \"tauri-desktop\" },\n  },\n\n  // === Dev-method skills (uzys 1st-party, v26.87.0) ===\n  // 본 하네스의 작업 방법론 skill 8종 (repo-bundled templates). tier official, core on dev tracks\n  // (has-dev-track → 기본 설치; wizard uncheck / --without <id> 로 제외 가능 — isAssetSelected 게이팅).\n  {\n    id: \"multi-persona-review\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description:\n      \"Multi-persona review — critique one artifact via 3-5 parallel user personas, then synthesize P0/P1/P2 fixes\",\n    category: \"dev-tools\",\n    source: \"uzys\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"internal\", key: \"multi-persona-review\" },\n  },\n  {\n    id: \"gap-analysis-e2e\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description:\n      \"Gap analysis E2E — detect north-star / correctness / UX gaps, then benchmark how reference services solved each\",\n    category: \"dev-tools\",\n    source: \"uzys\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"internal\", key: \"gap-analysis-e2e\" },\n  },\n  {\n    id: \"ultracode-service-audit\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description:\n      \"Ultracode service audit — multi-agent, adversarially-verified full-service audit across 7 dimensions → milestone roadmap\",\n    category: \"dev-tools\",\n    source: \"uzys\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"internal\", key: \"ultracode-service-audit\" },\n  },\n  {\n    id: \"asis-tobe-decision\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description:\n      \"ASIS→TOBE decision — present an A-or-B / approval moment as context → recommendation → option table → AS-IS/TO-BE contrast\",\n    category: \"workflow\",\n    source: \"uzys\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"internal\", key: \"asis-tobe-decision\" },\n  },\n  {\n    id: \"compaction-handoff\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description:\n      \"Compaction handoff — persist durable state + git snapshot + resume anchor before a context /compact so nothing is lost\",\n    category: \"workflow\",\n    source: \"uzys\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"internal\", key: \"compaction-handoff\" },\n  },\n  {\n    id: \"northstar-roadmap\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description:\n      \"North-star roadmap — measure current state vs the vision doc, then propose a ranked feature backlog persisted to docs/plans + memory\",\n    category: \"workflow\",\n    source: \"uzys\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"internal\", key: \"northstar-roadmap\" },\n  },\n  // v26.93.0 — 사용자 확정(2026-07-04) Orchestration & Model Policy 스킬화. v26.94.0 개정\n  //   (2026-07-07): 역할분담 재편 — orchestrator 직접: 방향성·스펙리뷰(multi-persona-review)·\n  //   기능개선·성능/보안 문제발굴 / opus@xhigh+: 문서작성·핵심구현·V&V(fresh instance) /\n  //   sonnet@high+: 반복구현·E2E. effort floor 강제 3경로 + quota 핸드오프는 유지.\n  {\n    id: \"model-orchestration\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description:\n      \"Model orchestration policy — role split (orchestrator directs/reviews · opus@xhigh+ authors docs/core impl/V&V · sonnet@high+ repetitive impl/E2E) + effort floors + delegation spec + quota handoff\",\n    category: \"workflow\",\n    source: \"uzys\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"internal\", key: \"model-orchestration\" },\n  },\n  // v26.98.0 — 하네스 건강 감사 (ADR-027). 어제(2026-07-14) 3개 프로젝트 교차 하네스 교정\n  //   작업에서 추출한 방법론 + 리서치 근거(context rot·lost-in-the-middle·skill undertriggering·\n  //   Ratchet). 기존 5분류(드리프트=정확성만)에서 3질문(A truth / B efficacy / C economy)으로\n  //   재설계 — \"맞는 말인데 아무것도 안 일어나는\" 하네스와 \"다 맞는데 너무 길어 안 지켜지는\"\n  //   하네스를 잡는다. 결정적 경계: 결정론적 린터(AgentLint/cclint)가 할 수 있는 form 검사는\n  //   위임하고, 린터가 구조적으로 못 하는 판단(이 단언이 이 repo 의 진짜 스택인가 / 이 훅이\n  //   실제로 fire 하는가 / 이 스킬이 트리거되는가)만 모델이 한다 (CLAUDE.md Rule 5 정합).\n  {\n    id: \"harness-health-audit\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿\n    description:\n      \"Harness health audit — audit the CLAUDE.md/rules/skills/hooks steering layer on 3 questions a linter can't answer: TRUE (matches real code) · USED (skills trigger, loop verifies) · ECONOMY (inside the budget where rules are still followed)\",\n    category: \"dev-tools\",\n    source: \"uzys\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"internal\", key: \"harness-health-audit\" },\n  },\n\n  // === Opt-in internal bundled skill (v26.95.0 — NOT dev-method) ===\n  // gemini-consult: uzys 1st-party skill wrapping Antigravity's `agy` CLI for natural Korean\n  //   phrasing + multi-persona second-opinion review. Bundled like dev-method skills\n  //   (templates/skills/gemini-consult/) so it renders across all 4 CLIs, but opt-in (condition\n  //   opt-in) — installed only on wizard check / `--with gemini-consult`. Ships a bash wrapper\n  //   (scripts/gemini-ask.sh) to Claude scope via the dir copy; non-Claude CLIs get the SKILL.md\n  //   which degrades to a direct `agy` call (graceful — no broken wrapper reference). tier\n  //   official (repo template); runtime dep on the external `agy` binary is a prereq, not a source.\n  {\n    id: \"gemini-consult\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿 (런타임 의존 agy 는 사용자 prereq)\n    description:\n      \"gemini-consult — consult Gemini (via Antigravity agy CLI) for natural Korean phrasing + multi-persona second-opinion review + Gemini image generation (opt-in; requires agy)\",\n    category: \"dev-tools\",\n    source: \"uzys\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"internal\", key: \"gemini-consult\" },\n  },\n\n  // codex-consult (v26.100.0): uzys 1st-party sibling of gemini-consult, wrapping the OpenAI\n  //   `codex` CLI (`codex exec`) for concise rewriting / document structuring + image generation\n  //   (codex `image_generation` tool → real PNG on disk). Same bundling shape: dir copy ships\n  //   scripts/codex-ask.sh to Claude scope; non-Claude CLIs get SKILL.md with a direct-call\n  //   fallback. Division of labor is encoded in both skills' descriptions (Korean nuance/persona\n  //   → gemini, concision/structure/default images → codex). Runtime dep on `codex` binary is a\n  //   user prereq, not a source.\n  {\n    id: \"codex-consult\",\n    tier: \"official\", // uzys 본 하네스 자체 템플릿 (런타임 의존 codex 는 사용자 prereq)\n    description:\n      \"codex-consult — consult OpenAI Codex (codex exec) for concise/structured rewriting + image generation (opt-in; requires codex CLI)\",\n    category: \"dev-tools\",\n    source: \"uzys\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"internal\", key: \"codex-consult\" },\n  },\n\n  // === Option-gated (v26.42.0 — opt-in, BREAKING vs prior has-dev-track auto-install) ===\n  {\n    id: \"addy-agent-skills\",\n    tier: \"vetted\", // addyosmani 47k\n    description: \"addy agent-skills (general dev)\",\n    category: \"workflow\",\n    source: \"addyosmani\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"addyosmani/agent-skills\",\n      pluginId: \"agent-skills@addy-agent-skills\",\n    },\n  },\n  {\n    id: \"superpowers\",\n    tier: \"official\", // anthropics/claude-plugins-official 공식 배포 (소스 obra 213k)\n    // 저자 = obra (190k★ github.com/obra/superpowers). 호스팅 = Anthropic 공식\n    // marketplace github.com/anthropics/claude-plugins-official (\"Official,\n    // Anthropic-managed directory of high quality Claude Code Plugins\").\n    // source/marketplace 분리는 의도적 — source=저자, marketplace=registry.\n    description: \"Superpowers — agentic skills framework (obra, Anthropic official marketplace)\",\n    category: \"workflow\",\n    source: \"obra\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"anthropics/claude-plugins-official\",\n      pluginId: \"superpowers@claude-plugins-official\",\n    },\n  },\n  {\n    // v26.75.0 (ADR-021) — wshobson/agents marketplace.json name = \"claude-code-workflows\"\n    // (84 plugins). 대표 = full-stack-orchestration. 다른 orchestrator(agent-orchestration/\n    // tdd-workflows/ship-mate 등): `claude plugin install <name>@claude-code-workflows`.\n    id: \"wshobson-agents\",\n    tier: \"vetted\", // wshobson/agents 36k\n    description: \"wshobson agents — multi-agent orchestration workflows (full-stack/tdd/review)\",\n    category: \"workflow\",\n    source: \"wshobson\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"wshobson/agents\",\n      pluginId: \"full-stack-orchestration@claude-code-workflows\",\n    },\n  },\n  {\n    // v26.75.0 (ADR-021) — `npm i --save-dev @fission-ai/openspec` 후 `openspec init` 로 슬래시 주입.\n    id: \"openspec\",\n    tier: \"vetted\", // Fission-AI/OpenSpec 53k\n    description: \"OpenSpec — spec-driven brownfield delta workflow (propose → apply → archive)\",\n    category: \"workflow\",\n    source: \"fission-ai\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"npm\", pkg: \"@fission-ai/openspec\", version: \"1.4.1\" },\n  },\n  {\n    // v26.75.0 (ADR-021) — 비대화형 install. v26.75.1: `--directory .` 누락 시 \"Installation\n    // directory\" 프롬프트에서 hang (Docker realcli 검출). cwd(=project) 기준 `.` 지정으로 봉합.\n    id: \"bmad-method\",\n    tier: \"vetted\", // bmad-code-org/BMAD-METHOD 48k\n    description: \"BMAD-METHOD — multi-agent agile workflow (PM/Architect/Dev, 12+ agents)\",\n    category: \"workflow\",\n    source: \"bmad-code-org\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"npx-run\",\n      cmd: \"bmad-method\",\n      version: \"6.9.0\",\n      args: [\"install\", \"--directory\", \".\", \"--tools\", \"claude-code\", \"--yes\"],\n    },\n  },\n\n  // === Railway (csr-fastify|csr-fastapi|ssr-*|full) ===\n  // v0.6.3 — railway-plugin entry 제거. railwayapp/railway-plugin repo 자체 존재 안 함\n  // (404 Not Found). 공식 docs (https://docs.railway.com/ai/claude-code-plugin) 형식은\n  // marketplace add `railwayapp/railway-skills` + plugin install `railway@railway-skills`만.\n  // → 아래 railway-skills entry로 단일화.\n  {\n    id: \"railway-skills\",\n    tier: \"experimental\", // railwayapp/railway-skills 268\n    description: \"Railway agent-skills (deploy + project/service/env management)\",\n    category: \"backend\",\n    source: \"railwayapp\",\n    condition: { kind: \"any-track\", tracks: RAILWAY_TRACKS },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"railwayapp/railway-skills\",\n      pluginId: \"railway@railway-skills\",\n    },\n  },\n\n  // === csr-supabase|full CLI ===\n  {\n    id: \"vercel-cli\",\n    tier: \"vetted\", // vercel/vercel 15k\n    description: \"Vercel CLI (npm)\",\n    category: \"backend\",\n    source: \"vercel\",\n    condition: { kind: \"any-track\", tracks: [\"csr-supabase\", \"full\"] },\n    method: { kind: \"npm\", pkg: \"vercel\", version: \"54.17.3\" },\n  },\n  {\n    id: \"netlify-cli\",\n    tier: \"vetted\", // netlify/cli 1.9k\n    description: \"Netlify CLI (npm)\",\n    category: \"backend\",\n    source: \"netlify\",\n    condition: { kind: \"any-track\", tracks: [\"csr-supabase\", \"full\"] },\n    method: { kind: \"npm\", pkg: \"netlify-cli\", version: \"26.1.0\" },\n  },\n  {\n    id: \"supabase-cli\",\n    tier: \"vetted\", // supabase 103k\n    description: \"Supabase CLI (npm) — first 'supabase login' requires OAuth\",\n    category: \"backend\",\n    source: \"supabase\",\n    condition: { kind: \"any-track\", tracks: [\"csr-supabase\", \"full\"] },\n    method: { kind: \"npm\", pkg: \"supabase\", version: \"2.108.0\" },\n  },\n\n  // === UI tracks (csr-*|ssr-*|full) ===\n  {\n    id: \"impeccable\",\n    tier: \"vetted\", // pbakaus 31k\n    description:\n      \"Impeccable — UI design guide + visual consistency review (pbakaus, single-skill repo)\",\n    category: \"frontend\",\n    source: \"pbakaus\",\n    condition: { kind: \"any-track\", tracks: ALL_CSR_SSR_FULL },\n    // v26.54.1 — skills cli 1.5.7 부터 `--skill <name>` 명시 필수 (single-skill repo 도)\n    method: { kind: \"skill\", source: \"pbakaus/impeccable\", skill: \"impeccable\" },\n  },\n  // v26.92.0 — frontend-design (Anthropic official, claude-plugins-official 984.5K installs).\n  //   impeccable(생성↔리뷰 짝)의 official 보완재 — frontend-design=distinctive UI 코드 생성,\n  //   impeccable=일관성 리뷰. 사용자 결정: has-dev-track 기본추천 (impeccable=UI 트랙보다\n  //   넓게 — 모든 개발 트랙, executive 제외). category=frontend (UI 자산, wizard 그룹).\n  //   repoForAsset=marketplace(anthropics/claude-plugins-official); official tier=drift 제외.\n  {\n    id: \"frontend-design\",\n    tier: \"official\", // anthropics/claude-plugins-official (Anthropic 저자, 984.5K installs)\n    description:\n      \"frontend-design — distinctive production-grade UI generation (Anthropic official, avoids generic AI aesthetics)\",\n    category: \"frontend\",\n    source: \"anthropics\",\n    condition: { kind: \"has-dev-track\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"anthropics/claude-plugins-official\",\n      pluginId: \"frontend-design@claude-plugins-official\",\n    },\n  },\n\n  // === dev tools (has_dev_track) ===\n  {\n    id: \"playwright-skill\",\n    tier: \"experimental\", // testdino-hq/playwright-skill 264\n    description: \"Playwright — browser automation E2E test authoring guide (testdino-hq)\",\n    category: \"dev-tools\",\n    source: \"testdino-hq\",\n    condition: { kind: \"has-dev-track\" },\n    // v26.54.1 — skills cli 1.5.7 부터 `--skill <name>` 명시 필수\n    method: {\n      kind: \"skill\",\n      source: \"testdino-hq/playwright-skill\",\n      skill: \"playwright-skill\",\n    },\n  },\n  {\n    id: \"find-skills\",\n    tier: \"vetted\", // vercel-labs/skills 20k (license none — 출처 신뢰)\n    description: \"find-skills — search · rank all installed skills (vercel-labs, all dev tracks)\",\n    category: \"dev-tools\",\n    source: \"vercel-labs\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"skill\", source: \"vercel-labs/skills\", skill: \"find-skills\" },\n  },\n  {\n    id: \"agent-browser\",\n    tier: \"vetted\", // vercel-labs/agent-browser 34k\n    description:\n      \"agent-browser — agent-friendly Playwright wrapper (screenshot · DOM search CLI, dev tracks)\",\n    // v26.78.0 — Understanding 으로 재분류: 웹 지각(screenshot·DOM). 영상/코드 지각과 같은 축.\n    category: \"understanding\",\n    source: \"vercel-labs\",\n    condition: { kind: \"has-dev-track\" },\n    method: { kind: \"npm\", pkg: \"agent-browser\", version: \"0.31.0\" },\n  },\n  // v26.78.0 — Understanding 신규 3종 (plugin, opt-in). 에이전트 인지 증강: 영상·코드 지각 + 메모리.\n  {\n    id: \"claude-video\",\n    tier: \"vetted\", // bradautomates/claude-video 1.8k\n    description:\n      \"Claude Video — /watch downloads any video, extracts frames + transcript so Claude can see + hear it (yt-dlp/ffmpeg auto on first run)\",\n    category: \"understanding\",\n    source: \"bradautomates\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"bradautomates/claude-video\",\n      pluginId: \"watch@claude-video\",\n    },\n  },\n  {\n    id: \"understand-anything\",\n    tier: \"vetted\", // Lum1104/Understand-Anything 53k\n    description:\n      \"Understand Anything — multi-agent pipeline builds an interactive knowledge graph of your codebase (files/functions/deps) to explore + query\",\n    category: \"understanding\",\n    source: \"Lum1104\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"Lum1104/Understand-Anything\",\n      pluginId: \"understand-anything@understand-anything\",\n    },\n  },\n  {\n    id: \"agentmemory\",\n    tier: \"vetted\", // rohitg00/agentmemory 21k\n    description:\n      \"AgentMemory — persistent memory runtime; plugin auto-wires MCP (53 tools) + hooks + skills. Runtime server: npx @agentmemory/agentmemory\",\n    category: \"understanding\",\n    source: \"rohitg00\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"rohitg00/agentmemory\",\n      pluginId: \"agentmemory@agentmemory\",\n    },\n  },\n\n  // === Visual & Media (v26.85.0) — 코드-퍼스트 제작 자산. 전부 opt-in. ===\n  // Docker 실설치 검증 PASS (실 claude 2.1.177): plugin install / npx skills add resolve 확인.\n  {\n    id: \"frontend-slides\",\n    tier: \"vetted\", // zarazhangrui/frontend-slides 21k\n    description:\n      \"frontend-slides — dependency-free HTML slide decks (presets · templates · PPTX→HTML · PDF export)\",\n    category: \"visual-media\",\n    source: \"zarazhangrui\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"zarazhangrui/frontend-slides\",\n      pluginId: \"frontend-slides@frontend-slides\",\n    },\n  },\n  {\n    id: \"marp-slide\",\n    tier: \"vetted\", // softaworks/agent-toolkit 2k\n    description: \"marp-slide — Marp Markdown slides (7 themes · PPTX/PDF export)\",\n    category: \"visual-media\",\n    source: \"softaworks\",\n    // softaworks plugin dir 는 plugin.json 부재 → skill 경로가 안전 (Docker 검증).\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"skill\", source: \"softaworks/agent-toolkit\", skill: \"marp-slide\" },\n  },\n  {\n    id: \"mermaid-diagrams\",\n    tier: \"vetted\", // softaworks/agent-toolkit 2k\n    description:\n      \"mermaid-diagrams — Mermaid flow/sequence/ER/state diagram authoring (code · docs)\",\n    category: \"visual-media\",\n    source: \"softaworks\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"skill\", source: \"softaworks/agent-toolkit\", skill: \"mermaid-diagrams\" },\n  },\n  {\n    id: \"gsap-skills\",\n    tier: \"vetted\", // greensock/gsap-skills 9k (GSAP 본가 공식)\n    description:\n      \"GSAP skills — official GreenSock motion/scroll animation guide (8 skills: timeline · scrolltrigger · react)\",\n    category: \"visual-media\",\n    source: \"greensock\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"greensock/gsap-skills\",\n      pluginId: \"gsap-skills@gsap-skills\",\n    },\n  },\n  {\n    // remotion: star 3.6k → vetted (star 기반 tier SSOT + trust-tier-drift CI 정합, 사용자 결정 2026-06-13).\n    //   코어 BUSL(Business Source License) — opt-in + description 고지로 신중 취급 (경고 배지 대신).\n    //   --skill 값 = remotion-best-practices (dir `remotion` ≠ frontmatter name, Docker 실측 확정).\n    id: \"remotion\",\n    tier: \"vetted\", // remotion-dev/skills 3.6k (license none — 출처 신뢰; 코어 BUSL 고지)\n    description:\n      \"Remotion — programmatic MP4 video from React components (data-driven). Core license = BUSL\",\n    category: \"visual-media\",\n    source: \"remotion-dev\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"skill\", source: \"remotion-dev/skills\", skill: \"remotion-best-practices\" },\n  },\n  // Issue #176 — 프레젠테이션 생성 스택 4종 (Docker 실설치 4/4 PASS: skills@1.5.11 add <src> --agent claude-code --skill, 2026-06-20).\n  {\n    id: \"ppt-master\",\n    tier: \"vetted\", // hugohe3/ppt-master 29k\n    description:\n      \"ppt-master — editable PowerPoint (.pptx) from any document (native shapes · speaker notes · custom .pptx template)\",\n    category: \"visual-media\",\n    source: \"hugohe3\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"skill\", source: \"hugohe3/ppt-master\", skill: \"ppt-master\" },\n  },\n  {\n    // deer-flow 72k 거대 harness지만 --skill 로 ppt-generation 단일 skill만 설치 (skills/public/ 중첩, Docker 확인).\n    id: \"ppt-generation\",\n    tier: \"vetted\", // bytedance/deer-flow 72k\n    description:\n      \"ppt-generation — PPTX by generating an image per slide and composing into PowerPoint (deer-flow skill)\",\n    category: \"visual-media\",\n    source: \"bytedance\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"skill\", source: \"bytedance/deer-flow\", skill: \"ppt-generation\" },\n  },\n  {\n    id: \"web-video-presentation\",\n    tier: \"vetted\", // ConardLi/garden-skills 8.4k\n    description:\n      \"web-video-presentation — click-driven 16:9 web decks that look like video (optional TTS narration; garden-skills)\",\n    category: \"visual-media\",\n    source: \"ConardLi\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"skill\", source: \"ConardLi/garden-skills\", skill: \"web-video-presentation\" },\n  },\n  {\n    id: \"revealjs\",\n    tier: \"experimental\", // ryanbbrown/revealjs-skill 347 (<1000 → experimental, opt-in + 경고)\n    description:\n      \"reveal.js — polished HTML presentations (themes · multi-column · code highlight · speaker notes, no build step)\",\n    category: \"visual-media\",\n    source: \"ryanbbrown\",\n    condition: { kind: \"opt-in\" },\n    method: { kind: \"skill\", source: \"ryanbbrown/revealjs-skill\", skill: \"revealjs\" },\n  },\n  {\n    id: \"architecture-decision-record\",\n    tier: \"experimental\", // yonatangross/orchestkit 179\n    description:\n      \"ADR — Architecture Decision Record template + status flow (orchestkit, one of 80+ skills)\",\n    category: \"dev-tools\",\n    source: \"yonatangross\",\n    condition: { kind: \"has-dev-track\" },\n    method: {\n      kind: \"skill\",\n      source: \"yonatangross/orchestkit\",\n      skill: \"architecture-decision-record\",\n    },\n  },\n\n  // === Supabase agent-skills (csr-supabase|full) ===\n  {\n    id: \"supabase-agent-skills\",\n    tier: \"vetted\", // supabase/agent-skills 2.2k\n    description:\n      \"Supabase — RLS · auth · edge function · realtime guide (csr-supabase · full tracks)\",\n    category: \"backend\",\n    source: \"supabase\",\n    condition: { kind: \"any-track\", tracks: [\"csr-supabase\", \"full\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"supabase/agent-skills\",\n      pluginId: \"supabase@supabase-agent-skills\",\n    },\n  },\n  {\n    id: \"postgres-best-practices\",\n    tier: \"vetted\", // supabase/agent-skills 2.2k\n    description:\n      \"Postgres best practices — schema · index · query patterns (csr-supabase · full tracks)\",\n    category: \"backend\",\n    source: \"supabase\",\n    condition: { kind: \"any-track\", tracks: [\"csr-supabase\", \"full\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"supabase/agent-skills\",\n      pluginId: \"postgres-best-practices@supabase-agent-skills\",\n    },\n  },\n\n  // === React + Next UI tracks ===\n  // v0.6.3 — vercel-labs/agent-skills source는 short form 안 됨. full HTTPS URL 필요.\n  // 사용자 확인 형식: `npx skills add https://github.com/vercel-labs/agent-skills --skill <name>`.\n  {\n    id: \"react-best-practices\",\n    tier: \"vetted\", // vercel-labs/agent-skills 27k (license none — 출처 신뢰)\n    description:\n      \"React best practices — Vercel's hook · perf · component patterns (CSR · SSR · Next tracks)\",\n    category: \"frontend\",\n    source: \"vercel-labs\",\n    condition: { kind: \"any-track\", tracks: CSR_SSR_NEXTJS_FULL },\n    method: {\n      kind: \"skill\",\n      source: \"https://github.com/vercel-labs/agent-skills\",\n      // v0.6.5 — skills.sh registry name. GitHub dir 이름(react-best-practices)과 다름.\n      // skills.sh: 대부분 vercel- prefix (web-design-guidelines, deploy-to-vercel만 예외).\n      skill: \"vercel-react-best-practices\",\n    },\n  },\n  {\n    id: \"shadcn-ui\",\n    tier: \"vetted\", // shadcn-ui/ui 115k\n    description: \"shadcn/ui — Radix-based React component copy + Tailwind theme (shadcn official)\",\n    category: \"frontend\",\n    source: \"shadcn-ui\",\n    condition: { kind: \"any-track\", tracks: CSR_SSR_NEXTJS_FULL },\n    // v26.54.1 — shadcn/ui repo 의 실제 skill 이름은 `shadcn` (자산 id 와 다름).\n    method: { kind: \"skill\", source: \"shadcn/ui\", skill: \"shadcn\" },\n  },\n  {\n    id: \"web-design-guidelines\",\n    tier: \"vetted\", // vercel-labs/agent-skills 27k (license none — 출처 신뢰)\n    description:\n      \"Web design guidelines — Vercel's visual hierarchy · color · spacing (CSR · SSR · Next tracks)\",\n    category: \"frontend\",\n    source: \"vercel-labs\",\n    condition: { kind: \"any-track\", tracks: CSR_SSR_NEXTJS_FULL },\n    method: {\n      kind: \"skill\",\n      source: \"https://github.com/vercel-labs/agent-skills\",\n      skill: \"web-design-guidelines\",\n    },\n  },\n  // === Executive tracks ===\n  {\n    id: \"anthropic-document-skills\",\n    tier: \"official\", // anthropics/skills 144k\n    description: \"Anthropic document-skills (pptx/docx/xlsx/pdf)\",\n    category: \"business\",\n    source: \"anthropics\",\n    condition: { kind: \"any-track\", tracks: [\"executive\", \"full\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"anthropics/skills\",\n      pluginId: \"document-skills@anthropic-agent-skills\",\n    },\n  },\n  // alirezarezvani/claude-skills marketplace (v2.3.0) — 2026-04-25 통합 갱신.\n  // 기존 alirezarezvani/c-level-skills + alirezarezvani/finance-skills 별도 marketplace\n  // → 통합된 alirezarezvani/claude-skills marketplace (claude-code-skills 이름)로 이동.\n  {\n    id: \"c-level-skills\",\n    tier: \"vetted\", // alirezarezvani 16k\n    description: \"c-level-skills (claude-code-skills, 28 advisory)\",\n    category: \"business\",\n    source: \"alirezarezvani\",\n    condition: { kind: \"any-track\", tracks: [\"executive\", \"full\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"alirezarezvani/claude-skills\",\n      pluginId: \"c-level-skills@claude-code-skills\",\n    },\n  },\n  {\n    id: \"business-growth-skills\",\n    tier: \"vetted\", // alirezarezvani 16k\n    description: \"business-growth-skills (4 — customer success, sales eng, revops, contract)\",\n    category: \"business\",\n    source: \"alirezarezvani\",\n    // v0.5.0 — growth-marketing Track에서도 재사용. 합집합 조건.\n    condition: { kind: \"any-track\", tracks: [\"executive\", \"full\", \"growth-marketing\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"alirezarezvani/claude-skills\",\n      pluginId: \"business-growth-skills@claude-code-skills\",\n    },\n  },\n  {\n    id: \"finance-skills\",\n    tier: \"vetted\", // alirezarezvani 16k\n    description: \"finance-skills (3 — financial analyst, SaaS metrics, investment advisor)\",\n    category: \"business\",\n    source: \"alirezarezvani\",\n    condition: { kind: \"any-track\", tracks: [\"executive\", \"full\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"alirezarezvani/claude-skills\",\n      pluginId: \"finance-skills@claude-code-skills\",\n    },\n  },\n\n  // === Project Management Track (v0.5.0) ===\n  // SPEC docs/specs/new-tracks-pm-growth.md §3.5 — pm-skills 4/4.\n  {\n    id: \"pm-skills\",\n    tier: \"vetted\", // alirezarezvani 16k\n    description:\n      \"pm-skills (6 — senior PM, scrum master, Jira/Confluence/Atlassian admin, template creator)\",\n    category: \"business\",\n    source: \"alirezarezvani\",\n    condition: { kind: \"any-track\", tracks: [\"project-management\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"alirezarezvani/claude-skills\",\n      pluginId: \"pm-skills@claude-code-skills\",\n    },\n  },\n  // SPEC §3.5 — product-skills: has-dev-track + project-management 합집합 (executive/growth-marketing 제외).\n  // v0.8.1 — DEV_PLUS_PM_TRACKS 상수로 SSOT 통일 (reviewer MEDIUM-3 fix).\n  {\n    id: \"product-skills\",\n    tier: \"vetted\", // alirezarezvani 16k\n    description: \"product-skills (15 — RICE, PRD, agile PO, UX research, SaaS scaffolder ...)\",\n    category: \"dev-tools\",\n    source: \"alirezarezvani\",\n    condition: { kind: \"any-track\", tracks: [...DEV_PLUS_PM_TRACKS] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"alirezarezvani/claude-skills\",\n      pluginId: \"product-skills@claude-code-skills\",\n    },\n  },\n\n  // === Growth Marketing Track (v0.5.0) ===\n  // SPEC docs/specs/new-tracks-pm-growth.md §3.5 — 4 entries 모두 4/4.\n  {\n    id: \"marketing-skills\",\n    tier: \"vetted\", // alirezarezvani 16k\n    description:\n      \"marketing-skills (44 — content/SEO/CRO/channels/growth/intelligence/sales/twitter)\",\n    category: \"business\",\n    source: \"alirezarezvani\",\n    condition: { kind: \"any-track\", tracks: [\"growth-marketing\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"alirezarezvani/claude-skills\",\n      pluginId: \"marketing-skills@claude-code-skills\",\n    },\n  },\n  // v26.91.0 — coreyhaines31/marketingskills (35k★, MIT, plugin v2.5.1). 위 alirezarezvani\n  //   marketing-skills(16k) 와 병존 — id 구분(marketingskills ≠ marketing-skills). opt-in =\n  //   growth-marketing 외 전 트랙에서도 wizard 토글 + `--with marketingskills` 로 설치 가능\n  //   (\"SEO 는 일반 개발에도 활용\" 충족: dev 트랙에서 본 번들 토글). 45 스킬 중 SEO 7종\n  //   (seo-audit/schema/ai-seo/site-architecture/programmatic-seo/content/aso)은 상호참조\n  //   (product-marketing 우선 + seo-audit↔schema↔ai-seo)라 부분 추출 시 포인터 깨짐 → 번들\n  //   통째 설치만 정합. repoForAsset = marketplace(coreyhaines31/marketingskills) → drift 라이브.\n  {\n    id: \"marketingskills\",\n    tier: \"vetted\", // coreyhaines31 35k\n    description: \"marketingskills (45 — CRO/copywriting/SEO/AI-SEO/ads/growth, coreyhaines31 35k★)\",\n    category: \"business\",\n    source: \"coreyhaines31\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"coreyhaines31/marketingskills\",\n      pluginId: \"marketing-skills@marketingskills\",\n    },\n  },\n  // v26.76.0 — content-creator / demand-gen 제거: alirezarezvani/claude-skills marketplace.json 에\n  // 해당 plugin 부재(Docker 실설치 검출, exit 1). 거짓 광고 0건 원칙(Promise=Implementation).\n  // growth-marketing 트랙은 business-growth-skills + marketing-skills + research-summarizer 유지.\n  {\n    id: \"research-summarizer\",\n    tier: \"vetted\", // alirezarezvani 16k\n    description: \"research-summarizer (market research summarization)\",\n    category: \"business\",\n    source: \"alirezarezvani\",\n    condition: { kind: \"any-track\", tracks: [\"growth-marketing\"] },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"alirezarezvani/claude-skills\",\n      pluginId: \"research-summarizer@claude-code-skills\",\n    },\n  },\n\n  // === Code-quality enforcement (has-dev-track, v0.5.0) ===\n  // SPEC §3.5 — karpathy-coder 4/4. CLAUDE.md P1-P4 선언적 원칙의 검출 도구 layer.\n  // 4 Python tools (stdlib only) + reviewer agent + /karpathy-check + pre-commit hook.\n  {\n    id: \"karpathy-coder\",\n    tier: \"vetted\", // alirezarezvani 16k\n    description:\n      \"karpathy-coder (4 Python tool + reviewer agent + /karpathy-check + pre-commit hook)\",\n    category: \"dev-tools\",\n    source: \"alirezarezvani\",\n    condition: { kind: \"has-dev-track\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"alirezarezvani/claude-skills\",\n      pluginId: \"karpathy-coder@claude-code-skills\",\n    },\n  },\n\n  // === Option-gated ===\n  {\n    // v26.39.2 fix — marketplace name = \"trailofbits\" (NOT \"trailofbits-skills\") +\n    // \"trailofbits-skills\" plugin 자체가 존재하지 않음. marketplace 안에 14+ 개별 plugin.\n    // 단일 대표 plugin = `differential-review` (코드 변경 보안 리뷰, 가장 보편).\n    // 추가 plugin 원하는 사용자는: `claude plugin install <name>@trailofbits` (예: audit-context-building)\n    id: \"trailofbits-skills\",\n    tier: \"vetted\", // trailofbits/skills 5.5k (CC-BY-SA — 출처 신뢰)\n    description: \"Trail of Bits differential-review plugin (security-focused code review)\",\n    category: \"dev-tools\",\n    source: \"trailofbits\",\n    condition: { kind: \"opt-in\" },\n    method: {\n      kind: \"plugin\",\n      marketplace: \"trailofbits/skills\",\n      pluginId: \"differential-review@trailofbits\",\n    },\n  },\n  {\n    id: \"ecc-plugin\",\n    tier: \"vetted\", // affaan-m/everything-claude-code 199k\n    description: \"ECC — 60 agents · 230 skills · 75 commands. Affaan's hackathon package\",\n    category: \"ecc-suite\",\n    source: \"affaan-m\",\n    condition: { kind: \"opt-in\" },\n    // v26.54.1 — upstream marketplace.json 의 name 은 \"ecc\" (plugin name 도 \"ecc\").\n    // 기존 매핑 `everything-claude-code@everything-claude-code` 는 marketplace 가\n    // 그 이름으로 등록되던 옛 버전 기준. fresh install 에서는 \"Plugin not found\" 발생.\n    method: {\n      kind: \"plugin\",\n      marketplace: \"affaan-m/everything-claude-code\",\n      pluginId: \"ecc@ecc\",\n    },\n  },\n  {\n    id: \"ecc-prune\",\n    tier: \"official\", // uzys 본 하네스 자체\n    description:\n      \"ECC prune (drop items beyond curated 89 KEEP → copy to .claude/local-plugins/ecc/)\",\n    category: \"ecc-suite\",\n    source: \"uzys\",\n    condition: { kind: \"option\", flag: \"withPrune\" },\n    method: {\n      kind: \"shell-script\",\n      script: \"scripts/prune-ecc.sh\",\n      args: [\"--apply\", \"--force\"],\n    },\n  },\n];\n\n/**\n * v26.87.0 — dev-method skill ids (uzys 1st-party, internal templates). installer 의\n * `selectedInternalSkills` 계산 + manifest copy 게이팅 + 테스트가 공유하는 SSOT.\n * 각 id 는 method.kind===\"internal\" 이며 `templates/skills/<id>/SKILL.md` 로 번들된다.\n */\nexport const DEV_METHOD_SKILL_IDS: ReadonlyArray<string> = [\n  \"multi-persona-review\",\n  \"gap-analysis-e2e\",\n  \"ultracode-service-audit\",\n  \"asis-tobe-decision\",\n  \"compaction-handoff\",\n  \"northstar-roadmap\",\n  // v26.93.0 — Orchestration & Model Policy.\n  \"model-orchestration\",\n  // v26.98.0 — 하네스 건강 감사 (ADR-027).\n  \"harness-health-audit\",\n];\n\n/**\n * v26.95.0 — ALL repo-bundled internal skill ids (dev-method + opt-in advisors). Bundling is\n * condition-agnostic: manifest Claude dir-copy, the 3 non-Claude CLI transforms, and\n * gen-compatibility iterate THIS superset so every bundled skill renders across CLIs; each entry's\n * `condition` (has-dev-track vs opt-in) still gates whether it actually installs. Kept separate\n * from `DEV_METHOD_SKILL_IDS` so \"dev-method\" keeps meaning the 8 has-dev-track methodology skills.\n */\nexport const INTERNAL_BUNDLED_SKILL_IDS: ReadonlyArray<string> = [\n  ...DEV_METHOD_SKILL_IDS,\n  // opt-in internal skills (NOT dev-method): bundled + 4-CLI rendered, installed only on opt-in.\n  \"gemini-consult\",\n  // v26.100.0 — Codex advisor (concision/structure + image gen). ADR-029.\n  \"codex-consult\",\n];\n\n/**\n * v26.79.0 — `TRUST_TIER` 는 EXTERNAL_ASSETS.tier 에서 derive (단일 출처). 별도 Record 유지 시\n * 누락/stale drift 가능 → 제거. 기존 소비자(prompts.ts·gen-compatibility·trust-tier-drift)는\n * 이 derived map 을 그대로 import. id 키는 각 자산 id 와 1:1 (자산 추가 시 자동 반영).\n */\nexport const TRUST_TIER: Record<string, TrustTier> = Object.fromEntries(\n  EXTERNAL_ASSETS.map((a) => [a.id, a.tier]),\n);\n\n/** 자산의 검증 tier. 미분류(catalog 외 id)는 보수적으로 experimental. */\nexport function assetTrustTier(assetId: string): TrustTier {\n  return TRUST_TIER[assetId] ?? \"experimental\";\n}\n\n/**\n * v26.47.0 — User override of preset/option condition (Phase C full, SPEC §3.1).\n * - `forceInclude`: condition 무관 강제 포함 (사용자가 명시 추가)\n * - `forceExclude`: condition 무관 강제 제외 (사용자가 추천 ✓ 풀음)\n *\n * 우선순위: `forceExclude` > `forceInclude` > `condition`.\n */\nexport interface UserOverride {\n  forceInclude: ReadonlyArray<string>;\n  forceExclude: ReadonlyArray<string>;\n}\n\n/**\n * 조건 평가 — 주어진 spec(tracks + options + userOverride)에서 자산이 설치 대상인지 판정.\n */\nexport function shouldInstallAsset(\n  asset: ExternalAsset,\n  ctx: {\n    tracks: ReadonlyArray<Track>;\n    options: OptionFlags;\n    userOverride?: UserOverride;\n  },\n): boolean {\n  // v26.47.0 — userOverride 우선순위: forceExclude > forceInclude > condition.\n  if (ctx.userOverride?.forceExclude.includes(asset.id)) return false;\n  if (ctx.userOverride?.forceInclude.includes(asset.id)) return true;\n  // v26.71.1 — experimental(T3) opt-in only (PRD v26-71 R6/AC4). condition 매치만으론 미설치.\n  //   --with <id> (forceInclude) 또는 interactive 체크(→forceInclude) 시에만 설치 — 선택권 유지(강제 차단 아님).\n  //   v26.71.0 은 recommendedExternalAssets(pre-check)에만 제외 적용 → 비대화형/미체크 install 경로 누락 버그 fix.\n  //   게이트는 명시 분류(TRUST_TIER[id])만 본다 — assetTrustTier()의 unknown→experimental default 는\n  //   DISPLAY(경고 배지)용이며 설치 게이트엔 미적용. 실 자산 전부 매핑은 \"no-missing\" 테스트가 강제(AC1).\n  if (TRUST_TIER[asset.id] === \"experimental\") return false;\n  return matchesCondition(asset, ctx);\n}\n\n/**\n * Track/option condition 매치만 평가 (tier·override 무관). shouldInstallAsset 의 조건절 +\n * experimentalOptInCandidates 의 \"조건은 맞지만 T3\" 판정에서 공유 (SSOT).\n */\nfunction matchesCondition(\n  asset: ExternalAsset,\n  ctx: { tracks: ReadonlyArray<Track>; options: OptionFlags },\n): boolean {\n  const cond = asset.condition;\n  switch (cond.kind) {\n    case \"any-track\":\n      return ctx.tracks.some((t) => cond.tracks.includes(t));\n    case \"has-dev-track\":\n      // SSOT — track-match.ts hasDevTrack(): csr-*|ssr-*|data|full|tooling (= DEV_TRACKS).\n      // EXECUTIVE_STYLE_TRACKS (executive + project-management + growth-marketing) 는 제외.\n      return hasDevTrack(ctx.tracks);\n    case \"option\":\n      return ctx.options[cond.flag] === true;\n    case \"opt-in\":\n      // v26.81.0 (ADR-022) — 순수 opt-in: condition 으론 절대 설치 안 됨.\n      //   forceInclude(wizard 체크 / --with <id>)가 shouldInstallAsset 상위에서 처리.\n      return false;\n  }\n}\n\n/**\n * v26.81.0 (ADR-022) — spec 에서 특정 자산의 선택 여부 판정.\n * 내부 자산(tauri-desktop)의 manifest/transform 게이팅이 이전\n * `spec.options.withTauri` 등 boolean 자리를 대체해 호출. (wizard 체크/--with 는\n * forceInclude 로 들어오므로 shouldInstallAsset 가 그대로 판정)\n */\nexport function isAssetSelected(\n  assetId: string,\n  ctx: {\n    tracks: ReadonlyArray<Track>;\n    options: OptionFlags;\n    userOverride?: UserOverride;\n  },\n): boolean {\n  const asset = EXTERNAL_ASSETS.find((a) => a.id === assetId);\n  return asset ? shouldInstallAsset(asset, ctx) : false;\n}\n\n/**\n * v26.71.1 — track/option condition 은 매치하지만 T3(experimental)라서 default 설치에서 제외된 자산.\n * forceInclude(--with / interactive 체크)된 것은 이미 설치되므로 제외. 비대화형 install 의\n * discoverability 힌트용 (Transparent Defaults — 숨김 0건. --with 로 opt-in 가능함을 사용자에게 알림).\n */\nexport function experimentalOptInCandidates(ctx: {\n  tracks: ReadonlyArray<Track>;\n  options: OptionFlags;\n  userOverride?: UserOverride;\n}): ReadonlyArray<ExternalAsset> {\n  return EXTERNAL_ASSETS.filter(\n    (a) =>\n      TRUST_TIER[a.id] === \"experimental\" &&\n      !ctx.userOverride?.forceInclude.includes(a.id) &&\n      matchesCondition(a, ctx),\n  );\n}\n\n/**\n * spec에 적용 가능한 자산 필터.\n */\nexport function filterApplicableAssets(\n  assets: ReadonlyArray<ExternalAsset>,\n  ctx: {\n    tracks: ReadonlyArray<Track>;\n    options: OptionFlags;\n    userOverride?: UserOverride;\n  },\n): ReadonlyArray<ExternalAsset> {\n  return assets.filter((a) => shouldInstallAsset(a, ctx));\n}\n","import type { Track } from \"./types.js\";\n\n/** Match a track against a glob-style pattern (bash-compatible: `csr-*`, `csr-*|full`). */\nexport function matchTrack(track: Track, pattern: string): boolean {\n  return pattern.split(\"|\").some((p) => globToRegex(p.trim()).test(track));\n}\n\nexport function anyTrack(tracks: ReadonlyArray<Track>, pattern: string): boolean {\n  return tracks.some((t) => matchTrack(t, pattern));\n}\n\nexport function hasDevTrack(tracks: ReadonlyArray<Track>): boolean {\n  // Dev tracks = anything that is NOT executive AND NOT tooling-only-meta.\n  // Mirrors setup-harness.sh has_dev_track: csr-*, ssr-*, data, full, tooling.\n  return anyTrack(tracks, \"csr-*|ssr-*|data|full|tooling\");\n}\n\nexport function hasUiTrack(tracks: ReadonlyArray<Track>): boolean {\n  return anyTrack(tracks, \"csr-*|ssr-*|full\");\n}\n\n/** Convert a bash glob (only `*` is supported) to a strict-anchored RegExp. */\nfunction globToRegex(pattern: string): RegExp {\n  const escaped = pattern.replace(/[.+?^${}()|[\\]\\\\]/g, \"\\\\$&\").replace(/\\*/g, \".*\");\n  return new RegExp(`^${escaped}$`);\n}\n","/**\n * Category-based installer (v26.43.0) — 분야별 대표 스킬 큐레이션.\n *\n * 9 카테고리: Frontend / Backend / Data / Business / Dev Tools / Understanding / Visual & Media / Workflow / ECC Suite.\n * 각 카테고리 안에서 자산은 (출처, ExternalAsset.id) 로 식별. Step 2 UI 그룹화 기준.\n *\n * Source labels = 정확한 GitHub org/user (Phase A의 SSOT).\n * `[3rd-party]` 같은 generic 라벨 금지 (SPEC R6).\n */\n\nexport const CATEGORIES = [\n  \"frontend\",\n  \"backend\",\n  \"data\",\n  \"business\",\n  \"dev-tools\",\n  \"understanding\",\n  \"visual-media\",\n  \"workflow\",\n  \"ecc-suite\",\n] as const;\nexport type Category = (typeof CATEGORIES)[number];\n\nexport const CATEGORY_TITLES: Record<Category, string> = {\n  frontend: \"🎨 Frontend (UI · Design)\",\n  backend: \"🗄️  Backend (API · DB · Deploy)\",\n  data: \"📊 Data\",\n  business: \"💼 Business (Documents)\",\n  \"dev-tools\": \"🛡️  Dev Tools (Security · Quality)\",\n  // v26.78.0 — 에이전트 인지 증강: 환경에 대한 지각(영상·웹·코드) + 기억(memory).\n  understanding: \"🧠 Understanding (Perception · Memory)\",\n  // v26.85.0 — 코드-퍼스트 비주얼/미디어 제작: 슬라이드·다이어그램·모션·동영상.\n  \"visual-media\": \"🎬 Visual & Media (Slides · Diagrams · Motion · Video)\",\n  workflow: \"🔄 Workflow (Development Cycle)\",\n  \"ecc-suite\": \"📦 ECC Suite\",\n};\n\n/** Source labels — GitHub org/user. Maps the canonical owner shown to the user. */\nexport const SOURCE_LABELS = {\n  anthropics: \"anthropics\",\n  \"vercel-labs\": \"vercel-labs\",\n  \"shadcn-ui\": \"shadcn/ui\",\n  vercel: \"vercel\",\n  netlify: \"netlify\",\n  supabase: \"supabase\",\n  railwayapp: \"railwayapp\",\n  trailofbits: \"trailofbits\",\n  obra: \"obra\",\n  addyosmani: \"addyosmani\",\n  pbakaus: \"pbakaus\",\n  \"K-Dense-AI\": \"K-Dense-AI\",\n  wshobson: \"wshobson\",\n  \"testdino-hq\": \"testdino-hq\",\n  yonatangross: \"yonatangross\",\n  alirezarezvani: \"alirezarezvani\",\n  \"affaan-m\": \"affaan-m\",\n  \"get-shit-done-cc\": \"get-shit-done-cc\",\n  \"fission-ai\": \"Fission-AI\",\n  \"bmad-code-org\": \"bmad-code-org\",\n  // v26.78.0 — Understanding 카테고리 신규 출처\n  bradautomates: \"bradautomates\",\n  Lum1104: \"Lum1104\",\n  rohitg00: \"rohitg00\",\n  // v26.85.0 — Visual & Media 카테고리 출처 (Docker 실설치 검증 PASS).\n  zarazhangrui: \"zarazhangrui\",\n  greensock: \"greensock\",\n  softaworks: \"softaworks\",\n  \"remotion-dev\": \"remotion-dev\",\n  // v26.86.0 — Visual & Media 프레젠테이션 4종 (Issue #176, Docker 실설치 4/4 PASS).\n  hugohe3: \"hugohe3\",\n  bytedance: \"bytedance\",\n  ConardLi: \"ConardLi\",\n  ryanbbrown: \"ryanbbrown\",\n  // v26.91.0 — Business 카테고리 마케팅 번들 (coreyhaines31/marketingskills 35k★, MIT).\n  coreyhaines31: \"coreyhaines31\",\n  uzys: \"this project\",\n} as const;\nexport type Source = keyof typeof SOURCE_LABELS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAF9B;AAAA;AAAA;AAAA;AAAA;;;ACAA;;;ACAA;AAGO,SAAS,WAAW,OAAc,SAA0B;AACjE,SAAO,QAAQ,MAAM,GAAG,EAAE,KAAK,CAAC,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC;AACzE;AAEO,SAAS,SAAS,QAA8B,SAA0B;AAC/E,SAAO,OAAO,KAAK,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAClD;AAEO,SAAS,YAAY,QAAuC;AAGjE,SAAO,SAAS,QAAQ,+BAA+B;AACzD;AAEO,SAAS,WAAW,QAAuC;AAChE,SAAO,SAAS,QAAQ,kBAAkB;AAC5C;AAGA,SAAS,YAAY,SAAyB;AAC5C,QAAM,UAAU,QAAQ,QAAQ,sBAAsB,MAAM,EAAE,QAAQ,OAAO,IAAI;AACjF,SAAO,IAAI,OAAO,IAAI,OAAO,GAAG;AAClC;;;AD+EA,IAAM,mBAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAM,sBAA+B;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,iBAA0B,CAAC,eAAe,eAAe,YAAY,cAAc,MAAM;AAwBxF,IAAM,aAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,qBAA2C,CAAC,GAAG,YAAY,oBAAoB;AAQrF,IAAM,kBAAgD;AAAA;AAAA,EAE3D;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,QAAQ,MAAM,EAAE;AAAA,IACzD,QAAQ,EAAE,MAAM,SAAS,QAAQ,sCAAsC,OAAO,SAAS;AAAA;AAAA,EAEzF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,QAAQ,MAAM,EAAE;AAAA,IACzD,QAAQ,EAAE,MAAM,SAAS,QAAQ,sCAAsC,OAAO,OAAO;AAAA,EACvF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,QAAQ,MAAM,EAAE;AAAA,IACzD,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,QAAQ,MAAM,EAAE;AAAA,IACzD,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,QAAQ,MAAM,EAAE;AAAA,IACzD,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,YAAY,KAAK,gBAAgB;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC1D;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,YAAY,KAAK,mBAAmB;AAAA,EACtD;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,YAAY,KAAK,0BAA0B;AAAA,EAC7D;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,YAAY,KAAK,qBAAqB;AAAA,EACxD;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,YAAY,KAAK,qBAAqB;AAAA,EACxD;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,YAAY,KAAK,oBAAoB;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,YAAY,KAAK,sBAAsB;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,YAAY,KAAK,iBAAiB;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,YAAY,KAAK,gBAAgB;AAAA,EACnD;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,IAIE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA;AAAA,IAEE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,OAAO,KAAK,wBAAwB,SAAS,QAAQ;AAAA,EACvE;AAAA,EACA;AAAA;AAAA;AAAA,IAGE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,KAAK;AAAA,MACL,SAAS;AAAA,MACT,MAAM,CAAC,WAAW,eAAe,KAAK,WAAW,eAAe,OAAO;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,eAAe;AAAA,IACvD,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,gBAAgB,MAAM,EAAE;AAAA,IACjE,QAAQ,EAAE,MAAM,OAAO,KAAK,UAAU,SAAS,UAAU;AAAA,EAC3D;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,gBAAgB,MAAM,EAAE;AAAA,IACjE,QAAQ,EAAE,MAAM,OAAO,KAAK,eAAe,SAAS,SAAS;AAAA,EAC/D;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,gBAAgB,MAAM,EAAE;AAAA,IACjE,QAAQ,EAAE,MAAM,OAAO,KAAK,YAAY,SAAS,UAAU;AAAA,EAC7D;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,iBAAiB;AAAA;AAAA,IAEzD,QAAQ,EAAE,MAAM,SAAS,QAAQ,sBAAsB,OAAO,aAAa;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA;AAAA,IAEnC,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,SAAS,QAAQ,sBAAsB,OAAO,cAAc;AAAA,EAC9E;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA;AAAA,IAEF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ,EAAE,MAAM,OAAO,KAAK,iBAAiB,SAAS,SAAS;AAAA,EACjE;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA,EAIA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA;AAAA,IAER,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,SAAS,QAAQ,4BAA4B,OAAO,aAAa;AAAA,EACnF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,SAAS,QAAQ,4BAA4B,OAAO,mBAAmB;AAAA,EACzF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,IAIE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,SAAS,QAAQ,uBAAuB,OAAO,0BAA0B;AAAA,EAC3F;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,SAAS,QAAQ,sBAAsB,OAAO,aAAa;AAAA,EAC7E;AAAA,EACA;AAAA;AAAA,IAEE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,SAAS,QAAQ,uBAAuB,OAAO,iBAAiB;AAAA,EAClF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,SAAS,QAAQ,0BAA0B,OAAO,yBAAyB;AAAA,EAC7F;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ,EAAE,MAAM,SAAS,QAAQ,6BAA6B,OAAO,WAAW;AAAA,EAClF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,gBAAgB,MAAM,EAAE;AAAA,IACjE,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,gBAAgB,MAAM,EAAE;AAAA,IACjE,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,oBAAoB;AAAA,IAC5D,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA;AAAA;AAAA,MAGR,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,oBAAoB;AAAA;AAAA,IAE5D,QAAQ,EAAE,MAAM,SAAS,QAAQ,aAAa,OAAO,SAAS;AAAA,EAChE;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,oBAAoB;AAAA,IAC5D,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,aAAa,MAAM,EAAE;AAAA,IAC9D,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,aAAa,MAAM,EAAE;AAAA,IAC9D,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA;AAAA,IAER,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,aAAa,QAAQ,kBAAkB,EAAE;AAAA,IAClF,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,aAAa,MAAM,EAAE;AAAA,IAC9D,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA,EAIA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,oBAAoB,EAAE;AAAA,IAC/D,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,GAAG,kBAAkB,EAAE;AAAA,IAChE,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA,EAIA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,kBAAkB,EAAE;AAAA,IAC7D,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,aAAa,QAAQ,CAAC,kBAAkB,EAAE;AAAA,IAC7D,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,gBAAgB;AAAA,IACnC,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA,IAC5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,SAAS;AAAA;AAAA;AAAA;AAAA,IAI5B,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,WAAW,EAAE,MAAM,UAAU,MAAM,YAAY;AAAA,IAC/C,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,CAAC,WAAW,SAAS;AAAA,IAC7B;AAAA,EACF;AACF;AAOO,IAAM,uBAA8C;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AACF;AASO,IAAM,6BAAoD;AAAA,EAC/D,GAAG;AAAA;AAAA,EAEH;AAAA;AAAA,EAEA;AACF;AAOO,IAAM,aAAwC,OAAO;AAAA,EAC1D,gBAAgB,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;AAC3C;AAGO,SAAS,eAAe,SAA4B;AACzD,SAAO,WAAW,OAAO,KAAK;AAChC;AAiBO,SAAS,mBACd,OACA,KAKS;AAET,MAAI,IAAI,cAAc,aAAa,SAAS,MAAM,EAAE,EAAG,QAAO;AAC9D,MAAI,IAAI,cAAc,aAAa,SAAS,MAAM,EAAE,EAAG,QAAO;AAM9D,MAAI,WAAW,MAAM,EAAE,MAAM,eAAgB,QAAO;AACpD,SAAO,iBAAiB,OAAO,GAAG;AACpC;AAMA,SAAS,iBACP,OACA,KACS;AACT,QAAM,OAAO,MAAM;AACnB,UAAQ,KAAK,MAAM;AAAA,IACjB,KAAK;AACH,aAAO,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,OAAO,SAAS,CAAC,CAAC;AAAA,IACvD,KAAK;AAGH,aAAO,YAAY,IAAI,MAAM;AAAA,IAC/B,KAAK;AACH,aAAO,IAAI,QAAQ,KAAK,IAAI,MAAM;AAAA,IACpC,KAAK;AAGH,aAAO;AAAA,EACX;AACF;AAQO,SAAS,gBACd,SACA,KAKS;AACT,QAAM,QAAQ,gBAAgB,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;AAC1D,SAAO,QAAQ,mBAAmB,OAAO,GAAG,IAAI;AAClD;AAOO,SAAS,4BAA4B,KAIX;AAC/B,SAAO,gBAAgB;AAAA,IACrB,CAAC,MACC,WAAW,EAAE,EAAE,MAAM,kBACrB,CAAC,IAAI,cAAc,aAAa,SAAS,EAAE,EAAE,KAC7C,iBAAiB,GAAG,GAAG;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,QACA,KAK8B;AAC9B,SAAO,OAAO,OAAO,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACxD;;;AE9oCA;AAUO,IAAM,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,kBAA4C;AAAA,EACvD,UAAU;AAAA,EACV,SAAS;AAAA,EACT,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA;AAAA,EAEb,eAAe;AAAA;AAAA,EAEf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,aAAa;AACf;","names":[]}