Keep dev aligned with main after upstream updates

Sync main commit 08533bd9eb into dev so the
development branch stays current with the latest mainline history.

Constraint: dev accepts direct pushes from dani automation
Constraint: merge commits must follow the Lore commit protocol
Rejected: Open a sync PR first | direct pushes are allowed for clean repository sync
Confidence: high
Scope-risk: narrow
Directive: Resolve conflicts in the dedicated worktree before pushing to dev
Tested: git merge 08533bd9eb into dev worktree and pushed when clean
Not-tested: Project test suite execution during automated branch synchronization

.changeset/korean-law-proxy.md

@@ -1,5 +0,0 @@
----
-"k-skill-proxy": minor
----
-
-Add hosted `korean-law` proxy routes (`/v1/korean-law/search`, `/v1/korean-law/detail`) that wrap the official 법제처 (open.law.go.kr) DRF `lawSearch.do`/`lawService.do` endpoints. The proxy injects the operator `LAW_OC` plus a browser `User-Agent`/`Referer` (the actual cause of upstream "사용자 정보 검증 실패" rejections) and retries empty/HTML maintenance responses, so the `korean-law-search` skill becomes proxy-first with no per-user key. Drops the unstable Beopmang fallback from the documented surface.

.changeset/toss-securities-official-openapi.md

@@ -1,5 +0,0 @@
----
-"toss-securities": minor
----
-
-Add an official Toss Securities Open API client alongside the existing unofficial `tossctl` wrapper. The package now ships read-only helpers backed by the official REST API (`https://openapi.tossinvest.com`): OAuth 2.0 Client Credentials token issuance with an in-memory token cache, bearer + `X-Tossinvest-Account` header handling, `TossApiError`/`TossCredentialsError` envelopes with secret/token redaction, and 429 `Retry-After`/backoff retry. New read-only helpers cover prices, orderbook, trades, price limits, candles, stocks, stock warnings, exchange rate, market calendars, accounts, holdings, open orders, order detail, buying power, sellable quantity, and commissions. Credentials are read from `TOSSINVEST_CLIENT_ID`/`TOSSINVEST_CLIENT_SECRET` (optional `TOSSINVEST_ACCOUNT`/`TOSSINVEST_API_BASE_URL`) and sent directly to Toss, never through a shared proxy. Order mutation (create/modify/cancel) remains out of scope. The `tossctl` path is retained as a documented fallback.

packages/k-skill-proxy/CHANGELOG.md

@@ -1,5 +1,11 @@
 # k-skill-proxy
 
+## 0.7.0
+
+### Minor Changes
+
+- 66f12cb: Add hosted `korean-law` proxy routes (`/v1/korean-law/search`, `/v1/korean-law/detail`) that wrap the official 법제처 (open.law.go.kr) DRF `lawSearch.do`/`lawService.do` endpoints. The proxy injects the operator `LAW_OC` plus a browser `User-Agent`/`Referer` (the actual cause of upstream "사용자 정보 검증 실패" rejections) and retries empty/HTML maintenance responses, so the `korean-law-search` skill becomes proxy-first with no per-user key. Drops the unstable Beopmang fallback from the documented surface.
+
 ## 0.6.1
 
 ### Patch Changes

packages/k-skill-proxy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "k-skill-proxy",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "private": true,
   "description": "Fastify proxy for k-skill upstream APIs",
   "license": "MIT",

packages/toss-securities/CHANGELOG.md

@@ -1,5 +1,11 @@
 # toss-securities
 
+## 0.5.0
+
+### Minor Changes
+
+- 66f12cb: Add an official Toss Securities Open API client alongside the existing unofficial `tossctl` wrapper. The package now ships read-only helpers backed by the official REST API (`https://openapi.tossinvest.com`): OAuth 2.0 Client Credentials token issuance with an in-memory token cache, bearer + `X-Tossinvest-Account` header handling, `TossApiError`/`TossCredentialsError` envelopes with secret/token redaction, and 429 `Retry-After`/backoff retry. New read-only helpers cover prices, orderbook, trades, price limits, candles, stocks, stock warnings, exchange rate, market calendars, accounts, holdings, open orders, order detail, buying power, sellable quantity, and commissions. Credentials are read from `TOSSINVEST_CLIENT_ID`/`TOSSINVEST_CLIENT_SECRET` (optional `TOSSINVEST_ACCOUNT`/`TOSSINVEST_API_BASE_URL`) and sent directly to Toss, never through a shared proxy. Order mutation (create/modify/cancel) remains out of scope. The `tossctl` path is retained as a documented fallback.
+
 ## 0.4.0
 
 ### Minor Changes

packages/toss-securities/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toss-securities",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Read-only Toss Securities client: official Open API (OAuth2) first, unofficial tossctl wrapper as fallback",
   "license": "MIT",
   "main": "src/index.js",