@agenticmail/enterprise 0.3.2 → 0.4.0

package/dist/chunk-LKAFZ343.js

@@ -0,0 +1,591 @@
+import {
+  ENTERPRISE_SKILL_DEFS,
+  GWS_SKILL_DEFS,
+  M365_SKILL_DEFS,
+  init_skills,
+  init_tool_catalog,
+  tool_catalog_exports
+} from "./chunk-X6UVWFHW.js";
+import {
+  __toCommonJS
+} from "./chunk-KFQGP6VL.js";
+
+// src/engine/skills.ts
+init_skills();
+var SKILL_SUITES = [
+  {
+    id: "microsoft-365",
+    name: "Microsoft 365",
+    description: "Complete Microsoft 365 suite \u2014 Outlook, Teams, SharePoint, OneDrive, Word, Excel, PowerPoint, OneNote, Planner, Power BI, Power Automate, Forms, To Do, Bookings, Whiteboard, Admin Center, Copilot.",
+    icon: "\u{1F3E2}",
+    skills: [
+      "m365-outlook",
+      "m365-teams",
+      "m365-sharepoint",
+      "m365-onedrive",
+      "m365-word",
+      "m365-excel",
+      "m365-powerpoint",
+      "m365-onenote",
+      "m365-planner",
+      "m365-power-bi",
+      "m365-power-automate",
+      "m365-forms",
+      "m365-todo",
+      "m365-bookings",
+      "m365-whiteboard",
+      "m365-admin",
+      "m365-copilot"
+    ]
+  },
+  {
+    id: "google-workspace",
+    name: "Google Workspace",
+    description: "Complete Google Workspace suite \u2014 Gmail, Calendar, Drive, Docs, Sheets, Slides, Meet, Chat, Forms, Sites, Keep, Admin Console, Vault, Groups.",
+    icon: "\u{1F535}",
+    skills: [
+      "gws-gmail",
+      "gws-calendar",
+      "gws-drive",
+      "gws-docs",
+      "gws-sheets",
+      "gws-slides",
+      "gws-meet",
+      "gws-chat",
+      "gws-forms",
+      "gws-sites",
+      "gws-keep",
+      "gws-admin",
+      "gws-vault",
+      "gws-groups"
+    ]
+  },
+  {
+    id: "atlassian",
+    name: "Atlassian Suite",
+    description: "Jira, Confluence, Bitbucket, Trello, Statuspage, and Opsgenie.",
+    icon: "\u{1F537}",
+    skills: ["jira", "confluence", "bitbucket", "trello", "statuspage", "opsgenie"]
+  },
+  {
+    id: "aws",
+    name: "Amazon Web Services",
+    description: "AWS cloud infrastructure \u2014 S3, EC2, Lambda, RDS, CloudWatch, IAM, SES, SNS, SQS, DynamoDB, CloudFormation.",
+    icon: "\u2601\uFE0F",
+    skills: ["aws-s3", "aws-ec2", "aws-lambda", "aws-rds", "aws-cloudwatch", "aws-iam", "aws-ses", "aws-sns", "aws-sqs", "aws-dynamodb", "aws-cloudformation"]
+  },
+  {
+    id: "azure",
+    name: "Microsoft Azure",
+    description: "Azure cloud infrastructure \u2014 VMs, App Service, Functions, Storage, SQL, CosmosDB, DevOps, Active Directory.",
+    icon: "\u26C5",
+    skills: ["azure-vms", "azure-app-service", "azure-functions", "azure-storage", "azure-sql", "azure-cosmosdb", "azure-devops", "azure-ad"]
+  },
+  {
+    id: "gcp",
+    name: "Google Cloud Platform",
+    description: "GCP cloud infrastructure \u2014 Compute Engine, Cloud Functions, Cloud Storage, BigQuery, Cloud Run, Pub/Sub, Firestore.",
+    icon: "\u{1F324}\uFE0F",
+    skills: ["gcp-compute", "gcp-functions", "gcp-storage", "gcp-bigquery", "gcp-run", "gcp-pubsub", "gcp-firestore"]
+  },
+  {
+    id: "salesforce-suite",
+    name: "Salesforce Suite",
+    description: "Salesforce CRM, Service Cloud, Marketing Cloud, and Commerce Cloud.",
+    icon: "\u2601",
+    skills: ["salesforce", "salesforce-service", "salesforce-marketing", "salesforce-commerce"]
+  },
+  {
+    id: "hubspot-suite",
+    name: "HubSpot Suite",
+    description: "HubSpot CRM, Marketing Hub, Sales Hub, Service Hub, and CMS.",
+    icon: "\u{1F7E0}",
+    skills: ["hubspot-crm", "hubspot-marketing", "hubspot-sales", "hubspot-service"]
+  },
+  {
+    id: "adobe-creative",
+    name: "Adobe Creative Cloud",
+    description: "Adobe Photoshop, Illustrator, Premiere Pro, After Effects, InDesign, and XD.",
+    icon: "\u{1F3A8}",
+    skills: ["adobe-photoshop", "adobe-illustrator", "adobe-premiere", "adobe-after-effects", "adobe-indesign", "adobe-xd"]
+  },
+  {
+    id: "enterprise-utility",
+    name: "Enterprise Utility Tools",
+    description: "Built-in enterprise productivity tools \u2014 database queries, spreadsheets, documents, calendar, knowledge search, web research, translation, logs, workflow, notifications, finance, HTTP, security scanning, code sandbox, diff, and vision.",
+    icon: "\u{1F3D7}\uFE0F",
+    skills: [
+      "enterprise-database",
+      "enterprise-spreadsheet",
+      "enterprise-documents",
+      "enterprise-calendar",
+      "enterprise-knowledge-search",
+      "enterprise-web-research",
+      "enterprise-translation",
+      "enterprise-logs",
+      "enterprise-workflow",
+      "enterprise-notifications",
+      "enterprise-finance",
+      "enterprise-http",
+      "enterprise-security-scan",
+      "enterprise-code-sandbox",
+      "enterprise-diff",
+      "enterprise-vision"
+    ]
+  }
+];
+var PRESET_PROFILES = [
+  {
+    name: "Research Assistant",
+    description: "Can search the web, read files, and summarize content. Cannot send messages, run code, or modify anything.",
+    skills: { mode: "allowlist", list: ["research", "summarize", "data-read"] },
+    tools: { blocked: ["exec", "write", "edit"], allowed: ["web_search", "web_fetch", "read", "memory_search", "memory_get"] },
+    maxRiskLevel: "low",
+    blockedSideEffects: ["sends-email", "sends-message", "sends-sms", "posts-social", "runs-code", "modifies-files", "deletes-data", "controls-device", "financial"],
+    requireApproval: { enabled: false, forRiskLevels: [], forSideEffects: [], approvers: [], timeoutMinutes: 30 },
+    rateLimits: { toolCallsPerMinute: 30, toolCallsPerHour: 500, toolCallsPerDay: 5e3, externalActionsPerHour: 0 },
+    constraints: { maxConcurrentTasks: 3, maxSessionDurationMinutes: 480, sandboxMode: false }
+  },
+  {
+    name: "Customer Support Agent",
+    description: "Can read/send emails, search knowledge base, and manage tickets. Cannot run code or access files.",
+    skills: { mode: "allowlist", list: ["communication", "research", "agenticmail", "m365-outlook", "m365-teams", "gws-gmail", "gws-calendar", "zendesk", "intercom"] },
+    tools: { blocked: ["exec", "browser", "write", "edit"], allowed: ["agenticmail_send", "agenticmail_reply", "agenticmail_inbox", "agenticmail_read", "agenticmail_search", "web_search", "web_fetch"] },
+    maxRiskLevel: "medium",
+    blockedSideEffects: ["runs-code", "modifies-files", "deletes-data", "controls-device", "financial", "posts-social"],
+    requireApproval: { enabled: true, forRiskLevels: ["high", "critical"], forSideEffects: ["sends-email"], approvers: [], timeoutMinutes: 60 },
+    rateLimits: { toolCallsPerMinute: 20, toolCallsPerHour: 300, toolCallsPerDay: 3e3, externalActionsPerHour: 50 },
+    constraints: { maxConcurrentTasks: 5, maxSessionDurationMinutes: 480, sandboxMode: false }
+  },
+  {
+    name: "Developer Assistant",
+    description: "Full development capabilities: code, git, GitHub, shell. Cannot send external messages or access smart home.",
+    skills: { mode: "allowlist", list: ["development", "github", "coding-agent", "research", "data", "docker", "github-actions", "jira", "linear", "slack"] },
+    tools: { blocked: ["agenticmail_send", "message", "tts", "nodes"], allowed: ["exec", "read", "write", "edit", "web_search", "web_fetch", "browser"] },
+    maxRiskLevel: "high",
+    blockedSideEffects: ["sends-email", "sends-message", "sends-sms", "posts-social", "controls-device", "financial"],
+    requireApproval: { enabled: true, forRiskLevels: ["critical"], forSideEffects: [], approvers: [], timeoutMinutes: 15 },
+    rateLimits: { toolCallsPerMinute: 60, toolCallsPerHour: 1e3, toolCallsPerDay: 1e4, externalActionsPerHour: 100 },
+    constraints: { maxConcurrentTasks: 3, maxSessionDurationMinutes: 720, sandboxMode: false }
+  },
+  {
+    name: "Full Access (Owner)",
+    description: "Unrestricted access to all skills and tools. Use with caution.",
+    skills: { mode: "blocklist", list: [] },
+    tools: { blocked: [], allowed: [] },
+    maxRiskLevel: "critical",
+    blockedSideEffects: [],
+    requireApproval: { enabled: false, forRiskLevels: [], forSideEffects: [], approvers: [], timeoutMinutes: 30 },
+    rateLimits: { toolCallsPerMinute: 120, toolCallsPerHour: 5e3, toolCallsPerDay: 5e4, externalActionsPerHour: 500 },
+    constraints: { maxConcurrentTasks: 10, maxSessionDurationMinutes: 1440, sandboxMode: false }
+  },
+  {
+    name: "Sandbox (Testing)",
+    description: "All tools available but in simulation mode. No real external actions are taken.",
+    skills: { mode: "blocklist", list: [] },
+    tools: { blocked: [], allowed: [] },
+    maxRiskLevel: "critical",
+    blockedSideEffects: [],
+    requireApproval: { enabled: false, forRiskLevels: [], forSideEffects: [], approvers: [], timeoutMinutes: 30 },
+    rateLimits: { toolCallsPerMinute: 60, toolCallsPerHour: 1e3, toolCallsPerDay: 1e4, externalActionsPerHour: 500 },
+    constraints: { maxConcurrentTasks: 5, maxSessionDurationMinutes: 480, sandboxMode: true }
+  }
+];
+var BUILTIN_SKILLS = [
+  // Communication
+  { id: "agenticmail", name: "AgenticMail", description: "Full email system \u2014 send, receive, organize, search, forward, reply. Agent-to-agent messaging and task delegation.", category: "communication", risk: "medium", icon: "\u{1F4E7}", source: "builtin" },
+  { id: "imsg", name: "iMessage", description: "Send and receive iMessages and SMS via macOS.", category: "communication", risk: "high", icon: "\u{1F4AC}", source: "builtin", requires: ["macos"] },
+  { id: "wacli", name: "WhatsApp", description: "Send WhatsApp messages and search chat history.", category: "communication", risk: "high", icon: "\u{1F4F1}", source: "builtin" },
+  // Development
+  { id: "github", name: "GitHub", description: "Manage issues, PRs, CI runs, and repositories via gh CLI.", category: "development", risk: "medium", icon: "\u{1F419}", source: "builtin" },
+  { id: "coding-agent", name: "Coding Agent", description: "Run Codex CLI, Claude Code, or other coding agents as background processes.", category: "development", risk: "high", icon: "\u{1F4BB}", source: "builtin" },
+  // Productivity
+  { id: "gog", name: "Google Workspace", description: "Gmail, Calendar, Drive, Contacts, Sheets, and Docs.", category: "productivity", risk: "medium", icon: "\u{1F4C5}", source: "builtin" },
+  { id: "apple-notes", name: "Apple Notes", description: "Create, search, edit, and manage Apple Notes.", category: "productivity", risk: "low", icon: "\u{1F4DD}", source: "builtin", requires: ["macos"] },
+  { id: "apple-reminders", name: "Apple Reminders", description: "Manage Apple Reminders lists and items.", category: "productivity", risk: "low", icon: "\u2705", source: "builtin", requires: ["macos"] },
+  { id: "bear-notes", name: "Bear Notes", description: "Create, search, and manage Bear notes.", category: "productivity", risk: "low", icon: "\u{1F43B}", source: "builtin", requires: ["macos"] },
+  { id: "obsidian", name: "Obsidian", description: "Work with Obsidian vaults and automate via CLI.", category: "productivity", risk: "low", icon: "\u{1F48E}", source: "builtin" },
+  { id: "things-mac", name: "Things 3", description: "Manage tasks and projects in Things 3.", category: "productivity", risk: "low", icon: "\u2611\uFE0F", source: "builtin", requires: ["macos"] },
+  // Research
+  { id: "web-search", name: "Web Search", description: "Search the web via Brave Search API.", category: "research", risk: "low", icon: "\u{1F50D}", source: "builtin" },
+  { id: "web-fetch", name: "Web Fetch", description: "Fetch and extract readable content from URLs.", category: "research", risk: "low", icon: "\u{1F310}", source: "builtin" },
+  { id: "summarize", name: "Summarize", description: "Summarize or transcribe URLs, podcasts, and files.", category: "research", risk: "low", icon: "\u{1F4C4}", source: "builtin" },
+  { id: "blogwatcher", name: "Blog Watcher", description: "Monitor blogs and RSS/Atom feeds for updates.", category: "research", risk: "low", icon: "\u{1F4E1}", source: "builtin" },
+  // Media
+  { id: "openai-image-gen", name: "Image Generation", description: "Generate images via OpenAI Images API.", category: "media", risk: "low", icon: "\u{1F3A8}", source: "builtin" },
+  { id: "nano-banana-pro", name: "Gemini Image", description: "Generate or edit images via Gemini 3 Pro.", category: "media", risk: "low", icon: "\u{1F5BC}\uFE0F", source: "builtin" },
+  { id: "tts", name: "Text-to-Speech", description: "Convert text to speech audio.", category: "media", risk: "low", icon: "\u{1F50A}", source: "builtin" },
+  { id: "openai-whisper", name: "Whisper Transcription", description: "Transcribe audio via OpenAI Whisper API.", category: "media", risk: "low", icon: "\u{1F399}\uFE0F", source: "builtin" },
+  { id: "video-frames", name: "Video Frames", description: "Extract frames or clips from videos.", category: "media", risk: "low", icon: "\u{1F3AC}", source: "builtin" },
+  { id: "gifgrep", name: "GIF Search", description: "Search and download GIFs.", category: "media", risk: "low", icon: "\u{1F3AD}", source: "builtin" },
+  // Automation
+  { id: "browser", name: "Browser Control", description: "Automate web browsers \u2014 navigate, click, type, screenshot.", category: "automation", risk: "high", icon: "\u{1F30D}", source: "builtin" },
+  { id: "exec", name: "Shell Commands", description: "Execute shell commands on the host machine.", category: "automation", risk: "critical", icon: "\u26A1", source: "builtin" },
+  { id: "peekaboo", name: "macOS UI Automation", description: "Capture and automate macOS UI with Peekaboo.", category: "automation", risk: "high", icon: "\u{1F441}\uFE0F", source: "builtin", requires: ["macos"] },
+  { id: "cron", name: "Scheduled Tasks", description: "Create and manage cron jobs and reminders.", category: "automation", risk: "medium", icon: "\u23F0", source: "builtin" },
+  // Smart Home
+  { id: "openhue", name: "Philips Hue", description: "Control Hue lights and scenes.", category: "smart-home", risk: "low", icon: "\u{1F4A1}", source: "builtin" },
+  { id: "sonoscli", name: "Sonos", description: "Control Sonos speakers.", category: "smart-home", risk: "low", icon: "\u{1F508}", source: "builtin" },
+  { id: "blucli", name: "BluOS", description: "Control BluOS speakers.", category: "smart-home", risk: "low", icon: "\u{1F3B5}", source: "builtin" },
+  { id: "eightctl", name: "Eight Sleep", description: "Control Eight Sleep pod temperature and alarms.", category: "smart-home", risk: "low", icon: "\u{1F6CF}\uFE0F", source: "builtin" },
+  { id: "camsnap", name: "IP Cameras", description: "Capture frames from RTSP/ONVIF cameras.", category: "smart-home", risk: "medium", icon: "\u{1F4F7}", source: "builtin" },
+  // Data
+  { id: "files", name: "File System", description: "Read, write, and edit files on the host.", category: "data", risk: "medium", icon: "\u{1F4C1}", source: "builtin" },
+  { id: "memory", name: "Agent Memory", description: "Persistent memory search and storage.", category: "data", risk: "low", icon: "\u{1F9E0}", source: "builtin" },
+  // Security
+  { id: "1password", name: "1Password", description: "Read and manage secrets via 1Password CLI.", category: "security", risk: "critical", icon: "\u{1F510}", source: "builtin" },
+  { id: "healthcheck", name: "Security Audit", description: "Host security hardening and risk checks.", category: "security", risk: "medium", icon: "\u{1F6E1}\uFE0F", source: "builtin" },
+  // Social
+  { id: "twitter", name: "Twitter/X", description: "Post tweets, read timeline, manage social presence.", category: "social", risk: "high", icon: "\u{1F426}", source: "builtin" },
+  // Platform
+  { id: "gateway", name: "Agent Runtime Gateway", description: "Restart, configure, and update the agent runtime gateway.", category: "platform", risk: "critical", icon: "\u2699\uFE0F", source: "builtin" },
+  { id: "sessions", name: "Session Management", description: "Spawn sub-agents, list sessions, send messages between sessions.", category: "platform", risk: "medium", icon: "\u{1F504}", source: "builtin" },
+  { id: "nodes", name: "Node Control", description: "Discover and control paired devices (camera, screen, location).", category: "platform", risk: "high", icon: "\u{1F4E1}", source: "builtin" },
+  // ─── Microsoft 365 (from individual skill files) ────────
+  ...M365_SKILL_DEFS,
+  // ─── Google Workspace (from individual skill files) ─────
+  ...GWS_SKILL_DEFS,
+  // ─── Collaboration ──────────────────────────────────────
+  { id: "slack", name: "Slack", description: "Messaging, channels, threads, apps, workflows, and Slack Connect.", category: "collaboration", risk: "medium", icon: "\u{1F4AC}", source: "builtin" },
+  { id: "zoom", name: "Zoom", description: "Video meetings, webinars, recordings, scheduling, and Zoom Phone.", category: "collaboration", risk: "medium", icon: "\u{1F4F9}", source: "builtin" },
+  { id: "discord", name: "Discord", description: "Messaging, voice channels, bots, and server management.", category: "collaboration", risk: "medium", icon: "\u{1F3AE}", source: "builtin" },
+  { id: "webex", name: "Webex", description: "Cisco Webex meetings, messaging, calling, and device management.", category: "collaboration", risk: "medium", icon: "\u{1F4DE}", source: "builtin" },
+  { id: "mattermost", name: "Mattermost", description: "Open-source team messaging, channels, and integrations.", category: "collaboration", risk: "medium", icon: "\u{1F4AD}", source: "builtin" },
+  // ─── CRM ────────────────────────────────────────────────
+  { id: "salesforce", name: "Salesforce CRM", description: "Leads, contacts, opportunities, accounts, cases, and custom objects.", category: "crm", risk: "medium", icon: "\u2601\uFE0F", source: "builtin" },
+  { id: "salesforce-service", name: "Salesforce Service Cloud", description: "Case management, knowledge base, service console, and omni-channel routing.", category: "customer-support", risk: "medium", icon: "\u{1F3A7}", source: "builtin" },
+  { id: "salesforce-marketing", name: "Salesforce Marketing Cloud", description: "Email campaigns, journeys, audiences, and marketing automation.", category: "marketing", risk: "medium", icon: "\u{1F4E3}", source: "builtin" },
+  { id: "salesforce-commerce", name: "Salesforce Commerce Cloud", description: "Online storefronts, product catalogs, orders, and customer data.", category: "ecommerce", risk: "medium", icon: "\u{1F6D2}", source: "builtin" },
+  { id: "hubspot-crm", name: "HubSpot CRM", description: "Contacts, deals, companies, tickets, and pipeline management.", category: "crm", risk: "medium", icon: "\u{1F7E0}", source: "builtin" },
+  { id: "hubspot-marketing", name: "HubSpot Marketing", description: "Email marketing, landing pages, forms, workflows, and analytics.", category: "marketing", risk: "medium", icon: "\u{1F4E7}", source: "builtin" },
+  { id: "hubspot-sales", name: "HubSpot Sales", description: "Sales pipeline, sequences, meetings, quotes, and call tracking.", category: "crm", risk: "medium", icon: "\u{1F4B0}", source: "builtin" },
+  { id: "hubspot-service", name: "HubSpot Service", description: "Help desk, tickets, knowledge base, customer feedback, and live chat.", category: "customer-support", risk: "medium", icon: "\u{1F3AF}", source: "builtin" },
+  { id: "pipedrive", name: "Pipedrive", description: "Sales CRM \u2014 deals, contacts, activities, and pipeline visualization.", category: "crm", risk: "medium", icon: "\u{1F517}", source: "builtin" },
+  { id: "zoho-crm", name: "Zoho CRM", description: "Leads, contacts, deals, workflows, and custom modules.", category: "crm", risk: "medium", icon: "\u{1F7E1}", source: "builtin" },
+  // ─── Project Management ─────────────────────────────────
+  { id: "jira", name: "Jira", description: "Issues, sprints, boards, backlogs, epics, and agile project management.", category: "project-management", risk: "medium", icon: "\u{1F537}", source: "builtin" },
+  { id: "confluence", name: "Confluence", description: "Wiki pages, spaces, templates, comments, and knowledge management.", category: "project-management", risk: "medium", icon: "\u{1F4D6}", source: "builtin" },
+  { id: "asana", name: "Asana", description: "Tasks, projects, timelines, portfolios, and workload management.", category: "project-management", risk: "medium", icon: "\u{1F534}", source: "builtin" },
+  { id: "monday", name: "Monday.com", description: "Boards, items, automations, dashboards, and work management.", category: "project-management", risk: "medium", icon: "\u{1F7E3}", source: "builtin" },
+  { id: "notion", name: "Notion", description: "Pages, databases, wikis, templates, and all-in-one workspace.", category: "project-management", risk: "medium", icon: "\u{1F4D3}", source: "builtin" },
+  { id: "linear", name: "Linear", description: "Issue tracking, cycles, projects, roadmaps, and triage.", category: "project-management", risk: "medium", icon: "\u{1F7EA}", source: "builtin" },
+  { id: "trello", name: "Trello", description: "Boards, cards, lists, checklists, and power-ups.", category: "project-management", risk: "low", icon: "\u{1F4CC}", source: "builtin" },
+  { id: "clickup", name: "ClickUp", description: "Tasks, docs, whiteboards, goals, and time tracking.", category: "project-management", risk: "medium", icon: "\u2B06\uFE0F", source: "builtin" },
+  { id: "basecamp", name: "Basecamp", description: "Projects, message boards, to-dos, schedules, and campfires.", category: "project-management", risk: "low", icon: "\u{1F3D5}\uFE0F", source: "builtin" },
+  { id: "airtable", name: "Airtable", description: "Spreadsheet-database hybrid with views, automations, and apps.", category: "project-management", risk: "medium", icon: "\u{1F5C3}\uFE0F", source: "builtin" },
+  // ─── Customer Support ───────────────────────────────────
+  { id: "zendesk", name: "Zendesk", description: "Tickets, help center, chat, talk, and customer analytics.", category: "customer-support", risk: "medium", icon: "\u{1F3A7}", source: "builtin" },
+  { id: "intercom", name: "Intercom", description: "Live chat, inbox, help center, bots, and product tours.", category: "customer-support", risk: "medium", icon: "\u{1F4AC}", source: "builtin" },
+  { id: "freshdesk", name: "Freshdesk", description: "Tickets, automations, SLA management, and customer portal.", category: "customer-support", risk: "medium", icon: "\u{1F7E2}", source: "builtin" },
+  { id: "servicenow", name: "ServiceNow", description: "IT service management, incidents, changes, assets, and workflows.", category: "customer-support", risk: "high", icon: "\u{1F527}", source: "builtin" },
+  { id: "front", name: "Front", description: "Shared inbox, assignments, SLAs, tags, and team collaboration.", category: "customer-support", risk: "medium", icon: "\u{1F4EE}", source: "builtin" },
+  // ─── Cloud Infrastructure — AWS ─────────────────────────
+  { id: "aws-s3", name: "AWS S3", description: "Object storage \u2014 buckets, objects, permissions, lifecycle policies.", category: "cloud-infrastructure", risk: "medium", icon: "\u{1FAA3}", source: "builtin" },
+  { id: "aws-ec2", name: "AWS EC2", description: "Virtual machines \u2014 instances, AMIs, security groups, EBS volumes.", category: "cloud-infrastructure", risk: "high", icon: "\u{1F5A5}\uFE0F", source: "builtin" },
+  { id: "aws-lambda", name: "AWS Lambda", description: "Serverless functions \u2014 deployment, invocation, layers, event triggers.", category: "cloud-infrastructure", risk: "high", icon: "\u03BB", source: "builtin" },
+  { id: "aws-rds", name: "AWS RDS", description: "Managed databases \u2014 instances, snapshots, parameter groups, and read replicas.", category: "database", risk: "high", icon: "\u{1F5C4}\uFE0F", source: "builtin" },
+  { id: "aws-cloudwatch", name: "AWS CloudWatch", description: "Monitoring, logs, alarms, dashboards, and metrics.", category: "monitoring", risk: "low", icon: "\u{1F441}\uFE0F", source: "builtin" },
+  { id: "aws-iam", name: "AWS IAM", description: "Identity and access management \u2014 users, roles, policies, and MFA.", category: "security", risk: "critical", icon: "\u{1F511}", source: "builtin" },
+  { id: "aws-ses", name: "AWS SES", description: "Simple Email Service \u2014 send, receive, templates, and domain verification.", category: "communication", risk: "medium", icon: "\u{1F4E7}", source: "builtin" },
+  { id: "aws-sns", name: "AWS SNS", description: "Simple Notification Service \u2014 topics, subscriptions, push notifications.", category: "communication", risk: "medium", icon: "\u{1F514}", source: "builtin" },
+  { id: "aws-sqs", name: "AWS SQS", description: "Simple Queue Service \u2014 queues, messages, dead letter queues.", category: "cloud-infrastructure", risk: "medium", icon: "\u{1F4E8}", source: "builtin" },
+  { id: "aws-dynamodb", name: "AWS DynamoDB", description: "NoSQL database \u2014 tables, items, indexes, and streams.", category: "database", risk: "medium", icon: "\u26A1", source: "builtin" },
+  { id: "aws-cloudformation", name: "AWS CloudFormation", description: "Infrastructure as code \u2014 stacks, templates, change sets.", category: "devops", risk: "high", icon: "\u{1F3D7}\uFE0F", source: "builtin" },
+  // ─── Cloud Infrastructure — Azure ───────────────────────
+  { id: "azure-vms", name: "Azure VMs", description: "Virtual machines, scale sets, images, and managed disks.", category: "cloud-infrastructure", risk: "high", icon: "\u{1F5A5}\uFE0F", source: "builtin" },
+  { id: "azure-app-service", name: "Azure App Service", description: "Web apps, APIs, mobile backends, and deployment slots.", category: "cloud-infrastructure", risk: "medium", icon: "\u{1F310}", source: "builtin" },
+  { id: "azure-functions", name: "Azure Functions", description: "Serverless compute \u2014 triggers, bindings, and durable functions.", category: "cloud-infrastructure", risk: "high", icon: "\u0192", source: "builtin" },
+  { id: "azure-storage", name: "Azure Storage", description: "Blobs, files, queues, tables, and data lake storage.", category: "storage", risk: "medium", icon: "\u{1F4BE}", source: "builtin" },
+  { id: "azure-sql", name: "Azure SQL", description: "Managed SQL databases, elastic pools, and server management.", category: "database", risk: "high", icon: "\u{1F5C4}\uFE0F", source: "builtin" },
+  { id: "azure-cosmosdb", name: "Azure Cosmos DB", description: "Globally distributed NoSQL database with multiple APIs.", category: "database", risk: "medium", icon: "\u{1F30D}", source: "builtin" },
+  { id: "azure-devops", name: "Azure DevOps", description: "Boards, repos, pipelines, test plans, and artifacts.", category: "devops", risk: "medium", icon: "\u{1F537}", source: "builtin" },
+  { id: "azure-ad", name: "Azure Active Directory", description: "Identity management, SSO, conditional access, and app registrations.", category: "security", risk: "critical", icon: "\u{1F510}", source: "builtin" },
+  // ─── Cloud Infrastructure — GCP ─────────────────────────
+  { id: "gcp-compute", name: "GCP Compute Engine", description: "Virtual machines, instance groups, and persistent disks.", category: "cloud-infrastructure", risk: "high", icon: "\u{1F5A5}\uFE0F", source: "builtin" },
+  { id: "gcp-functions", name: "GCP Cloud Functions", description: "Serverless functions with event triggers.", category: "cloud-infrastructure", risk: "high", icon: "\u0192", source: "builtin" },
+  { id: "gcp-storage", name: "GCP Cloud Storage", description: "Object storage buckets, objects, and lifecycle management.", category: "storage", risk: "medium", icon: "\u{1FAA3}", source: "builtin" },
+  { id: "gcp-bigquery", name: "BigQuery", description: "Data warehouse \u2014 SQL queries, datasets, tables, and ML models.", category: "analytics", risk: "medium", icon: "\u{1F4CA}", source: "builtin" },
+  { id: "gcp-run", name: "GCP Cloud Run", description: "Serverless containers \u2014 deploy, manage, and auto-scale.", category: "cloud-infrastructure", risk: "high", icon: "\u{1F3C3}", source: "builtin" },
+  { id: "gcp-pubsub", name: "GCP Pub/Sub", description: "Messaging and event streaming \u2014 topics and subscriptions.", category: "cloud-infrastructure", risk: "medium", icon: "\u{1F4E8}", source: "builtin" },
+  { id: "gcp-firestore", name: "Firestore", description: "NoSQL document database with real-time sync.", category: "database", risk: "medium", icon: "\u{1F525}", source: "builtin" },
+  // ─── DevOps & CI/CD ─────────────────────────────────────
+  { id: "docker", name: "Docker", description: "Container management \u2014 images, containers, compose, and registries.", category: "devops", risk: "high", icon: "\u{1F433}", source: "builtin" },
+  { id: "kubernetes", name: "Kubernetes", description: "Container orchestration \u2014 pods, deployments, services, and helm charts.", category: "devops", risk: "high", icon: "\u2638\uFE0F", source: "builtin" },
+  { id: "terraform", name: "Terraform", description: "Infrastructure as code \u2014 plan, apply, state management, and modules.", category: "devops", risk: "high", icon: "\u{1F3D7}\uFE0F", source: "builtin" },
+  { id: "ansible", name: "Ansible", description: "Configuration management \u2014 playbooks, roles, and inventories.", category: "devops", risk: "high", icon: "\u{1F4DC}", source: "builtin" },
+  { id: "github-actions", name: "GitHub Actions", description: "CI/CD workflows, actions marketplace, and secrets management.", category: "devops", risk: "medium", icon: "\u2699\uFE0F", source: "builtin" },
+  { id: "gitlab-ci", name: "GitLab CI/CD", description: "Pipelines, runners, artifacts, environments, and deployments.", category: "devops", risk: "medium", icon: "\u{1F98A}", source: "builtin" },
+  { id: "jenkins", name: "Jenkins", description: "Build automation \u2014 jobs, pipelines, plugins, and agents.", category: "devops", risk: "medium", icon: "\u{1F3D7}\uFE0F", source: "builtin" },
+  { id: "circleci", name: "CircleCI", description: "CI/CD pipelines, orbs, caching, and test splitting.", category: "devops", risk: "medium", icon: "\u2B55", source: "builtin" },
+  { id: "bitbucket", name: "Bitbucket", description: "Git repositories, pull requests, code review, and pipelines.", category: "development", risk: "medium", icon: "\u{1F535}", source: "builtin" },
+  { id: "gitlab", name: "GitLab", description: "Repositories, merge requests, issues, and DevSecOps platform.", category: "development", risk: "medium", icon: "\u{1F98A}", source: "builtin" },
+  { id: "vercel", name: "Vercel", description: "Frontend deployment, serverless functions, edge config, and analytics.", category: "devops", risk: "medium", icon: "\u25B2", source: "builtin" },
+  { id: "netlify", name: "Netlify", description: "Web deployment, forms, identity, functions, and edge handlers.", category: "devops", risk: "medium", icon: "\u{1F310}", source: "builtin" },
+  // ─── Finance & Payments ─────────────────────────────────
+  { id: "stripe", name: "Stripe", description: "Payments, subscriptions, invoices, customers, and financial reports.", category: "finance", risk: "high", icon: "\u{1F4B3}", source: "builtin" },
+  { id: "quickbooks", name: "QuickBooks", description: "Accounting \u2014 invoices, expenses, reports, payroll, and bank reconciliation.", category: "finance", risk: "high", icon: "\u{1F4D2}", source: "builtin" },
+  { id: "xero", name: "Xero", description: "Cloud accounting \u2014 invoicing, bank feeds, reporting, and payroll.", category: "finance", risk: "high", icon: "\u{1F4D7}", source: "builtin" },
+  { id: "freshbooks", name: "FreshBooks", description: "Invoicing, time tracking, expenses, and financial reports.", category: "finance", risk: "medium", icon: "\u{1F4D8}", source: "builtin" },
+  { id: "paypal", name: "PayPal", description: "Payments, invoices, subscriptions, and disputes.", category: "finance", risk: "high", icon: "\u{1F4B0}", source: "builtin" },
+  { id: "wise", name: "Wise", description: "International transfers, multi-currency accounts, and batch payments.", category: "finance", risk: "high", icon: "\u{1F30D}", source: "builtin" },
+  { id: "plaid", name: "Plaid", description: "Bank connections, account data, transactions, and identity verification.", category: "finance", risk: "critical", icon: "\u{1F3E6}", source: "builtin" },
+  // ─── Analytics & BI ─────────────────────────────────────
+  { id: "tableau", name: "Tableau", description: "Data visualization, dashboards, workbooks, and data sources.", category: "analytics", risk: "medium", icon: "\u{1F4CA}", source: "builtin" },
+  { id: "looker", name: "Looker", description: "Business intelligence \u2014 explores, dashboards, LookML, and scheduling.", category: "analytics", risk: "medium", icon: "\u{1F50D}", source: "builtin" },
+  { id: "mixpanel", name: "Mixpanel", description: "Product analytics \u2014 events, funnels, retention, and user profiles.", category: "analytics", risk: "low", icon: "\u{1F4C8}", source: "builtin" },
+  { id: "amplitude", name: "Amplitude", description: "Product analytics \u2014 behavioral data, cohorts, experiments, and segments.", category: "analytics", risk: "low", icon: "\u{1F4C9}", source: "builtin" },
+  { id: "segment", name: "Segment", description: "Customer data platform \u2014 sources, destinations, protocols, and personas.", category: "analytics", risk: "medium", icon: "\u{1F7E2}", source: "builtin" },
+  { id: "google-analytics", name: "Google Analytics", description: "Web analytics \u2014 pageviews, events, conversions, audiences, and reports.", category: "analytics", risk: "low", icon: "\u{1F4CA}", source: "builtin" },
+  { id: "hotjar", name: "Hotjar", description: "Heatmaps, session recordings, surveys, and user feedback.", category: "analytics", risk: "low", icon: "\u{1F525}", source: "builtin" },
+  // ─── Design ─────────────────────────────────────────────
+  { id: "figma", name: "Figma", description: "UI/UX design \u2014 files, components, prototypes, and design tokens.", category: "design", risk: "low", icon: "\u{1F3A8}", source: "builtin" },
+  { id: "canva", name: "Canva", description: "Graphic design \u2014 templates, brand kit, team designs, and media library.", category: "design", risk: "low", icon: "\u{1F5BC}\uFE0F", source: "builtin" },
+  { id: "miro", name: "Miro", description: "Online whiteboard \u2014 boards, frames, sticky notes, and templates.", category: "design", risk: "low", icon: "\u{1F7E1}", source: "builtin" },
+  { id: "adobe-photoshop", name: "Adobe Photoshop", description: "Image editing, compositing, and batch processing.", category: "design", risk: "low", icon: "\u{1F3A8}", source: "builtin" },
+  { id: "adobe-illustrator", name: "Adobe Illustrator", description: "Vector graphics, logos, icons, and illustrations.", category: "design", risk: "low", icon: "\u2712\uFE0F", source: "builtin" },
+  { id: "adobe-premiere", name: "Adobe Premiere Pro", description: "Video editing, color grading, audio mixing, and export.", category: "media", risk: "low", icon: "\u{1F3AC}", source: "builtin" },
+  { id: "adobe-after-effects", name: "Adobe After Effects", description: "Motion graphics, visual effects, and compositing.", category: "media", risk: "low", icon: "\u2728", source: "builtin" },
+  { id: "adobe-indesign", name: "Adobe InDesign", description: "Page layout, publishing, and document design.", category: "design", risk: "low", icon: "\u{1F4C4}", source: "builtin" },
+  { id: "adobe-xd", name: "Adobe XD", description: "UI/UX design, prototyping, and design systems.", category: "design", risk: "low", icon: "\u{1F3AF}", source: "builtin" },
+  // ─── Marketing ──────────────────────────────────────────
+  { id: "mailchimp", name: "Mailchimp", description: "Email campaigns, audiences, automations, templates, and analytics.", category: "marketing", risk: "medium", icon: "\u{1F435}", source: "builtin" },
+  { id: "sendgrid", name: "SendGrid", description: "Transactional and marketing email \u2014 templates, stats, and deliverability.", category: "marketing", risk: "medium", icon: "\u{1F4E7}", source: "builtin" },
+  { id: "google-ads", name: "Google Ads", description: "Search, display, video, and shopping campaigns. Bidding and reporting.", category: "marketing", risk: "high", icon: "\u{1F4E2}", source: "builtin" },
+  { id: "meta-ads", name: "Meta Ads", description: "Facebook and Instagram advertising \u2014 campaigns, audiences, and creatives.", category: "marketing", risk: "high", icon: "\u{1F4F1}", source: "builtin" },
+  { id: "linkedin-marketing", name: "LinkedIn Marketing", description: "Sponsored content, InMail campaigns, and lead gen forms.", category: "marketing", risk: "high", icon: "\u{1F517}", source: "builtin" },
+  { id: "activecampaign", name: "ActiveCampaign", description: "Email automation, CRM, site messaging, and machine learning.", category: "marketing", risk: "medium", icon: "\u{1F4EC}", source: "builtin" },
+  { id: "buffer", name: "Buffer", description: "Social media scheduling, analytics, and team collaboration.", category: "social", risk: "medium", icon: "\u{1F4CB}", source: "builtin" },
+  { id: "hootsuite", name: "Hootsuite", description: "Social media management \u2014 scheduling, monitoring, and reporting.", category: "social", risk: "medium", icon: "\u{1F989}", source: "builtin" },
+  // ─── E-Commerce ─────────────────────────────────────────
+  { id: "shopify", name: "Shopify", description: "Online store \u2014 products, orders, customers, inventory, and shipping.", category: "ecommerce", risk: "medium", icon: "\u{1F6CD}\uFE0F", source: "builtin" },
+  { id: "woocommerce", name: "WooCommerce", description: "WordPress ecommerce \u2014 products, orders, coupons, and shipping.", category: "ecommerce", risk: "medium", icon: "\u{1F6D2}", source: "builtin" },
+  { id: "bigcommerce", name: "BigCommerce", description: "Enterprise ecommerce \u2014 catalog, orders, customers, and channels.", category: "ecommerce", risk: "medium", icon: "\u{1F3EC}", source: "builtin" },
+  { id: "magento", name: "Magento", description: "Adobe Commerce \u2014 products, categories, orders, and customer segments.", category: "ecommerce", risk: "medium", icon: "\u{1F9F2}", source: "builtin" },
+  // ─── HR & People ────────────────────────────────────────
+  { id: "bamboohr", name: "BambooHR", description: "Employee records, time-off, onboarding, performance, and reporting.", category: "hr", risk: "high", icon: "\u{1F38B}", source: "builtin" },
+  { id: "workday", name: "Workday", description: "HCM, payroll, time tracking, benefits, and talent management.", category: "hr", risk: "high", icon: "\u{1F3E2}", source: "builtin" },
+  { id: "gusto", name: "Gusto", description: "Payroll, benefits, HR, and compliance for small businesses.", category: "hr", risk: "high", icon: "\u{1F49A}", source: "builtin" },
+  { id: "rippling", name: "Rippling", description: "Unified HR, IT, and Finance \u2014 payroll, devices, apps, and benefits.", category: "hr", risk: "high", icon: "\u{1F30A}", source: "builtin" },
+  { id: "lever", name: "Lever", description: "Recruiting \u2014 job postings, candidates, interviews, and offer letters.", category: "hr", risk: "medium", icon: "\u{1F527}", source: "builtin" },
+  { id: "greenhouse", name: "Greenhouse", description: "Talent acquisition \u2014 requisitions, scorecards, scheduling, and reports.", category: "hr", risk: "medium", icon: "\u{1F331}", source: "builtin" },
+  // ─── Legal & Compliance ─────────────────────────────────
+  { id: "docusign", name: "DocuSign", description: "Electronic signatures, envelopes, templates, and agreement workflows.", category: "legal", risk: "high", icon: "\u270D\uFE0F", source: "builtin" },
+  { id: "pandadoc", name: "PandaDoc", description: "Document automation \u2014 proposals, quotes, contracts, and e-signatures.", category: "legal", risk: "medium", icon: "\u{1F43C}", source: "builtin" },
+  { id: "clio", name: "Clio", description: "Legal practice management \u2014 matters, time entries, billing, and documents.", category: "legal", risk: "high", icon: "\u2696\uFE0F", source: "builtin" },
+  // ─── Storage & File Sharing ─────────────────────────────
+  { id: "dropbox", name: "Dropbox", description: "Cloud storage, file sharing, Paper docs, and team spaces.", category: "storage", risk: "medium", icon: "\u{1F4E6}", source: "builtin" },
+  { id: "box", name: "Box", description: "Enterprise content management \u2014 files, folders, metadata, and workflows.", category: "storage", risk: "medium", icon: "\u{1F4C1}", source: "builtin" },
+  // ─── Database ───────────────────────────────────────────
+  { id: "mongodb-atlas", name: "MongoDB Atlas", description: "Cloud MongoDB \u2014 clusters, collections, indexes, and aggregations.", category: "database", risk: "high", icon: "\u{1F343}", source: "builtin" },
+  { id: "redis-cloud", name: "Redis Cloud", description: "Managed Redis \u2014 databases, keys, streams, and pub/sub.", category: "database", risk: "medium", icon: "\u{1F534}", source: "builtin" },
+  { id: "elasticsearch", name: "Elasticsearch", description: "Search and analytics \u2014 indexes, queries, aggregations, and mappings.", category: "database", risk: "medium", icon: "\u{1F50E}", source: "builtin" },
+  { id: "snowflake", name: "Snowflake", description: "Cloud data warehouse \u2014 SQL queries, warehouses, stages, and shares.", category: "database", risk: "high", icon: "\u2744\uFE0F", source: "builtin" },
+  { id: "supabase", name: "Supabase", description: "Open-source Firebase \u2014 Postgres, auth, storage, realtime, and edge functions.", category: "database", risk: "medium", icon: "\u26A1", source: "builtin" },
+  { id: "planetscale", name: "PlanetScale", description: "Serverless MySQL \u2014 branches, deploy requests, and schema management.", category: "database", risk: "medium", icon: "\u{1F310}", source: "builtin" },
+  // ─── Monitoring & Observability ─────────────────────────
+  { id: "datadog", name: "Datadog", description: "APM, logs, metrics, dashboards, monitors, and synthetics.", category: "monitoring", risk: "medium", icon: "\u{1F436}", source: "builtin" },
+  { id: "pagerduty", name: "PagerDuty", description: "Incident management \u2014 alerts, escalations, schedules, and on-call.", category: "monitoring", risk: "medium", icon: "\u{1F6A8}", source: "builtin" },
+  { id: "sentry", name: "Sentry", description: "Error tracking \u2014 issues, releases, performance, and session replay.", category: "monitoring", risk: "low", icon: "\u{1FAB2}", source: "builtin" },
+  { id: "newrelic", name: "New Relic", description: "Full-stack observability \u2014 APM, infrastructure, logs, and dashboards.", category: "monitoring", risk: "medium", icon: "\u{1F52D}", source: "builtin" },
+  { id: "grafana", name: "Grafana", description: "Dashboards, alerting, and data source visualization.", category: "monitoring", risk: "low", icon: "\u{1F4CA}", source: "builtin" },
+  { id: "statuspage", name: "Statuspage", description: "Public and private status pages, incidents, and maintenance windows.", category: "monitoring", risk: "medium", icon: "\u{1F7E2}", source: "builtin" },
+  { id: "opsgenie", name: "Opsgenie", description: "Alert management, on-call schedules, escalations, and incident response.", category: "monitoring", risk: "medium", icon: "\u{1F514}", source: "builtin" },
+  // ─── Security & Identity ────────────────────────────────
+  { id: "okta", name: "Okta", description: "Identity management \u2014 SSO, MFA, user lifecycle, and API access management.", category: "security", risk: "critical", icon: "\u{1F510}", source: "builtin" },
+  { id: "auth0", name: "Auth0", description: "Authentication \u2014 login flows, social connections, roles, and organizations.", category: "security", risk: "high", icon: "\u{1F513}", source: "builtin" },
+  { id: "vault-hashicorp", name: "HashiCorp Vault", description: "Secrets management \u2014 KV store, dynamic credentials, encryption, and PKI.", category: "security", risk: "critical", icon: "\u{1F5DD}\uFE0F", source: "builtin" },
+  { id: "crowdstrike", name: "CrowdStrike", description: "Endpoint security \u2014 detections, incidents, IoCs, and threat intelligence.", category: "security", risk: "high", icon: "\u{1F985}", source: "builtin" },
+  { id: "snyk", name: "Snyk", description: "Developer security \u2014 vulnerability scanning, license compliance, and SBOM.", category: "security", risk: "medium", icon: "\u{1F50D}", source: "builtin" },
+  // ─── Social Media (expanded) ────────────────────────────
+  { id: "linkedin", name: "LinkedIn", description: "Professional networking \u2014 posts, connections, company pages, and messaging.", category: "social", risk: "high", icon: "\u{1F517}", source: "builtin" },
+  { id: "instagram", name: "Instagram", description: "Photo/video sharing \u2014 posts, stories, reels, and insights.", category: "social", risk: "high", icon: "\u{1F4F8}", source: "builtin" },
+  { id: "facebook", name: "Facebook Pages", description: "Page management \u2014 posts, comments, insights, and messenger.", category: "social", risk: "high", icon: "\u{1F4D8}", source: "builtin" },
+  { id: "youtube", name: "YouTube", description: "Video platform \u2014 uploads, playlists, analytics, comments, and live streams.", category: "social", risk: "high", icon: "\u25B6\uFE0F", source: "builtin" },
+  { id: "tiktok", name: "TikTok Business", description: "Short-form video \u2014 uploads, analytics, and business tools.", category: "social", risk: "high", icon: "\u{1F3B5}", source: "builtin" },
+  { id: "reddit", name: "Reddit", description: "Posts, comments, subreddits, and moderation.", category: "social", risk: "medium", icon: "\u{1F534}", source: "builtin" },
+  // ─── Communication (expanded) ───────────────────────────
+  { id: "twilio", name: "Twilio", description: "Programmable voice, SMS, video, and messaging APIs.", category: "communication", risk: "high", icon: "\u{1F4DE}", source: "builtin" },
+  { id: "vonage", name: "Vonage", description: "Communication APIs \u2014 SMS, voice, video, and verification.", category: "communication", risk: "high", icon: "\u{1F4F1}", source: "builtin" },
+  { id: "ringcentral", name: "RingCentral", description: "Cloud phone system \u2014 calls, messages, video, and fax.", category: "communication", risk: "medium", icon: "\u{1F4DE}", source: "builtin" },
+  // ─── Automation (expanded) ──────────────────────────────
+  { id: "zapier", name: "Zapier", description: "No-code automation \u2014 zaps, triggers, actions, and multi-step workflows.", category: "automation", risk: "medium", icon: "\u26A1", source: "builtin" },
+  { id: "make", name: "Make (Integromat)", description: "Visual automation \u2014 scenarios, modules, and data routing.", category: "automation", risk: "medium", icon: "\u{1F500}", source: "builtin" },
+  { id: "n8n", name: "n8n", description: "Open-source workflow automation \u2014 nodes, triggers, and custom functions.", category: "automation", risk: "medium", icon: "\u{1F504}", source: "builtin" },
+  // ─── Infrastructure ─────────────────────────────────────
+  { id: "cloudflare", name: "Cloudflare", description: "CDN, DNS, Workers, Pages, security, and zero trust.", category: "cloud-infrastructure", risk: "high", icon: "\u{1F536}", source: "builtin" },
+  { id: "digitalocean", name: "DigitalOcean", description: "Cloud infrastructure \u2014 droplets, databases, spaces, and app platform.", category: "cloud-infrastructure", risk: "high", icon: "\u{1F30A}", source: "builtin" },
+  { id: "heroku", name: "Heroku", description: "Cloud platform \u2014 apps, dynos, add-ons, and pipelines.", category: "cloud-infrastructure", risk: "medium", icon: "\u{1F7E3}", source: "builtin" },
+  { id: "fly-io", name: "Fly.io", description: "Edge deployment \u2014 machines, volumes, secrets, and global routing.", category: "cloud-infrastructure", risk: "medium", icon: "\u{1FA81}", source: "builtin" },
+  // ─── Enterprise Utility Skills (from individual skill files) ─
+  ...ENTERPRISE_SKILL_DEFS
+];
+var PermissionEngine = class {
+  skills = /* @__PURE__ */ new Map();
+  profiles = /* @__PURE__ */ new Map();
+  engineDb;
+  constructor(skills) {
+    if (skills) {
+      for (const s of skills) this.skills.set(s.id, s);
+    }
+  }
+  /**
+   * Set the database adapter and load existing profiles from DB
+   */
+  async setDb(db) {
+    this.engineDb = db;
+  }
+  registerSkill(skill) {
+    this.skills.set(skill.id, skill);
+  }
+  setProfile(agentId, profile, orgId) {
+    this.profiles.set(agentId, profile);
+    if (this.engineDb && orgId) {
+      this.engineDb.upsertPermissionProfile(orgId, profile).catch((err) => {
+        console.error(`[permissions] Failed to persist profile for agent ${agentId}:`, err);
+      });
+    }
+  }
+  getProfile(agentId) {
+    return this.profiles.get(agentId);
+  }
+  /**
+   * Core permission check: Can this agent use this tool right now?
+   * Returns { allowed, reason, requiresApproval }
+   */
+  checkPermission(agentId, toolId, context) {
+    const profile = this.profiles.get(agentId);
+    if (!profile) {
+      return { allowed: false, reason: "No permission profile assigned", requiresApproval: false };
+    }
+    if (profile.constraints.sandboxMode) {
+      return { allowed: true, reason: "Sandbox mode \u2014 action will be simulated", requiresApproval: false, sandbox: true };
+    }
+    if (profile.constraints.allowedWorkingHours) {
+      const now = context?.timestamp || /* @__PURE__ */ new Date();
+      const { start, end, timezone } = profile.constraints.allowedWorkingHours;
+      const hour = parseInt(new Intl.DateTimeFormat("en-US", { hour: "numeric", hour12: false, timeZone: timezone }).format(now));
+      const startHour = parseInt(start.split(":")[0]);
+      const endHour = parseInt(end.split(":")[0]);
+      if (hour < startHour || hour >= endHour) {
+        return { allowed: false, reason: `Outside working hours (${start}-${end} ${timezone})`, requiresApproval: false };
+      }
+    }
+    if (profile.constraints.allowedIPs?.length && context?.ip) {
+      if (!profile.constraints.allowedIPs.includes(context.ip)) {
+        return { allowed: false, reason: `IP ${context.ip} not in allowlist`, requiresApproval: false };
+      }
+    }
+    if (profile.tools.blocked.includes(toolId)) {
+      return { allowed: false, reason: `Tool "${toolId}" is explicitly blocked`, requiresApproval: false };
+    }
+    if (profile.tools.allowed.includes(toolId)) {
+      return this._checkApproval(profile, toolId);
+    }
+    const tool = this._findTool(toolId);
+    if (!tool) {
+      return { allowed: false, reason: `Unknown tool "${toolId}"`, requiresApproval: false };
+    }
+    const skillAllowed = profile.skills.mode === "allowlist" ? profile.skills.list.includes(tool.skillId) : !profile.skills.list.includes(tool.skillId);
+    if (!skillAllowed) {
+      return { allowed: false, reason: `Skill "${tool.skillId}" is not permitted`, requiresApproval: false };
+    }
+    const riskOrder = ["low", "medium", "high", "critical"];
+    const toolRiskIdx = riskOrder.indexOf(tool.risk);
+    const maxRiskIdx = riskOrder.indexOf(profile.maxRiskLevel);
+    if (toolRiskIdx > maxRiskIdx) {
+      return { allowed: false, reason: `Tool risk "${tool.risk}" exceeds max allowed "${profile.maxRiskLevel}"`, requiresApproval: false };
+    }
+    for (const effect of tool.sideEffects) {
+      if (profile.blockedSideEffects.includes(effect)) {
+        return { allowed: false, reason: `Side effect "${effect}" is blocked`, requiresApproval: false };
+      }
+    }
+    return this._checkApproval(profile, toolId, tool);
+  }
+  _checkApproval(profile, toolId, tool) {
+    if (!profile.requireApproval.enabled) {
+      return { allowed: true, reason: "Permitted", requiresApproval: false };
+    }
+    if (tool) {
+      if (profile.requireApproval.forRiskLevels.includes(tool.risk)) {
+        return { allowed: true, reason: "Requires human approval (risk level)", requiresApproval: true };
+      }
+      for (const effect of tool.sideEffects) {
+        if (profile.requireApproval.forSideEffects.includes(effect)) {
+          return { allowed: true, reason: `Requires human approval (${effect})`, requiresApproval: true };
+        }
+      }
+    }
+    return { allowed: true, reason: "Permitted", requiresApproval: false };
+  }
+  _findTool(toolId) {
+    for (const skill of this.skills.values()) {
+      const tool = skill.tools.find((t) => t.id === toolId);
+      if (tool) return tool;
+    }
+    try {
+      const { TOOL_INDEX } = (init_tool_catalog(), __toCommonJS(tool_catalog_exports));
+      return TOOL_INDEX.get(toolId);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Get the full resolved tool list for an agent — what they can actually use
+   */
+  getAvailableTools(agentId) {
+    const result = [];
+    for (const skill of this.skills.values()) {
+      for (const tool of skill.tools) {
+        const perm = this.checkPermission(agentId, tool.id);
+        if (perm.allowed) {
+          result.push({
+            tool,
+            status: perm.sandbox ? "sandbox" : perm.requiresApproval ? "approval-required" : "allowed"
+          });
+        }
+      }
+    }
+    return result;
+  }
+  /**
+   * Generate the tool policy config for an agent based on their profile
+   */
+  generateToolPolicy(agentId) {
+    const profile = this.profiles.get(agentId);
+    if (!profile) return { allowedTools: [], blockedTools: [], approvalRequired: [], rateLimits: { toolCallsPerMinute: 10, toolCallsPerHour: 100, toolCallsPerDay: 1e3, externalActionsPerHour: 10 } };
+    const allowed = [];
+    const blocked = [];
+    const approval = [];
+    for (const skill of this.skills.values()) {
+      for (const tool of skill.tools) {
+        const perm = this.checkPermission(agentId, tool.id);
+        if (perm.allowed) {
+          allowed.push(tool.id);
+          if (perm.requiresApproval) approval.push(tool.id);
+        } else {
+          blocked.push(tool.id);
+        }
+      }
+    }
+    return { allowedTools: allowed, blockedTools: blocked, approvalRequired: approval, rateLimits: profile.rateLimits };
+  }
+  getAllSkills() {
+    return Array.from(this.skills.values());
+  }
+  getSkillsByCategory() {
+    const result = {};
+    for (const skill of this.skills.values()) {
+      if (!result[skill.category]) result[skill.category] = [];
+      result[skill.category].push(skill);
+    }
+    return result;
+  }
+};
+
+export {
+  SKILL_SUITES,
+  PRESET_PROFILES,
+  BUILTIN_SKILLS,
+  PermissionEngine
+};