@damiangilgonzalez/harness 1.3.7

package/skills/harness/references/providers.yaml

@@ -0,0 +1,3546 @@
+# Provider catalog for harness.
+#
+# Each entry defines how to DETECT a provider in a workspace and what to SHIP
+# inside 01-TOOLS/<ID>/ when it is detected. Adding a new provider = add a new
+# entry here. The SKILL.md never needs to change.
+#
+# Schema:
+#   id:                   uppercase folder name under 01-TOOLS/
+#   category:             grouping for 01-TOOLS/README.md
+#   detectors:
+#     imports:            list of grep patterns for SDK imports (any match)
+#     env_vars:           list of env var names to grep
+#     deps:               list of dependency names in manifests
+#   env_example:          literal body of .env.example
+#   dashboard_url:        provider dashboard for credentials
+#   files:                map of relative path -> file body
+#                         Variables: {{TODAY}}
+#   manual_only:          true if provider has no automated test_connection
+#                         (e.g. credentials kept for human dashboard use)
+
+providers:
+
+  - id: STRIPE
+    category: pagos
+    detectors:
+      imports:
+        - "import stripe"
+        - "from stripe"
+        - "require('stripe')"
+        - "require(\"stripe\")"
+        - "@stripe/stripe-js"
+        - "@stripe/stripe-node"
+      env_vars:
+        - "STRIPE_SECRET_KEY"
+        - "STRIPE_PUBLISHABLE_KEY"
+        - "STRIPE_WEBHOOK_SECRET"
+      deps:
+        - "stripe"
+        - "@stripe/stripe-js"
+        - "@stripe/stripe-node"
+    dashboard_url: "https://dashboard.stripe.com/apikeys"
+    env_example: |
+      # STRIPE — operational credentials
+      # Generate at: https://dashboard.stripe.com/apikeys
+      #
+      # Copy this file to `.env`, fill in real values, and `chmod 600 .env`.
+
+      STRIPE_SECRET_KEY=
+      STRIPE_PUBLISHABLE_KEY=
+      STRIPE_WEBHOOK_SECRET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Smoke-test against Stripe API: GET /v1/account.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        ENV_PATH="$SCRIPT_DIR/.env"
+        [ -f "$ENV_PATH" ] || { echo "ERROR: missing $ENV_PATH" >&2; exit 1; }
+        set -a; source "$ENV_PATH"; set +a
+        : "${STRIPE_SECRET_KEY:?STRIPE_SECRET_KEY not set in $ENV_PATH}"
+        RESP=$(curl -fsS -u "$STRIPE_SECRET_KEY:" https://api.stripe.com/v1/account)
+        echo "$RESP" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(f"OK — account: {d[\"id\"]} ({d.get(\"business_profile\",{}).get(\"name\",\"-\")})")'
+      README.md: |
+        # STRIPE
+
+        Operations against the project Stripe account: pricing, customers,
+        subscriptions, webhook events.
+
+        ## Setup
+
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Set `STRIPE_SECRET_KEY` from https://dashboard.stripe.com/apikeys
+        3. `./test_connection.sh` — should print `OK — account: acct_…`
+
+        ## Scripts
+
+        | Script | What it does |
+        |--------|--------------|
+        | `test_connection.sh` | Smoke-test against `/v1/account`. |
+
+        ## Notes
+
+        - The product backend consumes Stripe via its own runtime SDK.
+          This tool is for manual terminal-driven operations only.
+      CREDENTIALS.md: |
+        # Credentials — STRIPE
+
+        ## Dashboard
+
+        - URL: https://dashboard.stripe.com/apikeys
+        - 2FA mandatory.
+
+        ## Variables
+
+        | Variable | Type | Where to generate | Rotation |
+        |----------|------|-------------------|----------|
+        | `STRIPE_SECRET_KEY`      | secret | Dashboard → Developers → API keys | on suspected leak |
+        | `STRIPE_PUBLISHABLE_KEY` | public | Dashboard → Developers → API keys | n/a |
+        | `STRIPE_WEBHOOK_SECRET`  | secret | Dashboard → Developers → Webhooks → endpoint | whenever the endpoint changes |
+
+        ## If a credential leaks
+
+        1. Revocar inmediatamente en el dashboard (rolling key).
+        2. Generar una nueva y actualizar `.env` local.
+        3. Si el backend la consume en runtime: actualizar env vars del despliegue.
+
+  - id: MAILJET
+    category: pagos_email
+    detectors:
+      imports:
+        - "import mailjet_rest"
+        - "from mailjet_rest"
+        - "node-mailjet"
+        - "require('node-mailjet')"
+      env_vars:
+        - "MAILJET_API_KEY"
+        - "MAILJET_API_SECRET"
+        - "MJ_APIKEY_PUBLIC"
+        - "MJ_APIKEY_PRIVATE"
+      deps:
+        - "mailjet-rest"
+        - "node-mailjet"
+        - "mailjet"
+    dashboard_url: "https://app.mailjet.com/account/apikeys"
+    env_example: |
+      # MAILJET — operational credentials
+      # Generate at: https://app.mailjet.com/account/apikeys
+      MAILJET_API_KEY=
+      MAILJET_API_SECRET=
+      MAILJET_FROM_EMAIL=
+      MAILJET_FROM_NAME=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Smoke-test against Mailjet API: GET /v3/REST/sender.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        ENV_PATH="$SCRIPT_DIR/.env"
+        [ -f "$ENV_PATH" ] || { echo "ERROR: missing $ENV_PATH" >&2; exit 1; }
+        set -a; source "$ENV_PATH"; set +a
+        : "${MAILJET_API_KEY:?MAILJET_API_KEY not set}"
+        : "${MAILJET_API_SECRET:?MAILJET_API_SECRET not set}"
+        RESP=$(curl -fsS -u "$MAILJET_API_KEY:$MAILJET_API_SECRET" https://api.mailjet.com/v3/REST/sender)
+        echo "$RESP" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(f"OK — registered senders: {d[\"Count\"]}")'
+      README.md: |
+        # MAILJET
+
+        Transactional email (verification, invites, password reset).
+
+        ## Setup
+
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Fill in `MAILJET_API_KEY` and `MAILJET_API_SECRET` from https://app.mailjet.com/account/apikeys
+        3. `./test_connection.sh`
+
+        ## Scripts
+
+        | Script | What it does |
+        |--------|--------------|
+        | `test_connection.sh` | Lists registered senders — confirms auth. |
+      CREDENTIALS.md: |
+        # Credentials — MAILJET
+
+        Dashboard: https://app.mailjet.com/account/apikeys
+
+        | Variable | Type | Where to generate |
+        |----------|------|-------------------|
+        | `MAILJET_API_KEY`    | public | Dashboard → API Keys |
+        | `MAILJET_API_SECRET` | secret | Dashboard → API Keys |
+        | `MAILJET_FROM_EMAIL` | config | Address verified as sender |
+        | `MAILJET_FROM_NAME`  | config | Display name shown to recipients |
+
+  - id: HETZNER
+    category: infra
+    detectors:
+      imports:
+        - "hcloud"
+        - "from hcloud"
+      env_vars:
+        - "HCLOUD_TOKEN"
+        - "HETZNER_TOKEN"
+        - "HETZNER_API_TOKEN"
+      deps:
+        - "hcloud"
+        - "hetznercloud"
+    dashboard_url: "https://console.hetzner.cloud/projects"
+    env_example: |
+      # HETZNER Cloud — operational credentials
+      # Generate at: https://console.hetzner.cloud (proyecto → Security → API tokens)
+      HCLOUD_TOKEN=
+    files:
+      test_connection.py: |
+        #!/usr/bin/env python3
+        """Smoke-test against Hetzner Cloud API: GET /v1/servers."""
+        import os, sys, urllib.request, urllib.error, json
+        from pathlib import Path
+
+        env_path = Path(__file__).parent / ".env"
+        if not env_path.exists():
+            print(f"ERROR: missing {env_path}", file=sys.stderr); sys.exit(1)
+        for line in env_path.read_text().splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line: continue
+            k, v = line.split("=", 1); os.environ.setdefault(k, v)
+
+        token = os.environ.get("HCLOUD_TOKEN")
+        if not token:
+            print("ERROR: HCLOUD_TOKEN not set", file=sys.stderr); sys.exit(1)
+
+        req = urllib.request.Request(
+            "https://api.hetzner.cloud/v1/servers",
+            headers={"Authorization": f"Bearer {token}"},
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=10) as r:
+                data = json.load(r)
+            n = len(data.get("servers", []))
+            print(f"OK — servers in the project: {n}")
+        except urllib.error.HTTPError as e:
+            print(f"FAIL: {e.code} {e.reason}", file=sys.stderr); sys.exit(1)
+      README.md: |
+        # HETZNER
+
+        Provisioning and operation of Hetzner Cloud servers.
+
+        ## Setup
+
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Create an API token for the project: https://console.hetzner.cloud
+        3. `python3 test_connection.py`
+
+        ## Scripts
+
+        | Script | What it does |
+        |--------|--------------|
+        | `test_connection.py` | Lists servers in the project — confirms auth. |
+      CREDENTIALS.md: |
+        # Credentials — HETZNER
+
+        Dashboard: https://console.hetzner.cloud
+
+        | Variable | Type | Where to generate | Rotation |
+        |----------|------|-------------------|----------|
+        | `HCLOUD_TOKEN` | secret | Project → Security → API tokens | revoke + regenerate on leak |
+
+  - id: REPLICATE
+    category: ia
+    detectors:
+      imports:
+        - "import replicate"
+        - "from replicate"
+        - "require('replicate')"
+      env_vars:
+        - "REPLICATE_API_TOKEN"
+      deps:
+        - "replicate"
+    dashboard_url: "https://replicate.com/account/api-tokens"
+    env_example: |
+      # REPLICATE — operational credentials
+      # Generate at: https://replicate.com/account/api-tokens
+      REPLICATE_API_TOKEN=
+    files:
+      test_connection.py: |
+        #!/usr/bin/env python3
+        """Smoke-test against Replicate API: GET /v1/account."""
+        import os, sys, urllib.request, urllib.error, json
+        from pathlib import Path
+
+        env_path = Path(__file__).parent / ".env"
+        if not env_path.exists():
+            print(f"ERROR: missing {env_path}", file=sys.stderr); sys.exit(1)
+        for line in env_path.read_text().splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line: continue
+            k, v = line.split("=", 1); os.environ.setdefault(k, v)
+
+        token = os.environ.get("REPLICATE_API_TOKEN")
+        if not token:
+            print("ERROR: REPLICATE_API_TOKEN not set", file=sys.stderr); sys.exit(1)
+
+        req = urllib.request.Request(
+            "https://api.replicate.com/v1/account",
+            headers={"Authorization": f"Bearer {token}"},
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=10) as r:
+                data = json.load(r)
+            print(f"OK — username: {data.get('username','?')} type: {data.get('type','?')}")
+        except urllib.error.HTTPError as e:
+            print(f"FAIL: {e.code} {e.reason}", file=sys.stderr); sys.exit(1)
+      README.md: |
+        # REPLICATE
+
+        Image and model generation via Replicate.
+
+        ## Setup
+
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Token from https://replicate.com/account/api-tokens
+        3. `python3 test_connection.py`
+      CREDENTIALS.md: |
+        # Credentials — REPLICATE
+
+        Dashboard: https://replicate.com/account/api-tokens
+
+        | Variable | Type | Rotation |
+        |----------|------|----------|
+        | `REPLICATE_API_TOKEN` | secret | revoke + regenerate on leak |
+
+  - id: FIREBASE
+    category: mobile_auth
+    detectors:
+      imports:
+        - "firebase-admin"
+        - "from firebase_admin"
+        - "import firebase_admin"
+        - "firebase/app"
+        - "firebase/messaging"
+        - "@react-native-firebase"
+      env_vars:
+        - "FIREBASE_PROJECT_ID"
+        - "FCM_SERVER_KEY"
+        - "GOOGLE_APPLICATION_CREDENTIALS"
+      deps:
+        - "firebase-admin"
+        - "firebase"
+        - "@react-native-firebase/app"
+    dashboard_url: "https://console.firebase.google.com"
+    env_example: |
+      # FIREBASE / FCM — operational credentials
+      # Required: service account JSON downloaded from the Firebase project.
+      # Console → Project settings → Service accounts → Generate new private key
+      FIREBASE_PROJECT_ID=
+      GOOGLE_APPLICATION_CREDENTIALS=./service-account.json
+    files:
+      test_connection.py: |
+        #!/usr/bin/env python3
+        """Smoke-test FCM: firma un JWT y pide un access token a Google."""
+        import os, sys, json, time, base64, hmac, hashlib, urllib.request, urllib.parse
+        from pathlib import Path
+
+        env_path = Path(__file__).parent / ".env"
+        if not env_path.exists():
+            print(f"ERROR: missing {env_path}", file=sys.stderr); sys.exit(1)
+        for line in env_path.read_text().splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line: continue
+            k, v = line.split("=", 1); os.environ.setdefault(k, v)
+
+        sa_path = os.environ.get("GOOGLE_APPLICATION_CREDENTIALS", "./service-account.json")
+        sa_path = (Path(__file__).parent / sa_path).resolve()
+        if not sa_path.exists():
+            print(f"ERROR: service account not found at {sa_path}", file=sys.stderr); sys.exit(1)
+
+        try:
+            from google.oauth2 import service_account
+            from google.auth.transport.requests import Request
+        except ImportError:
+            print("ERROR: pip install google-auth", file=sys.stderr); sys.exit(1)
+
+        creds = service_account.Credentials.from_service_account_file(
+            str(sa_path),
+            scopes=["https://www.googleapis.com/auth/firebase.messaging"],
+        )
+        creds.refresh(Request())
+        if creds.token:
+            print(f"OK — FCM access token obtained (project: {os.environ.get('FIREBASE_PROJECT_ID','?')})")
+        else:
+            print("FAIL: no token obtained", file=sys.stderr); sys.exit(1)
+      requirements.txt: |
+        google-auth>=2.0
+      README.md: |
+        # FIREBASE / FCM
+
+        Push notifications for Android / iOS / Web via Firebase Cloud Messaging.
+
+        ## Setup
+
+        1. Download the service account JSON from Console → Project settings → Service accounts.
+        2. Save it as `service-account.json` in this folder (gitignored).
+        3. `cp .env.example .env && chmod 600 .env` and fill in `FIREBASE_PROJECT_ID`.
+        4. `pip install -r requirements.txt`
+        5. `python3 test_connection.py`
+      CREDENTIALS.md: |
+        # Credentials — FIREBASE
+
+        Dashboard: https://console.firebase.google.com
+
+        | Artifact | Where to generate | Notes |
+        |----------|-------------------|-------|
+        | service-account.json | Project settings → Service accounts → Generate new private key | DO NOT commit; gitignored |
+        | `FIREBASE_PROJECT_ID` | Project settings → General | Identifies the project |
+
+        ## Manual FCM setup per platform
+
+        - Android: `google-services.json` in `android/app/`.
+        - iOS: `GoogleService-Info.plist` in the app bundle.
+        - Web: client config with `apiKey`, `messagingSenderId`, `appId`.
+
+  - id: GOOGLE_OAUTH
+    category: mobile_auth
+    detectors:
+      imports:
+        - "google-auth-oauthlib"
+        - "from google.oauth2"
+        - "next-auth/providers/google"
+        - "@react-oauth/google"
+      env_vars:
+        - "GOOGLE_CLIENT_ID"
+        - "GOOGLE_CLIENT_SECRET"
+        - "GOOGLE_OAUTH_CLIENT_ID"
+      deps:
+        - "google-auth-oauthlib"
+        - "@react-oauth/google"
+        - "next-auth"
+    dashboard_url: "https://console.cloud.google.com/apis/credentials"
+    env_example: |
+      # GOOGLE OAuth 2.0 — operational credentials
+      # Generate at: https://console.cloud.google.com/apis/credentials
+      # Need a Client ID + Secret per platform (Web/Android/iOS).
+      GOOGLE_CLIENT_ID=
+      GOOGLE_CLIENT_SECRET=
+      GOOGLE_REDIRECT_URI=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Smoke-test: validate that Google's discovery endpoint responds
+        # and that GOOGLE_CLIENT_ID has a reasonable shape.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        ENV_PATH="$SCRIPT_DIR/.env"
+        [ -f "$ENV_PATH" ] || { echo "ERROR: missing $ENV_PATH" >&2; exit 1; }
+        set -a; source "$ENV_PATH"; set +a
+        : "${GOOGLE_CLIENT_ID:?GOOGLE_CLIENT_ID not set}"
+        [[ "$GOOGLE_CLIENT_ID" == *".apps.googleusercontent.com" ]] || {
+          echo "FAIL: GOOGLE_CLIENT_ID does not end with .apps.googleusercontent.com" >&2; exit 1; }
+        curl -fsS https://accounts.google.com/.well-known/openid-configuration > /dev/null
+        echo "OK — discovery endpoint reachable and client_id shape is valid."
+      README.md: |
+        # GOOGLE_OAUTH
+
+        Login with Google. Per-platform Client IDs (Web, Android, iOS).
+
+        ## Setup
+
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Client IDs from https://console.cloud.google.com/apis/credentials
+        3. `./test_connection.sh`
+
+        ## Notes
+
+        - For Android/iOS: the client_id is shipped in the app (not a secret).
+        - For Web: you need client_secret and a registered redirect_uri.
+      CREDENTIALS.md: |
+        # Credentials — GOOGLE OAuth
+
+        Dashboard: https://console.cloud.google.com/apis/credentials
+
+        | Variable | Type | Notes |
+        |----------|------|-------|
+        | `GOOGLE_CLIENT_ID` | public-ish | OAuth client identifier |
+        | `GOOGLE_CLIENT_SECRET` | secret | Web only. NEVER in mobile apps. |
+        | `GOOGLE_REDIRECT_URI` | config | Must match exactly a registered URI |
+
+  - id: DB_CLI
+    category: datos
+    detectors:
+      imports:
+        - "from sqlalchemy"
+        - "import sqlalchemy"
+        - "psycopg"
+        - "asyncpg"
+        - "from pg"
+        - "require('pg')"
+      env_vars:
+        - "DATABASE_URL"
+        - "POSTGRES_USER"
+        - "POSTGRES_PASSWORD"
+        - "POSTGRES_HOST"
+        - "POSTGRES_DB"
+      deps:
+        - "sqlalchemy"
+        - "psycopg"
+        - "psycopg2-binary"
+        - "asyncpg"
+        - "pg"
+        - "drizzle-orm"
+    dashboard_url: ""
+    env_example: |
+      # DB_CLI — access to the project's Postgres database
+      # If the DB is on a remote server via SSH, set SSH_HOST + SSH_USER.
+      # If local, only POSTGRES_* is needed.
+      DATABASE_URL=postgresql://user:pass@host:5432/dbname
+      # Alternative: individual vars
+      POSTGRES_HOST=localhost
+      POSTGRES_PORT=5432
+      POSTGRES_USER=
+      POSTGRES_PASSWORD=
+      POSTGRES_DB=
+      # Optional — for a DB behind an SSH bastion
+      SSH_HOST=
+      SSH_USER=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Smoke-test against Postgres: pg_isready (local or via SSH).
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        ENV_PATH="$SCRIPT_DIR/.env"
+        [ -f "$ENV_PATH" ] || { echo "ERROR: missing $ENV_PATH" >&2; exit 1; }
+        set -a; source "$ENV_PATH"; set +a
+
+        if [ -n "${SSH_HOST:-}" ] && [ -n "${SSH_USER:-}" ]; then
+          ssh "${SSH_USER}@${SSH_HOST}" "pg_isready -h ${POSTGRES_HOST:-localhost} -p ${POSTGRES_PORT:-5432}"
+          echo "OK — Postgres reachable via ${SSH_USER}@${SSH_HOST}."
+        else
+          : "${POSTGRES_HOST:?POSTGRES_HOST or DATABASE_URL not set}"
+          pg_isready -h "${POSTGRES_HOST}" -p "${POSTGRES_PORT:-5432}" -U "${POSTGRES_USER:-postgres}"
+          echo "OK — Local Postgres reachable."
+        fi
+      abrir_psql.sh: |
+        #!/usr/bin/env bash
+        # Opens an interactive psql session against the DB in .env.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        if [ -n "${DATABASE_URL:-}" ]; then
+          psql "$DATABASE_URL"
+        else
+          PGPASSWORD="$POSTGRES_PASSWORD" psql -h "$POSTGRES_HOST" -p "${POSTGRES_PORT:-5432}" -U "$POSTGRES_USER" -d "$POSTGRES_DB"
+        fi
+      README.md: |
+        # DB_CLI
+
+        Terminal access to the project's Postgres database.
+
+        ## Setup
+
+        1. `cp .env.example .env && chmod 600 .env` and fill in.
+        2. `./test_connection.sh`
+        3. `./abrir_psql.sh` for an interactive session.
+
+        ## Notes
+
+        - If the production DB does not expose a public port, set
+          `SSH_HOST`/`SSH_USER` and the script will tunnel via SSH.
+      CREDENTIALS.md: |
+        # Credentials — DB_CLI
+
+        | Variable | Type | Notes |
+        |----------|------|-------|
+        | `DATABASE_URL` | secret | Full DSN, alternative to the individual vars |
+        | `POSTGRES_PASSWORD` | secret | Rotate on exposure |
+
+  - id: COOLIFY
+    category: infra
+    detectors:
+      imports: []
+      env_vars:
+        - "COOLIFY_TOKEN"
+        - "COOLIFY_URL"
+      deps: []
+    dashboard_url: ""
+    manual_only: false
+    env_example: |
+      # COOLIFY — self-hosted PaaS panel
+      COOLIFY_URL=
+      COOLIFY_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Smoke-test against Coolify API: GET /api/v1/version.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${COOLIFY_URL:?COOLIFY_URL not set}"
+        : "${COOLIFY_TOKEN:?COOLIFY_TOKEN not set}"
+        RESP=$(curl -fsS -H "Authorization: Bearer $COOLIFY_TOKEN" "${COOLIFY_URL%/}/api/v1/version")
+        echo "OK — Coolify version: $RESP"
+      README.md: |
+        # COOLIFY
+
+        Access to the self-hosted PaaS panel that orchestrates deployments.
+
+        ## Setup
+
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Token from Coolify → Profile → API tokens.
+        3. `./test_connection.sh`
+      CREDENTIALS.md: |
+        # Credentials — COOLIFY
+
+        | Variable | Type | Notes |
+        |----------|------|-------|
+        | `COOLIFY_URL`   | config | Panel base URL (no trailing slash) |
+        | `COOLIFY_TOKEN` | secret | Generated from Profile → API tokens |
+
+  - id: TAILSCALE
+    category: infra
+    detectors:
+      imports: []
+      env_vars:
+        - "TAILSCALE_AUTHKEY"
+        - "TS_AUTHKEY"
+      deps: []
+    dashboard_url: "https://login.tailscale.com/admin/settings/keys"
+    manual_only: true
+    env_example: |
+      # TAILSCALE — auth keys (only if we automate provisioning)
+      # For normal human use the `tailscale` CLI manages the session without .env.
+      TAILSCALE_AUTHKEY=
+    files:
+      README.md: |
+        # TAILSCALE
+
+        Mesh VPN over WireGuard. Access to internal services without exposing ports.
+
+        ## Manual setup
+
+        - Client: install from https://tailscale.com/download
+        - `tailscale up` from the device; auth happens in the browser.
+        - Auth keys (for automated server provisioning) from:
+          https://login.tailscale.com/admin/settings/keys
+
+        ## No automated smoke-test
+
+        State is verified with `tailscale status` from the official CLI.
+      CREDENTIALS.md: |
+        # Credentials — TAILSCALE
+
+        Dashboard: https://login.tailscale.com/admin
+
+        - Auth keys: single-use, expire. Only for provisioning new nodes
+          without interactive login.
+        - Human usage relies on the client's OAuth session — no `.env` secrets.
+
+  - id: GITHUB_RUNNER
+    category: infra
+    detectors:
+      imports: []
+      env_vars:
+        - "RUNNER_TOKEN"
+        - "GH_RUNNER_TOKEN"
+      deps: []
+    dashboard_url: ""
+    manual_only: true
+    env_example: |
+      # GITHUB self-hosted runner — registration
+      # Registration token: GitHub → Settings → Actions → Runners → New self-hosted runner
+      # (Org-level: org Settings, not a single repo.)
+      GH_OWNER=
+      GH_RUNNER_TOKEN=
+      RUNNER_NAME=
+      RUNNER_LABELS=self-hosted,linux,x64
+    files:
+      README.md: |
+        # GITHUB_RUNNER
+
+        Self-hosted GitHub Actions runner.
+
+        ## Setup
+
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Token from Settings → Actions → Runners → New self-hosted runner.
+        3. Run the runner following GitHub's instructions for your OS.
+
+        The token expires in ~1h; only used at registration time.
+
+        ## Operations
+
+        - Runner status: `sudo systemctl status actions.runner.*`
+        - Logs: `journalctl -u actions.runner.*`
+      CREDENTIALS.md: |
+        # Credentials — GITHUB_RUNNER
+
+        | Variable | Type | Notes |
+        |----------|------|-------|
+        | `GH_OWNER` | config | Org or user the runner is registered against |
+        | `GH_RUNNER_TOKEN` | secret | Ephemeral (~1h). Regenerate per registration. |
+
+  - id: APPLE
+    category: mobile_auth
+    detectors:
+      imports: []
+      env_vars:
+        - "APP_STORE_CONNECT_API_KEY"
+        - "FASTLANE_USER"
+        - "MATCH_PASSWORD"
+      deps: []
+    dashboard_url: "https://appstoreconnect.apple.com"
+    manual_only: true
+    env_example: |
+      # APPLE — App Store Connect + Fastlane Match
+      # API key JSON: appstoreconnect.apple.com → Users and Access → Keys
+      ASC_KEY_ID=
+      ASC_ISSUER_ID=
+      ASC_KEY_PATH=./AuthKey_XXXXXXXXXX.p8
+      # Fastlane Match (keep names EXACT: the SDK requires them)
+      MATCH_PASSWORD=
+      MATCH_GIT_URL=
+    files:
+      README.md: |
+        # APPLE
+
+        App Store Connect: API key, Fastlane Match (certs/profiles), Team ID.
+
+        ## Manual setup
+
+        1. Download the API key (`.p8`) from App Store Connect → Users and Access → Keys.
+        2. Save it in this folder as `AuthKey_<KEY_ID>.p8` (gitignored).
+        3. Configure `MATCH_PASSWORD` and `MATCH_GIT_URL` for the certs repo.
+
+        ## No automated smoke-test
+
+        Verify via Fastlane: `fastlane match development --readonly`.
+      CREDENTIALS.md: |
+        # Credentials — APPLE
+
+        Dashboard: https://appstoreconnect.apple.com
+
+        | Artifact | Notes |
+        |----------|-------|
+        | `AuthKey_*.p8`     | API key downloaded ONCE. Keep it safe. |
+        | `ASC_KEY_ID`       | Visible next to the key in the dashboard |
+        | `ASC_ISSUER_ID`    | Visible in Users and Access → Keys |
+        | `MATCH_PASSWORD`   | Name required by Fastlane (not `APPLE_*`) |
+        | `MATCH_GIT_URL`    | Private repo with encrypted certs |
+
+  - id: GOOGLE_PLAY
+    category: mobile_auth
+    detectors:
+      imports: []
+      env_vars:
+        - "GOOGLE_PLAY_SERVICE_ACCOUNT"
+        - "SUPPLY_JSON_KEY"
+      deps: []
+    dashboard_url: "https://play.google.com/console"
+    manual_only: true
+    env_example: |
+      # GOOGLE PLAY Console
+      # Service account JSON: Play Console → Setup → API access → Service accounts
+      GOOGLE_PLAY_SERVICE_ACCOUNT=./play-service-account.json
+      PACKAGE_NAME=
+    files:
+      README.md: |
+        # GOOGLE_PLAY
+
+        Play Console: service account JSON, upload keystore, package name.
+
+        ## Manual setup
+
+        1. Create a GCP service account and link it in Play Console → Setup → API access.
+        2. Download the JSON and save it here as `play-service-account.json` (gitignored).
+        3. `PACKAGE_NAME` must match `applicationId` from the Android build.
+
+        ## No automated smoke-test
+
+        Verify via Fastlane: `fastlane supply --track internal --skip_upload_apk --skip_upload_aab`.
+      CREDENTIALS.md: |
+        # Credentials — GOOGLE_PLAY
+
+        Dashboard: https://play.google.com/console
+
+        | Artifact | Notes |
+        |----------|-------|
+        | `play-service-account.json` | DO NOT commit; gitignored |
+        | `PACKAGE_NAME` | applicationId of the Android project |
+
+  # ------------------------------------------------------------------
+  # IA / LLMs (texto)
+  # ------------------------------------------------------------------
+
+  - id: OPENAI
+    category: ia_texto
+    detectors:
+      imports: ["import openai", "from openai", "require('openai')", "@ai-sdk/openai", "from langchain_openai"]
+      env_vars: ["OPENAI_API_KEY", "OPENAI_ORG_ID"]
+      deps: ["openai", "@ai-sdk/openai", "langchain-openai"]
+    dashboard_url: "https://platform.openai.com/api-keys"
+    env_example: |
+      # OPENAI — generate at https://platform.openai.com/api-keys
+      OPENAI_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${OPENAI_API_KEY:?OPENAI_API_KEY not set}"
+        N=$(curl -fsS https://api.openai.com/v1/models -H "Authorization: Bearer $OPENAI_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — $N models available."
+      README.md: |
+        # OPENAI
+        OpenAI API (GPT, embeddings, DALL·E, Whisper).
+        ## Setup
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Key from https://platform.openai.com/api-keys
+        3. `./test_connection.sh`
+      CREDENTIALS.md: |
+        # Credentials — OPENAI
+        Dashboard: https://platform.openai.com/api-keys
+        | Variable | Type |
+        |----------|------|
+        | `OPENAI_API_KEY` | secret |
+
+  - id: ANTHROPIC
+    category: ia_texto
+    detectors:
+      imports: ["import anthropic", "from anthropic", "@anthropic-ai/sdk", "@ai-sdk/anthropic", "from langchain_anthropic"]
+      env_vars: ["ANTHROPIC_API_KEY"]
+      deps: ["anthropic", "@anthropic-ai/sdk", "@ai-sdk/anthropic", "langchain-anthropic"]
+    dashboard_url: "https://console.anthropic.com/settings/keys"
+    env_example: |
+      # ANTHROPIC — generate at https://console.anthropic.com/settings/keys
+      ANTHROPIC_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${ANTHROPIC_API_KEY:?ANTHROPIC_API_KEY not set}"
+        N=$(curl -fsS https://api.anthropic.com/v1/models -H "x-api-key: $ANTHROPIC_API_KEY" -H "anthropic-version: 2023-06-01" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — $N Claude models available."
+      README.md: |
+        # ANTHROPIC
+        Claude API (Opus, Sonnet, Haiku).
+        ## Setup
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Key from https://console.anthropic.com/settings/keys
+        3. `./test_connection.sh`
+      CREDENTIALS.md: |
+        # Credentials — ANTHROPIC
+        Dashboard: https://console.anthropic.com/settings/keys
+        `ANTHROPIC_API_KEY` — secret. Rotate on leak.
+
+  - id: GOOGLE_AI
+    category: ia_texto
+    detectors:
+      imports: ["import google.generativeai", "from google import genai", "@google/generative-ai", "@ai-sdk/google"]
+      env_vars: ["GOOGLE_API_KEY", "GEMINI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"]
+      deps: ["google-generativeai", "@google/generative-ai", "@ai-sdk/google"]
+    dashboard_url: "https://aistudio.google.com/apikey"
+    env_example: |
+      # GOOGLE AI (Gemini) — generate at https://aistudio.google.com/apikey
+      GEMINI_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        KEY="${GEMINI_API_KEY:-${GOOGLE_API_KEY:-}}"
+        [ -n "$KEY" ] || { echo "ERROR: GEMINI_API_KEY not set" >&2; exit 1; }
+        N=$(curl -fsS "https://generativelanguage.googleapis.com/v1beta/models?key=$KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["models"]))')
+        echo "OK — $N Gemini models available."
+      README.md: |
+        # GOOGLE_AI
+        Google Gemini API (text + multimodal).
+        ## Setup
+        1. `cp .env.example .env && chmod 600 .env`
+        2. Key from https://aistudio.google.com/apikey
+        3. `./test_connection.sh`
+      CREDENTIALS.md: |
+        # Credentials — GOOGLE_AI
+        Dashboard: https://aistudio.google.com/apikey
+        `GEMINI_API_KEY` — secret. Shares AI Studio quotas.
+
+  - id: COHERE
+    category: ia_texto
+    detectors:
+      imports: ["import cohere", "from cohere"]
+      env_vars: ["COHERE_API_KEY", "CO_API_KEY"]
+      deps: ["cohere", "cohere-ai"]
+    dashboard_url: "https://dashboard.cohere.com/api-keys"
+    env_example: |
+      COHERE_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${COHERE_API_KEY:?COHERE_API_KEY not set}"
+        curl -fsS https://api.cohere.com/v1/check-api-key -X POST -H "Authorization: Bearer $COHERE_API_KEY" >/dev/null
+        echo "OK — Cohere API key valid."
+      README.md: |
+        # COHERE
+        Cohere API (embed, rerank, command).
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.cohere.com/api-keys
+        `COHERE_API_KEY` — secret.
+
+  - id: MISTRAL
+    category: ia_texto
+    detectors:
+      imports: ["import mistralai", "from mistralai", "@mistralai/mistralai", "@ai-sdk/mistral"]
+      env_vars: ["MISTRAL_API_KEY"]
+      deps: ["mistralai", "@mistralai/mistralai", "@ai-sdk/mistral"]
+    dashboard_url: "https://console.mistral.ai/api-keys"
+    env_example: |
+      MISTRAL_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${MISTRAL_API_KEY:?MISTRAL_API_KEY not set}"
+        N=$(curl -fsS https://api.mistral.ai/v1/models -H "Authorization: Bearer $MISTRAL_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — $N Mistral models."
+      README.md: |
+        # MISTRAL
+        Mistral AI API (Mistral, Codestral, Pixtral).
+      CREDENTIALS.md: |
+        Dashboard: https://console.mistral.ai/api-keys
+        `MISTRAL_API_KEY` — secret.
+
+  - id: TOGETHER_AI
+    category: ia_texto
+    detectors:
+      imports: ["import together", "from together", "@ai-sdk/togetherai"]
+      env_vars: ["TOGETHER_API_KEY", "TOGETHERAI_API_KEY"]
+      deps: ["together", "@ai-sdk/togetherai"]
+    dashboard_url: "https://api.together.ai/settings/api-keys"
+    env_example: |
+      TOGETHER_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${TOGETHER_API_KEY:?TOGETHER_API_KEY not set}"
+        N=$(curl -fsS https://api.together.xyz/v1/models -H "Authorization: Bearer $TOGETHER_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)))')
+        echo "OK — $N open-source models via Together."
+      README.md: |
+        # TOGETHER_AI
+        Cheap inference for open-source models (Llama, Mixtral, etc.).
+      CREDENTIALS.md: |
+        Dashboard: https://api.together.ai/settings/api-keys
+        `TOGETHER_API_KEY` — secret.
+
+  - id: HUGGINGFACE
+    category: ia_texto
+    detectors:
+      imports: ["from huggingface_hub", "import huggingface_hub", "@huggingface/inference"]
+      env_vars: ["HF_TOKEN", "HUGGINGFACE_API_KEY", "HUGGINGFACEHUB_API_TOKEN"]
+      deps: ["huggingface_hub", "@huggingface/inference"]
+    dashboard_url: "https://huggingface.co/settings/tokens"
+    env_example: |
+      HF_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${HF_TOKEN:-${HUGGINGFACE_API_KEY:-${HUGGINGFACEHUB_API_TOKEN:-}}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: HF_TOKEN not set" >&2; exit 1; }
+        USER=$(curl -fsS https://huggingface.co/api/whoami-v2 -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["name"])')
+        echo "OK — authed as $USER."
+      README.md: |
+        # HUGGINGFACE
+        Hub + Inference API + Spaces.
+      CREDENTIALS.md: |
+        Dashboard: https://huggingface.co/settings/tokens
+        `HF_TOKEN` — secret. Minimal scopes for the Inference API.
+
+  - id: PERPLEXITY
+    category: ia_texto
+    detectors:
+      imports: ["@ai-sdk/perplexity"]
+      env_vars: ["PERPLEXITY_API_KEY", "PPLX_API_KEY"]
+      deps: ["@ai-sdk/perplexity"]
+    dashboard_url: "https://www.perplexity.ai/settings/api"
+    env_example: |
+      PERPLEXITY_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Perplexity has no /models endpoint; validate via a tiny POST.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${PERPLEXITY_API_KEY:?PERPLEXITY_API_KEY not set}"
+        RESP=$(curl -fsS https://api.perplexity.ai/chat/completions \
+          -H "Authorization: Bearer $PERPLEXITY_API_KEY" \
+          -H "Content-Type: application/json" \
+          -d '{"model":"sonar","messages":[{"role":"user","content":"ping"}],"max_tokens":1}')
+        echo "OK — Perplexity API key valid."
+      README.md: |
+        # PERPLEXITY
+        Perplexity Sonar API (search-grounded LLM).
+        > The smoke-test sends 1 token. Cost is negligible.
+      CREDENTIALS.md: |
+        Dashboard: https://www.perplexity.ai/settings/api
+        `PERPLEXITY_API_KEY` — secret.
+
+  # ------------------------------------------------------------------
+  # IA / multimedia (audio, imagen, vídeo)
+  # ------------------------------------------------------------------
+
+  - id: ELEVENLABS
+    category: ia_media
+    detectors:
+      imports: ["from elevenlabs", "import elevenlabs", "@elevenlabs/elevenlabs-js"]
+      env_vars: ["ELEVENLABS_API_KEY", "ELEVEN_API_KEY"]
+      deps: ["elevenlabs", "@elevenlabs/elevenlabs-js"]
+    dashboard_url: "https://elevenlabs.io/app/settings/api-keys"
+    env_example: |
+      ELEVENLABS_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        KEY="${ELEVENLABS_API_KEY:-${ELEVEN_API_KEY:-}}"
+        [ -n "$KEY" ] || { echo "ERROR: ELEVENLABS_API_KEY not set" >&2; exit 1; }
+        TIER=$(curl -fsS https://api.elevenlabs.io/v1/user -H "xi-api-key: $KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("subscription",{}).get("tier","?"))')
+        echo "OK — ElevenLabs tier: $TIER."
+      README.md: |
+        # ELEVENLABS
+        Text-to-speech, voice cloning, dubbing.
+      CREDENTIALS.md: |
+        Dashboard: https://elevenlabs.io/app/settings/api-keys
+        `ELEVENLABS_API_KEY` — secret.
+
+  - id: FAL_AI
+    category: ia_media
+    detectors:
+      imports: ["import fal_client", "from fal_client", "@fal-ai/client"]
+      env_vars: ["FAL_KEY", "FAL_API_KEY"]
+      deps: ["fal-client", "@fal-ai/client"]
+    dashboard_url: "https://fal.ai/dashboard/keys"
+    env_example: |
+      FAL_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Lightweight validation: GET on the queue API with auth Key.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${FAL_KEY:?FAL_KEY not set}"
+        curl -fsS https://queue.fal.run/health -H "Authorization: Key $FAL_KEY" >/dev/null
+        echo "OK — fal.ai queue reachable."
+      README.md: |
+        # FAL_AI
+        Fast inference of image/video models (Flux, etc.).
+      CREDENTIALS.md: |
+        Dashboard: https://fal.ai/dashboard/keys
+        `FAL_KEY` — secret.
+
+  - id: DEEPGRAM
+    category: ia_media
+    detectors:
+      imports: ["from deepgram", "import deepgram", "@deepgram/sdk"]
+      env_vars: ["DEEPGRAM_API_KEY"]
+      deps: ["deepgram-sdk", "@deepgram/sdk"]
+    dashboard_url: "https://console.deepgram.com/project/_/keys"
+    env_example: |
+      DEEPGRAM_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${DEEPGRAM_API_KEY:?DEEPGRAM_API_KEY not set}"
+        N=$(curl -fsS https://api.deepgram.com/v1/projects -H "Authorization: Token $DEEPGRAM_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["projects"]))')
+        echo "OK — $N Deepgram projects."
+      README.md: |
+        # DEEPGRAM
+        Speech-to-text + audio intelligence.
+      CREDENTIALS.md: |
+        Dashboard: https://console.deepgram.com
+        `DEEPGRAM_API_KEY` — secret.
+
+  - id: ASSEMBLYAI
+    category: ia_media
+    detectors:
+      imports: ["import assemblyai", "from assemblyai", "assemblyai"]
+      env_vars: ["ASSEMBLYAI_API_KEY"]
+      deps: ["assemblyai"]
+    dashboard_url: "https://www.assemblyai.com/app/account"
+    env_example: |
+      ASSEMBLYAI_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${ASSEMBLYAI_API_KEY:?ASSEMBLYAI_API_KEY not set}"
+        curl -fsS https://api.assemblyai.com/v2/transcript -H "Authorization: $ASSEMBLYAI_API_KEY" -G --data-urlencode "limit=1" >/dev/null
+        echo "OK — AssemblyAI API key valid."
+      README.md: |
+        # ASSEMBLYAI
+        Speech-to-text + LeMUR (LLM sobre audio).
+      CREDENTIALS.md: |
+        Dashboard: https://www.assemblyai.com/app/account
+        `ASSEMBLYAI_API_KEY` — secret.
+
+  # ------------------------------------------------------------------
+  # Email (transaccional)
+  # ------------------------------------------------------------------
+
+  - id: SENDGRID
+    category: email
+    detectors:
+      imports: ["from sendgrid", "import sendgrid", "@sendgrid/mail"]
+      env_vars: ["SENDGRID_API_KEY"]
+      deps: ["sendgrid", "@sendgrid/mail"]
+    dashboard_url: "https://app.sendgrid.com/settings/api_keys"
+    env_example: |
+      SENDGRID_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${SENDGRID_API_KEY:?SENDGRID_API_KEY not set}"
+        TYPE=$(curl -fsS https://api.sendgrid.com/v3/scopes -H "Authorization: Bearer $SENDGRID_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["scopes"]))')
+        echo "OK — SendGrid API key con $TYPE scopes."
+      README.md: |
+        # SENDGRID
+        Email transaccional (Twilio SendGrid).
+      CREDENTIALS.md: |
+        Dashboard: https://app.sendgrid.com/settings/api_keys
+        `SENDGRID_API_KEY` — secret.
+
+  - id: POSTMARK
+    category: email
+    detectors:
+      imports: ["from postmarker", "import postmarker", "postmark"]
+      env_vars: ["POSTMARK_SERVER_TOKEN", "POSTMARK_API_TOKEN"]
+      deps: ["postmark", "postmarker"]
+    dashboard_url: "https://account.postmarkapp.com/servers"
+    env_example: |
+      POSTMARK_SERVER_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${POSTMARK_SERVER_TOKEN:?POSTMARK_SERVER_TOKEN not set}"
+        NAME=$(curl -fsS https://api.postmarkapp.com/server -H "Accept: application/json" -H "X-Postmark-Server-Token: $POSTMARK_SERVER_TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["Name"])')
+        echo "OK — Postmark server: $NAME."
+      README.md: |
+        # POSTMARK
+        Email transaccional rápido y simple.
+      CREDENTIALS.md: |
+        Dashboard: https://account.postmarkapp.com/servers
+        `POSTMARK_SERVER_TOKEN` — uno por server, scoped.
+
+  - id: RESEND
+    category: email
+    detectors:
+      imports: ["from resend", "import resend", "resend"]
+      env_vars: ["RESEND_API_KEY"]
+      deps: ["resend"]
+    dashboard_url: "https://resend.com/api-keys"
+    env_example: |
+      RESEND_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${RESEND_API_KEY:?RESEND_API_KEY not set}"
+        N=$(curl -fsS https://api.resend.com/domains -H "Authorization: Bearer $RESEND_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — Resend dominios: $N."
+      README.md: |
+        # RESEND
+        Email transaccional para developers (React Email-friendly).
+      CREDENTIALS.md: |
+        Dashboard: https://resend.com/api-keys
+        `RESEND_API_KEY` — secret.
+
+  - id: MAILGUN
+    category: email
+    detectors:
+      imports: ["import mailgun", "from mailgun", "mailgun.js"]
+      env_vars: ["MAILGUN_API_KEY", "MAILGUN_DOMAIN"]
+      deps: ["mailgun", "mailgun.js"]
+    dashboard_url: "https://app.mailgun.com/settings/api_security"
+    env_example: |
+      MAILGUN_API_KEY=
+      MAILGUN_DOMAIN=
+      MAILGUN_REGION=api
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${MAILGUN_API_KEY:?MAILGUN_API_KEY not set}"
+        REGION="${MAILGUN_REGION:-api}"
+        N=$(curl -fsS "https://${REGION}.mailgun.net/v4/domains" -u "api:$MAILGUN_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["total_count"])')
+        echo "OK — Mailgun dominios: $N."
+      README.md: |
+        # MAILGUN
+        Email transaccional + email parsing.
+      CREDENTIALS.md: |
+        Dashboard: https://app.mailgun.com/settings/api_security
+        Region: `api` (US) o `api.eu`.
+
+  - id: AWS_SES
+    category: email
+    detectors:
+      imports: ["from boto3", "import boto3", "@aws-sdk/client-ses"]
+      env_vars: ["AWS_SES_ACCESS_KEY_ID", "SES_REGION"]
+      deps: ["@aws-sdk/client-ses"]
+    dashboard_url: "https://console.aws.amazon.com/ses"
+    manual_only: true
+    env_example: |
+      # AWS SES — usa el CLI oficial de AWS para verificar.
+      AWS_ACCESS_KEY_ID=
+      AWS_SECRET_ACCESS_KEY=
+      AWS_REGION=eu-west-1
+    files:
+      README.md: |
+        # AWS_SES
+        Amazon SES para email transaccional. La auth SigV4 es compleja —
+        verifica con el AWS CLI:
+
+            aws ses get-account-sending-enabled --region $AWS_REGION
+
+        ## No hay smoke-test bash automatizado
+        SigV4 requiere firma HMAC compleja; usa boto3 o el AWS CLI.
+      CREDENTIALS.md: |
+        Dashboard: https://console.aws.amazon.com/ses
+        Credentials: IAM access key with the `ses:SendEmail` policy.
+
+  # ------------------------------------------------------------------
+  # Payments & billing
+  # ------------------------------------------------------------------
+
+  - id: PADDLE
+    category: pagos
+    detectors:
+      imports: ["@paddle/paddle-node-sdk", "@paddle/paddle-js"]
+      env_vars: ["PADDLE_API_KEY", "PADDLE_VENDOR_ID", "PADDLE_NOTIFICATION_SECRET"]
+      deps: ["@paddle/paddle-node-sdk", "@paddle/paddle-js"]
+    dashboard_url: "https://vendors.paddle.com/authentication"
+    env_example: |
+      # PADDLE — generate at https://vendors.paddle.com/authentication
+      PADDLE_API_KEY=
+      PADDLE_ENV=sandbox
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${PADDLE_API_KEY:?PADDLE_API_KEY not set}"
+        HOST="https://api.paddle.com"
+        [ "${PADDLE_ENV:-}" = "sandbox" ] && HOST="https://sandbox-api.paddle.com"
+        N=$(curl -fsS "$HOST/products" -H "Authorization: Bearer $PADDLE_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — Paddle ($PADDLE_ENV) products: $N."
+      README.md: |
+        # PADDLE
+        Merchant-of-record billing (subscriptions, taxes handled).
+      CREDENTIALS.md: |
+        Dashboard: https://vendors.paddle.com/authentication
+        `PADDLE_API_KEY` — secret. Set `PADDLE_ENV=sandbox` for the sandbox.
+
+  - id: LEMONSQUEEZY
+    category: pagos
+    detectors:
+      imports: ["@lemonsqueezy/lemonsqueezy.js"]
+      env_vars: ["LEMONSQUEEZY_API_KEY", "LEMONSQUEEZY_STORE_ID", "LEMONSQUEEZY_WEBHOOK_SECRET"]
+      deps: ["@lemonsqueezy/lemonsqueezy.js"]
+    dashboard_url: "https://app.lemonsqueezy.com/settings/api"
+    env_example: |
+      LEMONSQUEEZY_API_KEY=
+      LEMONSQUEEZY_STORE_ID=
+      LEMONSQUEEZY_WEBHOOK_SECRET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${LEMONSQUEEZY_API_KEY:?LEMONSQUEEZY_API_KEY not set}"
+        NAME=$(curl -fsS https://api.lemonsqueezy.com/v1/users/me \
+          -H "Accept: application/vnd.api+json" \
+          -H "Authorization: Bearer $LEMONSQUEEZY_API_KEY" \
+          | python3 -c 'import json,sys; print(json.load(sys.stdin)["data"]["attributes"]["name"])')
+        echo "OK — Lemon Squeezy authed as $NAME."
+      README.md: |
+        # LEMONSQUEEZY
+        Merchant-of-record SaaS billing (alternative to Paddle).
+      CREDENTIALS.md: |
+        Dashboard: https://app.lemonsqueezy.com/settings/api
+        `LEMONSQUEEZY_API_KEY` — secret. `LEMONSQUEEZY_STORE_ID` from the URL of the store page.
+
+  - id: REVENUECAT
+    category: pagos
+    detectors:
+      imports: ["import Purchases", "from purchases", "@revenuecat/purchases-js", "react-native-purchases", "purchases_flutter"]
+      env_vars: ["REVENUECAT_API_KEY", "REVENUECAT_SECRET_API_KEY"]
+      deps: ["@revenuecat/purchases-js", "react-native-purchases", "purchases-flutter"]
+    dashboard_url: "https://app.revenuecat.com/projects"
+    env_example: |
+      # Secret API key for server-side ops (mobile clients use public SDK keys).
+      REVENUECAT_SECRET_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${REVENUECAT_SECRET_API_KEY:?REVENUECAT_SECRET_API_KEY not set}"
+        # v2 API: list projects under the current account.
+        N=$(curl -fsS https://api.revenuecat.com/v2/projects -H "Authorization: Bearer $REVENUECAT_SECRET_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin).get("items",[])))')
+        echo "OK — RevenueCat projects: $N."
+      README.md: |
+        # REVENUECAT
+        Cross-platform subscription management (iOS + Android + web).
+      CREDENTIALS.md: |
+        Dashboard: https://app.revenuecat.com/projects
+        `REVENUECAT_SECRET_API_KEY` — secret, for server-side calls only.
+        Public SDK keys (iOS/Android/web) go directly in the client.
+
+  # ------------------------------------------------------------------
+  # Auth & identity
+  # ------------------------------------------------------------------
+
+  - id: CLERK
+    category: auth
+    detectors:
+      imports: ["@clerk/clerk-sdk-node", "@clerk/nextjs", "@clerk/clerk-react", "@clerk/backend", "from clerk_backend_api"]
+      env_vars: ["CLERK_SECRET_KEY", "CLERK_PUBLISHABLE_KEY", "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY"]
+      deps: ["@clerk/nextjs", "@clerk/clerk-sdk-node", "@clerk/backend", "clerk-backend-api"]
+    dashboard_url: "https://dashboard.clerk.com"
+    env_example: |
+      CLERK_SECRET_KEY=
+      CLERK_PUBLISHABLE_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${CLERK_SECRET_KEY:?CLERK_SECRET_KEY not set}"
+        N=$(curl -fsS https://api.clerk.com/v1/users?limit=1 -H "Authorization: Bearer $CLERK_SECRET_KEY" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(len(d) if isinstance(d,list) else "?")')
+        echo "OK — Clerk users endpoint accessible (sample: $N)."
+      README.md: |
+        # CLERK
+        Drop-in auth + user management for Next.js, React, Expo.
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.clerk.com
+        `CLERK_SECRET_KEY` — backend secret. `CLERK_PUBLISHABLE_KEY` — public.
+
+  - id: WORKOS
+    category: auth
+    detectors:
+      imports: ["@workos-inc/node", "@workos-inc/authkit-nextjs", "import workos"]
+      env_vars: ["WORKOS_API_KEY", "WORKOS_CLIENT_ID"]
+      deps: ["@workos-inc/node", "@workos-inc/authkit-nextjs", "workos"]
+    dashboard_url: "https://dashboard.workos.com/api-keys"
+    env_example: |
+      WORKOS_API_KEY=
+      WORKOS_CLIENT_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${WORKOS_API_KEY:?WORKOS_API_KEY not set}"
+        N=$(curl -fsS "https://api.workos.com/organizations?limit=1" -H "Authorization: Bearer $WORKOS_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — WorkOS organizations sample: $N."
+      README.md: |
+        # WORKOS
+        Enterprise SSO (SAML, OIDC), SCIM, Directory Sync, AuthKit.
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.workos.com/api-keys
+        `WORKOS_API_KEY` — secret. `WORKOS_CLIENT_ID` — public.
+
+  - id: AUTH0
+    category: auth
+    detectors:
+      imports: ["@auth0/nextjs-auth0", "@auth0/auth0-react", "@auth0/auth0-spa-js", "from auth0"]
+      env_vars: ["AUTH0_DOMAIN", "AUTH0_CLIENT_ID", "AUTH0_CLIENT_SECRET", "AUTH0_MGMT_API_TOKEN"]
+      deps: ["@auth0/nextjs-auth0", "@auth0/auth0-react", "auth0"]
+    dashboard_url: "https://manage.auth0.com"
+    env_example: |
+      AUTH0_DOMAIN=
+      AUTH0_CLIENT_ID=
+      AUTH0_CLIENT_SECRET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Auth0: validate that the tenant domain serves OIDC discovery.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${AUTH0_DOMAIN:?AUTH0_DOMAIN not set}"
+        ISSUER=$(curl -fsS "https://${AUTH0_DOMAIN}/.well-known/openid-configuration" | python3 -c 'import json,sys; print(json.load(sys.stdin)["issuer"])')
+        echo "OK — Auth0 tenant reachable: $ISSUER."
+      README.md: |
+        # AUTH0
+        Identity platform (login, MFA, social, enterprise SSO).
+        > Management API checks need a separate M2M token — see CREDENTIALS.md.
+      CREDENTIALS.md: |
+        Dashboard: https://manage.auth0.com
+        - `AUTH0_DOMAIN` — `<tenant>.auth0.com` or custom domain.
+        - `AUTH0_CLIENT_ID` / `AUTH0_CLIENT_SECRET` — per Application.
+        - `AUTH0_MGMT_API_TOKEN` — only needed for Management API calls.
+
+  - id: STYTCH
+    category: auth
+    detectors:
+      imports: ["import stytch", "from stytch", "@stytch/nextjs", "stytch"]
+      env_vars: ["STYTCH_PROJECT_ID", "STYTCH_SECRET"]
+      deps: ["stytch", "@stytch/nextjs"]
+    dashboard_url: "https://stytch.com/dashboard/api-keys"
+    env_example: |
+      STYTCH_PROJECT_ID=
+      STYTCH_SECRET=
+      STYTCH_ENV=test
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${STYTCH_PROJECT_ID:?STYTCH_PROJECT_ID not set}"
+        : "${STYTCH_SECRET:?STYTCH_SECRET not set}"
+        HOST="https://test.stytch.com"
+        [ "${STYTCH_ENV:-test}" = "live" ] && HOST="https://api.stytch.com"
+        # Lists trusted metadata — read-only, safe smoke test.
+        curl -fsS "$HOST/v1/projects" -u "$STYTCH_PROJECT_ID:$STYTCH_SECRET" >/dev/null
+        echo "OK — Stytch ($STYTCH_ENV) auth valid."
+      README.md: |
+        # STYTCH
+        Passwordless + passkeys + B2B SaaS auth APIs.
+      CREDENTIALS.md: |
+        Dashboard: https://stytch.com/dashboard/api-keys
+        `STYTCH_PROJECT_ID` + `STYTCH_SECRET`. Set `STYTCH_ENV=live` for prod.
+
+  - id: KINDE
+    category: auth
+    detectors:
+      imports: ["@kinde-oss/kinde-auth-nextjs", "@kinde-oss/kinde-typescript-sdk", "@kinde-oss/kinde-auth-react"]
+      env_vars: ["KINDE_CLIENT_ID", "KINDE_CLIENT_SECRET", "KINDE_ISSUER_URL", "KINDE_M2M_CLIENT_ID", "KINDE_M2M_CLIENT_SECRET"]
+      deps: ["@kinde-oss/kinde-auth-nextjs", "@kinde-oss/kinde-typescript-sdk"]
+    dashboard_url: "https://app.kinde.com"
+    env_example: |
+      KINDE_ISSUER_URL=
+      KINDE_CLIENT_ID=
+      KINDE_CLIENT_SECRET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${KINDE_ISSUER_URL:?KINDE_ISSUER_URL not set}"
+        ISSUER=$(curl -fsS "${KINDE_ISSUER_URL%/}/.well-known/openid-configuration" | python3 -c 'import json,sys; print(json.load(sys.stdin)["issuer"])')
+        echo "OK — Kinde tenant reachable: $ISSUER."
+      README.md: |
+        # KINDE
+        Auth + user management with feature flags built in.
+      CREDENTIALS.md: |
+        Dashboard: https://app.kinde.com
+        `KINDE_ISSUER_URL` is `https://<subdomain>.kinde.com`.
+        Management API needs M2M client (see KINDE_M2M_*).
+
+  # ------------------------------------------------------------------
+  # Databases & backend-as-a-service
+  # ------------------------------------------------------------------
+
+  - id: SUPABASE
+    category: datos
+    detectors:
+      imports: ["@supabase/supabase-js", "@supabase/ssr", "from supabase", "import supabase"]
+      env_vars: ["SUPABASE_URL", "SUPABASE_ANON_KEY", "SUPABASE_SERVICE_ROLE_KEY", "NEXT_PUBLIC_SUPABASE_URL"]
+      deps: ["@supabase/supabase-js", "@supabase/ssr", "supabase"]
+    dashboard_url: "https://supabase.com/dashboard"
+    env_example: |
+      SUPABASE_URL=
+      SUPABASE_ANON_KEY=
+      SUPABASE_SERVICE_ROLE_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${SUPABASE_URL:?SUPABASE_URL not set}"
+        : "${SUPABASE_ANON_KEY:?SUPABASE_ANON_KEY not set}"
+        curl -fsS "${SUPABASE_URL%/}/auth/v1/health" -H "apikey: $SUPABASE_ANON_KEY" >/dev/null
+        echo "OK — Supabase auth service reachable."
+      README.md: |
+        # SUPABASE
+        Postgres + Auth + Storage + Realtime + Edge Functions.
+      CREDENTIALS.md: |
+        Dashboard: https://supabase.com/dashboard
+        `SUPABASE_ANON_KEY` — public.
+        `SUPABASE_SERVICE_ROLE_KEY` — secret, bypasses RLS. Server-only.
+
+  - id: NEON
+    category: datos
+    detectors:
+      imports: ["@neondatabase/serverless", "from neon"]
+      env_vars: ["NEON_API_KEY", "NEON_PROJECT_ID", "DATABASE_URL"]
+      deps: ["@neondatabase/serverless"]
+    dashboard_url: "https://console.neon.tech/app/settings/api-keys"
+    env_example: |
+      NEON_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${NEON_API_KEY:?NEON_API_KEY not set}"
+        N=$(curl -fsS https://console.neon.tech/api/v2/projects -H "Authorization: Bearer $NEON_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["projects"]))')
+        echo "OK — Neon projects: $N."
+      README.md: |
+        # NEON
+        Serverless Postgres with branching.
+      CREDENTIALS.md: |
+        Dashboard: https://console.neon.tech/app/settings/api-keys
+        `NEON_API_KEY` — secret.
+
+  - id: PLANETSCALE
+    category: datos
+    detectors:
+      imports: ["@planetscale/database", "from planetscale"]
+      env_vars: ["PLANETSCALE_TOKEN", "PLANETSCALE_SERVICE_TOKEN", "PLANETSCALE_SERVICE_TOKEN_NAME", "DATABASE_URL"]
+      deps: ["@planetscale/database"]
+    dashboard_url: "https://app.planetscale.com/settings/service-tokens"
+    env_example: |
+      PLANETSCALE_SERVICE_TOKEN_NAME=
+      PLANETSCALE_SERVICE_TOKEN=
+      PLANETSCALE_ORG=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${PLANETSCALE_SERVICE_TOKEN_NAME:?not set}"
+        : "${PLANETSCALE_SERVICE_TOKEN:?not set}"
+        : "${PLANETSCALE_ORG:?not set}"
+        N=$(curl -fsS "https://api.planetscale.com/v1/organizations/$PLANETSCALE_ORG/databases" \
+          -H "Authorization: ${PLANETSCALE_SERVICE_TOKEN_NAME}:${PLANETSCALE_SERVICE_TOKEN}" \
+          | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — PlanetScale databases: $N."
+      README.md: |
+        # PLANETSCALE
+        Serverless MySQL with branching.
+      CREDENTIALS.md: |
+        Dashboard: https://app.planetscale.com/settings/service-tokens
+        Service tokens use `NAME:TOKEN` in the Authorization header.
+
+  - id: TURSO
+    category: datos
+    detectors:
+      imports: ["@libsql/client", "libsql_client", "import libsql"]
+      env_vars: ["TURSO_AUTH_TOKEN", "TURSO_DATABASE_URL", "TURSO_API_TOKEN", "TURSO_ORG"]
+      deps: ["@libsql/client", "libsql"]
+    dashboard_url: "https://turso.tech/app"
+    env_example: |
+      TURSO_API_TOKEN=
+      TURSO_ORG=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${TURSO_API_TOKEN:?TURSO_API_TOKEN not set}"
+        : "${TURSO_ORG:?TURSO_ORG not set}"
+        N=$(curl -fsS "https://api.turso.tech/v1/organizations/$TURSO_ORG/databases" -H "Authorization: Bearer $TURSO_API_TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["databases"]))')
+        echo "OK — Turso databases: $N."
+      README.md: |
+        # TURSO
+        SQLite at the edge (libSQL).
+      CREDENTIALS.md: |
+        Dashboard: https://turso.tech/app
+        `TURSO_API_TOKEN` — for platform API.
+        `TURSO_AUTH_TOKEN` — per-database, for client connections.
+
+  - id: MONGODB_ATLAS
+    category: datos
+    detectors:
+      imports: ["pymongo", "from motor", "mongoose", "mongodb"]
+      env_vars: ["MONGODB_URI", "MONGO_URL", "ATLAS_PUBLIC_KEY", "ATLAS_PRIVATE_KEY"]
+      deps: ["pymongo", "motor", "mongoose", "mongodb"]
+    dashboard_url: "https://cloud.mongodb.com"
+    manual_only: true
+    env_example: |
+      # MongoDB Atlas — connection string for runtime + Atlas API key for ops.
+      MONGODB_URI=
+      ATLAS_PUBLIC_KEY=
+      ATLAS_PRIVATE_KEY=
+    files:
+      README.md: |
+        # MONGODB_ATLAS
+        Managed MongoDB. The Atlas Admin API uses HTTP digest auth which is
+        non-trivial in plain bash. Verify with:
+
+            mongosh "$MONGODB_URI" --eval "db.runCommand({ ping: 1 })"
+
+        or use the Atlas CLI: `atlas projects list`.
+      CREDENTIALS.md: |
+        Dashboard: https://cloud.mongodb.com
+        - `MONGODB_URI` — full SRV connection string for runtime.
+        - `ATLAS_PUBLIC_KEY` / `ATLAS_PRIVATE_KEY` — for Admin API (HTTP digest).
+
+  - id: UPSTASH_REDIS
+    category: datos
+    detectors:
+      imports: ["@upstash/redis", "@upstash/ratelimit"]
+      env_vars: ["UPSTASH_REDIS_REST_URL", "UPSTASH_REDIS_REST_TOKEN", "KV_REST_API_URL", "KV_REST_API_TOKEN"]
+      deps: ["@upstash/redis", "@upstash/ratelimit"]
+    dashboard_url: "https://console.upstash.com"
+    env_example: |
+      UPSTASH_REDIS_REST_URL=
+      UPSTASH_REDIS_REST_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        URL="${UPSTASH_REDIS_REST_URL:-${KV_REST_API_URL:-}}"
+        TOKEN="${UPSTASH_REDIS_REST_TOKEN:-${KV_REST_API_TOKEN:-}}"
+        [ -n "$URL" ] && [ -n "$TOKEN" ] || { echo "ERROR: missing URL/token" >&2; exit 1; }
+        # PING via REST API.
+        curl -fsS "${URL%/}/ping" -H "Authorization: Bearer $TOKEN" | grep -q PONG
+        echo "OK — Upstash Redis REST responds PONG."
+      README.md: |
+        # UPSTASH_REDIS
+        Serverless Redis (REST API friendly for edge runtimes).
+      CREDENTIALS.md: |
+        Dashboard: https://console.upstash.com
+        Both URL + token are needed; the URL embeds the DB region.
+
+  - id: CONVEX
+    category: datos
+    detectors:
+      imports: ["convex/server", "convex/react", "from convex"]
+      env_vars: ["CONVEX_URL", "CONVEX_DEPLOY_KEY", "CONVEX_DEPLOYMENT", "NEXT_PUBLIC_CONVEX_URL"]
+      deps: ["convex"]
+    dashboard_url: "https://dashboard.convex.dev"
+    manual_only: true
+    env_example: |
+      CONVEX_URL=
+      CONVEX_DEPLOY_KEY=
+    files:
+      README.md: |
+        # CONVEX
+        Reactive backend (TS functions + realtime DB). The deploy-key is
+        validated implicitly by `npx convex deploy`; there is no public
+        read-only smoke endpoint. Verify with:
+
+            npx convex run system:listFunctions
+
+        ## No automated smoke-test in bash
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.convex.dev
+        `CONVEX_URL` — public deployment URL.
+        `CONVEX_DEPLOY_KEY` — secret, only needed for CI/CD deploys.
+
+  # ------------------------------------------------------------------
+  # Search & vector databases
+  # ------------------------------------------------------------------
+
+  - id: PINECONE
+    category: busqueda
+    detectors:
+      imports: ["import pinecone", "from pinecone", "@pinecone-database/pinecone"]
+      env_vars: ["PINECONE_API_KEY", "PINECONE_ENVIRONMENT"]
+      deps: ["pinecone", "pinecone-client", "@pinecone-database/pinecone"]
+    dashboard_url: "https://app.pinecone.io"
+    env_example: |
+      PINECONE_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${PINECONE_API_KEY:?PINECONE_API_KEY not set}"
+        N=$(curl -fsS https://api.pinecone.io/indexes -H "Api-Key: $PINECONE_API_KEY" -H "X-Pinecone-API-Version: 2025-10" | python3 -c 'import json,sys; print(len(json.load(sys.stdin).get("indexes",[])))')
+        echo "OK — Pinecone indexes: $N."
+      README.md: |
+        # PINECONE
+        Managed vector database for RAG and similarity search.
+      CREDENTIALS.md: |
+        Dashboard: https://app.pinecone.io
+        `PINECONE_API_KEY` — secret, scoped per project.
+
+  - id: WEAVIATE
+    category: busqueda
+    detectors:
+      imports: ["import weaviate", "from weaviate", "weaviate-ts-client", "weaviate-client"]
+      env_vars: ["WEAVIATE_URL", "WEAVIATE_API_KEY"]
+      deps: ["weaviate-client", "weaviate-ts-client"]
+    dashboard_url: "https://console.weaviate.cloud"
+    env_example: |
+      WEAVIATE_URL=
+      WEAVIATE_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${WEAVIATE_URL:?WEAVIATE_URL not set}"
+        AUTH=()
+        [ -n "${WEAVIATE_API_KEY:-}" ] && AUTH=(-H "Authorization: Bearer ${WEAVIATE_API_KEY}")
+        VER=$(curl -fsS "${WEAVIATE_URL%/}/v1/meta" "${AUTH[@]+"${AUTH[@]}"}" | python3 -c 'import json,sys; print(json.load(sys.stdin)["version"])')
+        echo "OK — Weaviate version: $VER."
+      README.md: |
+        # WEAVIATE
+        Open-source vector DB with modules (text2vec, generative, etc.).
+      CREDENTIALS.md: |
+        Dashboard: https://console.weaviate.cloud (managed) or self-hosted.
+        `WEAVIATE_URL` — full base URL including scheme.
+
+  - id: QDRANT
+    category: busqueda
+    detectors:
+      imports: ["from qdrant_client", "import qdrant_client", "@qdrant/js-client-rest"]
+      env_vars: ["QDRANT_URL", "QDRANT_API_KEY"]
+      deps: ["qdrant-client", "@qdrant/js-client-rest"]
+    dashboard_url: "https://cloud.qdrant.io"
+    env_example: |
+      QDRANT_URL=
+      QDRANT_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${QDRANT_URL:?QDRANT_URL not set}"
+        AUTH=()
+        [ -n "${QDRANT_API_KEY:-}" ] && AUTH=(-H "api-key: ${QDRANT_API_KEY}")
+        N=$(curl -fsS "${QDRANT_URL%/}/collections" "${AUTH[@]+"${AUTH[@]}"}" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["result"]["collections"]))')
+        echo "OK — Qdrant collections: $N."
+      README.md: |
+        # QDRANT
+        Vector DB written in Rust. Managed (Qdrant Cloud) or self-hosted.
+      CREDENTIALS.md: |
+        Dashboard: https://cloud.qdrant.io
+        `QDRANT_URL` includes the port (6333 by default for self-hosted).
+
+  - id: ALGOLIA
+    category: busqueda
+    detectors:
+      imports: ["algoliasearch", "from algoliasearch", "import algoliasearch", "react-instantsearch"]
+      env_vars: ["ALGOLIA_APP_ID", "ALGOLIA_ADMIN_API_KEY", "ALGOLIA_SEARCH_API_KEY", "NEXT_PUBLIC_ALGOLIA_APP_ID"]
+      deps: ["algoliasearch", "react-instantsearch", "algoliasearch-helper"]
+    dashboard_url: "https://dashboard.algolia.com/account/api-keys"
+    env_example: |
+      ALGOLIA_APP_ID=
+      ALGOLIA_ADMIN_API_KEY=
+      ALGOLIA_SEARCH_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${ALGOLIA_APP_ID:?ALGOLIA_APP_ID not set}"
+        : "${ALGOLIA_ADMIN_API_KEY:?ALGOLIA_ADMIN_API_KEY not set}"
+        N=$(curl -fsS "https://${ALGOLIA_APP_ID}.algolia.net/1/indexes" \
+          -H "X-Algolia-Application-Id: $ALGOLIA_APP_ID" \
+          -H "X-Algolia-API-Key: $ALGOLIA_ADMIN_API_KEY" \
+          | python3 -c 'import json,sys; print(json.load(sys.stdin)["nbHits"])')
+        echo "OK — Algolia indices: $N."
+      README.md: |
+        # ALGOLIA
+        Hosted search-as-a-service. Admin key for ops, search key for clients.
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.algolia.com/account/api-keys
+        `ALGOLIA_ADMIN_API_KEY` — secret, server-only.
+        `ALGOLIA_SEARCH_API_KEY` — public, safe for clients.
+
+  - id: TYPESENSE
+    category: busqueda
+    detectors:
+      imports: ["import typesense", "from typesense", "typesense"]
+      env_vars: ["TYPESENSE_API_KEY", "TYPESENSE_HOST", "TYPESENSE_PORT"]
+      deps: ["typesense"]
+    dashboard_url: "https://cloud.typesense.org/clusters"
+    env_example: |
+      TYPESENSE_HOST=
+      TYPESENSE_PORT=443
+      TYPESENSE_PROTOCOL=https
+      TYPESENSE_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${TYPESENSE_HOST:?TYPESENSE_HOST not set}"
+        : "${TYPESENSE_API_KEY:?TYPESENSE_API_KEY not set}"
+        PROTO="${TYPESENSE_PROTOCOL:-https}"
+        PORT="${TYPESENSE_PORT:-443}"
+        curl -fsS "${PROTO}://${TYPESENSE_HOST}:${PORT}/health" -H "X-TYPESENSE-API-KEY: $TYPESENSE_API_KEY" | grep -q '"ok":true'
+        echo "OK — Typesense health: ok."
+      README.md: |
+        # TYPESENSE
+        Open-source typo-tolerant search engine. Managed cloud available.
+      CREDENTIALS.md: |
+        Dashboard: https://cloud.typesense.org/clusters
+        `TYPESENSE_API_KEY` — generate per cluster.
+
+  - id: MEILISEARCH
+    category: busqueda
+    detectors:
+      imports: ["meilisearch", "import meilisearch", "from meilisearch"]
+      env_vars: ["MEILI_MASTER_KEY", "MEILI_URL", "MEILISEARCH_HOST"]
+      deps: ["meilisearch"]
+    dashboard_url: "https://cloud.meilisearch.com"
+    env_example: |
+      MEILI_URL=
+      MEILI_MASTER_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        URL="${MEILI_URL:-${MEILISEARCH_HOST:-}}"
+        [ -n "$URL" ] || { echo "ERROR: MEILI_URL not set" >&2; exit 1; }
+        : "${MEILI_MASTER_KEY:?MEILI_MASTER_KEY not set}"
+        curl -fsS "${URL%/}/health" -H "Authorization: Bearer $MEILI_MASTER_KEY" | grep -q available
+        echo "OK — Meilisearch available."
+      README.md: |
+        # MEILISEARCH
+        Open-source instant search. Managed cloud or self-hosted.
+      CREDENTIALS.md: |
+        Dashboard: https://cloud.meilisearch.com
+        `MEILI_MASTER_KEY` — secret. Use scoped API keys for clients.
+
+  # ------------------------------------------------------------------
+  # Observability (logs, errors, tracing, product analytics)
+  # ------------------------------------------------------------------
+
+  - id: SENTRY
+    category: observabilidad
+    detectors:
+      imports: ["@sentry/nextjs", "@sentry/node", "@sentry/react", "import sentry_sdk", "from sentry_sdk"]
+      env_vars: ["SENTRY_DSN", "SENTRY_AUTH_TOKEN", "SENTRY_ORG", "SENTRY_PROJECT", "NEXT_PUBLIC_SENTRY_DSN"]
+      deps: ["@sentry/nextjs", "@sentry/node", "@sentry/react", "sentry-sdk", "sentry-cli"]
+    dashboard_url: "https://sentry.io/settings/auth-tokens/"
+    env_example: |
+      SENTRY_DSN=
+      SENTRY_AUTH_TOKEN=
+      SENTRY_ORG=
+      SENTRY_PROJECT=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${SENTRY_AUTH_TOKEN:?SENTRY_AUTH_TOKEN not set}"
+        : "${SENTRY_ORG:?SENTRY_ORG not set}"
+        N=$(curl -fsS "https://sentry.io/api/0/organizations/$SENTRY_ORG/projects/" -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)))')
+        echo "OK — Sentry projects: $N."
+      README.md: |
+        # SENTRY
+        Error tracking + performance + session replay.
+      CREDENTIALS.md: |
+        Dashboard: https://sentry.io/settings/auth-tokens/
+        `SENTRY_DSN` — public, for SDK init.
+        `SENTRY_AUTH_TOKEN` — secret, for sourcemaps upload + API.
+
+  - id: DATADOG
+    category: observabilidad
+    detectors:
+      imports: ["from datadog", "import datadog", "datadog-api-client", "dd-trace"]
+      env_vars: ["DD_API_KEY", "DD_APP_KEY", "DATADOG_API_KEY", "DD_SITE"]
+      deps: ["datadog", "datadog-api-client", "dd-trace"]
+    dashboard_url: "https://app.datadoghq.com/organization-settings/api-keys"
+    env_example: |
+      DD_API_KEY=
+      DD_APP_KEY=
+      DD_SITE=datadoghq.eu
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${DD_API_KEY:?DD_API_KEY not set}"
+        SITE="${DD_SITE:-datadoghq.com}"
+        curl -fsS "https://api.${SITE}/api/v1/validate" -H "DD-API-KEY: $DD_API_KEY" | grep -q '"valid":true'
+        echo "OK — Datadog API key valid ($SITE)."
+      README.md: |
+        # DATADOG
+        Logs + APM + metrics + RUM. Pick `DD_SITE` for your region.
+      CREDENTIALS.md: |
+        Dashboard: https://app.datadoghq.com/organization-settings/api-keys
+        `DD_API_KEY` — for ingest. `DD_APP_KEY` — for API queries.
+
+  - id: NEW_RELIC
+    category: observabilidad
+    detectors:
+      imports: ["import newrelic", "newrelic"]
+      env_vars: ["NEW_RELIC_LICENSE_KEY", "NEW_RELIC_API_KEY", "NEW_RELIC_ACCOUNT_ID"]
+      deps: ["newrelic"]
+    dashboard_url: "https://one.newrelic.com/admin-portal/api-keys/home"
+    env_example: |
+      NEW_RELIC_API_KEY=
+      NEW_RELIC_ACCOUNT_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${NEW_RELIC_API_KEY:?NEW_RELIC_API_KEY not set}"
+        : "${NEW_RELIC_ACCOUNT_ID:?NEW_RELIC_ACCOUNT_ID not set}"
+        # NerdGraph query for account name (smallest valid request).
+        curl -fsS https://api.newrelic.com/graphql \
+          -H "API-Key: $NEW_RELIC_API_KEY" \
+          -H "Content-Type: application/json" \
+          -d "{\"query\":\"{ actor { account(id: $NEW_RELIC_ACCOUNT_ID) { name } } }\"}" >/dev/null
+        echo "OK — New Relic API key valid."
+      README.md: |
+        # NEW_RELIC
+        APM + logs + metrics + browser/mobile.
+      CREDENTIALS.md: |
+        Dashboard: https://one.newrelic.com/admin-portal/api-keys/home
+        `NEW_RELIC_LICENSE_KEY` — for agents (ingest).
+        `NEW_RELIC_API_KEY` — for NerdGraph queries.
+
+  - id: BETTER_STACK
+    category: observabilidad
+    detectors:
+      imports: ["@logtail/node", "@logtail/next", "import logtail", "from logtail"]
+      env_vars: ["LOGTAIL_SOURCE_TOKEN", "BETTERSTACK_API_TOKEN"]
+      deps: ["@logtail/node", "@logtail/next", "logtail"]
+    dashboard_url: "https://logs.betterstack.com"
+    env_example: |
+      LOGTAIL_SOURCE_TOKEN=
+      BETTERSTACK_API_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${BETTERSTACK_API_TOKEN:?BETTERSTACK_API_TOKEN not set}"
+        N=$(curl -fsS https://logs.betterstack.com/api/v1/sources -H "Authorization: Bearer $BETTERSTACK_API_TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — Better Stack sources: $N."
+      README.md: |
+        # BETTER_STACK
+        Logs (Logtail) + uptime + incident management (formerly Better Uptime).
+      CREDENTIALS.md: |
+        Dashboard: https://logs.betterstack.com
+        `LOGTAIL_SOURCE_TOKEN` — for log ingest.
+        `BETTERSTACK_API_TOKEN` — for API/management.
+
+  - id: AXIOM
+    category: observabilidad
+    detectors:
+      imports: ["@axiomhq/js", "@axiomhq/nextjs", "import axiom"]
+      env_vars: ["AXIOM_TOKEN", "AXIOM_DATASET", "AXIOM_ORG_ID"]
+      deps: ["@axiomhq/js", "@axiomhq/nextjs"]
+    dashboard_url: "https://app.axiom.co/settings/api-tokens"
+    env_example: |
+      AXIOM_TOKEN=
+      AXIOM_DATASET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${AXIOM_TOKEN:?AXIOM_TOKEN not set}"
+        N=$(curl -fsS https://api.axiom.co/v1/datasets -H "Authorization: Bearer $AXIOM_TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)))')
+        echo "OK — Axiom datasets: $N."
+      README.md: |
+        # AXIOM
+        Time-series + logs platform with SQL/APL queries.
+      CREDENTIALS.md: |
+        Dashboard: https://app.axiom.co/settings/api-tokens
+        `AXIOM_TOKEN` — API token (per-dataset or org-wide).
+
+  - id: HONEYCOMB
+    category: observabilidad
+    detectors:
+      imports: ["@honeycombio/opentelemetry-node", "from honeycomb_beeline"]
+      env_vars: ["HONEYCOMB_API_KEY", "HONEYCOMB_DATASET"]
+      deps: ["@honeycombio/opentelemetry-node", "honeycomb-beeline"]
+    dashboard_url: "https://ui.honeycomb.io/account/api_keys"
+    env_example: |
+      HONEYCOMB_API_KEY=
+      HONEYCOMB_DATASET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${HONEYCOMB_API_KEY:?HONEYCOMB_API_KEY not set}"
+        TEAM=$(curl -fsS https://api.honeycomb.io/1/auth -H "X-Honeycomb-Team: $HONEYCOMB_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["team"]["slug"])')
+        echo "OK — Honeycomb team: $TEAM."
+      README.md: |
+        # HONEYCOMB
+        Observability for tracing-heavy distributed systems.
+      CREDENTIALS.md: |
+        Dashboard: https://ui.honeycomb.io/account/api_keys
+        `HONEYCOMB_API_KEY` — secret, scoped per environment.
+
+  - id: POSTHOG
+    category: observabilidad
+    detectors:
+      imports: ["posthog-js", "posthog-node", "posthog-python", "import posthog", "from posthog"]
+      env_vars: ["POSTHOG_API_KEY", "POSTHOG_PROJECT_API_KEY", "POSTHOG_PERSONAL_API_KEY", "NEXT_PUBLIC_POSTHOG_KEY"]
+      deps: ["posthog-js", "posthog-node", "posthog"]
+    dashboard_url: "https://app.posthog.com/project/settings"
+    env_example: |
+      POSTHOG_PROJECT_API_KEY=
+      POSTHOG_PERSONAL_API_KEY=
+      POSTHOG_HOST=https://us.i.posthog.com
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${POSTHOG_PERSONAL_API_KEY:?POSTHOG_PERSONAL_API_KEY not set}"
+        HOST="${POSTHOG_HOST:-https://us.i.posthog.com}"
+        NAME=$(curl -fsS "${HOST%/}/api/users/@me/" -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("email","?"))')
+        echo "OK — PostHog authed as $NAME."
+      README.md: |
+        # POSTHOG
+        Product analytics + session replay + feature flags + A/B + LLM observability.
+      CREDENTIALS.md: |
+        Dashboard: https://app.posthog.com/project/settings
+        `POSTHOG_PROJECT_API_KEY` — public, for SDK init.
+        `POSTHOG_PERSONAL_API_KEY` — secret, for API queries.
+
+  - id: LANGFUSE
+    category: observabilidad
+    detectors:
+      imports: ["langfuse", "import langfuse", "from langfuse"]
+      env_vars: ["LANGFUSE_PUBLIC_KEY", "LANGFUSE_SECRET_KEY", "LANGFUSE_HOST"]
+      deps: ["langfuse"]
+    dashboard_url: "https://cloud.langfuse.com"
+    env_example: |
+      LANGFUSE_PUBLIC_KEY=
+      LANGFUSE_SECRET_KEY=
+      LANGFUSE_HOST=https://cloud.langfuse.com
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${LANGFUSE_PUBLIC_KEY:?LANGFUSE_PUBLIC_KEY not set}"
+        : "${LANGFUSE_SECRET_KEY:?LANGFUSE_SECRET_KEY not set}"
+        HOST="${LANGFUSE_HOST:-https://cloud.langfuse.com}"
+        curl -fsS "${HOST%/}/api/public/projects" -u "$LANGFUSE_PUBLIC_KEY:$LANGFUSE_SECRET_KEY" >/dev/null
+        echo "OK — Langfuse credentials valid."
+      README.md: |
+        # LANGFUSE
+        LLM observability: tracing, evals, prompts, datasets.
+      CREDENTIALS.md: |
+        Dashboard: https://cloud.langfuse.com
+        Both keys are needed; the public key is used as the username.
+
+  - id: LOGFIRE
+    category: observabilidad
+    detectors:
+      imports: ["import logfire", "from logfire"]
+      env_vars: ["LOGFIRE_TOKEN"]
+      deps: ["logfire"]
+    dashboard_url: "https://logfire.pydantic.dev"
+    env_example: |
+      LOGFIRE_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Logfire ingests via OTLP; there's no read-only auth endpoint.
+        # We validate the token format and probe the public OTLP endpoint.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${LOGFIRE_TOKEN:?LOGFIRE_TOKEN not set}"
+        curl -fsS -o /dev/null -w "%{http_code}\n" https://logfire-api.pydantic.dev/health | grep -q 200
+        echo "OK — Logfire ingest endpoint reachable."
+      README.md: |
+        # LOGFIRE
+        Observability built on OpenTelemetry by the Pydantic team.
+      CREDENTIALS.md: |
+        Dashboard: https://logfire.pydantic.dev
+        `LOGFIRE_TOKEN` — secret, scoped per project.
+
+  # ------------------------------------------------------------------
+  # Product analytics
+  # ------------------------------------------------------------------
+
+  - id: MIXPANEL
+    category: analitica
+    detectors:
+      imports: ["import mixpanel", "from mixpanel", "mixpanel-browser", "mixpanel"]
+      env_vars: ["MIXPANEL_TOKEN", "MIXPANEL_API_SECRET", "MIXPANEL_PROJECT_ID", "MIXPANEL_SA_USER", "MIXPANEL_SA_SECRET"]
+      deps: ["mixpanel", "mixpanel-browser"]
+    dashboard_url: "https://mixpanel.com/settings/project"
+    env_example: |
+      MIXPANEL_TOKEN=
+      MIXPANEL_SA_USER=
+      MIXPANEL_SA_SECRET=
+      MIXPANEL_PROJECT_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${MIXPANEL_SA_USER:?MIXPANEL_SA_USER not set}"
+        : "${MIXPANEL_SA_SECRET:?MIXPANEL_SA_SECRET not set}"
+        : "${MIXPANEL_PROJECT_ID:?MIXPANEL_PROJECT_ID not set}"
+        curl -fsS "https://mixpanel.com/api/app/projects/$MIXPANEL_PROJECT_ID" -u "$MIXPANEL_SA_USER:$MIXPANEL_SA_SECRET" >/dev/null
+        echo "OK — Mixpanel service account valid."
+      README.md: |
+        # MIXPANEL
+        Event-based product analytics.
+      CREDENTIALS.md: |
+        Dashboard: https://mixpanel.com/settings/project
+        `MIXPANEL_TOKEN` — public, for SDK init.
+        `MIXPANEL_SA_USER` / `MIXPANEL_SA_SECRET` — Service Account credentials for API queries.
+
+  - id: AMPLITUDE
+    category: analitica
+    detectors:
+      imports: ["@amplitude/analytics-browser", "@amplitude/analytics-node", "amplitude-js", "import amplitude"]
+      env_vars: ["AMPLITUDE_API_KEY", "AMPLITUDE_SECRET_KEY"]
+      deps: ["@amplitude/analytics-browser", "@amplitude/analytics-node", "amplitude"]
+    dashboard_url: "https://amplitude.com/settings"
+    env_example: |
+      AMPLITUDE_API_KEY=
+      AMPLITUDE_SECRET_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Amplitude API uses HTTP Basic with api_key:secret_key.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${AMPLITUDE_API_KEY:?AMPLITUDE_API_KEY not set}"
+        : "${AMPLITUDE_SECRET_KEY:?AMPLITUDE_SECRET_KEY not set}"
+        curl -fsS https://amplitude.com/api/2/usersearch?user=test -u "$AMPLITUDE_API_KEY:$AMPLITUDE_SECRET_KEY" >/dev/null
+        echo "OK — Amplitude credentials valid."
+      README.md: |
+        # AMPLITUDE
+        Product analytics + experimentation.
+      CREDENTIALS.md: |
+        Dashboard: https://amplitude.com/settings
+        Both keys are needed for the API (Basic auth: api_key:secret_key).
+
+  - id: PLAUSIBLE
+    category: analitica
+    detectors:
+      imports: ["next-plausible", "plausible-tracker"]
+      env_vars: ["PLAUSIBLE_API_KEY", "PLAUSIBLE_SITE_ID", "PLAUSIBLE_HOST"]
+      deps: ["next-plausible", "plausible-tracker"]
+    dashboard_url: "https://plausible.io/settings/api-keys"
+    env_example: |
+      PLAUSIBLE_API_KEY=
+      PLAUSIBLE_SITE_ID=
+      PLAUSIBLE_HOST=https://plausible.io
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${PLAUSIBLE_API_KEY:?PLAUSIBLE_API_KEY not set}"
+        : "${PLAUSIBLE_SITE_ID:?PLAUSIBLE_SITE_ID not set}"
+        HOST="${PLAUSIBLE_HOST:-https://plausible.io}"
+        N=$(curl -fsS "${HOST%/}/api/v1/stats/realtime/visitors?site_id=$PLAUSIBLE_SITE_ID" -H "Authorization: Bearer $PLAUSIBLE_API_KEY")
+        echo "OK — Plausible realtime visitors: $N."
+      README.md: |
+        # PLAUSIBLE
+        Privacy-friendly, GDPR-compliant analytics.
+      CREDENTIALS.md: |
+        Dashboard: https://plausible.io/settings/api-keys
+        `PLAUSIBLE_SITE_ID` is the domain (e.g. `example.com`).
+
+  - id: FATHOM
+    category: analitica
+    detectors:
+      imports: ["fathom-client"]
+      env_vars: ["FATHOM_API_TOKEN", "FATHOM_SITE_ID"]
+      deps: ["fathom-client"]
+    dashboard_url: "https://app.usefathom.com/api"
+    env_example: |
+      FATHOM_API_TOKEN=
+      FATHOM_SITE_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${FATHOM_API_TOKEN:?FATHOM_API_TOKEN not set}"
+        N=$(curl -fsS https://api.usefathom.com/v1/sites -H "Authorization: Bearer $FATHOM_API_TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — Fathom sites: $N."
+      README.md: |
+        # FATHOM
+        Simple, privacy-focused web analytics.
+      CREDENTIALS.md: |
+        Dashboard: https://app.usefathom.com/api
+        `FATHOM_API_TOKEN` — secret.
+
+  - id: UMAMI
+    category: analitica
+    detectors:
+      imports: ["@umami/node"]
+      env_vars: ["UMAMI_API_KEY", "UMAMI_HOST", "UMAMI_WEBSITE_ID"]
+      deps: ["@umami/node"]
+    dashboard_url: "https://cloud.umami.is/settings/api"
+    env_example: |
+      UMAMI_HOST=https://api.umami.is
+      UMAMI_API_KEY=
+      UMAMI_WEBSITE_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${UMAMI_API_KEY:?UMAMI_API_KEY not set}"
+        HOST="${UMAMI_HOST:-https://api.umami.is}"
+        curl -fsS "${HOST%/}/v1/me" -H "x-umami-api-key: $UMAMI_API_KEY" >/dev/null
+        echo "OK — Umami API key valid."
+      README.md: |
+        # UMAMI
+        Open-source, privacy-focused analytics. Cloud or self-hosted.
+      CREDENTIALS.md: |
+        Dashboard: https://cloud.umami.is/settings/api
+        `UMAMI_API_KEY` — secret.
+
+  - id: SEGMENT
+    category: analitica
+    detectors:
+      imports: ["@segment/analytics-node", "@segment/analytics-next", "from segment"]
+      env_vars: ["SEGMENT_WRITE_KEY", "SEGMENT_API_TOKEN"]
+      deps: ["@segment/analytics-node", "@segment/analytics-next"]
+    dashboard_url: "https://app.segment.com/goto-my-workspace/settings/access-management"
+    env_example: |
+      SEGMENT_WRITE_KEY=
+      SEGMENT_API_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${SEGMENT_API_TOKEN:?SEGMENT_API_TOKEN not set}"
+        N=$(curl -fsS https://api.segmentapis.com/sources -H "Authorization: Bearer $SEGMENT_API_TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]["sources"]))')
+        echo "OK — Segment sources: $N."
+      README.md: |
+        # SEGMENT
+        CDP (Customer Data Platform). Pipes events to other tools.
+      CREDENTIALS.md: |
+        Dashboard: https://app.segment.com/goto-my-workspace/settings/access-management
+        `SEGMENT_WRITE_KEY` — per source, for SDKs.
+        `SEGMENT_API_TOKEN` — workspace, for Config API.
+
+  # ------------------------------------------------------------------
+  # Deploy & PaaS
+  # ------------------------------------------------------------------
+
+  - id: VERCEL
+    category: infra
+    detectors:
+      imports: ["@vercel/sdk", "@vercel/analytics", "@vercel/blob", "@vercel/kv", "@vercel/postgres"]
+      env_vars: ["VERCEL_TOKEN", "VERCEL_TEAM_ID", "VERCEL_PROJECT_ID"]
+      deps: ["@vercel/sdk", "vercel"]
+    dashboard_url: "https://vercel.com/account/tokens"
+    env_example: |
+      VERCEL_TOKEN=
+      VERCEL_TEAM_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${VERCEL_TOKEN:?VERCEL_TOKEN not set}"
+        USER=$(curl -fsS https://api.vercel.com/v2/user -H "Authorization: Bearer $VERCEL_TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["user"]["username"])')
+        echo "OK — Vercel authed as $USER."
+      README.md: |
+        # VERCEL
+        Frontend + serverless deploy. Tokens scoped per-team.
+      CREDENTIALS.md: |
+        Dashboard: https://vercel.com/account/tokens
+        `VERCEL_TOKEN` — secret. `VERCEL_TEAM_ID` needed for team-scoped calls.
+
+  - id: NETLIFY
+    category: infra
+    detectors:
+      imports: ["@netlify/functions", "@netlify/blobs"]
+      env_vars: ["NETLIFY_AUTH_TOKEN", "NETLIFY_SITE_ID"]
+      deps: ["netlify", "netlify-cli", "@netlify/functions"]
+    dashboard_url: "https://app.netlify.com/user/applications#personal-access-tokens"
+    env_example: |
+      NETLIFY_AUTH_TOKEN=
+      NETLIFY_SITE_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${NETLIFY_AUTH_TOKEN:?NETLIFY_AUTH_TOKEN not set}"
+        N=$(curl -fsS https://api.netlify.com/api/v1/sites -H "Authorization: Bearer $NETLIFY_AUTH_TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)))')
+        echo "OK — Netlify sites: $N."
+      README.md: |
+        # NETLIFY
+        Static + serverless hosting.
+      CREDENTIALS.md: |
+        Dashboard: https://app.netlify.com/user/applications#personal-access-tokens
+        `NETLIFY_AUTH_TOKEN` — secret.
+
+  - id: RAILWAY
+    category: infra
+    detectors:
+      imports: []
+      env_vars: ["RAILWAY_TOKEN", "RAILWAY_API_TOKEN", "RAILWAY_PROJECT_ID"]
+      deps: ["@railway/cli"]
+    dashboard_url: "https://railway.app/account/tokens"
+    env_example: |
+      RAILWAY_API_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Railway uses GraphQL exclusively.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${RAILWAY_API_TOKEN:?RAILWAY_API_TOKEN not set}"
+        curl -fsS https://backboard.railway.app/graphql/v2 \
+          -H "Authorization: Bearer $RAILWAY_API_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"query":"{ me { name } }"}' \
+          | python3 -c 'import json,sys; d=json.load(sys.stdin); print("OK — Railway authed as", d["data"]["me"]["name"])'
+      README.md: |
+        # RAILWAY
+        Hetzner-style PaaS with templates and Postgres add-ons.
+      CREDENTIALS.md: |
+        Dashboard: https://railway.app/account/tokens
+        `RAILWAY_API_TOKEN` — secret, account-scoped.
+
+  - id: FLY_IO
+    category: infra
+    detectors:
+      imports: []
+      env_vars: ["FLY_API_TOKEN", "FLY_ACCESS_TOKEN", "FLY_ORG"]
+      deps: []
+    dashboard_url: "https://fly.io/user/personal_access_tokens"
+    env_example: |
+      FLY_API_TOKEN=
+      FLY_ORG=personal
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${FLY_API_TOKEN:-${FLY_ACCESS_TOKEN:-}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: FLY_API_TOKEN not set" >&2; exit 1; }
+        # Fly Machines REST API.
+        ORG="${FLY_ORG:-personal}"
+        N=$(curl -fsS "https://api.machines.dev/v1/apps?org_slug=$ORG" -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin).get("apps",[])))')
+        echo "OK — Fly.io apps in '$ORG': $N."
+      README.md: |
+        # FLY_IO
+        Run apps as Firecracker microVMs in regions worldwide.
+      CREDENTIALS.md: |
+        Dashboard: https://fly.io/user/personal_access_tokens
+        `FLY_API_TOKEN` — secret. `FLY_ORG` is the org slug (default `personal`).
+
+  - id: RENDER
+    category: infra
+    detectors:
+      imports: []
+      env_vars: ["RENDER_API_KEY"]
+      deps: []
+    dashboard_url: "https://dashboard.render.com/u/settings#api-keys"
+    env_example: |
+      RENDER_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${RENDER_API_KEY:?RENDER_API_KEY not set}"
+        N=$(curl -fsS https://api.render.com/v1/services -H "Authorization: Bearer $RENDER_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)))')
+        echo "OK — Render services: $N."
+      README.md: |
+        # RENDER
+        PaaS for web services, cron jobs, static sites, databases.
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.render.com/u/settings#api-keys
+        `RENDER_API_KEY` — secret.
+
+  - id: DIGITALOCEAN
+    category: infra
+    detectors:
+      imports: ["pydo", "from digitalocean", "@digitalocean/godo"]
+      env_vars: ["DIGITALOCEAN_TOKEN", "DO_API_TOKEN", "DIGITALOCEAN_ACCESS_TOKEN"]
+      deps: ["pydo", "digitalocean"]
+    dashboard_url: "https://cloud.digitalocean.com/account/api/tokens"
+    env_example: |
+      DIGITALOCEAN_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${DIGITALOCEAN_TOKEN:-${DO_API_TOKEN:-${DIGITALOCEAN_ACCESS_TOKEN:-}}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: DIGITALOCEAN_TOKEN not set" >&2; exit 1; }
+        EMAIL=$(curl -fsS https://api.digitalocean.com/v2/account -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["account"]["email"])')
+        echo "OK — DigitalOcean account: $EMAIL."
+      README.md: |
+        # DIGITALOCEAN
+        Droplets, Spaces, App Platform, Managed Databases.
+      CREDENTIALS.md: |
+        Dashboard: https://cloud.digitalocean.com/account/api/tokens
+        `DIGITALOCEAN_TOKEN` — secret. Read + write scope.
+
+  - id: CLOUDFLARE
+    category: infra
+    detectors:
+      imports: ["cloudflare", "import cloudflare", "from cloudflare", "@cloudflare/workers-types", "wrangler"]
+      env_vars: ["CLOUDFLARE_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID", "CF_API_TOKEN"]
+      deps: ["cloudflare", "wrangler", "@cloudflare/workers-types"]
+    dashboard_url: "https://dash.cloudflare.com/profile/api-tokens"
+    env_example: |
+      CLOUDFLARE_API_TOKEN=
+      CLOUDFLARE_ACCOUNT_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${CLOUDFLARE_API_TOKEN:-${CF_API_TOKEN:-}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: CLOUDFLARE_API_TOKEN not set" >&2; exit 1; }
+        curl -fsS https://api.cloudflare.com/client/v4/user/tokens/verify -H "Authorization: Bearer $TOKEN" | grep -q '"success":true'
+        echo "OK — Cloudflare token verified."
+      README.md: |
+        # CLOUDFLARE
+        DNS + CDN + Workers + R2 + D1 + Pages + Tunnels.
+      CREDENTIALS.md: |
+        Dashboard: https://dash.cloudflare.com/profile/api-tokens
+        `CLOUDFLARE_API_TOKEN` — scoped, prefer over global API key.
+
+  - id: HEROKU
+    category: infra
+    detectors:
+      imports: []
+      env_vars: ["HEROKU_API_KEY"]
+      deps: ["heroku"]
+    dashboard_url: "https://dashboard.heroku.com/account"
+    env_example: |
+      HEROKU_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${HEROKU_API_KEY:?HEROKU_API_KEY not set}"
+        EMAIL=$(curl -fsS https://api.heroku.com/account -H "Accept: application/vnd.heroku+json; version=3" -H "Authorization: Bearer $HEROKU_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["email"])')
+        echo "OK — Heroku account: $EMAIL."
+      README.md: |
+        # HEROKU
+        Classic PaaS for buildpack-based apps.
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.heroku.com/account
+        `HEROKU_API_KEY` — secret.
+
+  - id: VULTR
+    category: infra
+    detectors:
+      imports: []
+      env_vars: ["VULTR_API_KEY"]
+      deps: []
+    dashboard_url: "https://my.vultr.com/settings/#settingsapi"
+    env_example: |
+      VULTR_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${VULTR_API_KEY:?VULTR_API_KEY not set}"
+        BAL=$(curl -fsS https://api.vultr.com/v2/account -H "Authorization: Bearer $VULTR_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["account"]["balance"])')
+        echo "OK — Vultr account balance: $BAL."
+      README.md: |
+        # VULTR
+        Cloud servers, block/object storage, bare metal.
+      CREDENTIALS.md: |
+        Dashboard: https://my.vultr.com/settings/#settingsapi
+        `VULTR_API_KEY` — secret. IP allowlist may apply.
+
+  # ------------------------------------------------------------------
+  # Object storage
+  # ------------------------------------------------------------------
+
+  - id: AWS_S3
+    category: almacenamiento
+    detectors:
+      imports: ["@aws-sdk/client-s3", "from boto3", "import boto3"]
+      env_vars: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION", "S3_BUCKET"]
+      deps: ["@aws-sdk/client-s3", "boto3"]
+    dashboard_url: "https://console.aws.amazon.com/iam/home"
+    manual_only: true
+    env_example: |
+      AWS_ACCESS_KEY_ID=
+      AWS_SECRET_ACCESS_KEY=
+      AWS_REGION=eu-west-1
+      S3_BUCKET=
+    files:
+      README.md: |
+        # AWS_S3
+        S3 uses SigV4 signing which is not trivial to implement in plain bash.
+        Verify with the AWS CLI:
+
+            aws s3 ls s3://$S3_BUCKET --region $AWS_REGION
+
+        or with boto3:
+
+            python -c "import boto3; print(boto3.client('s3').list_buckets()['Buckets'])"
+      CREDENTIALS.md: |
+        Dashboard: https://console.aws.amazon.com/iam/home
+        IAM access key with at minimum `s3:ListBucket`, `s3:GetObject`, `s3:PutObject` on the target bucket.
+
+  - id: CLOUDFLARE_R2
+    category: almacenamiento
+    detectors:
+      imports: ["@aws-sdk/client-s3"]
+      env_vars: ["R2_ACCOUNT_ID", "R2_ACCESS_KEY_ID", "R2_SECRET_ACCESS_KEY", "R2_BUCKET", "R2_ENDPOINT"]
+      deps: ["@aws-sdk/client-s3"]
+    dashboard_url: "https://dash.cloudflare.com/?to=/:account/r2/api-tokens"
+    manual_only: true
+    env_example: |
+      R2_ACCOUNT_ID=
+      R2_ACCESS_KEY_ID=
+      R2_SECRET_ACCESS_KEY=
+      R2_BUCKET=
+      R2_ENDPOINT=https://<account_id>.r2.cloudflarestorage.com
+    files:
+      README.md: |
+        # CLOUDFLARE_R2
+        S3-compatible object storage. Same SigV4 caveat as AWS_S3 — verify with:
+
+            aws --endpoint-url=$R2_ENDPOINT s3 ls s3://$R2_BUCKET
+
+        or `wrangler r2 bucket list`.
+      CREDENTIALS.md: |
+        Dashboard: https://dash.cloudflare.com/?to=/:account/r2/api-tokens
+        R2 keys are S3-compatible. Endpoint is per account.
+
+  - id: BACKBLAZE_B2
+    category: almacenamiento
+    detectors:
+      imports: ["b2sdk", "from b2sdk"]
+      env_vars: ["B2_APPLICATION_KEY_ID", "B2_APPLICATION_KEY", "B2_BUCKET"]
+      deps: ["b2sdk"]
+    dashboard_url: "https://secure.backblaze.com/app_keys.htm"
+    env_example: |
+      B2_APPLICATION_KEY_ID=
+      B2_APPLICATION_KEY=
+      B2_BUCKET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # b2_authorize_account is the canonical auth handshake.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${B2_APPLICATION_KEY_ID:?not set}"
+        : "${B2_APPLICATION_KEY:?not set}"
+        ACC=$(curl -fsS https://api.backblazeb2.com/b2api/v3/b2_authorize_account -u "$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["accountId"])')
+        echo "OK — Backblaze B2 account: $ACC."
+      README.md: |
+        # BACKBLAZE_B2
+        Cheap S3-compatible (and native) object storage.
+      CREDENTIALS.md: |
+        Dashboard: https://secure.backblaze.com/app_keys.htm
+        `B2_APPLICATION_KEY_ID` + `B2_APPLICATION_KEY`. Restrict to specific bucket.
+
+  # ------------------------------------------------------------------
+  # Realtime, video, WebRTC
+  # ------------------------------------------------------------------
+
+  - id: MUX
+    category: realtime
+    detectors:
+      imports: ["@mux/mux-node", "@mux/mux-player-react"]
+      env_vars: ["MUX_TOKEN_ID", "MUX_TOKEN_SECRET", "MUX_WEBHOOK_SECRET"]
+      deps: ["@mux/mux-node", "@mux/mux-player-react"]
+    dashboard_url: "https://dashboard.mux.com/settings/access-tokens"
+    env_example: |
+      MUX_TOKEN_ID=
+      MUX_TOKEN_SECRET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${MUX_TOKEN_ID:?MUX_TOKEN_ID not set}"
+        : "${MUX_TOKEN_SECRET:?MUX_TOKEN_SECRET not set}"
+        N=$(curl -fsS "https://api.mux.com/video/v1/assets?limit=1" -u "$MUX_TOKEN_ID:$MUX_TOKEN_SECRET" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — Mux access token valid (sample assets: $N)."
+      README.md: |
+        # MUX
+        Video infrastructure for product teams (upload, transcode, deliver).
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.mux.com/settings/access-tokens
+        Token id + secret, scoped per env (dev/prod).
+
+  - id: LIVEKIT
+    category: realtime
+    detectors:
+      imports: ["livekit-server-sdk", "livekit-client", "from livekit"]
+      env_vars: ["LIVEKIT_API_KEY", "LIVEKIT_API_SECRET", "LIVEKIT_URL"]
+      deps: ["livekit-server-sdk", "livekit-client", "livekit"]
+    dashboard_url: "https://cloud.livekit.io"
+    manual_only: true
+    env_example: |
+      LIVEKIT_URL=
+      LIVEKIT_API_KEY=
+      LIVEKIT_API_SECRET=
+    files:
+      README.md: |
+        # LIVEKIT
+        WebRTC infra (rooms, recording, ingress). The API requires JWTs
+        signed with the API secret — verify with the official CLI:
+
+            livekit-cli list-rooms --url $LIVEKIT_URL --api-key $LIVEKIT_API_KEY --api-secret $LIVEKIT_API_SECRET
+      CREDENTIALS.md: |
+        Dashboard: https://cloud.livekit.io
+        Project URL + API key/secret. Self-hosted is the same env vars.
+
+  - id: DAILY_CO
+    category: realtime
+    detectors:
+      imports: ["@daily-co/daily-js", "@daily-co/daily-react"]
+      env_vars: ["DAILY_API_KEY", "DAILY_DOMAIN"]
+      deps: ["@daily-co/daily-js", "@daily-co/daily-react"]
+    dashboard_url: "https://dashboard.daily.co/developers"
+    env_example: |
+      DAILY_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${DAILY_API_KEY:?DAILY_API_KEY not set}"
+        DOMAIN=$(curl -fsS https://api.daily.co/v1/ -H "Authorization: Bearer $DAILY_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("domain_name","?"))')
+        echo "OK — Daily.co domain: $DOMAIN."
+      README.md: |
+        # DAILY_CO
+        Embeddable video calls + meeting infra.
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.daily.co/developers
+        `DAILY_API_KEY` — secret.
+
+  - id: PUSHER
+    category: realtime
+    detectors:
+      imports: ["pusher", "pusher-js", "import pusher"]
+      env_vars: ["PUSHER_APP_ID", "PUSHER_KEY", "PUSHER_SECRET", "PUSHER_CLUSTER"]
+      deps: ["pusher", "pusher-js"]
+    dashboard_url: "https://dashboard.pusher.com"
+    manual_only: true
+    env_example: |
+      PUSHER_APP_ID=
+      PUSHER_KEY=
+      PUSHER_SECRET=
+      PUSHER_CLUSTER=eu
+    files:
+      README.md: |
+        # PUSHER
+        Channels (pub/sub) + Beams (push). The REST API requires per-request
+        HMAC-SHA256 signing — easiest to verify with the official SDK:
+
+            node -e "const Pusher = require('pusher'); new Pusher({appId: process.env.PUSHER_APP_ID, key: process.env.PUSHER_KEY, secret: process.env.PUSHER_SECRET, cluster: process.env.PUSHER_CLUSTER}).get({path: '/channels'}, console.log)"
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.pusher.com
+        4 vars: app_id, key, secret, cluster.
+
+  - id: ABLY
+    category: realtime
+    detectors:
+      imports: ["ably", "import ably", "from ably"]
+      env_vars: ["ABLY_API_KEY"]
+      deps: ["ably"]
+    dashboard_url: "https://ably.com/accounts/any/apps"
+    env_example: |
+      ABLY_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${ABLY_API_KEY:?ABLY_API_KEY not set}"
+        # Time endpoint requires auth and is read-only/cheap.
+        TS=$(curl -fsS https://rest.ably.io/time -u "$ABLY_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)[0])')
+        echo "OK — Ably server timestamp: $TS."
+      README.md: |
+        # ABLY
+        Realtime messaging / pub-sub at scale.
+      CREDENTIALS.md: |
+        Dashboard: https://ably.com/accounts/any/apps
+        `ABLY_API_KEY` has the form `appKeyId:appKeySecret`.
+
+  # ------------------------------------------------------------------
+  # Communications (SMS, voice, push, in-app notifications)
+  # ------------------------------------------------------------------
+
+  - id: TWILIO
+    category: comunicacion
+    detectors:
+      imports: ["twilio", "from twilio", "import twilio"]
+      env_vars: ["TWILIO_ACCOUNT_SID", "TWILIO_AUTH_TOKEN", "TWILIO_API_KEY", "TWILIO_API_SECRET"]
+      deps: ["twilio"]
+    dashboard_url: "https://console.twilio.com"
+    env_example: |
+      TWILIO_ACCOUNT_SID=
+      TWILIO_AUTH_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${TWILIO_ACCOUNT_SID:?TWILIO_ACCOUNT_SID not set}"
+        : "${TWILIO_AUTH_TOKEN:?TWILIO_AUTH_TOKEN not set}"
+        STATUS=$(curl -fsS "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_ACCOUNT_SID.json" -u "$TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["status"])')
+        echo "OK — Twilio account status: $STATUS."
+      README.md: |
+        # TWILIO
+        SMS, voice, WhatsApp, Verify, Video.
+      CREDENTIALS.md: |
+        Dashboard: https://console.twilio.com
+        Account SID + Auth Token from the main account page.
+
+  - id: VONAGE
+    category: comunicacion
+    detectors:
+      imports: ["@vonage/server-sdk", "vonage"]
+      env_vars: ["VONAGE_API_KEY", "VONAGE_API_SECRET"]
+      deps: ["@vonage/server-sdk", "vonage"]
+    dashboard_url: "https://dashboard.nexmo.com/settings"
+    env_example: |
+      VONAGE_API_KEY=
+      VONAGE_API_SECRET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${VONAGE_API_KEY:?VONAGE_API_KEY not set}"
+        : "${VONAGE_API_SECRET:?VONAGE_API_SECRET not set}"
+        BAL=$(curl -fsS "https://rest.nexmo.com/account/get-balance?api_key=$VONAGE_API_KEY&api_secret=$VONAGE_API_SECRET" | python3 -c 'import json,sys; print(json.load(sys.stdin)["value"])')
+        echo "OK — Vonage balance: $BAL."
+      README.md: |
+        # VONAGE
+        SMS, voice, verify (formerly Nexmo).
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.nexmo.com/settings
+        API key + secret. Some APIs (Conversations) need an Application ID.
+
+  - id: ONESIGNAL
+    category: comunicacion
+    detectors:
+      imports: ["react-onesignal", "onesignal-node", "@onesignal/onesignal-react-native"]
+      env_vars: ["ONESIGNAL_APP_ID", "ONESIGNAL_REST_API_KEY", "ONESIGNAL_USER_AUTH_KEY"]
+      deps: ["onesignal-node", "react-onesignal", "@onesignal/onesignal-react-native"]
+    dashboard_url: "https://dashboard.onesignal.com/apps"
+    env_example: |
+      ONESIGNAL_APP_ID=
+      ONESIGNAL_REST_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${ONESIGNAL_APP_ID:?ONESIGNAL_APP_ID not set}"
+        : "${ONESIGNAL_REST_API_KEY:?ONESIGNAL_REST_API_KEY not set}"
+        N=$(curl -fsS "https://api.onesignal.com/apps/$ONESIGNAL_APP_ID" -H "Authorization: Key $ONESIGNAL_REST_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["players"])')
+        echo "OK — OneSignal app players: $N."
+      README.md: |
+        # ONESIGNAL
+        Multi-channel push (mobile, web, email).
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.onesignal.com/apps
+        REST API key is per-app, scoped.
+
+  - id: EXPO_PUSH
+    category: comunicacion
+    detectors:
+      imports: ["expo-server-sdk", "expo-notifications"]
+      env_vars: ["EXPO_ACCESS_TOKEN"]
+      deps: ["expo-server-sdk", "expo-notifications"]
+    dashboard_url: "https://expo.dev/accounts/[account]/settings/access-tokens"
+    manual_only: true
+    env_example: |
+      EXPO_ACCESS_TOKEN=
+    files:
+      README.md: |
+        # EXPO_PUSH
+        Push notifications for Expo apps. The push endpoint requires a real
+        ExponentPushToken from a device — there is no read-only health endpoint.
+        Verify by calling `expo whoami` after `export EXPO_TOKEN=$EXPO_ACCESS_TOKEN`.
+      CREDENTIALS.md: |
+        Dashboard: https://expo.dev/accounts/[account]/settings/access-tokens
+        `EXPO_ACCESS_TOKEN` — secret, account-scoped.
+
+  - id: KNOCK
+    category: comunicacion
+    detectors:
+      imports: ["@knocklabs/node", "@knocklabs/react", "@knocklabs/client"]
+      env_vars: ["KNOCK_API_KEY", "KNOCK_PUBLIC_API_KEY", "KNOCK_SIGNING_KEY"]
+      deps: ["@knocklabs/node", "@knocklabs/react"]
+    dashboard_url: "https://dashboard.knock.app"
+    env_example: |
+      KNOCK_API_KEY=
+      KNOCK_PUBLIC_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${KNOCK_API_KEY:?KNOCK_API_KEY not set}"
+        # List users with a tiny limit; cheap auth check.
+        curl -fsS "https://api.knock.app/v1/users?page_size=1" -H "Authorization: Bearer $KNOCK_API_KEY" >/dev/null
+        echo "OK — Knock API key valid."
+      README.md: |
+        # KNOCK
+        Notifications-as-a-service: orchestrate email, push, in-app, SMS.
+      CREDENTIALS.md: |
+        Dashboard: https://dashboard.knock.app
+        Secret key for backend, public key for client SDKs.
+
+  # ------------------------------------------------------------------
+  # Maps / geo
+  # ------------------------------------------------------------------
+
+  - id: GOOGLE_MAPS
+    category: mapas_geo
+    detectors:
+      imports: ["@googlemaps/js-api-loader", "@googlemaps/google-maps-services-js", "@react-google-maps/api"]
+      env_vars: ["GOOGLE_MAPS_API_KEY", "NEXT_PUBLIC_GOOGLE_MAPS_API_KEY"]
+      deps: ["@googlemaps/js-api-loader", "@googlemaps/google-maps-services-js", "@react-google-maps/api"]
+    dashboard_url: "https://console.cloud.google.com/google/maps-apis/credentials"
+    env_example: |
+      GOOGLE_MAPS_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Geocoding a known landmark is cheap (~$0.005) and validates the key.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${GOOGLE_MAPS_API_KEY:?GOOGLE_MAPS_API_KEY not set}"
+        STATUS=$(curl -fsS "https://maps.googleapis.com/maps/api/geocode/json?address=Madrid&key=$GOOGLE_MAPS_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["status"])')
+        [ "$STATUS" = "OK" ] || { echo "FAIL: status=$STATUS" >&2; exit 1; }
+        echo "OK — Google Maps geocoding accessible."
+      README.md: |
+        # GOOGLE_MAPS
+        Maps, Places, Geocoding, Directions, Distance Matrix.
+        > The smoke-test costs ~$0.005 (1 geocode).
+      CREDENTIALS.md: |
+        Dashboard: https://console.cloud.google.com/google/maps-apis/credentials
+        Restrict the key by HTTP referrer (web) or app bundle (mobile).
+
+  - id: MAPBOX
+    category: mapas_geo
+    detectors:
+      imports: ["mapbox-gl", "react-map-gl", "@mapbox/mapbox-sdk"]
+      env_vars: ["MAPBOX_ACCESS_TOKEN", "NEXT_PUBLIC_MAPBOX_TOKEN", "MAPBOX_SECRET_TOKEN"]
+      deps: ["mapbox-gl", "react-map-gl", "@mapbox/mapbox-sdk"]
+    dashboard_url: "https://account.mapbox.com/access-tokens"
+    env_example: |
+      MAPBOX_ACCESS_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${MAPBOX_ACCESS_TOKEN:?MAPBOX_ACCESS_TOKEN not set}"
+        # Geocoding API: 1 free request.
+        FEATURES=$(curl -fsS "https://api.mapbox.com/geocoding/v5/mapbox.places/Madrid.json?access_token=$MAPBOX_ACCESS_TOKEN&limit=1" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["features"]))')
+        echo "OK — Mapbox geocoding returned $FEATURES feature(s)."
+      README.md: |
+        # MAPBOX
+        Vector maps, geocoding, navigation, search.
+      CREDENTIALS.md: |
+        Dashboard: https://account.mapbox.com/access-tokens
+        Public tokens (`pk.*`) for clients, secret tokens (`sk.*`) for server.
+
+  # ------------------------------------------------------------------
+  # Calendar / scheduling
+  # ------------------------------------------------------------------
+
+  - id: CAL_COM
+    category: productividad
+    detectors:
+      imports: ["@calcom/embed-react"]
+      env_vars: ["CAL_API_KEY", "CALCOM_API_KEY"]
+      deps: ["@calcom/embed-react"]
+    dashboard_url: "https://app.cal.com/settings/developer/api-keys"
+    env_example: |
+      CALCOM_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        KEY="${CALCOM_API_KEY:-${CAL_API_KEY:-}}"
+        [ -n "$KEY" ] || { echo "ERROR: CALCOM_API_KEY not set" >&2; exit 1; }
+        # v1: GET /me?apiKey=
+        EMAIL=$(curl -fsS "https://api.cal.com/v1/me?apiKey=$KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["user"]["email"])')
+        echo "OK — Cal.com user: $EMAIL."
+      README.md: |
+        # CAL_COM
+        Open-source scheduling (Calendly alternative).
+      CREDENTIALS.md: |
+        Dashboard: https://app.cal.com/settings/developer/api-keys
+        `CALCOM_API_KEY` — secret.
+
+  - id: CALENDLY
+    category: productividad
+    detectors:
+      imports: []
+      env_vars: ["CALENDLY_API_KEY", "CALENDLY_ACCESS_TOKEN"]
+      deps: []
+    dashboard_url: "https://calendly.com/integrations/api_webhooks"
+    env_example: |
+      CALENDLY_ACCESS_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${CALENDLY_ACCESS_TOKEN:-${CALENDLY_API_KEY:-}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: CALENDLY_ACCESS_TOKEN not set" >&2; exit 1; }
+        EMAIL=$(curl -fsS https://api.calendly.com/users/me -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["resource"]["email"])')
+        echo "OK — Calendly user: $EMAIL."
+      README.md: |
+        # CALENDLY
+        Scheduling SaaS. API access requires a paid plan.
+      CREDENTIALS.md: |
+        Dashboard: https://calendly.com/integrations/api_webhooks
+        `CALENDLY_ACCESS_TOKEN` — secret. Personal access tokens for individuals.
+
+  # ------------------------------------------------------------------
+  # Productivity / project management / CRM / dev tools APIs
+  # ------------------------------------------------------------------
+
+  - id: LINEAR
+    category: productividad
+    detectors:
+      imports: ["@linear/sdk"]
+      env_vars: ["LINEAR_API_KEY"]
+      deps: ["@linear/sdk"]
+    dashboard_url: "https://linear.app/settings/api"
+    env_example: |
+      LINEAR_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Linear is GraphQL-only.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${LINEAR_API_KEY:?LINEAR_API_KEY not set}"
+        NAME=$(curl -fsS https://api.linear.app/graphql \
+          -H "Authorization: $LINEAR_API_KEY" \
+          -H "Content-Type: application/json" \
+          -d '{"query":"{ viewer { name } }"}' \
+          | python3 -c 'import json,sys; print(json.load(sys.stdin)["data"]["viewer"]["name"])')
+        echo "OK — Linear authed as $NAME."
+      README.md: |
+        # LINEAR
+        Issue tracking and project management. GraphQL API.
+      CREDENTIALS.md: |
+        Dashboard: https://linear.app/settings/api
+        `LINEAR_API_KEY` — secret, personal API key.
+
+  - id: NOTION
+    category: productividad
+    detectors:
+      imports: ["@notionhq/client", "notion-client"]
+      env_vars: ["NOTION_API_KEY", "NOTION_TOKEN", "NOTION_DATABASE_ID"]
+      deps: ["@notionhq/client"]
+    dashboard_url: "https://www.notion.so/my-integrations"
+    env_example: |
+      NOTION_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${NOTION_API_KEY:-${NOTION_TOKEN:-}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: NOTION_API_KEY not set" >&2; exit 1; }
+        NAME=$(curl -fsS https://api.notion.com/v1/users/me \
+          -H "Authorization: Bearer $TOKEN" \
+          -H "Notion-Version: 2022-06-28" \
+          | python3 -c 'import json,sys; print(json.load(sys.stdin).get("name","?"))')
+        echo "OK — Notion integration: $NAME."
+      README.md: |
+        # NOTION
+        Internal integration token gives access to pages explicitly shared with it.
+      CREDENTIALS.md: |
+        Dashboard: https://www.notion.so/my-integrations
+        Internal integration secret. Share each page/db with the integration.
+
+  - id: HUBSPOT
+    category: productividad
+    detectors:
+      imports: ["@hubspot/api-client"]
+      env_vars: ["HUBSPOT_ACCESS_TOKEN", "HUBSPOT_PRIVATE_APP_TOKEN"]
+      deps: ["@hubspot/api-client", "hubspot-api-client"]
+    dashboard_url: "https://app.hubspot.com/private-apps"
+    env_example: |
+      HUBSPOT_ACCESS_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${HUBSPOT_ACCESS_TOKEN:-${HUBSPOT_PRIVATE_APP_TOKEN:-}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: HUBSPOT_ACCESS_TOKEN not set" >&2; exit 1; }
+        N=$(curl -fsS "https://api.hubapi.com/crm/v3/objects/contacts?limit=1" -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["results"]))')
+        echo "OK — HubSpot contacts endpoint accessible (sample: $N)."
+      README.md: |
+        # HUBSPOT
+        CRM + marketing automation + service hub.
+      CREDENTIALS.md: |
+        Dashboard: https://app.hubspot.com/private-apps
+        Private apps use a single bearer token with selectable scopes.
+
+  - id: GITHUB_API
+    category: productividad
+    detectors:
+      imports: ["@octokit/rest", "@octokit/core", "from github", "import github"]
+      env_vars: ["GH_TOKEN", "GITHUB_TOKEN", "GH_PAT", "GITHUB_PAT"]
+      deps: ["@octokit/rest", "@octokit/core", "pygithub", "octokit"]
+    dashboard_url: "https://github.com/settings/tokens"
+    env_example: |
+      GITHUB_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${GITHUB_TOKEN:-${GH_TOKEN:-${GH_PAT:-${GITHUB_PAT:-}}}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: GITHUB_TOKEN not set" >&2; exit 1; }
+        LOGIN=$(curl -fsS https://api.github.com/user -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["login"])')
+        echo "OK — GitHub authed as $LOGIN."
+      README.md: |
+        # GITHUB_API
+        Programmatic access to GitHub (repos, PRs, issues, releases, Actions).
+      CREDENTIALS.md: |
+        Dashboard: https://github.com/settings/tokens (or fine-grained tokens).
+        Use a fine-grained token scoped to the minimal repos/permissions.
+
+  - id: GITLAB_API
+    category: productividad
+    detectors:
+      imports: ["@gitbeaker/rest", "from gitlab", "import gitlab"]
+      env_vars: ["GITLAB_TOKEN", "GITLAB_PRIVATE_TOKEN"]
+      deps: ["@gitbeaker/rest", "python-gitlab"]
+    dashboard_url: "https://gitlab.com/-/user_settings/personal_access_tokens"
+    env_example: |
+      GITLAB_TOKEN=
+      GITLAB_URL=https://gitlab.com
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${GITLAB_TOKEN:?GITLAB_TOKEN not set}"
+        URL="${GITLAB_URL:-https://gitlab.com}"
+        NAME=$(curl -fsS "${URL%/}/api/v4/user" -H "PRIVATE-TOKEN: $GITLAB_TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["username"])')
+        echo "OK — GitLab authed as $NAME."
+      README.md: |
+        # GITLAB_API
+        Programmatic access to GitLab. Works for SaaS and self-hosted.
+      CREDENTIALS.md: |
+        Dashboard: https://gitlab.com/-/user_settings/personal_access_tokens
+        `GITLAB_URL` defaults to gitlab.com; override for self-hosted instances.
+
+  # ------------------------------------------------------------------
+  # Customer support
+  # ------------------------------------------------------------------
+
+  - id: INTERCOM
+    category: productividad
+    detectors:
+      imports: ["@intercom/messenger-js-sdk", "intercom-client"]
+      env_vars: ["INTERCOM_ACCESS_TOKEN", "INTERCOM_APP_ID"]
+      deps: ["intercom-client", "@intercom/messenger-js-sdk"]
+    dashboard_url: "https://app.intercom.com/a/apps/_/developer-hub"
+    env_example: |
+      INTERCOM_ACCESS_TOKEN=
+      INTERCOM_APP_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${INTERCOM_ACCESS_TOKEN:?INTERCOM_ACCESS_TOKEN not set}"
+        NAME=$(curl -fsS https://api.intercom.io/me \
+          -H "Authorization: Bearer $INTERCOM_ACCESS_TOKEN" \
+          -H "Accept: application/json" \
+          | python3 -c 'import json,sys; print(json.load(sys.stdin).get("app",{}).get("name","?"))')
+        echo "OK — Intercom workspace: $NAME."
+      README.md: |
+        # INTERCOM
+        Customer messaging + help center + product tours.
+      CREDENTIALS.md: |
+        Dashboard: https://app.intercom.com/a/apps/_/developer-hub
+        Personal access token (developer hub).
+
+  - id: CRISP
+    category: productividad
+    detectors:
+      imports: ["crisp-api"]
+      env_vars: ["CRISP_IDENTIFIER", "CRISP_KEY", "CRISP_WEBSITE_ID"]
+      deps: ["crisp-api"]
+    dashboard_url: "https://app.crisp.chat/initiate/plugin/"
+    manual_only: true
+    env_example: |
+      CRISP_IDENTIFIER=
+      CRISP_KEY=
+      CRISP_WEBSITE_ID=
+    files:
+      README.md: |
+        # CRISP
+        Customer chat + helpdesk. The REST API uses Basic auth with
+        `identifier:key` plus a Website ID — verify via the official SDK:
+
+            node -e "require('crisp-api').authenticateTier('plugin', process.env.CRISP_IDENTIFIER, process.env.CRISP_KEY)"
+      CREDENTIALS.md: |
+        Dashboard: https://app.crisp.chat/initiate/plugin/
+        Plugin tokens scoped to a specific Website ID.
+
+  # ------------------------------------------------------------------
+  # Feature flags / experimentation
+  # ------------------------------------------------------------------
+
+  - id: GROWTHBOOK
+    category: feature_flags
+    detectors:
+      imports: ["@growthbook/growthbook", "@growthbook/growthbook-react", "growthbook"]
+      env_vars: ["GROWTHBOOK_API_KEY", "GROWTHBOOK_CLIENT_KEY", "GROWTHBOOK_HOST"]
+      deps: ["@growthbook/growthbook", "@growthbook/growthbook-react", "growthbook"]
+    dashboard_url: "https://app.growthbook.io/settings/keys"
+    env_example: |
+      GROWTHBOOK_HOST=https://api.growthbook.io
+      GROWTHBOOK_API_KEY=
+      GROWTHBOOK_CLIENT_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${GROWTHBOOK_API_KEY:?GROWTHBOOK_API_KEY not set}"
+        HOST="${GROWTHBOOK_HOST:-https://api.growthbook.io}"
+        N=$(curl -fsS "${HOST%/}/api/v1/features?limit=1" -H "Authorization: Bearer $GROWTHBOOK_API_KEY" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("limit","?"))')
+        echo "OK — GrowthBook API key valid."
+      README.md: |
+        # GROWTHBOOK
+        Open-source feature flags + experimentation. Cloud or self-hosted.
+      CREDENTIALS.md: |
+        Dashboard: https://app.growthbook.io/settings/keys
+        `GROWTHBOOK_API_KEY` — secret, for the management API.
+        `GROWTHBOOK_CLIENT_KEY` — public, for SDK init.
+
+  - id: LAUNCHDARKLY
+    category: feature_flags
+    detectors:
+      imports: ["launchdarkly-node-server-sdk", "launchdarkly-react-client-sdk", "launchdarkly-js-client-sdk"]
+      env_vars: ["LAUNCHDARKLY_SDK_KEY", "LAUNCHDARKLY_API_KEY", "LD_SDK_KEY", "LD_API_KEY"]
+      deps: ["launchdarkly-node-server-sdk", "launchdarkly-react-client-sdk"]
+    dashboard_url: "https://app.launchdarkly.com/settings/authorization"
+    env_example: |
+      LAUNCHDARKLY_API_KEY=
+      LAUNCHDARKLY_SDK_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        TOKEN="${LAUNCHDARKLY_API_KEY:-${LD_API_KEY:-}}"
+        [ -n "$TOKEN" ] || { echo "ERROR: LAUNCHDARKLY_API_KEY not set" >&2; exit 1; }
+        N=$(curl -fsS https://app.launchdarkly.com/api/v2/projects -H "Authorization: $TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["totalCount"])')
+        echo "OK — LaunchDarkly projects: $N."
+      README.md: |
+        # LAUNCHDARKLY
+        Enterprise feature flagging + experimentation.
+      CREDENTIALS.md: |
+        Dashboard: https://app.launchdarkly.com/settings/authorization
+        `LAUNCHDARKLY_API_KEY` — for REST API.
+        `LAUNCHDARKLY_SDK_KEY` — per-environment, for runtime SDKs.
+
+  - id: FLAGSMITH
+    category: feature_flags
+    detectors:
+      imports: ["flagsmith", "flagsmith-nodejs"]
+      env_vars: ["FLAGSMITH_ENVIRONMENT_KEY", "FLAGSMITH_API_URL", "FLAGSMITH_API_TOKEN"]
+      deps: ["flagsmith", "flagsmith-nodejs"]
+    dashboard_url: "https://app.flagsmith.com"
+    env_example: |
+      FLAGSMITH_API_URL=https://edge.api.flagsmith.com/api/v1
+      FLAGSMITH_ENVIRONMENT_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${FLAGSMITH_ENVIRONMENT_KEY:?FLAGSMITH_ENVIRONMENT_KEY not set}"
+        URL="${FLAGSMITH_API_URL:-https://edge.api.flagsmith.com/api/v1}"
+        # Fetch flags for the env (anonymous identity).
+        curl -fsS "${URL%/}/flags/" -H "X-Environment-Key: $FLAGSMITH_ENVIRONMENT_KEY" >/dev/null
+        echo "OK — Flagsmith environment key valid."
+      README.md: |
+        # FLAGSMITH
+        Open-source feature flagging + remote config. Cloud or self-hosted.
+      CREDENTIALS.md: |
+        Dashboard: https://app.flagsmith.com
+        Environment key per env (dev/staging/prod). Admin tokens for management API.
+
+  # ------------------------------------------------------------------
+  # Chatops & automation
+  # ------------------------------------------------------------------
+
+  - id: SLACK_WEBHOOK
+    category: chat_webhooks
+    detectors:
+      imports: ["@slack/webhook", "@slack/web-api", "slack_sdk"]
+      env_vars: ["SLACK_WEBHOOK_URL", "SLACK_BOT_TOKEN"]
+      deps: ["@slack/webhook", "@slack/web-api", "slack-sdk"]
+    dashboard_url: "https://api.slack.com/apps"
+    env_example: |
+      SLACK_WEBHOOK_URL=
+      SLACK_BOT_TOKEN=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # Posts a test message — visible in the target channel.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${SLACK_WEBHOOK_URL:?SLACK_WEBHOOK_URL not set}"
+        curl -fsS -X POST -H "Content-Type: application/json" \
+          --data '{"text":"harness smoke-test — ignore."}' \
+          "$SLACK_WEBHOOK_URL" | grep -q ok
+        echo "OK — Slack webhook posted a test message."
+      README.md: |
+        # SLACK_WEBHOOK
+        Incoming webhooks + bot token for richer flows (chat.postMessage).
+        > The smoke-test posts a visible message to the target channel.
+      CREDENTIALS.md: |
+        Dashboard: https://api.slack.com/apps
+        Incoming webhook URL is per-channel. Bot tokens (xoxb-…) for Web API.
+
+  - id: DISCORD_WEBHOOK
+    category: chat_webhooks
+    detectors:
+      imports: ["discord.js", "from discord", "import discord"]
+      env_vars: ["DISCORD_WEBHOOK_URL", "DISCORD_BOT_TOKEN"]
+      deps: ["discord.js", "discord.py"]
+    dashboard_url: "https://discord.com/developers/applications"
+    env_example: |
+      DISCORD_WEBHOOK_URL=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        # GET on the webhook URL returns its metadata without sending a message.
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${DISCORD_WEBHOOK_URL:?DISCORD_WEBHOOK_URL not set}"
+        NAME=$(curl -fsS "$DISCORD_WEBHOOK_URL" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("name","?"))')
+        echo "OK — Discord webhook: $NAME."
+      README.md: |
+        # DISCORD_WEBHOOK
+        Incoming webhook for posting messages to a channel.
+      CREDENTIALS.md: |
+        Dashboard: https://discord.com/developers/applications
+        Webhook URL contains an embedded token — treat as secret.
+
+  - id: TELEGRAM_BOT
+    category: chat_webhooks
+    detectors:
+      imports: ["python-telegram-bot", "telegraf", "node-telegram-bot-api"]
+      env_vars: ["TELEGRAM_BOT_TOKEN", "TELEGRAM_CHAT_ID"]
+      deps: ["python-telegram-bot", "telegraf", "node-telegram-bot-api"]
+    dashboard_url: "https://t.me/BotFather"
+    env_example: |
+      TELEGRAM_BOT_TOKEN=
+      TELEGRAM_CHAT_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${TELEGRAM_BOT_TOKEN:?TELEGRAM_BOT_TOKEN not set}"
+        NAME=$(curl -fsS "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/getMe" | python3 -c 'import json,sys; print(json.load(sys.stdin)["result"]["username"])')
+        echo "OK — Telegram bot: @$NAME."
+      README.md: |
+        # TELEGRAM_BOT
+        Create a bot with @BotFather, then drive it via the Bot API.
+      CREDENTIALS.md: |
+        Dashboard: https://t.me/BotFather (chat with @BotFather to create/manage bots)
+        `TELEGRAM_BOT_TOKEN` — secret. Chat ID is the user/group to message.
+
+  - id: N8N
+    category: automatizacion
+    detectors:
+      imports: []
+      env_vars: ["N8N_API_KEY", "N8N_HOST"]
+      deps: []
+    dashboard_url: "https://app.n8n.cloud/settings/api"
+    env_example: |
+      N8N_HOST=
+      N8N_API_KEY=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${N8N_HOST:?N8N_HOST not set}"
+        : "${N8N_API_KEY:?N8N_API_KEY not set}"
+        N=$(curl -fsS "${N8N_HOST%/}/api/v1/workflows?limit=1" -H "X-N8N-API-KEY: $N8N_API_KEY" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["data"]))')
+        echo "OK — n8n workflows endpoint accessible (sample: $N)."
+      README.md: |
+        # N8N
+        Open-source workflow automation. Self-hosted or n8n Cloud.
+      CREDENTIALS.md: |
+        Dashboard: https://app.n8n.cloud/settings/api (or self-hosted equivalent).
+        `N8N_API_KEY` — secret. Required for all REST API calls.
+        API surface: workflows CRUD + `/activate` `/deactivate` + `/workflows/{id}/execute`
+        (recent; no custom input — use a Webhook trigger for runtime params). See the `n8n` skill.
+
+  - id: MAKE
+    category: automatizacion
+    detectors:
+      imports: []
+      env_vars: ["MAKE_API_TOKEN", "MAKE_ZONE"]
+      deps: []
+    dashboard_url: "https://www.make.com/en/help/tools/api"
+    env_example: |
+      MAKE_ZONE=eu1.make.com        # your zone: eu1/eu2/us1/us2 (wrong zone => auth error)
+      MAKE_API_TOKEN=               # Profile > API/token; scopes are fixed at creation
+      MAKE_TEAM_ID=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${MAKE_ZONE:?MAKE_ZONE not set (e.g. eu1.make.com)}"
+        : "${MAKE_API_TOKEN:?MAKE_API_TOKEN not set}"
+        # envelope-agnostic smoke test: -f fails on 4xx/5xx (wrong zone/token); no response-shape parsing
+        curl -fsS "https://${MAKE_ZONE%/}/api/v2/users/me" -H "Authorization: Token $MAKE_API_TOKEN" > /dev/null
+        echo "OK — Make API reachable on $MAKE_ZONE (token accepted)."
+      README.md: |
+        # MAKE
+        Make.com (formerly Integromat). Scenarios via /api/v2; blueprint is a stringified JSON
+        round-trip. Base URL is zone-scoped. See the `make` skill for dynamic create/manage.
+      CREDENTIALS.md: |
+        Dashboard: Profile > API (https://www.make.com/en/help/tools/api).
+        `MAKE_API_TOKEN` — secret; token scopes are immutable after creation. Wrong `MAKE_ZONE`
+        returns an auth error even with a valid token. Endpoints are case-sensitive.
+
+  - id: ZAPIER
+    category: automatizacion
+    detectors:
+      imports: []
+      env_vars: ["ZAPIER_MCP_URL", "ZAPIER_MCP_API_KEY"]
+      deps: []
+    dashboard_url: "https://mcp.zapier.com"
+    env_example: |
+      ZAPIER_MCP_URL=https://mcp.zapier.com/api/v1/connect
+      ZAPIER_MCP_API_KEY=           # Bearer key from the Zapier MCP dashboard (2 tasks per call)
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${ZAPIER_MCP_URL:?ZAPIER_MCP_URL not set}"
+        : "${ZAPIER_MCP_API_KEY:?ZAPIER_MCP_API_KEY not set}"
+        # Zapier exposes no account-CRUD REST API; smoke-test the MCP endpoint with an initialize handshake.
+        CODE=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$ZAPIER_MCP_URL" \
+          -H "Authorization: Bearer $ZAPIER_MCP_API_KEY" -H "Content-Type: application/json" \
+          -H "Accept: application/json, text/event-stream" \
+          -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"rsc","version":"1"}}}')
+        case "$CODE" in 2*) echo "OK — Zapier MCP endpoint reachable (HTTP $CODE).";; *) echo "FAIL — HTTP $CODE" >&2; exit 1;; esac
+      README.md: |
+        # ZAPIER
+        Zapier has NO public API for a normal user to create/manage their own Zaps. Programmatic
+        use = Zapier MCP (runs pre-configured actions across 9,000+ apps; does not author Zaps).
+        See the `zapier` skill for the honest boundary and when to use n8n/Make instead.
+      CREDENTIALS.md: |
+        Dashboard: https://mcp.zapier.com — generate an MCP server + Bearer key.
+        `ZAPIER_MCP_API_KEY` — secret (Bearer). Each successful tool call costs 2 Zapier tasks.
+
+  - id: POWER_AUTOMATE
+    category: automatizacion
+    detectors:
+      imports: []
+      env_vars: ["PA_DATAVERSE_URL", "PA_TENANT_ID", "PA_CLIENT_ID", "PA_CLIENT_SECRET"]
+      deps: []
+    dashboard_url: "https://make.powerautomate.com"
+    env_example: |
+      PA_DATAVERSE_URL=https://<org>.crm.dynamics.com   # your Dataverse org URL (region domain varies)
+      PA_TENANT_ID=                 # Entra tenant id
+      PA_CLIENT_ID=                 # Entra app registration (needs a Dataverse application user)
+      PA_CLIENT_SECRET=
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${PA_DATAVERSE_URL:?PA_DATAVERSE_URL not set}"
+        : "${PA_TENANT_ID:?PA_TENANT_ID not set}"; : "${PA_CLIENT_ID:?PA_CLIENT_ID not set}"; : "${PA_CLIENT_SECRET:?PA_CLIENT_SECRET not set}"
+        TOKEN=$(curl -fsS "https://login.microsoftonline.com/${PA_TENANT_ID}/oauth2/v2.0/token" \
+          -d "grant_type=client_credentials&client_id=${PA_CLIENT_ID}&client_secret=${PA_CLIENT_SECRET}&scope=${PA_DATAVERSE_URL%/}/.default" \
+          | python3 -c 'import json,sys; print(json.load(sys.stdin)["access_token"])')
+        N=$(curl -fsS "${PA_DATAVERSE_URL%/}/api/data/v9.2/workflows?\$filter=category%20eq%205&\$top=1" \
+          -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["value"]))')
+        echo "OK — Dataverse reachable; cloud-flow query returned $N row(s)."
+      README.md: |
+        # POWER_AUTOMATE
+        Microsoft Power Automate cloud flows via the Dataverse Web API (solution-aware flows only;
+        `api.flow.microsoft.com` is unsupported). Auth is Entra OAuth. See the `power-automate` skill.
+      CREDENTIALS.md: |
+        Register an Entra app; add it as a Dataverse application user with a security role granting
+        Process (workflow) privileges. `PA_CLIENT_SECRET` — secret. Only flows inside a Dataverse
+        solution are code-manageable; personal "My Flows" are not.
+
+  - id: WANDB
+    category: ia_training
+    detectors:
+      imports: ["import wandb", "from wandb", "@wandb/sdk"]
+      env_vars: ["WANDB_API_KEY", "WANDB_ENTITY", "WANDB_PROJECT"]
+      deps: ["wandb"]
+    dashboard_url: "https://wandb.ai/authorize"
+    env_example: |
+      # Weights & Biases — experiment tracking for training runs. Key: https://wandb.ai/authorize
+      WANDB_API_KEY=
+      # WANDB_ENTITY=       # team or username (optional default)
+      # WANDB_PROJECT=      # default project (optional)
+    files:
+      test_connection.sh: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        set -a; source "$SCRIPT_DIR/.env"; set +a
+        : "${WANDB_API_KEY:?WANDB_API_KEY not set}"
+        # GraphQL viewer whoami; W&B authenticates the API key via HTTP basic (key in the password field).
+        # If the GraphQL shape/auth changes, the portable fallback is: pip install wandb && wandb login --verify
+        USER=$(curl -fsS "https://api.wandb.ai/graphql" -u "api:$WANDB_API_KEY" \
+          -H "Content-Type: application/json" \
+          -d '{"query":"query { viewer { username } }"}' \
+          | python3 -c 'import json,sys; print(json.load(sys.stdin)["data"]["viewer"]["username"])')
+        echo "OK — W&B authed as $USER."
+      README.md: |
+        # WANDB
+        Weights & Biases — experiment tracking / MLOps for training runs (loss curves, sweeps,
+        artifacts). Used by the `finetuning`, `deep-learning`, and `machine-learning` skills.
+      CREDENTIALS.md: |
+        Dashboard: https://wandb.ai/authorize (copy your API key).
+        `WANDB_API_KEY` — secret. Verify with `wandb login --verify` if the GraphQL check is flaky.
+
+# Categories used to group tools in 01-TOOLS/README.md.
+categories:
+  infra: "Infra & deploy"
+  datos: "Databases & BaaS"
+  almacenamiento: "Object storage"
+  pagos: "Payments & billing"
+  email: "Email (transactional)"
+  pagos_email: "Email (transactional, legacy bucket)"
+  mobile_auth: "Mobile / auth"
+  auth: "Auth & identity"
+  ia: "AI / generation (legacy bucket)"
+  ia_texto: "AI / LLMs"
+  ia_media: "AI / audio, image, video"
+  busqueda: "Search & vector databases"
+  observabilidad: "Observability"
+  analitica: "Product analytics"
+  comunicacion: "Communications (SMS, push, voice)"
+  realtime: "Realtime & video"
+  mapas_geo: "Maps & geolocation"
+  productividad: "Productivity / PM / CRM"
+  feature_flags: "Feature flags"
+  chat_webhooks: "Chatops webhooks"
+  automatizacion: "Automation"
+  ia_training: "AI / training & MLOps"