@volter/twin-world 0.1.0 → 0.1.1

package/known-external-services.json

@@ -0,0 +1,1192 @@
+{
+  "//": "PACKLESS-VENDOR REGISTRY — every external-service-shaped npm dep / env stem the catalog KNOWS but has no pack for, plus the not-a-service suppressions and the external-shape patterns. ONE home (absorbs covers.ts's inline NOT_AN_EXTERNAL_SERVICE / UNKNOWN_DEP_KNOWN_SERVICES / UNKNOWN_DEP_PATTERNS and the 2026-08-31 census rulings ledger — company-layer notes/census-rulings-2026-08-31.md). disposition 'demanded' = a real coverage gap, stays LOUD (the demand queue); 'acknowledged' = adjudicated acceptable, covers auto-acknowledges with the recorded reason. AN ENTRY DIES THE DAY ITS PACK IS BORN (scripts/packless-claims.test.ts enforces disjointness with pack adoption + SDK_TWINS).",
+  "deps": {
+    "@1password/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor 1password, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@ai-sdk/alibaba": {
+      "disposition": "demanded",
+      "reason": "vendor alibaba-dashscope, pack demanded by census 2026-08-31 (rulings-draft: new-pack, ×1). NB: an earlier encoding mislabeled this acknowledged by citing the bare `alibaba` env stem's separate ruling — §9 round two H6, 2026-08-31."
+    },
+    "@ai-sdk/cerebras": {
+      "disposition": "demanded",
+      "reason": "vendor cerebras, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@ai-sdk/deepinfra": {
+      "disposition": "demanded",
+      "reason": "vendor deepinfra, pack demanded by census 2026-08-31 (×2)"
+    },
+    "@ai-sdk/fireworks": {
+      "disposition": "demanded",
+      "reason": "vendor fireworks, pack demanded by census 2026-08-31 (×2)"
+    },
+    "@ai-sdk/minimax": {
+      "disposition": "demanded",
+      "reason": "vendor minimax, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@ai-sdk/moonshotai": {
+      "disposition": "demanded",
+      "reason": "vendor moonshot, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@ai-sdk/openai-compatible": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: config-time OpenAI-compatible adapter, no vendor of its own — coverage is judged per repo by the provider host it is configured against; mapping it to one vendor would be the googleapis-umbrella lie (census 2026-08-31, ×14)"
+    },
+    "@ai-sdk/togetherai": {
+      "disposition": "demanded",
+      "reason": "vendor togetherai, pack demanded by census 2026-08-31 (×3)"
+    },
+    "@azure/communication-email": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Communication Services area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "@azure/communication-sms": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Communication Services area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "@azure/keyvault-secrets": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Key Vault area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "@azure/msal-node": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Entra auth area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×4)"
+    },
+    "@azure/playwright": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Playwright Testing area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "@azure/search-documents": {
+      "disposition": "demanded",
+      "reason": "vendor azure (AI Search area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×2)"
+    },
+    "@base44/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor base44, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@botpress/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor botpress, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@configcat/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor configcat, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@daytona/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor daytona, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@directus/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor directus, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@getalby/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor alby, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@getbrevo/brevo": {
+      "disposition": "demanded",
+      "reason": "vendor brevo, well-known service client with no twin pack (curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES)"
+    },
+    "@gomomento/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor momento, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@infobip-api/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor infobip, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@kapaai/react-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor kapa.ai, pack demanded by census 2026-08-31 (×2)"
+    },
+    "@larksuiteoapi/node-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor lark, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@launchdarkly/node-server-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor launchdarkly, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@libsql/client": {
+      "disposition": "demanded",
+      "reason": "vendor turso, DB data-plane over HTTP; hides behind DATABASE_URL-shaped env that init's infra heuristic claims first, so the dep name is the only escaping signal (twin#255)"
+    },
+    "@lightdash/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor lightdash, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@line/bot-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor line, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@mailchain/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor mailchain, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@n8n_io/ai-assistant-sdk": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: n8n's own hosted AI-assistant service; the CE playground runs without it (census 2026-08-31, ×1)"
+    },
+    "@n8n_io/license-sdk": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: n8n's own hosted license server; the CE playground runs without it (census 2026-08-31, ×1)"
+    },
+    "@neondatabase/serverless": {
+      "disposition": "demanded",
+      "reason": "vendor neon, DB data-plane over HTTP; hides behind DATABASE_URL-shaped env that init's infra heuristic claims first, so the dep name is the only escaping signal (twin#255)"
+    },
+    "@neynar/nodejs-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor neynar, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@octopusdeploy/api-client": {
+      "disposition": "demanded",
+      "reason": "vendor octopus-deploy, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@openpanel/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor openpanel, pack demanded by census 2026-08-31 (×2)"
+    },
+    "@ringcentral/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor ringcentral, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@runwayml/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor runwayml, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@scrapeless-ai/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor scrapeless, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@shopify/shopify-api": {
+      "disposition": "demanded",
+      "reason": "vendor shopify, well-known service client with no twin pack (curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES)"
+    },
+    "@stigg/node-server-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor stigg, pack demanded by census 2026-08-31 (×1); needed by ponder"
+    },
+    "@stigg/react-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor stigg, pack demanded by census 2026-08-31 (×1); needed by ponder"
+    },
+    "@trigger.dev/sdk": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: self-hostable job orchestration — census-rulings-2026-08-31.md:66 rules acknowledge first; re-rule into a pack if hosted-cloud demand recurs (×4)"
+    },
+    "@usercentrics/cmp-browser-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor usercentrics, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@vapi-ai/server-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor vapi, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@vonage/server-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor vonage, pack demanded by census 2026-08-31 (×2)"
+    },
+    "@xata.io/client": {
+      "disposition": "demanded",
+      "reason": "vendor xata, DB data-plane over HTTP; hides behind DATABASE_URL-shaped env that init's infra heuristic claims first, so the dep name is the only escaping signal (twin#255)"
+    },
+    "discord.js": {
+      "disposition": "demanded",
+      "reason": "vendor discord, well-known service client with no twin pack (curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES)"
+    },
+    "expo-server-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor expo, pack demanded by census 2026-08-31 (×2); needed by ponder"
+    },
+    "facebook-nodejs-business-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor meta, pack demanded by census 2026-08-31 (×1)"
+    },
+    "googleapis": {
+      "disposition": "demanded",
+      "reason": "stays LOUD deliberately, overriding the census ledger's acknowledged ruling: the umbrella client (Drive/Sheets/Calendar/Gmail/YouTube+) must never map to one vendor NOR self-acknowledge — either would report per-repo coverage the world does not have (§9 finding 2026-08-19; reaffirmed §9 round two H6 2026-08-31). Retired from the pack demand queue: never build a `googleapis` pack — the FOCUSED @googleapis/* siblings map via SDK_TWINS."
+    },
+    "launchdarkly-node-server-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor launchdarkly, well-known service client with no twin pack (curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES)"
+    },
+    "launchdarkly-react-client-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor launchdarkly, pack demanded by census 2026-08-31 (×1)"
+    },
+    "matrix-js-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor matrix, pack demanded by census 2026-08-31 (×1)"
+    },
+    "node-telegram-bot-api": {
+      "disposition": "demanded",
+      "reason": "vendor telegram, pack demanded by census 2026-08-31 (×2); already curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES"
+    },
+    "npm-registry@npm.jsr.io": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: registry destination — the npm-registry twin deliberately owns npmjs + GitHub only (census 2026-08-31, ×2)"
+    },
+    "pluggy-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor pluggy, pack demanded by census 2026-08-31 (×1)"
+    },
+    "retell-client-js-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor retell, pack demanded by census 2026-08-31 (×1)"
+    },
+    "retell-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor retell, pack demanded by census 2026-08-31 (×1)"
+    },
+    "shopify-api-node": {
+      "disposition": "demanded",
+      "reason": "vendor shopify, well-known service client with no twin pack (curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES)"
+    },
+    "telegraf": {
+      "disposition": "demanded",
+      "reason": "vendor telegram, pack demanded by census 2026-08-31 (×1); already curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES"
+    },
+    "together-ai": {
+      "disposition": "demanded",
+      "reason": "vendor togetherai, well-known service client with no twin pack (curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES)"
+    },
+    "twenty-client-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor twenty, pack demanded by census 2026-08-31 (×1)"
+    },
+    "twenty-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor twenty, pack demanded by census 2026-08-31 (×1)"
+    },
+    "@lobehub/market-sdk": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: LobeHub's own marketplace client — first-party-adjacent surface judged per repo (census-rulings-2026-08-31.md:103-105, the one unadjudicated judgment row, ruled acknowledged)"
+    },
+    "@vercel/postgres": {
+      "disposition": "demanded",
+      "reason": "vendor neon, DB data-plane over HTTP — the neon driver in disguise (census-rulings-2026-08-31.md:93-94); joins the @neondatabase/serverless / @libsql/client / @xata.io/client twin#255 class: hides behind DATABASE_URL-shaped env, the dep name is the only escaping signal"
+    },
+    "@aws-sdk/credential-providers": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: credential-resolution glue for the AWS SDKs, not a service surface of its own — ruled acknowledged by census 2026-08-31 (×10); kept out of notExternal because it IS aws-scoped and the pattern would otherwise flag it"
+    },
+    "@aws-sdk/credential-provider-node": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: same class as @aws-sdk/credential-providers (census 2026-08-31, ×2)"
+    },
+    "@aws-sdk/client-lambda": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Lambda area), ×3 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-sns": {
+      "disposition": "demanded",
+      "reason": "vendor aws (SNS area), ×3 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-sts": {
+      "disposition": "demanded",
+      "reason": "vendor aws (STS area — the twin serves no sts.<region>.amazonaws.com surface), ×3 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-ses": {
+      "disposition": "demanded",
+      "reason": "vendor aws (SES v1 Query API area — the sesv2 area answers the v1 wire loudly rather than modeling it, per the pack's own ruling), ×2 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-textract": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Textract area), ×2 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-cloudfront": {
+      "disposition": "demanded",
+      "reason": "vendor aws (CloudFront area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-cloudwatch": {
+      "disposition": "demanded",
+      "reason": "vendor aws (CloudWatch area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-cognito-identity-provider": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Cognito area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-eventbridge": {
+      "disposition": "demanded",
+      "reason": "vendor aws (EventBridge area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-kendra": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Kendra area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-kinesis": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Kinesis area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-kms": {
+      "disposition": "demanded",
+      "reason": "vendor aws (KMS area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-lambda-microvms": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Lambda MicroVMs area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-polly": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Polly area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-redshift-data": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Redshift Data API area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-route-53": {
+      "disposition": "demanded",
+      "reason": "vendor aws (Route 53 area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-scheduler": {
+      "disposition": "demanded",
+      "reason": "vendor aws (EventBridge Scheduler area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-sqs": {
+      "disposition": "demanded",
+      "reason": "vendor aws (SQS area), ×1 — ladder classification 2026-09-02"
+    },
+    "@aws-sdk/client-sso-oidc": {
+      "disposition": "demanded",
+      "reason": "vendor aws (IAM Identity Center OIDC area), ×1 — ladder classification 2026-09-02"
+    },
+    "@azure/msal-browser": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Entra auth area; same class as @azure/msal-node — the pack deliberately does not claim login.microsoftonline.com), ×1 — ladder classification 2026-09-02"
+    },
+    "@vercel/analytics": {
+      "disposition": "demanded",
+      "reason": "vendor vercel (Web Analytics ingestion area — the beacon posts to vitals.vercel-insights.com / _vercel/insights, neither of the two hosts this twin serves), ×4 — ladder classification 2026-09-02"
+    },
+    "@vercel/speed-insights": {
+      "disposition": "demanded",
+      "reason": "vendor vercel (Speed Insights ingestion area — same beacon class as @vercel/analytics), ×2 — ladder classification 2026-09-02"
+    },
+    "@segment/analytics-next": {
+      "disposition": "demanded",
+      "reason": "vendor segment (Analytics.js browser area — the browser build boots from a cdn.segment.com settings fetch the tracking-API twin does not serve; the pack declines the claim deliberately), ×3 — ladder classification 2026-09-02"
+    },
+    "@intercom/messenger-js-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor intercom (Messenger widget area — loads widget.intercom.io and talks to api-iam.intercom.io, neither served by the REST twin), ×1 — ladder classification 2026-09-02"
+    },
+    "@posthog/mcp-analytics": {
+      "disposition": "demanded",
+      "reason": "vendor posthog (remote MCP area — an alias of @posthog/mcp, which targets mcp.posthog.com, a host this twin does not serve), ×1 — ladder classification 2026-09-02"
+    },
+    "@google-cloud/bigtable": {
+      "disposition": "demanded",
+      "reason": "vendor googlecloud (Bigtable area; one family pack per the census rulings' convention 1), ×1 — ladder classification 2026-09-02"
+    },
+    "@google-cloud/logging-winston": {
+      "disposition": "demanded",
+      "reason": "vendor googlecloud (Cloud Logging area; one family pack per the census rulings' convention 1), ×1 — ladder classification 2026-09-02"
+    },
+    "@google-cloud/opentelemetry-cloud-trace-exporter": {
+      "disposition": "demanded",
+      "reason": "vendor googlecloud (Cloud Trace area — the EXPORTER ships spans to cloudtrace.googleapis.com; its sibling @google-cloud/opentelemetry-resource-util is a local helper and stays not-external), ×1 — ladder classification 2026-09-02"
+    },
+    "@google-cloud/pubsub": {
+      "disposition": "demanded",
+      "reason": "vendor googlecloud (Pub/Sub area; one family pack per the census rulings' convention 1), ×1 — ladder classification 2026-09-02"
+    },
+    "@google-cloud/resource-manager": {
+      "disposition": "demanded",
+      "reason": "vendor googlecloud (Resource Manager area; one family pack per the census rulings' convention 1), ×1 — ladder classification 2026-09-02"
+    },
+    "@google-cloud/secret-manager": {
+      "disposition": "demanded",
+      "reason": "vendor googlecloud (Secret Manager area; one family pack per the census rulings' convention 1), ×1 — ladder classification 2026-09-02"
+    },
+    "@google-cloud/spanner": {
+      "disposition": "demanded",
+      "reason": "vendor googlecloud (Spanner area; one family pack per the census rulings' convention 1), ×1 — ladder classification 2026-09-02"
+    },
+    "@googleapis/admin": {
+      "disposition": "demanded",
+      "reason": "vendor google-workspace-admin (Admin SDK Directory/Reports), ×1 — ladder classification 2026-09-02"
+    },
+    "@googleapis/androidpublisher": {
+      "disposition": "demanded",
+      "reason": "vendor google-play (Play Developer API), ×1 — ladder classification 2026-09-02"
+    },
+    "@googleapis/calendar": {
+      "disposition": "demanded",
+      "reason": "vendor google-calendar, ×1 (plus the GOOGLE_CALENDAR_API_KEY stem, ×1) — ladder classification 2026-09-02"
+    },
+    "@googleapis/sheets": {
+      "disposition": "demanded",
+      "reason": "vendor google-sheets, ×1 — ladder classification 2026-09-02"
+    },
+    "@grafana/faro-web-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor grafana-faro (Faro frontend-observability collector); its @grafana/aws-sdk and @grafana/azure-sdk siblings are datasource-plugin helper libraries and stay not-external, ×1 — ladder classification 2026-09-02"
+    },
+    "@betterbugs/web-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor betterbugs (betterbugs.io session/bug capture), ×1 — ladder classification 2026-09-02"
+    },
+    "@prelude.so/js-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor prelude (prelude.so phone verification), ×1 — ladder classification 2026-09-02"
+    },
+    "@rss3/sdk": {
+      "disposition": "demanded",
+      "reason": "vendor rss3 (api.rss3.io), ×1 — ladder classification 2026-09-02"
+    },
+    "fanfou-sdk": {
+      "disposition": "demanded",
+      "reason": "vendor fanfou (Fanfou microblog API), ×1 — ladder classification 2026-09-02"
+    },
+    "stigg": {
+      "disposition": "demanded",
+      "reason": "vendor stigg, pack demanded by consumer (ponder) — a real vendor this application calls with no twin yet; needed by ponder"
+    },
+    "bitly": {
+      "disposition": "demanded",
+      "reason": "vendor bitly, pack demanded by consumer (dub) — a real vendor this application calls with no twin yet; needed by dub"
+    },
+    "paypal": {
+      "disposition": "demanded",
+      "reason": "vendor paypal, pack demanded by consumer (dub) — a real vendor this application calls with no twin yet; needed by dub"
+    },
+    "googleads": {
+      "disposition": "demanded",
+      "reason": "vendor googleads, pack demanded by consumer (dub) — a real vendor this application calls with no twin yet; needed by dub"
+    },
+    "tiktok": {
+      "disposition": "demanded",
+      "reason": "vendor tiktok, pack demanded by consumer (dub) — a real vendor this application calls with no twin yet; needed by dub"
+    }
+  },
+  "envStems": {
+    "ai302": {
+      "disposition": "demanded",
+      "reason": "vendor 302ai, pack demanded by census 2026-08-31 (×1)"
+    },
+    "alibaba": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: ambiguous Alibaba stem (Alibaba Cloud / DashScope / OAuth login) — singleton, re-rule if demand recurs (census 2026-08-31, ×1)"
+    },
+    "apple": {
+      "disposition": "demanded",
+      "reason": "vendor apple, pack demanded by census 2026-08-31 (×3)"
+    },
+    "appleloginweb": {
+      "disposition": "demanded",
+      "reason": "vendor apple, pack demanded by census 2026-08-31 (×1)"
+    },
+    "appsumo": {
+      "disposition": "demanded",
+      "reason": "vendor appsumo, pack demanded by census 2026-08-31 (×1)"
+    },
+    "auth0": {
+      "disposition": "demanded",
+      "reason": "vendor auth0, pack demanded by census 2026-08-31 (×1)"
+    },
+    "authelia": {
+      "disposition": "demanded",
+      "reason": "vendor authelia, pack demanded by census 2026-08-31 (×1)"
+    },
+    "authentik": {
+      "disposition": "demanded",
+      "reason": "vendor authentik, pack demanded by census 2026-08-31 (×1)"
+    },
+    "authmicrosoft": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Entra auth area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "azureadb2c": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Entra auth area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "azureaisearch": {
+      "disposition": "demanded",
+      "reason": "vendor azure (AI Search area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "baidu": {
+      "disposition": "demanded",
+      "reason": "vendor baidu, pack demanded by census 2026-08-31 (×1)"
+    },
+    "basecamp3": {
+      "disposition": "demanded",
+      "reason": "vendor basecamp, pack demanded by census 2026-08-31 (×1)"
+    },
+    "battlenet": {
+      "disposition": "demanded",
+      "reason": "vendor battlenet, pack demanded by census 2026-08-31 (×1)"
+    },
+    "beehiive": {
+      "disposition": "demanded",
+      "reason": "vendor beehiiv, pack demanded by census 2026-08-31 (×1)"
+    },
+    "bitly": {
+      "disposition": "demanded",
+      "reason": "vendor bitly, pack demanded by census 2026-08-31 (×1)"
+    },
+    "box": {
+      "disposition": "demanded",
+      "reason": "vendor box, pack demanded by census 2026-08-31 (×1)"
+    },
+    "bungie": {
+      "disposition": "demanded",
+      "reason": "vendor bungie, pack demanded by census 2026-08-31 (×1)"
+    },
+    "buttondown": {
+      "disposition": "demanded",
+      "reason": "vendor buttondown, pack demanded by census 2026-08-31 (×1)"
+    },
+    "bytedance": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: ambiguous ByteDance stem (TikTok / Douyin / Volcengine) — singleton, re-rule if demand recurs (census 2026-08-31, ×1)"
+    },
+    "chatglm": {
+      "disposition": "demanded",
+      "reason": "vendor zhipu, pack demanded by census 2026-08-31 (×1)"
+    },
+    "closecom": {
+      "disposition": "demanded",
+      "reason": "vendor close, pack demanded by census 2026-08-31 (×1)"
+    },
+    "cloudinary": {
+      "disposition": "demanded",
+      "reason": "vendor cloudinary, pack demanded by census 2026-08-31 (×1)"
+    },
+    "coinbase": {
+      "disposition": "demanded",
+      "reason": "vendor coinbase, pack demanded by census 2026-08-31 (×1)"
+    },
+    "crowdin": {
+      "disposition": "demanded",
+      "reason": "vendor crowdin, pack demanded by census 2026-08-31 (×1)"
+    },
+    "daily": {
+      "disposition": "demanded",
+      "reason": "vendor daily.co, pack demanded by census 2026-08-31 (×1)"
+    },
+    "daytona": {
+      "disposition": "demanded",
+      "reason": "vendor daytona, pack demanded by census 2026-08-31 (×1)"
+    },
+    "discord": {
+      "disposition": "demanded",
+      "reason": "vendor discord, pack demanded by census 2026-08-31 (×4)"
+    },
+    "dribbble": {
+      "disposition": "demanded",
+      "reason": "vendor dribbble, pack demanded by census 2026-08-31 (×1)"
+    },
+    "dropbox": {
+      "disposition": "demanded",
+      "reason": "vendor dropbox, pack demanded by census 2026-08-31 (×1)"
+    },
+    "dub": {
+      "disposition": "demanded",
+      "reason": "vendor dub, pack demanded by census 2026-08-31 (×1)"
+    },
+    "e2b": {
+      "disposition": "demanded",
+      "reason": "vendor e2b, pack demanded by census 2026-08-31 (×2)"
+    },
+    "eveonline": {
+      "disposition": "demanded",
+      "reason": "vendor eveonline, pack demanded by census 2026-08-31 (×1)"
+    },
+    "facebook": {
+      "disposition": "demanded",
+      "reason": "vendor meta, pack demanded by census 2026-08-31 (×2)"
+    },
+    "faceit": {
+      "disposition": "demanded",
+      "reason": "vendor faceit, pack demanded by census 2026-08-31 (×1)"
+    },
+    "firebase": {
+      "disposition": "demanded",
+      "reason": "vendor firebase, pack demanded by census 2026-08-31 (×1)"
+    },
+    "foursquare": {
+      "disposition": "demanded",
+      "reason": "vendor foursquare, pack demanded by census 2026-08-31 (×1)"
+    },
+    "freshbooks": {
+      "disposition": "demanded",
+      "reason": "vendor freshbooks, pack demanded by census 2026-08-31 (×1)"
+    },
+    "fusionauth": {
+      "disposition": "demanded",
+      "reason": "vendor fusionauth, pack demanded by census 2026-08-31 (×1)"
+    },
+    "giphy": {
+      "disposition": "demanded",
+      "reason": "vendor giphy, pack demanded by census 2026-08-31 (×1)"
+    },
+    "gitlab": {
+      "disposition": "demanded",
+      "reason": "vendor gitlab, pack demanded by census 2026-08-31 (×2)"
+    },
+    "hanko": {
+      "disposition": "demanded",
+      "reason": "vendor hanko, pack demanded by census 2026-08-31 (×1)"
+    },
+    "huddle01": {
+      "disposition": "demanded",
+      "reason": "vendor huddle01, pack demanded by census 2026-08-31 (×1)"
+    },
+    "iffy": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: iffy.com content-moderation SaaS — pack on demand (census 2026-08-31, ×1)"
+    },
+    "iflytek": {
+      "disposition": "demanded",
+      "reason": "vendor iflytek, pack demanded by census 2026-08-31 (×1)"
+    },
+    "iframely": {
+      "disposition": "demanded",
+      "reason": "vendor iframely, pack demanded by census 2026-08-31 (×1)"
+    },
+    "infappconnectionazureappconfiguration": {
+      "disposition": "demanded",
+      "reason": "vendor azure (App Configuration area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "infappconnectionazureclientsecrets": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Entra auth area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "infappconnectionazuredevops": {
+      "disposition": "demanded",
+      "reason": "vendor azure (DevOps area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "infappconnectionazurekeyvault": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Key Vault area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "infappconnectiongitlaboauth": {
+      "disposition": "demanded",
+      "reason": "vendor gitlab, pack demanded by census 2026-08-31 (×1)"
+    },
+    "infappconnectionherokuoauth": {
+      "disposition": "demanded",
+      "reason": "vendor heroku, pack demanded by census 2026-08-31 (×1)"
+    },
+    "kakao": {
+      "disposition": "demanded",
+      "reason": "vendor kakao, pack demanded by census 2026-08-31 (×1)"
+    },
+    "keycloak": {
+      "disposition": "demanded",
+      "reason": "vendor keycloak, pack demanded by census 2026-08-31 (×1)"
+    },
+    "lemonsqueezy": {
+      "disposition": "demanded",
+      "reason": "vendor lemonsqueezy, pack demanded by census 2026-08-31 (×1)"
+    },
+    "line": {
+      "disposition": "demanded",
+      "reason": "vendor line, pack demanded by census 2026-08-31 (×1)"
+    },
+    "lingo": {
+      "disposition": "demanded",
+      "reason": "vendor lingo.dev, pack demanded by census 2026-08-31 (×1)"
+    },
+    "lingodotdev": {
+      "disposition": "demanded",
+      "reason": "vendor lingo.dev, pack demanded by census 2026-08-31 (×1)"
+    },
+    "linkedin": {
+      "disposition": "demanded",
+      "reason": "vendor linkedin, pack demanded by census 2026-08-31 (×3)"
+    },
+    "llamaparse": {
+      "disposition": "demanded",
+      "reason": "vendor llamacloud, pack demanded by census 2026-08-31 (×1)"
+    },
+    "loops": {
+      "disposition": "demanded",
+      "reason": "vendor loops, pack demanded by census 2026-08-31 (×2)"
+    },
+    "mailchimp": {
+      "disposition": "demanded",
+      "reason": "vendor mailchimp, pack demanded by census 2026-08-31 (×1)"
+    },
+    "mailru": {
+      "disposition": "demanded",
+      "reason": "vendor mailru, pack demanded by census 2026-08-31 (×1)"
+    },
+    "mandrillingress": {
+      "disposition": "demanded",
+      "reason": "vendor mailchimp, pack demanded by census 2026-08-31 (×1)"
+    },
+    "mastodon": {
+      "disposition": "demanded",
+      "reason": "vendor mastodon, pack demanded by census 2026-08-31 (×1)"
+    },
+    "microsoft": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Entra auth area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "moonshot": {
+      "disposition": "demanded",
+      "reason": "vendor moonshot, pack demanded by census 2026-08-31 (×1)"
+    },
+    "msgraph": {
+      "disposition": "demanded",
+      "reason": "vendor microsoft-graph, pack demanded by census 2026-08-31 (×1)"
+    },
+    "naver": {
+      "disposition": "demanded",
+      "reason": "vendor naver, pack demanded by census 2026-08-31 (×1)"
+    },
+    "netlify": {
+      "disposition": "demanded",
+      "reason": "vendor netlify, pack demanded by census 2026-08-31 (×1)"
+    },
+    "nextprivatemailchannels": {
+      "disposition": "demanded",
+      "reason": "vendor mailchannels, pack demanded by census 2026-08-31 (×1)"
+    },
+    "nextprivatemicrosoft": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Entra auth area; one family pack per the census rulings' convention 1), pack demanded by census 2026-08-31 (×1)"
+    },
+    "okta": {
+      "disposition": "demanded",
+      "reason": "vendor okta, pack demanded by census 2026-08-31 (×1)"
+    },
+    "onelogin": {
+      "disposition": "demanded",
+      "reason": "vendor onelogin, pack demanded by census 2026-08-31 (×1)"
+    },
+    "openpanel": {
+      "disposition": "demanded",
+      "reason": "vendor openpanel, pack demanded by census 2026-08-31 (×1)"
+    },
+    "osu": {
+      "disposition": "demanded",
+      "reason": "vendor osu, pack demanded by census 2026-08-31 (×1)"
+    },
+    "patreon": {
+      "disposition": "demanded",
+      "reason": "vendor patreon, pack demanded by census 2026-08-31 (×1)"
+    },
+    "paypal": {
+      "disposition": "demanded",
+      "reason": "vendor paypal, pack demanded by census 2026-08-31 (×1)"
+    },
+    "pinterest": {
+      "disposition": "demanded",
+      "reason": "vendor pinterest, pack demanded by census 2026-08-31 (×2)"
+    },
+    "pipedrive": {
+      "disposition": "demanded",
+      "reason": "vendor pipedrive, pack demanded by census 2026-08-31 (×1)"
+    },
+    "playgroundunkey": {
+      "disposition": "demanded",
+      "reason": "vendor unkey, pack demanded by census 2026-08-31 (×1)"
+    },
+    "plunk": {
+      "disposition": "demanded",
+      "reason": "vendor plunk, pack demanded by census 2026-08-31 (×1)"
+    },
+    "reddit": {
+      "disposition": "demanded",
+      "reason": "vendor reddit, pack demanded by census 2026-08-31 (×2)"
+    },
+    "reodev": {
+      "disposition": "demanded",
+      "reason": "vendor reo.dev, pack demanded by census 2026-08-31 (×1)"
+    },
+    "salesforce": {
+      "disposition": "demanded",
+      "reason": "vendor salesforce, pack demanded by census 2026-08-31 (×2)"
+    },
+    "scrapingbee": {
+      "disposition": "demanded",
+      "reason": "vendor scrapingbee, pack demanded by census 2026-08-31 (×1)"
+    },
+    "searchapi": {
+      "disposition": "demanded",
+      "reason": "vendor searchapi, pack demanded by census 2026-08-31 (×1)"
+    },
+    "siliconflow": {
+      "disposition": "demanded",
+      "reason": "vendor siliconflow, pack demanded by census 2026-08-31 (×1)"
+    },
+    "spotify": {
+      "disposition": "demanded",
+      "reason": "vendor spotify, pack demanded by census 2026-08-31 (×1)"
+    },
+    "stability": {
+      "disposition": "demanded",
+      "reason": "vendor stability-ai, pack demanded by census 2026-08-31 (×1)"
+    },
+    "strava": {
+      "disposition": "demanded",
+      "reason": "vendor strava, pack demanded by census 2026-08-31 (×1)"
+    },
+    "tavily": {
+      "disposition": "demanded",
+      "reason": "vendor tavily, pack demanded by census 2026-08-31 (×1)"
+    },
+    "tencent": {
+      "disposition": "demanded",
+      "reason": "vendor tencent, pack demanded by census 2026-08-31 (×1)"
+    },
+    "tiktok": {
+      "disposition": "demanded",
+      "reason": "vendor tiktok, pack demanded by census 2026-08-31 (×2)"
+    },
+    "tiktokbusiness": {
+      "disposition": "demanded",
+      "reason": "vendor tiktok, pack demanded by census 2026-08-31 (×1)"
+    },
+    "todoist": {
+      "disposition": "demanded",
+      "reason": "vendor todoist, pack demanded by census 2026-08-31 (×1)"
+    },
+    "traversaal": {
+      "disposition": "demanded",
+      "reason": "vendor traversaal, pack demanded by census 2026-08-31 (×1)"
+    },
+    "trigger": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: trigger.dev stem — same acknowledge-first ruling as @trigger.dev/sdk (census-rulings-2026-08-31.md:66)"
+    },
+    "tumblr": {
+      "disposition": "demanded",
+      "reason": "vendor tumblr, pack demanded by census 2026-08-31 (×1)"
+    },
+    "turbopuffer": {
+      "disposition": "demanded",
+      "reason": "vendor turbopuffer, pack demanded by census 2026-08-31 (×1)"
+    },
+    "twitch": {
+      "disposition": "demanded",
+      "reason": "vendor twitch, pack demanded by census 2026-08-31 (×1)"
+    },
+    "unitedeffects": {
+      "disposition": "acknowledged",
+      "reason": "acknowledged: United Effects OIDC SaaS, low-confidence identity — singleton, re-rule if demand recurs (census 2026-08-31, ×1)"
+    },
+    "unsplash": {
+      "disposition": "demanded",
+      "reason": "vendor unsplash, pack demanded by census 2026-08-31 (×1)"
+    },
+    "vk": {
+      "disposition": "demanded",
+      "reason": "vendor vk, pack demanded by census 2026-08-31 (×1)"
+    },
+    "wikimedia": {
+      "disposition": "demanded",
+      "reason": "vendor wikimedia, pack demanded by census 2026-08-31 (×1)"
+    },
+    "wordpress": {
+      "disposition": "demanded",
+      "reason": "vendor wordpress, pack demanded by census 2026-08-31 (×1)"
+    },
+    "workos": {
+      "disposition": "demanded",
+      "reason": "vendor workos, pack demanded by census 2026-08-31 (×1)"
+    },
+    "yandex": {
+      "disposition": "demanded",
+      "reason": "vendor yandex, pack demanded by census 2026-08-31 (×1)"
+    },
+    "zapiernla": {
+      "disposition": "demanded",
+      "reason": "vendor zapier, pack demanded by census 2026-08-31 (×1)"
+    },
+    "zitadel": {
+      "disposition": "demanded",
+      "reason": "vendor zitadel, pack demanded by census 2026-08-31 (×1)"
+    },
+    "zoho": {
+      "disposition": "demanded",
+      "reason": "vendor zoho, pack demanded by census 2026-08-31 (×1)"
+    },
+    "zohocrm": {
+      "disposition": "demanded",
+      "reason": "vendor zoho, pack demanded by census 2026-08-31 (×1)"
+    },
+    "zoom": {
+      "disposition": "demanded",
+      "reason": "vendor zoom, pack demanded by census 2026-08-31 (×2)"
+    },
+    "azuread": {
+      "disposition": "demanded",
+      "reason": "vendor azure (Entra auth area — DEFERRED: the azure family pack serves the blob and OpenAI areas and deliberately does not claim login.microsoftonline.com, so this stem must stay a LOUD gap until the Entra area is built; §9 round two H6, 2026-08-31; census ×4 via @azure/msal-node)"
+    },
+    "amplitude": {
+      "disposition": "demanded",
+      "reason": "vendor amplitude (NEXT_PUBLIC_AMPLITUDE_API_KEY), ×1 — ladder classification 2026-09-02"
+    },
+    "brave": {
+      "disposition": "demanded",
+      "reason": "vendor brave-search (Brave Search API), ×1 — ladder classification 2026-09-02"
+    },
+    "getxapi": {
+      "disposition": "demanded",
+      "reason": "vendor getxapi (api.getxapi.com — an X/Twitter search proxy), ×1 — ladder classification 2026-09-02"
+    },
+    "ghostadmin": {
+      "disposition": "demanded",
+      "reason": "vendor ghost (Ghost Admin API key), ×1 — ladder classification 2026-09-02"
+    },
+    "ghostcontent": {
+      "disposition": "demanded",
+      "reason": "vendor ghost (Ghost Content API key), ×1 — ladder classification 2026-09-02"
+    },
+    "publicghostcontent": {
+      "disposition": "demanded",
+      "reason": "vendor ghost (VITE_PUBLIC_GHOST_CONTENT_API_KEY — the browser-side Content API key), ×1 — ladder classification 2026-09-02"
+    },
+    "googlecalendar": {
+      "disposition": "demanded",
+      "reason": "vendor google-calendar (GOOGLE_CALENDAR_API_KEY; the @googleapis/calendar client is the same demand), ×1 — ladder classification 2026-09-02"
+    },
+    "googlecloud": {
+      "disposition": "demanded",
+      "reason": "vendor googlecloud (GOOGLE_CLOUD_API_KEY; the roster's one consumer spends it on the Web Fonts Developer API at www.googleapis.com/webfonts/v1, so the stem is a Google Cloud API key rather than a googleoauth credential), ×1 — ladder classification 2026-09-02"
+    },
+    "googlesearch": {
+      "disposition": "demanded",
+      "reason": "vendor google-cse (GOOGLE_SEARCH_API_KEY — the Programmable Search JSON API), ×1 — ladder classification 2026-09-02"
+    },
+    "groundroute": {
+      "disposition": "demanded",
+      "reason": "vendor groundroute (api.groundroute.ai), ×1 — ladder classification 2026-09-02"
+    },
+    "ncbi": {
+      "disposition": "demanded",
+      "reason": "vendor ncbi (E-utilities / PubMed), ×1 — ladder classification 2026-09-02"
+    },
+    "novita": {
+      "disposition": "demanded",
+      "reason": "vendor novita (Novita AI hosted models), ×2 — ladder classification 2026-09-02"
+    },
+    "openalex": {
+      "disposition": "demanded",
+      "reason": "vendor openalex (scholarly works API), ×1 — ladder classification 2026-09-02"
+    },
+    "pdfservices": {
+      "disposition": "demanded",
+      "reason": "vendor adobe-pdfservices (PDF_SERVICES_CLIENT_ID/_SECRET), ×1 — ladder classification 2026-09-02"
+    },
+    "retellaitestcal": {
+      "disposition": "demanded",
+      "reason": "vendor retell (RETELL_AI_TEST_CAL_API_KEY; same demand as retell-sdk / retell-client-js-sdk), ×1 — ladder classification 2026-09-02"
+    },
+    "reworkdplatformserp": {
+      "disposition": "demanded",
+      "reason": "vendor serpapi (REWORKD_PLATFORM_SERP_API_KEY), ×1 — ladder classification 2026-09-02"
+    },
+    "reworkdplatformsid": {
+      "disposition": "demanded",
+      "reason": "vendor sid (sid.ai OAuth: REWORKD_PLATFORM_SID_CLIENT_ID/_SECRET), ×1 — ladder classification 2026-09-02"
+    },
+    "skyvernauthbitwarden": {
+      "disposition": "demanded",
+      "reason": "vendor bitwarden (SKYVERN_AUTH_BITWARDEN_CLIENT_ID/_SECRET), ×1 — ladder classification 2026-09-02"
+    },
+    "volcengine": {
+      "disposition": "demanded",
+      "reason": "vendor volcengine (ByteDance Volcengine Ark), ×1 — ladder classification 2026-09-02"
+    },
+    "voyage": {
+      "disposition": "demanded",
+      "reason": "vendor voyageai (VOYAGE_API_KEY embeddings), ×1 — ladder classification 2026-09-02"
+    },
+    "xquik": {
+      "disposition": "demanded",
+      "reason": "vendor xquik (xquik.com — an X/Twitter search proxy), ×1 — ladder classification 2026-09-02"
+    },
+    "yutori": {
+      "disposition": "demanded",
+      "reason": "vendor yutori (YUTORI_API_KEY; the repo also declares the `yutori` PyPI SDK), ×1 — ladder classification 2026-09-02"
+    },
+    "stiggclient": {
+      "disposition": "demanded",
+      "reason": "vendor stigg, pack demanded by consumer (ponder) — a real vendor this application calls with no twin yet; needed by ponder"
+    }
+  },
+  "notExternal": {
+    "@agentclientprotocol/sdk": "Agent Client Protocol library, not a vendor",
+    "@ai-sdk/devtools": "local dev-tools UI for the AI SDK",
+    "@ai-sdk/langchain": "LangChain interop adapter, not a service",
+    "@ai-sdk/mcp": "MCP protocol client library, not a vendor surface",
+    "@ai-sdk/otel": "OpenTelemetry glue for the AI SDK",
+    "@ai-sdk/provider": "AI SDK provider/UI helper library, no service surface of its own",
+    "@ai-sdk/provider-utils": "AI SDK provider/UI helper library, no service surface of its own",
+    "@ai-sdk/react": "AI SDK provider/UI helper library, no service surface of its own",
+    "@ai-sdk/rsc": "AI SDK provider/UI helper library, no service surface of its own",
+    "@ai-sdk/svelte": "AI SDK provider/UI helper library, no service surface of its own",
+    "@ai-sdk/ui-utils": "AI SDK provider/UI helper library, no service surface of its own",
+    "@ai-sdk/vue": "AI SDK provider/UI helper library, no service surface of its own",
+    "@aws-sdk/cloudfront-signer": "local URL signing, no API call",
+    "@aws-sdk/node-http-handler": "HTTP transport plumbing for the SDK, not a service",
+    "@aws-sdk/rds-signer": "local IAM auth-token generation, no API call",
+    "@aws-sdk/s3-presigned-post": "local presign computation, no API call",
+    "@aws-sdk/signature-v4-crt": "local SigV4 signing helper, no API call",
+    "@aws-sdk/types": "type-only package, no runtime call",
+    "@azure/abort-controller": "Azure SDK core/auth plumbing, no service surface of its own",
+    "@azure/core-asynciterator-polyfill": "async-iterator polyfill, no service",
+    "@azure/core-auth": "Azure SDK core/auth plumbing, no service surface of its own",
+    "@azure/core-rest-pipeline": "Azure SDK core/auth plumbing, no service surface of its own",
+    "@azure/identity": "Azure SDK core/auth plumbing, no service surface of its own",
+    "@azure/logger": "Azure SDK core/auth plumbing, no service surface of its own",
+    "@directus/extensions-sdk": "extension authoring/build tooling, not a client",
+    "@google-cloud/opentelemetry-resource-util": "OTel resource-attribute helper, no service call",
+    "@google-cloud/precise-date": "timestamp utility library, no service",
+    "@immich/plugin-sdk": "plugin authoring API for a self-hosted app, not a client",
+    "@immich/sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "@karakeep/sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "@langchain/langgraph-sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "@medusajs/admin-sdk": "Medusa framework internals, not an external API",
+    "@medusajs/js-sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "@medusajs/modules-sdk": "Medusa framework internals, not an external API",
+    "@medusajs/workflows-sdk": "Medusa framework internals, not an external API",
+    "@modelcontextprotocol/sdk": "protocol library, no service",
+    "@n8n/ai-node-sdk": "n8n's own monorepo package, not an external service",
+    "@n8n/extension-sdk": "n8n's own monorepo package, not an external service",
+    "@n8n/frontend-module-sdk": "n8n's own monorepo package, not an external service",
+    "@n8n/rest-api-client": "n8n's own monorepo package, not an external service",
+    "@n8n/workflow-sdk": "n8n's own monorepo package, not an external service",
+    "@nocobase/sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "@opentelemetry/instrumentation-aws-sdk": "OpenTelemetry instrumentation wrapper, not a service client",
+    "@payloadcms/sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "@restatedev/restate-sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "@rocket.chat/api-client": "Rocket.Chat monorepo internal package, not an external service",
+    "@rocket.chat/federation-sdk": "Rocket.Chat monorepo internal package, not an external service",
+    "@saintno/comfyui-sdk": "client for a locally-run ComfyUI instance, not a SaaS surface",
+    "@segment/action-destinations": "Segment destination authoring framework, not a client",
+    "@segment/actions-core": "Segment destination authoring framework, not a client",
+    "@teable/sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "@types/facebook-nodejs-business-sdk": "type-only package, no runtime call",
+    "@types/snowflake-sdk": "type-only package, no runtime call",
+    "@vercel/config": "Vercel build/dev tooling, no service call",
+    "@vercel/functions": "Vercel function runtime helpers (geo, waitUntil), no external API",
+    "@vercel/git-hooks": "Vercel build/dev tooling, no service call",
+    "@vercel/ncc": "bundler, no service call",
+    "@vercel/node": "Vercel framework adapter, no service call",
+    "@vercel/og": "local image generation at the edge, no API call",
+    "@vercel/otel": "OpenTelemetry setup helper, no service call",
+    "@vercel/react-router": "Vercel framework adapter, no service call",
+    "@vercel/remix": "Vercel framework adapter, no service call",
+    "@vercel/stega": "Vercel build tooling, no service call",
+    "@vercel/toolbar": "Vercel dev tooling, no service call",
+    "@vercel/webpack-asset-relocator-loader": "Vercel build tooling, no service call",
+    "@webstudio-is/react-sdk": "Webstudio's own monorepo package, not an external service",
+    "@webstudio-is/sdk": "Webstudio's own monorepo package, not an external service",
+    "ai": "AI SDK core library, no vendor of its own",
+    "ap": "generic app-internal env stem, names no vendor",
+    "appcache": "generic app-internal env stem, names no vendor",
+    "assistants": "generic app-internal env stem, names no vendor",
+    "backendoidc": "generic OAuth2/OIDC protocol stem, names no vendor",
+    "betterauth": "local auth library (Better Auth), not a service",
+    "bookerembedoauth": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "cms": "generic app-internal env stem, names no vendor",
+    "cron": "generic app-internal env stem, names no vendor",
+    "ctrl": "generic app-internal env stem, names no vendor",
+    "cubejs": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "duendeids6": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "ee-embed-sdk": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "enterpriseadmin": "generic app-internal env stem, names no vendor",
+    "fortytwo": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "google-auth-library": "auth library, no service surface of its own",
+    "hdauthoidcmyoidc": "generic OAuth2/OIDC protocol stem, names no vendor",
+    "hideuser": "generic app-internal env stem, names no vendor",
+    "hub": "generic app-internal env stem, names no vendor",
+    "ids4": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "karakeep": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "listmonk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "llm": "generic app-internal env stem, names no vendor",
+    "nextprivateoidc": "generic OAuth2/OIDC protocol stem, names no vendor",
+    "nextprivatesigningcscoauth": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "nocodb-sdk": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "oauth2": "generic OAuth2/OIDC protocol stem, names no vendor",
+    "openid": "generic OAuth2/OIDC protocol stem, names no vendor",
+    "organizationlicense": "generic app-internal env stem, names no vendor",
+    "osso": "defunct SAML SaaS (Osso), no live vendor surface",
+    "postgrest": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "postizoauth": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "seedoauth2": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "seedplatformoauth": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "sink": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "ssogitoauth2": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "stt": "generic app-internal env stem, names no vendor",
+    "synology": "self-instance client; targets the app's own self-hosted deployment, which is local in a keyless world",
+    "synth": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "tandem": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "trpcserver": "generic app-internal env stem, names no vendor",
+    "tts": "generic app-internal env stem, names no vendor",
+    "wizardcloudrunoauth": "repo-local stem; env-stem extraction firing on an app-internal name, no vendor exists",
+    "@vercel/edge": "Vercel edge request helpers (geolocation, ipAddress, rewrite), no external API (ladder classification 2026-09-02)",
+    "@vercel/nft": "Node File Trace — build-time dependency tracer, no service call (ladder classification 2026-09-02)",
+    "@grafana/aws-sdk": "Grafana datasource-plugin helper library (credential editors, temporary-credential types), not a service client (ladder classification 2026-09-02)",
+    "@grafana/azure-sdk": "Grafana datasource-plugin helper library (Azure credential editors), not a service client (ladder classification 2026-09-02)",
+    "@openfeature/react-sdk": "vendor-neutral feature-flag spec library; the configured provider, not this SDK, names a service (ladder classification 2026-09-02)",
+    "@openfeature/web-sdk": "vendor-neutral feature-flag spec library; the configured provider, not this SDK, names a service (ladder classification 2026-09-02)",
+    "@posthog/brand": "PostHog's own brand-asset package, not an external service (ladder classification 2026-09-02)",
+    "@posthog/hedgehog-mode": "PostHog's own mascot animation library, no service call (ladder classification 2026-09-02)",
+    "@posthog/icons": "PostHog's own icon library, not an external service (ladder classification 2026-09-02)",
+    "@posthog/lemon-ui": "PostHog's own monorepo UI package, not an external service (ladder classification 2026-09-02)",
+    "@posthog/react-native-plugin": "React Native / Expo build-config plugin for posthog-react-native, no service call (ladder classification 2026-09-02)",
+    "@posthog/rollup-plugin": "bundler plugin, no service call (ladder classification 2026-09-02)",
+    "@posthog/siphash": "SipHash implementation, no service (ladder classification 2026-09-02)",
+    "@sendgrid/eventwebhook": "local ECDSA verification of inbound SendGrid event webhooks, no API call (ladder classification 2026-09-02)",
+    "@stripe/ui-extension-sdk": "Stripe Apps UI-extension authoring API, runs inside the Stripe dashboard; not a client of the Stripe API (ladder classification 2026-09-02)",
+    "@follow-app/client-sdk": "Folo's own first-party client for the app's own backend, not a third-party vendor surface (ladder classification 2026-09-02)",
+    "frappe-react-sdk": "self-instance client; targets the app's own self-hosted Frappe deployment, which is local in a keyless world (ladder classification 2026-09-02)",
+    "calcomadmin": "repo-local stem; CALCOM_ADMIN_API_KEY authenticates against the app's OWN cal.com instance (the credential-sync example calls http://localhost:3002), not api.cal.com (ladder classification 2026-09-02)",
+    "graphrag": "library-named credential; Microsoft GraphRAG runs locally and GRAPHRAG_API_KEY holds the configured model provider's key (the roster consumer's own example says <YOUR_OPENAI_KEY>), which that provider's stem detects (ladder classification 2026-09-02)",
+    "infinity": "self-instance client; Infinity is a locally-run rerank/embedding server and INFINITY_API_BASE is required, so the key names no hosted vendor (ladder classification 2026-09-02)",
+    "langflow": "repo-local stem; the app's own configuration, names no vendor (ladder classification 2026-09-02)",
+    "openaioauth": "repo-local stem; OPENAI_OAUTH_CLIENT_ID is the client id the app's OWN MCP OAuth server accepts from the ChatGPT connector — inbound, no api.openai.com call (ladder classification 2026-09-02)",
+    "skyvern": "repo-local stem; the app's own API key, names no vendor (ladder classification 2026-09-02)",
+    "twentypartners": "repo-local stem; Twenty's own partners-marketplace API (TWENTY_PARTNERS_API_URL is app-configured), no third-party vendor (ladder classification 2026-09-02)",
+    "widget": "generic app-internal env stem, names no vendor (ladder classification 2026-09-02)",
+    "@hubspot/cli": "HubSpot CLI (a dev tool), not a service",
+    "@volter/twin": "our own twin package — the platform, not an external service",
+    "@volter/twin-world": "our own twin package — the platform, not an external service",
+    "@volter/twin-anthropic": "our own twin package — the platform, not an external service",
+    "@volter/twin-assemblyai": "our own twin package — the platform, not an external service",
+    "@volter/twin-deepgram": "our own twin package — the platform, not an external service",
+    "@volter/twin-figma": "our own twin package — the platform, not an external service",
+    "@volter/twin-gcs": "our own twin package — the platform, not an external service",
+    "@volter/twin-gemini": "our own twin package — the platform, not an external service",
+    "@volter/twin-stripe": "our own twin package — the platform, not an external service"
+  },
+  "patterns": [
+    {
+      "pattern": "^@aws-sdk\\/",
+      "reason": "unmapped client from a multi-service cloud scope (AWS)"
+    },
+    {
+      "pattern": "^@azure(-rest)?\\/",
+      "reason": "unmapped client from a multi-service cloud scope (Azure)"
+    },
+    {
+      "pattern": "^@google-cloud\\/",
+      "reason": "unmapped client from a multi-service cloud scope (Google Cloud)"
+    },
+    {
+      "pattern": "^@ai-sdk\\/",
+      "reason": "unmapped AI SDK provider adapter; each names a hosted model vendor"
+    },
+    {
+      "pattern": "(^|[-.])sdk$",
+      "reason": "generic client shape"
+    },
+    {
+      "pattern": "^@[^/]+\\/(sdk|api-client)$",
+      "reason": "generic client shape (scoped sdk/api-client package)"
+    },
+    {
+      "pattern": "-api-client$",
+      "reason": "generic client shape (api-client suffix)"
+    }
+  ]
+}