agenttwin 0.3.0 → 0.3.2

package/dist/cli.js

@@ -48,6 +48,704 @@ var init_git = __esm({
   }
 });
 
+// src/lib/files.ts
+import { readdir as readdir2, readFile as readFile3, stat } from "fs/promises";
+import { join as join3, relative, sep } from "path";
+function shouldIgnoreDir(name) {
+  return IGNORED_DIRS.has(name) || name === ".git";
+}
+async function walkDir(root, maxFiles, budgetMs) {
+  const out = [];
+  const limits = [];
+  const stack = [root];
+  const started = Date.now();
+  while (stack.length > 0 && out.length < maxFiles && Date.now() - started < budgetMs) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await readdir2(dir, { withFileTypes: true });
+    } catch {
+      limits.push(`Directory could not be read: ${relative(root, dir) || "."}`);
+      continue;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const full = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!shouldIgnoreDir(entry.name)) stack.push(full);
+      } else if (entry.isFile()) {
+        out.push(relative(root, full).split(sep).join("/"));
+        if (out.length >= maxFiles) break;
+      }
+    }
+  }
+  if (out.length >= maxFiles) limits.push(`File scan limit reached (${maxFiles} files); additional files may be unscanned`);
+  if (stack.length && Date.now() - started >= budgetMs) limits.push(`File walk time budget reached (${budgetMs}ms); directories remain unscanned`);
+  return { files: out.sort(), limits };
+}
+async function createFileIndex(cwd) {
+  return new RepoFileIndex(cwd);
+}
+var IGNORED_DIRS, MAX_FILES, MAX_BYTES, WALK_BUDGET_MS, RepoFileIndex;
+var init_files = __esm({
+  "src/lib/files.ts"() {
+    "use strict";
+    IGNORED_DIRS = /* @__PURE__ */ new Set([
+      ".git",
+      ".agenttwin",
+      "node_modules",
+      "dist",
+      "build",
+      "out",
+      "coverage",
+      ".next",
+      ".nuxt",
+      ".venv",
+      "venv",
+      "env",
+      "site-packages",
+      "__pycache__",
+      ".pytest_cache",
+      ".mypy_cache",
+      ".ruff_cache",
+      ".tox",
+      "vendor",
+      "target",
+      ".turbo",
+      ".cache",
+      ".idea",
+      ".vscode",
+      ".terraform",
+      "models",
+      "data",
+      "datasets",
+      "media",
+      "uploads",
+      "tmp",
+      "logs",
+      "gen"
+    ]);
+    MAX_FILES = 2e4;
+    MAX_BYTES = 1e6;
+    WALK_BUDGET_MS = 8e3;
+    RepoFileIndex = class {
+      cwd;
+      cache = { contents: /* @__PURE__ */ new Map(), limits: [] };
+      bounds;
+      constructor(cwd, bounds = { maxFiles: MAX_FILES, budgetMs: WALK_BUDGET_MS }) {
+        this.cwd = cwd;
+        this.bounds = bounds;
+      }
+      async walk() {
+        if (!this.cache.files) {
+          const result = await walkDir(this.cwd, this.bounds.maxFiles, this.bounds.budgetMs);
+          this.cache.files = result.files;
+          this.cache.limits.push(...result.limits);
+        }
+        return this.cache.files;
+      }
+      scanLimits() {
+        return [...new Set(this.cache.limits)].sort();
+      }
+      async exists(path) {
+        try {
+          await stat(join3(this.cwd, path));
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      async read(path, maxBytes = MAX_BYTES) {
+        const cached = this.cache.contents.get(path);
+        if (cached !== void 0) return cached;
+        const full = join3(this.cwd, path);
+        try {
+          const info2 = await stat(full);
+          if (!info2.isFile()) return void 0;
+          if (info2.size > maxBytes) {
+            this.cache.limits.push(`File excluded by size limit (${maxBytes} bytes): ${path}`);
+            return void 0;
+          }
+          const text = await readFile3(full, "utf8");
+          this.cache.contents.set(path, text);
+          return text;
+        } catch {
+          return void 0;
+        }
+      }
+      async byExt(...exts) {
+        const wanted = new Set(exts.map((e) => e.replace(/^\./, "").toLowerCase()));
+        const files = await this.walk();
+        return files.filter((f) => {
+          const dot = f.lastIndexOf(".");
+          if (dot < 0) return false;
+          return wanted.has(f.slice(dot + 1).toLowerCase());
+        });
+      }
+      async byName(pattern) {
+        const files = await this.walk();
+        return files.filter((f) => pattern.test(f));
+      }
+      line(ref) {
+        const idx = ref.lastIndexOf(":");
+        if (idx < 0) return void 0;
+        const path = ref.slice(0, idx);
+        const num = Number(ref.slice(idx + 1));
+        if (!Number.isInteger(num)) return void 0;
+        const text = this.cache.contents.get(path);
+        if (text === void 0) return void 0;
+        const lines = text.split(/\r?\n/);
+        return lines[num - 1];
+      }
+    };
+  }
+});
+
+// src/inventory/entrypoints.ts
+function codeOnly(source) {
+  return source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`/g, (part) => part.replace(/[^\n]/g, " "));
+}
+function exportedEntrypoints(source) {
+  const code = codeOnly(source);
+  const pattern = /\bexport\s+(?:default\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)[^{;]*\{|\bexport\s+(?:const|let)\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=;]+)?=>\s*\{/g;
+  const result = [];
+  let match;
+  while (match = pattern.exec(code)) {
+    let depth = 1, end = pattern.lastIndex;
+    while (end < code.length && depth) {
+      if (code[end] === "{") depth++;
+      if (code[end] === "}") depth--;
+      end++;
+    }
+    if (depth) continue;
+    result.push({ name: match[1] || match[2], startLine: code.slice(0, match.index).split("\n").length, endLine: code.slice(0, end).split("\n").length });
+    pattern.lastIndex = end;
+  }
+  return result;
+}
+var init_entrypoints = __esm({
+  "src/inventory/entrypoints.ts"() {
+    "use strict";
+  }
+});
+
+// src/discovery/masking.ts
+function maskSecret(value) {
+  return value.replace(TOKENISH, (match) => `${match.slice(0, 4)}***`);
+}
+function maskEmail(value) {
+  return value.replace(EMAIL, "$1***$2");
+}
+function maskUrl(value) {
+  try {
+    const url = new URL(value);
+    return `${url.protocol}//${url.host}${url.pathname}`;
+  } catch {
+    return maskSecret(value);
+  }
+}
+function redactDetail(value) {
+  return maskSecret(maskEmail(value)).slice(0, 200);
+}
+var EMAIL, TOKENISH;
+var init_masking = __esm({
+  "src/discovery/masking.ts"() {
+    "use strict";
+    EMAIL = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
+    TOKENISH = /\b(sk|rk|pk|ghp|gho|ghs|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
+  }
+});
+
+// src/discovery/probes/providers/stripe.ts
+var stripeProbe;
+var init_stripe = __esm({
+  "src/discovery/probes/providers/stripe.ts"() {
+    "use strict";
+    init_masking();
+    stripeProbe = {
+      id: "stripe.readonly",
+      providerId: "stripe",
+      title: "Enumerate Stripe account configuration (read-only)",
+      description: "Reads products, prices and webhook endpoints. Read-only; issues no writes.",
+      readScope: {
+        endpoints: [
+          "GET /v1/products",
+          "GET /v1/prices",
+          "GET /v1/webhook_endpoints"
+        ],
+        methods: ["GET"]
+      },
+      credentials: [
+        {
+          envVar: "STRIPE_SECRET_KEY",
+          label: "Stripe restricted key (read scopes)",
+          required: true,
+          scopes: ["products:read", "prices:read", "webhook_endpoints:read"],
+          hint: "Prefer a restricted key (rk_...) with read scopes over a full sk_live_ key."
+        }
+      ],
+      async run(ctx) {
+        const spec = this.credentials[0];
+        const key = ctx.credential(spec);
+        if (!key) {
+          return {
+            providerId: this.providerId,
+            ok: false,
+            summary: "no credential present",
+            resources: [],
+            evidence: []
+          };
+        }
+        const get = async (path) => {
+          const response = await ctx.fetch(`https://api.stripe.com${path}`, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${key}` },
+            signal: ctx.signal
+          });
+          if (!response.ok) {
+            throw new Error(`Stripe ${path} -> HTTP ${response.status}`);
+          }
+          return await response.json();
+        };
+        try {
+          const [products, prices, hooks] = await Promise.all([
+            get("/v1/products?limit=100"),
+            get("/v1/prices?limit=100"),
+            get("/v1/webhook_endpoints?limit=100")
+          ]);
+          return {
+            providerId: this.providerId,
+            ok: true,
+            summary: `${products.data.length} products, ${prices.data.length} prices, ${hooks.data.length} webhook endpoints`,
+            resources: [
+              {
+                kind: "products",
+                count: products.data.length,
+                sample: products.data.slice(0, 5).map((p) => ({
+                  id: p.id,
+                  name: p.name,
+                  active: p.active
+                }))
+              },
+              { kind: "prices", count: prices.data.length },
+              {
+                kind: "webhook_endpoints",
+                count: hooks.data.length,
+                sample: hooks.data.slice(0, 5).map((h2) => ({
+                  url: typeof h2.url === "string" ? maskUrl(h2.url) : void 0,
+                  status: h2.status
+                }))
+              }
+            ],
+            evidence: [
+              {
+                ref: "probe:stripe",
+                pass: "probe",
+                signal: "probe",
+                detail: "account reachable via read scopes"
+              }
+            ]
+          };
+        } catch (error) {
+          return {
+            providerId: this.providerId,
+            ok: false,
+            error: { message: error instanceof Error ? error.message : String(error) },
+            summary: "probe failed",
+            resources: [],
+            evidence: []
+          };
+        }
+      }
+    };
+  }
+});
+
+// src/discovery/probes/providers/github.ts
+var githubProbe;
+var init_github = __esm({
+  "src/discovery/probes/providers/github.ts"() {
+    "use strict";
+    githubProbe = {
+      id: "github.readonly",
+      providerId: "github",
+      title: "Enumerate GitHub account (read-only)",
+      description: "Reads the authenticated user and their repositories. Read-only.",
+      readScope: {
+        endpoints: ["GET /user", "GET /user/repos"],
+        methods: ["GET"]
+      },
+      credentials: [
+        {
+          envVar: "GITHUB_TOKEN",
+          label: "GitHub token (read:user, repo:read)",
+          required: true,
+          scopes: ["read:user", "public_repo"],
+          hint: "A fine-grained token with read-only repository access is sufficient."
+        }
+      ],
+      async run(ctx) {
+        const key = ctx.credential(this.credentials[0]);
+        if (!key) {
+          return {
+            providerId: this.providerId,
+            ok: false,
+            summary: "no credential present",
+            resources: [],
+            evidence: []
+          };
+        }
+        const headers = {
+          Authorization: `Bearer ${key}`,
+          Accept: "application/vnd.github+json",
+          "User-Agent": "agenttwin-discovery"
+        };
+        try {
+          const userResponse = await ctx.fetch("https://api.github.com/user", {
+            method: "GET",
+            headers,
+            signal: ctx.signal
+          });
+          if (!userResponse.ok) {
+            throw new Error(`GitHub /user -> HTTP ${userResponse.status}`);
+          }
+          const user = await userResponse.json();
+          const reposResponse = await ctx.fetch(
+            "https://api.github.com/user/repos?per_page=100&sort=updated",
+            { method: "GET", headers, signal: ctx.signal }
+          );
+          const repos = reposResponse.ok ? await reposResponse.json() : [];
+          return {
+            providerId: this.providerId,
+            ok: true,
+            summary: `${repos.length} repositories readable for @${user.login ?? "unknown"}`,
+            resources: [
+              {
+                kind: "repositories",
+                count: repos.length,
+                sample: repos.slice(0, 5).map((r) => ({
+                  name: r.name,
+                  private: r.private,
+                  archived: r.archived
+                }))
+              }
+            ],
+            evidence: [
+              {
+                ref: "probe:github",
+                pass: "probe",
+                signal: "probe",
+                detail: "account reachable via read scopes"
+              }
+            ]
+          };
+        } catch (error) {
+          return {
+            providerId: this.providerId,
+            ok: false,
+            error: { message: error instanceof Error ? error.message : String(error) },
+            summary: "probe failed",
+            resources: [],
+            evidence: []
+          };
+        }
+      }
+    };
+  }
+});
+
+// src/discovery/providers/catalog.ts
+function planned(unknown) {
+  return { supported: [], verified: [], unknown, implemented: false };
+}
+var NO_TWIN, PROVIDERS;
+var init_catalog = __esm({
+  "src/discovery/providers/catalog.ts"() {
+    "use strict";
+    init_stripe();
+    init_github();
+    NO_TWIN = ["all behavior (no twin implemented)"];
+    PROVIDERS = [
+      {
+        id: "stripe",
+        title: "Stripe",
+        category: "payments",
+        twin: planned(["refunds", "payouts", "disputes", "webhook ordering"]),
+        probe: stripeProbe,
+        signatures: {
+          packages: {
+            node: ["stripe"],
+            python: ["stripe"],
+            go: ["stripe-go"],
+            java: ["stripe-java"],
+            ruby: ["stripe"],
+            php: ["stripe/stripe-php"],
+            dotnet: ["Stripe.net"]
+          },
+          imports: ["new Stripe\\(", `from ["']stripe["']`, `require\\(['"]stripe['"]\\)`, "stripe-go"],
+          hosts: ["api.stripe.com"],
+          envPrefixes: ["STRIPE_"],
+          webhookPaths: ["/webhooks/stripe", "/stripe/webhook", "/webhook/stripe"]
+        },
+        docs: "https://stripe.com/docs/api"
+      },
+      {
+        id: "slack",
+        title: "Slack",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@slack/web-api", "@slack/bolt", "@slack/events-api", "@slack/socket-mode"],
+            python: ["slack_sdk", "slack-bolt"],
+            go: ["slack-go"],
+            java: ["slack-java-sdk"],
+            ruby: ["slack-ruby-client"]
+          },
+          imports: ["@slack/web-api", "WebClient\\(", "slack_sdk"],
+          hosts: ["slack.com", "api.slack.com", "hooks.slack.com"],
+          envPrefixes: ["SLACK_"]
+        }
+      },
+      {
+        id: "github",
+        title: "GitHub",
+        category: "vcs",
+        twin: planned(NO_TWIN),
+        probe: githubProbe,
+        signatures: {
+          packages: {
+            node: ["@octokit/rest", "@octokit/core", "@octokit/auth", "octokit"],
+            python: ["PyGithub", "github"],
+            go: ["google/go-github"],
+            java: ["github-api"],
+            ruby: ["octokit"]
+          },
+          imports: ["Octokit", "@octokit/", "PyGithub"],
+          hosts: ["api.github.com"],
+          envPrefixes: ["GITHUB_", "GH_"],
+          webhookPaths: ["/webhooks/github", "/github/webhook"]
+        }
+      },
+      {
+        id: "aws",
+        title: "AWS",
+        category: "cloud",
+        twin: planned(["service coverage (LocalStack passthrough planned)"]),
+        envWeak: true,
+        signatures: {
+          packages: {
+            node: ["@aws-sdk/", "aws-sdk"],
+            python: ["boto3", "botocore"],
+            go: ["aws-sdk-go", "aws-sdk-go-v2"],
+            java: ["software.amazon.awssdk", "aws-java-sdk"],
+            ruby: ["aws-sdk-"],
+            php: ["aws/aws-sdk-php"],
+            dotnet: ["AWSSDK."]
+          },
+          imports: ["@aws-sdk/", "boto3", "aws-sdk-go"],
+          hosts: ["amazonaws.com"],
+          envPrefixes: ["AWS_"]
+        }
+      },
+      {
+        id: "google",
+        title: "Google (Gmail / Calendar / Workspace)",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        envWeak: true,
+        signatures: {
+          packages: {
+            node: ["googleapis", "google-auth-library"],
+            python: ["google-api-python-client", "google-cloud", "google-auth"],
+            go: ["google.golang.org/api"],
+            java: ["google-api-client"],
+            ruby: ["google-apis-"]
+          },
+          imports: ["googleapis", "google-api-python-client", "google.golang.org/api"],
+          hosts: ["googleapis.com", "gmail.googleapis.com", "www.googleapis.com"],
+          envPrefixes: ["GOOGLE_", "GCP_", "GMAIL_"]
+        }
+      },
+      {
+        id: "openai",
+        title: "OpenAI",
+        category: "ai",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["openai"],
+            python: ["openai"],
+            go: ["go-openai"],
+            ruby: ["ruby-openai"]
+          },
+          imports: ["OpenAI\\(", `from ["']openai["']`, "go-openai"],
+          hosts: ["api.openai.com"],
+          envPrefixes: ["OPENAI_"]
+        }
+      },
+      {
+        id: "anthropic",
+        title: "Anthropic",
+        category: "ai",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@anthropic-ai/sdk"],
+            python: ["anthropic"],
+            go: ["anthropic-sdk-go"]
+          },
+          imports: ["@anthropic-ai/sdk", "Anthropic\\("],
+          hosts: ["api.anthropic.com"],
+          envPrefixes: ["ANTHROPIC_"]
+        }
+      },
+      {
+        id: "shopify",
+        title: "Shopify",
+        category: "commerce",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@shopify/", "shopify-api"],
+            python: ["ShopifyAPI"],
+            ruby: ["shopify_api"]
+          },
+          imports: ["@shopify/", "ShopifyAPI"],
+          hosts: ["myshopify.com", "shopify.com"],
+          envPrefixes: ["SHOPIFY_"]
+        }
+      },
+      {
+        id: "twilio",
+        title: "Twilio",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["twilio"],
+            python: ["twilio"],
+            java: ["twilio"],
+            ruby: ["twilio-ruby"],
+            php: ["twilio/sdk"]
+          },
+          imports: ["twilio"],
+          hosts: ["api.twilio.com"],
+          envPrefixes: ["TWILIO_"]
+        }
+      },
+      {
+        id: "sendgrid",
+        title: "SendGrid",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@sendgrid/mail", "@sendgrid/client"],
+            python: ["sendgrid"],
+            ruby: ["sendgrid-ruby"]
+          },
+          imports: ["@sendgrid/", "sendgrid"],
+          hosts: ["api.sendgrid.com"],
+          envPrefixes: ["SENDGRID_"]
+        }
+      },
+      {
+        id: "hubspot",
+        title: "HubSpot",
+        category: "crm",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@hubspot/api-client"],
+            python: ["hubspot-api-client"],
+            ruby: ["hubspot-api-client"]
+          },
+          imports: ["@hubspot/api-client", "hubspot-api-client"],
+          hosts: ["api.hubapi.com"],
+          envPrefixes: ["HUBSPOT_"]
+        }
+      },
+      {
+        id: "salesforce",
+        title: "Salesforce",
+        category: "crm",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["jsforce", "@salesforce/"],
+            python: ["simple-salesforce"],
+            java: ["force-wsc"]
+          },
+          imports: ["jsforce", "simple-salesforce"],
+          hosts: ["salesforce.com", "force.com"],
+          envPrefixes: ["SALESFORCE_", "SF_"]
+        }
+      },
+      {
+        id: "zendesk",
+        title: "Zendesk",
+        category: "support",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["node-zendesk"],
+            python: ["zendesk", "zenpy"],
+            ruby: ["zendesk_api"]
+          },
+          imports: ["node-zendesk", "zenpy"],
+          hosts: ["zendesk.com"],
+          envPrefixes: ["ZENDESK_"]
+        }
+      },
+      {
+        id: "linear",
+        title: "Linear",
+        category: "pm",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: { node: ["@linear/sdk"], python: ["linear"] },
+          imports: ["@linear/sdk"],
+          hosts: ["api.linear.app"],
+          envPrefixes: ["LINEAR_"]
+        }
+      },
+      {
+        id: "notion",
+        title: "Notion",
+        category: "docs",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: { node: ["@notionhq/client"], python: ["notion-client"] },
+          imports: ["@notionhq/client", "notion-client"],
+          hosts: ["api.notion.com"],
+          envPrefixes: ["NOTION_"]
+        }
+      },
+      {
+        id: "resend",
+        title: "Resend",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: { node: ["resend"] },
+          imports: [`from ["']resend["']`],
+          hosts: ["api.resend.com"],
+          envPrefixes: ["RESEND_"]
+        }
+      }
+    ];
+    for (const [id, title, category, node, python, hosts] of [
+      ["composio", "Composio", "integration", ["@composio/core", "@composio/client"], ["composio", "composio-core"], ["backend.composio.dev"]],
+      ["kernel", "Kernel", "browser", ["@onkernel/sdk"], ["kernel"], ["api.onkernel.com"]],
+      ["e2b", "E2B", "runtime", ["e2b", "@e2b/code-interpreter"], ["e2b", "e2b-code-interpreter"], ["api.e2b.dev"]],
+      ["mem0", "Mem0", "ai", ["mem0ai"], ["mem0ai"], ["api.mem0.ai"]],
+      ["ollama", "Ollama", "ai", ["ollama"], ["ollama"], []],
+      ["onepassword", "1Password", "security", ["@1password/sdk"], ["onepassword-sdk"], []]
+    ]) PROVIDERS.push({ id, title, category, twin: planned(NO_TWIN), signatures: { packages: { node: [...node], python: [...python] }, imports: [...node, ...python], hosts: [...hosts] } });
+  }
+});
+
 // src/inventory/dashboard-transfer.ts
 function discoveryTransfer(value) {
   const input = value;
@@ -91,37 +789,98 @@ var init_dashboard_transfer = __esm({
   }
 });
 
+// src/inventory/project-products.ts
+async function projectProducts(cwd, data, base) {
+  const current = new Set(base.tools.map((t) => t.id));
+  const known = new Set(PROVIDERS.map((p) => p.title));
+  const tools = data.tools.filter((t) => current.has(t.id) || !known.has(t.title) && t.category !== "access" && t.category !== "tooling");
+  const ids = new Set(tools.map((t) => t.id));
+  const workflows = data.workflows.map((w) => ({ ...w, tools: w.tools.filter((id) => ids.has(id)), steps: w.steps.filter((s) => ids.has(s.tool)) }));
+  const google = tools.find((t) => /Google \(Gmail/.test(t.title));
+  if (!google) return discoveryTransfer({ ...data, tools, workflows });
+  const products = [
+    { key: "gmail", title: "Gmail", pattern: /(?:gmail\.googleapis\.com|\/gmail\/v\d|\bgoogle\.gmail\s*\()/i },
+    { key: "calendar", title: "Google Calendar", pattern: /(?:\/calendar\/v\d|\bgoogle\.calendar\s*\()/i },
+    { key: "drive", title: "Google Drive", pattern: /(?:\/drive\/v\d|\bgoogle\.drive\s*\()/i },
+    { key: "docs", title: "Google Docs", pattern: /(?:docs\.googleapis\.com|\/documents\/|\bgoogle\.docs\s*\()/i },
+    { key: "sheets", title: "Google Sheets", pattern: /(?:sheets\.googleapis\.com|\/spreadsheets\/|\bgoogle\.sheets\s*\()/i }
+  ];
+  const files = await createFileIndex(cwd);
+  const paths = (await files.walk()).filter((p) => /\.(?:ts|tsx|js|mjs|py)$/.test(p) && !/(?:^|\/)(?:artifacts|tests?|testbed|docs?|fixtures?|examples?|public|assets)(?:\/|$)|\.(?:test|spec)\.|fixtures?\./i.test(p)).slice(0, 2500);
+  const found = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    const source = await files.read(path, 2e5);
+    if (!source) continue;
+    for (const p of products) if (p.pattern.test(source)) found.add(p.key);
+  }
+  const mapped = workflows.map((w) => {
+    if (!w.tools.includes(google.id)) return w;
+    const [path, fn] = (w.entrypoint ?? "").split("#");
+    return { w, path, fn };
+  });
+  const finalWorkflows = [];
+  let unresolved = false;
+  for (const value of mapped) {
+    if (!("w" in value)) {
+      finalWorkflows.push(value);
+      continue;
+    }
+    const { w, path, fn } = value;
+    const source = path ? await files.read(path, 2e5) : void 0;
+    const entry = source && fn ? exportedEntrypoints(source).find((e) => e.name === fn) : void 0;
+    const body = source && entry ? source.split("\n").slice(entry.startLine - 1, entry.endLine).join("\n") : source ?? "";
+    const matches = products.filter((p) => found.has(p.key) && p.pattern.test(body)).map((p) => google.id + ":" + p.key);
+    if (!matches.length) {
+      unresolved = true;
+      finalWorkflows.push(w);
+      continue;
+    }
+    finalWorkflows.push({ ...w, tools: [...new Set(w.tools.flatMap((id) => id === google.id ? matches : [id]))], steps: w.steps.flatMap((s) => s.tool === google.id ? matches.map((tool) => ({ ...s, tool })) : [s]) });
+  }
+  const productTools = products.filter((p) => found.has(p.key)).map((p) => ({ ...google, id: google.id + ":" + p.key, title: p.title }));
+  return discoveryTransfer({ ...data, tools: [...tools.filter((t) => t.id !== google.id || unresolved || !productTools.length).map((t) => t.id === google.id ? { ...t, title: "Google API (unspecified)" } : t), ...productTools], workflows: finalWorkflows });
+}
+var init_project_products = __esm({
+  "src/inventory/project-products.ts"() {
+    "use strict";
+    init_files();
+    init_entrypoints();
+    init_catalog();
+    init_dashboard_transfer();
+  }
+});
+
 // src/inspect/sanitize.ts
 function stripUrlCredentials(value) {
   return value.replace(URL_CREDENTIALS, "$1");
 }
 function sanitizeOutput(value) {
-  return stripUrlCredentials(value).replace(TOKENISH, (m) => `${m.slice(0, 4)}***`).replace(EMAIL, "$1***$2");
+  return stripUrlCredentials(value).replace(TOKENISH2, (m) => `${m.slice(0, 4)}***`).replace(EMAIL2, "$1***$2");
 }
 function excerpt(value, max = 200) {
   const clean = sanitizeOutput(value).replace(/\s+/g, " ").trim();
   return clean.length > max ? `${clean.slice(0, max)}\u2026` : clean;
 }
-var URL_CREDENTIALS, TOKENISH, EMAIL;
+var URL_CREDENTIALS, TOKENISH2, EMAIL2;
 var init_sanitize = __esm({
   "src/inspect/sanitize.ts"() {
     "use strict";
     URL_CREDENTIALS = /(https?:\/\/)([^/@\s:]+)(:[^/@\s]+)?@/gi;
-    TOKENISH = /\b(sk|rk|pk|ghp|gho|ghs|glpat|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
-    EMAIL = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
+    TOKENISH2 = /\b(sk|rk|pk|ghp|gho|ghs|glpat|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
+    EMAIL2 = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
   }
 });
 
 // src/commands/dashboard.ts
-import { cp, mkdir, readFile as readFile3, writeFile } from "fs/promises";
-import { basename, join as join3 } from "path";
+import { cp, mkdir, readFile as readFile4, writeFile } from "fs/promises";
+import { basename, join as join4 } from "path";
 import { fileURLToPath } from "url";
 function dashboardInventory(cwd, inventory) {
   return JSON.parse(sanitizeOutput(JSON.stringify({
     schema: "company-inventory/v1",
     generatedAt: inventory.generatedAt,
     name: basename(cwd),
-    tools: inventory.tools.map((t) => ({
+    tools: inventory.tools.filter((t) => !t.facts?.length || !t.facts.every((f) => f.evidence.every((e) => /^(?:credential:|command:)/.test(e.ref)))).map((t) => ({
       id: t.id,
       title: t.title,
       kind: t.kind,
@@ -133,26 +892,26 @@ function dashboardInventory(cwd, inventory) {
   })));
 }
 async function writeDashboard(cwd, inventory) {
-  const directory = join3(cwd, ".agenttwin", "dashboard");
+  const directory = join4(cwd, ".agenttwin", "dashboard");
   let bundle = fileURLToPath(new URL("./dashboard/", import.meta.url));
   try {
-    await readFile3(join3(bundle, "index.html"));
+    await readFile4(join4(bundle, "index.html"));
   } catch {
     bundle = fileURLToPath(new URL("../../../../site/", import.meta.url));
   }
-  await mkdir(join3(directory, "assets", "dashboard"), { recursive: true });
-  const html = await readFile3(join3(bundle, bundle.endsWith("/site/") ? "dashboard.html" : "index.html"), "utf8");
+  await mkdir(join4(directory, "assets", "dashboard"), { recursive: true });
+  const html = await readFile4(join4(bundle, bundle.endsWith("/site/") ? "dashboard.html" : "index.html"), "utf8");
   for (const folder of ["dashboard", "icons", "logo", "fonts", "vendor"]) {
-    await cp(join3(bundle, "assets", folder), join3(directory, "assets", folder), { recursive: true });
+    await cp(join4(bundle, "assets", folder), join4(directory, "assets", folder), { recursive: true });
   }
-  await cp(join3(bundle, "assets", "brand.css"), join3(directory, "assets", "brand.css"));
+  await cp(join4(bundle, "assets", "brand.css"), join4(directory, "assets", "brand.css"));
   const data = await loadDashboardDiscovery(cwd, inventory);
   const payload = JSON.stringify(data).replace(/</g, "\\u003c");
   const page2 = html.replaceAll('type="module"', "defer").replace('<script src="assets/dashboard/dashboard.js', `<script id="agenttwin-discovery" type="application/json">${payload}</script><script src="assets/dashboard/dashboard.js`).replace(/href="index.html"/g, 'href="../report.html"').replace(/href="docs\/"/g, 'href="../report.html"').replace("Docs \u2197", "Discovery report \u2197").replace("Runtime documentation \u2197", "Coverage report \u2197").replace("Back to website \u2197", "Discovery report \u2197");
-  await writeFile(join3(directory, "index.html"), page2, "utf8");
-  await writeFile(join3(directory, "assets", "dashboard", "inventory.json"), JSON.stringify(data), "utf8");
-  await writeFile(join3(directory, "assets", "dashboard", "runs.json"), '{"runs":[]}', "utf8");
-  return join3(directory, "index.html");
+  await writeFile(join4(directory, "index.html"), page2, "utf8");
+  await writeFile(join4(directory, "assets", "dashboard", "inventory.json"), JSON.stringify(data), "utf8");
+  await writeFile(join4(directory, "assets", "dashboard", "runs.json"), '{"runs":[]}', "utf8");
+  return join4(directory, "index.html");
 }
 var init_dashboard = __esm({
   "src/commands/dashboard.ts"() {
@@ -172,8 +931,8 @@ __export(session_exports, {
   writeSessionTask: () => writeSessionTask
 });
 import { spawn, spawnSync } from "child_process";
-import { writeFile as writeFile2, readFile as readFile4 } from "fs/promises";
-import { join as join4 } from "path";
+import { writeFile as writeFile2, readFile as readFile5 } from "fs/promises";
+import { join as join5 } from "path";
 function sessionTask() {
   return `# Prepare this repository for AgentTwin
 
@@ -198,7 +957,7 @@ function installedOpenCode() {
   return spawnSync("opencode", ["--version"], { stdio: "ignore", timeout: 5e3 }).status === 0;
 }
 async function writeSessionTask(cwd) {
-  const path = join4(cwd, ".agenttwin/AGENT-TASK.md");
+  const path = join5(cwd, ".agenttwin/AGENT-TASK.md");
   await writeFile2(path, sessionTask(), "utf8");
   return path;
 }
@@ -215,9 +974,9 @@ async function loadDashboardDiscovery(cwd, inventory) {
   const base = discoveryTransfer(dashboardInventory(cwd, inventory));
   let raw;
   try {
-    raw = await readFile4(join4(cwd, ".agenttwin/agent-discovery.json"), "utf8");
+    raw = await readFile5(join5(cwd, ".agenttwin/agent-discovery.json"), "utf8");
   } catch (error) {
-    if (error.code === "ENOENT") return base;
+    if (error.code === "ENOENT") return projectProducts(cwd, base, base);
     throw error;
   }
   if (Buffer.byteLength(raw) > 2 * 1024 * 1024) throw new Error("Agent discovery exceeds 2 MiB");
@@ -229,11 +988,12 @@ async function loadDashboardDiscovery(cwd, inventory) {
   const result = discoveryTransfer({ ...base, tools: [...tools.values()], workflows: [...workflows.values()] });
   const ids = new Set(result.tools.map((t) => t.id));
   if (result.workflows.some((w) => w.tools.some((id) => !ids.has(id)) || w.steps.some((s) => !ids.has(s.tool)))) throw new Error("Agent discovery references unknown tools. Correct .agenttwin/agent-discovery.json before syncing.");
-  return result;
+  return projectProducts(cwd, result, base);
 }
 var init_session = __esm({
   "src/commands/session.ts"() {
     "use strict";
+    init_project_products();
     init_dashboard_transfer();
     init_dashboard();
   }
@@ -289,8 +1049,8 @@ import { parseArgs } from "util";
 
 // src/commands/sync.ts
 init_git();
-import { readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
-import { join as join5 } from "path";
+import { readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
+import { join as join6 } from "path";
 
 // src/runtime/receipt-sync.ts
 init_git();
@@ -438,11 +1198,11 @@ async function runSync(cwd) {
   const token = process.env.AGENTTWIN_TOKEN;
   if (!token || !/^at_user_[a-f0-9]{64}$/.test(token)) throw new Error("Set AGENTTWIN_TOKEN to your individual account token.");
   const base = apiBase(process.env.AGENTTWIN_API_URL || "https://agenttwin-api.212.56.40.125.sslip.io");
-  const inventory = JSON.parse(await readFile5(join5(cwd, ".agenttwin/inventory.json"), "utf8"));
+  const inventory = JSON.parse(await readFile6(join6(cwd, ".agenttwin/inventory.json"), "utf8"));
   const payload = await loadDashboardDiscovery(cwd, inventory);
   let previousHead;
   try {
-    previousHead = JSON.parse(await readFile5(join5(cwd, ".agenttwin/git.json"), "utf8")).head;
+    previousHead = JSON.parse(await readFile6(join6(cwd, ".agenttwin/git.json"), "utf8")).head;
   } catch {
   }
   const git = await captureGit(cwd, previousHead);
@@ -450,22 +1210,22 @@ async function runSync(cwd) {
   const response = await fetch(base + "/v1/discovery", { method: "POST", headers: { authorization: "Bearer " + token, "content-type": "application/json" }, body: JSON.stringify(payload), redirect: "error", signal: AbortSignal.timeout(2e4) });
   const result = await response.json();
   if (!response.ok) throw new Error(result.error || "Discovery sync failed: " + response.status);
-  if (git) await writeFile3(join5(cwd, ".agenttwin/git.json"), JSON.stringify(git) + "\n", { mode: 384 });
+  if (git) await writeFile3(join6(cwd, ".agenttwin/git.json"), JSON.stringify(git) + "\n", { mode: 384 });
   const receipts = await syncReceipts(cwd, base, token);
   return { receipts, synced: true, tools: payload.tools.length, workflows: payload.workflows.length, dashboard: "https://agenttwin.si/site/dashboard.html", uploaded: "discovery, Git metadata and run evidence; no application source or credentials" };
 }
 
 // src/commands/prepare.ts
 init_git();
-import { mkdir as mkdir3, mkdtemp as mkdtemp2, readFile as readFile8, writeFile as writeFile5, rm as rm2 } from "fs/promises";
-import { join as join8, resolve as resolve2, dirname as dirname2 } from "path";
+import { mkdir as mkdir3, mkdtemp as mkdtemp2, readFile as readFile9, writeFile as writeFile5, rm as rm2 } from "fs/promises";
+import { join as join9, resolve as resolve2, dirname as dirname2 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 
 // src/commands/run.ts
-import { mkdtemp, mkdir as mkdir2, readFile as readFile7, writeFile as writeFile4, realpath, lstat, rm, copyFile } from "fs/promises";
+import { mkdtemp, mkdir as mkdir2, readFile as readFile8, writeFile as writeFile4, realpath, lstat, rm, copyFile } from "fs/promises";
 import { tmpdir } from "os";
-import { basename as basename2, dirname, isAbsolute, join as join7, relative, resolve, sep } from "path";
+import { basename as basename2, dirname, isAbsolute, join as join8, relative as relative2, resolve, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createHash, randomUUID } from "crypto";
 
@@ -718,17 +1478,17 @@ init_git();
 
 // src/runtime/e2b.ts
 import { Sandbox } from "e2b";
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import { randomBytes as randomBytes2 } from "crypto";
 import { homedir } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 async function executeE2B(stage, spec, log, signal) {
   signal?.throwIfAborted();
   const apiKey = process.env.E2B_API_KEY;
   if (!apiKey) throw new CliError("E2B_API_KEY is not configured", { code: EXIT.BLOCKED, action: "Set E2B_API_KEY in your shell. It remains on the host and is never passed to the application." });
   let saved = {};
   try {
-    saved = JSON.parse(await readFile6(join6(homedir(), ".agenttwin/runtime.json"), "utf8"));
+    saved = JSON.parse(await readFile7(join7(homedir(), ".agenttwin/runtime.json"), "utf8"));
   } catch {
   }
   const template = process.env.E2B_TEMPLATE_ID ?? saved.templateId;
@@ -747,7 +1507,7 @@ async function executeE2B(stage, spec, log, signal) {
     signal?.throwIfAborted();
     await sandbox.commands.run("mkdir -p /input/app && chmod 755 /input /input/app", { user: "root" });
     for (const file of ["world.json", "worker.js", ...spec.files.map((f) => `app/${f}`)]) {
-      await sandbox.files.write(`/input/${file}`, new Uint8Array(await readFile6(join6(stage, file))).buffer, { user: "root" });
+      await sandbox.files.write(`/input/${file}`, new Uint8Array(await readFile7(join7(stage, file))).buffer, { user: "root" });
     }
     await sandbox.commands.run("chmod -R a+rX /input", { user: "root" });
     const runtimeEnv = {};
@@ -868,12 +1628,12 @@ async function stageApplication(root, files, destination) {
   for (const file of files) {
     if (isAbsolute(file) || file.includes("\\") || file.split("/").some((p) => p === ".." || /^(\.env.*|\.git|\.ssh|\.aws|\.azure|\.config|\.npmrc|\.netrc|credentials.*)$/i.test(p)) || /\.(pem|key|p12|pfx)$/i.test(file)) throw new CliError(`Unsafe application file: ${file}`, { code: EXIT.USAGE });
     const source = await realpath(resolve(canonicalRoot, file));
-    const rel = relative(canonicalRoot, source);
-    if (rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel) || source !== resolve(canonicalRoot, file) || !(await lstat(source)).isFile()) throw new CliError(`Files must be regular files within the project, without symlinks: ${file}`, { code: EXIT.USAGE });
-    const contents = await readFile7(source);
+    const rel = relative2(canonicalRoot, source);
+    if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute(rel) || source !== resolve(canonicalRoot, file) || !(await lstat(source)).isFile()) throw new CliError(`Files must be regular files within the project, without symlinks: ${file}`, { code: EXIT.USAGE });
+    const contents = await readFile8(source);
     bytes += contents.length;
     if (bytes > 20 * 1024 * 1024) throw new CliError("Application files exceed 20 MiB; supply a smaller built bundle", { code: EXIT.USAGE });
-    const target = join7(destination, file);
+    const target = join8(destination, file);
     await mkdir2(dirname(target), { recursive: true });
     await writeFile4(target, contents, { mode: 420 });
     digests[file] = createHash("sha256").update(contents).digest("hex");
@@ -884,14 +1644,14 @@ async function runWorld(cwd, opts) {
   const file = resolve(cwd, opts.file ?? "agenttwin.world.json");
   let spec;
   try {
-    spec = parseWorld(JSON.parse(await readFile7(file, "utf8")));
+    spec = parseWorld(JSON.parse(await readFile8(file, "utf8")));
   } catch (error) {
     throw new CliError(String(error), { code: EXIT.USAGE, action: "Create agenttwin.world.json; run agenttwin example --out ./agenttwin-example for a working example." });
   }
   if (spec.workflowId) {
     let inventory;
     try {
-      inventory = JSON.parse(await readFile7(join7(cwd, ".agenttwin/inventory.json"), "utf8"));
+      inventory = JSON.parse(await readFile8(join8(cwd, ".agenttwin/inventory.json"), "utf8"));
     } catch {
       throw new CliError("Linked workflow needs discovery inventory; run init first", { code: EXIT.BLOCKED });
     }
@@ -904,24 +1664,24 @@ async function runWorld(cwd, opts) {
   const runtime = opts.runtime ?? "local";
   if (!["local", "e2b", "hosted"].includes(runtime)) throw new CliError("runtime must be local, hosted or e2b", { code: EXIT.USAGE });
   if (runtime === "e2b" && !process.env.E2B_API_KEY) throw new CliError("E2B_API_KEY is not configured", { code: EXIT.BLOCKED, action: "Configure your E2B key in the shell; it will not be uploaded." });
-  const stage = await mkdtemp(join7(tmpdir(), "agenttwin-world-"));
+  const stage = await mkdtemp(join8(tmpdir(), "agenttwin-world-"));
   try {
-    const sourceDigests = await stageApplication(dirname(file), spec.files, join7(stage, "app"));
-    await writeFile4(join7(stage, "world.json"), JSON.stringify(spec), { mode: 420 });
+    const sourceDigests = await stageApplication(dirname(file), spec.files, join8(stage, "app"));
+    await writeFile4(join8(stage, "world.json"), JSON.stringify(spec), { mode: 420 });
     const git = await captureGit(cwd);
     let project;
     try {
-      project = JSON.parse(await readFile7(join7(cwd, ".agenttwin/inventory.json"), "utf8")).name ?? basename2(cwd);
+      project = JSON.parse(await readFile8(join8(cwd, ".agenttwin/inventory.json"), "utf8")).name ?? basename2(cwd);
     } catch {
     }
     if (runtime === "local") {
       opts.log("Testing through the CLI with in-process service twins. No cloud VM or containers.");
-      const report2 = await executeLocal(join7(stage, "app"), spec, opts.signal);
+      const report2 = await executeLocal(join8(stage, "app"), spec, opts.signal);
       const runId2 = randomUUID();
       const receipt2 = { ...report2, runId: runId2, runtime, project, git, createdAt: (/* @__PURE__ */ new Date()).toISOString(), sourceDigests, specDigest: createHash("sha256").update(JSON.stringify(spec)).digest("hex"), provenance: "CLI-reported execution" };
       const out2 = resolve(cwd, opts.out ?? `.agenttwin/runs/${runId2}`);
       await mkdir2(out2, { recursive: true });
-      const evidencePath = join7(out2, "run.json"), reportPath = join7(out2, "report.md");
+      const evidencePath = join8(out2, "run.json"), reportPath = join8(out2, "report.md");
       await writeFile4(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
       await writeFile4(reportPath, `# ${spec.name}: ${receipt2.status}
 
@@ -931,8 +1691,8 @@ Git: ${git?.head ?? "unavailable"}
 ` + receipt2.assertions.map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}${a.path}: expected ${a.count}, observed ${a.actual}`).join("\n") + "\n\nSee run.json for activities, fault and initial/final state.\n");
       return { ...receipt2, reportPath, evidencePath };
     }
-    const worker = join7(dirname(fileURLToPath2(import.meta.url)), "worker.js");
-    await copyFile(worker, join7(stage, "worker.js"));
+    const worker = join8(dirname(fileURLToPath2(import.meta.url)), "worker.js");
+    await copyFile(worker, join8(stage, "worker.js"));
     if (runtime === "hosted") {
       const receipt2 = await executeRemote(stage, spec, opts.log, { git, project });
       if (receipt2.schema !== "agenttwin/run-v1" || typeof receipt2.runId !== "string" || !/^[a-f0-9-]{36}$/.test(receipt2.runId) || !["passed", "failed", "error", "incomplete"].includes(String(receipt2.status))) throw new CliError("Invalid hosted receipt");
@@ -941,8 +1701,8 @@ Git: ${git?.head ?? "unavailable"}
       if (receipt2.specDigest !== expectedSpec || !reportedSources || Object.keys(reportedSources).length !== Object.keys(sourceDigests).length || Object.entries(sourceDigests).some(([path, digest]) => reportedSources[path] !== digest)) throw new CliError("Hosted receipt does not match the submitted source/specification");
       const out2 = resolve(cwd, opts.out ?? `.agenttwin/runs/${receipt2.runId}`);
       await mkdir2(out2, { recursive: true });
-      const evidencePath = join7(out2, "run.json");
-      const reportPath = join7(out2, "report.md");
+      const evidencePath = join8(out2, "run.json");
+      const reportPath = join8(out2, "report.md");
       await writeFile4(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
       await writeFile4(reportPath, `# ${spec.name}: ${receipt2.status}
 
@@ -979,11 +1739,11 @@ See run.json for assertions, service state, application output and isolation met
     };
     const out = resolve(cwd, opts.out ?? `.agenttwin/runs/${runId}`);
     await mkdir2(out, { recursive: true });
-    await writeFile4(join7(out, "run.json"), JSON.stringify(receipt, null, 2) + "\n", { mode: 384 });
-    await writeFile4(join7(out, "world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
+    await writeFile4(join8(out, "run.json"), JSON.stringify(receipt, null, 2) + "\n", { mode: 384 });
+    await writeFile4(join8(out, "world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
     const summary = [`# ${spec.name}: ${report.status}`, "", `Run: ${runId}`, `Image: ${image}`, "", "## Assertions", "", ...report.assertions.map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}${a.path}: expected ${a.count}, observed ${a.actual}`), "", "## Infrastructure assertions", "", ...(report.infrastructureAssertions ?? []).map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}: ${JSON.stringify(a.actual)}`), "", "## Coverage", "", report.coverage, "", "External networking disabled. Only explicitly listed source files were uploaded. New state and tokens are created for each run.", "", "See run.json for application output, faults, events, and initial/final state.", ""].join("\n");
-    await writeFile4(join7(out, "report.md"), summary);
-    return { ...receipt, reportPath: join7(out, "report.md"), evidencePath: join7(out, "run.json") };
+    await writeFile4(join8(out, "report.md"), summary);
+    return { ...receipt, reportPath: join8(out, "report.md"), evidencePath: join8(out, "run.json") };
   } finally {
     await rm(stage, { recursive: true, force: true });
   }
@@ -1037,36 +1797,36 @@ function reviewPreparation(inventory, input) {
 async function runPrepare(cwd, opts) {
   if (!opts.file) throw new CliError("prepare requires --file preparation.json", { code: EXIT.USAGE });
   const file = resolve2(cwd, opts.file);
-  const inventory = JSON.parse(await readFile8(join8(cwd, ".agenttwin/inventory.json"), "utf8"));
+  const inventory = JSON.parse(await readFile9(join9(cwd, ".agenttwin/inventory.json"), "utf8"));
   const discovered = await loadDashboardDiscovery(cwd, inventory);
   const known = new Set(inventory.workflows.map((w) => w.id));
   for (const w of discovered.workflows) if (!known.has(w.id)) {
     inventory.workflows.push({ ...w, confidence: "low", apps: [], sharedEntities: [], evidence: [{ source: "agent-analysis", ref: ".agenttwin/agent-discovery.json" }], steps: w.steps.map((s) => ({ ...s, app: "", evidence: [] })), risk: "high", rank: 0, supported: false, hypothesis: true, linkingSignals: ["Coding-agent analysis requires user review"], scopeUncertain: true, verified: false });
   }
   for (const t of discovered.tools) if (!inventory.tools.some((tool) => tool.id === t.id)) throw new Error("Agent-discovered dependencies must be classified in init before preparation. Review the additional tool, then rerun init.");
-  const { spec, workflow, mappings } = reviewPreparation(inventory, JSON.parse(await readFile8(file, "utf8")));
+  const { spec, workflow, mappings } = reviewPreparation(inventory, JSON.parse(await readFile9(file, "utf8")));
   const directory = resolve2(cwd, opts.out ?? `.agenttwin/prepared/${spec.name}-${randomUUID2().slice(0, 8)}`);
-  const stage = await mkdtemp2(join8(tmpdir2(), "agenttwin-prepare-"));
+  const stage = await mkdtemp2(join9(tmpdir2(), "agenttwin-prepare-"));
   try {
     const sourceDigests = await stageApplication(dirname2(file), spec.files, stage);
     const files = /* @__PURE__ */ Object.create(null);
-    for (const name of spec.files) files[name] = (await readFile8(join8(stage, name))).toString("base64");
+    for (const name of spec.files) files[name] = (await readFile9(join9(stage, name))).toString("base64");
     const manifest = { project: discovered.name, git: await captureGit(cwd), schema: "agenttwin/prepared-v1", workflowId: workflow.id, invocation: spec.command, sourceDigests, specDigest: createHash2("sha256").update(JSON.stringify(spec)).digest("hex"), mappings, provenance: "user-reviewed invocation and operation contracts; discovery does not verify runtime fidelity", createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    await writeFile5(join8(stage, "agenttwin.world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
-    await writeFile5(join8(stage, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
-    await writeFile5(join8(stage, "agenttwin.bundle.json"), JSON.stringify({ schema: "agenttwin/upload-v1", spec, files, manifest }, null, 2) + "\n", { mode: 384 });
-    await mkdir3(join8(stage, ".agenttwin"), { recursive: true });
-    await writeFile5(join8(stage, ".agenttwin/inventory.json"), JSON.stringify({ name: discovered.name, workflows: [{ id: workflow.id }] }), { mode: 384 });
+    await writeFile5(join9(stage, "agenttwin.world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
+    await writeFile5(join9(stage, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
+    await writeFile5(join9(stage, "agenttwin.bundle.json"), JSON.stringify({ schema: "agenttwin/upload-v1", spec, files, manifest }, null, 2) + "\n", { mode: 384 });
+    await mkdir3(join9(stage, ".agenttwin"), { recursive: true });
+    await writeFile5(join9(stage, ".agenttwin/inventory.json"), JSON.stringify({ name: discovered.name, workflows: [{ id: workflow.id }] }), { mode: 384 });
     await mkdir3(dirname2(directory), { recursive: true });
     await mkdir3(directory, { mode: 448 });
     try {
       const { cp: cp2, readdir: readdir3 } = await import("fs/promises");
-      for (const entry of await readdir3(stage)) await cp2(join8(stage, entry), join8(directory, entry), { recursive: true, force: false, errorOnExist: true });
+      for (const entry of await readdir3(stage)) await cp2(join9(stage, entry), join9(directory, entry), { recursive: true, force: false, errorOnExist: true });
     } catch (error) {
       await rm2(directory, { recursive: true, force: true });
       throw error;
     }
-    return { directory, worldPath: join8(directory, "agenttwin.world.json"), bundlePath: join8(directory, "agenttwin.bundle.json"), manifest };
+    return { directory, worldPath: join9(directory, "agenttwin.world.json"), bundlePath: join9(directory, "agenttwin.bundle.json"), manifest };
   } finally {
     await rm2(stage, { recursive: true, force: true });
   }
@@ -1076,7 +1836,7 @@ async function runPrepare(cwd, opts) {
 import { Template } from "e2b";
 import { mkdir as mkdir4, writeFile as writeFile6 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 async function runSetup(log) {
   if (!process.env.E2B_API_KEY) throw new CliError("Set E2B_API_KEY before creating your hosted runtime template", { code: EXIT.BLOCKED });
   log("Building the AgentTwin template on E2B (Node 22, PostgreSQL 15, Redis). No local containers are used.");
@@ -1084,16 +1844,16 @@ async function runSetup(log) {
   const result = await Template.build(template, "agenttwin-node-v2", { apiKey: process.env.E2B_API_KEY, cpuCount: 2, memoryMB: 2048, onBuildLogs: (entry) => {
     if (!entry.message.includes("[stdout]") && !entry.message.includes("[stderr]")) log(entry.message);
   } });
-  const directory = join9(homedir2(), ".agenttwin");
+  const directory = join10(homedir2(), ".agenttwin");
   await mkdir4(directory, { recursive: true, mode: 448 });
-  const path = join9(directory, "runtime.json");
+  const path = join10(directory, "runtime.json");
   await writeFile6(path, JSON.stringify({ provider: "e2b", templateId: result.templateId, buildId: result.buildId }, null, 2) + "\n", { mode: 384 });
   return { provider: "e2b", templateId: result.templateId, buildId: result.buildId, configPath: path };
 }
 
 // src/commands/example.ts
-import { mkdir as mkdir5, writeFile as writeFile7, stat } from "fs/promises";
-import { resolve as resolve3, join as join10 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile7, stat as stat2 } from "fs/promises";
+import { resolve as resolve3, join as join11 } from "path";
 var exampleSource = `// Replace this file with your own bundled Node workflow.
 const safe = process.argv.includes('--safe');
 const crm = process.env.AGENTTWIN_CRM_URL;
@@ -1136,18 +1896,18 @@ function exampleWorld(safe = false) {
 }
 async function runExample(cwd, out) {
   const directory = resolve3(cwd, out ?? "agenttwin-example");
-  if (await stat(directory).then(() => true, () => false)) throw new CliError(`Destination exists: ${directory}`, { code: EXIT.USAGE, action: "Choose a new --out directory." });
+  if (await stat2(directory).then(() => true, () => false)) throw new CliError(`Destination exists: ${directory}`, { code: EXIT.USAGE, action: "Choose a new --out directory." });
   await mkdir5(directory, { recursive: true });
-  await writeFile7(join10(directory, "workflow.mjs"), exampleSource);
-  await writeFile7(join10(directory, "agenttwin.world.json"), JSON.stringify(exampleWorld(), null, 2) + "\n");
-  await writeFile7(join10(directory, "safe.world.json"), JSON.stringify(exampleWorld(true), null, 2) + "\n");
-  await writeFile7(join10(directory, "README.md"), `# Support workflow
+  await writeFile7(join11(directory, "workflow.mjs"), exampleSource);
+  await writeFile7(join11(directory, "agenttwin.world.json"), JSON.stringify(exampleWorld(), null, 2) + "\n");
+  await writeFile7(join11(directory, "safe.world.json"), JSON.stringify(exampleWorld(true), null, 2) + "\n");
+  await writeFile7(join11(directory, "README.md"), `# Support workflow
 
 Run with agenttwin run --file agenttwin.world.json (expected FAIL), then --file safe.world.json (expected PASS). Runs through the CLI with in-process service twins by default. No VM or containers. Use --runtime hosted or --runtime e2b explicitly only when a cloud machine is needed.
 
 This is actual application code using a synthetic custom ticket API plus the supported Slack JSON subset. It is not a clone of a CRM vendor. Replace workflow.mjs with your own built code and edit the explicit file list, endpoints, seed records and assertions. No npm install runs in the sandbox; dependencies must be bundled into your application.
 `);
-  return { directory, worldPath: join10(directory, "agenttwin.world.json") };
+  return { directory, worldPath: join11(directory, "agenttwin.world.json") };
 }
 
 // src/commands/init.ts
@@ -1155,152 +1915,8 @@ import { readFileSync as readFileSync2 } from "fs";
 import { writeFile as writeFile11 } from "fs/promises";
 import { join as join17 } from "path";
 
-// src/lib/files.ts
-import { readdir as readdir2, readFile as readFile9, stat as stat2 } from "fs/promises";
-import { join as join11, relative as relative2, sep as sep2 } from "path";
-var IGNORED_DIRS = /* @__PURE__ */ new Set([
-  ".git",
-  ".agenttwin",
-  "node_modules",
-  "dist",
-  "build",
-  "out",
-  "coverage",
-  ".next",
-  ".nuxt",
-  ".venv",
-  "venv",
-  "env",
-  "site-packages",
-  "__pycache__",
-  ".pytest_cache",
-  ".mypy_cache",
-  ".ruff_cache",
-  ".tox",
-  "vendor",
-  "target",
-  ".turbo",
-  ".cache",
-  ".idea",
-  ".vscode",
-  ".terraform",
-  "models",
-  "data",
-  "datasets",
-  "media",
-  "uploads",
-  "tmp",
-  "logs",
-  "gen"
-]);
-var MAX_FILES = 2e4;
-var MAX_BYTES = 1e6;
-var WALK_BUDGET_MS = 8e3;
-function shouldIgnoreDir(name) {
-  return IGNORED_DIRS.has(name) || name === ".git";
-}
-async function walkDir(root, maxFiles, budgetMs) {
-  const out = [];
-  const limits = [];
-  const stack = [root];
-  const started = Date.now();
-  while (stack.length > 0 && out.length < maxFiles && Date.now() - started < budgetMs) {
-    const dir = stack.pop();
-    let entries;
-    try {
-      entries = await readdir2(dir, { withFileTypes: true });
-    } catch {
-      limits.push(`Directory could not be read: ${relative2(root, dir) || "."}`);
-      continue;
-    }
-    entries.sort((a, b) => a.name.localeCompare(b.name));
-    for (const entry of entries) {
-      const full = join11(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (!shouldIgnoreDir(entry.name)) stack.push(full);
-      } else if (entry.isFile()) {
-        out.push(relative2(root, full).split(sep2).join("/"));
-        if (out.length >= maxFiles) break;
-      }
-    }
-  }
-  if (out.length >= maxFiles) limits.push(`File scan limit reached (${maxFiles} files); additional files may be unscanned`);
-  if (stack.length && Date.now() - started >= budgetMs) limits.push(`File walk time budget reached (${budgetMs}ms); directories remain unscanned`);
-  return { files: out.sort(), limits };
-}
-var RepoFileIndex = class {
-  cwd;
-  cache = { contents: /* @__PURE__ */ new Map(), limits: [] };
-  bounds;
-  constructor(cwd, bounds = { maxFiles: MAX_FILES, budgetMs: WALK_BUDGET_MS }) {
-    this.cwd = cwd;
-    this.bounds = bounds;
-  }
-  async walk() {
-    if (!this.cache.files) {
-      const result = await walkDir(this.cwd, this.bounds.maxFiles, this.bounds.budgetMs);
-      this.cache.files = result.files;
-      this.cache.limits.push(...result.limits);
-    }
-    return this.cache.files;
-  }
-  scanLimits() {
-    return [...new Set(this.cache.limits)].sort();
-  }
-  async exists(path) {
-    try {
-      await stat2(join11(this.cwd, path));
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async read(path, maxBytes = MAX_BYTES) {
-    const cached = this.cache.contents.get(path);
-    if (cached !== void 0) return cached;
-    const full = join11(this.cwd, path);
-    try {
-      const info2 = await stat2(full);
-      if (!info2.isFile()) return void 0;
-      if (info2.size > maxBytes) {
-        this.cache.limits.push(`File excluded by size limit (${maxBytes} bytes): ${path}`);
-        return void 0;
-      }
-      const text = await readFile9(full, "utf8");
-      this.cache.contents.set(path, text);
-      return text;
-    } catch {
-      return void 0;
-    }
-  }
-  async byExt(...exts) {
-    const wanted = new Set(exts.map((e) => e.replace(/^\./, "").toLowerCase()));
-    const files = await this.walk();
-    return files.filter((f) => {
-      const dot = f.lastIndexOf(".");
-      if (dot < 0) return false;
-      return wanted.has(f.slice(dot + 1).toLowerCase());
-    });
-  }
-  async byName(pattern) {
-    const files = await this.walk();
-    return files.filter((f) => pattern.test(f));
-  }
-  line(ref) {
-    const idx = ref.lastIndexOf(":");
-    if (idx < 0) return void 0;
-    const path = ref.slice(0, idx);
-    const num = Number(ref.slice(idx + 1));
-    if (!Number.isInteger(num)) return void 0;
-    const text = this.cache.contents.get(path);
-    if (text === void 0) return void 0;
-    const lines = text.split(/\r?\n/);
-    return lines[num - 1];
-  }
-};
-async function createFileIndex(cwd) {
-  return new RepoFileIndex(cwd);
-}
+// src/discovery/engine.ts
+init_files();
 
 // src/discovery/scoring.ts
 var WEIGHTS = {
@@ -1856,9 +2472,9 @@ var iacDetector = {
 var SOURCE_EXTS = ["ts", "tsx", "js", "jsx", "mjs", "cjs", "py", "go", "java", "kt", "rb", "php", "cs"];
 var MAX_FILES2 = 2500;
 var MAX_EVIDENCE = 6;
-var NON_USAGE_DIR = /(^|\/)(docs?|examples?|demos?|samples?|fixtures?|tests?|__tests__|__mocks__|spec|specs|e2e|storybook|public|static|assets|generated|dist|build|coverage)(\/|$)/i;
+var NON_USAGE_DIR = /(^|\/)(artifacts|testbed|docs?|examples?|demos?|samples?|fixtures?|tests?|__tests__|__mocks__|spec|specs|e2e|storybook|public|static|assets|generated|dist|build|coverage)(\/|$)/i;
 function isNonUsagePath(path) {
-  return NON_USAGE_DIR.test(path);
+  return NON_USAGE_DIR.test(path) || /(?:\.(?:test|spec)\.[^/]+$|(?:demo|test)?fixtures?\.[^/]+$)/i.test(path);
 }
 function safeRegex(source) {
   try {
@@ -2024,7 +2640,7 @@ var envVarDetector = {
 };
 
 // src/discovery/detectors/ci.ts
-var PROVIDERS = [
+var PROVIDERS2 = [
   { re: /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/, id: "github-actions", title: "GitHub Actions" },
   { re: /(^|\/)\.gitlab-ci\.ya?ml$/, id: "gitlab-ci", title: "GitLab CI" },
   { re: /(^|\/)\.circleci\/config\.ya?ml$/, id: "circleci", title: "CircleCI" },
@@ -2040,7 +2656,7 @@ var ciDetector = {
     const all = await ctx.files.walk();
     const findings = [];
     const providerEvidence = /* @__PURE__ */ new Map();
-    for (const system of PROVIDERS) {
+    for (const system of PROVIDERS2) {
       const matches = all.filter((f) => system.re.test(f));
       if (matches.length === 0) continue;
       const evidence = matches.slice(0, 3).map((ref) => ({
@@ -2182,487 +2798,8 @@ function registerDetectors() {
   ];
 }
 
-// src/discovery/masking.ts
-var EMAIL2 = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
-var TOKENISH2 = /\b(sk|rk|pk|ghp|gho|ghs|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
-function maskSecret(value) {
-  return value.replace(TOKENISH2, (match) => `${match.slice(0, 4)}***`);
-}
-function maskEmail(value) {
-  return value.replace(EMAIL2, "$1***$2");
-}
-function maskUrl(value) {
-  try {
-    const url = new URL(value);
-    return `${url.protocol}//${url.host}${url.pathname}`;
-  } catch {
-    return maskSecret(value);
-  }
-}
-function redactDetail(value) {
-  return maskSecret(maskEmail(value)).slice(0, 200);
-}
-
-// src/discovery/probes/providers/stripe.ts
-var stripeProbe = {
-  id: "stripe.readonly",
-  providerId: "stripe",
-  title: "Enumerate Stripe account configuration (read-only)",
-  description: "Reads products, prices and webhook endpoints. Read-only; issues no writes.",
-  readScope: {
-    endpoints: [
-      "GET /v1/products",
-      "GET /v1/prices",
-      "GET /v1/webhook_endpoints"
-    ],
-    methods: ["GET"]
-  },
-  credentials: [
-    {
-      envVar: "STRIPE_SECRET_KEY",
-      label: "Stripe restricted key (read scopes)",
-      required: true,
-      scopes: ["products:read", "prices:read", "webhook_endpoints:read"],
-      hint: "Prefer a restricted key (rk_...) with read scopes over a full sk_live_ key."
-    }
-  ],
-  async run(ctx) {
-    const spec = this.credentials[0];
-    const key = ctx.credential(spec);
-    if (!key) {
-      return {
-        providerId: this.providerId,
-        ok: false,
-        summary: "no credential present",
-        resources: [],
-        evidence: []
-      };
-    }
-    const get = async (path) => {
-      const response = await ctx.fetch(`https://api.stripe.com${path}`, {
-        method: "GET",
-        headers: { Authorization: `Bearer ${key}` },
-        signal: ctx.signal
-      });
-      if (!response.ok) {
-        throw new Error(`Stripe ${path} -> HTTP ${response.status}`);
-      }
-      return await response.json();
-    };
-    try {
-      const [products, prices, hooks] = await Promise.all([
-        get("/v1/products?limit=100"),
-        get("/v1/prices?limit=100"),
-        get("/v1/webhook_endpoints?limit=100")
-      ]);
-      return {
-        providerId: this.providerId,
-        ok: true,
-        summary: `${products.data.length} products, ${prices.data.length} prices, ${hooks.data.length} webhook endpoints`,
-        resources: [
-          {
-            kind: "products",
-            count: products.data.length,
-            sample: products.data.slice(0, 5).map((p) => ({
-              id: p.id,
-              name: p.name,
-              active: p.active
-            }))
-          },
-          { kind: "prices", count: prices.data.length },
-          {
-            kind: "webhook_endpoints",
-            count: hooks.data.length,
-            sample: hooks.data.slice(0, 5).map((h2) => ({
-              url: typeof h2.url === "string" ? maskUrl(h2.url) : void 0,
-              status: h2.status
-            }))
-          }
-        ],
-        evidence: [
-          {
-            ref: "probe:stripe",
-            pass: "probe",
-            signal: "probe",
-            detail: "account reachable via read scopes"
-          }
-        ]
-      };
-    } catch (error) {
-      return {
-        providerId: this.providerId,
-        ok: false,
-        error: { message: error instanceof Error ? error.message : String(error) },
-        summary: "probe failed",
-        resources: [],
-        evidence: []
-      };
-    }
-  }
-};
-
-// src/discovery/probes/providers/github.ts
-var githubProbe = {
-  id: "github.readonly",
-  providerId: "github",
-  title: "Enumerate GitHub account (read-only)",
-  description: "Reads the authenticated user and their repositories. Read-only.",
-  readScope: {
-    endpoints: ["GET /user", "GET /user/repos"],
-    methods: ["GET"]
-  },
-  credentials: [
-    {
-      envVar: "GITHUB_TOKEN",
-      label: "GitHub token (read:user, repo:read)",
-      required: true,
-      scopes: ["read:user", "public_repo"],
-      hint: "A fine-grained token with read-only repository access is sufficient."
-    }
-  ],
-  async run(ctx) {
-    const key = ctx.credential(this.credentials[0]);
-    if (!key) {
-      return {
-        providerId: this.providerId,
-        ok: false,
-        summary: "no credential present",
-        resources: [],
-        evidence: []
-      };
-    }
-    const headers = {
-      Authorization: `Bearer ${key}`,
-      Accept: "application/vnd.github+json",
-      "User-Agent": "agenttwin-discovery"
-    };
-    try {
-      const userResponse = await ctx.fetch("https://api.github.com/user", {
-        method: "GET",
-        headers,
-        signal: ctx.signal
-      });
-      if (!userResponse.ok) {
-        throw new Error(`GitHub /user -> HTTP ${userResponse.status}`);
-      }
-      const user = await userResponse.json();
-      const reposResponse = await ctx.fetch(
-        "https://api.github.com/user/repos?per_page=100&sort=updated",
-        { method: "GET", headers, signal: ctx.signal }
-      );
-      const repos = reposResponse.ok ? await reposResponse.json() : [];
-      return {
-        providerId: this.providerId,
-        ok: true,
-        summary: `${repos.length} repositories readable for @${user.login ?? "unknown"}`,
-        resources: [
-          {
-            kind: "repositories",
-            count: repos.length,
-            sample: repos.slice(0, 5).map((r) => ({
-              name: r.name,
-              private: r.private,
-              archived: r.archived
-            }))
-          }
-        ],
-        evidence: [
-          {
-            ref: "probe:github",
-            pass: "probe",
-            signal: "probe",
-            detail: "account reachable via read scopes"
-          }
-        ]
-      };
-    } catch (error) {
-      return {
-        providerId: this.providerId,
-        ok: false,
-        error: { message: error instanceof Error ? error.message : String(error) },
-        summary: "probe failed",
-        resources: [],
-        evidence: []
-      };
-    }
-  }
-};
-
-// src/discovery/providers/catalog.ts
-function planned(unknown) {
-  return { supported: [], verified: [], unknown, implemented: false };
-}
-var NO_TWIN = ["all behavior (no twin implemented)"];
-var PROVIDERS2 = [
-  {
-    id: "stripe",
-    title: "Stripe",
-    category: "payments",
-    twin: planned(["refunds", "payouts", "disputes", "webhook ordering"]),
-    probe: stripeProbe,
-    signatures: {
-      packages: {
-        node: ["stripe"],
-        python: ["stripe"],
-        go: ["stripe-go"],
-        java: ["stripe-java"],
-        ruby: ["stripe"],
-        php: ["stripe/stripe-php"],
-        dotnet: ["Stripe.net"]
-      },
-      imports: ["new Stripe\\(", `from ["']stripe["']`, `require\\(['"]stripe['"]\\)`, "stripe-go"],
-      hosts: ["api.stripe.com"],
-      envPrefixes: ["STRIPE_"],
-      webhookPaths: ["/webhooks/stripe", "/stripe/webhook", "/webhook/stripe"]
-    },
-    docs: "https://stripe.com/docs/api"
-  },
-  {
-    id: "slack",
-    title: "Slack",
-    category: "comms",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["@slack/web-api", "@slack/bolt", "@slack/events-api", "@slack/socket-mode"],
-        python: ["slack_sdk", "slack-bolt"],
-        go: ["slack-go"],
-        java: ["slack-java-sdk"],
-        ruby: ["slack-ruby-client"]
-      },
-      imports: ["@slack/web-api", "WebClient\\(", "slack_sdk"],
-      hosts: ["slack.com", "api.slack.com", "hooks.slack.com"],
-      envPrefixes: ["SLACK_"]
-    }
-  },
-  {
-    id: "github",
-    title: "GitHub",
-    category: "vcs",
-    twin: planned(NO_TWIN),
-    probe: githubProbe,
-    signatures: {
-      packages: {
-        node: ["@octokit/rest", "@octokit/core", "@octokit/auth", "octokit"],
-        python: ["PyGithub", "github"],
-        go: ["google/go-github"],
-        java: ["github-api"],
-        ruby: ["octokit"]
-      },
-      imports: ["Octokit", "@octokit/", "PyGithub"],
-      hosts: ["api.github.com"],
-      envPrefixes: ["GITHUB_", "GH_"],
-      webhookPaths: ["/webhooks/github", "/github/webhook"]
-    }
-  },
-  {
-    id: "aws",
-    title: "AWS",
-    category: "cloud",
-    twin: planned(["service coverage (LocalStack passthrough planned)"]),
-    envWeak: true,
-    signatures: {
-      packages: {
-        node: ["@aws-sdk/", "aws-sdk"],
-        python: ["boto3", "botocore"],
-        go: ["aws-sdk-go", "aws-sdk-go-v2"],
-        java: ["software.amazon.awssdk", "aws-java-sdk"],
-        ruby: ["aws-sdk-"],
-        php: ["aws/aws-sdk-php"],
-        dotnet: ["AWSSDK."]
-      },
-      imports: ["@aws-sdk/", "boto3", "aws-sdk-go"],
-      hosts: ["amazonaws.com"],
-      envPrefixes: ["AWS_"]
-    }
-  },
-  {
-    id: "google",
-    title: "Google (Gmail / Calendar / Workspace)",
-    category: "comms",
-    twin: planned(NO_TWIN),
-    envWeak: true,
-    signatures: {
-      packages: {
-        node: ["googleapis", "google-auth-library"],
-        python: ["google-api-python-client", "google-cloud", "google-auth"],
-        go: ["google.golang.org/api"],
-        java: ["google-api-client"],
-        ruby: ["google-apis-"]
-      },
-      imports: ["googleapis", "google-api-python-client", "google.golang.org/api"],
-      hosts: ["googleapis.com", "gmail.googleapis.com", "www.googleapis.com"],
-      envPrefixes: ["GOOGLE_", "GCP_", "GMAIL_"]
-    }
-  },
-  {
-    id: "openai",
-    title: "OpenAI",
-    category: "ai",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["openai"],
-        python: ["openai"],
-        go: ["go-openai"],
-        ruby: ["ruby-openai"]
-      },
-      imports: ["OpenAI\\(", `from ["']openai["']`, "go-openai"],
-      hosts: ["api.openai.com"],
-      envPrefixes: ["OPENAI_"]
-    }
-  },
-  {
-    id: "anthropic",
-    title: "Anthropic",
-    category: "ai",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["@anthropic-ai/sdk"],
-        python: ["anthropic"],
-        go: ["anthropic-sdk-go"]
-      },
-      imports: ["@anthropic-ai/sdk", "Anthropic\\("],
-      hosts: ["api.anthropic.com"],
-      envPrefixes: ["ANTHROPIC_"]
-    }
-  },
-  {
-    id: "shopify",
-    title: "Shopify",
-    category: "commerce",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["@shopify/", "shopify-api"],
-        python: ["ShopifyAPI"],
-        ruby: ["shopify_api"]
-      },
-      imports: ["@shopify/", "ShopifyAPI"],
-      hosts: ["myshopify.com", "shopify.com"],
-      envPrefixes: ["SHOPIFY_"]
-    }
-  },
-  {
-    id: "twilio",
-    title: "Twilio",
-    category: "comms",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["twilio"],
-        python: ["twilio"],
-        java: ["twilio"],
-        ruby: ["twilio-ruby"],
-        php: ["twilio/sdk"]
-      },
-      imports: ["twilio"],
-      hosts: ["api.twilio.com"],
-      envPrefixes: ["TWILIO_"]
-    }
-  },
-  {
-    id: "sendgrid",
-    title: "SendGrid",
-    category: "comms",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["@sendgrid/mail", "@sendgrid/client"],
-        python: ["sendgrid"],
-        ruby: ["sendgrid-ruby"]
-      },
-      imports: ["@sendgrid/", "sendgrid"],
-      hosts: ["api.sendgrid.com"],
-      envPrefixes: ["SENDGRID_"]
-    }
-  },
-  {
-    id: "hubspot",
-    title: "HubSpot",
-    category: "crm",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["@hubspot/api-client"],
-        python: ["hubspot-api-client"],
-        ruby: ["hubspot-api-client"]
-      },
-      imports: ["@hubspot/api-client", "hubspot-api-client"],
-      hosts: ["api.hubapi.com"],
-      envPrefixes: ["HUBSPOT_"]
-    }
-  },
-  {
-    id: "salesforce",
-    title: "Salesforce",
-    category: "crm",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["jsforce", "@salesforce/"],
-        python: ["simple-salesforce"],
-        java: ["force-wsc"]
-      },
-      imports: ["jsforce", "simple-salesforce"],
-      hosts: ["salesforce.com", "force.com"],
-      envPrefixes: ["SALESFORCE_", "SF_"]
-    }
-  },
-  {
-    id: "zendesk",
-    title: "Zendesk",
-    category: "support",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: {
-        node: ["node-zendesk"],
-        python: ["zendesk", "zenpy"],
-        ruby: ["zendesk_api"]
-      },
-      imports: ["node-zendesk", "zenpy"],
-      hosts: ["zendesk.com"],
-      envPrefixes: ["ZENDESK_"]
-    }
-  },
-  {
-    id: "linear",
-    title: "Linear",
-    category: "pm",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: { node: ["@linear/sdk"], python: ["linear"] },
-      imports: ["@linear/sdk"],
-      hosts: ["api.linear.app"],
-      envPrefixes: ["LINEAR_"]
-    }
-  },
-  {
-    id: "notion",
-    title: "Notion",
-    category: "docs",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: { node: ["@notionhq/client"], python: ["notion-client"] },
-      imports: ["@notionhq/client", "notion-client"],
-      hosts: ["api.notion.com"],
-      envPrefixes: ["NOTION_"]
-    }
-  },
-  {
-    id: "resend",
-    title: "Resend",
-    category: "comms",
-    twin: planned(NO_TWIN),
-    signatures: {
-      packages: { node: ["resend"] },
-      imports: [`from ["']resend["']`],
-      hosts: ["api.resend.com"],
-      envPrefixes: ["RESEND_"]
-    }
-  }
-];
+// src/discovery/engine.ts
+init_catalog();
 
 // src/discovery/registry.ts
 var SimpleProviderRegistry = class {
@@ -2883,6 +3020,7 @@ async function runProbes({ probes, timeoutMs = 15e3, log }) {
 }
 
 // src/discovery/engine.ts
+init_masking();
 function twinStatus(provider) {
   if (!provider) return "unknown";
   const twin = provider.twin;
@@ -2893,7 +3031,7 @@ function twinStatus(provider) {
 var PASS_BUDGET_MS = 2e4;
 async function runDiscovery(opts) {
   const files = await createFileIndex(opts.cwd);
-  const providers = new SimpleProviderRegistry(PROVIDERS2);
+  const providers = new SimpleProviderRegistry(PROVIDERS);
   const detectors = new SimpleDetectorRegistry(registerDetectors());
   const collected = [];
   const passes = [];
@@ -3235,31 +3373,9 @@ function singularize(word) {
 }
 
 // src/inventory/relationships.ts
+init_entrypoints();
 import { createHash as createHash4 } from "crypto";
 
-// src/inventory/entrypoints.ts
-function codeOnly(source) {
-  return source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`/g, (part) => part.replace(/[^\n]/g, " "));
-}
-function exportedEntrypoints(source) {
-  const code = codeOnly(source);
-  const pattern = /\bexport\s+(?:default\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)[^{;]*\{|\bexport\s+(?:const|let)\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=;]+)?=>\s*\{/g;
-  const result = [];
-  let match;
-  while (match = pattern.exec(code)) {
-    let depth = 1, end = pattern.lastIndex;
-    while (end < code.length && depth) {
-      if (code[end] === "{") depth++;
-      if (code[end] === "}") depth--;
-      end++;
-    }
-    if (depth) continue;
-    result.push({ name: match[1] || match[2], startLine: code.slice(0, match.index).split("\n").length, endLine: code.slice(0, end).split("\n").length });
-    pattern.lastIndex = end;
-  }
-  return result;
-}
-
 // src/inventory/operations.ts
 var WRITE_VERBS = /* @__PURE__ */ new Set([
   "create",
@@ -3318,9 +3434,10 @@ function scanOperations(text, path) {
 }
 
 // src/inventory/relationships.ts
+init_catalog();
 var SOURCE_EXTS2 = ["ts", "tsx", "js", "jsx", "mjs", "cjs", "py", "go", "java", "kt", "rb", "php", "cs"];
 var MAX_FILES3 = 2500;
-var NON_USAGE_DIR2 = /(^|\/)(docs?|examples?|demos?|samples?|fixtures?|tests?|__tests__|__mocks__|spec|specs|e2e|storybook|public|static|assets|generated)(\/|$)/i;
+var NON_USAGE_DIR2 = /(^|\/)(artifacts|testbed|docs?|examples?|demos?|samples?|fixtures?|tests?|__tests__|__mocks__|spec|specs|e2e|storybook|public|static|assets|generated)(\/|$)/i;
 var PROVIDER_KINDS = /* @__PURE__ */ new Set([
   "payments",
   "comms",
@@ -3362,7 +3479,7 @@ function fileRefs(tool) {
   return [...refs2];
 }
 function packagesFor(providerId) {
-  const provider = PROVIDERS2.find((p) => p.id === providerId);
+  const provider = PROVIDERS.find((p) => p.id === providerId);
   if (!provider) return [];
   const set = /* @__PURE__ */ new Set();
   for (const list2 of Object.values(provider.signatures.packages ?? {})) {
@@ -3489,7 +3606,7 @@ async function buildRelationships(apps, tools, files, decisions) {
       });
     }
   }
-  const sourceFiles = (await Promise.all(SOURCE_EXTS2.map((ext) => files.byExt(ext)))).flat().filter((f) => !NON_USAGE_DIR2.test(f)).slice(0, MAX_FILES3);
+  const sourceFiles = (await Promise.all(SOURCE_EXTS2.map((ext) => files.byExt(ext)))).flat().filter((f) => !NON_USAGE_DIR2.test(f) && !/(?:\.(?:test|spec)\.[^/]+$|(?:demo|test)?fixtures?\.[^/]+$)/i.test(f)).slice(0, MAX_FILES3);
   const records = /* @__PURE__ */ new Map();
   const roles = /* @__PURE__ */ new Map();
   const fileEntities = /* @__PURE__ */ new Map();
@@ -3738,6 +3855,8 @@ async function extractScopeHints(files, inspections) {
 }
 
 // src/inventory/build.ts
+init_catalog();
+init_files();
 var CATEGORY_KIND = {
   payments: "payments",
   comms: "comms",
@@ -3748,7 +3867,7 @@ var CATEGORY_KIND = {
   ai: "ai"
 };
 function providerKind(id) {
-  const provider = PROVIDERS2.find((p) => p.id === id);
+  const provider = PROVIDERS.find((p) => p.id === id);
   if (!provider) return "external-api";
   return CATEGORY_KIND[provider.category] ?? "external-api";
 }
@@ -3982,7 +4101,7 @@ async function buildInventory({
   const scanLimits = [.../* @__PURE__ */ new Set([...manifest.scanLimits ?? [], ...files.scanLimits()])];
   if (scanLimits.length) sources.push({ id: "files:coverage", tier: "local", status: "limited", findings: 0, detail: scanLimits.join("; ") });
   const unclassified = candidates.filter((u) => !classified.has(u.ref));
-  const withTwin = toolList.filter((t) => PROVIDERS2.some((p) => p.id === t.id && p.twin.implemented)).length;
+  const withTwin = toolList.filter((t) => PROVIDERS.some((p) => p.id === t.id && p.twin.implemented)).length;
   const coverage = {
     sources,
     counts: {
@@ -4364,6 +4483,9 @@ async function runInspections(opts) {
   return results.sort((a, b) => a.id.localeCompare(b.id));
 }
 
+// src/commands/inventory.ts
+init_catalog();
+
 // src/inventory/workflows.ts
 function permissionsFor(kind, entities) {
   const list2 = [];