@amodalai/core 0.1.0

package/dist/src/security/scope-checker.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { ScopingRule } from '../repo/connection-schemas.js';
+/**
+ * A scope violation finding.
+ */
+export interface ScopeViolation {
+    entity: string;
+    snippet: string;
+    expectedQualification: string;
+}
+export interface ScopeCheckerContext {
+    scopeRules: Record<string, ScopingRule>;
+    scopeLabels: Record<string, string>;
+}
+/**
+ * Checks agent output for unqualified aggregate claims about scoped entities.
+ */
+export declare class ScopeChecker {
+    private readonly scopeRules;
+    private readonly scopeLabels;
+    constructor(context: ScopeCheckerContext);
+    check(text: string): ScopeViolation[];
+}

package/dist/src/security/scope-checker.js

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Aggregate keywords that indicate unqualified statements.
+ */
+const AGGREGATE_PATTERN = /\b(?:all|every|total|across all|entire|whole|all of the|each and every)\b/gi;
+/**
+ * Checks agent output for unqualified aggregate claims about scoped entities.
+ */
+export class ScopeChecker {
+    scopeRules;
+    scopeLabels;
+    constructor(context) {
+        this.scopeRules = context.scopeRules;
+        this.scopeLabels = context.scopeLabels;
+    }
+    check(text) {
+        const violations = [];
+        const entityNames = Object.keys(this.scopeRules);
+        if (entityNames.length === 0)
+            return violations;
+        // Find aggregate keywords and check nearby entity mentions
+        let m;
+        const re = new RegExp(AGGREGATE_PATTERN.source, 'gi');
+        while ((m = re.exec(text)) !== null) {
+            const start = Math.max(0, m.index - 80);
+            const end = Math.min(text.length, m.index + m[0].length + 80);
+            const snippet = text.slice(start, end);
+            for (const entity of entityNames) {
+                const rule = this.scopeRules[entity];
+                if (!rule)
+                    continue;
+                // Only flag field_match and through_relation scoping
+                if (rule.type === 'all')
+                    continue;
+                if (snippet.toLowerCase().includes(entity.toLowerCase())) {
+                    const label = this.scopeLabels[entity] ?? rule.label ?? `scoped by ${rule.type}`;
+                    violations.push({
+                        entity,
+                        snippet: snippet.trim(),
+                        expectedQualification: label,
+                    });
+                }
+            }
+        }
+        return violations;
+    }
+}
+//# sourceMappingURL=scope-checker.js.map

package/dist/src/security/scope-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-checker.js","sourceRoot":"","sources":["../../../src/security/scope-checker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH;;GAEG;AACH,MAAM,iBAAiB,GACrB,6EAA6E,CAAC;AAEhF;;GAEG;AACH,MAAM,OAAO,YAAY;IACN,UAAU,CAA8B;IACxC,WAAW,CAAyB;IAErD,YAAY,OAA4B;QACtC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAY;QAChB,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAEhD,2DAA2D;QAC3D,IAAI,CAAyB,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAEvC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACrC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,qDAAqD;gBACrD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;oBAAE,SAAS;gBAElC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACzD,MAAM,KAAK,GACT,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;oBACrE,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM;wBACN,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;wBACvB,qBAAqB,EAAE,KAAK;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/src/security/scrub-tracker.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { ScrubRecord } from './security-types.js';
+/**
+ * Per-session accumulator of scrubbed field values.
+ * The field scrubber writes records; the output guard reads them
+ * to detect leaks in agent responses.
+ */
+export declare class ScrubTracker {
+    private readonly records;
+    private readonly values;
+    addRecords(records: readonly ScrubRecord[]): void;
+    getAllRecords(): readonly ScrubRecord[];
+    getScrubbedValues(): ReadonlySet<string>;
+    getRecordsBySensitivity(sensitivity: string): readonly ScrubRecord[];
+    clear(): void;
+    get size(): number;
+}

package/dist/src/security/scrub-tracker.js

@@ -0,0 +1,39 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Per-session accumulator of scrubbed field values.
+ * The field scrubber writes records; the output guard reads them
+ * to detect leaks in agent responses.
+ */
+export class ScrubTracker {
+    records = [];
+    values = new Set();
+    addRecords(records) {
+        for (const record of records) {
+            this.records.push(record);
+            if (record.value.length > 0) {
+                this.values.add(record.value);
+            }
+        }
+    }
+    getAllRecords() {
+        return this.records;
+    }
+    getScrubbedValues() {
+        return this.values;
+    }
+    getRecordsBySensitivity(sensitivity) {
+        return this.records.filter((r) => r.sensitivity === sensitivity);
+    }
+    clear() {
+        this.records.length = 0;
+        this.values.clear();
+    }
+    get size() {
+        return this.records.length;
+    }
+}
+//# sourceMappingURL=scrub-tracker.js.map

package/dist/src/security/scrub-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub-tracker.js","sourceRoot":"","sources":["../../../src/security/scrub-tracker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACN,OAAO,GAAkB,EAAE,CAAC;IAC5B,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAC;IAEjD,UAAU,CAAC,OAA+B;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,uBAAuB,CACrB,WAAmB;QAEnB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;IACnE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;CACF"}

package/dist/src/security/security-types.d.ts

@@ -0,0 +1,69 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * A record of a scrubbed field value, tracked per session.
+ */
+export interface ScrubRecord {
+    value: string;
+    entity: string;
+    field: string;
+    sensitivity: string;
+    policy: 'never_retrieve' | 'retrieve_but_redact' | 'role_gated';
+    entityId?: string;
+    connectionName: string;
+    timestamp: number;
+}
+/**
+ * Result from field scrubbing an API response.
+ */
+export interface ScrubResult {
+    data: unknown;
+    records: ScrubRecord[];
+    strippedCount: number;
+    redactableCount: number;
+}
+/**
+ * A finding from the output guard.
+ */
+export interface GuardFinding {
+    type: 'field_redaction' | 'pattern_match' | 'leak_detected' | 'scope_violation';
+    description: string;
+    location?: string;
+    severity: 'info' | 'warning' | 'critical';
+}
+/**
+ * Result from the output guard.
+ */
+export interface GuardResult {
+    output: string;
+    modified: boolean;
+    findings: GuardFinding[];
+    blocked: boolean;
+}
+/**
+ * Decision from the action gate.
+ */
+export type GateDecision = 'allow' | 'confirm' | 'review' | 'never';
+/**
+ * Result from the action gate.
+ */
+export interface GateResult {
+    decision: GateDecision;
+    reason?: string;
+    escalated: boolean;
+    endpointPath: string;
+}
+/**
+ * Error codes for security operations.
+ */
+export type SecurityErrorCode = 'INVALID_CONFIG' | 'SCRUB_FAILED' | 'GUARD_FAILED' | 'GATE_FAILED';
+/**
+ * Error thrown during security operations.
+ */
+export declare class SecurityError extends Error {
+    readonly code: SecurityErrorCode;
+    constructor(code: SecurityErrorCode, message: string, cause?: unknown);
+}

package/dist/src/security/security-types.js

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Error thrown during security operations.
+ */
+export class SecurityError extends Error {
+    code;
+    constructor(code, message, cause) {
+        super(message, { cause });
+        this.name = 'SecurityError';
+        this.code = code;
+    }
+}
+//# sourceMappingURL=security-types.js.map

package/dist/src/security/security-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-types.js","sourceRoot":"","sources":["../../../src/security/security-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsEH;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAoB;IAEjC,YAAY,IAAuB,EAAE,OAAe,EAAE,KAAe;QACnE,KAAK,CAAC,OAAO,EAAE,EAAC,KAAK,EAAC,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/src/security/threshold-evaluator.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { Threshold } from '../repo/connection-schemas.js';
+/**
+ * Evaluates threshold escalation rules against request parameters.
+ * Returns the highest triggered escalation, or null if none trigger.
+ */
+export declare class ThresholdEvaluator {
+    evaluate(thresholds: Threshold[], params: Record<string, unknown>): 'review' | 'never' | null;
+}

package/dist/src/security/threshold-evaluator.js

@@ -0,0 +1,44 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Evaluates threshold escalation rules against request parameters.
+ * Returns the highest triggered escalation, or null if none trigger.
+ */
+export class ThresholdEvaluator {
+    evaluate(thresholds, params) {
+        // Sort descending by `above` so we check highest thresholds first
+        const sorted = [...thresholds].sort((a, b) => b.above - a.above);
+        for (const threshold of sorted) {
+            const value = extractDotPath(params, threshold.field);
+            if (value === undefined)
+                continue;
+            if (typeof value !== 'number')
+                continue;
+            if (value > threshold.above) {
+                return threshold.escalate;
+            }
+        }
+        return null;
+    }
+}
+/**
+ * Extracts a value from a nested object using dot-path notation.
+ * e.g., "body.amount" extracts params.body.amount
+ */
+function extractDotPath(obj, path) {
+    const parts = path.split('.');
+    let current = obj;
+    for (const part of parts) {
+        if (current === null || current === undefined)
+            return undefined;
+        if (typeof current !== 'object')
+            return undefined;
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- traversing unknown nested structure
+        current = current[part];
+    }
+    return current;
+}
+//# sourceMappingURL=threshold-evaluator.js.map

package/dist/src/security/threshold-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threshold-evaluator.js","sourceRoot":"","sources":["../../../src/security/threshold-evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAC7B,QAAQ,CACN,UAAuB,EACvB,MAA+B;QAE/B,kEAAkE;QAClE,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAEjE,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAExC,IAAI,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,GAA4B,EAC5B,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClD,8GAA8G;QAC9G,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/snapshot/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export * from './snapshot-types.js';
+export * from './snapshot-builder.js';
+export * from './snapshot-loader.js';

package/dist/src/snapshot/index.js

@@ -0,0 +1,9 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export * from './snapshot-types.js';
+export * from './snapshot-builder.js';
+export * from './snapshot-loader.js';
+//# sourceMappingURL=index.js.map

package/dist/src/snapshot/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/snapshot/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC"}

package/dist/src/snapshot/snapshot-builder.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { AmodalRepo } from '../repo/repo-types.js';
+import type { SurfaceEndpoint } from '../repo/connection-types.js';
+import type { BuildSnapshotOptions, DeploySnapshot } from './snapshot-types.js';
+/**
+ * Generate a deploy ID: `deploy-` followed by 7 hex characters.
+ */
+export declare function generateDeployId(): string;
+/**
+ * Serialize surface endpoints back to the markdown format used in surface.md.
+ *
+ * Format per endpoint:
+ * ```
+ * - [x] GET /users — List all users
+ * - [ ] DELETE /users/:id — Delete a user
+ * ```
+ */
+export declare function serializeSurface(endpoints: SurfaceEndpoint[]): string;
+/**
+ * Build an immutable deploy snapshot from a loaded AmodalRepo.
+ *
+ * The snapshot contains the fully-resolved configuration with `env:VAR_NAME`
+ * references left intact (not resolved) — secrets are resolved at runtime.
+ */
+export declare function buildSnapshot(repo: AmodalRepo, options: BuildSnapshotOptions): DeploySnapshot;
+/**
+ * Serialize a deploy snapshot to a JSON string.
+ */
+export declare function serializeSnapshot(snapshot: DeploySnapshot): string;
+/**
+ * Get the byte size of a serialized snapshot.
+ */
+export declare function snapshotSizeBytes(serialized: string): number;

package/dist/src/snapshot/snapshot-builder.js

@@ -0,0 +1,152 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { randomBytes } from 'node:crypto';
+/**
+ * Generate a deploy ID: `deploy-` followed by 7 hex characters.
+ */
+export function generateDeployId() {
+    const hex = randomBytes(4).toString('hex').slice(0, 7);
+    return `deploy-${hex}`;
+}
+/**
+ * Serialize surface endpoints back to the markdown format used in surface.md.
+ *
+ * Format per endpoint:
+ * ```
+ * - [x] GET /users — List all users
+ * - [ ] DELETE /users/:id — Delete a user
+ * ```
+ */
+export function serializeSurface(endpoints) {
+    if (endpoints.length === 0)
+        return '';
+    return endpoints
+        .map((ep) => {
+        const check = ep.included ? 'x' : ' ';
+        const opPrefix = ep.operationType ? `${ep.operationType} ` : '';
+        return `- [${check}] ${opPrefix}${ep.method} ${ep.path} — ${ep.description}`;
+    })
+        .join('\n');
+}
+/**
+ * Build an immutable deploy snapshot from a loaded AmodalRepo.
+ *
+ * The snapshot contains the fully-resolved configuration with `env:VAR_NAME`
+ * references left intact (not resolved) — secrets are resolved at runtime.
+ */
+export function buildSnapshot(repo, options) {
+    // Transform connections Map to Record
+    const connections = {};
+    for (const [name, conn] of repo.connections) {
+        connections[name] = {
+            spec: conn.spec,
+            surface: serializeSurface(conn.surface),
+            access: conn.access,
+            ...(conn.entities ? { entities: conn.entities } : {}),
+            ...(conn.rules ? { rules: conn.rules } : {}),
+        };
+    }
+    // Transform skills
+    const skills = repo.skills.map((s) => ({
+        name: s.name,
+        description: s.description,
+        ...(s.trigger ? { trigger: s.trigger } : {}),
+        body: s.body,
+    }));
+    // Transform automations
+    const automations = repo.automations.map((a) => ({
+        name: a.name,
+        title: a.title,
+        ...(a.schedule ? { schedule: a.schedule } : {}),
+        trigger: a.trigger,
+        prompt: a.prompt,
+    }));
+    // Transform knowledge
+    const knowledge = repo.knowledge.map((k) => ({
+        name: k.name,
+        title: k.title,
+        body: k.body,
+    }));
+    // Build agents if present
+    const hasAgents = repo.agents.main || repo.agents.simple || (repo.agents.subagents?.length ?? 0) > 0;
+    const agents = hasAgents
+        ? {
+            ...(repo.agents.main ? { main: repo.agents.main } : {}),
+            ...(repo.agents.simple ? { simple: repo.agents.simple } : {}),
+            ...((repo.agents.subagents?.length ?? 0) > 0
+                ? {
+                    subagents: repo.agents.subagents.map((sa) => ({
+                        name: sa.name,
+                        displayName: sa.displayName,
+                        description: sa.description,
+                        prompt: sa.prompt,
+                        tools: sa.tools,
+                        maxDepth: sa.maxDepth,
+                        maxToolCalls: sa.maxToolCalls,
+                        timeout: sa.timeout,
+                    })),
+                }
+                : {}),
+        }
+        : undefined;
+    // Transform tools (metadata only — handler code is in Daytona snapshots)
+    const tools = repo.tools.map((t) => ({
+        name: t.name,
+        description: t.description,
+        parameters: t.parameters,
+        confirm: t.confirm,
+        timeout: t.timeout,
+        env: t.env,
+    }));
+    // Transform evals
+    const evals = repo.evals.map((e) => ({
+        name: e.name,
+        title: e.title,
+        description: e.description,
+        query: e.query,
+        assertions: e.assertions.map((a) => ({ text: a.text, negated: a.negated })),
+    }));
+    return {
+        deployId: generateDeployId(),
+        createdAt: new Date().toISOString(),
+        createdBy: options.createdBy,
+        source: options.source,
+        ...(options.commitSha ? { commitSha: options.commitSha } : {}),
+        ...(options.branch ? { branch: options.branch } : {}),
+        ...(options.message ? { message: options.message } : {}),
+        config: repo.config,
+        connections,
+        skills,
+        automations,
+        knowledge,
+        ...(agents ? { agents } : {}),
+        ...(tools.length > 0 ? { tools } : {}),
+        ...(options.buildManifest ? { buildManifest: options.buildManifest } : {}),
+        ...(evals.length > 0 ? { evals } : {}),
+        ...((repo.stores?.length ?? 0) > 0 ? { stores: repo.stores.map((s) => ({
+                name: s.name,
+                entity: s.entity,
+                ...(s.ttl !== undefined ? { ttl: s.ttl } : {}),
+                ...(s.failure ? { failure: s.failure } : {}),
+                ...(s.history ? { history: s.history } : {}),
+                ...(s.trace ? { trace: s.trace } : {}),
+            })) } : {}),
+        ...(repo.mcpServers && Object.keys(repo.mcpServers).length > 0 ? { mcpServers: repo.mcpServers } : {}),
+    };
+}
+/**
+ * Serialize a deploy snapshot to a JSON string.
+ */
+export function serializeSnapshot(snapshot) {
+    return JSON.stringify(snapshot, null, 2);
+}
+/**
+ * Get the byte size of a serialized snapshot.
+ */
+export function snapshotSizeBytes(serialized) {
+    return Buffer.byteLength(serialized, 'utf-8');
+}
+//# sourceMappingURL=snapshot-builder.js.map

package/dist/src/snapshot/snapshot-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-builder.js","sourceRoot":"","sources":["../../../src/snapshot/snapshot-builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,WAAW,EAAC,MAAM,aAAa,CAAC;AAaxC;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAA4B;IAC3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,SAAS;SACb,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACV,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACtC,MAAM,QAAQ,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,MAAM,KAAK,KAAK,QAAQ,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/E,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAgB,EAChB,OAA6B;IAE7B,sCAAsC;IACtC,MAAM,WAAW,GAAuC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,WAAW,CAAC,IAAI,CAAC,GAAG;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,MAAM,MAAM,GAAoB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC,CAAC,CAAC;IAEJ,wBAAwB;IACxB,MAAM,WAAW,GAAyB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC,CAAC,CAAC;IAEJ,sBAAsB;IACtB,MAAM,SAAS,GAAwB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC,CAAC,CAAC;IAEJ,0BAA0B;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC;YACE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;gBAC1C,CAAC,CAAC;oBACE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;wBAC5C,IAAI,EAAE,EAAE,CAAC,IAAI;wBACb,WAAW,EAAE,EAAE,CAAC,WAAW;wBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;wBAC3B,MAAM,EAAE,EAAE,CAAC,MAAM;wBACjB,KAAK,EAAE,EAAE,CAAC,KAAK;wBACf,QAAQ,EAAE,EAAE,CAAC,QAAQ;wBACrB,YAAY,EAAE,EAAE,CAAC,YAAY;wBAC7B,OAAO,EAAE,EAAE,CAAC,OAAO;qBACpB,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,yEAAyE;IACzE,MAAM,KAAK,GAAmB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,EAAE,CAAC,CAAC,GAAG;KACX,CAAC,CAAC,CAAC;IAEJ,kBAAkB;IAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC;KAC1E,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,QAAQ,EAAE,gBAAgB,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW;QACX,MAAM;QACN,WAAW;QACX,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAC,aAAa,EAAE,OAAO,CAAC,aAAa,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpE,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrC,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACV,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAwB;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}

package/dist/src/snapshot/snapshot-loader.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { AmodalRepo } from '../repo/repo-types.js';
+import type { SurfaceEndpoint } from '../repo/connection-types.js';
+import type { DeploySnapshot } from './snapshot-types.js';
+/**
+ * Parse surface markdown back into SurfaceEndpoint[].
+ *
+ * Expected format per line:
+ * ```
+ * - [x] GET /users — List all users
+ * - [ ] DELETE /users/:id — Delete a user
+ * - [x] query GET /graphql — Query endpoint
+ * ```
+ */
+export declare function parseSurfaceFromSnapshot(surfaceMarkdown: string): SurfaceEndpoint[];
+/**
+ * Load a deploy snapshot from a JSON file on disk.
+ * Validates with Zod schema.
+ */
+export declare function loadSnapshotFromFile(filePath: string): Promise<DeploySnapshot>;
+/**
+ * Convert a deploy snapshot back into an AmodalRepo for runtime use
+ * (e.g., `amodal serve --config ./resolved-config.json`).
+ */
+export declare function snapshotToRepo(snapshot: DeploySnapshot, origin: string): AmodalRepo;