@spotpatch/dev-server 0.3.0 → 0.5.0

package/dist/index.js

@@ -204,7 +204,11 @@ function createAgentJobManager(options) {
     }
   };
   const applyChange = async (job, preparedChange) => {
-    transition(job, "applying", "Applying validated changes to the project.");
+    transition(
+      job,
+      "applying",
+      job.applyMode === "trusted-auto" ? "Applying trusted change directly to the project." : "Applying validated changes to the project."
+    );
     try {
       await dependencies.applyChange(preparedChange);
       transition(job, "applied", "Changes were applied to local project files.");
@@ -243,11 +247,15 @@ function createAgentJobManager(options) {
           );
         }
       };
+      const execution = Object.freeze({
+        ...options.ai.execution,
+        applyMode: job.applyMode
+      });
       const preparedChange = await dependencies.executeChange({
         annotation: job.annotation,
         callbacks,
         credential: job.credential,
-        execution: options.ai.execution,
+        execution,
         jobId: job.id,
         model: job.model,
         provider: job.provider,
@@ -734,7 +742,8 @@ import {
   DEFAULT_AGENT_LIMITS,
   MAX_ANNOTATION_TARGETS,
   SPOTPATCH_EDITOR_PREFERENCES,
-  SPOTPATCH_LOCALE_PREFERENCES
+  SPOTPATCH_LOCALE_PREFERENCES,
+  DEFAULT_DATA_FLOW_LIMITS
 } from "@spotpatch/shared";
 import { z } from "zod";
 var DEFAULT_EXCLUDE = Object.freeze([
@@ -745,7 +754,7 @@ var DEFAULT_EXCLUDE = Object.freeze([
   /(?:^|\/)dist(?:\/|$)/,
   /(?:^|\/)coverage(?:\/|$)/
 ]);
-var DEFAULT_INCLUDE = Object.freeze([/(?:^|[/\\])src[/\\].+\.(?:jsx|tsx)$/]);
+var DEFAULT_INCLUDE = Object.freeze([/(?:^|[/\\])src[/\\].+\.(?:js|jsx|ts|tsx)$/]);
 var DEFAULT_BUDGET = Object.freeze({
   totalCharacters: 16e3,
   domCharacters: 3e3,
@@ -766,7 +775,12 @@ var DEFAULT_OPTIONS = Object.freeze({
   debug: false,
   locale: "auto",
   maxTargets: 8,
-  ai: false
+  ai: false,
+  dataFlow: Object.freeze({
+    enabled: false,
+    runtime: "dispatch",
+    limits: DEFAULT_DATA_FLOW_LIMITS
+  })
 });
 var PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 var ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]{1,127}$/;
@@ -1058,6 +1072,36 @@ function assertPositiveBudget(budget) {
     }
   }
 }
+function resolveDataFlowOptions(options) {
+  if (options === void 0 || options === false) {
+    return DEFAULT_OPTIONS.dataFlow;
+  }
+  const candidate = options;
+  if (typeof candidate !== "object" || candidate === null) {
+    throw new RangeError("SpotPatch dataFlow configuration is invalid.");
+  }
+  const runtime = options.runtime ?? "dispatch";
+  if (runtime !== "dispatch") {
+    throw new RangeError("SpotPatch dataFlow runtime mode is invalid.");
+  }
+  return Object.freeze({
+    enabled: true,
+    runtime,
+    limits: DEFAULT_DATA_FLOW_LIMITS
+  });
+}
+function createRuntimeDataFlowConfig(options) {
+  return Object.freeze({
+    enabled: options.enabled,
+    runtime: options.runtime,
+    limits: Object.freeze({
+      observationMaxEntries: options.limits.observationMaxEntries,
+      observationMaxBytes: options.limits.observationMaxBytes,
+      observationTtlMs: options.limits.observationTtlMs,
+      reportMaxBytes: options.limits.reportMaxBytes
+    })
+  });
+}
 function resolveOptions(options = {}, environmentAi) {
   if (options.trustedFastMode !== void 0 && typeof options.trustedFastMode !== "boolean") {
     throw new RangeError("SpotPatch trustedFastMode must be a boolean.");
@@ -1093,7 +1137,8 @@ function resolveOptions(options = {}, environmentAi) {
     debug: options.debug ?? DEFAULT_OPTIONS.debug,
     locale,
     maxTargets,
-    ai: resolveAiOptions(options.ai ?? environmentAi)
+    ai: resolveAiOptions(options.ai ?? environmentAi),
+    dataFlow: resolveDataFlowOptions(options.dataFlow)
   };
   if (resolved.shortcut.trim().length === 0 || resolved.shortcut.length > 128 || resolved.shortcut.includes("\0")) {
     throw new RangeError("SpotPatch shortcut is invalid.");
@@ -1279,37 +1324,62 @@ function createSourceRegistry(options = {}) {
   const createId = options.createId ?? createRandomSourceId;
   const pathToId = /* @__PURE__ */ new Map();
   const idToPath = /* @__PURE__ */ new Map();
+  const componentAnchors = /* @__PURE__ */ new Map();
+  const componentIdsByPath = /* @__PURE__ */ new Map();
+  function registerSourcePath(absolutePath) {
+    const normalizedPath = normalizeAbsolutePath(absolutePath);
+    const existingId = pathToId.get(normalizedPath);
+    if (existingId !== void 0) {
+      return existingId;
+    }
+    let fileId = createId();
+    while (idToPath.has(fileId)) fileId = createId();
+    pathToId.set(normalizedPath, fileId);
+    idToPath.set(fileId, normalizedPath);
+    return fileId;
+  }
   return Object.freeze({
     register(absolutePath) {
+      return registerSourcePath(absolutePath);
+    },
+    registerDataFlowComponents(absolutePath, sourceVersion, components) {
       const normalizedPath = normalizeAbsolutePath(absolutePath);
-      const existingId = pathToId.get(normalizedPath);
-      if (existingId !== void 0) {
-        return existingId;
+      const previousIds = componentIdsByPath.get(normalizedPath);
+      for (const componentSourceId of previousIds ?? []) {
+        componentAnchors.delete(componentSourceId);
       }
-      let fileId = createId();
-      while (idToPath.has(fileId)) {
-        fileId = createId();
+      const fileId = registerSourcePath(normalizedPath);
+      const currentIds = /* @__PURE__ */ new Set();
+      for (const component of components) {
+        currentIds.add(component.componentSourceId);
+        componentAnchors.set(
+          component.componentSourceId,
+          Object.freeze({ ...component, fileId, sourceVersion })
+        );
       }
-      pathToId.set(normalizedPath, fileId);
-      idToPath.set(fileId, normalizedPath);
-      return fileId;
+      componentIdsByPath.set(normalizedPath, currentIds);
     },
     resolve(fileId) {
       return idToPath.get(fileId);
     },
+    resolveDataFlowComponent(componentSourceId) {
+      return componentAnchors.get(componentSourceId);
+    },
     clear() {
       pathToId.clear();
       idToPath.clear();
+      componentAnchors.clear();
+      componentIdsByPath.clear();
     }
   });
 }
 
 // src/server/middleware.ts
 import {
-  ERROR_CODES as ERROR_CODES9,
+  ERROR_CODES as ERROR_CODES10,
   SPOTPATCH_API_BASE,
   SPOTPATCH_ENDPOINTS as SPOTPATCH_ENDPOINTS2,
-  SpotPatchError as SpotPatchError9,
+  SpotPatchError as SpotPatchError10,
   openEditorRequestSchema,
   sourceContextRequestSchema
 } from "@spotpatch/shared";
@@ -2142,10 +2212,186 @@ function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
 }
 var launchConfiguredEditor = createEditorLauncher();
 
+// src/server/data-flow-http.ts
+import { createHash as createHash2 } from "crypto";
+import {
+  createStaticDataFlowAnalyzer
+} from "@spotpatch/analyzer";
+import {
+  DATA_FLOW_SCHEMA_VERSION,
+  ERROR_CODES as ERROR_CODES7,
+  SpotPatchError as SpotPatchError7,
+  dataFlowComponentReportRequestSchema,
+  dataFlowPageReportRequestSchema,
+  limitDataFlowReportCollections
+} from "@spotpatch/shared";
+function envelopeBytes(report) {
+  return Buffer.byteLength(JSON.stringify({ ok: true, data: report }), "utf8");
+}
+function limitDataFlowReportToBytes(report, maximumBytes) {
+  const structurallyLimited = limitDataFlowReportCollections(report);
+  if (envelopeBytes(structurallyLimited) <= maximumBytes) {
+    return structurallyLimited;
+  }
+  let limited = limitDataFlowReportCollections(structurallyLimited, {
+    forceTruncation: true,
+    maximumDependencies: 0,
+    truncatedBy: "bytes"
+  });
+  if (envelopeBytes(limited) > maximumBytes) {
+    throw new SpotPatchError7(ERROR_CODES7.INTERNAL_ERROR);
+  }
+  for (let maximumDependencies = 1; maximumDependencies <= structurallyLimited.dependencies.length; maximumDependencies += 1) {
+    const candidate = limitDataFlowReportCollections(structurallyLimited, {
+      forceTruncation: true,
+      maximumDependencies,
+      truncatedBy: "bytes"
+    });
+    if (envelopeBytes(candidate) > maximumBytes) break;
+    limited = candidate;
+  }
+  return limited;
+}
+function createDataFlowAnalyzer(options) {
+  if (!options.options.dataFlow.enabled) return void 0;
+  return createStaticDataFlowAnalyzer({
+    root: options.root,
+    registryEpoch: options.session.id,
+    registerSource: (absolutePath) => options.registry.register(absolutePath),
+    limits: options.options.dataFlow.limits
+  });
+}
+async function analyzeTarget(request, analyzer, options) {
+  const resolvedRequest = (() => {
+    if ("componentSourceId" in request) {
+      const anchor = options.registry.resolveDataFlowComponent(
+        request.componentSourceId
+      );
+      if (anchor?.sourceVersion !== request.sourceVersion) {
+        throw new SpotPatchError7(ERROR_CODES7.DATA_FLOW_SOURCE_STALE);
+      }
+      return anchor;
+    }
+    return request;
+  })();
+  const absolutePath = await resolveSourceFile({
+    fileId: resolvedRequest.fileId,
+    registry: options.registry,
+    root: options.root
+  });
+  const report = analyzer.analyzeComponent({
+    absolutePath,
+    line: resolvedRequest.line,
+    column: resolvedRequest.column
+  });
+  if (resolvedRequest.sourceVersion !== void 0 && resolvedRequest.sourceVersion !== report.component.source.sourceVersion) {
+    throw new SpotPatchError7(ERROR_CODES7.DATA_FLOW_SOURCE_STALE);
+  }
+  return limitDataFlowReportToBytes(
+    report,
+    options.options.dataFlow.limits.reportMaxBytes
+  );
+}
+function requireAnalyzer(analyzer) {
+  if (analyzer === void 0) {
+    throw new SpotPatchError7(ERROR_CODES7.DATA_FLOW_DISABLED);
+  }
+  return analyzer;
+}
+async function handleComponentDataFlowReport(request, analyzer, options) {
+  const parsed = dataFlowComponentReportRequestSchema.safeParse(
+    await readJsonRequestBody(
+      request,
+      options.options.dataFlow.limits.protocolRequestMaxBytes
+    )
+  );
+  if (!parsed.success) {
+    throw new SpotPatchError7(ERROR_CODES7.INVALID_REQUEST);
+  }
+  return analyzeTarget(parsed.data, requireAnalyzer(analyzer), options);
+}
+async function handlePageDataFlowReport(request, analyzer, options) {
+  const parsed = dataFlowPageReportRequestSchema.safeParse(
+    await readJsonRequestBody(
+      request,
+      options.options.dataFlow.limits.protocolRequestMaxBytes
+    )
+  );
+  if (!parsed.success) {
+    throw new SpotPatchError7(ERROR_CODES7.INVALID_REQUEST);
+  }
+  const activeAnalyzer = requireAnalyzer(analyzer);
+  const componentReports = await Promise.all(
+    parsed.data.targets.map((target) => analyzeTarget(target, activeAnalyzer, options))
+  );
+  const dependencies = new Map(
+    componentReports.flatMap(
+      (report2) => report2.dependencies.map((dependency) => [dependency.id, dependency])
+    )
+  );
+  const evidence = new Map(
+    componentReports.flatMap(
+      (report2) => report2.evidence.map((entry) => [entry.id, entry])
+    )
+  );
+  const diagnostics = new Map(
+    componentReports.flatMap(
+      (report2) => report2.diagnostics.map((entry) => [entry.id, entry])
+    )
+  );
+  const analyzedVersions = new Set(
+    componentReports.flatMap((report2) => report2.baseline.analyzedSourceVersions)
+  );
+  const reportId = `page_${createHash2("sha256").update(componentReports.map((report2) => report2.reportId).join("\0")).digest("base64url").slice(0, 22)}`;
+  const complete = componentReports.every((report2) => report2.completeness.complete);
+  const report = Object.freeze({
+    schemaVersion: DATA_FLOW_SCHEMA_VERSION,
+    reportId,
+    baseline: Object.freeze({
+      registryEpoch: options.session.id,
+      analyzerVersion: componentReports[0]?.baseline.analyzerVersion ?? "unavailable",
+      adapterSetHash: componentReports[0]?.baseline.adapterSetHash ?? "unavailable",
+      analyzedSourceVersions: Object.freeze([...analyzedVersions].sort())
+    }),
+    capability: Object.freeze({
+      enabled: true,
+      staticAnalysis: complete ? "available" : "partial",
+      runtimeObservation: "dispatch-only",
+      responseShape: "consumed-fields-only",
+      aiAssistance: "disabled",
+      reasons: Object.freeze(
+        componentReports.flatMap((report2) => report2.capability.reasons)
+      )
+    }),
+    dependencies: Object.freeze([...dependencies.values()]),
+    evidence: Object.freeze([...evidence.values()]),
+    diagnostics: Object.freeze([...diagnostics.values()]),
+    completeness: Object.freeze({
+      complete,
+      visitedModules: componentReports.reduce(
+        (total, report2) => total + report2.completeness.visitedModules,
+        0
+      ),
+      visitedCallsites: componentReports.reduce(
+        (total, report2) => total + report2.completeness.visitedCallsites,
+        0
+      ),
+      frontierCount: componentReports.reduce(
+        (total, report2) => total + report2.completeness.frontierCount,
+        0
+      )
+    })
+  });
+  return limitDataFlowReportToBytes(
+    report,
+    options.options.dataFlow.limits.reportMaxBytes
+  );
+}
+
 // src/server/request-security.ts
 import { timingSafeEqual } from "crypto";
 import { isIP } from "net";
-import { ERROR_CODES as ERROR_CODES7, SPOTPATCH_TOKEN_HEADER, SpotPatchError as SpotPatchError7 } from "@spotpatch/shared";
+import { ERROR_CODES as ERROR_CODES8, SPOTPATCH_TOKEN_HEADER, SpotPatchError as SpotPatchError8 } from "@spotpatch/shared";
 function getSingleHeader(request, name) {
   const value = request.headers[name.toLowerCase()];
   return Array.isArray(value) ? value[0] : value;
@@ -2192,32 +2438,32 @@ function parseOrigin(value) {
 function assertRequestAuthorized(request, options) {
   const actualToken = getSingleHeader(request, SPOTPATCH_TOKEN_HEADER);
   if (!tokensMatch(actualToken, options.sessionToken)) {
-    throw new SpotPatchError7(ERROR_CODES7.INVALID_TOKEN);
+    throw new SpotPatchError8(ERROR_CODES8.INVALID_TOKEN);
   }
   const hostHeader = getSingleHeader(request, "host");
   const originHeader = getSingleHeader(request, "origin");
   const host = hostHeader === void 0 ? void 0 : parseHost(hostHeader);
   const origin = originHeader === void 0 ? void 0 : parseOrigin(originHeader);
   if (host === void 0 || origin === void 0) {
-    throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
+    throw new SpotPatchError8(ERROR_CODES8.ORIGIN_NOT_ALLOWED);
   }
   const hostIsLoopback = isLoopbackHostname(host.hostname);
   const originIsLoopback = isLoopbackHostname(origin.hostname);
   if (!options.allowLan) {
     if (!hostIsLoopback || !originIsLoopback) {
-      throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
+      throw new SpotPatchError8(ERROR_CODES8.ORIGIN_NOT_ALLOWED);
     }
     return;
   }
   if (!originIsLoopback && origin.host.toLowerCase() !== host.host.toLowerCase()) {
-    throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
+    throw new SpotPatchError8(ERROR_CODES8.ORIGIN_NOT_ALLOWED);
   }
 }
 
 // src/server/runtime-bootstrap.ts
 import {
-  ERROR_CODES as ERROR_CODES8,
-  SpotPatchError as SpotPatchError8,
+  ERROR_CODES as ERROR_CODES9,
+  SpotPatchError as SpotPatchError9,
   runtimeBootstrapRequestSchema,
   runtimeConfigSchema
 } from "@spotpatch/shared";
@@ -2247,7 +2493,7 @@ function resolveRuntimeBootstrapOptions(options) {
 function assertRuntimeBootstrapRequest(request, expectedOrigin) {
   const contentType = getSingleHeader2(request, "content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (request.method !== "POST" || contentType !== "application/json") {
-    throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
+    throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
   }
   const host = getSingleHeader2(request, "host");
   let hostIsLoopback = false;
@@ -2259,7 +2505,7 @@ function assertRuntimeBootstrapRequest(request, expectedOrigin) {
     }
   }
   if (!hostIsLoopback || getSingleHeader2(request, "origin") !== expectedOrigin || getSingleHeader2(request, "sec-fetch-site") !== "same-origin") {
-    throw new SpotPatchError8(ERROR_CODES8.ORIGIN_NOT_ALLOWED);
+    throw new SpotPatchError9(ERROR_CODES9.ORIGIN_NOT_ALLOWED);
   }
 }
 async function readRuntimeBootstrap(request, options) {
@@ -2268,81 +2514,87 @@ async function readRuntimeBootstrap(request, options) {
     await readJsonRequestBody(request)
   );
   if (!parsedBody.success) {
-    throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
+    throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
   }
   return options.runtimeConfig;
 }
 
 // src/server/middleware.ts
 var STATUS_BY_ERROR = Object.freeze({
-  [ERROR_CODES9.INVALID_REQUEST]: 400,
-  [ERROR_CODES9.INVALID_TOKEN]: 401,
-  [ERROR_CODES9.ORIGIN_NOT_ALLOWED]: 403,
-  [ERROR_CODES9.SOURCE_NOT_FOUND]: 404,
-  [ERROR_CODES9.SOURCE_OUTSIDE_ROOT]: 403,
-  [ERROR_CODES9.SOURCE_TOO_LARGE]: 413,
-  [ERROR_CODES9.EDITOR_OPEN_FAILED]: 500,
-  [ERROR_CODES9.AI_DISABLED]: 404,
-  [ERROR_CODES9.PROVIDER_NOT_CONFIGURED]: 503,
-  [ERROR_CODES9.PROVIDER_AUTH_FAILED]: 502,
-  [ERROR_CODES9.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
-  [ERROR_CODES9.MODEL_NOT_ALLOWED]: 400,
-  [ERROR_CODES9.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
-  [ERROR_CODES9.PROVIDER_RATE_LIMITED]: 429,
-  [ERROR_CODES9.AGENT_BUSY]: 409,
-  [ERROR_CODES9.AGENT_LIMIT_EXCEEDED]: 413,
-  [ERROR_CODES9.AGENT_CANCELLED]: 409,
-  [ERROR_CODES9.WORKTREE_DIRTY]: 409,
-  [ERROR_CODES9.WORKTREE_NOT_REPOSITORY]: 409,
-  [ERROR_CODES9.WORKTREE_OPERATION_IN_PROGRESS]: 409,
-  [ERROR_CODES9.WORKTREE_CONFLICTED]: 409,
-  [ERROR_CODES9.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
-  [ERROR_CODES9.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
-  [ERROR_CODES9.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
-  [ERROR_CODES9.TOOL_DENIED]: 403,
-  [ERROR_CODES9.TOOL_INPUT_INVALID]: 422,
-  [ERROR_CODES9.TOOL_ARGUMENTS_INVALID]: 422,
-  [ERROR_CODES9.TOOL_CALL_ID_CONFLICT]: 422,
-  [ERROR_CODES9.TOOL_PATH_DENIED]: 403,
-  [ERROR_CODES9.PATCH_REJECTED]: 422,
-  [ERROR_CODES9.VALIDATION_FAILED]: 422,
-  [ERROR_CODES9.APPLY_CONFLICT]: 409,
-  [ERROR_CODES9.INTERNAL_ERROR]: 500
+  [ERROR_CODES10.INVALID_REQUEST]: 400,
+  [ERROR_CODES10.INVALID_TOKEN]: 401,
+  [ERROR_CODES10.ORIGIN_NOT_ALLOWED]: 403,
+  [ERROR_CODES10.SOURCE_NOT_FOUND]: 404,
+  [ERROR_CODES10.SOURCE_OUTSIDE_ROOT]: 403,
+  [ERROR_CODES10.SOURCE_TOO_LARGE]: 413,
+  [ERROR_CODES10.EDITOR_OPEN_FAILED]: 500,
+  [ERROR_CODES10.DATA_FLOW_DISABLED]: 404,
+  [ERROR_CODES10.DATA_FLOW_SOURCE_STALE]: 409,
+  [ERROR_CODES10.DATA_FLOW_ANALYSIS_CANCELLED]: 409,
+  [ERROR_CODES10.AI_DISABLED]: 404,
+  [ERROR_CODES10.PROVIDER_NOT_CONFIGURED]: 503,
+  [ERROR_CODES10.PROVIDER_AUTH_FAILED]: 502,
+  [ERROR_CODES10.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
+  [ERROR_CODES10.MODEL_NOT_ALLOWED]: 400,
+  [ERROR_CODES10.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
+  [ERROR_CODES10.PROVIDER_RATE_LIMITED]: 429,
+  [ERROR_CODES10.AGENT_BUSY]: 409,
+  [ERROR_CODES10.AGENT_LIMIT_EXCEEDED]: 413,
+  [ERROR_CODES10.AGENT_CANCELLED]: 409,
+  [ERROR_CODES10.WORKTREE_DIRTY]: 409,
+  [ERROR_CODES10.WORKTREE_NOT_REPOSITORY]: 409,
+  [ERROR_CODES10.WORKTREE_OPERATION_IN_PROGRESS]: 409,
+  [ERROR_CODES10.WORKTREE_CONFLICTED]: 409,
+  [ERROR_CODES10.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
+  [ERROR_CODES10.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
+  [ERROR_CODES10.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
+  [ERROR_CODES10.TOOL_DENIED]: 403,
+  [ERROR_CODES10.TOOL_INPUT_INVALID]: 422,
+  [ERROR_CODES10.TOOL_ARGUMENTS_INVALID]: 422,
+  [ERROR_CODES10.TOOL_CALL_ID_CONFLICT]: 422,
+  [ERROR_CODES10.TOOL_PATH_DENIED]: 403,
+  [ERROR_CODES10.PATCH_REJECTED]: 422,
+  [ERROR_CODES10.VALIDATION_FAILED]: 422,
+  [ERROR_CODES10.APPLY_CONFLICT]: 409,
+  [ERROR_CODES10.INTERNAL_ERROR]: 500
 });
 var PUBLIC_MESSAGES = Object.freeze({
-  [ERROR_CODES9.INVALID_REQUEST]: "The request is invalid.",
-  [ERROR_CODES9.INVALID_TOKEN]: "The session token is invalid.",
-  [ERROR_CODES9.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
-  [ERROR_CODES9.SOURCE_NOT_FOUND]: "The source file is unavailable.",
-  [ERROR_CODES9.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
-  [ERROR_CODES9.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
-  [ERROR_CODES9.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
-  [ERROR_CODES9.AI_DISABLED]: "AI execution is not enabled.",
-  [ERROR_CODES9.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
-  [ERROR_CODES9.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
-  [ERROR_CODES9.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
-  [ERROR_CODES9.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
-  [ERROR_CODES9.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
-  [ERROR_CODES9.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
-  [ERROR_CODES9.AGENT_BUSY]: "Another Agent job is already running.",
-  [ERROR_CODES9.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
-  [ERROR_CODES9.AGENT_CANCELLED]: "The Agent job was cancelled.",
-  [ERROR_CODES9.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
-  [ERROR_CODES9.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
-  [ERROR_CODES9.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
-  [ERROR_CODES9.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
-  [ERROR_CODES9.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
-  [ERROR_CODES9.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
-  [ERROR_CODES9.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
-  [ERROR_CODES9.TOOL_DENIED]: "The Agent tool request was denied.",
-  [ERROR_CODES9.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
-  [ERROR_CODES9.TOOL_ARGUMENTS_INVALID]: "The Agent tool arguments are invalid.",
-  [ERROR_CODES9.TOOL_CALL_ID_CONFLICT]: "A tool call ID conflicts within one Agent turn.",
-  [ERROR_CODES9.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
-  [ERROR_CODES9.PATCH_REJECTED]: "The proposed patch was rejected.",
-  [ERROR_CODES9.VALIDATION_FAILED]: "The proposed change failed validation.",
-  [ERROR_CODES9.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
-  [ERROR_CODES9.INTERNAL_ERROR]: "The request could not be completed."
+  [ERROR_CODES10.INVALID_REQUEST]: "The request is invalid.",
+  [ERROR_CODES10.INVALID_TOKEN]: "The session token is invalid.",
+  [ERROR_CODES10.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
+  [ERROR_CODES10.SOURCE_NOT_FOUND]: "The source file is unavailable.",
+  [ERROR_CODES10.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
+  [ERROR_CODES10.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
+  [ERROR_CODES10.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
+  [ERROR_CODES10.DATA_FLOW_DISABLED]: "Component data-flow analysis is not enabled.",
+  [ERROR_CODES10.DATA_FLOW_SOURCE_STALE]: "The selected source version is stale.",
+  [ERROR_CODES10.DATA_FLOW_ANALYSIS_CANCELLED]: "The data-flow analysis was cancelled.",
+  [ERROR_CODES10.AI_DISABLED]: "AI execution is not enabled.",
+  [ERROR_CODES10.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
+  [ERROR_CODES10.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
+  [ERROR_CODES10.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
+  [ERROR_CODES10.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
+  [ERROR_CODES10.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
+  [ERROR_CODES10.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
+  [ERROR_CODES10.AGENT_BUSY]: "Another Agent job is already running.",
+  [ERROR_CODES10.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
+  [ERROR_CODES10.AGENT_CANCELLED]: "The Agent job was cancelled.",
+  [ERROR_CODES10.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
+  [ERROR_CODES10.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
+  [ERROR_CODES10.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
+  [ERROR_CODES10.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
+  [ERROR_CODES10.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
+  [ERROR_CODES10.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
+  [ERROR_CODES10.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
+  [ERROR_CODES10.TOOL_DENIED]: "The Agent tool request was denied.",
+  [ERROR_CODES10.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
+  [ERROR_CODES10.TOOL_ARGUMENTS_INVALID]: "The Agent tool arguments are invalid.",
+  [ERROR_CODES10.TOOL_CALL_ID_CONFLICT]: "A tool call ID conflicts within one Agent turn.",
+  [ERROR_CODES10.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
+  [ERROR_CODES10.PATCH_REJECTED]: "The proposed patch was rejected.",
+  [ERROR_CODES10.VALIDATION_FAILED]: "The proposed change failed validation.",
+  [ERROR_CODES10.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
+  [ERROR_CODES10.INTERNAL_ERROR]: "The request could not be completed."
 });
 function writeJson(response, status, payload) {
   response.statusCode = status;
@@ -2351,11 +2603,11 @@ function writeJson(response, status, payload) {
   response.end(JSON.stringify(payload));
 }
 function asSpotPatchError(error) {
-  return error instanceof SpotPatchError9 ? error : new SpotPatchError9(ERROR_CODES9.INTERNAL_ERROR, void 0, { cause: error });
+  return error instanceof SpotPatchError10 ? error : new SpotPatchError10(ERROR_CODES10.INTERNAL_ERROR, void 0, { cause: error });
 }
 function writeError(response, error, logger) {
   const normalized = asSpotPatchError(error);
-  if (normalized.code === ERROR_CODES9.INTERNAL_ERROR) {
+  if (normalized.code === ERROR_CODES10.INTERNAL_ERROR) {
     logger?.warn("[spotpatch:server] Internal request failure.");
   }
   writeJson(response, STATUS_BY_ERROR[normalized.code], {
@@ -2378,7 +2630,7 @@ async function handleSourceContext(request, options) {
     await readJsonRequestBody(request)
   );
   if (!parsed.success) {
-    throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+    throw new SpotPatchError10(ERROR_CODES10.INVALID_REQUEST);
   }
   return readSourceContext({
     request: parsed.data,
@@ -2391,7 +2643,7 @@ async function handleSourceContext(request, options) {
 async function handleOpenEditor(request, options) {
   const parsed = openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
   if (!parsed.success) {
-    throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+    throw new SpotPatchError10(ERROR_CODES10.INVALID_REQUEST);
   }
   const body = parsed.data;
   const sourcePath = await resolveSourceFile({
@@ -2408,17 +2660,18 @@ async function handleOpenEditor(request, options) {
     options.logger?.warn(
       `[spotpatch:server] ${options.options.editor === "auto" ? "The detected editor" : options.options.editor} rejected an editor request.`
     );
-    throw new SpotPatchError9(ERROR_CODES9.EDITOR_OPEN_FAILED, void 0, {
+    throw new SpotPatchError10(ERROR_CODES10.EDITOR_OPEN_FAILED, void 0, {
       cause: error
     });
   }
 }
 function createSpotPatchMiddleware(options) {
   const bootstrap = options.bootstrap === void 0 ? void 0 : resolveRuntimeBootstrapOptions(options.bootstrap);
+  const dataFlowAnalyzer = createDataFlowAnalyzer(options);
   return (request, response, next) => {
     const path8 = requestPath(request);
     const agentRoute = matchAgentRequestPath(path8);
-    if (path8 !== SPOTPATCH_ENDPOINTS2.sourceContext && path8 !== SPOTPATCH_ENDPOINTS2.openEditor && agentRoute === void 0 && !path8.startsWith(`${SPOTPATCH_API_BASE}/`)) {
+    if (path8 !== SPOTPATCH_ENDPOINTS2.sourceContext && path8 !== SPOTPATCH_ENDPOINTS2.openEditor && path8 !== SPOTPATCH_ENDPOINTS2.dataFlowComponentReport && path8 !== SPOTPATCH_ENDPOINTS2.dataFlowPageReport && agentRoute === void 0 && !path8.startsWith(`${SPOTPATCH_API_BASE}/`)) {
       next();
       return;
     }
@@ -2437,7 +2690,7 @@ function createSpotPatchMiddleware(options) {
       });
       if (path8 === SPOTPATCH_ENDPOINTS2.sourceContext) {
         if (request.method !== "POST") {
-          throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+          throw new SpotPatchError10(ERROR_CODES10.INVALID_REQUEST);
         }
         const data = await handleSourceContext(request, options);
         writeJson(response, 200, { ok: true, data });
@@ -2445,14 +2698,34 @@ function createSpotPatchMiddleware(options) {
       }
       if (path8 === SPOTPATCH_ENDPOINTS2.openEditor) {
         if (request.method !== "POST") {
-          throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+          throw new SpotPatchError10(ERROR_CODES10.INVALID_REQUEST);
         }
         const data = await handleOpenEditor(request, options);
         writeJson(response, 200, { ok: true, data });
         return;
       }
+      if (path8 === SPOTPATCH_ENDPOINTS2.dataFlowComponentReport) {
+        if (request.method !== "POST") {
+          throw new SpotPatchError10(ERROR_CODES10.INVALID_REQUEST);
+        }
+        const data = await handleComponentDataFlowReport(
+          request,
+          dataFlowAnalyzer,
+          options
+        );
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
+      if (path8 === SPOTPATCH_ENDPOINTS2.dataFlowPageReport) {
+        if (request.method !== "POST") {
+          throw new SpotPatchError10(ERROR_CODES10.INVALID_REQUEST);
+        }
+        const data = await handlePageDataFlowReport(request, dataFlowAnalyzer, options);
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
       if (agentRoute === void 0) {
-        throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+        throw new SpotPatchError10(ERROR_CODES10.INVALID_REQUEST);
       }
       await handleAgentRequest(
         request,
@@ -2603,6 +2876,7 @@ var OPTION_KEYS = Object.freeze([
   "allowLan",
   "budget",
   "debug",
+  "dataFlow",
   "editor",
   "enabled",
   "exclude",
@@ -2690,6 +2964,9 @@ function serializeResolvedSpotPatchOptions(options) {
     allowLan: options.allowLan,
     budget: options.budget,
     debug: options.debug,
+    dataFlow: options.dataFlow.enabled ? Object.freeze({
+      runtime: options.dataFlow.runtime
+    }) : false,
     editor: options.editor,
     enabled: options.enabled,
     exclude: Object.freeze(options.exclude.map(serializeFilter)),
@@ -2732,6 +3009,15 @@ function parseBudget(value) {
   );
   return Object.freeze(budget);
 }
+function parseDataFlow(value) {
+  if (value === false) return false;
+  if (!isRecord2(value) || !hasExactKeys(value, ["runtime"]) || value.runtime !== "dispatch") {
+    throw new TypeError("The SpotPatch data-flow transport is invalid.");
+  }
+  return Object.freeze({
+    runtime: value.runtime
+  });
+}
 function parseSerializedSpotPatchOptions(value) {
   if (!isRecord2(value) || !hasExactKeys(value, OPTION_KEYS)) {
     throw new TypeError("The SpotPatch options transport is invalid.");
@@ -2745,6 +3031,7 @@ function parseSerializedSpotPatchOptions(value) {
       allowLan: value.allowLan,
       budget: parseBudget(value.budget),
       debug: value.debug,
+      dataFlow: parseDataFlow(value.dataFlow),
       editor: value.editor,
       enabled: value.enabled,
       exclude: parseFilterList(value.exclude),
@@ -2767,6 +3054,7 @@ export {
   createAgentJobManager,
   createIntegrationFileChange,
   createRuntimeAiConfig,
+  createRuntimeDataFlowConfig,
   createSession,
   createSourceRegistrationService,
   createSourceRegistry,