@spotpatch/dev-server 0.4.0 → 0.5.0

package/dist/index.cjs

@@ -36,6 +36,7 @@ __export(index_exports, {
   createAgentJobManager: () => createAgentJobManager,
   createIntegrationFileChange: () => createIntegrationFileChange,
   createRuntimeAiConfig: () => createRuntimeAiConfig,
+  createRuntimeDataFlowConfig: () => createRuntimeDataFlowConfig,
   createSession: () => createSession,
   createSourceRegistrationService: () => createSourceRegistrationService,
   createSourceRegistry: () => createSourceRegistry,
@@ -785,7 +786,7 @@ var DEFAULT_EXCLUDE = Object.freeze([
   /(?:^|\/)dist(?:\/|$)/,
   /(?:^|\/)coverage(?:\/|$)/
 ]);
-var DEFAULT_INCLUDE = Object.freeze([/(?:^|[/\\])src[/\\].+\.(?:jsx|tsx)$/]);
+var DEFAULT_INCLUDE = Object.freeze([/(?:^|[/\\])src[/\\].+\.(?:js|jsx|ts|tsx)$/]);
 var DEFAULT_BUDGET = Object.freeze({
   totalCharacters: 16e3,
   domCharacters: 3e3,
@@ -806,7 +807,12 @@ var DEFAULT_OPTIONS = Object.freeze({
   debug: false,
   locale: "auto",
   maxTargets: 8,
-  ai: false
+  ai: false,
+  dataFlow: Object.freeze({
+    enabled: false,
+    runtime: "dispatch",
+    limits: import_shared2.DEFAULT_DATA_FLOW_LIMITS
+  })
 });
 var PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 var ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]{1,127}$/;
@@ -1098,6 +1104,36 @@ function assertPositiveBudget(budget) {
     }
   }
 }
+function resolveDataFlowOptions(options) {
+  if (options === void 0 || options === false) {
+    return DEFAULT_OPTIONS.dataFlow;
+  }
+  const candidate = options;
+  if (typeof candidate !== "object" || candidate === null) {
+    throw new RangeError("SpotPatch dataFlow configuration is invalid.");
+  }
+  const runtime = options.runtime ?? "dispatch";
+  if (runtime !== "dispatch") {
+    throw new RangeError("SpotPatch dataFlow runtime mode is invalid.");
+  }
+  return Object.freeze({
+    enabled: true,
+    runtime,
+    limits: import_shared2.DEFAULT_DATA_FLOW_LIMITS
+  });
+}
+function createRuntimeDataFlowConfig(options) {
+  return Object.freeze({
+    enabled: options.enabled,
+    runtime: options.runtime,
+    limits: Object.freeze({
+      observationMaxEntries: options.limits.observationMaxEntries,
+      observationMaxBytes: options.limits.observationMaxBytes,
+      observationTtlMs: options.limits.observationTtlMs,
+      reportMaxBytes: options.limits.reportMaxBytes
+    })
+  });
+}
 function resolveOptions(options = {}, environmentAi) {
   if (options.trustedFastMode !== void 0 && typeof options.trustedFastMode !== "boolean") {
     throw new RangeError("SpotPatch trustedFastMode must be a boolean.");
@@ -1133,7 +1169,8 @@ function resolveOptions(options = {}, environmentAi) {
     debug: options.debug ?? DEFAULT_OPTIONS.debug,
     locale,
     maxTargets,
-    ai: resolveAiOptions(options.ai ?? environmentAi)
+    ai: resolveAiOptions(options.ai ?? environmentAi),
+    dataFlow: resolveDataFlowOptions(options.dataFlow)
   };
   if (resolved.shortcut.trim().length === 0 || resolved.shortcut.length > 128 || resolved.shortcut.includes("\0")) {
     throw new RangeError("SpotPatch shortcut is invalid.");
@@ -1319,33 +1356,58 @@ function createSourceRegistry(options = {}) {
   const createId = options.createId ?? createRandomSourceId;
   const pathToId = /* @__PURE__ */ new Map();
   const idToPath = /* @__PURE__ */ new Map();
+  const componentAnchors = /* @__PURE__ */ new Map();
+  const componentIdsByPath = /* @__PURE__ */ new Map();
+  function registerSourcePath(absolutePath) {
+    const normalizedPath = normalizeAbsolutePath(absolutePath);
+    const existingId = pathToId.get(normalizedPath);
+    if (existingId !== void 0) {
+      return existingId;
+    }
+    let fileId = createId();
+    while (idToPath.has(fileId)) fileId = createId();
+    pathToId.set(normalizedPath, fileId);
+    idToPath.set(fileId, normalizedPath);
+    return fileId;
+  }
   return Object.freeze({
     register(absolutePath) {
+      return registerSourcePath(absolutePath);
+    },
+    registerDataFlowComponents(absolutePath, sourceVersion, components) {
       const normalizedPath = normalizeAbsolutePath(absolutePath);
-      const existingId = pathToId.get(normalizedPath);
-      if (existingId !== void 0) {
-        return existingId;
+      const previousIds = componentIdsByPath.get(normalizedPath);
+      for (const componentSourceId of previousIds ?? []) {
+        componentAnchors.delete(componentSourceId);
       }
-      let fileId = createId();
-      while (idToPath.has(fileId)) {
-        fileId = createId();
+      const fileId = registerSourcePath(normalizedPath);
+      const currentIds = /* @__PURE__ */ new Set();
+      for (const component of components) {
+        currentIds.add(component.componentSourceId);
+        componentAnchors.set(
+          component.componentSourceId,
+          Object.freeze({ ...component, fileId, sourceVersion })
+        );
       }
-      pathToId.set(normalizedPath, fileId);
-      idToPath.set(fileId, normalizedPath);
-      return fileId;
+      componentIdsByPath.set(normalizedPath, currentIds);
     },
     resolve(fileId) {
       return idToPath.get(fileId);
     },
+    resolveDataFlowComponent(componentSourceId) {
+      return componentAnchors.get(componentSourceId);
+    },
     clear() {
       pathToId.clear();
       idToPath.clear();
+      componentAnchors.clear();
+      componentIdsByPath.clear();
     }
   });
 }
 
 // src/server/middleware.ts
-var import_shared10 = require("@spotpatch/shared");
+var import_shared11 = require("@spotpatch/shared");
 
 // src/server/agent-http.ts
 var import_shared7 = require("@spotpatch/shared");
@@ -2158,10 +2220,177 @@ function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
 }
 var launchConfiguredEditor = createEditorLauncher();
 
-// src/server/request-security.ts
+// src/server/data-flow-http.ts
 var import_node_crypto4 = require("crypto");
-var import_node_net = require("net");
+var import_analyzer = require("@spotpatch/analyzer");
 var import_shared8 = require("@spotpatch/shared");
+function envelopeBytes(report) {
+  return Buffer.byteLength(JSON.stringify({ ok: true, data: report }), "utf8");
+}
+function limitDataFlowReportToBytes(report, maximumBytes) {
+  const structurallyLimited = (0, import_shared8.limitDataFlowReportCollections)(report);
+  if (envelopeBytes(structurallyLimited) <= maximumBytes) {
+    return structurallyLimited;
+  }
+  let limited = (0, import_shared8.limitDataFlowReportCollections)(structurallyLimited, {
+    forceTruncation: true,
+    maximumDependencies: 0,
+    truncatedBy: "bytes"
+  });
+  if (envelopeBytes(limited) > maximumBytes) {
+    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.INTERNAL_ERROR);
+  }
+  for (let maximumDependencies = 1; maximumDependencies <= structurallyLimited.dependencies.length; maximumDependencies += 1) {
+    const candidate = (0, import_shared8.limitDataFlowReportCollections)(structurallyLimited, {
+      forceTruncation: true,
+      maximumDependencies,
+      truncatedBy: "bytes"
+    });
+    if (envelopeBytes(candidate) > maximumBytes) break;
+    limited = candidate;
+  }
+  return limited;
+}
+function createDataFlowAnalyzer(options) {
+  if (!options.options.dataFlow.enabled) return void 0;
+  return (0, import_analyzer.createStaticDataFlowAnalyzer)({
+    root: options.root,
+    registryEpoch: options.session.id,
+    registerSource: (absolutePath) => options.registry.register(absolutePath),
+    limits: options.options.dataFlow.limits
+  });
+}
+async function analyzeTarget(request, analyzer, options) {
+  const resolvedRequest = (() => {
+    if ("componentSourceId" in request) {
+      const anchor = options.registry.resolveDataFlowComponent(
+        request.componentSourceId
+      );
+      if (anchor?.sourceVersion !== request.sourceVersion) {
+        throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.DATA_FLOW_SOURCE_STALE);
+      }
+      return anchor;
+    }
+    return request;
+  })();
+  const absolutePath = await resolveSourceFile({
+    fileId: resolvedRequest.fileId,
+    registry: options.registry,
+    root: options.root
+  });
+  const report = analyzer.analyzeComponent({
+    absolutePath,
+    line: resolvedRequest.line,
+    column: resolvedRequest.column
+  });
+  if (resolvedRequest.sourceVersion !== void 0 && resolvedRequest.sourceVersion !== report.component.source.sourceVersion) {
+    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.DATA_FLOW_SOURCE_STALE);
+  }
+  return limitDataFlowReportToBytes(
+    report,
+    options.options.dataFlow.limits.reportMaxBytes
+  );
+}
+function requireAnalyzer(analyzer) {
+  if (analyzer === void 0) {
+    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.DATA_FLOW_DISABLED);
+  }
+  return analyzer;
+}
+async function handleComponentDataFlowReport(request, analyzer, options) {
+  const parsed = import_shared8.dataFlowComponentReportRequestSchema.safeParse(
+    await readJsonRequestBody(
+      request,
+      options.options.dataFlow.limits.protocolRequestMaxBytes
+    )
+  );
+  if (!parsed.success) {
+    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.INVALID_REQUEST);
+  }
+  return analyzeTarget(parsed.data, requireAnalyzer(analyzer), options);
+}
+async function handlePageDataFlowReport(request, analyzer, options) {
+  const parsed = import_shared8.dataFlowPageReportRequestSchema.safeParse(
+    await readJsonRequestBody(
+      request,
+      options.options.dataFlow.limits.protocolRequestMaxBytes
+    )
+  );
+  if (!parsed.success) {
+    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.INVALID_REQUEST);
+  }
+  const activeAnalyzer = requireAnalyzer(analyzer);
+  const componentReports = await Promise.all(
+    parsed.data.targets.map((target) => analyzeTarget(target, activeAnalyzer, options))
+  );
+  const dependencies = new Map(
+    componentReports.flatMap(
+      (report2) => report2.dependencies.map((dependency) => [dependency.id, dependency])
+    )
+  );
+  const evidence = new Map(
+    componentReports.flatMap(
+      (report2) => report2.evidence.map((entry) => [entry.id, entry])
+    )
+  );
+  const diagnostics = new Map(
+    componentReports.flatMap(
+      (report2) => report2.diagnostics.map((entry) => [entry.id, entry])
+    )
+  );
+  const analyzedVersions = new Set(
+    componentReports.flatMap((report2) => report2.baseline.analyzedSourceVersions)
+  );
+  const reportId = `page_${(0, import_node_crypto4.createHash)("sha256").update(componentReports.map((report2) => report2.reportId).join("\0")).digest("base64url").slice(0, 22)}`;
+  const complete = componentReports.every((report2) => report2.completeness.complete);
+  const report = Object.freeze({
+    schemaVersion: import_shared8.DATA_FLOW_SCHEMA_VERSION,
+    reportId,
+    baseline: Object.freeze({
+      registryEpoch: options.session.id,
+      analyzerVersion: componentReports[0]?.baseline.analyzerVersion ?? "unavailable",
+      adapterSetHash: componentReports[0]?.baseline.adapterSetHash ?? "unavailable",
+      analyzedSourceVersions: Object.freeze([...analyzedVersions].sort())
+    }),
+    capability: Object.freeze({
+      enabled: true,
+      staticAnalysis: complete ? "available" : "partial",
+      runtimeObservation: "dispatch-only",
+      responseShape: "consumed-fields-only",
+      aiAssistance: "disabled",
+      reasons: Object.freeze(
+        componentReports.flatMap((report2) => report2.capability.reasons)
+      )
+    }),
+    dependencies: Object.freeze([...dependencies.values()]),
+    evidence: Object.freeze([...evidence.values()]),
+    diagnostics: Object.freeze([...diagnostics.values()]),
+    completeness: Object.freeze({
+      complete,
+      visitedModules: componentReports.reduce(
+        (total, report2) => total + report2.completeness.visitedModules,
+        0
+      ),
+      visitedCallsites: componentReports.reduce(
+        (total, report2) => total + report2.completeness.visitedCallsites,
+        0
+      ),
+      frontierCount: componentReports.reduce(
+        (total, report2) => total + report2.completeness.frontierCount,
+        0
+      )
+    })
+  });
+  return limitDataFlowReportToBytes(
+    report,
+    options.options.dataFlow.limits.reportMaxBytes
+  );
+}
+
+// src/server/request-security.ts
+var import_node_crypto5 = require("crypto");
+var import_node_net = require("net");
+var import_shared9 = require("@spotpatch/shared");
 function getSingleHeader(request, name) {
   const value = request.headers[name.toLowerCase()];
   return Array.isArray(value) ? value[0] : value;
@@ -2172,7 +2401,7 @@ function tokensMatch(actual, expected) {
   }
   const actualBytes = Buffer.from(actual);
   const expectedBytes = Buffer.from(expected);
-  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto4.timingSafeEqual)(actualBytes, expectedBytes);
+  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto5.timingSafeEqual)(actualBytes, expectedBytes);
 }
 function isLoopbackHostname(hostname) {
   const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
@@ -2206,32 +2435,32 @@ function parseOrigin(value) {
   }
 }
 function assertRequestAuthorized(request, options) {
-  const actualToken = getSingleHeader(request, import_shared8.SPOTPATCH_TOKEN_HEADER);
+  const actualToken = getSingleHeader(request, import_shared9.SPOTPATCH_TOKEN_HEADER);
   if (!tokensMatch(actualToken, options.sessionToken)) {
-    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.INVALID_TOKEN);
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INVALID_TOKEN);
   }
   const hostHeader = getSingleHeader(request, "host");
   const originHeader = getSingleHeader(request, "origin");
   const host = hostHeader === void 0 ? void 0 : parseHost(hostHeader);
   const origin = originHeader === void 0 ? void 0 : parseOrigin(originHeader);
   if (host === void 0 || origin === void 0) {
-    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.ORIGIN_NOT_ALLOWED);
   }
   const hostIsLoopback = isLoopbackHostname(host.hostname);
   const originIsLoopback = isLoopbackHostname(origin.hostname);
   if (!options.allowLan) {
     if (!hostIsLoopback || !originIsLoopback) {
-      throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+      throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.ORIGIN_NOT_ALLOWED);
     }
     return;
   }
   if (!originIsLoopback && origin.host.toLowerCase() !== host.host.toLowerCase()) {
-    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.ORIGIN_NOT_ALLOWED);
   }
 }
 
 // src/server/runtime-bootstrap.ts
-var import_shared9 = require("@spotpatch/shared");
+var import_shared10 = require("@spotpatch/shared");
 function getSingleHeader2(request, name) {
   const value = request.headers[name.toLowerCase()];
   return Array.isArray(value) ? value[0] : value;
@@ -2246,7 +2475,7 @@ function resolveRuntimeBootstrapOptions(options) {
   if (expectedOrigin.origin !== options.expectedOrigin || expectedOrigin.protocol !== "http:" || !isLoopbackHostname(expectedOrigin.hostname)) {
     throw new TypeError("The SpotPatch bootstrap origin must be a loopback origin.");
   }
-  const parsedConfig = import_shared9.runtimeConfigSchema.safeParse(options.runtimeConfig);
+  const parsedConfig = import_shared10.runtimeConfigSchema.safeParse(options.runtimeConfig);
   if (!parsedConfig.success) {
     throw new TypeError("The SpotPatch Runtime configuration is invalid.");
   }
@@ -2258,7 +2487,7 @@ function resolveRuntimeBootstrapOptions(options) {
 function assertRuntimeBootstrapRequest(request, expectedOrigin) {
   const contentType = getSingleHeader2(request, "content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (request.method !== "POST" || contentType !== "application/json") {
-    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
   }
   const host = getSingleHeader2(request, "host");
   let hostIsLoopback = false;
@@ -2270,90 +2499,96 @@ function assertRuntimeBootstrapRequest(request, expectedOrigin) {
     }
   }
   if (!hostIsLoopback || getSingleHeader2(request, "origin") !== expectedOrigin || getSingleHeader2(request, "sec-fetch-site") !== "same-origin") {
-    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.ORIGIN_NOT_ALLOWED);
   }
 }
 async function readRuntimeBootstrap(request, options) {
   assertRuntimeBootstrapRequest(request, options.expectedOrigin);
-  const parsedBody = import_shared9.runtimeBootstrapRequestSchema.safeParse(
+  const parsedBody = import_shared10.runtimeBootstrapRequestSchema.safeParse(
     await readJsonRequestBody(request)
   );
   if (!parsedBody.success) {
-    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
   }
   return options.runtimeConfig;
 }
 
 // src/server/middleware.ts
 var STATUS_BY_ERROR = Object.freeze({
-  [import_shared10.ERROR_CODES.INVALID_REQUEST]: 400,
-  [import_shared10.ERROR_CODES.INVALID_TOKEN]: 401,
-  [import_shared10.ERROR_CODES.ORIGIN_NOT_ALLOWED]: 403,
-  [import_shared10.ERROR_CODES.SOURCE_NOT_FOUND]: 404,
-  [import_shared10.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: 403,
-  [import_shared10.ERROR_CODES.SOURCE_TOO_LARGE]: 413,
-  [import_shared10.ERROR_CODES.EDITOR_OPEN_FAILED]: 500,
-  [import_shared10.ERROR_CODES.AI_DISABLED]: 404,
-  [import_shared10.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: 503,
-  [import_shared10.ERROR_CODES.PROVIDER_AUTH_FAILED]: 502,
-  [import_shared10.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
-  [import_shared10.ERROR_CODES.MODEL_NOT_ALLOWED]: 400,
-  [import_shared10.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
-  [import_shared10.ERROR_CODES.PROVIDER_RATE_LIMITED]: 429,
-  [import_shared10.ERROR_CODES.AGENT_BUSY]: 409,
-  [import_shared10.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: 413,
-  [import_shared10.ERROR_CODES.AGENT_CANCELLED]: 409,
-  [import_shared10.ERROR_CODES.WORKTREE_DIRTY]: 409,
-  [import_shared10.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: 409,
-  [import_shared10.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: 409,
-  [import_shared10.ERROR_CODES.WORKTREE_CONFLICTED]: 409,
-  [import_shared10.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
-  [import_shared10.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
-  [import_shared10.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
-  [import_shared10.ERROR_CODES.TOOL_DENIED]: 403,
-  [import_shared10.ERROR_CODES.TOOL_INPUT_INVALID]: 422,
-  [import_shared10.ERROR_CODES.TOOL_ARGUMENTS_INVALID]: 422,
-  [import_shared10.ERROR_CODES.TOOL_CALL_ID_CONFLICT]: 422,
-  [import_shared10.ERROR_CODES.TOOL_PATH_DENIED]: 403,
-  [import_shared10.ERROR_CODES.PATCH_REJECTED]: 422,
-  [import_shared10.ERROR_CODES.VALIDATION_FAILED]: 422,
-  [import_shared10.ERROR_CODES.APPLY_CONFLICT]: 409,
-  [import_shared10.ERROR_CODES.INTERNAL_ERROR]: 500
+  [import_shared11.ERROR_CODES.INVALID_REQUEST]: 400,
+  [import_shared11.ERROR_CODES.INVALID_TOKEN]: 401,
+  [import_shared11.ERROR_CODES.ORIGIN_NOT_ALLOWED]: 403,
+  [import_shared11.ERROR_CODES.SOURCE_NOT_FOUND]: 404,
+  [import_shared11.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: 403,
+  [import_shared11.ERROR_CODES.SOURCE_TOO_LARGE]: 413,
+  [import_shared11.ERROR_CODES.EDITOR_OPEN_FAILED]: 500,
+  [import_shared11.ERROR_CODES.DATA_FLOW_DISABLED]: 404,
+  [import_shared11.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: 409,
+  [import_shared11.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: 409,
+  [import_shared11.ERROR_CODES.AI_DISABLED]: 404,
+  [import_shared11.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: 503,
+  [import_shared11.ERROR_CODES.PROVIDER_AUTH_FAILED]: 502,
+  [import_shared11.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
+  [import_shared11.ERROR_CODES.MODEL_NOT_ALLOWED]: 400,
+  [import_shared11.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
+  [import_shared11.ERROR_CODES.PROVIDER_RATE_LIMITED]: 429,
+  [import_shared11.ERROR_CODES.AGENT_BUSY]: 409,
+  [import_shared11.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: 413,
+  [import_shared11.ERROR_CODES.AGENT_CANCELLED]: 409,
+  [import_shared11.ERROR_CODES.WORKTREE_DIRTY]: 409,
+  [import_shared11.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: 409,
+  [import_shared11.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: 409,
+  [import_shared11.ERROR_CODES.WORKTREE_CONFLICTED]: 409,
+  [import_shared11.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
+  [import_shared11.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
+  [import_shared11.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
+  [import_shared11.ERROR_CODES.TOOL_DENIED]: 403,
+  [import_shared11.ERROR_CODES.TOOL_INPUT_INVALID]: 422,
+  [import_shared11.ERROR_CODES.TOOL_ARGUMENTS_INVALID]: 422,
+  [import_shared11.ERROR_CODES.TOOL_CALL_ID_CONFLICT]: 422,
+  [import_shared11.ERROR_CODES.TOOL_PATH_DENIED]: 403,
+  [import_shared11.ERROR_CODES.PATCH_REJECTED]: 422,
+  [import_shared11.ERROR_CODES.VALIDATION_FAILED]: 422,
+  [import_shared11.ERROR_CODES.APPLY_CONFLICT]: 409,
+  [import_shared11.ERROR_CODES.INTERNAL_ERROR]: 500
 });
 var PUBLIC_MESSAGES = Object.freeze({
-  [import_shared10.ERROR_CODES.INVALID_REQUEST]: "The request is invalid.",
-  [import_shared10.ERROR_CODES.INVALID_TOKEN]: "The session token is invalid.",
-  [import_shared10.ERROR_CODES.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
-  [import_shared10.ERROR_CODES.SOURCE_NOT_FOUND]: "The source file is unavailable.",
-  [import_shared10.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
-  [import_shared10.ERROR_CODES.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
-  [import_shared10.ERROR_CODES.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
-  [import_shared10.ERROR_CODES.AI_DISABLED]: "AI execution is not enabled.",
-  [import_shared10.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
-  [import_shared10.ERROR_CODES.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
-  [import_shared10.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
-  [import_shared10.ERROR_CODES.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
-  [import_shared10.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
-  [import_shared10.ERROR_CODES.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
-  [import_shared10.ERROR_CODES.AGENT_BUSY]: "Another Agent job is already running.",
-  [import_shared10.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
-  [import_shared10.ERROR_CODES.AGENT_CANCELLED]: "The Agent job was cancelled.",
-  [import_shared10.ERROR_CODES.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
-  [import_shared10.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
-  [import_shared10.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
-  [import_shared10.ERROR_CODES.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
-  [import_shared10.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
-  [import_shared10.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
-  [import_shared10.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
-  [import_shared10.ERROR_CODES.TOOL_DENIED]: "The Agent tool request was denied.",
-  [import_shared10.ERROR_CODES.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
-  [import_shared10.ERROR_CODES.TOOL_ARGUMENTS_INVALID]: "The Agent tool arguments are invalid.",
-  [import_shared10.ERROR_CODES.TOOL_CALL_ID_CONFLICT]: "A tool call ID conflicts within one Agent turn.",
-  [import_shared10.ERROR_CODES.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
-  [import_shared10.ERROR_CODES.PATCH_REJECTED]: "The proposed patch was rejected.",
-  [import_shared10.ERROR_CODES.VALIDATION_FAILED]: "The proposed change failed validation.",
-  [import_shared10.ERROR_CODES.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
-  [import_shared10.ERROR_CODES.INTERNAL_ERROR]: "The request could not be completed."
+  [import_shared11.ERROR_CODES.INVALID_REQUEST]: "The request is invalid.",
+  [import_shared11.ERROR_CODES.INVALID_TOKEN]: "The session token is invalid.",
+  [import_shared11.ERROR_CODES.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
+  [import_shared11.ERROR_CODES.SOURCE_NOT_FOUND]: "The source file is unavailable.",
+  [import_shared11.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
+  [import_shared11.ERROR_CODES.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
+  [import_shared11.ERROR_CODES.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
+  [import_shared11.ERROR_CODES.DATA_FLOW_DISABLED]: "Component data-flow analysis is not enabled.",
+  [import_shared11.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: "The selected source version is stale.",
+  [import_shared11.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: "The data-flow analysis was cancelled.",
+  [import_shared11.ERROR_CODES.AI_DISABLED]: "AI execution is not enabled.",
+  [import_shared11.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
+  [import_shared11.ERROR_CODES.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
+  [import_shared11.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
+  [import_shared11.ERROR_CODES.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
+  [import_shared11.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
+  [import_shared11.ERROR_CODES.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
+  [import_shared11.ERROR_CODES.AGENT_BUSY]: "Another Agent job is already running.",
+  [import_shared11.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
+  [import_shared11.ERROR_CODES.AGENT_CANCELLED]: "The Agent job was cancelled.",
+  [import_shared11.ERROR_CODES.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
+  [import_shared11.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
+  [import_shared11.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
+  [import_shared11.ERROR_CODES.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
+  [import_shared11.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
+  [import_shared11.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
+  [import_shared11.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
+  [import_shared11.ERROR_CODES.TOOL_DENIED]: "The Agent tool request was denied.",
+  [import_shared11.ERROR_CODES.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
+  [import_shared11.ERROR_CODES.TOOL_ARGUMENTS_INVALID]: "The Agent tool arguments are invalid.",
+  [import_shared11.ERROR_CODES.TOOL_CALL_ID_CONFLICT]: "A tool call ID conflicts within one Agent turn.",
+  [import_shared11.ERROR_CODES.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
+  [import_shared11.ERROR_CODES.PATCH_REJECTED]: "The proposed patch was rejected.",
+  [import_shared11.ERROR_CODES.VALIDATION_FAILED]: "The proposed change failed validation.",
+  [import_shared11.ERROR_CODES.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
+  [import_shared11.ERROR_CODES.INTERNAL_ERROR]: "The request could not be completed."
 });
 function writeJson(response, status, payload) {
   response.statusCode = status;
@@ -2362,11 +2597,11 @@ function writeJson(response, status, payload) {
   response.end(JSON.stringify(payload));
 }
 function asSpotPatchError(error) {
-  return error instanceof import_shared10.SpotPatchError ? error : new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
+  return error instanceof import_shared11.SpotPatchError ? error : new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
 }
 function writeError(response, error, logger) {
   const normalized = asSpotPatchError(error);
-  if (normalized.code === import_shared10.ERROR_CODES.INTERNAL_ERROR) {
+  if (normalized.code === import_shared11.ERROR_CODES.INTERNAL_ERROR) {
     logger?.warn("[spotpatch:server] Internal request failure.");
   }
   writeJson(response, STATUS_BY_ERROR[normalized.code], {
@@ -2385,11 +2620,11 @@ function requestPath(request) {
   }
 }
 async function handleSourceContext(request, options) {
-  const parsed = import_shared10.sourceContextRequestSchema.safeParse(
+  const parsed = import_shared11.sourceContextRequestSchema.safeParse(
     await readJsonRequestBody(request)
   );
   if (!parsed.success) {
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INVALID_REQUEST);
   }
   return readSourceContext({
     request: parsed.data,
@@ -2400,9 +2635,9 @@ async function handleSourceContext(request, options) {
   });
 }
 async function handleOpenEditor(request, options) {
-  const parsed = import_shared10.openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
+  const parsed = import_shared11.openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
   if (!parsed.success) {
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INVALID_REQUEST);
   }
   const body = parsed.data;
   const sourcePath = await resolveSourceFile({
@@ -2419,22 +2654,23 @@ async function handleOpenEditor(request, options) {
     options.logger?.warn(
       `[spotpatch:server] ${options.options.editor === "auto" ? "The detected editor" : options.options.editor} rejected an editor request.`
     );
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.EDITOR_OPEN_FAILED, void 0, {
+    throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.EDITOR_OPEN_FAILED, void 0, {
       cause: error
     });
   }
 }
 function createSpotPatchMiddleware(options) {
   const bootstrap = options.bootstrap === void 0 ? void 0 : resolveRuntimeBootstrapOptions(options.bootstrap);
+  const dataFlowAnalyzer = createDataFlowAnalyzer(options);
   return (request, response, next) => {
     const path8 = requestPath(request);
     const agentRoute = matchAgentRequestPath(path8);
-    if (path8 !== import_shared10.SPOTPATCH_ENDPOINTS.sourceContext && path8 !== import_shared10.SPOTPATCH_ENDPOINTS.openEditor && agentRoute === void 0 && !path8.startsWith(`${import_shared10.SPOTPATCH_API_BASE}/`)) {
+    if (path8 !== import_shared11.SPOTPATCH_ENDPOINTS.sourceContext && path8 !== import_shared11.SPOTPATCH_ENDPOINTS.openEditor && path8 !== import_shared11.SPOTPATCH_ENDPOINTS.dataFlowComponentReport && path8 !== import_shared11.SPOTPATCH_ENDPOINTS.dataFlowPageReport && agentRoute === void 0 && !path8.startsWith(`${import_shared11.SPOTPATCH_API_BASE}/`)) {
       next();
       return;
     }
     const handle = async () => {
-      if (path8 === import_shared10.SPOTPATCH_ENDPOINTS.bootstrap && bootstrap !== void 0) {
+      if (path8 === import_shared11.SPOTPATCH_ENDPOINTS.bootstrap && bootstrap !== void 0) {
         const data = await readRuntimeBootstrap(
           request,
           bootstrap
@@ -2446,24 +2682,44 @@ function createSpotPatchMiddleware(options) {
         allowLan: options.options.allowLan,
         sessionToken: options.session.token
       });
-      if (path8 === import_shared10.SPOTPATCH_ENDPOINTS.sourceContext) {
+      if (path8 === import_shared11.SPOTPATCH_ENDPOINTS.sourceContext) {
         if (request.method !== "POST") {
-          throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
+          throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INVALID_REQUEST);
         }
         const data = await handleSourceContext(request, options);
         writeJson(response, 200, { ok: true, data });
         return;
       }
-      if (path8 === import_shared10.SPOTPATCH_ENDPOINTS.openEditor) {
+      if (path8 === import_shared11.SPOTPATCH_ENDPOINTS.openEditor) {
         if (request.method !== "POST") {
-          throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
+          throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INVALID_REQUEST);
         }
         const data = await handleOpenEditor(request, options);
         writeJson(response, 200, { ok: true, data });
         return;
       }
+      if (path8 === import_shared11.SPOTPATCH_ENDPOINTS.dataFlowComponentReport) {
+        if (request.method !== "POST") {
+          throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INVALID_REQUEST);
+        }
+        const data = await handleComponentDataFlowReport(
+          request,
+          dataFlowAnalyzer,
+          options
+        );
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
+      if (path8 === import_shared11.SPOTPATCH_ENDPOINTS.dataFlowPageReport) {
+        if (request.method !== "POST") {
+          throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INVALID_REQUEST);
+        }
+        const data = await handlePageDataFlowReport(request, dataFlowAnalyzer, options);
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
       if (agentRoute === void 0) {
-        throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.INVALID_REQUEST);
+        throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INVALID_REQUEST);
       }
       await handleAgentRequest(
         request,
@@ -2482,7 +2738,7 @@ function createSpotPatchMiddleware(options) {
 }
 
 // src/server/source-registration.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_promises6 = require("fs/promises");
 var import_node_path7 = __toESM(require("path"), 1);
 var import_compiler = require("@spotpatch/compiler");
@@ -2505,7 +2761,7 @@ function identitiesMatch(actual, expected) {
   }
   const actualBytes = Buffer.from(actual);
   const expectedBytes = Buffer.from(expected);
-  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto5.timingSafeEqual)(actualBytes, expectedBytes);
+  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto6.timingSafeEqual)(actualBytes, expectedBytes);
 }
 function isWithinRoot(root, candidate) {
   const relative = import_node_path7.default.relative(root, candidate);
@@ -2600,11 +2856,11 @@ async function createSourceRegistrationService(input) {
 }
 
 // src/session/session.ts
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 function createSession() {
   return Object.freeze({
-    id: (0, import_node_crypto6.randomBytes)(16).toString("base64url"),
-    token: (0, import_node_crypto6.randomBytes)(16).toString("base64url")
+    id: (0, import_node_crypto7.randomBytes)(16).toString("base64url"),
+    token: (0, import_node_crypto7.randomBytes)(16).toString("base64url")
   });
 }
 
@@ -2614,6 +2870,7 @@ var OPTION_KEYS = Object.freeze([
   "allowLan",
   "budget",
   "debug",
+  "dataFlow",
   "editor",
   "enabled",
   "exclude",
@@ -2701,6 +2958,9 @@ function serializeResolvedSpotPatchOptions(options) {
     allowLan: options.allowLan,
     budget: options.budget,
     debug: options.debug,
+    dataFlow: options.dataFlow.enabled ? Object.freeze({
+      runtime: options.dataFlow.runtime
+    }) : false,
     editor: options.editor,
     enabled: options.enabled,
     exclude: Object.freeze(options.exclude.map(serializeFilter)),
@@ -2743,6 +3003,15 @@ function parseBudget(value) {
   );
   return Object.freeze(budget);
 }
+function parseDataFlow(value) {
+  if (value === false) return false;
+  if (!isRecord2(value) || !hasExactKeys(value, ["runtime"]) || value.runtime !== "dispatch") {
+    throw new TypeError("The SpotPatch data-flow transport is invalid.");
+  }
+  return Object.freeze({
+    runtime: value.runtime
+  });
+}
 function parseSerializedSpotPatchOptions(value) {
   if (!isRecord2(value) || !hasExactKeys(value, OPTION_KEYS)) {
     throw new TypeError("The SpotPatch options transport is invalid.");
@@ -2756,6 +3025,7 @@ function parseSerializedSpotPatchOptions(value) {
       allowLan: value.allowLan,
       budget: parseBudget(value.budget),
       debug: value.debug,
+      dataFlow: parseDataFlow(value.dataFlow),
       editor: value.editor,
       enabled: value.enabled,
       exclude: parseFilterList(value.exclude),
@@ -2779,6 +3049,7 @@ function parseSerializedSpotPatchOptions(value) {
   createAgentJobManager,
   createIntegrationFileChange,
   createRuntimeAiConfig,
+  createRuntimeDataFlowConfig,
   createSession,
   createSourceRegistrationService,
   createSourceRegistry,