@spotpatch/runtime 1.7.1 → 1.9.0

package/dist/index.cjs

@@ -18,12 +18,17 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-var index_exports = {};
-__export(index_exports, {
+var src_exports = {};
+__export(src_exports, {
   UI_MARKER_ATTRIBUTE: () => UI_MARKER_ATTRIBUTE,
-  bootstrapSpotPatch: () => bootstrapSpotPatch
+  bootstrapSpotPatch: () => bootstrapSpotPatch,
+  createDataFlowRuntime: () => createDataFlowRuntime,
+  getDataFlowRuntime: () => getDataFlowRuntime,
+  installDataFlowPrelude: () => installDataFlowPrelude,
+  mergeComponentDataFlowReport: () => mergeComponentDataFlowReport,
+  mergePageDataFlowReport: () => mergePageDataFlowReport
 });
-module.exports = __toCommonJS(index_exports);
+module.exports = __toCommonJS(src_exports);
 
 // src/controller/runtime-controller.ts
 var import_react_adapter = require("@spotpatch/react-adapter");
@@ -348,15 +353,36 @@ function parseJson(text2) {
     throw new RuntimeApiError();
   }
 }
-async function readJsonEnvelope(response) {
+async function readJsonEnvelope(response, maximumBytes = MAX_JSON_RESPONSE_BYTES) {
   const payload = parseJson(
-    await readBoundedText(response, MAX_JSON_RESPONSE_BYTES)
+    await readBoundedText(response, maximumBytes)
   );
   if (!response.ok) {
     throw new RuntimeApiError(readFailureCode(payload));
   }
   return readSuccessData(payload);
 }
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function isReportCompleteness(value) {
+  return isRecord2(value) && typeof value.complete === "boolean" && typeof value.visitedModules === "number" && typeof value.visitedCallsites === "number" && typeof value.frontierCount === "number";
+}
+function isDataFlowCapability(value) {
+  return isRecord2(value) && typeof value.enabled === "boolean" && (value.staticAnalysis === "available" || value.staticAnalysis === "partial" || value.staticAnalysis === "unavailable") && value.runtimeObservation === "dispatch-only" && value.responseShape === "consumed-fields-only" && value.aiAssistance === "disabled" && Array.isArray(value.reasons);
+}
+function isDataFlowDependency(value) {
+  return isRecord2(value) && typeof value.id === "string" && typeof value.kind === "string" && typeof value.direction === "string" && typeof value.execution === "string" && typeof value.proof === "string" && typeof value.association === "string" && Array.isArray(value.parameters) && isRecord2(value.response) && isStringArray(value.response.consumedFields) && isStringArray(value.evidenceIds) && isStringArray(value.observationIds);
+}
+function isDataFlowReportBase(value) {
+  return isRecord2(value) && value.schemaVersion === import_shared3.DATA_FLOW_SCHEMA_VERSION && typeof value.reportId === "string" && isRecord2(value.baseline) && typeof value.baseline.registryEpoch === "string" && typeof value.baseline.analyzerVersion === "string" && isStringArray(value.baseline.analyzedSourceVersions) && isDataFlowCapability(value.capability) && Array.isArray(value.dependencies) && value.dependencies.every(isDataFlowDependency) && Array.isArray(value.evidence) && Array.isArray(value.diagnostics) && isReportCompleteness(value.completeness);
+}
+function isComponentDataFlowReport(value) {
+  return isDataFlowReportBase(value) && isRecord2(value) && isRecord2(value.component) && isRecord2(value.component.source) && typeof value.component.source.fileId === "string" && typeof value.component.source.sourceVersion === "string";
+}
+function isPageDataFlowReport(value) {
+  return isDataFlowReportBase(value);
+}
 function parseCapability(value, expected) {
   if (!isAgentCapabilitySnapshot(value) || value.providerProfileId !== expected.providerProfileId || value.modelProfileId !== expected.modelProfileId) {
     throw new RuntimeApiError();
@@ -408,7 +434,7 @@ function createRuntimeApi(options) {
     }
     pendingRequests.clear();
   }
-  async function requestJson(endpoint, method, body) {
+  async function requestJson(endpoint, method, body, maximumResponseBytes = MAX_JSON_RESPONSE_BYTES) {
     const abortController = new AbortController();
     pendingRequests.add(abortController);
     try {
@@ -421,7 +447,7 @@ function createRuntimeApi(options) {
         ...body === void 0 ? {} : { body: JSON.stringify(body) },
         signal: abortController.signal
       });
-      return await readJsonEnvelope(response);
+      return await readJsonEnvelope(response, maximumResponseBytes);
     } finally {
       pendingRequests.delete(abortController);
     }
@@ -515,6 +541,30 @@ function createRuntimeApi(options) {
       }
       return Object.freeze({ ...data });
     },
+    async componentDataFlowReport(request) {
+      const data = await requestJson(
+        import_shared3.SPOTPATCH_ENDPOINTS.dataFlowComponentReport,
+        "POST",
+        request,
+        options.dataFlowReportMaxBytes
+      );
+      if (!isComponentDataFlowReport(data)) {
+        throw new RuntimeApiError();
+      }
+      return deepFreeze(data);
+    },
+    async pageDataFlowReport(request) {
+      const data = await requestJson(
+        import_shared3.SPOTPATCH_ENDPOINTS.dataFlowPageReport,
+        "POST",
+        request,
+        options.dataFlowReportMaxBytes
+      );
+      if (!isPageDataFlowReport(data)) {
+        throw new RuntimeApiError();
+      }
+      return deepFreeze(data);
+    },
     async openEditor(request) {
       const data = await requestJson(import_shared3.SPOTPATCH_ENDPOINTS.openEditor, "POST", request);
       if (!isRecord2(data) || data.editor !== "auto" && data.editor !== "vscode" && data.editor !== "cursor") {
@@ -2455,6 +2505,12 @@ function createBrandMark(document, content) {
   return svg;
 }
 
+// src/ui/data-flow-panel-contract.ts
+var DATA_FLOW_EXTENSION_KEY = /* @__PURE__ */ Symbol.for("spotpatch.data-flow.extension.v1");
+function getDataFlowExtension(target2 = globalThis) {
+  return target2[DATA_FLOW_EXTENSION_KEY];
+}
+
 // src/ui/dialog-placement.ts
 var VIEWPORT_MARGIN = 16;
 var TARGET_GAP = 14;
@@ -2562,6 +2618,9 @@ var ERROR_MESSAGES_EN = Object.freeze({
   [import_shared6.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "The selected source is outside the project.",
   [import_shared6.ERROR_CODES.SOURCE_TOO_LARGE]: "The selected source exceeds the safety limit.",
   [import_shared6.ERROR_CODES.EDITOR_OPEN_FAILED]: "The editor request failed.",
+  [import_shared6.ERROR_CODES.DATA_FLOW_DISABLED]: "Component data-flow analysis is disabled.",
+  [import_shared6.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: "The selected source changed. Select the component again.",
+  [import_shared6.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: "Component data-flow analysis was cancelled.",
   [import_shared6.ERROR_CODES.AI_DISABLED]: "AI execution is disabled in Vite configuration.",
   [import_shared6.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "The provider Key environment variable is missing on the Vite process.",
   [import_shared6.ERROR_CODES.PROVIDER_AUTH_FAILED]: "The provider rejected authentication. Check the server-side Key.",
@@ -2597,6 +2656,9 @@ var ERROR_MESSAGES_ZH = Object.freeze({
   [import_shared6.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "\u9009\u4E2D\u6E90\u7801\u4F4D\u4E8E\u9879\u76EE\u6839\u76EE\u5F55\u4E4B\u5916\u3002",
   [import_shared6.ERROR_CODES.SOURCE_TOO_LARGE]: "\u9009\u4E2D\u6E90\u7801\u8D85\u8FC7\u5B89\u5168\u5927\u5C0F\u9650\u5236\u3002",
   [import_shared6.ERROR_CODES.EDITOR_OPEN_FAILED]: "\u7F16\u8F91\u5668\u6253\u5F00\u8BF7\u6C42\u5931\u8D25\u3002",
+  [import_shared6.ERROR_CODES.DATA_FLOW_DISABLED]: "\u7EC4\u4EF6\u6570\u636E\u94FE\u8DEF\u5206\u6790\u672A\u542F\u7528\u3002",
+  [import_shared6.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: "\u9009\u4E2D\u6E90\u7801\u5DF2\u7ECF\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9\u7EC4\u4EF6\u3002",
+  [import_shared6.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: "\u7EC4\u4EF6\u6570\u636E\u94FE\u8DEF\u5206\u6790\u5DF2\u53D6\u6D88\u3002",
   [import_shared6.ERROR_CODES.AI_DISABLED]: "Vite \u914D\u7F6E\u672A\u542F\u7528 AI \u6267\u884C\u3002",
   [import_shared6.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "\u542F\u52A8 Vite \u7684\u8FDB\u7A0B\u4E2D\u7F3A\u5C11\u6A21\u578B\u670D\u52A1 Key \u73AF\u5883\u53D8\u91CF\u3002",
   [import_shared6.ERROR_CODES.PROVIDER_AUTH_FAILED]: "\u6A21\u578B\u670D\u52A1\u9274\u6743\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u670D\u52A1\u7AEF Key\u3002",
@@ -2777,14 +2839,14 @@ var UI_MESSAGES = Object.freeze({
       mode: "Execution mode",
       review: "Review",
       autoGated: "Auto gated",
-      trustedFast: "Trusted fast",
+      trustedFast: "Trusted direct",
       provider: "Provider",
       model: "Model",
       providerAriaLabel: "AI provider",
       modelAriaLabel: "AI model",
       providerUnavailable: "Provider configuration is unavailable.",
       consent: (provider) => `I understand selected context and allowed source may be sent to ${provider}; its data policy is my responsibility.`,
-      trustedFastConsent: (provider) => `Enable trusted fast mode for ${provider}: send allowed project context, include current local changes, and directly apply AI changes after required checks, including file deletions and configuration changes.`,
+      trustedFastConsent: (provider) => `Enable trusted direct mode for ${provider}: send allowed project context, include current local changes, skip project validation checks, and immediately apply AI changes, including file deletions and configuration changes.`,
       connectionNotTested: "Optional connection check not run",
       workspaceNotChecked: "Local workspace not checked",
       checkingWorkspace: "Checking Git workspace and isolated execution\u2026",
@@ -2796,7 +2858,7 @@ var UI_MESSAGES = Object.freeze({
       capabilityVerified: "Agent capability verified",
       capabilityVerifiedAnnouncement: "AI provider capability verified.",
       testingCapability: "Testing authentication, tools, continuation, and streaming\u2026",
-      applying: "Applying validated changes to the project.",
+      applying: "Applying changes to the project.",
       cancelling: "Cancelling Agent job.",
       reverting: "Reverting the applied Agent change.",
       consentRequired: "Confirm remote provider data transmission before running AI.",
@@ -2915,14 +2977,14 @@ var UI_MESSAGES = Object.freeze({
       mode: "\u6267\u884C\u65B9\u5F0F",
       review: "\u5BA1\u9605\u6A21\u5F0F",
       autoGated: "\u53D7\u63A7\u81EA\u52A8\u6A21\u5F0F",
-      trustedFast: "\u53EF\u4FE1\u5FEB\u901F\u6A21\u5F0F",
+      trustedFast: "\u53EF\u4FE1\u6781\u901F\u6A21\u5F0F",
       provider: "\u6A21\u578B\u670D\u52A1",
       model: "\u6A21\u578B",
       providerAriaLabel: "AI \u6A21\u578B\u670D\u52A1",
       modelAriaLabel: "AI \u6A21\u578B",
       providerUnavailable: "\u6A21\u578B\u670D\u52A1\u914D\u7F6E\u4E0D\u53EF\u7528\u3002",
       consent: (provider) => `\u6211\u4E86\u89E3\u9009\u4E2D\u4E0A\u4E0B\u6587\u4E0E\u83B7\u51C6\u6E90\u7801\u53EF\u80FD\u53D1\u9001\u5230 ${provider}\uFF0C\u5E76\u81EA\u884C\u8D1F\u8D23\u5176\u6570\u636E\u7B56\u7565\u3002`,
-      trustedFastConsent: (provider) => `\u4E3A ${provider} \u542F\u7528\u53EF\u4FE1\u5FEB\u901F\u6A21\u5F0F\uFF1A\u53D1\u9001\u83B7\u51C6\u7684\u9879\u76EE\u4E0A\u4E0B\u6587\u3001\u7EB3\u5165\u5F53\u524D\u672C\u5730\u4FEE\u6539\uFF0C\u5E76\u5728\u5FC5\u9700\u68C0\u67E5\u901A\u8FC7\u540E\u76F4\u63A5\u5E94\u7528 AI \u53D8\u66F4\uFF0C\u5305\u62EC\u5220\u9664\u6587\u4EF6\u4E0E\u914D\u7F6E\u53D8\u66F4\u3002`,
+      trustedFastConsent: (provider) => `\u4E3A ${provider} \u542F\u7528\u53EF\u4FE1\u6781\u901F\u6A21\u5F0F\uFF1A\u53D1\u9001\u83B7\u51C6\u7684\u9879\u76EE\u4E0A\u4E0B\u6587\u3001\u7EB3\u5165\u5F53\u524D\u672C\u5730\u4FEE\u6539\u3001\u8DF3\u8FC7\u9879\u76EE\u9A8C\u8BC1\u68C0\u67E5\uFF0C\u5E76\u7ACB\u5373\u5E94\u7528 AI \u53D8\u66F4\uFF0C\u5305\u62EC\u5220\u9664\u6587\u4EF6\u4E0E\u914D\u7F6E\u53D8\u66F4\u3002`,
       connectionNotTested: "\u5C1A\u672A\u6267\u884C\u53EF\u9009\u8FDE\u63A5\u68C0\u67E5",
       workspaceNotChecked: "\u5C1A\u672A\u68C0\u67E5\u672C\u5730\u5DE5\u4F5C\u533A",
       checkingWorkspace: "\u6B63\u5728\u68C0\u67E5 Git \u5DE5\u4F5C\u533A\u4E0E\u9694\u79BB\u6267\u884C\u73AF\u5883\u2026\u2026",
@@ -2934,7 +2996,7 @@ var UI_MESSAGES = Object.freeze({
       capabilityVerified: "Agent \u80FD\u529B\u9A8C\u8BC1\u901A\u8FC7",
       capabilityVerifiedAnnouncement: "AI \u6A21\u578B\u670D\u52A1\u80FD\u529B\u9A8C\u8BC1\u901A\u8FC7\u3002",
       testingCapability: "\u6B63\u5728\u9A8C\u8BC1\u9274\u6743\u3001\u5DE5\u5177\u8C03\u7528\u3001\u8FDE\u7EED\u8C03\u7528\u4E0E\u6D41\u5F0F\u54CD\u5E94\u2026\u2026",
-      applying: "\u6B63\u5728\u5C06\u5DF2\u9A8C\u8BC1\u53D8\u66F4\u5E94\u7528\u5230\u9879\u76EE\u3002",
+      applying: "\u6B63\u5728\u5C06\u53D8\u66F4\u5E94\u7528\u5230\u9879\u76EE\u3002",
       cancelling: "\u6B63\u5728\u53D6\u6D88 Agent \u4EFB\u52A1\u3002",
       reverting: "\u6B63\u5728\u64A4\u9500\u5DF2\u5E94\u7528\u7684 Agent \u53D8\u66F4\u3002",
       consentRequired: "\u8FD0\u884C AI \u524D\uFF0C\u8BF7\u5148\u786E\u8BA4\u5141\u8BB8\u5411\u8FDC\u7A0B\u6A21\u578B\u670D\u52A1\u4F20\u8F93\u6570\u636E\u3002",
@@ -3741,7 +3803,18 @@ function summaryLine(summary, prefix) {
   const line = summary.split("\n").find((candidate) => candidate.startsWith(`${prefix}: `));
   return line?.slice(prefix.length + 2).trim();
 }
-function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: false }), localePreference = "auto") {
+function createUnavailableDataFlowPanel(document, changesRoot, diagnosticsRoot) {
+  changesRoot.append(diagnosticsRoot);
+  return Object.freeze({
+    root: changesRoot,
+    refreshButton: createButton(document, ""),
+    styles: document.createElement("style"),
+    dispose: () => void 0,
+    render: () => void 0,
+    resetView: () => void 0
+  });
+}
+function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: false }), localePreference = "auto", dataFlowEnabled = false) {
   const localizer = createUiLocalizer(document, localePreference);
   let messages = localizer.messages();
   const host = document.createElement("spotpatch-root");
@@ -3857,7 +3930,17 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
   summary.className = "spotpatch-summary";
   diagnostics.append(diagnosticsLabel, summary);
   const agentPanel = createAgentPanel(document, ai, localizer);
-  selectionPanel.append(targetsPanel, diagnostics, agentPanel.root);
+  const changesPanel = createMarkedElement(document, "div");
+  changesPanel.append(targetsPanel, agentPanel.root);
+  const dataFlowPanel = getDataFlowExtension()?.createPanel(
+    document,
+    dataFlowEnabled,
+    localizer.locale,
+    changesPanel,
+    diagnostics,
+    placeDialog
+  ) ?? createUnavailableDataFlowPanel(document, changesPanel, diagnostics);
+  selectionPanel.append(dataFlowPanel.root);
   const previewPanel = createMarkedElement(document, "div");
   previewPanel.className = "spotpatch-preview-panel";
   previewPanel.hidden = true;
@@ -3917,6 +4000,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
   liveRegion.setAttribute("aria-atomic", "true");
   shadowRoot.append(
     createStyles(document),
+    dataFlowPanel.styles,
     selectionHighlights,
     highlight,
     dialog,
@@ -3934,6 +4018,13 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
   let currentTargets = [];
   let currentMaximum = 0;
   let currentEditorFeedbackState = "idle";
+  let currentDataFlowState = Object.freeze({
+    component: Object.freeze({
+      status: dataFlowEnabled ? "idle" : "disabled"
+    }),
+    page: Object.freeze({ status: dataFlowEnabled ? "idle" : "disabled" }),
+    observationCount: 0
+  });
   function renderEditorStatus(state) {
     currentEditorFeedbackState = state;
     editorFeedback.dataset.state = state;
@@ -4235,6 +4326,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
     previewButton.textContent = messages.actions.preview;
     copyButton.textContent = messages.actions.copy;
     backButton.textContent = messages.actions.back;
+    dataFlowPanel.render(currentDataFlowState);
     triggerButton.title = messages.trigger.title(shortcut);
     triggerButton.textContent = currentStatus === "inspecting" ? messages.trigger.stop : messages.trigger.select;
     renderPanelStatus(currentStatus);
@@ -4273,6 +4365,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
     repositoryLink,
     previewButton,
     copyButton,
+    dataFlowRefreshButton: dataFlowPanel.refreshButton,
     backButton,
     closeButton,
     agentProviderSelect: agentPanel.providerSelect,
@@ -4293,6 +4386,11 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
       renderPanelStatus(status);
     },
     renderEditorStatus,
+    renderDataFlow(state) {
+      currentDataFlowState = state;
+      dataFlowPanel.render(state);
+      placeDialog();
+    },
     showHighlight(rect, label) {
       currentRect = rect;
       highlight.hidden = false;
@@ -4355,6 +4453,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
       agentPanel.setSelectionVisible(false);
       agentPanel.setEditingEnabled(true);
       agentPanel.resetJob();
+      dataFlowPanel.resetView();
     },
     hideSelectionTemporarily() {
       dialog.hidden = true;
@@ -4423,6 +4522,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
       diagnostics.removeEventListener("toggle", placeDialog);
       localeButton.removeEventListener("click", localizer.toggle);
       unsubscribeLocale();
+      dataFlowPanel.dispose();
       agentPanel.dispose();
       host.remove();
     }
@@ -4913,9 +5013,16 @@ function resolveBrowserDependencies(dependencies) {
 }
 function createController(config, dependencies = {}) {
   const browser = resolveBrowserDependencies(dependencies);
-  const view = dependencies.view ?? createRuntimeView(browser.document, config.shortcut, config.ai, config.locale);
+  const view = dependencies.view ?? createRuntimeView(
+    browser.document,
+    config.shortcut,
+    config.ai,
+    config.locale,
+    config.dataFlow.enabled
+  );
   const api = dependencies.api ?? createRuntimeApi({
     apiBase: config.apiBase,
+    dataFlowReportMaxBytes: config.dataFlow.limits.reportMaxBytes,
     fetch: browser.window.fetch.bind(browser.window),
     sessionToken: config.sessionToken
   });
@@ -4927,6 +5034,9 @@ function createController(config, dependencies = {}) {
   const restoredSelection = selectionSession.load();
   const sourceResolver = createSourceResolver({
     adapter: dependencies.reactAdapter ?? (0, import_react_adapter.createReact18Adapter)({
+      ...config.dataFlow.enabled ? {
+        getComponentRegistration: (component) => getDataFlowExtension()?.getComponentRegistration(component)
+      } : {},
       maxComponentDepth: config.budget.maxComponentDepth
     }),
     onAdapterError() {
@@ -4950,6 +5060,8 @@ function createController(config, dependencies = {}) {
       apiStatus: marker === void 0 ? "not-required" : target2.code === void 0 ? "failed" : "connected",
       code: target2.code,
       collectionStatus: "ready",
+      dataFlowReport: void 0,
+      dataFlowStatus: "idle",
       element: void 0,
       elementContext: target2.element,
       instruction: target2.instruction,
@@ -4964,6 +5076,9 @@ function createController(config, dependencies = {}) {
   let workflowSelectionActive = false;
   let sessionRevision = 0;
   let editorRequestRevision = 0;
+  let dataFlowRequestRevision = 0;
+  let pageDataFlowReport;
+  let pageDataFlowStatus = "idle";
   let addingTarget = false;
   let previewPrompt = "";
   let previousFocus;
@@ -4978,6 +5093,90 @@ function createController(config, dependencies = {}) {
   function activeTarget() {
     return targets.find((target2) => target2.id === activeTargetId) ?? targets.at(-1);
   }
+  function dataFlowRequest(target2) {
+    const react2 = target2.resolution.react;
+    if (react2.componentSourceId !== void 0 && react2.sourceVersion !== void 0) {
+      return Object.freeze({
+        schemaVersion: import_shared9.DATA_FLOW_SCHEMA_VERSION,
+        componentSourceId: react2.componentSourceId,
+        sourceVersion: react2.sourceVersion
+      });
+    }
+    const marker = target2.marker;
+    return marker === void 0 ? void 0 : Object.freeze({
+      schemaVersion: import_shared9.DATA_FLOW_SCHEMA_VERSION,
+      fileId: marker.fileId,
+      line: marker.line,
+      column: marker.column
+    });
+  }
+  function renderDataFlowView() {
+    const dataFlowClient = getDataFlowExtension();
+    const observations = dataFlowClient?.observations(browser.window.location.pathname) ?? [];
+    const current = activeTarget();
+    view.renderDataFlow({
+      component: Object.freeze({
+        status: config.dataFlow.enabled ? current?.dataFlowStatus ?? "idle" : "disabled",
+        ...current?.dataFlowReport === void 0 ? {} : {
+          report: dataFlowClient?.mergeComponentReport(
+            current.dataFlowReport,
+            observations
+          ) ?? current.dataFlowReport
+        }
+      }),
+      page: Object.freeze({
+        status: config.dataFlow.enabled ? pageDataFlowStatus : "disabled",
+        ...pageDataFlowReport === void 0 ? {} : {
+          report: dataFlowClient?.mergePageReport(pageDataFlowReport, observations) ?? pageDataFlowReport
+        }
+      }),
+      observationCount: observations.length
+    });
+  }
+  async function loadDataFlowReports() {
+    if (!config.dataFlow.enabled) {
+      renderDataFlowView();
+      return;
+    }
+    const current = activeTarget();
+    const currentRequest = current === void 0 ? void 0 : dataFlowRequest(current);
+    const pageTargets = targets.flatMap((target2) => {
+      const request = dataFlowRequest(target2);
+      return request === void 0 ? [] : [request];
+    });
+    const revision = ++dataFlowRequestRevision;
+    const selectionRevision = sessionRevision;
+    if (current !== void 0) current.dataFlowStatus = "loading";
+    pageDataFlowStatus = pageTargets.length === 0 ? "idle" : "loading";
+    renderDataFlowView();
+    const [componentResult, pageResult] = await Promise.allSettled([
+      currentRequest === void 0 ? Promise.resolve(void 0) : api.componentDataFlowReport(currentRequest),
+      pageTargets.length === 0 ? Promise.resolve(void 0) : api.pageDataFlowReport({
+        schemaVersion: import_shared9.DATA_FLOW_SCHEMA_VERSION,
+        targets: pageTargets
+      })
+    ]);
+    if (!mounted || revision !== dataFlowRequestRevision || selectionRevision !== sessionRevision) {
+      return;
+    }
+    if (current !== void 0 && targets.includes(current)) {
+      if (componentResult.status === "fulfilled") {
+        current.dataFlowReport = componentResult.value;
+        current.dataFlowStatus = componentResult.value === void 0 ? "idle" : "ready";
+      } else {
+        current.dataFlowReport = void 0;
+        current.dataFlowStatus = "error";
+      }
+    }
+    if (pageResult.status === "fulfilled") {
+      pageDataFlowReport = pageResult.value;
+      pageDataFlowStatus = pageResult.value === void 0 ? "idle" : "ready";
+    } else {
+      pageDataFlowReport = void 0;
+      pageDataFlowStatus = "error";
+    }
+    renderDataFlowView();
+  }
   function snapshotTarget(target2) {
     if (target2.elementContext === void 0 || target2.styles === void 0) {
       return void 0;
@@ -5146,6 +5345,9 @@ ${summary}`;
     resizeObserver?.disconnect();
     targets = [];
     activeTargetId = void 0;
+    dataFlowRequestRevision += 1;
+    pageDataFlowReport = void 0;
+    pageDataFlowStatus = "idle";
     selectionOpen = false;
     workflowSelectionActive = false;
     addingTarget = false;
@@ -5200,6 +5402,7 @@ ${summary}`;
         workflowSelectionActive = true;
       }
       refreshSelectionView(true);
+      void loadDataFlowReports();
       view.focusTargetInstruction(activeTargetId);
       persistSelection();
       return;
@@ -5350,6 +5553,7 @@ ${summary}`;
       transition({ type: "SELECT" });
       view.hideHighlight();
       refreshSelectionView(true);
+      void loadDataFlowReports();
       view.focusTargetInstruction(duplicate.id);
       view.announce(view.messages().announcements.duplicate);
       return;
@@ -5381,7 +5585,9 @@ ${summary}`;
       styles: void 0,
       instruction: "",
       apiStatus: marker === void 0 ? "not-required" : "loading",
-      collectionStatus: "loading"
+      collectionStatus: "loading",
+      dataFlowReport: void 0,
+      dataFlowStatus: "idle"
     };
     targets.push(target2);
     activeTargetId = target2.id;
@@ -5391,6 +5597,7 @@ ${summary}`;
     view.hideHighlight();
     resizeObserver?.observe(element2);
     refreshSelectionView(true);
+    void loadDataFlowReports();
     selectionOpen = true;
     view.focusTargetInstruction(target2.id);
     scheduleBrowserContextCollection(target2, revision);
@@ -5495,11 +5702,15 @@ ${summary}`;
       }
       view.hideSelectionTemporarily();
       view.hideSelectionHighlights();
+      pageDataFlowReport = void 0;
+      pageDataFlowStatus = "idle";
+      renderDataFlowView();
       selectionSession.clear();
       view.announce(view.messages().announcements.allTargetsRemoved);
       return;
     }
     refreshSelectionView();
+    void loadDataFlowReports();
     persistSelection();
     view.announce(view.messages().announcements.targetRemoved);
   }
@@ -5662,11 +5873,15 @@ ${summary}`;
     }
     activeTargetId = targetId;
     refreshSelectionView();
+    void loadDataFlowReports();
     view.focusTargetInstruction(targetId);
   }
   function handleReselect() {
     beginReselect();
   }
+  function handleDataFlowRefresh() {
+    void loadDataFlowReports();
+  }
   function mount() {
     if (mounted) {
       return;
@@ -5685,6 +5900,7 @@ ${summary}`;
     view.targetList.addEventListener("input", handleTargetListInput);
     view.targetList.addEventListener("keydown", handleTargetListKeydown);
     view.openEditorButton.addEventListener("click", handleOpenEditorButtonClick);
+    view.dataFlowRefreshButton.addEventListener("click", handleDataFlowRefresh);
     view.previewButton.addEventListener("click", handlePreview);
     view.copyButton.addEventListener("click", handleCopy);
     view.backButton.addEventListener("click", handleBack);
@@ -5755,6 +5971,7 @@ ${summary}`;
     view.targetList.removeEventListener("input", handleTargetListInput);
     view.targetList.removeEventListener("keydown", handleTargetListKeydown);
     view.openEditorButton.removeEventListener("click", handleOpenEditorButtonClick);
+    view.dataFlowRefreshButton.removeEventListener("click", handleDataFlowRefresh);
     view.previewButton.removeEventListener("click", handlePreview);
     view.copyButton.removeEventListener("click", handleCopy);
     view.backButton.removeEventListener("click", handleBack);
@@ -5815,9 +6032,551 @@ function bootstrapSpotPatch(config) {
   target2[RUNTIME_INSTANCE_KEY] = controller;
   controller.mount();
 }
+
+// src/data-flow/data-flow-runtime.ts
+var import_data_flow_runtime = require("@spotpatch/shared/data-flow-runtime");
+var RUNTIME_KEY = /* @__PURE__ */ Symbol.for(
+  "spotpatch.data-flow.runtime.v1"
+);
+var REACT_MEMO_TYPE = /* @__PURE__ */ Symbol.for("react.memo");
+var REACT_FORWARD_REF_TYPE = /* @__PURE__ */ Symbol.for("react.forward_ref");
+function positiveNow(target2) {
+  return target2.performance?.now() ?? Date.now();
+}
+function createOpaqueSequence(prefix) {
+  let sequence = 0;
+  const randomPrefix = (() => {
+    try {
+      const bytes = new Uint8Array(8);
+      globalThis.crypto.getRandomValues(bytes);
+      return Array.from(bytes, (value) => value.toString(36).padStart(2, "0")).join("");
+    } catch {
+      return "local";
+    }
+  })();
+  return () => {
+    sequence += 1;
+    return `${prefix}_${randomPrefix}_${sequence.toString(36)}`;
+  };
+}
+function freezeUrl(value, baseUrl) {
+  try {
+    const url = new URL(value, baseUrl);
+    return Object.freeze({
+      origin: url.origin,
+      pathname: url.pathname,
+      queryKeys: Object.freeze(
+        [...new Set(url.searchParams.keys())].sort().slice(0, import_data_flow_runtime.DATA_FLOW_URL_QUERY_KEY_LIMIT)
+      )
+    });
+  } catch {
+    return Object.freeze({
+      pathname: value.split(/[?#]/u, 1)[0] ?? "{invalid}",
+      queryKeys: Object.freeze([])
+    });
+  }
+}
+function readFetchUrl(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.toString();
+  return input.url;
+}
+function readFetchMethod(input, init) {
+  if (init?.method !== void 0) return init.method.toUpperCase();
+  return typeof Request !== "undefined" && input instanceof Request ? input.method.toUpperCase() : "GET";
+}
+function isSpotPatchInternalUrl(value, baseUrl) {
+  try {
+    const pathname = new URL(value, baseUrl).pathname;
+    return pathname === import_data_flow_runtime.SPOTPATCH_API_BASE || pathname.startsWith(`${import_data_flow_runtime.SPOTPATCH_API_BASE}/`);
+  } catch {
+    return false;
+  }
+}
+function approximateBytes(value) {
+  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
+function createRingStore(limits, target2) {
+  const entries = [];
+  let totalBytes = 0;
+  function removeExpired(now) {
+    while (entries[0] !== void 0 && now - entries[0].recordedAt > limits.observationTtlMs) {
+      const removed = entries.shift();
+      if (removed !== void 0) totalBytes -= removed.bytes;
+    }
+  }
+  return Object.freeze({
+    add(observation) {
+      const now = positiveNow(target2);
+      removeExpired(now);
+      const bytes = approximateBytes(observation);
+      if (bytes > limits.observationMaxBytes) return;
+      entries.push(Object.freeze({ bytes, observation, recordedAt: now }));
+      totalBytes += bytes;
+      while (entries.length > limits.observationMaxEntries || totalBytes > limits.observationMaxBytes) {
+        const removed = entries.shift();
+        if (removed !== void 0) totalBytes -= removed.bytes;
+      }
+    },
+    clear() {
+      entries.length = 0;
+      totalBytes = 0;
+    },
+    values() {
+      removeExpired(positiveNow(target2));
+      return Object.freeze(entries.map(({ observation }) => observation));
+    }
+  });
+}
+function ownPropertyDescriptor(target2, key) {
+  try {
+    return Object.getOwnPropertyDescriptor(target2, key);
+  } catch {
+    return void 0;
+  }
+}
+function nestedReactWrapperComponent(candidate) {
+  const marker = ownPropertyDescriptor(candidate, "$$typeof")?.value;
+  const key = marker === REACT_MEMO_TYPE ? "type" : marker === REACT_FORWARD_REF_TYPE ? "render" : void 0;
+  if (key === void 0) return void 0;
+  const nested = ownPropertyDescriptor(candidate, key)?.value;
+  return typeof nested === "object" && nested !== null || typeof nested === "function" ? nested : void 0;
+}
+function installWritableDataProperty(target2, key, replacement, original = ownPropertyDescriptor(target2, key)) {
+  if (original === void 0 || !("value" in original) || !original.writable) {
+    return void 0;
+  }
+  try {
+    Object.defineProperty(target2, key, { ...original, value: replacement });
+  } catch {
+    return void 0;
+  }
+  return () => {
+    try {
+      if (ownPropertyDescriptor(target2, key)?.value === replacement) {
+        Object.defineProperty(target2, key, original);
+      }
+    } catch {
+    }
+  };
+}
+function recordWithoutAffectingHost(record2) {
+  try {
+    record2();
+  } catch {
+  }
+}
+function createDataFlowRuntime(config, target2 = globalThis) {
+  const componentRegistry = /* @__PURE__ */ new WeakMap();
+  const xhrMetadata = /* @__PURE__ */ new WeakMap();
+  const store = createRingStore(config.limits, target2);
+  const nextInvocationId = createOpaqueSequence("invocation");
+  const nextObservationId = createOpaqueSequence("observation");
+  const pageEpoch = createOpaqueSequence("page")();
+  const nextRouteEpoch = createOpaqueSequence("route");
+  let routeEpoch = nextRouteEpoch();
+  let routeKey;
+  let currentInvocation;
+  let currentRequestFrame;
+  let disposed = false;
+  const originalFetch = (() => {
+    try {
+      return target2.fetch;
+    } catch {
+      return void 0;
+    }
+  })();
+  function spotPatchFetch(input, init) {
+    if (originalFetch === void 0) {
+      throw new TypeError("Fetch is unavailable.");
+    }
+    const result = Reflect.apply(originalFetch, this, [input, init]);
+    recordWithoutAffectingHost(() => {
+      const frame = currentRequestFrame;
+      const token = frame?.invocationToken;
+      const rawUrl = readFetchUrl(input);
+      if (isSpotPatchInternalUrl(
+        rawUrl,
+        target2.location?.href ?? "http://spotpatch.invalid/"
+      )) {
+        return;
+      }
+      store.add(
+        Object.freeze({
+          schemaVersion: import_data_flow_runtime.DATA_FLOW_SCHEMA_VERSION,
+          id: nextObservationId(),
+          pageEpoch,
+          routeEpoch,
+          ...frame === void 0 ? {} : {
+            requestCallsiteId: frame.requestCallsiteId,
+            sourceVersion: frame.sourceVersion
+          },
+          ...token === void 0 ? {} : {
+            invocationId: token.invocationId,
+            componentSourceId: token.componentSourceId,
+            triggerCallsiteId: token.triggerCallsiteId
+          },
+          transport: "fetch",
+          method: readFetchMethod(input, init),
+          url: freezeUrl(rawUrl, target2.location?.href ?? "http://spotpatch.invalid/"),
+          outcome: "dispatched",
+          freshness: "current",
+          diagnosticIds: Object.freeze([])
+        })
+      );
+    });
+    return result;
+  }
+  const restoreFetch = originalFetch === void 0 ? void 0 : installWritableDataProperty(target2, "fetch", spotPatchFetch);
+  const xhrPrototype = (() => {
+    try {
+      return target2.XMLHttpRequest?.prototype;
+    } catch {
+      return void 0;
+    }
+  })();
+  const originalOpenDescriptor = xhrPrototype === void 0 ? void 0 : ownPropertyDescriptor(xhrPrototype, "open");
+  const originalSendDescriptor = xhrPrototype === void 0 ? void 0 : ownPropertyDescriptor(xhrPrototype, "send");
+  function spotPatchOpen(method, url, ...rest) {
+    const original = originalOpenDescriptor?.value;
+    if (typeof original === "function") {
+      Reflect.apply(original, this, [method, url, ...rest]);
+    }
+    recordWithoutAffectingHost(() => {
+      xhrMetadata.set(this, Object.freeze({ method, url: String(url) }));
+    });
+  }
+  function spotPatchSend(body) {
+    const original = originalSendDescriptor?.value;
+    if (typeof original === "function") Reflect.apply(original, this, [body]);
+    recordWithoutAffectingHost(() => {
+      const metadata = xhrMetadata.get(this);
+      if (metadata === void 0 || isSpotPatchInternalUrl(
+        metadata.url,
+        target2.location?.href ?? "http://spotpatch.invalid/"
+      )) {
+        return;
+      }
+      const frame = currentRequestFrame;
+      const token = frame?.invocationToken;
+      store.add(
+        Object.freeze({
+          schemaVersion: import_data_flow_runtime.DATA_FLOW_SCHEMA_VERSION,
+          id: nextObservationId(),
+          pageEpoch,
+          routeEpoch,
+          ...frame === void 0 ? {} : {
+            requestCallsiteId: frame.requestCallsiteId,
+            sourceVersion: frame.sourceVersion
+          },
+          ...token === void 0 ? {} : {
+            invocationId: token.invocationId,
+            componentSourceId: token.componentSourceId,
+            triggerCallsiteId: token.triggerCallsiteId
+          },
+          transport: "xhr",
+          method: metadata.method.toUpperCase(),
+          url: freezeUrl(
+            metadata.url,
+            target2.location?.href ?? "http://spotpatch.invalid/"
+          ),
+          outcome: "dispatched",
+          freshness: "current",
+          diagnosticIds: Object.freeze([])
+        })
+      );
+    });
+  }
+  const restoreXhrOpen = xhrPrototype === void 0 || typeof originalOpenDescriptor?.value !== "function" ? void 0 : installWritableDataProperty(
+    xhrPrototype,
+    "open",
+    spotPatchOpen,
+    originalOpenDescriptor
+  );
+  const restoreXhrSend = xhrPrototype === void 0 || typeof originalSendDescriptor?.value !== "function" ? void 0 : installWritableDataProperty(
+    xhrPrototype,
+    "send",
+    spotPatchSend,
+    originalSendDescriptor
+  );
+  const runtime = Object.freeze({
+    beginInvocation(metadata) {
+      return Object.freeze({
+        invocationId: nextInvocationId(),
+        componentSourceId: metadata.componentSourceId,
+        triggerCallsiteId: metadata.triggerCallsiteId,
+        sourceVersion: metadata.sourceVersion
+      });
+    },
+    bindInvocation(token, callback) {
+      return function boundInvocation(...args) {
+        return runtime.withInvocation(token, () => Reflect.apply(callback, this, args));
+      };
+    },
+    bindTrigger(metadata, callback) {
+      if (typeof callback !== "function") return callback;
+      const callable = callback;
+      return function boundTrigger(...args) {
+        const token = runtime.beginInvocation(metadata);
+        return runtime.withInvocation(token, () => Reflect.apply(callable, this, args));
+      };
+    },
+    captureInvocation: () => currentInvocation,
+    clear: store.clear,
+    createTrpcLink() {
+      return () => (options) => {
+        recordWithoutAffectingHost(() => {
+          const operation = options.op.path;
+          const operationType = options.op.type;
+          if (typeof operation !== "string" || operation.length === 0 || operation.length > 512 || operationType !== "query" && operationType !== "mutation" && operationType !== "subscription") {
+            return;
+          }
+          const frame = currentRequestFrame;
+          const token = frame?.invocationToken;
+          store.add(
+            Object.freeze({
+              schemaVersion: import_data_flow_runtime.DATA_FLOW_SCHEMA_VERSION,
+              id: nextObservationId(),
+              pageEpoch,
+              routeEpoch,
+              ...frame === void 0 ? {} : {
+                requestCallsiteId: frame.requestCallsiteId,
+                sourceVersion: frame.sourceVersion
+              },
+              ...token === void 0 ? {} : {
+                invocationId: token.invocationId,
+                componentSourceId: token.componentSourceId,
+                triggerCallsiteId: token.triggerCallsiteId
+              },
+              transport: "trpc",
+              method: operationType.toUpperCase(),
+              operation,
+              url: Object.freeze({
+                pathname: operation,
+                queryKeys: Object.freeze([])
+              }),
+              outcome: "dispatched",
+              freshness: "current",
+              diagnosticIds: Object.freeze([])
+            })
+          );
+        });
+        return options.next(options.op);
+      };
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      store.clear();
+      restoreFetch?.();
+      restoreXhrOpen?.();
+      restoreXhrSend?.();
+    },
+    getComponentRegistration: (component) => componentRegistry.get(component),
+    getCurrentRequestFrame: () => currentRequestFrame,
+    observations: () => Object.freeze(
+      store.values().map(
+        (observation) => observation.routeEpoch === routeEpoch ? observation : Object.freeze({ ...observation, freshness: "stale-route" })
+      )
+    ),
+    registerComponent(component, componentSourceId, registeredSourceVersion) {
+      const registration = Object.freeze({
+        componentSourceId,
+        sourceVersion: registeredSourceVersion
+      });
+      const pending = [component];
+      const registered = /* @__PURE__ */ new Set();
+      while (pending.length > 0) {
+        const candidate = pending.pop();
+        if (candidate === void 0 || registered.has(candidate)) continue;
+        registered.add(candidate);
+        componentRegistry.set(candidate, registration);
+        const nested = nestedReactWrapperComponent(candidate);
+        if (nested !== void 0) pending.push(nested);
+      }
+    },
+    updateRoute(nextRouteKey) {
+      if (routeKey === void 0) {
+        routeKey = nextRouteKey;
+      } else if (routeKey !== nextRouteKey) {
+        routeKey = nextRouteKey;
+        routeEpoch = nextRouteEpoch();
+      }
+    },
+    withInvocation(token, callback) {
+      const parent = currentInvocation;
+      currentInvocation = token;
+      try {
+        return callback();
+      } finally {
+        currentInvocation = parent;
+      }
+    },
+    withRequestFrame(token, metadata, callback) {
+      const parent = currentRequestFrame;
+      currentRequestFrame = Object.freeze({
+        requestCallsiteId: metadata.requestCallsiteId,
+        sourceVersion: metadata.sourceVersion,
+        ...token === void 0 ? {} : { invocationToken: token }
+      });
+      try {
+        return callback();
+      } finally {
+        currentRequestFrame = parent;
+      }
+    }
+  });
+  return runtime;
+}
+function installDataFlowPrelude(config, target2 = globalThis) {
+  if (!config.enabled) return void 0;
+  const runtime = target2[RUNTIME_KEY] ?? createDataFlowRuntime(config, target2);
+  target2[RUNTIME_KEY] = runtime;
+  return runtime;
+}
+function getDataFlowRuntime(target2 = globalThis) {
+  return target2[RUNTIME_KEY];
+}
+
+// src/data-flow/report-merger.ts
+var import_shared10 = require("@spotpatch/shared");
+function observationMatchesDependency(observation, dependency) {
+  const origin = dependency.origin;
+  const transportMatches = dependency.kind === "rpc" ? observation.transport === "trpc" && dependency.operation !== void 0 && observation.operation === dependency.operation : dependency.kind === "http" ? observation.transport === "fetch" || observation.transport === "xhr" : false;
+  if (!transportMatches || observation.freshness !== "current" || origin === void 0 || observation.requestCallsiteId !== origin.requestCallsiteId || observation.sourceVersion !== origin.sourceVersion || dependency.method !== void 0 && observation.method.toUpperCase() !== dependency.method.toUpperCase() || dependency.url !== void 0 && observation.url.pathname !== dependency.url.pathname || dependency.url?.origin !== void 0 && observation.url.origin !== dependency.url.origin || origin.componentSourceId !== void 0 && observation.componentSourceId !== void 0 && observation.componentSourceId !== origin.componentSourceId || origin.triggerCallsiteId !== void 0 && observation.triggerCallsiteId !== void 0 && observation.triggerCallsiteId !== origin.triggerCallsiteId) {
+    return false;
+  }
+  return dependency.association !== "transitive" || observation.componentSourceId === origin.componentSourceId && observation.triggerCallsiteId === origin.triggerCallsiteId;
+}
+function runtimeEvidence(observation) {
+  return Object.freeze({
+    id: observation.id,
+    kind: "runtime-observation",
+    summaryKey: "dataFlow.evidence.runtimeDispatch"
+  });
+}
+function mergeDependencies(dependencies, observations) {
+  const matchedObservationIds = /* @__PURE__ */ new Set();
+  const merged = dependencies.map((dependency) => {
+    const matches = observations.filter(
+      (observation) => observationMatchesDependency(observation, dependency)
+    );
+    for (const observation of matches) matchedObservationIds.add(observation.id);
+    if (matches.length === 0) return dependency;
+    const observedOrigins = [
+      ...new Set(
+        matches.flatMap(({ url }) => url.origin === void 0 ? [] : [url.origin])
+      )
+    ];
+    const observedOrigin = observedOrigins.length === 1 ? observedOrigins[0] : void 0;
+    return Object.freeze({
+      ...dependency,
+      ...dependency.url === void 0 || dependency.url.origin !== void 0 || observedOrigin === void 0 ? {} : {
+        url: Object.freeze({
+          ...dependency.url,
+          origin: observedOrigin
+        })
+      },
+      execution: "observed",
+      observationIds: Object.freeze([
+        .../* @__PURE__ */ new Set([...dependency.observationIds, ...matches.map(({ id }) => id)])
+      ]),
+      evidenceIds: Object.freeze([
+        .../* @__PURE__ */ new Set([...dependency.evidenceIds, ...matches.map(({ id }) => id)])
+      ])
+    });
+  });
+  return Object.freeze({
+    dependencies: Object.freeze(merged),
+    matchedObservationIds
+  });
+}
+function appendRuntimeEvidence(evidence, observations, matchedIds) {
+  const existing = new Set(evidence.map(({ id }) => id));
+  return Object.freeze([
+    ...evidence,
+    ...observations.flatMap(
+      (observation) => matchedIds.has(observation.id) && !existing.has(observation.id) ? [runtimeEvidence(observation)] : []
+    )
+  ]);
+}
+function mergeComponentDataFlowReport(report, observations) {
+  const componentObservations = observations.filter(
+    (observation) => observation.componentSourceId === void 0 || observation.componentSourceId === report.component.componentSourceId
+  );
+  const merged = mergeDependencies(report.dependencies, componentObservations);
+  return (0, import_shared10.limitDataFlowReportCollections)(
+    Object.freeze({
+      ...report,
+      dependencies: merged.dependencies,
+      evidence: appendRuntimeEvidence(
+        report.evidence,
+        componentObservations,
+        merged.matchedObservationIds
+      )
+    }),
+    { mode: "observation" }
+  );
+}
+function unassignedDependency(observation) {
+  const isRpc = observation.transport === "trpc";
+  return Object.freeze({
+    id: observation.id,
+    kind: isRpc ? "rpc" : "http",
+    direction: observation.method === "GET" || observation.method === "HEAD" || observation.method === "QUERY" || observation.method === "SUBSCRIPTION" ? "read" : "write",
+    execution: "observed",
+    proof: "unavailable",
+    association: "unassigned",
+    method: observation.method,
+    ...isRpc ? observation.operation === void 0 ? {} : { operation: observation.operation } : { url: observation.url },
+    parameters: Object.freeze(
+      (isRpc ? [] : observation.url.queryKeys).map(
+        (path) => Object.freeze({
+          path,
+          position: "query",
+          sensitive: (0, import_shared10.isSensitiveName)(path),
+          valueState: "not-collected",
+          evidenceIds: Object.freeze([observation.id])
+        })
+      )
+    ),
+    response: Object.freeze({
+      consumedFields: Object.freeze([])
+    }),
+    suppliedBindings: Object.freeze([]),
+    locationIds: Object.freeze([]),
+    evidenceIds: Object.freeze([observation.id]),
+    observationIds: Object.freeze([observation.id])
+  });
+}
+function mergePageDataFlowReport(report, observations) {
+  const currentObservations = observations.filter(
+    ({ freshness }) => freshness === "current"
+  );
+  const merged = mergeDependencies(report.dependencies, currentObservations);
+  const unassigned = currentObservations.filter(({ id }) => !merged.matchedObservationIds.has(id)).map(unassignedDependency);
+  const allObservationIds = new Set(currentObservations.map(({ id }) => id));
+  return (0, import_shared10.limitDataFlowReportCollections)(
+    Object.freeze({
+      ...report,
+      dependencies: Object.freeze([...merged.dependencies, ...unassigned]),
+      evidence: appendRuntimeEvidence(
+        report.evidence,
+        currentObservations,
+        allObservationIds
+      )
+    }),
+    { mode: "observation" }
+  );
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   UI_MARKER_ATTRIBUTE,
-  bootstrapSpotPatch
+  bootstrapSpotPatch,
+  createDataFlowRuntime,
+  getDataFlowRuntime,
+  installDataFlowPrelude,
+  mergeComponentDataFlowReport,
+  mergePageDataFlowReport
 });
 //# sourceMappingURL=index.cjs.map