@spotpatch/runtime 1.8.0 → 1.10.0

package/dist/index.cjs

@@ -18,12 +18,17 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-var index_exports = {};
-__export(index_exports, {
+var src_exports = {};
+__export(src_exports, {
   UI_MARKER_ATTRIBUTE: () => UI_MARKER_ATTRIBUTE,
-  bootstrapSpotPatch: () => bootstrapSpotPatch
+  bootstrapSpotPatch: () => bootstrapSpotPatch,
+  createDataFlowRuntime: () => createDataFlowRuntime,
+  getDataFlowRuntime: () => getDataFlowRuntime,
+  installDataFlowPrelude: () => installDataFlowPrelude,
+  mergeComponentDataFlowReport: () => mergeComponentDataFlowReport,
+  mergePageDataFlowReport: () => mergePageDataFlowReport
 });
-module.exports = __toCommonJS(index_exports);
+module.exports = __toCommonJS(src_exports);
 
 // src/controller/runtime-controller.ts
 var import_react_adapter = require("@spotpatch/react-adapter");
@@ -348,15 +353,36 @@ function parseJson(text2) {
     throw new RuntimeApiError();
   }
 }
-async function readJsonEnvelope(response) {
+async function readJsonEnvelope(response, maximumBytes = MAX_JSON_RESPONSE_BYTES) {
   const payload = parseJson(
-    await readBoundedText(response, MAX_JSON_RESPONSE_BYTES)
+    await readBoundedText(response, maximumBytes)
   );
   if (!response.ok) {
     throw new RuntimeApiError(readFailureCode(payload));
   }
   return readSuccessData(payload);
 }
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function isReportCompleteness(value) {
+  return isRecord2(value) && typeof value.complete === "boolean" && typeof value.visitedModules === "number" && typeof value.visitedCallsites === "number" && typeof value.frontierCount === "number";
+}
+function isDataFlowCapability(value) {
+  return isRecord2(value) && typeof value.enabled === "boolean" && (value.staticAnalysis === "available" || value.staticAnalysis === "partial" || value.staticAnalysis === "unavailable") && value.runtimeObservation === "dispatch-only" && value.responseShape === "consumed-fields-only" && value.aiAssistance === "disabled" && Array.isArray(value.reasons);
+}
+function isDataFlowDependency(value) {
+  return isRecord2(value) && typeof value.id === "string" && typeof value.kind === "string" && typeof value.direction === "string" && typeof value.execution === "string" && typeof value.proof === "string" && typeof value.association === "string" && Array.isArray(value.parameters) && isRecord2(value.response) && isStringArray(value.response.consumedFields) && isStringArray(value.evidenceIds) && isStringArray(value.observationIds);
+}
+function isDataFlowReportBase(value) {
+  return isRecord2(value) && value.schemaVersion === import_shared3.DATA_FLOW_SCHEMA_VERSION && typeof value.reportId === "string" && isRecord2(value.baseline) && typeof value.baseline.registryEpoch === "string" && typeof value.baseline.analyzerVersion === "string" && isStringArray(value.baseline.analyzedSourceVersions) && isDataFlowCapability(value.capability) && Array.isArray(value.dependencies) && value.dependencies.every(isDataFlowDependency) && Array.isArray(value.evidence) && Array.isArray(value.diagnostics) && isReportCompleteness(value.completeness);
+}
+function isComponentDataFlowReport(value) {
+  return isDataFlowReportBase(value) && isRecord2(value) && isRecord2(value.component) && isRecord2(value.component.source) && typeof value.component.source.fileId === "string" && typeof value.component.source.sourceVersion === "string";
+}
+function isPageDataFlowReport(value) {
+  return isDataFlowReportBase(value);
+}
 function parseCapability(value, expected) {
   if (!isAgentCapabilitySnapshot(value) || value.providerProfileId !== expected.providerProfileId || value.modelProfileId !== expected.modelProfileId) {
     throw new RuntimeApiError();
@@ -408,7 +434,7 @@ function createRuntimeApi(options) {
     }
     pendingRequests.clear();
   }
-  async function requestJson(endpoint, method, body) {
+  async function requestJson(endpoint, method, body, maximumResponseBytes = MAX_JSON_RESPONSE_BYTES) {
     const abortController = new AbortController();
     pendingRequests.add(abortController);
     try {
@@ -421,7 +447,7 @@ function createRuntimeApi(options) {
         ...body === void 0 ? {} : { body: JSON.stringify(body) },
         signal: abortController.signal
       });
-      return await readJsonEnvelope(response);
+      return await readJsonEnvelope(response, maximumResponseBytes);
     } finally {
       pendingRequests.delete(abortController);
     }
@@ -515,6 +541,30 @@ function createRuntimeApi(options) {
       }
       return Object.freeze({ ...data });
     },
+    async componentDataFlowReport(request) {
+      const data = await requestJson(
+        import_shared3.SPOTPATCH_ENDPOINTS.dataFlowComponentReport,
+        "POST",
+        request,
+        options.dataFlowReportMaxBytes
+      );
+      if (!isComponentDataFlowReport(data)) {
+        throw new RuntimeApiError();
+      }
+      return deepFreeze(data);
+    },
+    async pageDataFlowReport(request) {
+      const data = await requestJson(
+        import_shared3.SPOTPATCH_ENDPOINTS.dataFlowPageReport,
+        "POST",
+        request,
+        options.dataFlowReportMaxBytes
+      );
+      if (!isPageDataFlowReport(data)) {
+        throw new RuntimeApiError();
+      }
+      return deepFreeze(data);
+    },
     async openEditor(request) {
       const data = await requestJson(import_shared3.SPOTPATCH_ENDPOINTS.openEditor, "POST", request);
       if (!isRecord2(data) || data.editor !== "auto" && data.editor !== "vscode" && data.editor !== "cursor") {
@@ -2455,6 +2505,12 @@ function createBrandMark(document, content) {
   return svg;
 }
 
+// src/ui/data-flow-panel-contract.ts
+var DATA_FLOW_EXTENSION_KEY = /* @__PURE__ */ Symbol.for("spotpatch.data-flow.extension.v1");
+function getDataFlowExtension(target2 = globalThis) {
+  return target2[DATA_FLOW_EXTENSION_KEY];
+}
+
 // src/ui/dialog-placement.ts
 var VIEWPORT_MARGIN = 16;
 var TARGET_GAP = 14;
@@ -2522,6 +2578,12 @@ function calculateDialogPlacement({
   });
 }
 
+// src/ui/external-handoff-contract.ts
+var EXTERNAL_HANDOFF_EXTENSION_KEY = /* @__PURE__ */ Symbol.for("spotpatch.external-handoff.v1");
+function getExternalHandoffExtension() {
+  return globalThis[EXTERNAL_HANDOFF_EXTENSION_KEY];
+}
+
 // src/ui/localization.ts
 var import_shared6 = require("@spotpatch/shared");
 var STATUS_EN = Object.freeze({
@@ -2554,6 +2616,8 @@ var STATUS_ZH = Object.freeze({
   reverted: "\u5DF2\u64A4\u9500",
   failed: "\u5931\u8D25"
 });
+var EXTERNAL_HANDOFF_ERROR_EN = "The external Agent handoff request failed.";
+var EXTERNAL_HANDOFF_ERROR_ZH = "\u5916\u90E8 Agent \u4EA4\u63A5\u8BF7\u6C42\u5931\u8D25\u3002";
 var ERROR_MESSAGES_EN = Object.freeze({
   [import_shared6.ERROR_CODES.INVALID_REQUEST]: "The Agent request was rejected as invalid.",
   [import_shared6.ERROR_CODES.INVALID_TOKEN]: "The local SpotPatch session expired.",
@@ -2562,6 +2626,9 @@ var ERROR_MESSAGES_EN = Object.freeze({
   [import_shared6.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "The selected source is outside the project.",
   [import_shared6.ERROR_CODES.SOURCE_TOO_LARGE]: "The selected source exceeds the safety limit.",
   [import_shared6.ERROR_CODES.EDITOR_OPEN_FAILED]: "The editor request failed.",
+  [import_shared6.ERROR_CODES.DATA_FLOW_DISABLED]: "Component data-flow analysis is disabled.",
+  [import_shared6.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: "The selected source changed. Select the component again.",
+  [import_shared6.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: "Component data-flow analysis was cancelled.",
   [import_shared6.ERROR_CODES.AI_DISABLED]: "AI execution is disabled in Vite configuration.",
   [import_shared6.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "The provider Key environment variable is missing on the Vite process.",
   [import_shared6.ERROR_CODES.PROVIDER_AUTH_FAILED]: "The provider rejected authentication. Check the server-side Key.",
@@ -2572,6 +2639,24 @@ var ERROR_MESSAGES_EN = Object.freeze({
   [import_shared6.ERROR_CODES.AGENT_BUSY]: "Another write Agent job is still active.",
   [import_shared6.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: "The Agent stopped at a configured time, turn, output, or size limit.",
   [import_shared6.ERROR_CODES.AGENT_CANCELLED]: "The Agent job was cancelled.",
+  [import_shared6.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.EXTERNAL_HANDOFF_UNAVAILABLE]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.HANDOFF_VALIDATION_FAILED]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.HANDOFF_SOURCE_STALE]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.HANDOFF_NOT_FOUND]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.HANDOFF_EXPIRED]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.HANDOFF_CURSOR_INVALID]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.HANDOFF_RESPONSE_TOO_LARGE]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.BRIDGE_UNAUTHORIZED]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.BRIDGE_PROTOCOL_MISMATCH]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.BRIDGE_BUSY]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.EXTERNAL_AGENT_BUSY]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.ACTIVE_ADAPTER_CONFLICT]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.ACTIVE_ADAPTER_LEASE_INVALID]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.ACTIVE_DISPATCH_INVALID]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.SESSION_NOT_FOUND]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.SESSION_AMBIGUOUS]: EXTERNAL_HANDOFF_ERROR_EN,
+  [import_shared6.ERROR_CODES.SESSION_CLOSED]: EXTERNAL_HANDOFF_ERROR_EN,
   [import_shared6.ERROR_CODES.WORKTREE_DIRTY]: "Confirm inclusion of local changes before running AI.",
   [import_shared6.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: "Vite root must be an initialized Git repository root.",
   [import_shared6.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: "Finish the active merge, rebase, cherry-pick, or revert.",
@@ -2597,6 +2682,9 @@ var ERROR_MESSAGES_ZH = Object.freeze({
   [import_shared6.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "\u9009\u4E2D\u6E90\u7801\u4F4D\u4E8E\u9879\u76EE\u6839\u76EE\u5F55\u4E4B\u5916\u3002",
   [import_shared6.ERROR_CODES.SOURCE_TOO_LARGE]: "\u9009\u4E2D\u6E90\u7801\u8D85\u8FC7\u5B89\u5168\u5927\u5C0F\u9650\u5236\u3002",
   [import_shared6.ERROR_CODES.EDITOR_OPEN_FAILED]: "\u7F16\u8F91\u5668\u6253\u5F00\u8BF7\u6C42\u5931\u8D25\u3002",
+  [import_shared6.ERROR_CODES.DATA_FLOW_DISABLED]: "\u7EC4\u4EF6\u6570\u636E\u94FE\u8DEF\u5206\u6790\u672A\u542F\u7528\u3002",
+  [import_shared6.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: "\u9009\u4E2D\u6E90\u7801\u5DF2\u7ECF\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9\u7EC4\u4EF6\u3002",
+  [import_shared6.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: "\u7EC4\u4EF6\u6570\u636E\u94FE\u8DEF\u5206\u6790\u5DF2\u53D6\u6D88\u3002",
   [import_shared6.ERROR_CODES.AI_DISABLED]: "Vite \u914D\u7F6E\u672A\u542F\u7528 AI \u6267\u884C\u3002",
   [import_shared6.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "\u542F\u52A8 Vite \u7684\u8FDB\u7A0B\u4E2D\u7F3A\u5C11\u6A21\u578B\u670D\u52A1 Key \u73AF\u5883\u53D8\u91CF\u3002",
   [import_shared6.ERROR_CODES.PROVIDER_AUTH_FAILED]: "\u6A21\u578B\u670D\u52A1\u9274\u6743\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u670D\u52A1\u7AEF Key\u3002",
@@ -2607,6 +2695,24 @@ var ERROR_MESSAGES_ZH = Object.freeze({
   [import_shared6.ERROR_CODES.AGENT_BUSY]: "\u5F53\u524D\u9879\u76EE\u5DF2\u6709\u4E00\u4E2A\u5199\u5165\u4EFB\u52A1\u6B63\u5728\u8FD0\u884C\u3002",
   [import_shared6.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: "Agent \u8FBE\u5230\u65F6\u95F4\u3001\u8F6E\u6B21\u3001\u8F93\u51FA\u6216\u53D8\u66F4\u89C4\u6A21\u9650\u5236\u3002",
   [import_shared6.ERROR_CODES.AGENT_CANCELLED]: "Agent \u4EFB\u52A1\u5DF2\u53D6\u6D88\u3002",
+  [import_shared6.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.EXTERNAL_HANDOFF_UNAVAILABLE]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.HANDOFF_VALIDATION_FAILED]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.HANDOFF_SOURCE_STALE]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.HANDOFF_NOT_FOUND]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.HANDOFF_EXPIRED]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.HANDOFF_CURSOR_INVALID]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.HANDOFF_RESPONSE_TOO_LARGE]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.BRIDGE_UNAUTHORIZED]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.BRIDGE_PROTOCOL_MISMATCH]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.BRIDGE_BUSY]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.EXTERNAL_AGENT_BUSY]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.ACTIVE_ADAPTER_CONFLICT]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.ACTIVE_ADAPTER_LEASE_INVALID]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.ACTIVE_DISPATCH_INVALID]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.SESSION_NOT_FOUND]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.SESSION_AMBIGUOUS]: EXTERNAL_HANDOFF_ERROR_ZH,
+  [import_shared6.ERROR_CODES.SESSION_CLOSED]: EXTERNAL_HANDOFF_ERROR_ZH,
   [import_shared6.ERROR_CODES.WORKTREE_DIRTY]: "\u8FD0\u884C AI \u524D\uFF0C\u8BF7\u660E\u786E\u540C\u610F\u5C06\u5F53\u524D\u672C\u5730\u4FEE\u6539\u7EB3\u5165\u9694\u79BB\u57FA\u7EBF\u3002",
   [import_shared6.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: "Vite \u6839\u76EE\u5F55\u4E0D\u662F\u5DF2\u521D\u59CB\u5316 Git \u4ED3\u5E93\u7684\u9876\u5C42\u76EE\u5F55\u3002",
   [import_shared6.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: "\u8BF7\u5148\u5B8C\u6210\u5F53\u524D merge\u3001rebase\u3001cherry-pick \u6216 revert\uFF0C\u518D\u8FD0\u884C AI\u3002",
@@ -3031,6 +3137,15 @@ var DIALOG_FALLBACK_HEIGHT = Object.freeze({
   previewing: 560,
   selected: DIALOG_MAX_HEIGHT
 });
+function resolveStyleNonce(document) {
+  const nonces = new Set(
+    [...document.querySelectorAll("script[nonce]")].map((script) => script.nonce?.trim() ?? "").filter(Boolean)
+  );
+  if (nonces.size !== 1) {
+    return void 0;
+  }
+  return nonces.values().next().value;
+}
 function createStyles(document) {
   const style = document.createElement("style");
   style.textContent = `
@@ -3741,7 +3856,18 @@ function summaryLine(summary, prefix) {
   const line = summary.split("\n").find((candidate) => candidate.startsWith(`${prefix}: `));
   return line?.slice(prefix.length + 2).trim();
 }
-function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: false }), localePreference = "auto") {
+function createUnavailableDataFlowPanel(document, changesRoot, diagnosticsRoot) {
+  changesRoot.append(diagnosticsRoot);
+  return Object.freeze({
+    root: changesRoot,
+    refreshButton: createButton(document, ""),
+    styles: document.createElement("style"),
+    dispose: () => void 0,
+    render: () => void 0,
+    resetView: () => void 0
+  });
+}
+function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: false }), localePreference = "auto", dataFlowEnabled = false, externalAgentEnabled = false, framework = "vite", sessionId = "") {
   const localizer = createUiLocalizer(document, localePreference);
   let messages = localizer.messages();
   const host = document.createElement("spotpatch-root");
@@ -3857,7 +3983,29 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
   summary.className = "spotpatch-summary";
   diagnostics.append(diagnosticsLabel, summary);
   const agentPanel = createAgentPanel(document, ai, localizer);
-  selectionPanel.append(targetsPanel, diagnostics, agentPanel.root);
+  const changesPanel = createMarkedElement(document, "div");
+  const externalHandoffPanel = externalAgentEnabled ? getExternalHandoffExtension()?.createPanel(
+    document,
+    framework,
+    localizer.locale,
+    sessionId,
+    localizer.subscribe,
+    placeDialog
+  ) : void 0;
+  changesPanel.append(
+    targetsPanel,
+    agentPanel.root,
+    ...externalHandoffPanel === void 0 ? [] : [externalHandoffPanel.root]
+  );
+  const dataFlowPanel = getDataFlowExtension()?.createPanel(
+    document,
+    dataFlowEnabled,
+    localizer.locale,
+    changesPanel,
+    diagnostics,
+    placeDialog
+  ) ?? createUnavailableDataFlowPanel(document, changesPanel, diagnostics);
+  selectionPanel.append(dataFlowPanel.root);
   const previewPanel = createMarkedElement(document, "div");
   previewPanel.className = "spotpatch-preview-panel";
   previewPanel.hidden = true;
@@ -3900,6 +4048,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
     agentPanel.testButton,
     addTargetButton,
     agentPanel.runButton,
+    ...externalHandoffPanel === void 0 ? [] : [externalHandoffPanel.sendButton],
     previewButton,
     agentPanel.cancelButton,
     agentPanel.applyButton,
@@ -3915,8 +4064,19 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
   liveRegion.className = "spotpatch-live";
   liveRegion.setAttribute("aria-live", "polite");
   liveRegion.setAttribute("aria-atomic", "true");
-  shadowRoot.append(
+  const styles2 = [
     createStyles(document),
+    dataFlowPanel.styles,
+    ...externalHandoffPanel === void 0 ? [] : [externalHandoffPanel.styles]
+  ];
+  const styleNonce = resolveStyleNonce(document);
+  if (styleNonce !== void 0) {
+    for (const style of styles2) {
+      style.nonce = styleNonce;
+    }
+  }
+  shadowRoot.append(
+    ...styles2,
     selectionHighlights,
     highlight,
     dialog,
@@ -3934,6 +4094,13 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
   let currentTargets = [];
   let currentMaximum = 0;
   let currentEditorFeedbackState = "idle";
+  let currentDataFlowState = Object.freeze({
+    component: Object.freeze({
+      status: dataFlowEnabled ? "idle" : "disabled"
+    }),
+    page: Object.freeze({ status: dataFlowEnabled ? "idle" : "disabled" }),
+    observationCount: 0
+  });
   function renderEditorStatus(state) {
     currentEditorFeedbackState = state;
     editorFeedback.dataset.state = state;
@@ -4191,6 +4358,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
     openEditorButton.disabled = !canOpenEditor;
     previewButton.disabled = !canPreview;
     agentPanel.setContextReady(canPreview);
+    externalHandoffPanel?.setContextReady(canPreview);
     updateContextOverview(summaryText);
     placeDialog();
   }
@@ -4207,6 +4375,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
     previewButton.hidden = !selected;
     secondaryActions.hidden = !selected;
     agentPanel.setSelectionVisible(selected);
+    externalHandoffPanel?.setSelectionVisible(selected);
     copyButton.hidden = !previewing;
     backButton.hidden = !previewing;
     title.textContent = previewing ? messages.dialog.previewTitle : messages.dialog.editTitle;
@@ -4235,6 +4404,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
     previewButton.textContent = messages.actions.preview;
     copyButton.textContent = messages.actions.copy;
     backButton.textContent = messages.actions.back;
+    dataFlowPanel.render(currentDataFlowState);
     triggerButton.title = messages.trigger.title(shortcut);
     triggerButton.textContent = currentStatus === "inspecting" ? messages.trigger.stop : messages.trigger.select;
     renderPanelStatus(currentStatus);
@@ -4273,6 +4443,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
     repositoryLink,
     previewButton,
     copyButton,
+    dataFlowRefreshButton: dataFlowPanel.refreshButton,
     backButton,
     closeButton,
     agentProviderSelect: agentPanel.providerSelect,
@@ -4286,6 +4457,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
     agentApplyButton: agentPanel.applyButton,
     agentRevertButton: agentPanel.revertButton,
     agentResetButton: agentPanel.resetButton,
+    ...externalHandoffPanel === void 0 ? {} : { externalHandoffPanel },
     renderStatus(status) {
       const inspecting = status === "inspecting";
       triggerButton.setAttribute("aria-pressed", String(inspecting));
@@ -4293,6 +4465,11 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
       renderPanelStatus(status);
     },
     renderEditorStatus,
+    renderDataFlow(state) {
+      currentDataFlowState = state;
+      dataFlowPanel.render(state);
+      placeDialog();
+    },
     showHighlight(rect, label) {
       currentRect = rect;
       highlight.hidden = false;
@@ -4329,6 +4506,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
       currentCanPreview = enabled;
       previewButton.disabled = !enabled;
       agentPanel.setContextReady(enabled);
+      externalHandoffPanel?.setContextReady(enabled);
     },
     hideSelection() {
       dialog.hidden = true;
@@ -4353,8 +4531,11 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
       currentCanPreview = false;
       agentPanel.setContextReady(false);
       agentPanel.setSelectionVisible(false);
+      externalHandoffPanel?.setContextReady(false);
+      externalHandoffPanel?.setSelectionVisible(false);
       agentPanel.setEditingEnabled(true);
       agentPanel.resetJob();
+      dataFlowPanel.resetView();
     },
     hideSelectionTemporarily() {
       dialog.hidden = true;
@@ -4384,6 +4565,7 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
       });
       openEditorButton.disabled = !currentCanOpenEditor;
       previewButton.disabled = !enabled || !currentCanPreview;
+      externalHandoffPanel?.setContextReady(enabled && currentCanPreview);
       agentPanel.setEditingEnabled(enabled);
       placeDialog();
     },
@@ -4423,6 +4605,8 @@ function createRuntimeView(document, shortcut, ai = Object.freeze({ enabled: fal
       diagnostics.removeEventListener("toggle", placeDialog);
       localeButton.removeEventListener("click", localizer.toggle);
       unsubscribeLocale();
+      dataFlowPanel.dispose();
+      externalHandoffPanel?.dispose();
       agentPanel.dispose();
       host.remove();
     }
@@ -4913,9 +5097,19 @@ function resolveBrowserDependencies(dependencies) {
 }
 function createController(config, dependencies = {}) {
   const browser = resolveBrowserDependencies(dependencies);
-  const view = dependencies.view ?? createRuntimeView(browser.document, config.shortcut, config.ai, config.locale);
+  const view = dependencies.view ?? createRuntimeView(
+    browser.document,
+    config.shortcut,
+    config.ai,
+    config.locale,
+    config.dataFlow.enabled,
+    config.externalAgent.enabled,
+    config.framework,
+    config.sessionId
+  );
   const api = dependencies.api ?? createRuntimeApi({
     apiBase: config.apiBase,
+    dataFlowReportMaxBytes: config.dataFlow.limits.reportMaxBytes,
     fetch: browser.window.fetch.bind(browser.window),
     sessionToken: config.sessionToken
   });
@@ -4927,6 +5121,9 @@ function createController(config, dependencies = {}) {
   const restoredSelection = selectionSession.load();
   const sourceResolver = createSourceResolver({
     adapter: dependencies.reactAdapter ?? (0, import_react_adapter.createReact18Adapter)({
+      ...config.dataFlow.enabled ? {
+        getComponentRegistration: (component) => getDataFlowExtension()?.getComponentRegistration(component)
+      } : {},
       maxComponentDepth: config.budget.maxComponentDepth
     }),
     onAdapterError() {
@@ -4950,6 +5147,8 @@ function createController(config, dependencies = {}) {
       apiStatus: marker === void 0 ? "not-required" : target2.code === void 0 ? "failed" : "connected",
       code: target2.code,
       collectionStatus: "ready",
+      dataFlowReport: void 0,
+      dataFlowStatus: "idle",
       element: void 0,
       elementContext: target2.element,
       instruction: target2.instruction,
@@ -4964,6 +5163,9 @@ function createController(config, dependencies = {}) {
   let workflowSelectionActive = false;
   let sessionRevision = 0;
   let editorRequestRevision = 0;
+  let dataFlowRequestRevision = 0;
+  let pageDataFlowReport;
+  let pageDataFlowStatus = "idle";
   let addingTarget = false;
   let previewPrompt = "";
   let previousFocus;
@@ -4978,6 +5180,90 @@ function createController(config, dependencies = {}) {
   function activeTarget() {
     return targets.find((target2) => target2.id === activeTargetId) ?? targets.at(-1);
   }
+  function dataFlowRequest(target2) {
+    const react2 = target2.resolution.react;
+    if (react2.componentSourceId !== void 0 && react2.sourceVersion !== void 0) {
+      return Object.freeze({
+        schemaVersion: import_shared9.DATA_FLOW_SCHEMA_VERSION,
+        componentSourceId: react2.componentSourceId,
+        sourceVersion: react2.sourceVersion
+      });
+    }
+    const marker = target2.marker;
+    return marker === void 0 ? void 0 : Object.freeze({
+      schemaVersion: import_shared9.DATA_FLOW_SCHEMA_VERSION,
+      fileId: marker.fileId,
+      line: marker.line,
+      column: marker.column
+    });
+  }
+  function renderDataFlowView() {
+    const dataFlowClient = getDataFlowExtension();
+    const observations = dataFlowClient?.observations(browser.window.location.pathname) ?? [];
+    const current = activeTarget();
+    view.renderDataFlow({
+      component: Object.freeze({
+        status: config.dataFlow.enabled ? current?.dataFlowStatus ?? "idle" : "disabled",
+        ...current?.dataFlowReport === void 0 ? {} : {
+          report: dataFlowClient?.mergeComponentReport(
+            current.dataFlowReport,
+            observations
+          ) ?? current.dataFlowReport
+        }
+      }),
+      page: Object.freeze({
+        status: config.dataFlow.enabled ? pageDataFlowStatus : "disabled",
+        ...pageDataFlowReport === void 0 ? {} : {
+          report: dataFlowClient?.mergePageReport(pageDataFlowReport, observations) ?? pageDataFlowReport
+        }
+      }),
+      observationCount: observations.length
+    });
+  }
+  async function loadDataFlowReports() {
+    if (!config.dataFlow.enabled) {
+      renderDataFlowView();
+      return;
+    }
+    const current = activeTarget();
+    const currentRequest = current === void 0 ? void 0 : dataFlowRequest(current);
+    const pageTargets = targets.flatMap((target2) => {
+      const request = dataFlowRequest(target2);
+      return request === void 0 ? [] : [request];
+    });
+    const revision = ++dataFlowRequestRevision;
+    const selectionRevision = sessionRevision;
+    if (current !== void 0) current.dataFlowStatus = "loading";
+    pageDataFlowStatus = pageTargets.length === 0 ? "idle" : "loading";
+    renderDataFlowView();
+    const [componentResult, pageResult] = await Promise.allSettled([
+      currentRequest === void 0 ? Promise.resolve(void 0) : api.componentDataFlowReport(currentRequest),
+      pageTargets.length === 0 ? Promise.resolve(void 0) : api.pageDataFlowReport({
+        schemaVersion: import_shared9.DATA_FLOW_SCHEMA_VERSION,
+        targets: pageTargets
+      })
+    ]);
+    if (!mounted || revision !== dataFlowRequestRevision || selectionRevision !== sessionRevision) {
+      return;
+    }
+    if (current !== void 0 && targets.includes(current)) {
+      if (componentResult.status === "fulfilled") {
+        current.dataFlowReport = componentResult.value;
+        current.dataFlowStatus = componentResult.value === void 0 ? "idle" : "ready";
+      } else {
+        current.dataFlowReport = void 0;
+        current.dataFlowStatus = "error";
+      }
+    }
+    if (pageResult.status === "fulfilled") {
+      pageDataFlowReport = pageResult.value;
+      pageDataFlowStatus = pageResult.value === void 0 ? "idle" : "ready";
+    } else {
+      pageDataFlowReport = void 0;
+      pageDataFlowStatus = "error";
+    }
+    renderDataFlowView();
+  }
   function snapshotTarget(target2) {
     if (target2.elementContext === void 0 || target2.styles === void 0) {
       return void 0;
@@ -5142,10 +5428,14 @@ ${summary}`;
     sessionRevision += 1;
     api.cancelPending();
     agentWorkflow.disposeSelection();
+    externalHandoffWorkflow?.cancelPending();
     clearCollectionTimers();
     resizeObserver?.disconnect();
     targets = [];
     activeTargetId = void 0;
+    dataFlowRequestRevision += 1;
+    pageDataFlowReport = void 0;
+    pageDataFlowStatus = "idle";
     selectionOpen = false;
     workflowSelectionActive = false;
     addingTarget = false;
@@ -5200,6 +5490,7 @@ ${summary}`;
         workflowSelectionActive = true;
       }
       refreshSelectionView(true);
+      void loadDataFlowReports();
       view.focusTargetInstruction(activeTargetId);
       persistSelection();
       return;
@@ -5256,6 +5547,13 @@ ${summary}`;
     },
     view
   });
+  const externalHandoffWorkflow = config.externalAgent.enabled && view.externalHandoffPanel !== void 0 ? getExternalHandoffExtension()?.createWorkflow(
+    browser.window.fetch.bind(browser.window),
+    view.externalHandoffPanel,
+    selectedAnnotation,
+    config.sessionToken,
+    browser.window
+  ) : void 0;
   async function loadSourceContext(target2, revision) {
     const marker = target2.marker;
     if (marker === void 0) {
@@ -5350,6 +5648,7 @@ ${summary}`;
       transition({ type: "SELECT" });
       view.hideHighlight();
       refreshSelectionView(true);
+      void loadDataFlowReports();
       view.focusTargetInstruction(duplicate.id);
       view.announce(view.messages().announcements.duplicate);
       return;
@@ -5381,7 +5680,9 @@ ${summary}`;
       styles: void 0,
       instruction: "",
       apiStatus: marker === void 0 ? "not-required" : "loading",
-      collectionStatus: "loading"
+      collectionStatus: "loading",
+      dataFlowReport: void 0,
+      dataFlowStatus: "idle"
     };
     targets.push(target2);
     activeTargetId = target2.id;
@@ -5391,6 +5692,7 @@ ${summary}`;
     view.hideHighlight();
     resizeObserver?.observe(element2);
     refreshSelectionView(true);
+    void loadDataFlowReports();
     selectionOpen = true;
     view.focusTargetInstruction(target2.id);
     scheduleBrowserContextCollection(target2, revision);
@@ -5495,11 +5797,15 @@ ${summary}`;
       }
       view.hideSelectionTemporarily();
       view.hideSelectionHighlights();
+      pageDataFlowReport = void 0;
+      pageDataFlowStatus = "idle";
+      renderDataFlowView();
       selectionSession.clear();
       view.announce(view.messages().announcements.allTargetsRemoved);
       return;
     }
     refreshSelectionView();
+    void loadDataFlowReports();
     persistSelection();
     view.announce(view.messages().announcements.targetRemoved);
   }
@@ -5662,16 +5968,21 @@ ${summary}`;
     }
     activeTargetId = targetId;
     refreshSelectionView();
+    void loadDataFlowReports();
     view.focusTargetInstruction(targetId);
   }
   function handleReselect() {
     beginReselect();
   }
+  function handleDataFlowRefresh() {
+    void loadDataFlowReports();
+  }
   function mount() {
     if (mounted) {
       return;
     }
     mounted = true;
+    externalHandoffWorkflow?.mount();
     view.renderStatus(state.status);
     browser.document.addEventListener("pointermove", handlePointerMove, true);
     browser.document.addEventListener("click", handleClick, true);
@@ -5685,6 +5996,7 @@ ${summary}`;
     view.targetList.addEventListener("input", handleTargetListInput);
     view.targetList.addEventListener("keydown", handleTargetListKeydown);
     view.openEditorButton.addEventListener("click", handleOpenEditorButtonClick);
+    view.dataFlowRefreshButton.addEventListener("click", handleDataFlowRefresh);
     view.previewButton.addEventListener("click", handlePreview);
     view.copyButton.addEventListener("click", handleCopy);
     view.backButton.addEventListener("click", handleBack);
@@ -5737,6 +6049,7 @@ ${summary}`;
       api.cancelPending();
       api.dispose();
       agentWorkflow.disposeSelection();
+      externalHandoffWorkflow?.dispose();
       sourceResolver.dispose();
       return;
     }
@@ -5755,6 +6068,7 @@ ${summary}`;
     view.targetList.removeEventListener("input", handleTargetListInput);
     view.targetList.removeEventListener("keydown", handleTargetListKeydown);
     view.openEditorButton.removeEventListener("click", handleOpenEditorButtonClick);
+    view.dataFlowRefreshButton.removeEventListener("click", handleDataFlowRefresh);
     view.previewButton.removeEventListener("click", handlePreview);
     view.copyButton.removeEventListener("click", handleCopy);
     view.backButton.removeEventListener("click", handleBack);
@@ -5799,6 +6113,7 @@ ${summary}`;
     api.cancelPending();
     api.dispose();
     agentWorkflow.disposeSelection();
+    externalHandoffWorkflow?.dispose();
     sourceResolver.dispose();
     view.dispose();
     state = INITIAL_RUNTIME_STATE;
@@ -5815,9 +6130,551 @@ function bootstrapSpotPatch(config) {
   target2[RUNTIME_INSTANCE_KEY] = controller;
   controller.mount();
 }
+
+// src/data-flow/data-flow-runtime.ts
+var import_data_flow_runtime = require("@spotpatch/shared/data-flow-runtime");
+var RUNTIME_KEY = /* @__PURE__ */ Symbol.for(
+  "spotpatch.data-flow.runtime.v1"
+);
+var REACT_MEMO_TYPE = /* @__PURE__ */ Symbol.for("react.memo");
+var REACT_FORWARD_REF_TYPE = /* @__PURE__ */ Symbol.for("react.forward_ref");
+function positiveNow(target2) {
+  return target2.performance?.now() ?? Date.now();
+}
+function createOpaqueSequence(prefix) {
+  let sequence = 0;
+  const randomPrefix = (() => {
+    try {
+      const bytes = new Uint8Array(8);
+      globalThis.crypto.getRandomValues(bytes);
+      return Array.from(bytes, (value) => value.toString(36).padStart(2, "0")).join("");
+    } catch {
+      return "local";
+    }
+  })();
+  return () => {
+    sequence += 1;
+    return `${prefix}_${randomPrefix}_${sequence.toString(36)}`;
+  };
+}
+function freezeUrl(value, baseUrl) {
+  try {
+    const url = new URL(value, baseUrl);
+    return Object.freeze({
+      origin: url.origin,
+      pathname: url.pathname,
+      queryKeys: Object.freeze(
+        [...new Set(url.searchParams.keys())].sort().slice(0, import_data_flow_runtime.DATA_FLOW_URL_QUERY_KEY_LIMIT)
+      )
+    });
+  } catch {
+    return Object.freeze({
+      pathname: value.split(/[?#]/u, 1)[0] ?? "{invalid}",
+      queryKeys: Object.freeze([])
+    });
+  }
+}
+function readFetchUrl(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.toString();
+  return input.url;
+}
+function readFetchMethod(input, init) {
+  if (init?.method !== void 0) return init.method.toUpperCase();
+  return typeof Request !== "undefined" && input instanceof Request ? input.method.toUpperCase() : "GET";
+}
+function isSpotPatchInternalUrl(value, baseUrl) {
+  try {
+    const pathname = new URL(value, baseUrl).pathname;
+    return pathname === import_data_flow_runtime.SPOTPATCH_API_BASE || pathname.startsWith(`${import_data_flow_runtime.SPOTPATCH_API_BASE}/`);
+  } catch {
+    return false;
+  }
+}
+function approximateBytes(value) {
+  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
+function createRingStore(limits, target2) {
+  const entries = [];
+  let totalBytes = 0;
+  function removeExpired(now) {
+    while (entries[0] !== void 0 && now - entries[0].recordedAt > limits.observationTtlMs) {
+      const removed = entries.shift();
+      if (removed !== void 0) totalBytes -= removed.bytes;
+    }
+  }
+  return Object.freeze({
+    add(observation) {
+      const now = positiveNow(target2);
+      removeExpired(now);
+      const bytes = approximateBytes(observation);
+      if (bytes > limits.observationMaxBytes) return;
+      entries.push(Object.freeze({ bytes, observation, recordedAt: now }));
+      totalBytes += bytes;
+      while (entries.length > limits.observationMaxEntries || totalBytes > limits.observationMaxBytes) {
+        const removed = entries.shift();
+        if (removed !== void 0) totalBytes -= removed.bytes;
+      }
+    },
+    clear() {
+      entries.length = 0;
+      totalBytes = 0;
+    },
+    values() {
+      removeExpired(positiveNow(target2));
+      return Object.freeze(entries.map(({ observation }) => observation));
+    }
+  });
+}
+function ownPropertyDescriptor(target2, key) {
+  try {
+    return Object.getOwnPropertyDescriptor(target2, key);
+  } catch {
+    return void 0;
+  }
+}
+function nestedReactWrapperComponent(candidate) {
+  const marker = ownPropertyDescriptor(candidate, "$$typeof")?.value;
+  const key = marker === REACT_MEMO_TYPE ? "type" : marker === REACT_FORWARD_REF_TYPE ? "render" : void 0;
+  if (key === void 0) return void 0;
+  const nested = ownPropertyDescriptor(candidate, key)?.value;
+  return typeof nested === "object" && nested !== null || typeof nested === "function" ? nested : void 0;
+}
+function installWritableDataProperty(target2, key, replacement, original = ownPropertyDescriptor(target2, key)) {
+  if (original === void 0 || !("value" in original) || !original.writable) {
+    return void 0;
+  }
+  try {
+    Object.defineProperty(target2, key, { ...original, value: replacement });
+  } catch {
+    return void 0;
+  }
+  return () => {
+    try {
+      if (ownPropertyDescriptor(target2, key)?.value === replacement) {
+        Object.defineProperty(target2, key, original);
+      }
+    } catch {
+    }
+  };
+}
+function recordWithoutAffectingHost(record2) {
+  try {
+    record2();
+  } catch {
+  }
+}
+function createDataFlowRuntime(config, target2 = globalThis) {
+  const componentRegistry = /* @__PURE__ */ new WeakMap();
+  const xhrMetadata = /* @__PURE__ */ new WeakMap();
+  const store = createRingStore(config.limits, target2);
+  const nextInvocationId = createOpaqueSequence("invocation");
+  const nextObservationId = createOpaqueSequence("observation");
+  const pageEpoch = createOpaqueSequence("page")();
+  const nextRouteEpoch = createOpaqueSequence("route");
+  let routeEpoch = nextRouteEpoch();
+  let routeKey;
+  let currentInvocation;
+  let currentRequestFrame;
+  let disposed = false;
+  const originalFetch = (() => {
+    try {
+      return target2.fetch;
+    } catch {
+      return void 0;
+    }
+  })();
+  function spotPatchFetch(input, init) {
+    if (originalFetch === void 0) {
+      throw new TypeError("Fetch is unavailable.");
+    }
+    const result = Reflect.apply(originalFetch, this, [input, init]);
+    recordWithoutAffectingHost(() => {
+      const frame = currentRequestFrame;
+      const token = frame?.invocationToken;
+      const rawUrl = readFetchUrl(input);
+      if (isSpotPatchInternalUrl(
+        rawUrl,
+        target2.location?.href ?? "http://spotpatch.invalid/"
+      )) {
+        return;
+      }
+      store.add(
+        Object.freeze({
+          schemaVersion: import_data_flow_runtime.DATA_FLOW_SCHEMA_VERSION,
+          id: nextObservationId(),
+          pageEpoch,
+          routeEpoch,
+          ...frame === void 0 ? {} : {
+            requestCallsiteId: frame.requestCallsiteId,
+            sourceVersion: frame.sourceVersion
+          },
+          ...token === void 0 ? {} : {
+            invocationId: token.invocationId,
+            componentSourceId: token.componentSourceId,
+            triggerCallsiteId: token.triggerCallsiteId
+          },
+          transport: "fetch",
+          method: readFetchMethod(input, init),
+          url: freezeUrl(rawUrl, target2.location?.href ?? "http://spotpatch.invalid/"),
+          outcome: "dispatched",
+          freshness: "current",
+          diagnosticIds: Object.freeze([])
+        })
+      );
+    });
+    return result;
+  }
+  const restoreFetch = originalFetch === void 0 ? void 0 : installWritableDataProperty(target2, "fetch", spotPatchFetch);
+  const xhrPrototype = (() => {
+    try {
+      return target2.XMLHttpRequest?.prototype;
+    } catch {
+      return void 0;
+    }
+  })();
+  const originalOpenDescriptor = xhrPrototype === void 0 ? void 0 : ownPropertyDescriptor(xhrPrototype, "open");
+  const originalSendDescriptor = xhrPrototype === void 0 ? void 0 : ownPropertyDescriptor(xhrPrototype, "send");
+  function spotPatchOpen(method, url, ...rest) {
+    const original = originalOpenDescriptor?.value;
+    if (typeof original === "function") {
+      Reflect.apply(original, this, [method, url, ...rest]);
+    }
+    recordWithoutAffectingHost(() => {
+      xhrMetadata.set(this, Object.freeze({ method, url: String(url) }));
+    });
+  }
+  function spotPatchSend(body) {
+    const original = originalSendDescriptor?.value;
+    if (typeof original === "function") Reflect.apply(original, this, [body]);
+    recordWithoutAffectingHost(() => {
+      const metadata = xhrMetadata.get(this);
+      if (metadata === void 0 || isSpotPatchInternalUrl(
+        metadata.url,
+        target2.location?.href ?? "http://spotpatch.invalid/"
+      )) {
+        return;
+      }
+      const frame = currentRequestFrame;
+      const token = frame?.invocationToken;
+      store.add(
+        Object.freeze({
+          schemaVersion: import_data_flow_runtime.DATA_FLOW_SCHEMA_VERSION,
+          id: nextObservationId(),
+          pageEpoch,
+          routeEpoch,
+          ...frame === void 0 ? {} : {
+            requestCallsiteId: frame.requestCallsiteId,
+            sourceVersion: frame.sourceVersion
+          },
+          ...token === void 0 ? {} : {
+            invocationId: token.invocationId,
+            componentSourceId: token.componentSourceId,
+            triggerCallsiteId: token.triggerCallsiteId
+          },
+          transport: "xhr",
+          method: metadata.method.toUpperCase(),
+          url: freezeUrl(
+            metadata.url,
+            target2.location?.href ?? "http://spotpatch.invalid/"
+          ),
+          outcome: "dispatched",
+          freshness: "current",
+          diagnosticIds: Object.freeze([])
+        })
+      );
+    });
+  }
+  const restoreXhrOpen = xhrPrototype === void 0 || typeof originalOpenDescriptor?.value !== "function" ? void 0 : installWritableDataProperty(
+    xhrPrototype,
+    "open",
+    spotPatchOpen,
+    originalOpenDescriptor
+  );
+  const restoreXhrSend = xhrPrototype === void 0 || typeof originalSendDescriptor?.value !== "function" ? void 0 : installWritableDataProperty(
+    xhrPrototype,
+    "send",
+    spotPatchSend,
+    originalSendDescriptor
+  );
+  const runtime = Object.freeze({
+    beginInvocation(metadata) {
+      return Object.freeze({
+        invocationId: nextInvocationId(),
+        componentSourceId: metadata.componentSourceId,
+        triggerCallsiteId: metadata.triggerCallsiteId,
+        sourceVersion: metadata.sourceVersion
+      });
+    },
+    bindInvocation(token, callback) {
+      return function boundInvocation(...args) {
+        return runtime.withInvocation(token, () => Reflect.apply(callback, this, args));
+      };
+    },
+    bindTrigger(metadata, callback) {
+      if (typeof callback !== "function") return callback;
+      const callable = callback;
+      return function boundTrigger(...args) {
+        const token = runtime.beginInvocation(metadata);
+        return runtime.withInvocation(token, () => Reflect.apply(callable, this, args));
+      };
+    },
+    captureInvocation: () => currentInvocation,
+    clear: store.clear,
+    createTrpcLink() {
+      return () => (options) => {
+        recordWithoutAffectingHost(() => {
+          const operation = options.op.path;
+          const operationType = options.op.type;
+          if (typeof operation !== "string" || operation.length === 0 || operation.length > 512 || operationType !== "query" && operationType !== "mutation" && operationType !== "subscription") {
+            return;
+          }
+          const frame = currentRequestFrame;
+          const token = frame?.invocationToken;
+          store.add(
+            Object.freeze({
+              schemaVersion: import_data_flow_runtime.DATA_FLOW_SCHEMA_VERSION,
+              id: nextObservationId(),
+              pageEpoch,
+              routeEpoch,
+              ...frame === void 0 ? {} : {
+                requestCallsiteId: frame.requestCallsiteId,
+                sourceVersion: frame.sourceVersion
+              },
+              ...token === void 0 ? {} : {
+                invocationId: token.invocationId,
+                componentSourceId: token.componentSourceId,
+                triggerCallsiteId: token.triggerCallsiteId
+              },
+              transport: "trpc",
+              method: operationType.toUpperCase(),
+              operation,
+              url: Object.freeze({
+                pathname: operation,
+                queryKeys: Object.freeze([])
+              }),
+              outcome: "dispatched",
+              freshness: "current",
+              diagnosticIds: Object.freeze([])
+            })
+          );
+        });
+        return options.next(options.op);
+      };
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      store.clear();
+      restoreFetch?.();
+      restoreXhrOpen?.();
+      restoreXhrSend?.();
+    },
+    getComponentRegistration: (component) => componentRegistry.get(component),
+    getCurrentRequestFrame: () => currentRequestFrame,
+    observations: () => Object.freeze(
+      store.values().map(
+        (observation) => observation.routeEpoch === routeEpoch ? observation : Object.freeze({ ...observation, freshness: "stale-route" })
+      )
+    ),
+    registerComponent(component, componentSourceId, registeredSourceVersion) {
+      const registration = Object.freeze({
+        componentSourceId,
+        sourceVersion: registeredSourceVersion
+      });
+      const pending = [component];
+      const registered = /* @__PURE__ */ new Set();
+      while (pending.length > 0) {
+        const candidate = pending.pop();
+        if (candidate === void 0 || registered.has(candidate)) continue;
+        registered.add(candidate);
+        componentRegistry.set(candidate, registration);
+        const nested = nestedReactWrapperComponent(candidate);
+        if (nested !== void 0) pending.push(nested);
+      }
+    },
+    updateRoute(nextRouteKey) {
+      if (routeKey === void 0) {
+        routeKey = nextRouteKey;
+      } else if (routeKey !== nextRouteKey) {
+        routeKey = nextRouteKey;
+        routeEpoch = nextRouteEpoch();
+      }
+    },
+    withInvocation(token, callback) {
+      const parent = currentInvocation;
+      currentInvocation = token;
+      try {
+        return callback();
+      } finally {
+        currentInvocation = parent;
+      }
+    },
+    withRequestFrame(token, metadata, callback) {
+      const parent = currentRequestFrame;
+      currentRequestFrame = Object.freeze({
+        requestCallsiteId: metadata.requestCallsiteId,
+        sourceVersion: metadata.sourceVersion,
+        ...token === void 0 ? {} : { invocationToken: token }
+      });
+      try {
+        return callback();
+      } finally {
+        currentRequestFrame = parent;
+      }
+    }
+  });
+  return runtime;
+}
+function installDataFlowPrelude(config, target2 = globalThis) {
+  if (!config.enabled) return void 0;
+  const runtime = target2[RUNTIME_KEY] ?? createDataFlowRuntime(config, target2);
+  target2[RUNTIME_KEY] = runtime;
+  return runtime;
+}
+function getDataFlowRuntime(target2 = globalThis) {
+  return target2[RUNTIME_KEY];
+}
+
+// src/data-flow/report-merger.ts
+var import_shared10 = require("@spotpatch/shared");
+function observationMatchesDependency(observation, dependency) {
+  const origin = dependency.origin;
+  const transportMatches = dependency.kind === "rpc" ? observation.transport === "trpc" && dependency.operation !== void 0 && observation.operation === dependency.operation : dependency.kind === "http" ? observation.transport === "fetch" || observation.transport === "xhr" : false;
+  if (!transportMatches || observation.freshness !== "current" || origin === void 0 || observation.requestCallsiteId !== origin.requestCallsiteId || observation.sourceVersion !== origin.sourceVersion || dependency.method !== void 0 && observation.method.toUpperCase() !== dependency.method.toUpperCase() || dependency.url !== void 0 && observation.url.pathname !== dependency.url.pathname || dependency.url?.origin !== void 0 && observation.url.origin !== dependency.url.origin || origin.componentSourceId !== void 0 && observation.componentSourceId !== void 0 && observation.componentSourceId !== origin.componentSourceId || origin.triggerCallsiteId !== void 0 && observation.triggerCallsiteId !== void 0 && observation.triggerCallsiteId !== origin.triggerCallsiteId) {
+    return false;
+  }
+  return dependency.association !== "transitive" || observation.componentSourceId === origin.componentSourceId && observation.triggerCallsiteId === origin.triggerCallsiteId;
+}
+function runtimeEvidence(observation) {
+  return Object.freeze({
+    id: observation.id,
+    kind: "runtime-observation",
+    summaryKey: "dataFlow.evidence.runtimeDispatch"
+  });
+}
+function mergeDependencies(dependencies, observations) {
+  const matchedObservationIds = /* @__PURE__ */ new Set();
+  const merged = dependencies.map((dependency) => {
+    const matches = observations.filter(
+      (observation) => observationMatchesDependency(observation, dependency)
+    );
+    for (const observation of matches) matchedObservationIds.add(observation.id);
+    if (matches.length === 0) return dependency;
+    const observedOrigins = [
+      ...new Set(
+        matches.flatMap(({ url }) => url.origin === void 0 ? [] : [url.origin])
+      )
+    ];
+    const observedOrigin = observedOrigins.length === 1 ? observedOrigins[0] : void 0;
+    return Object.freeze({
+      ...dependency,
+      ...dependency.url === void 0 || dependency.url.origin !== void 0 || observedOrigin === void 0 ? {} : {
+        url: Object.freeze({
+          ...dependency.url,
+          origin: observedOrigin
+        })
+      },
+      execution: "observed",
+      observationIds: Object.freeze([
+        .../* @__PURE__ */ new Set([...dependency.observationIds, ...matches.map(({ id }) => id)])
+      ]),
+      evidenceIds: Object.freeze([
+        .../* @__PURE__ */ new Set([...dependency.evidenceIds, ...matches.map(({ id }) => id)])
+      ])
+    });
+  });
+  return Object.freeze({
+    dependencies: Object.freeze(merged),
+    matchedObservationIds
+  });
+}
+function appendRuntimeEvidence(evidence, observations, matchedIds) {
+  const existing = new Set(evidence.map(({ id }) => id));
+  return Object.freeze([
+    ...evidence,
+    ...observations.flatMap(
+      (observation) => matchedIds.has(observation.id) && !existing.has(observation.id) ? [runtimeEvidence(observation)] : []
+    )
+  ]);
+}
+function mergeComponentDataFlowReport(report, observations) {
+  const componentObservations = observations.filter(
+    (observation) => observation.componentSourceId === void 0 || observation.componentSourceId === report.component.componentSourceId
+  );
+  const merged = mergeDependencies(report.dependencies, componentObservations);
+  return (0, import_shared10.limitDataFlowReportCollections)(
+    Object.freeze({
+      ...report,
+      dependencies: merged.dependencies,
+      evidence: appendRuntimeEvidence(
+        report.evidence,
+        componentObservations,
+        merged.matchedObservationIds
+      )
+    }),
+    { mode: "observation" }
+  );
+}
+function unassignedDependency(observation) {
+  const isRpc = observation.transport === "trpc";
+  return Object.freeze({
+    id: observation.id,
+    kind: isRpc ? "rpc" : "http",
+    direction: observation.method === "GET" || observation.method === "HEAD" || observation.method === "QUERY" || observation.method === "SUBSCRIPTION" ? "read" : "write",
+    execution: "observed",
+    proof: "unavailable",
+    association: "unassigned",
+    method: observation.method,
+    ...isRpc ? observation.operation === void 0 ? {} : { operation: observation.operation } : { url: observation.url },
+    parameters: Object.freeze(
+      (isRpc ? [] : observation.url.queryKeys).map(
+        (path) => Object.freeze({
+          path,
+          position: "query",
+          sensitive: (0, import_shared10.isSensitiveName)(path),
+          valueState: "not-collected",
+          evidenceIds: Object.freeze([observation.id])
+        })
+      )
+    ),
+    response: Object.freeze({
+      consumedFields: Object.freeze([])
+    }),
+    suppliedBindings: Object.freeze([]),
+    locationIds: Object.freeze([]),
+    evidenceIds: Object.freeze([observation.id]),
+    observationIds: Object.freeze([observation.id])
+  });
+}
+function mergePageDataFlowReport(report, observations) {
+  const currentObservations = observations.filter(
+    ({ freshness }) => freshness === "current"
+  );
+  const merged = mergeDependencies(report.dependencies, currentObservations);
+  const unassigned = currentObservations.filter(({ id }) => !merged.matchedObservationIds.has(id)).map(unassignedDependency);
+  const allObservationIds = new Set(currentObservations.map(({ id }) => id));
+  return (0, import_shared10.limitDataFlowReportCollections)(
+    Object.freeze({
+      ...report,
+      dependencies: Object.freeze([...merged.dependencies, ...unassigned]),
+      evidence: appendRuntimeEvidence(
+        report.evidence,
+        currentObservations,
+        allObservationIds
+      )
+    }),
+    { mode: "observation" }
+  );
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   UI_MARKER_ATTRIBUTE,
-  bootstrapSpotPatch
+  bootstrapSpotPatch,
+  createDataFlowRuntime,
+  getDataFlowRuntime,
+  installDataFlowPrelude,
+  mergeComponentDataFlowReport,
+  mergePageDataFlowReport
 });
 //# sourceMappingURL=index.cjs.map