@spotpatch/shared 1.8.0 → 1.9.0

package/dist/index.cjs

@@ -27,7 +27,22 @@ __export(index_exports, {
   AGENT_JOB_STATUSES: () => AGENT_JOB_STATUSES,
   AGENT_WORKSPACE_SNAPSHOT_LIMITS: () => AGENT_WORKSPACE_SNAPSHOT_LIMITS,
   AGENT_WORKSPACE_STATES: () => AGENT_WORKSPACE_STATES,
+  DATA_FLOW_ASSOCIATION_KINDS: () => DATA_FLOW_ASSOCIATION_KINDS,
+  DATA_FLOW_DIAGNOSTIC_CODES: () => DATA_FLOW_DIAGNOSTIC_CODES,
+  DATA_FLOW_EXECUTION_STATES: () => DATA_FLOW_EXECUTION_STATES,
+  DATA_FLOW_FRESHNESS_STATES: () => DATA_FLOW_FRESHNESS_STATES,
+  DATA_FLOW_PROOF_STATES: () => DATA_FLOW_PROOF_STATES,
+  DATA_FLOW_QUERY_ADAPTER_MODULES: () => DATA_FLOW_QUERY_ADAPTER_MODULES,
+  DATA_FLOW_QUERY_HOOK_NAMES: () => DATA_FLOW_QUERY_HOOK_NAMES,
+  DATA_FLOW_SCHEMA_VERSION: () => DATA_FLOW_SCHEMA_VERSION,
+  DATA_FLOW_TRPC_CLIENT_FACTORY_NAMES: () => DATA_FLOW_TRPC_CLIENT_FACTORY_NAMES,
+  DATA_FLOW_TRPC_PROXY_FACTORY_NAMES: () => DATA_FLOW_TRPC_PROXY_FACTORY_NAMES,
+  DATA_FLOW_TRPC_REQUEST_METHODS: () => DATA_FLOW_TRPC_REQUEST_METHODS,
+  DATA_FLOW_TRPC_ROOT_FACTORY_NAMES: () => DATA_FLOW_TRPC_ROOT_FACTORY_NAMES,
+  DATA_FLOW_URL_QUERY_KEY_LIMIT: () => DATA_FLOW_URL_QUERY_KEY_LIMIT,
   DEFAULT_AGENT_LIMITS: () => DEFAULT_AGENT_LIMITS,
+  DEFAULT_DATA_FLOW_LIMITS: () => DEFAULT_DATA_FLOW_LIMITS,
+  DEFAULT_RUNTIME_DATA_FLOW_LIMITS: () => DEFAULT_RUNTIME_DATA_FLOW_LIMITS,
   ERROR_CODES: () => ERROR_CODES,
   MAX_ANNOTATION_INSTRUCTION_CHARACTERS: () => MAX_ANNOTATION_INSTRUCTION_CHARACTERS,
   MAX_ANNOTATION_TARGETS: () => MAX_ANNOTATION_TARGETS,
@@ -55,14 +70,22 @@ __export(index_exports, {
   agentJobSnapshotSchema: () => agentJobSnapshotSchema,
   agentWorkspaceHealthRequestSchema: () => agentWorkspaceHealthRequestSchema,
   agentWorkspaceHealthSnapshotSchema: () => agentWorkspaceHealthSnapshotSchema,
+  componentDataFlowReportSchema: () => componentDataFlowReportSchema,
+  dataDependencySchema: () => dataDependencySchema,
+  dataFlowComponentReportRequestSchema: () => dataFlowComponentReportRequestSchema,
+  dataFlowPageReportRequestSchema: () => dataFlowPageReportRequestSchema,
   formatSourceMarker: () => formatSourceMarker,
   getAgentJobEndpoint: () => getAgentJobEndpoint,
   isSensitiveName: () => isSensitiveName,
+  limitDataFlowReportCollections: () => limitDataFlowReportCollections,
+  networkObservationSchema: () => networkObservationSchema,
   openEditorRequestSchema: () => openEditorRequestSchema,
+  pageDataFlowReportSchema: () => pageDataFlowReportSchema,
   parseSourceMarker: () => parseSourceMarker,
   redactSensitiveText: () => redactSensitiveText,
   runtimeBootstrapRequestSchema: () => runtimeBootstrapRequestSchema,
   runtimeConfigSchema: () => runtimeConfigSchema,
+  runtimeDataFlowConfigSchema: () => runtimeDataFlowConfigSchema,
   sanitizeUrl: () => sanitizeUrl,
   sourceContextRequestSchema: () => sourceContextRequestSchema,
   spotAnnotationRequestSchema: () => spotAnnotationRequestSchema,
@@ -89,6 +112,9 @@ var ERROR_CODES = {
   SOURCE_OUTSIDE_ROOT: "SOURCE_OUTSIDE_ROOT",
   SOURCE_TOO_LARGE: "SOURCE_TOO_LARGE",
   EDITOR_OPEN_FAILED: "EDITOR_OPEN_FAILED",
+  DATA_FLOW_DISABLED: "DATA_FLOW_DISABLED",
+  DATA_FLOW_SOURCE_STALE: "DATA_FLOW_SOURCE_STALE",
+  DATA_FLOW_ANALYSIS_CANCELLED: "DATA_FLOW_ANALYSIS_CANCELLED",
   AI_DISABLED: "AI_DISABLED",
   PROVIDER_NOT_CONFIGURED: "PROVIDER_NOT_CONFIGURED",
   PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
@@ -196,9 +222,485 @@ var SPOTPATCH_LOCALE_PREFERENCES = Object.freeze([
   ...SPOTPATCH_LOCALES
 ]);
 
-// src/model/runtime-config.ts
+// src/model/data-flow-adapters.ts
+var DATA_FLOW_QUERY_ADAPTER_MODULES = Object.freeze([
+  "@tanstack/react-query",
+  "react-query"
+]);
+var DATA_FLOW_QUERY_HOOK_NAMES = Object.freeze([
+  "useInfiniteQuery",
+  "useMutation",
+  "useQuery"
+]);
+var DATA_FLOW_TRPC_CLIENT_FACTORY_NAMES = Object.freeze([
+  "createTRPCClient",
+  "createTRPCProxyClient"
+]);
+var DATA_FLOW_TRPC_PROXY_FACTORY_NAMES = Object.freeze([
+  "createTRPCNext",
+  "createTRPCReact"
+]);
+var DATA_FLOW_TRPC_ROOT_FACTORY_NAMES = Object.freeze([
+  ...DATA_FLOW_TRPC_CLIENT_FACTORY_NAMES,
+  ...DATA_FLOW_TRPC_PROXY_FACTORY_NAMES,
+  "createTRPCContext",
+  "createTRPCOptionsProxy"
+]);
+var DATA_FLOW_TRPC_REQUEST_METHODS = Object.freeze([
+  "infiniteQueryOptions",
+  "mutate",
+  "mutateAsync",
+  "mutationOptions",
+  "query",
+  "queryOptions",
+  "refetch",
+  "subscribe",
+  "subscriptionOptions",
+  "useInfiniteQuery",
+  "useMutation",
+  "useQuery",
+  "useSubscription",
+  "useSuspenseInfiniteQuery",
+  "useSuspenseQuery"
+]);
+
+// src/model/data-flow.ts
 var import_zod = require("zod");
 
+// src/model/data-flow-limits.ts
+var DEFAULT_DATA_FLOW_LIMITS = Object.freeze({
+  observationMaxEntries: 100,
+  observationMaxBytes: 256 * 1024,
+  observationTtlMs: 3e5,
+  protocolRequestMaxBytes: 32 * 1024,
+  reportMaxBytes: 128 * 1024,
+  reportMaxEvidence: 200,
+  reportMaxDiagnostics: 256,
+  capabilityMaxReasons: 64,
+  graphMaxDepth: 5,
+  graphMaxModules: 50,
+  graphMaxCallsites: 100,
+  analysisTimeoutMs: 2e3,
+  reportMaxFields: 100
+});
+var DATA_FLOW_URL_QUERY_KEY_LIMIT = DEFAULT_DATA_FLOW_LIMITS.reportMaxFields;
+var DEFAULT_RUNTIME_DATA_FLOW_LIMITS = Object.freeze({
+  observationMaxEntries: DEFAULT_DATA_FLOW_LIMITS.observationMaxEntries,
+  observationMaxBytes: DEFAULT_DATA_FLOW_LIMITS.observationMaxBytes,
+  observationTtlMs: DEFAULT_DATA_FLOW_LIMITS.observationTtlMs,
+  reportMaxBytes: DEFAULT_DATA_FLOW_LIMITS.reportMaxBytes
+});
+
+// src/model/data-flow-version.ts
+var DATA_FLOW_SCHEMA_VERSION = 1;
+
+// src/model/data-flow.ts
+var DATA_FLOW_EXECUTION_STATES = Object.freeze([
+  "observed",
+  "declared-not-observed",
+  "not-applicable",
+  "unknown"
+]);
+var DATA_FLOW_PROOF_STATES = Object.freeze([
+  "proven",
+  "candidate",
+  "unavailable",
+  "conflict"
+]);
+var DATA_FLOW_ASSOCIATION_KINDS = Object.freeze([
+  "direct",
+  "transitive",
+  "upstream",
+  "possible",
+  "unassigned",
+  "unknown"
+]);
+var DATA_FLOW_FRESHNESS_STATES = Object.freeze([
+  "current",
+  "stale-source",
+  "stale-route",
+  "expired"
+]);
+var DATA_FLOW_DIAGNOSTIC_CODES = Object.freeze([
+  "DATA_FLOW_CAPABILITY_DISABLED",
+  "DATA_FLOW_CAPABILITY_PRELUDE_UNAVAILABLE",
+  "DATA_FLOW_CAPABILITY_UNSUPPORTED_FRAMEWORK",
+  "DATA_FLOW_SOURCE_UNAVAILABLE",
+  "DATA_FLOW_SOURCE_STALE",
+  "DATA_FLOW_ANALYSIS_TIMEOUT",
+  "DATA_FLOW_ANALYSIS_TRUNCATED",
+  "DATA_FLOW_ANALYSIS_UNRESOLVED_CALL",
+  "DATA_FLOW_OBSERVATION_UNASSIGNED",
+  "DATA_FLOW_OBSERVATION_DROPPED",
+  "DATA_FLOW_REDACTION_APPLIED",
+  "DATA_FLOW_AI_DISABLED"
+]);
+var boundedText = (maximum) => import_zod.z.string().trim().min(1).max(maximum);
+var opaqueIdSchema = boundedText(128).regex(/^[A-Za-z0-9_-]+$/u);
+var diagnosticCodeSchema = import_zod.z.enum(DATA_FLOW_DIAGNOSTIC_CODES);
+var evidenceSourceSchema = import_zod.z.strictObject({
+  fileId: opaqueIdSchema,
+  displayPath: boundedText(1024),
+  line: import_zod.z.number().int().positive(),
+  column: import_zod.z.number().int().positive(),
+  sourceVersion: opaqueIdSchema
+});
+var sanitizedObservedUrlSchema = import_zod.z.strictObject({
+  origin: boundedText(512).optional(),
+  pathname: boundedText(2048),
+  queryKeys: import_zod.z.array(boundedText(256)).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxFields)
+});
+var dataParameterSchema = import_zod.z.strictObject({
+  path: boundedText(1024),
+  position: import_zod.z.enum([
+    "path",
+    "query",
+    "body",
+    "header",
+    "cookie",
+    "variable",
+    "form",
+    "unknown"
+  ]),
+  type: boundedText(512).optional(),
+  source: boundedText(1024).optional(),
+  condition: boundedText(1024).optional(),
+  sensitive: import_zod.z.boolean(),
+  valueState: import_zod.z.literal("not-collected"),
+  evidenceIds: import_zod.z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence)
+});
+var dataResponseSchema = import_zod.z.strictObject({
+  consumedFields: import_zod.z.array(boundedText(1024)).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxFields)
+});
+var requestOriginSchema = import_zod.z.strictObject({
+  componentSourceId: opaqueIdSchema.optional(),
+  triggerCallsiteId: opaqueIdSchema.optional(),
+  requestCallsiteId: opaqueIdSchema,
+  sourceVersion: opaqueIdSchema
+});
+var capabilityReasonSchema = import_zod.z.strictObject({
+  code: diagnosticCodeSchema,
+  retryable: import_zod.z.boolean()
+});
+var capabilitySchema = import_zod.z.strictObject({
+  enabled: import_zod.z.boolean(),
+  staticAnalysis: import_zod.z.enum(["available", "partial", "unavailable"]),
+  runtimeObservation: import_zod.z.literal("dispatch-only"),
+  responseShape: import_zod.z.literal("consumed-fields-only"),
+  aiAssistance: import_zod.z.literal("disabled"),
+  reasons: import_zod.z.array(capabilityReasonSchema).max(DEFAULT_DATA_FLOW_LIMITS.capabilityMaxReasons)
+});
+var evidenceSchema = import_zod.z.strictObject({
+  id: opaqueIdSchema,
+  kind: import_zod.z.enum([
+    "source-anchor",
+    "import-resolution",
+    "symbol-edge",
+    "trigger-edge",
+    "call-edge",
+    "data-binding",
+    "adapter-rule",
+    "runtime-observation",
+    "runtime-reference",
+    "diagnostic"
+  ]),
+  source: evidenceSourceSchema.optional(),
+  adapter: import_zod.z.strictObject({ id: boundedText(128), version: boundedText(64) }).optional(),
+  summaryKey: boundedText(256)
+});
+var diagnosticSchema = import_zod.z.strictObject({
+  id: opaqueIdSchema,
+  code: diagnosticCodeSchema,
+  severity: import_zod.z.enum(["info", "warning", "error"]),
+  retryable: import_zod.z.boolean(),
+  evidenceIds: import_zod.z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence)
+});
+var baselineSchema = import_zod.z.strictObject({
+  registryEpoch: opaqueIdSchema,
+  analyzerVersion: boundedText(64),
+  adapterSetHash: boundedText(128),
+  analyzedSourceVersions: import_zod.z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxModules)
+});
+var completenessSchema = import_zod.z.strictObject({
+  complete: import_zod.z.boolean(),
+  visitedModules: import_zod.z.number().int().nonnegative(),
+  visitedCallsites: import_zod.z.number().int().nonnegative(),
+  frontierCount: import_zod.z.number().int().nonnegative(),
+  truncatedBy: import_zod.z.enum(["depth", "modules", "callsites", "bytes", "timeout"]).optional()
+});
+var dataDependencySchema = import_zod.z.strictObject({
+  id: opaqueIdSchema,
+  kind: import_zod.z.enum(["http", "graphql", "rpc", "server-action", "unknown"]),
+  direction: import_zod.z.enum(["read", "write", "read-write", "unknown"]),
+  execution: import_zod.z.enum(DATA_FLOW_EXECUTION_STATES),
+  proof: import_zod.z.enum(DATA_FLOW_PROOF_STATES),
+  association: import_zod.z.enum(DATA_FLOW_ASSOCIATION_KINDS),
+  method: boundedText(32).optional(),
+  operation: boundedText(512).optional(),
+  url: sanitizedObservedUrlSchema.optional(),
+  parameters: import_zod.z.array(dataParameterSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxFields),
+  response: dataResponseSchema,
+  origin: requestOriginSchema.optional(),
+  suppliedBindings: import_zod.z.array(boundedText(1024)).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites),
+  locationIds: import_zod.z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites),
+  evidenceIds: import_zod.z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence),
+  observationIds: import_zod.z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.observationMaxEntries)
+});
+var networkObservationSchema = import_zod.z.strictObject({
+  schemaVersion: import_zod.z.literal(DATA_FLOW_SCHEMA_VERSION),
+  id: opaqueIdSchema,
+  pageEpoch: opaqueIdSchema,
+  routeEpoch: opaqueIdSchema,
+  requestCallsiteId: opaqueIdSchema.optional(),
+  invocationId: opaqueIdSchema.optional(),
+  componentSourceId: opaqueIdSchema.optional(),
+  triggerCallsiteId: opaqueIdSchema.optional(),
+  sourceVersion: opaqueIdSchema.optional(),
+  transport: import_zod.z.enum(["fetch", "trpc", "xhr"]),
+  method: boundedText(32),
+  operation: boundedText(512).optional(),
+  url: sanitizedObservedUrlSchema,
+  outcome: import_zod.z.literal("dispatched"),
+  freshness: import_zod.z.enum(DATA_FLOW_FRESHNESS_STATES),
+  diagnosticIds: import_zod.z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence)
+});
+var componentIdentitySchema = import_zod.z.strictObject({
+  componentSourceId: opaqueIdSchema.optional(),
+  displayName: boundedText(256).optional(),
+  source: evidenceSourceSchema
+});
+var componentDataFlowReportSchema = import_zod.z.strictObject({
+  schemaVersion: import_zod.z.literal(DATA_FLOW_SCHEMA_VERSION),
+  reportId: opaqueIdSchema,
+  baseline: baselineSchema,
+  capability: capabilitySchema,
+  component: componentIdentitySchema,
+  dependencies: import_zod.z.array(dataDependencySchema).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites),
+  evidence: import_zod.z.array(evidenceSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence),
+  diagnostics: import_zod.z.array(diagnosticSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxDiagnostics),
+  completeness: completenessSchema
+});
+var pageDataFlowReportSchema = import_zod.z.strictObject({
+  schemaVersion: import_zod.z.literal(DATA_FLOW_SCHEMA_VERSION),
+  reportId: opaqueIdSchema,
+  baseline: baselineSchema,
+  capability: capabilitySchema,
+  dependencies: import_zod.z.array(dataDependencySchema).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites),
+  evidence: import_zod.z.array(evidenceSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence),
+  diagnostics: import_zod.z.array(diagnosticSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxDiagnostics),
+  completeness: completenessSchema
+});
+var runtimeDataFlowConfigSchema = import_zod.z.strictObject({
+  enabled: import_zod.z.boolean(),
+  runtime: import_zod.z.literal("dispatch"),
+  limits: import_zod.z.strictObject({
+    observationMaxEntries: import_zod.z.number().int().positive(),
+    observationMaxBytes: import_zod.z.number().int().positive(),
+    observationTtlMs: import_zod.z.number().int().positive(),
+    reportMaxBytes: import_zod.z.number().int().positive()
+  })
+});
+
+// src/model/data-flow-budget.ts
+function prefix(values, maximum) {
+  return Object.freeze(values.slice(0, Math.max(0, maximum)));
+}
+function limitDependency(dependency) {
+  const queryKeys = dependency.url === void 0 ? void 0 : prefix(dependency.url.queryKeys, DEFAULT_DATA_FLOW_LIMITS.reportMaxFields);
+  const parameters = prefix(
+    dependency.parameters,
+    DEFAULT_DATA_FLOW_LIMITS.reportMaxFields
+  ).map(
+    (parameter) => Object.freeze({
+      ...parameter,
+      evidenceIds: prefix(
+        parameter.evidenceIds,
+        DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence
+      )
+    })
+  );
+  const consumedFields = prefix(
+    dependency.response.consumedFields,
+    DEFAULT_DATA_FLOW_LIMITS.reportMaxFields
+  );
+  const suppliedBindings = prefix(
+    dependency.suppliedBindings,
+    DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites
+  );
+  const locationIds = prefix(
+    dependency.locationIds,
+    DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites
+  );
+  const evidenceIds = prefix(
+    dependency.evidenceIds,
+    DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence
+  );
+  const observationIds = prefix(
+    dependency.observationIds,
+    DEFAULT_DATA_FLOW_LIMITS.observationMaxEntries
+  );
+  const trimmed = queryKeys?.length !== dependency.url?.queryKeys.length || parameters.length !== dependency.parameters.length || parameters.some(
+    (parameter, index) => parameter.evidenceIds.length !== dependency.parameters[index]?.evidenceIds.length
+  ) || consumedFields.length !== dependency.response.consumedFields.length || suppliedBindings.length !== dependency.suppliedBindings.length || locationIds.length !== dependency.locationIds.length || evidenceIds.length !== dependency.evidenceIds.length || observationIds.length !== dependency.observationIds.length;
+  if (!trimmed) return Object.freeze({ dependency, trimmed: false });
+  return Object.freeze({
+    dependency: Object.freeze({
+      ...dependency,
+      ...dependency.url === void 0 ? {} : {
+        url: Object.freeze({
+          ...dependency.url,
+          queryKeys: queryKeys ?? Object.freeze([])
+        })
+      },
+      parameters: Object.freeze(parameters),
+      response: Object.freeze({ consumedFields }),
+      suppliedBindings,
+      locationIds,
+      evidenceIds,
+      observationIds
+    }),
+    trimmed: true
+  });
+}
+function referencedEvidenceIds(dependencies, diagnostics) {
+  return Object.freeze([
+    .../* @__PURE__ */ new Set([
+      ...dependencies.flatMap((dependency) => [
+        ...dependency.evidenceIds,
+        ...dependency.parameters.flatMap((parameter) => parameter.evidenceIds)
+      ]),
+      ...diagnostics.flatMap((diagnostic) => diagnostic.evidenceIds)
+    ])
+  ]);
+}
+function prioritizeEvidence(evidence, referencedIds, retainUnreferenced) {
+  const byId = new Map(evidence.map((entry) => [entry.id, entry]));
+  const ordered = [];
+  const retained = /* @__PURE__ */ new Set();
+  for (const id of referencedIds) {
+    const entry = byId.get(id);
+    if (entry !== void 0 && !retained.has(id)) {
+      ordered.push(entry);
+      retained.add(id);
+    }
+  }
+  if (retainUnreferenced) {
+    for (const entry of evidence) {
+      if (!retained.has(entry.id)) ordered.push(entry);
+    }
+  }
+  return prefix(ordered, DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence);
+}
+function pruneEvidenceReferences(dependency, retainedIds) {
+  return Object.freeze({
+    ...dependency,
+    parameters: Object.freeze(
+      dependency.parameters.map(
+        (parameter) => Object.freeze({
+          ...parameter,
+          evidenceIds: Object.freeze(
+            parameter.evidenceIds.filter((id) => retainedIds.has(id))
+          )
+        })
+      )
+    ),
+    evidenceIds: Object.freeze(
+      dependency.evidenceIds.filter((id) => retainedIds.has(id))
+    )
+  });
+}
+function truncationCode(mode) {
+  return mode === "analysis" ? "DATA_FLOW_ANALYSIS_TRUNCATED" : "DATA_FLOW_OBSERVATION_DROPPED";
+}
+function limitDataFlowReportCollections(report, options = {}) {
+  const maximumDependencies = Math.min(
+    Math.max(
+      0,
+      options.maximumDependencies ?? DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites
+    ),
+    DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites
+  );
+  const dependencyResults = prefix(report.dependencies, maximumDependencies).map(
+    limitDependency
+  );
+  const dependencies = dependencyResults.map(({ dependency }) => dependency);
+  const analyzedSourceVersions = prefix(
+    report.baseline.analyzedSourceVersions,
+    DEFAULT_DATA_FLOW_LIMITS.graphMaxModules
+  );
+  const collectionTrimmed = report.dependencies.length > dependencies.length || dependencyResults.some(({ trimmed }) => trimmed) || report.baseline.analyzedSourceVersions.length > analyzedSourceVersions.length || report.capability.reasons.length > DEFAULT_DATA_FLOW_LIMITS.capabilityMaxReasons || report.evidence.length > DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence || report.diagnostics.length > DEFAULT_DATA_FLOW_LIMITS.reportMaxDiagnostics;
+  const truncated = options.forceTruncation === true || collectionTrimmed;
+  if (!truncated) return report;
+  const mode = options.mode ?? "analysis";
+  const code = truncationCode(mode);
+  const diagnosticId = `${report.reportId}_collection_${mode}`;
+  const reasons = Object.freeze([
+    ...report.capability.reasons.filter((reason) => reason.code !== code).slice(0, DEFAULT_DATA_FLOW_LIMITS.capabilityMaxReasons - 1),
+    Object.freeze({ code, retryable: false })
+  ]);
+  const diagnostics = Object.freeze([
+    ...report.diagnostics.filter((diagnostic) => diagnostic.id !== diagnosticId).slice(0, DEFAULT_DATA_FLOW_LIMITS.reportMaxDiagnostics - 1),
+    Object.freeze({
+      id: diagnosticId,
+      code,
+      severity: "warning",
+      retryable: false,
+      evidenceIds: Object.freeze([])
+    })
+  ]);
+  const referencedIds = referencedEvidenceIds(dependencies, diagnostics);
+  const evidence = prioritizeEvidence(
+    report.evidence,
+    referencedIds,
+    report.dependencies.length === dependencies.length
+  );
+  const retainedEvidenceIds = new Set(evidence.map(({ id }) => id));
+  const prunedDependencies = Object.freeze(
+    dependencies.map(
+      (dependency) => pruneEvidenceReferences(dependency, retainedEvidenceIds)
+    )
+  );
+  const prunedDiagnostics = Object.freeze(
+    diagnostics.map(
+      (diagnostic) => Object.freeze({
+        ...diagnostic,
+        evidenceIds: Object.freeze(
+          diagnostic.evidenceIds.filter((id) => retainedEvidenceIds.has(id))
+        )
+      })
+    )
+  );
+  const removedDependencies = report.dependencies.length - dependencies.length;
+  const removedModules = report.baseline.analyzedSourceVersions.length - analyzedSourceVersions.length;
+  const derivedTruncation = removedModules > 0 && removedDependencies === 0 ? "modules" : "callsites";
+  return Object.freeze({
+    ...report,
+    baseline: Object.freeze({
+      ...report.baseline,
+      analyzedSourceVersions
+    }),
+    capability: Object.freeze({
+      ...report.capability,
+      ...mode === "analysis" && report.capability.staticAnalysis === "available" ? { staticAnalysis: "partial" } : {},
+      reasons
+    }),
+    dependencies: prunedDependencies,
+    evidence,
+    diagnostics: prunedDiagnostics,
+    ...mode === "analysis" ? {
+      completeness: Object.freeze({
+        ...report.completeness,
+        complete: false,
+        frontierCount: report.completeness.frontierCount + removedDependencies + removedModules + (collectionTrimmed && removedDependencies === 0 && removedModules === 0 ? 1 : 0),
+        truncatedBy: options.truncatedBy ?? report.completeness.truncatedBy ?? derivedTruncation
+      })
+    } : {}
+  });
+}
+
+// src/model/runtime-config.ts
+var import_zod2 = require("zod");
+
 // src/protocol/endpoints.ts
 var SPOTPATCH_API_BASE = "/__spotpatch/v1";
 var SPOTPATCH_TOKEN_HEADER = "X-SpotPatch-Token";
@@ -206,6 +708,8 @@ var SPOTPATCH_ENDPOINTS = Object.freeze({
   bootstrap: `${SPOTPATCH_API_BASE}/bootstrap`,
   sourceContext: `${SPOTPATCH_API_BASE}/source-context`,
   openEditor: `${SPOTPATCH_API_BASE}/open-editor`,
+  dataFlowComponentReport: `${SPOTPATCH_API_BASE}/data-flow/component-report`,
+  dataFlowPageReport: `${SPOTPATCH_API_BASE}/data-flow/page-report`,
   agentCapability: `${SPOTPATCH_API_BASE}/agent/capability`,
   agentWorkspaceHealth: `${SPOTPATCH_API_BASE}/agent/workspace-health`,
   agentJobs: `${SPOTPATCH_API_BASE}/agent/jobs`
@@ -287,39 +791,39 @@ var SPOTPATCH_NEXT_ROUTER_KINDS = Object.freeze([
   "pages",
   "hybrid"
 ]);
-var boundedText = (maximum) => import_zod.z.string().trim().min(1).max(maximum);
-var profileIdSchema = import_zod.z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u);
-var runtimeAiModelSchema = import_zod.z.strictObject({
+var boundedText2 = (maximum) => import_zod2.z.string().trim().min(1).max(maximum);
+var profileIdSchema = import_zod2.z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u);
+var runtimeAiModelSchema = import_zod2.z.strictObject({
   id: profileIdSchema,
-  label: boundedText(100)
+  label: boundedText2(100)
 });
-var runtimeAiProviderSchema = import_zod.z.strictObject({
+var runtimeAiProviderSchema = import_zod2.z.strictObject({
   id: profileIdSchema,
-  label: boundedText(100),
-  protocol: import_zod.z.enum(["responses", "chat-completions"]),
-  models: import_zod.z.array(runtimeAiModelSchema).min(1).max(64),
+  label: boundedText2(100),
+  protocol: import_zod2.z.enum(["responses", "chat-completions"]),
+  models: import_zod2.z.array(runtimeAiModelSchema).min(1).max(64),
   defaultModel: profileIdSchema
 }).refine(
   ({ defaultModel, models }) => models.some(({ id }) => id === defaultModel) && new Set(models.map(({ id }) => id)).size === models.length,
   { message: "Runtime AI model profiles are inconsistent." }
 );
-var runtimeAiConfigSchema = import_zod.z.discriminatedUnion("enabled", [
-  import_zod.z.strictObject({ enabled: import_zod.z.literal(false) }),
-  import_zod.z.strictObject({
-    enabled: import_zod.z.literal(true),
-    providers: import_zod.z.array(runtimeAiProviderSchema).min(1).max(32),
+var runtimeAiConfigSchema = import_zod2.z.discriminatedUnion("enabled", [
+  import_zod2.z.strictObject({ enabled: import_zod2.z.literal(false) }),
+  import_zod2.z.strictObject({
+    enabled: import_zod2.z.literal(true),
+    providers: import_zod2.z.array(runtimeAiProviderSchema).min(1).max(32),
     defaultProvider: profileIdSchema,
-    applyMode: import_zod.z.enum(AGENT_APPLY_MODES)
+    applyMode: import_zod2.z.enum(AGENT_APPLY_MODES)
   }).refine(
     ({ defaultProvider, providers }) => providers.some(({ id }) => id === defaultProvider) && new Set(providers.map(({ id }) => id)).size === providers.length,
     { message: "Runtime AI provider profiles are inconsistent." }
   )
 ]);
-var positiveInteger = import_zod.z.number().int().positive();
+var positiveInteger = import_zod2.z.number().int().positive();
 var runtimeConfigBaseShape = {
-  apiBase: import_zod.z.literal(SPOTPATCH_API_BASE),
+  apiBase: import_zod2.z.literal(SPOTPATCH_API_BASE),
   ai: runtimeAiConfigSchema,
-  budget: import_zod.z.strictObject({
+  budget: import_zod2.z.strictObject({
     totalCharacters: positiveInteger,
     domCharacters: positiveInteger,
     cssCharacters: positiveInteger,
@@ -327,27 +831,28 @@ var runtimeConfigBaseShape = {
     maxCodeLines: positiveInteger,
     maxComponentDepth: positiveInteger
   }),
-  debug: import_zod.z.boolean(),
-  editor: import_zod.z.enum(SPOTPATCH_EDITOR_PREFERENCES),
-  frameworkVersion: boundedText(64),
-  locale: import_zod.z.enum(SPOTPATCH_LOCALE_PREFERENCES),
-  maxTargets: import_zod.z.number().int().min(1).max(MAX_ANNOTATION_TARGETS),
-  redact: import_zod.z.boolean(),
-  sessionId: import_zod.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/u),
-  sessionToken: import_zod.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/u),
-  shortcut: boundedText(128),
-  spotPatchVersion: boundedText(64)
+  debug: import_zod2.z.boolean(),
+  dataFlow: runtimeDataFlowConfigSchema,
+  editor: import_zod2.z.enum(SPOTPATCH_EDITOR_PREFERENCES),
+  frameworkVersion: boundedText2(64),
+  locale: import_zod2.z.enum(SPOTPATCH_LOCALE_PREFERENCES),
+  maxTargets: import_zod2.z.number().int().min(1).max(MAX_ANNOTATION_TARGETS),
+  redact: import_zod2.z.boolean(),
+  sessionId: import_zod2.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+  sessionToken: import_zod2.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+  shortcut: boundedText2(128),
+  spotPatchVersion: boundedText2(64)
 };
-var runtimeConfigSchema = import_zod.z.discriminatedUnion("framework", [
-  import_zod.z.strictObject({
+var runtimeConfigSchema = import_zod2.z.discriminatedUnion("framework", [
+  import_zod2.z.strictObject({
     ...runtimeConfigBaseShape,
-    framework: import_zod.z.literal("vite")
+    framework: import_zod2.z.literal("vite")
   }),
-  import_zod.z.strictObject({
+  import_zod2.z.strictObject({
     ...runtimeConfigBaseShape,
-    bundler: import_zod.z.enum(SPOTPATCH_NEXT_BUNDLERS),
-    framework: import_zod.z.literal("next"),
-    routerKind: import_zod.z.enum(SPOTPATCH_NEXT_ROUTER_KINDS)
+    bundler: import_zod2.z.enum(SPOTPATCH_NEXT_BUNDLERS),
+    framework: import_zod2.z.literal("next"),
+    routerKind: import_zod2.z.enum(SPOTPATCH_NEXT_ROUTER_KINDS)
   })
 ]);
 
@@ -375,90 +880,109 @@ function parseSourceMarker(value) {
 }
 
 // src/protocol/requests.ts
-var import_zod2 = require("zod");
-var runtimeBootstrapRequestSchema = import_zod2.z.strictObject({});
-var sourceCoordinatesSchema = import_zod2.z.strictObject({
-  fileId: import_zod2.z.string().min(1).max(128),
-  line: import_zod2.z.number().int().positive(),
-  column: import_zod2.z.number().int().positive()
+var import_zod3 = require("zod");
+var runtimeBootstrapRequestSchema = import_zod3.z.strictObject({});
+var sourceCoordinatesSchema = import_zod3.z.strictObject({
+  fileId: import_zod3.z.string().min(1).max(128),
+  line: import_zod3.z.number().int().positive(),
+  column: import_zod3.z.number().int().positive()
 });
 var sourceContextRequestSchema = sourceCoordinatesSchema.extend({
-  maxLines: import_zod2.z.number().int().positive()
+  maxLines: import_zod3.z.number().int().positive()
 }).strict();
 var openEditorRequestSchema = sourceCoordinatesSchema.strict();
-var profileIdSchema2 = import_zod2.z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
-var boundedString = (maximum) => import_zod2.z.string().max(maximum);
-var sourceRefSchema = import_zod2.z.strictObject({
+var dataFlowSourceCoordinatesRequestSchema = sourceCoordinatesSchema.extend({
+  schemaVersion: import_zod3.z.literal(1),
+  sourceVersion: import_zod3.z.string().min(1).max(128).optional()
+}).strict();
+var dataFlowComponentIdentityRequestSchema = import_zod3.z.strictObject({
+  schemaVersion: import_zod3.z.literal(1),
+  componentSourceId: import_zod3.z.string().min(1).max(128),
+  sourceVersion: import_zod3.z.string().min(1).max(128)
+});
+var dataFlowComponentReportRequestSchema = import_zod3.z.union([
+  dataFlowSourceCoordinatesRequestSchema,
+  dataFlowComponentIdentityRequestSchema
+]);
+var dataFlowPageReportRequestSchema = import_zod3.z.strictObject({
+  schemaVersion: import_zod3.z.literal(1),
+  targets: import_zod3.z.array(dataFlowComponentReportRequestSchema).min(1).max(MAX_ANNOTATION_TARGETS)
+});
+var profileIdSchema2 = import_zod3.z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
+var boundedString = (maximum) => import_zod3.z.string().max(maximum);
+var sourceRefSchema = import_zod3.z.strictObject({
   fileId: boundedString(128).optional(),
   relativePath: boundedString(1024).optional(),
-  line: import_zod2.z.number().int().positive().optional(),
-  column: import_zod2.z.number().int().positive().optional(),
-  origin: import_zod2.z.enum(["jsx-host", "react-fiber", "dom-ancestor", "none"]),
-  confidence: import_zod2.z.enum(["exact", "probable", "approximate", "unknown"])
+  line: import_zod3.z.number().int().positive().optional(),
+  column: import_zod3.z.number().int().positive().optional(),
+  origin: import_zod3.z.enum(["jsx-host", "react-fiber", "dom-ancestor", "none"]),
+  confidence: import_zod3.z.enum(["exact", "probable", "approximate", "unknown"])
 });
-var matchedStyleRuleSchema = import_zod2.z.strictObject({
+var matchedStyleRuleSchema = import_zod3.z.strictObject({
   selector: boundedString(2048),
   declarations: boundedString(8192),
   source: boundedString(1024).optional(),
   media: boundedString(1024).optional()
 });
-var codeContextSchema = import_zod2.z.strictObject({
+var codeContextSchema = import_zod3.z.strictObject({
   relativePath: boundedString(1024),
-  language: import_zod2.z.enum(["tsx", "jsx"]),
-  startLine: import_zod2.z.number().int().positive(),
-  endLine: import_zod2.z.number().int().positive(),
+  language: import_zod3.z.enum(["tsx", "jsx"]),
+  startLine: import_zod3.z.number().int().positive(),
+  endLine: import_zod3.z.number().int().positive(),
   excerpt: boundedString(16e3),
-  boundary: import_zod2.z.enum(["component", "nearby-lines"])
+  boundary: import_zod3.z.enum(["component", "nearby-lines"])
 });
-var pageContextSchema = import_zod2.z.strictObject({
+var pageContextSchema = import_zod3.z.strictObject({
   url: boundedString(2048),
   pathname: boundedString(2048),
   title: boundedString(1024),
-  viewportWidth: import_zod2.z.number().nonnegative(),
-  viewportHeight: import_zod2.z.number().nonnegative(),
-  devicePixelRatio: import_zod2.z.number().positive()
+  viewportWidth: import_zod3.z.number().nonnegative(),
+  viewportHeight: import_zod3.z.number().nonnegative(),
+  devicePixelRatio: import_zod3.z.number().positive()
 });
-var spotTargetContextRequestSchema = import_zod2.z.strictObject({
-  instruction: import_zod2.z.string().trim().min(1).max(MAX_TARGET_INSTRUCTION_CHARACTERS),
+var spotTargetContextRequestSchema = import_zod3.z.strictObject({
+  instruction: import_zod3.z.string().trim().min(1).max(MAX_TARGET_INSTRUCTION_CHARACTERS),
   page: pageContextSchema.optional(),
   source: sourceRefSchema,
-  react: import_zod2.z.strictObject({
-    supported: import_zod2.z.boolean(),
+  react: import_zod3.z.strictObject({
+    supported: import_zod3.z.boolean(),
     version: boundedString(64).optional(),
     componentName: boundedString(256).optional(),
-    componentStack: import_zod2.z.array(boundedString(256)).max(64),
+    componentSourceId: boundedString(128).optional(),
+    sourceVersion: boundedString(128).optional(),
+    componentStack: import_zod3.z.array(boundedString(256)).max(64),
     source: sourceRefSchema.optional()
   }),
-  element: import_zod2.z.strictObject({
+  element: import_zod3.z.strictObject({
     tagName: boundedString(128),
     selector: boundedString(2048),
     sanitizedHtml: boundedString(8192),
     textPreview: boundedString(2048).optional(),
     role: boundedString(256).optional(),
-    rect: import_zod2.z.strictObject({
-      x: import_zod2.z.number(),
-      y: import_zod2.z.number(),
-      width: import_zod2.z.number().nonnegative(),
-      height: import_zod2.z.number().nonnegative()
+    rect: import_zod3.z.strictObject({
+      x: import_zod3.z.number(),
+      y: import_zod3.z.number(),
+      width: import_zod3.z.number().nonnegative(),
+      height: import_zod3.z.number().nonnegative()
     })
   }),
-  styles: import_zod2.z.strictObject({
-    classNames: import_zod2.z.array(boundedString(512)).max(256),
+  styles: import_zod3.z.strictObject({
+    classNames: import_zod3.z.array(boundedString(512)).max(256),
     inlineStyle: boundedString(8192).optional(),
-    matchedRules: import_zod2.z.array(matchedStyleRuleSchema).max(256),
-    computed: import_zod2.z.record(boundedString(256), boundedString(2048)),
-    warnings: import_zod2.z.array(boundedString(1024)).max(64)
+    matchedRules: import_zod3.z.array(matchedStyleRuleSchema).max(256),
+    computed: import_zod3.z.record(boundedString(256), boundedString(2048)),
+    warnings: import_zod3.z.array(boundedString(1024)).max(64)
   }),
   code: codeContextSchema.optional(),
-  warnings: import_zod2.z.array(boundedString(1024)).max(64)
+  warnings: import_zod3.z.array(boundedString(1024)).max(64)
 });
-var spotAnnotationRequestSchema = import_zod2.z.strictObject({
-  schemaVersion: import_zod2.z.literal(3),
+var spotAnnotationRequestSchema = import_zod3.z.strictObject({
+  schemaVersion: import_zod3.z.literal(3),
   id: boundedString(128),
-  locale: import_zod2.z.enum(SPOTPATCH_LOCALES),
+  locale: import_zod3.z.enum(SPOTPATCH_LOCALES),
   page: pageContextSchema,
-  targets: import_zod2.z.array(spotTargetContextRequestSchema).min(1).max(MAX_ANNOTATION_TARGETS),
-  createdAt: import_zod2.z.iso.datetime()
+  targets: import_zod3.z.array(spotTargetContextRequestSchema).min(1).max(MAX_ANNOTATION_TARGETS),
+  createdAt: import_zod3.z.iso.datetime()
 }).superRefine((annotation, context) => {
   const total = annotation.targets.reduce(
     (characters, target) => characters + target.instruction.length,
@@ -472,53 +996,53 @@ var spotAnnotationRequestSchema = import_zod2.z.strictObject({
     });
   }
 });
-var agentCapabilityRequestSchema = import_zod2.z.strictObject({
+var agentCapabilityRequestSchema = import_zod3.z.strictObject({
   providerProfileId: profileIdSchema2,
   modelProfileId: profileIdSchema2
 });
-var agentWorkspaceHealthRequestSchema = import_zod2.z.strictObject({});
-var agentJobCreateRequestSchema = import_zod2.z.strictObject({
+var agentWorkspaceHealthRequestSchema = import_zod3.z.strictObject({});
+var agentJobCreateRequestSchema = import_zod3.z.strictObject({
   annotation: spotAnnotationRequestSchema,
-  applyMode: import_zod2.z.enum(AGENT_APPLY_MODES).optional(),
+  applyMode: import_zod3.z.enum(AGENT_APPLY_MODES).optional(),
   providerProfileId: profileIdSchema2,
   modelProfileId: profileIdSchema2,
-  providerDataConsent: import_zod2.z.literal(true),
-  trustedFastModeConsent: import_zod2.z.literal(true).optional(),
-  workingTreeMode: import_zod2.z.enum(["require-clean", "include-local-changes"]).default("require-clean")
+  providerDataConsent: import_zod3.z.literal(true),
+  trustedFastModeConsent: import_zod3.z.literal(true).optional(),
+  workingTreeMode: import_zod3.z.enum(["require-clean", "include-local-changes"]).default("require-clean")
 });
-var agentJobActionRequestSchema = import_zod2.z.strictObject({});
+var agentJobActionRequestSchema = import_zod3.z.strictObject({});
 
 // src/protocol/agent-schemas.ts
-var import_zod3 = require("zod");
-var profileIdSchema3 = import_zod3.z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
-var boundedString2 = (maximum) => import_zod3.z.string().max(maximum);
-var errorCodeSchema = import_zod3.z.enum(ERROR_CODES);
-var agentCapabilitySnapshotSchema = import_zod3.z.strictObject({
+var import_zod4 = require("zod");
+var profileIdSchema3 = import_zod4.z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
+var boundedString2 = (maximum) => import_zod4.z.string().max(maximum);
+var errorCodeSchema = import_zod4.z.enum(ERROR_CODES);
+var agentCapabilitySnapshotSchema = import_zod4.z.strictObject({
   providerProfileId: profileIdSchema3,
   providerLabel: boundedString2(100),
   modelProfileId: profileIdSchema3,
   modelLabel: boundedString2(100),
-  protocol: import_zod3.z.enum(["responses", "chat-completions"]),
-  state: import_zod3.z.enum(AGENT_CAPABILITY_STATES),
-  authenticated: import_zod3.z.boolean(),
-  modelAvailable: import_zod3.z.boolean(),
-  toolCalling: import_zod3.z.boolean(),
-  toolResultContinuation: import_zod3.z.boolean(),
-  streaming: import_zod3.z.boolean(),
-  checkedAt: import_zod3.z.iso.datetime().optional(),
+  protocol: import_zod4.z.enum(["responses", "chat-completions"]),
+  state: import_zod4.z.enum(AGENT_CAPABILITY_STATES),
+  authenticated: import_zod4.z.boolean(),
+  modelAvailable: import_zod4.z.boolean(),
+  toolCalling: import_zod4.z.boolean(),
+  toolResultContinuation: import_zod4.z.boolean(),
+  streaming: import_zod4.z.boolean(),
+  checkedAt: import_zod4.z.iso.datetime().optional(),
   errorCode: errorCodeSchema.optional()
 });
-var agentWorkspaceHealthSnapshotSchema = import_zod3.z.strictObject({
-  state: import_zod3.z.enum(AGENT_WORKSPACE_STATES),
-  checkedAt: import_zod3.z.iso.datetime(),
-  changes: import_zod3.z.strictObject({
-    staged: import_zod3.z.number().int().nonnegative(),
-    unstaged: import_zod3.z.number().int().nonnegative(),
-    untracked: import_zod3.z.number().int().nonnegative(),
-    conflicted: import_zod3.z.number().int().nonnegative(),
-    total: import_zod3.z.number().int().nonnegative()
+var agentWorkspaceHealthSnapshotSchema = import_zod4.z.strictObject({
+  state: import_zod4.z.enum(AGENT_WORKSPACE_STATES),
+  checkedAt: import_zod4.z.iso.datetime(),
+  changes: import_zod4.z.strictObject({
+    staged: import_zod4.z.number().int().nonnegative(),
+    unstaged: import_zod4.z.number().int().nonnegative(),
+    untracked: import_zod4.z.number().int().nonnegative(),
+    conflicted: import_zod4.z.number().int().nonnegative(),
+    total: import_zod4.z.number().int().nonnegative()
   }),
-  canIncludeLocalChanges: import_zod3.z.boolean(),
+  canIncludeLocalChanges: import_zod4.z.boolean(),
   errorCode: errorCodeSchema.optional()
 }).refine(
   ({ state, changes, canIncludeLocalChanges, errorCode }) => {
@@ -536,42 +1060,42 @@ var agentWorkspaceHealthSnapshotSchema = import_zod3.z.strictObject({
   },
   { message: "Agent workspace health fields are inconsistent." }
 );
-var agentChangedFileSchema = import_zod3.z.strictObject({
+var agentChangedFileSchema = import_zod4.z.strictObject({
   relativePath: boundedString2(1024),
-  kind: import_zod3.z.enum(AGENT_FILE_CHANGE_KINDS),
-  additions: import_zod3.z.number().int().nonnegative(),
-  deletions: import_zod3.z.number().int().nonnegative()
+  kind: import_zod4.z.enum(AGENT_FILE_CHANGE_KINDS),
+  additions: import_zod4.z.number().int().nonnegative(),
+  deletions: import_zod4.z.number().int().nonnegative()
 });
-var agentCheckResultSchema = import_zod3.z.strictObject({
+var agentCheckResultSchema = import_zod4.z.strictObject({
   checkId: profileIdSchema3,
   label: boundedString2(100),
-  status: import_zod3.z.enum(AGENT_CHECK_STATUSES),
-  durationMs: import_zod3.z.number().int().nonnegative(),
+  status: import_zod4.z.enum(AGENT_CHECK_STATUSES),
+  durationMs: import_zod4.z.number().int().nonnegative(),
   output: boundedString2(8e4)
 });
-var agentJobSnapshotSchema = import_zod3.z.strictObject({
-  jobId: import_zod3.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
-  status: import_zod3.z.enum(AGENT_JOB_STATUSES),
+var agentJobSnapshotSchema = import_zod4.z.strictObject({
+  jobId: import_zod4.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
+  status: import_zod4.z.enum(AGENT_JOB_STATUSES),
   providerProfileId: profileIdSchema3,
   providerLabel: boundedString2(100),
   modelProfileId: profileIdSchema3,
   modelLabel: boundedString2(100),
   phaseMessage: boundedString2(1024),
-  createdAt: import_zod3.z.iso.datetime(),
-  updatedAt: import_zod3.z.iso.datetime(),
-  canCancel: import_zod3.z.boolean(),
-  canApply: import_zod3.z.boolean(),
-  canRevert: import_zod3.z.boolean(),
+  createdAt: import_zod4.z.iso.datetime(),
+  updatedAt: import_zod4.z.iso.datetime(),
+  canCancel: import_zod4.z.boolean(),
+  canApply: import_zod4.z.boolean(),
+  canRevert: import_zod4.z.boolean(),
   errorCode: errorCodeSchema.optional()
 });
-var agentJobResultSchema = import_zod3.z.strictObject({
-  jobId: import_zod3.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
+var agentJobResultSchema = import_zod4.z.strictObject({
+  jobId: import_zod4.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
   summary: boundedString2(8e4),
   diff: boundedString2(1e6),
-  files: import_zod3.z.array(agentChangedFileSchema).max(100),
-  checks: import_zod3.z.array(agentCheckResultSchema).max(100)
+  files: import_zod4.z.array(agentChangedFileSchema).max(100),
+  checks: import_zod4.z.array(agentCheckResultSchema).max(100)
 });
-var agentJobResultResponseSchema = import_zod3.z.strictObject({
+var agentJobResultResponseSchema = import_zod4.z.strictObject({
   snapshot: agentJobSnapshotSchema,
   result: agentJobResultSchema.optional()
 }).superRefine((value, context) => {
@@ -583,44 +1107,44 @@ var agentJobResultResponseSchema = import_zod3.z.strictObject({
     });
   }
 });
-var agentJobEventBaseSchema = import_zod3.z.strictObject({
-  schemaVersion: import_zod3.z.literal(2),
-  sequence: import_zod3.z.number().int().positive(),
-  jobId: import_zod3.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
-  status: import_zod3.z.enum(AGENT_JOB_STATUSES),
-  timestamp: import_zod3.z.iso.datetime()
+var agentJobEventBaseSchema = import_zod4.z.strictObject({
+  schemaVersion: import_zod4.z.literal(2),
+  sequence: import_zod4.z.number().int().positive(),
+  jobId: import_zod4.z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
+  status: import_zod4.z.enum(AGENT_JOB_STATUSES),
+  timestamp: import_zod4.z.iso.datetime()
 });
-var agentJobEventSchema = import_zod3.z.discriminatedUnion("type", [
+var agentJobEventSchema = import_zod4.z.discriminatedUnion("type", [
   agentJobEventBaseSchema.extend({
-    type: import_zod3.z.literal("snapshot"),
-    data: import_zod3.z.strictObject({ snapshot: agentJobSnapshotSchema })
+    type: import_zod4.z.literal("snapshot"),
+    data: import_zod4.z.strictObject({ snapshot: agentJobSnapshotSchema })
   }),
   agentJobEventBaseSchema.extend({
-    type: import_zod3.z.literal("phase"),
-    data: import_zod3.z.strictObject({ message: boundedString2(1024) })
+    type: import_zod4.z.literal("phase"),
+    data: import_zod4.z.strictObject({ message: boundedString2(1024) })
   }),
   agentJobEventBaseSchema.extend({
-    type: import_zod3.z.literal("tool"),
-    data: import_zod3.z.strictObject({
-      turn: import_zod3.z.number().int().positive(),
+    type: import_zod4.z.literal("tool"),
+    data: import_zod4.z.strictObject({
+      turn: import_zod4.z.number().int().positive(),
       toolCallId: boundedString2(256),
       toolName: boundedString2(100),
-      state: import_zod3.z.enum(["started", "succeeded", "failed"]),
+      state: import_zod4.z.enum(["started", "succeeded", "failed"]),
       relativePath: boundedString2(1024).optional(),
       checkLabel: boundedString2(100).optional()
     })
   }),
   agentJobEventBaseSchema.extend({
-    type: import_zod3.z.literal("check"),
-    data: import_zod3.z.strictObject({ result: agentCheckResultSchema })
+    type: import_zod4.z.literal("check"),
+    data: import_zod4.z.strictObject({ result: agentCheckResultSchema })
   }),
   agentJobEventBaseSchema.extend({
-    type: import_zod3.z.literal("result-ready"),
-    data: import_zod3.z.strictObject({ hasResult: import_zod3.z.literal(true) })
+    type: import_zod4.z.literal("result-ready"),
+    data: import_zod4.z.strictObject({ hasResult: import_zod4.z.literal(true) })
   }),
   agentJobEventBaseSchema.extend({
-    type: import_zod3.z.literal("error"),
-    data: import_zod3.z.strictObject({
+    type: import_zod4.z.literal("error"),
+    data: import_zod4.z.strictObject({
       code: errorCodeSchema,
       message: boundedString2(1024)
     })
@@ -656,7 +1180,22 @@ var SPOTPATCH_REPOSITORY_URL = "https://github.com/huanglvjing/spotpatch";
   AGENT_JOB_STATUSES,
   AGENT_WORKSPACE_SNAPSHOT_LIMITS,
   AGENT_WORKSPACE_STATES,
+  DATA_FLOW_ASSOCIATION_KINDS,
+  DATA_FLOW_DIAGNOSTIC_CODES,
+  DATA_FLOW_EXECUTION_STATES,
+  DATA_FLOW_FRESHNESS_STATES,
+  DATA_FLOW_PROOF_STATES,
+  DATA_FLOW_QUERY_ADAPTER_MODULES,
+  DATA_FLOW_QUERY_HOOK_NAMES,
+  DATA_FLOW_SCHEMA_VERSION,
+  DATA_FLOW_TRPC_CLIENT_FACTORY_NAMES,
+  DATA_FLOW_TRPC_PROXY_FACTORY_NAMES,
+  DATA_FLOW_TRPC_REQUEST_METHODS,
+  DATA_FLOW_TRPC_ROOT_FACTORY_NAMES,
+  DATA_FLOW_URL_QUERY_KEY_LIMIT,
   DEFAULT_AGENT_LIMITS,
+  DEFAULT_DATA_FLOW_LIMITS,
+  DEFAULT_RUNTIME_DATA_FLOW_LIMITS,
   ERROR_CODES,
   MAX_ANNOTATION_INSTRUCTION_CHARACTERS,
   MAX_ANNOTATION_TARGETS,
@@ -684,14 +1223,22 @@ var SPOTPATCH_REPOSITORY_URL = "https://github.com/huanglvjing/spotpatch";
   agentJobSnapshotSchema,
   agentWorkspaceHealthRequestSchema,
   agentWorkspaceHealthSnapshotSchema,
+  componentDataFlowReportSchema,
+  dataDependencySchema,
+  dataFlowComponentReportRequestSchema,
+  dataFlowPageReportRequestSchema,
   formatSourceMarker,
   getAgentJobEndpoint,
   isSensitiveName,
+  limitDataFlowReportCollections,
+  networkObservationSchema,
   openEditorRequestSchema,
+  pageDataFlowReportSchema,
   parseSourceMarker,
   redactSensitiveText,
   runtimeBootstrapRequestSchema,
   runtimeConfigSchema,
+  runtimeDataFlowConfigSchema,
   sanitizeUrl,
   sourceContextRequestSchema,
   spotAnnotationRequestSchema,