@spotpatch/shared 1.8.0 → 1.9.0

package/dist/index.js

@@ -1,3 +1,14 @@
+import {
+  DATA_FLOW_SCHEMA_VERSION,
+  DATA_FLOW_URL_QUERY_KEY_LIMIT,
+  DEFAULT_DATA_FLOW_LIMITS,
+  DEFAULT_RUNTIME_DATA_FLOW_LIMITS,
+  SPOTPATCH_API_BASE,
+  SPOTPATCH_ENDPOINTS,
+  SPOTPATCH_TOKEN_HEADER,
+  getAgentJobEndpoint
+} from "./chunk-K2UAPG7T.js";
+
 // src/errors/spotpatch-error.ts
 var SpotPatchError = class extends Error {
   code;
@@ -17,6 +28,9 @@ var ERROR_CODES = {
   SOURCE_OUTSIDE_ROOT: "SOURCE_OUTSIDE_ROOT",
   SOURCE_TOO_LARGE: "SOURCE_TOO_LARGE",
   EDITOR_OPEN_FAILED: "EDITOR_OPEN_FAILED",
+  DATA_FLOW_DISABLED: "DATA_FLOW_DISABLED",
+  DATA_FLOW_SOURCE_STALE: "DATA_FLOW_SOURCE_STALE",
+  DATA_FLOW_ANALYSIS_CANCELLED: "DATA_FLOW_ANALYSIS_CANCELLED",
   AI_DISABLED: "AI_DISABLED",
   PROVIDER_NOT_CONFIGURED: "PROVIDER_NOT_CONFIGURED",
   PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
@@ -124,23 +138,455 @@ var SPOTPATCH_LOCALE_PREFERENCES = Object.freeze([
   ...SPOTPATCH_LOCALES
 ]);
 
-// src/model/runtime-config.ts
+// src/model/data-flow-adapters.ts
+var DATA_FLOW_QUERY_ADAPTER_MODULES = Object.freeze([
+  "@tanstack/react-query",
+  "react-query"
+]);
+var DATA_FLOW_QUERY_HOOK_NAMES = Object.freeze([
+  "useInfiniteQuery",
+  "useMutation",
+  "useQuery"
+]);
+var DATA_FLOW_TRPC_CLIENT_FACTORY_NAMES = Object.freeze([
+  "createTRPCClient",
+  "createTRPCProxyClient"
+]);
+var DATA_FLOW_TRPC_PROXY_FACTORY_NAMES = Object.freeze([
+  "createTRPCNext",
+  "createTRPCReact"
+]);
+var DATA_FLOW_TRPC_ROOT_FACTORY_NAMES = Object.freeze([
+  ...DATA_FLOW_TRPC_CLIENT_FACTORY_NAMES,
+  ...DATA_FLOW_TRPC_PROXY_FACTORY_NAMES,
+  "createTRPCContext",
+  "createTRPCOptionsProxy"
+]);
+var DATA_FLOW_TRPC_REQUEST_METHODS = Object.freeze([
+  "infiniteQueryOptions",
+  "mutate",
+  "mutateAsync",
+  "mutationOptions",
+  "query",
+  "queryOptions",
+  "refetch",
+  "subscribe",
+  "subscriptionOptions",
+  "useInfiniteQuery",
+  "useMutation",
+  "useQuery",
+  "useSubscription",
+  "useSuspenseInfiniteQuery",
+  "useSuspenseQuery"
+]);
+
+// src/model/data-flow.ts
 import { z } from "zod";
+var DATA_FLOW_EXECUTION_STATES = Object.freeze([
+  "observed",
+  "declared-not-observed",
+  "not-applicable",
+  "unknown"
+]);
+var DATA_FLOW_PROOF_STATES = Object.freeze([
+  "proven",
+  "candidate",
+  "unavailable",
+  "conflict"
+]);
+var DATA_FLOW_ASSOCIATION_KINDS = Object.freeze([
+  "direct",
+  "transitive",
+  "upstream",
+  "possible",
+  "unassigned",
+  "unknown"
+]);
+var DATA_FLOW_FRESHNESS_STATES = Object.freeze([
+  "current",
+  "stale-source",
+  "stale-route",
+  "expired"
+]);
+var DATA_FLOW_DIAGNOSTIC_CODES = Object.freeze([
+  "DATA_FLOW_CAPABILITY_DISABLED",
+  "DATA_FLOW_CAPABILITY_PRELUDE_UNAVAILABLE",
+  "DATA_FLOW_CAPABILITY_UNSUPPORTED_FRAMEWORK",
+  "DATA_FLOW_SOURCE_UNAVAILABLE",
+  "DATA_FLOW_SOURCE_STALE",
+  "DATA_FLOW_ANALYSIS_TIMEOUT",
+  "DATA_FLOW_ANALYSIS_TRUNCATED",
+  "DATA_FLOW_ANALYSIS_UNRESOLVED_CALL",
+  "DATA_FLOW_OBSERVATION_UNASSIGNED",
+  "DATA_FLOW_OBSERVATION_DROPPED",
+  "DATA_FLOW_REDACTION_APPLIED",
+  "DATA_FLOW_AI_DISABLED"
+]);
+var boundedText = (maximum) => z.string().trim().min(1).max(maximum);
+var opaqueIdSchema = boundedText(128).regex(/^[A-Za-z0-9_-]+$/u);
+var diagnosticCodeSchema = z.enum(DATA_FLOW_DIAGNOSTIC_CODES);
+var evidenceSourceSchema = z.strictObject({
+  fileId: opaqueIdSchema,
+  displayPath: boundedText(1024),
+  line: z.number().int().positive(),
+  column: z.number().int().positive(),
+  sourceVersion: opaqueIdSchema
+});
+var sanitizedObservedUrlSchema = z.strictObject({
+  origin: boundedText(512).optional(),
+  pathname: boundedText(2048),
+  queryKeys: z.array(boundedText(256)).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxFields)
+});
+var dataParameterSchema = z.strictObject({
+  path: boundedText(1024),
+  position: z.enum([
+    "path",
+    "query",
+    "body",
+    "header",
+    "cookie",
+    "variable",
+    "form",
+    "unknown"
+  ]),
+  type: boundedText(512).optional(),
+  source: boundedText(1024).optional(),
+  condition: boundedText(1024).optional(),
+  sensitive: z.boolean(),
+  valueState: z.literal("not-collected"),
+  evidenceIds: z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence)
+});
+var dataResponseSchema = z.strictObject({
+  consumedFields: z.array(boundedText(1024)).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxFields)
+});
+var requestOriginSchema = z.strictObject({
+  componentSourceId: opaqueIdSchema.optional(),
+  triggerCallsiteId: opaqueIdSchema.optional(),
+  requestCallsiteId: opaqueIdSchema,
+  sourceVersion: opaqueIdSchema
+});
+var capabilityReasonSchema = z.strictObject({
+  code: diagnosticCodeSchema,
+  retryable: z.boolean()
+});
+var capabilitySchema = z.strictObject({
+  enabled: z.boolean(),
+  staticAnalysis: z.enum(["available", "partial", "unavailable"]),
+  runtimeObservation: z.literal("dispatch-only"),
+  responseShape: z.literal("consumed-fields-only"),
+  aiAssistance: z.literal("disabled"),
+  reasons: z.array(capabilityReasonSchema).max(DEFAULT_DATA_FLOW_LIMITS.capabilityMaxReasons)
+});
+var evidenceSchema = z.strictObject({
+  id: opaqueIdSchema,
+  kind: z.enum([
+    "source-anchor",
+    "import-resolution",
+    "symbol-edge",
+    "trigger-edge",
+    "call-edge",
+    "data-binding",
+    "adapter-rule",
+    "runtime-observation",
+    "runtime-reference",
+    "diagnostic"
+  ]),
+  source: evidenceSourceSchema.optional(),
+  adapter: z.strictObject({ id: boundedText(128), version: boundedText(64) }).optional(),
+  summaryKey: boundedText(256)
+});
+var diagnosticSchema = z.strictObject({
+  id: opaqueIdSchema,
+  code: diagnosticCodeSchema,
+  severity: z.enum(["info", "warning", "error"]),
+  retryable: z.boolean(),
+  evidenceIds: z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence)
+});
+var baselineSchema = z.strictObject({
+  registryEpoch: opaqueIdSchema,
+  analyzerVersion: boundedText(64),
+  adapterSetHash: boundedText(128),
+  analyzedSourceVersions: z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxModules)
+});
+var completenessSchema = z.strictObject({
+  complete: z.boolean(),
+  visitedModules: z.number().int().nonnegative(),
+  visitedCallsites: z.number().int().nonnegative(),
+  frontierCount: z.number().int().nonnegative(),
+  truncatedBy: z.enum(["depth", "modules", "callsites", "bytes", "timeout"]).optional()
+});
+var dataDependencySchema = z.strictObject({
+  id: opaqueIdSchema,
+  kind: z.enum(["http", "graphql", "rpc", "server-action", "unknown"]),
+  direction: z.enum(["read", "write", "read-write", "unknown"]),
+  execution: z.enum(DATA_FLOW_EXECUTION_STATES),
+  proof: z.enum(DATA_FLOW_PROOF_STATES),
+  association: z.enum(DATA_FLOW_ASSOCIATION_KINDS),
+  method: boundedText(32).optional(),
+  operation: boundedText(512).optional(),
+  url: sanitizedObservedUrlSchema.optional(),
+  parameters: z.array(dataParameterSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxFields),
+  response: dataResponseSchema,
+  origin: requestOriginSchema.optional(),
+  suppliedBindings: z.array(boundedText(1024)).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites),
+  locationIds: z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites),
+  evidenceIds: z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence),
+  observationIds: z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.observationMaxEntries)
+});
+var networkObservationSchema = z.strictObject({
+  schemaVersion: z.literal(DATA_FLOW_SCHEMA_VERSION),
+  id: opaqueIdSchema,
+  pageEpoch: opaqueIdSchema,
+  routeEpoch: opaqueIdSchema,
+  requestCallsiteId: opaqueIdSchema.optional(),
+  invocationId: opaqueIdSchema.optional(),
+  componentSourceId: opaqueIdSchema.optional(),
+  triggerCallsiteId: opaqueIdSchema.optional(),
+  sourceVersion: opaqueIdSchema.optional(),
+  transport: z.enum(["fetch", "trpc", "xhr"]),
+  method: boundedText(32),
+  operation: boundedText(512).optional(),
+  url: sanitizedObservedUrlSchema,
+  outcome: z.literal("dispatched"),
+  freshness: z.enum(DATA_FLOW_FRESHNESS_STATES),
+  diagnosticIds: z.array(opaqueIdSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence)
+});
+var componentIdentitySchema = z.strictObject({
+  componentSourceId: opaqueIdSchema.optional(),
+  displayName: boundedText(256).optional(),
+  source: evidenceSourceSchema
+});
+var componentDataFlowReportSchema = z.strictObject({
+  schemaVersion: z.literal(DATA_FLOW_SCHEMA_VERSION),
+  reportId: opaqueIdSchema,
+  baseline: baselineSchema,
+  capability: capabilitySchema,
+  component: componentIdentitySchema,
+  dependencies: z.array(dataDependencySchema).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites),
+  evidence: z.array(evidenceSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence),
+  diagnostics: z.array(diagnosticSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxDiagnostics),
+  completeness: completenessSchema
+});
+var pageDataFlowReportSchema = z.strictObject({
+  schemaVersion: z.literal(DATA_FLOW_SCHEMA_VERSION),
+  reportId: opaqueIdSchema,
+  baseline: baselineSchema,
+  capability: capabilitySchema,
+  dependencies: z.array(dataDependencySchema).max(DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites),
+  evidence: z.array(evidenceSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence),
+  diagnostics: z.array(diagnosticSchema).max(DEFAULT_DATA_FLOW_LIMITS.reportMaxDiagnostics),
+  completeness: completenessSchema
+});
+var runtimeDataFlowConfigSchema = z.strictObject({
+  enabled: z.boolean(),
+  runtime: z.literal("dispatch"),
+  limits: z.strictObject({
+    observationMaxEntries: z.number().int().positive(),
+    observationMaxBytes: z.number().int().positive(),
+    observationTtlMs: z.number().int().positive(),
+    reportMaxBytes: z.number().int().positive()
+  })
+});
 
-// src/protocol/endpoints.ts
-var SPOTPATCH_API_BASE = "/__spotpatch/v1";
-var SPOTPATCH_TOKEN_HEADER = "X-SpotPatch-Token";
-var SPOTPATCH_ENDPOINTS = Object.freeze({
-  bootstrap: `${SPOTPATCH_API_BASE}/bootstrap`,
-  sourceContext: `${SPOTPATCH_API_BASE}/source-context`,
-  openEditor: `${SPOTPATCH_API_BASE}/open-editor`,
-  agentCapability: `${SPOTPATCH_API_BASE}/agent/capability`,
-  agentWorkspaceHealth: `${SPOTPATCH_API_BASE}/agent/workspace-health`,
-  agentJobs: `${SPOTPATCH_API_BASE}/agent/jobs`
-});
-function getAgentJobEndpoint(jobId, action) {
-  return `${SPOTPATCH_ENDPOINTS.agentJobs}/${encodeURIComponent(jobId)}/${action}`;
+// src/model/data-flow-budget.ts
+function prefix(values, maximum) {
+  return Object.freeze(values.slice(0, Math.max(0, maximum)));
 }
+function limitDependency(dependency) {
+  const queryKeys = dependency.url === void 0 ? void 0 : prefix(dependency.url.queryKeys, DEFAULT_DATA_FLOW_LIMITS.reportMaxFields);
+  const parameters = prefix(
+    dependency.parameters,
+    DEFAULT_DATA_FLOW_LIMITS.reportMaxFields
+  ).map(
+    (parameter) => Object.freeze({
+      ...parameter,
+      evidenceIds: prefix(
+        parameter.evidenceIds,
+        DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence
+      )
+    })
+  );
+  const consumedFields = prefix(
+    dependency.response.consumedFields,
+    DEFAULT_DATA_FLOW_LIMITS.reportMaxFields
+  );
+  const suppliedBindings = prefix(
+    dependency.suppliedBindings,
+    DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites
+  );
+  const locationIds = prefix(
+    dependency.locationIds,
+    DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites
+  );
+  const evidenceIds = prefix(
+    dependency.evidenceIds,
+    DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence
+  );
+  const observationIds = prefix(
+    dependency.observationIds,
+    DEFAULT_DATA_FLOW_LIMITS.observationMaxEntries
+  );
+  const trimmed = queryKeys?.length !== dependency.url?.queryKeys.length || parameters.length !== dependency.parameters.length || parameters.some(
+    (parameter, index) => parameter.evidenceIds.length !== dependency.parameters[index]?.evidenceIds.length
+  ) || consumedFields.length !== dependency.response.consumedFields.length || suppliedBindings.length !== dependency.suppliedBindings.length || locationIds.length !== dependency.locationIds.length || evidenceIds.length !== dependency.evidenceIds.length || observationIds.length !== dependency.observationIds.length;
+  if (!trimmed) return Object.freeze({ dependency, trimmed: false });
+  return Object.freeze({
+    dependency: Object.freeze({
+      ...dependency,
+      ...dependency.url === void 0 ? {} : {
+        url: Object.freeze({
+          ...dependency.url,
+          queryKeys: queryKeys ?? Object.freeze([])
+        })
+      },
+      parameters: Object.freeze(parameters),
+      response: Object.freeze({ consumedFields }),
+      suppliedBindings,
+      locationIds,
+      evidenceIds,
+      observationIds
+    }),
+    trimmed: true
+  });
+}
+function referencedEvidenceIds(dependencies, diagnostics) {
+  return Object.freeze([
+    .../* @__PURE__ */ new Set([
+      ...dependencies.flatMap((dependency) => [
+        ...dependency.evidenceIds,
+        ...dependency.parameters.flatMap((parameter) => parameter.evidenceIds)
+      ]),
+      ...diagnostics.flatMap((diagnostic) => diagnostic.evidenceIds)
+    ])
+  ]);
+}
+function prioritizeEvidence(evidence, referencedIds, retainUnreferenced) {
+  const byId = new Map(evidence.map((entry) => [entry.id, entry]));
+  const ordered = [];
+  const retained = /* @__PURE__ */ new Set();
+  for (const id of referencedIds) {
+    const entry = byId.get(id);
+    if (entry !== void 0 && !retained.has(id)) {
+      ordered.push(entry);
+      retained.add(id);
+    }
+  }
+  if (retainUnreferenced) {
+    for (const entry of evidence) {
+      if (!retained.has(entry.id)) ordered.push(entry);
+    }
+  }
+  return prefix(ordered, DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence);
+}
+function pruneEvidenceReferences(dependency, retainedIds) {
+  return Object.freeze({
+    ...dependency,
+    parameters: Object.freeze(
+      dependency.parameters.map(
+        (parameter) => Object.freeze({
+          ...parameter,
+          evidenceIds: Object.freeze(
+            parameter.evidenceIds.filter((id) => retainedIds.has(id))
+          )
+        })
+      )
+    ),
+    evidenceIds: Object.freeze(
+      dependency.evidenceIds.filter((id) => retainedIds.has(id))
+    )
+  });
+}
+function truncationCode(mode) {
+  return mode === "analysis" ? "DATA_FLOW_ANALYSIS_TRUNCATED" : "DATA_FLOW_OBSERVATION_DROPPED";
+}
+function limitDataFlowReportCollections(report, options = {}) {
+  const maximumDependencies = Math.min(
+    Math.max(
+      0,
+      options.maximumDependencies ?? DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites
+    ),
+    DEFAULT_DATA_FLOW_LIMITS.graphMaxCallsites
+  );
+  const dependencyResults = prefix(report.dependencies, maximumDependencies).map(
+    limitDependency
+  );
+  const dependencies = dependencyResults.map(({ dependency }) => dependency);
+  const analyzedSourceVersions = prefix(
+    report.baseline.analyzedSourceVersions,
+    DEFAULT_DATA_FLOW_LIMITS.graphMaxModules
+  );
+  const collectionTrimmed = report.dependencies.length > dependencies.length || dependencyResults.some(({ trimmed }) => trimmed) || report.baseline.analyzedSourceVersions.length > analyzedSourceVersions.length || report.capability.reasons.length > DEFAULT_DATA_FLOW_LIMITS.capabilityMaxReasons || report.evidence.length > DEFAULT_DATA_FLOW_LIMITS.reportMaxEvidence || report.diagnostics.length > DEFAULT_DATA_FLOW_LIMITS.reportMaxDiagnostics;
+  const truncated = options.forceTruncation === true || collectionTrimmed;
+  if (!truncated) return report;
+  const mode = options.mode ?? "analysis";
+  const code = truncationCode(mode);
+  const diagnosticId = `${report.reportId}_collection_${mode}`;
+  const reasons = Object.freeze([
+    ...report.capability.reasons.filter((reason) => reason.code !== code).slice(0, DEFAULT_DATA_FLOW_LIMITS.capabilityMaxReasons - 1),
+    Object.freeze({ code, retryable: false })
+  ]);
+  const diagnostics = Object.freeze([
+    ...report.diagnostics.filter((diagnostic) => diagnostic.id !== diagnosticId).slice(0, DEFAULT_DATA_FLOW_LIMITS.reportMaxDiagnostics - 1),
+    Object.freeze({
+      id: diagnosticId,
+      code,
+      severity: "warning",
+      retryable: false,
+      evidenceIds: Object.freeze([])
+    })
+  ]);
+  const referencedIds = referencedEvidenceIds(dependencies, diagnostics);
+  const evidence = prioritizeEvidence(
+    report.evidence,
+    referencedIds,
+    report.dependencies.length === dependencies.length
+  );
+  const retainedEvidenceIds = new Set(evidence.map(({ id }) => id));
+  const prunedDependencies = Object.freeze(
+    dependencies.map(
+      (dependency) => pruneEvidenceReferences(dependency, retainedEvidenceIds)
+    )
+  );
+  const prunedDiagnostics = Object.freeze(
+    diagnostics.map(
+      (diagnostic) => Object.freeze({
+        ...diagnostic,
+        evidenceIds: Object.freeze(
+          diagnostic.evidenceIds.filter((id) => retainedEvidenceIds.has(id))
+        )
+      })
+    )
+  );
+  const removedDependencies = report.dependencies.length - dependencies.length;
+  const removedModules = report.baseline.analyzedSourceVersions.length - analyzedSourceVersions.length;
+  const derivedTruncation = removedModules > 0 && removedDependencies === 0 ? "modules" : "callsites";
+  return Object.freeze({
+    ...report,
+    baseline: Object.freeze({
+      ...report.baseline,
+      analyzedSourceVersions
+    }),
+    capability: Object.freeze({
+      ...report.capability,
+      ...mode === "analysis" && report.capability.staticAnalysis === "available" ? { staticAnalysis: "partial" } : {},
+      reasons
+    }),
+    dependencies: prunedDependencies,
+    evidence,
+    diagnostics: prunedDiagnostics,
+    ...mode === "analysis" ? {
+      completeness: Object.freeze({
+        ...report.completeness,
+        complete: false,
+        frontierCount: report.completeness.frontierCount + removedDependencies + removedModules + (collectionTrimmed && removedDependencies === 0 && removedModules === 0 ? 1 : 0),
+        truncatedBy: options.truncatedBy ?? report.completeness.truncatedBy ?? derivedTruncation
+      })
+    } : {}
+  });
+}
+
+// src/model/runtime-config.ts
+import { z as z2 } from "zod";
 
 // src/model/editor.ts
 var SPOTPATCH_EDITOR_PREFERENCES = ["auto", "vscode", "cursor"];
@@ -215,39 +661,39 @@ var SPOTPATCH_NEXT_ROUTER_KINDS = Object.freeze([
   "pages",
   "hybrid"
 ]);
-var boundedText = (maximum) => z.string().trim().min(1).max(maximum);
-var profileIdSchema = z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u);
-var runtimeAiModelSchema = z.strictObject({
+var boundedText2 = (maximum) => z2.string().trim().min(1).max(maximum);
+var profileIdSchema = z2.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u);
+var runtimeAiModelSchema = z2.strictObject({
   id: profileIdSchema,
-  label: boundedText(100)
+  label: boundedText2(100)
 });
-var runtimeAiProviderSchema = z.strictObject({
+var runtimeAiProviderSchema = z2.strictObject({
   id: profileIdSchema,
-  label: boundedText(100),
-  protocol: z.enum(["responses", "chat-completions"]),
-  models: z.array(runtimeAiModelSchema).min(1).max(64),
+  label: boundedText2(100),
+  protocol: z2.enum(["responses", "chat-completions"]),
+  models: z2.array(runtimeAiModelSchema).min(1).max(64),
   defaultModel: profileIdSchema
 }).refine(
   ({ defaultModel, models }) => models.some(({ id }) => id === defaultModel) && new Set(models.map(({ id }) => id)).size === models.length,
   { message: "Runtime AI model profiles are inconsistent." }
 );
-var runtimeAiConfigSchema = z.discriminatedUnion("enabled", [
-  z.strictObject({ enabled: z.literal(false) }),
-  z.strictObject({
-    enabled: z.literal(true),
-    providers: z.array(runtimeAiProviderSchema).min(1).max(32),
+var runtimeAiConfigSchema = z2.discriminatedUnion("enabled", [
+  z2.strictObject({ enabled: z2.literal(false) }),
+  z2.strictObject({
+    enabled: z2.literal(true),
+    providers: z2.array(runtimeAiProviderSchema).min(1).max(32),
     defaultProvider: profileIdSchema,
-    applyMode: z.enum(AGENT_APPLY_MODES)
+    applyMode: z2.enum(AGENT_APPLY_MODES)
   }).refine(
     ({ defaultProvider, providers }) => providers.some(({ id }) => id === defaultProvider) && new Set(providers.map(({ id }) => id)).size === providers.length,
     { message: "Runtime AI provider profiles are inconsistent." }
   )
 ]);
-var positiveInteger = z.number().int().positive();
+var positiveInteger = z2.number().int().positive();
 var runtimeConfigBaseShape = {
-  apiBase: z.literal(SPOTPATCH_API_BASE),
+  apiBase: z2.literal(SPOTPATCH_API_BASE),
   ai: runtimeAiConfigSchema,
-  budget: z.strictObject({
+  budget: z2.strictObject({
     totalCharacters: positiveInteger,
     domCharacters: positiveInteger,
     cssCharacters: positiveInteger,
@@ -255,27 +701,28 @@ var runtimeConfigBaseShape = {
     maxCodeLines: positiveInteger,
     maxComponentDepth: positiveInteger
   }),
-  debug: z.boolean(),
-  editor: z.enum(SPOTPATCH_EDITOR_PREFERENCES),
-  frameworkVersion: boundedText(64),
-  locale: z.enum(SPOTPATCH_LOCALE_PREFERENCES),
-  maxTargets: z.number().int().min(1).max(MAX_ANNOTATION_TARGETS),
-  redact: z.boolean(),
-  sessionId: z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/u),
-  sessionToken: z.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/u),
-  shortcut: boundedText(128),
-  spotPatchVersion: boundedText(64)
+  debug: z2.boolean(),
+  dataFlow: runtimeDataFlowConfigSchema,
+  editor: z2.enum(SPOTPATCH_EDITOR_PREFERENCES),
+  frameworkVersion: boundedText2(64),
+  locale: z2.enum(SPOTPATCH_LOCALE_PREFERENCES),
+  maxTargets: z2.number().int().min(1).max(MAX_ANNOTATION_TARGETS),
+  redact: z2.boolean(),
+  sessionId: z2.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+  sessionToken: z2.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+  shortcut: boundedText2(128),
+  spotPatchVersion: boundedText2(64)
 };
-var runtimeConfigSchema = z.discriminatedUnion("framework", [
-  z.strictObject({
+var runtimeConfigSchema = z2.discriminatedUnion("framework", [
+  z2.strictObject({
     ...runtimeConfigBaseShape,
-    framework: z.literal("vite")
+    framework: z2.literal("vite")
   }),
-  z.strictObject({
+  z2.strictObject({
     ...runtimeConfigBaseShape,
-    bundler: z.enum(SPOTPATCH_NEXT_BUNDLERS),
-    framework: z.literal("next"),
-    routerKind: z.enum(SPOTPATCH_NEXT_ROUTER_KINDS)
+    bundler: z2.enum(SPOTPATCH_NEXT_BUNDLERS),
+    framework: z2.literal("next"),
+    routerKind: z2.enum(SPOTPATCH_NEXT_ROUTER_KINDS)
   })
 ]);
 
@@ -303,90 +750,109 @@ function parseSourceMarker(value) {
 }
 
 // src/protocol/requests.ts
-import { z as z2 } from "zod";
-var runtimeBootstrapRequestSchema = z2.strictObject({});
-var sourceCoordinatesSchema = z2.strictObject({
-  fileId: z2.string().min(1).max(128),
-  line: z2.number().int().positive(),
-  column: z2.number().int().positive()
+import { z as z3 } from "zod";
+var runtimeBootstrapRequestSchema = z3.strictObject({});
+var sourceCoordinatesSchema = z3.strictObject({
+  fileId: z3.string().min(1).max(128),
+  line: z3.number().int().positive(),
+  column: z3.number().int().positive()
 });
 var sourceContextRequestSchema = sourceCoordinatesSchema.extend({
-  maxLines: z2.number().int().positive()
+  maxLines: z3.number().int().positive()
 }).strict();
 var openEditorRequestSchema = sourceCoordinatesSchema.strict();
-var profileIdSchema2 = z2.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
-var boundedString = (maximum) => z2.string().max(maximum);
-var sourceRefSchema = z2.strictObject({
+var dataFlowSourceCoordinatesRequestSchema = sourceCoordinatesSchema.extend({
+  schemaVersion: z3.literal(1),
+  sourceVersion: z3.string().min(1).max(128).optional()
+}).strict();
+var dataFlowComponentIdentityRequestSchema = z3.strictObject({
+  schemaVersion: z3.literal(1),
+  componentSourceId: z3.string().min(1).max(128),
+  sourceVersion: z3.string().min(1).max(128)
+});
+var dataFlowComponentReportRequestSchema = z3.union([
+  dataFlowSourceCoordinatesRequestSchema,
+  dataFlowComponentIdentityRequestSchema
+]);
+var dataFlowPageReportRequestSchema = z3.strictObject({
+  schemaVersion: z3.literal(1),
+  targets: z3.array(dataFlowComponentReportRequestSchema).min(1).max(MAX_ANNOTATION_TARGETS)
+});
+var profileIdSchema2 = z3.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
+var boundedString = (maximum) => z3.string().max(maximum);
+var sourceRefSchema = z3.strictObject({
   fileId: boundedString(128).optional(),
   relativePath: boundedString(1024).optional(),
-  line: z2.number().int().positive().optional(),
-  column: z2.number().int().positive().optional(),
-  origin: z2.enum(["jsx-host", "react-fiber", "dom-ancestor", "none"]),
-  confidence: z2.enum(["exact", "probable", "approximate", "unknown"])
+  line: z3.number().int().positive().optional(),
+  column: z3.number().int().positive().optional(),
+  origin: z3.enum(["jsx-host", "react-fiber", "dom-ancestor", "none"]),
+  confidence: z3.enum(["exact", "probable", "approximate", "unknown"])
 });
-var matchedStyleRuleSchema = z2.strictObject({
+var matchedStyleRuleSchema = z3.strictObject({
   selector: boundedString(2048),
   declarations: boundedString(8192),
   source: boundedString(1024).optional(),
   media: boundedString(1024).optional()
 });
-var codeContextSchema = z2.strictObject({
+var codeContextSchema = z3.strictObject({
   relativePath: boundedString(1024),
-  language: z2.enum(["tsx", "jsx"]),
-  startLine: z2.number().int().positive(),
-  endLine: z2.number().int().positive(),
+  language: z3.enum(["tsx", "jsx"]),
+  startLine: z3.number().int().positive(),
+  endLine: z3.number().int().positive(),
   excerpt: boundedString(16e3),
-  boundary: z2.enum(["component", "nearby-lines"])
+  boundary: z3.enum(["component", "nearby-lines"])
 });
-var pageContextSchema = z2.strictObject({
+var pageContextSchema = z3.strictObject({
   url: boundedString(2048),
   pathname: boundedString(2048),
   title: boundedString(1024),
-  viewportWidth: z2.number().nonnegative(),
-  viewportHeight: z2.number().nonnegative(),
-  devicePixelRatio: z2.number().positive()
+  viewportWidth: z3.number().nonnegative(),
+  viewportHeight: z3.number().nonnegative(),
+  devicePixelRatio: z3.number().positive()
 });
-var spotTargetContextRequestSchema = z2.strictObject({
-  instruction: z2.string().trim().min(1).max(MAX_TARGET_INSTRUCTION_CHARACTERS),
+var spotTargetContextRequestSchema = z3.strictObject({
+  instruction: z3.string().trim().min(1).max(MAX_TARGET_INSTRUCTION_CHARACTERS),
   page: pageContextSchema.optional(),
   source: sourceRefSchema,
-  react: z2.strictObject({
-    supported: z2.boolean(),
+  react: z3.strictObject({
+    supported: z3.boolean(),
     version: boundedString(64).optional(),
     componentName: boundedString(256).optional(),
-    componentStack: z2.array(boundedString(256)).max(64),
+    componentSourceId: boundedString(128).optional(),
+    sourceVersion: boundedString(128).optional(),
+    componentStack: z3.array(boundedString(256)).max(64),
     source: sourceRefSchema.optional()
   }),
-  element: z2.strictObject({
+  element: z3.strictObject({
     tagName: boundedString(128),
     selector: boundedString(2048),
     sanitizedHtml: boundedString(8192),
     textPreview: boundedString(2048).optional(),
     role: boundedString(256).optional(),
-    rect: z2.strictObject({
-      x: z2.number(),
-      y: z2.number(),
-      width: z2.number().nonnegative(),
-      height: z2.number().nonnegative()
+    rect: z3.strictObject({
+      x: z3.number(),
+      y: z3.number(),
+      width: z3.number().nonnegative(),
+      height: z3.number().nonnegative()
     })
   }),
-  styles: z2.strictObject({
-    classNames: z2.array(boundedString(512)).max(256),
+  styles: z3.strictObject({
+    classNames: z3.array(boundedString(512)).max(256),
     inlineStyle: boundedString(8192).optional(),
-    matchedRules: z2.array(matchedStyleRuleSchema).max(256),
-    computed: z2.record(boundedString(256), boundedString(2048)),
-    warnings: z2.array(boundedString(1024)).max(64)
+    matchedRules: z3.array(matchedStyleRuleSchema).max(256),
+    computed: z3.record(boundedString(256), boundedString(2048)),
+    warnings: z3.array(boundedString(1024)).max(64)
   }),
   code: codeContextSchema.optional(),
-  warnings: z2.array(boundedString(1024)).max(64)
+  warnings: z3.array(boundedString(1024)).max(64)
 });
-var spotAnnotationRequestSchema = z2.strictObject({
-  schemaVersion: z2.literal(3),
+var spotAnnotationRequestSchema = z3.strictObject({
+  schemaVersion: z3.literal(3),
   id: boundedString(128),
-  locale: z2.enum(SPOTPATCH_LOCALES),
+  locale: z3.enum(SPOTPATCH_LOCALES),
   page: pageContextSchema,
-  targets: z2.array(spotTargetContextRequestSchema).min(1).max(MAX_ANNOTATION_TARGETS),
-  createdAt: z2.iso.datetime()
+  targets: z3.array(spotTargetContextRequestSchema).min(1).max(MAX_ANNOTATION_TARGETS),
+  createdAt: z3.iso.datetime()
 }).superRefine((annotation, context) => {
   const total = annotation.targets.reduce(
     (characters, target) => characters + target.instruction.length,
@@ -400,53 +866,53 @@ var spotAnnotationRequestSchema = z2.strictObject({
     });
   }
 });
-var agentCapabilityRequestSchema = z2.strictObject({
+var agentCapabilityRequestSchema = z3.strictObject({
   providerProfileId: profileIdSchema2,
   modelProfileId: profileIdSchema2
 });
-var agentWorkspaceHealthRequestSchema = z2.strictObject({});
-var agentJobCreateRequestSchema = z2.strictObject({
+var agentWorkspaceHealthRequestSchema = z3.strictObject({});
+var agentJobCreateRequestSchema = z3.strictObject({
   annotation: spotAnnotationRequestSchema,
-  applyMode: z2.enum(AGENT_APPLY_MODES).optional(),
+  applyMode: z3.enum(AGENT_APPLY_MODES).optional(),
   providerProfileId: profileIdSchema2,
   modelProfileId: profileIdSchema2,
-  providerDataConsent: z2.literal(true),
-  trustedFastModeConsent: z2.literal(true).optional(),
-  workingTreeMode: z2.enum(["require-clean", "include-local-changes"]).default("require-clean")
+  providerDataConsent: z3.literal(true),
+  trustedFastModeConsent: z3.literal(true).optional(),
+  workingTreeMode: z3.enum(["require-clean", "include-local-changes"]).default("require-clean")
 });
-var agentJobActionRequestSchema = z2.strictObject({});
+var agentJobActionRequestSchema = z3.strictObject({});
 
 // src/protocol/agent-schemas.ts
-import { z as z3 } from "zod";
-var profileIdSchema3 = z3.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
-var boundedString2 = (maximum) => z3.string().max(maximum);
-var errorCodeSchema = z3.enum(ERROR_CODES);
-var agentCapabilitySnapshotSchema = z3.strictObject({
+import { z as z4 } from "zod";
+var profileIdSchema3 = z4.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
+var boundedString2 = (maximum) => z4.string().max(maximum);
+var errorCodeSchema = z4.enum(ERROR_CODES);
+var agentCapabilitySnapshotSchema = z4.strictObject({
   providerProfileId: profileIdSchema3,
   providerLabel: boundedString2(100),
   modelProfileId: profileIdSchema3,
   modelLabel: boundedString2(100),
-  protocol: z3.enum(["responses", "chat-completions"]),
-  state: z3.enum(AGENT_CAPABILITY_STATES),
-  authenticated: z3.boolean(),
-  modelAvailable: z3.boolean(),
-  toolCalling: z3.boolean(),
-  toolResultContinuation: z3.boolean(),
-  streaming: z3.boolean(),
-  checkedAt: z3.iso.datetime().optional(),
+  protocol: z4.enum(["responses", "chat-completions"]),
+  state: z4.enum(AGENT_CAPABILITY_STATES),
+  authenticated: z4.boolean(),
+  modelAvailable: z4.boolean(),
+  toolCalling: z4.boolean(),
+  toolResultContinuation: z4.boolean(),
+  streaming: z4.boolean(),
+  checkedAt: z4.iso.datetime().optional(),
   errorCode: errorCodeSchema.optional()
 });
-var agentWorkspaceHealthSnapshotSchema = z3.strictObject({
-  state: z3.enum(AGENT_WORKSPACE_STATES),
-  checkedAt: z3.iso.datetime(),
-  changes: z3.strictObject({
-    staged: z3.number().int().nonnegative(),
-    unstaged: z3.number().int().nonnegative(),
-    untracked: z3.number().int().nonnegative(),
-    conflicted: z3.number().int().nonnegative(),
-    total: z3.number().int().nonnegative()
+var agentWorkspaceHealthSnapshotSchema = z4.strictObject({
+  state: z4.enum(AGENT_WORKSPACE_STATES),
+  checkedAt: z4.iso.datetime(),
+  changes: z4.strictObject({
+    staged: z4.number().int().nonnegative(),
+    unstaged: z4.number().int().nonnegative(),
+    untracked: z4.number().int().nonnegative(),
+    conflicted: z4.number().int().nonnegative(),
+    total: z4.number().int().nonnegative()
   }),
-  canIncludeLocalChanges: z3.boolean(),
+  canIncludeLocalChanges: z4.boolean(),
   errorCode: errorCodeSchema.optional()
 }).refine(
   ({ state, changes, canIncludeLocalChanges, errorCode }) => {
@@ -464,42 +930,42 @@ var agentWorkspaceHealthSnapshotSchema = z3.strictObject({
   },
   { message: "Agent workspace health fields are inconsistent." }
 );
-var agentChangedFileSchema = z3.strictObject({
+var agentChangedFileSchema = z4.strictObject({
   relativePath: boundedString2(1024),
-  kind: z3.enum(AGENT_FILE_CHANGE_KINDS),
-  additions: z3.number().int().nonnegative(),
-  deletions: z3.number().int().nonnegative()
+  kind: z4.enum(AGENT_FILE_CHANGE_KINDS),
+  additions: z4.number().int().nonnegative(),
+  deletions: z4.number().int().nonnegative()
 });
-var agentCheckResultSchema = z3.strictObject({
+var agentCheckResultSchema = z4.strictObject({
   checkId: profileIdSchema3,
   label: boundedString2(100),
-  status: z3.enum(AGENT_CHECK_STATUSES),
-  durationMs: z3.number().int().nonnegative(),
+  status: z4.enum(AGENT_CHECK_STATUSES),
+  durationMs: z4.number().int().nonnegative(),
   output: boundedString2(8e4)
 });
-var agentJobSnapshotSchema = z3.strictObject({
-  jobId: z3.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
-  status: z3.enum(AGENT_JOB_STATUSES),
+var agentJobSnapshotSchema = z4.strictObject({
+  jobId: z4.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
+  status: z4.enum(AGENT_JOB_STATUSES),
   providerProfileId: profileIdSchema3,
   providerLabel: boundedString2(100),
   modelProfileId: profileIdSchema3,
   modelLabel: boundedString2(100),
   phaseMessage: boundedString2(1024),
-  createdAt: z3.iso.datetime(),
-  updatedAt: z3.iso.datetime(),
-  canCancel: z3.boolean(),
-  canApply: z3.boolean(),
-  canRevert: z3.boolean(),
+  createdAt: z4.iso.datetime(),
+  updatedAt: z4.iso.datetime(),
+  canCancel: z4.boolean(),
+  canApply: z4.boolean(),
+  canRevert: z4.boolean(),
   errorCode: errorCodeSchema.optional()
 });
-var agentJobResultSchema = z3.strictObject({
-  jobId: z3.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
+var agentJobResultSchema = z4.strictObject({
+  jobId: z4.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
   summary: boundedString2(8e4),
   diff: boundedString2(1e6),
-  files: z3.array(agentChangedFileSchema).max(100),
-  checks: z3.array(agentCheckResultSchema).max(100)
+  files: z4.array(agentChangedFileSchema).max(100),
+  checks: z4.array(agentCheckResultSchema).max(100)
 });
-var agentJobResultResponseSchema = z3.strictObject({
+var agentJobResultResponseSchema = z4.strictObject({
   snapshot: agentJobSnapshotSchema,
   result: agentJobResultSchema.optional()
 }).superRefine((value, context) => {
@@ -511,44 +977,44 @@ var agentJobResultResponseSchema = z3.strictObject({
     });
   }
 });
-var agentJobEventBaseSchema = z3.strictObject({
-  schemaVersion: z3.literal(2),
-  sequence: z3.number().int().positive(),
-  jobId: z3.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
-  status: z3.enum(AGENT_JOB_STATUSES),
-  timestamp: z3.iso.datetime()
+var agentJobEventBaseSchema = z4.strictObject({
+  schemaVersion: z4.literal(2),
+  sequence: z4.number().int().positive(),
+  jobId: z4.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/),
+  status: z4.enum(AGENT_JOB_STATUSES),
+  timestamp: z4.iso.datetime()
 });
-var agentJobEventSchema = z3.discriminatedUnion("type", [
+var agentJobEventSchema = z4.discriminatedUnion("type", [
   agentJobEventBaseSchema.extend({
-    type: z3.literal("snapshot"),
-    data: z3.strictObject({ snapshot: agentJobSnapshotSchema })
+    type: z4.literal("snapshot"),
+    data: z4.strictObject({ snapshot: agentJobSnapshotSchema })
   }),
   agentJobEventBaseSchema.extend({
-    type: z3.literal("phase"),
-    data: z3.strictObject({ message: boundedString2(1024) })
+    type: z4.literal("phase"),
+    data: z4.strictObject({ message: boundedString2(1024) })
   }),
   agentJobEventBaseSchema.extend({
-    type: z3.literal("tool"),
-    data: z3.strictObject({
-      turn: z3.number().int().positive(),
+    type: z4.literal("tool"),
+    data: z4.strictObject({
+      turn: z4.number().int().positive(),
       toolCallId: boundedString2(256),
       toolName: boundedString2(100),
-      state: z3.enum(["started", "succeeded", "failed"]),
+      state: z4.enum(["started", "succeeded", "failed"]),
       relativePath: boundedString2(1024).optional(),
       checkLabel: boundedString2(100).optional()
     })
   }),
   agentJobEventBaseSchema.extend({
-    type: z3.literal("check"),
-    data: z3.strictObject({ result: agentCheckResultSchema })
+    type: z4.literal("check"),
+    data: z4.strictObject({ result: agentCheckResultSchema })
   }),
   agentJobEventBaseSchema.extend({
-    type: z3.literal("result-ready"),
-    data: z3.strictObject({ hasResult: z3.literal(true) })
+    type: z4.literal("result-ready"),
+    data: z4.strictObject({ hasResult: z4.literal(true) })
   }),
   agentJobEventBaseSchema.extend({
-    type: z3.literal("error"),
-    data: z3.strictObject({
+    type: z4.literal("error"),
+    data: z4.strictObject({
       code: errorCodeSchema,
       message: boundedString2(1024)
     })
@@ -583,7 +1049,22 @@ export {
   AGENT_JOB_STATUSES,
   AGENT_WORKSPACE_SNAPSHOT_LIMITS,
   AGENT_WORKSPACE_STATES,
+  DATA_FLOW_ASSOCIATION_KINDS,
+  DATA_FLOW_DIAGNOSTIC_CODES,
+  DATA_FLOW_EXECUTION_STATES,
+  DATA_FLOW_FRESHNESS_STATES,
+  DATA_FLOW_PROOF_STATES,
+  DATA_FLOW_QUERY_ADAPTER_MODULES,
+  DATA_FLOW_QUERY_HOOK_NAMES,
+  DATA_FLOW_SCHEMA_VERSION,
+  DATA_FLOW_TRPC_CLIENT_FACTORY_NAMES,
+  DATA_FLOW_TRPC_PROXY_FACTORY_NAMES,
+  DATA_FLOW_TRPC_REQUEST_METHODS,
+  DATA_FLOW_TRPC_ROOT_FACTORY_NAMES,
+  DATA_FLOW_URL_QUERY_KEY_LIMIT,
   DEFAULT_AGENT_LIMITS,
+  DEFAULT_DATA_FLOW_LIMITS,
+  DEFAULT_RUNTIME_DATA_FLOW_LIMITS,
   ERROR_CODES,
   MAX_ANNOTATION_INSTRUCTION_CHARACTERS,
   MAX_ANNOTATION_TARGETS,
@@ -611,14 +1092,22 @@ export {
   agentJobSnapshotSchema,
   agentWorkspaceHealthRequestSchema,
   agentWorkspaceHealthSnapshotSchema,
+  componentDataFlowReportSchema,
+  dataDependencySchema,
+  dataFlowComponentReportRequestSchema,
+  dataFlowPageReportRequestSchema,
   formatSourceMarker,
   getAgentJobEndpoint,
   isSensitiveName,
+  limitDataFlowReportCollections,
+  networkObservationSchema,
   openEditorRequestSchema,
+  pageDataFlowReportSchema,
   parseSourceMarker,
   redactSensitiveText,
   runtimeBootstrapRequestSchema,
   runtimeConfigSchema,
+  runtimeDataFlowConfigSchema,
   sanitizeUrl,
   sourceContextRequestSchema,
   spotAnnotationRequestSchema,