@spotpatch/vite 1.0.0

package/dist/index.cjs

@@ -0,0 +1,2268 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_AGENT_LIMITS: () => import_shared12.DEFAULT_AGENT_LIMITS,
+  DEFAULT_OPTIONS: () => DEFAULT_OPTIONS,
+  resolveOptions: () => resolveOptions,
+  spotPatch: () => spotPatch
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/options.ts
+var import_shared = require("@spotpatch/shared");
+var import_zod = require("zod");
+var DEFAULT_EXCLUDE = Object.freeze([
+  /node_modules/,
+  /\.test\.[jt]sx$/,
+  /\.spec\.[jt]sx$/,
+  /\.stories\.[jt]sx$/,
+  /(?:^|\/)dist(?:\/|$)/,
+  /(?:^|\/)coverage(?:\/|$)/
+]);
+var DEFAULT_INCLUDE = Object.freeze([/(?:^|[/\\])src[/\\].+\.(?:jsx|tsx)$/]);
+var DEFAULT_BUDGET = Object.freeze({
+  totalCharacters: 16e3,
+  domCharacters: 3e3,
+  cssCharacters: 4e3,
+  codeCharacters: 7e3,
+  maxCodeLines: 80,
+  maxComponentDepth: 8
+});
+var DEFAULT_OPTIONS = Object.freeze({
+  enabled: true,
+  include: DEFAULT_INCLUDE,
+  exclude: DEFAULT_EXCLUDE,
+  editor: "vscode",
+  redact: true,
+  budget: DEFAULT_BUDGET,
+  shortcut: "Mod+Shift+S",
+  allowLan: false,
+  debug: false,
+  locale: "auto",
+  maxTargets: 8,
+  ai: false
+});
+var PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]{1,127}$/;
+var agentLimitsSchema = import_zod.z.strictObject({
+  maxTurns: import_zod.z.number().optional(),
+  maxToolCalls: import_zod.z.number().optional(),
+  maxChangedFiles: import_zod.z.number().optional(),
+  maxDiffBytes: import_zod.z.number().optional(),
+  maxReadBytesPerFile: import_zod.z.number().optional(),
+  maxToolOutputCharacters: import_zod.z.number().optional(),
+  maxProviderResponseBytes: import_zod.z.number().optional(),
+  providerConnectTimeoutMs: import_zod.z.number().optional(),
+  providerFirstByteTimeoutMs: import_zod.z.number().optional(),
+  providerIdleTimeoutMs: import_zod.z.number().optional(),
+  checkTimeoutMs: import_zod.z.number().optional(),
+  jobTimeoutMs: import_zod.z.number().optional()
+}).optional();
+var agentCheckSchema = import_zod.z.strictObject({
+  label: import_zod.z.string(),
+  command: import_zod.z.string(),
+  args: import_zod.z.array(import_zod.z.string()).optional(),
+  required: import_zod.z.boolean().optional(),
+  timeoutMs: import_zod.z.number().optional()
+});
+var aiOptionsSchema = import_zod.z.strictObject({
+  providers: import_zod.z.record(
+    import_zod.z.string(),
+    import_zod.z.strictObject({
+      type: import_zod.z.literal("openai-compatible"),
+      label: import_zod.z.string(),
+      protocol: import_zod.z.enum(["responses", "chat-completions"]),
+      baseURL: import_zod.z.string(),
+      apiKeyEnv: import_zod.z.string(),
+      models: import_zod.z.record(
+        import_zod.z.string(),
+        import_zod.z.strictObject({ label: import_zod.z.string(), model: import_zod.z.string() })
+      ),
+      defaultModel: import_zod.z.string()
+    })
+  ),
+  defaultProvider: import_zod.z.string(),
+  execution: import_zod.z.strictObject({
+    isolation: import_zod.z.literal("git-worktree").optional(),
+    applyMode: import_zod.z.enum(["review", "auto"]).optional(),
+    checks: import_zod.z.record(import_zod.z.string(), agentCheckSchema).optional(),
+    limits: agentLimitsSchema
+  }).optional()
+});
+function assertIdentifier(value, label) {
+  if (!PROFILE_ID_PATTERN.test(value)) {
+    throw new RangeError(
+      `SpotPatch ${label} must contain only letters, numbers, dot, underscore, or hyphen.`
+    );
+  }
+}
+function nonEmpty(value, label, maximum = 256) {
+  const normalized = value.trim();
+  if (normalized.length === 0 || normalized.length > maximum || value.includes("\0")) {
+    throw new RangeError(`SpotPatch ${label} is invalid.`);
+  }
+  return normalized;
+}
+function normalizeProviderBaseURL(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new RangeError("SpotPatch AI provider baseURL must be a valid URL.");
+  }
+  const loopbackHosts = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+  const allowedProtocol = url.protocol === "https:" || url.protocol === "http:" && loopbackHosts.has(url.hostname);
+  if (!allowedProtocol || url.username.length > 0 || url.password.length > 0 || url.search.length > 0 || url.hash.length > 0) {
+    throw new RangeError("SpotPatch AI provider baseURL violates URL policy.");
+  }
+  url.pathname = url.pathname.replace(/\/{2,}/g, "/").replace(/\/$/, "");
+  return url.toString().replace(/\/$/, "");
+}
+function resolveLimits(limits) {
+  const resolved = Object.freeze({
+    maxTurns: limits?.maxTurns ?? import_shared.DEFAULT_AGENT_LIMITS.maxTurns,
+    maxToolCalls: limits?.maxToolCalls ?? import_shared.DEFAULT_AGENT_LIMITS.maxToolCalls,
+    maxChangedFiles: limits?.maxChangedFiles ?? import_shared.DEFAULT_AGENT_LIMITS.maxChangedFiles,
+    maxDiffBytes: limits?.maxDiffBytes ?? import_shared.DEFAULT_AGENT_LIMITS.maxDiffBytes,
+    maxReadBytesPerFile: limits?.maxReadBytesPerFile ?? import_shared.DEFAULT_AGENT_LIMITS.maxReadBytesPerFile,
+    maxToolOutputCharacters: limits?.maxToolOutputCharacters ?? import_shared.DEFAULT_AGENT_LIMITS.maxToolOutputCharacters,
+    maxProviderResponseBytes: limits?.maxProviderResponseBytes ?? import_shared.DEFAULT_AGENT_LIMITS.maxProviderResponseBytes,
+    providerConnectTimeoutMs: limits?.providerConnectTimeoutMs ?? import_shared.DEFAULT_AGENT_LIMITS.providerConnectTimeoutMs,
+    providerFirstByteTimeoutMs: limits?.providerFirstByteTimeoutMs ?? import_shared.DEFAULT_AGENT_LIMITS.providerFirstByteTimeoutMs,
+    providerIdleTimeoutMs: limits?.providerIdleTimeoutMs ?? import_shared.DEFAULT_AGENT_LIMITS.providerIdleTimeoutMs,
+    checkTimeoutMs: limits?.checkTimeoutMs ?? import_shared.DEFAULT_AGENT_LIMITS.checkTimeoutMs,
+    jobTimeoutMs: limits?.jobTimeoutMs ?? import_shared.DEFAULT_AGENT_LIMITS.jobTimeoutMs
+  });
+  for (const [name, value] of Object.entries(resolved)) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new RangeError(`SpotPatch AI limit ${name} must be a positive integer.`);
+    }
+  }
+  return resolved;
+}
+function resolveModels(models) {
+  const entries = Object.entries(models);
+  if (entries.length === 0) {
+    throw new RangeError("SpotPatch AI provider must declare at least one model.");
+  }
+  return Object.freeze(
+    Object.fromEntries(
+      entries.map(([id, model]) => {
+        assertIdentifier(id, "model profile id");
+        return [
+          id,
+          Object.freeze({
+            id,
+            label: nonEmpty(model.label, "model label", 100),
+            model: nonEmpty(model.model, "provider model name")
+          })
+        ];
+      })
+    )
+  );
+}
+function resolveProviders(providers) {
+  const entries = Object.entries(providers);
+  if (entries.length === 0) {
+    throw new RangeError("SpotPatch AI must declare at least one provider.");
+  }
+  return Object.freeze(
+    Object.fromEntries(
+      entries.map(([id, provider]) => {
+        assertIdentifier(id, "provider profile id");
+        if (!ENV_NAME_PATTERN.test(provider.apiKeyEnv) || provider.apiKeyEnv.startsWith("VITE_")) {
+          throw new RangeError(
+            "SpotPatch AI apiKeyEnv must be an uppercase non-VITE environment name."
+          );
+        }
+        const models = resolveModels(provider.models);
+        if (!(provider.defaultModel in models)) {
+          throw new RangeError(
+            "SpotPatch AI provider defaultModel must reference a configured model."
+          );
+        }
+        return [
+          id,
+          Object.freeze({
+            id,
+            type: provider.type,
+            label: nonEmpty(provider.label, "provider label", 100),
+            protocol: provider.protocol,
+            baseURL: normalizeProviderBaseURL(provider.baseURL),
+            apiKeyEnv: provider.apiKeyEnv,
+            models,
+            defaultModel: provider.defaultModel
+          })
+        ];
+      })
+    )
+  );
+}
+function resolveChecks(checks, defaultTimeoutMs) {
+  return Object.freeze(
+    Object.fromEntries(
+      Object.entries(checks ?? {}).map(([id, check]) => {
+        assertIdentifier(id, "check id");
+        const timeoutMs = check.timeoutMs ?? defaultTimeoutMs;
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+          throw new RangeError("SpotPatch AI check timeout must be positive.");
+        }
+        const args = Object.freeze(
+          [...check.args ?? []].map(
+            (argument) => nonEmpty(argument, "check argument", 4096)
+          )
+        );
+        return [
+          id,
+          Object.freeze({
+            id,
+            label: nonEmpty(check.label, "check label", 100),
+            command: nonEmpty(check.command, "check command", 1024),
+            args,
+            required: check.required ?? true,
+            timeoutMs
+          })
+        ];
+      })
+    )
+  );
+}
+function resolveAiOptions(options) {
+  if (options === void 0 || options === false) {
+    return false;
+  }
+  const parsed = aiOptionsSchema.safeParse(options);
+  if (!parsed.success) {
+    throw new RangeError("SpotPatch AI configuration is invalid.");
+  }
+  const validated = parsed.data;
+  const limits = resolveLimits(validated.execution?.limits);
+  const checks = resolveChecks(validated.execution?.checks, limits.checkTimeoutMs);
+  const applyMode = validated.execution?.applyMode ?? "review";
+  if (applyMode === "auto" && !Object.values(checks).some((check) => check.required)) {
+    throw new RangeError("SpotPatch AI auto mode requires a required check.");
+  }
+  const providers = resolveProviders(validated.providers);
+  if (!(validated.defaultProvider in providers)) {
+    throw new RangeError(
+      "SpotPatch AI defaultProvider must reference a configured provider."
+    );
+  }
+  return Object.freeze({
+    providers,
+    defaultProvider: validated.defaultProvider,
+    execution: Object.freeze({
+      isolation: "git-worktree",
+      applyMode,
+      checks,
+      limits
+    })
+  });
+}
+function createRuntimeAiConfig(options) {
+  if (options === false) {
+    return Object.freeze({ enabled: false });
+  }
+  return Object.freeze({
+    enabled: true,
+    defaultProvider: options.defaultProvider,
+    applyMode: options.execution.applyMode,
+    providers: Object.freeze(
+      Object.values(options.providers).map(
+        (provider) => Object.freeze({
+          id: provider.id,
+          label: provider.label,
+          protocol: provider.protocol,
+          defaultModel: provider.defaultModel,
+          models: Object.freeze(
+            Object.values(provider.models).map(
+              (model) => Object.freeze({ id: model.id, label: model.label })
+            )
+          )
+        })
+      )
+    )
+  });
+}
+function assertPositiveBudget(budget) {
+  for (const [name, value] of Object.entries(budget)) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new RangeError(`SpotPatch budget ${name} must be a positive integer.`);
+    }
+  }
+}
+function resolveOptions(options = {}) {
+  const budget = Object.freeze({
+    ...DEFAULT_OPTIONS.budget,
+    ...options.budget
+  });
+  assertPositiveBudget(budget);
+  const maxTargets = options.maxTargets ?? DEFAULT_OPTIONS.maxTargets;
+  const locale = options.locale ?? DEFAULT_OPTIONS.locale;
+  if (!import_shared.SPOTPATCH_LOCALE_PREFERENCES.includes(locale)) {
+    throw new RangeError("SpotPatch locale must be auto, en-US, or zh-CN.");
+  }
+  if (!Number.isSafeInteger(maxTargets) || maxTargets < 1 || maxTargets > import_shared.MAX_ANNOTATION_TARGETS) {
+    throw new RangeError(
+      `SpotPatch maxTargets must be an integer between 1 and ${String(import_shared.MAX_ANNOTATION_TARGETS)}.`
+    );
+  }
+  const resolved = {
+    enabled: options.enabled ?? DEFAULT_OPTIONS.enabled,
+    include: Object.freeze([...options.include ?? DEFAULT_OPTIONS.include]),
+    exclude: Object.freeze([...options.exclude ?? DEFAULT_OPTIONS.exclude]),
+    editor: options.editor ?? DEFAULT_OPTIONS.editor,
+    redact: options.redact ?? DEFAULT_OPTIONS.redact,
+    budget,
+    shortcut: options.shortcut ?? DEFAULT_OPTIONS.shortcut,
+    allowLan: options.allowLan ?? DEFAULT_OPTIONS.allowLan,
+    debug: options.debug ?? DEFAULT_OPTIONS.debug,
+    locale,
+    maxTargets,
+    ai: resolveAiOptions(options.ai)
+  };
+  if (resolved.shortcut.trim().length === 0) {
+    throw new RangeError("SpotPatch shortcut cannot be empty.");
+  }
+  return Object.freeze(resolved);
+}
+
+// src/registry/source-registry.ts
+var import_node_path = __toESM(require("path"), 1);
+
+// src/registry/source-id.ts
+var import_node_crypto = require("crypto");
+var SOURCE_ID_BYTES = 8;
+var createRandomSourceId = () => (0, import_node_crypto.randomBytes)(SOURCE_ID_BYTES).toString("base64url");
+
+// src/registry/source-registry.ts
+function normalizeAbsolutePath(absolutePath) {
+  return import_node_path.default.normalize(import_node_path.default.resolve(absolutePath));
+}
+function createSourceRegistry(options = {}) {
+  const createId = options.createId ?? createRandomSourceId;
+  const pathToId = /* @__PURE__ */ new Map();
+  const idToPath = /* @__PURE__ */ new Map();
+  return Object.freeze({
+    register(absolutePath) {
+      const normalizedPath = normalizeAbsolutePath(absolutePath);
+      const existingId = pathToId.get(normalizedPath);
+      if (existingId !== void 0) {
+        return existingId;
+      }
+      let fileId = createId();
+      while (idToPath.has(fileId)) {
+        fileId = createId();
+      }
+      pathToId.set(normalizedPath, fileId);
+      idToPath.set(fileId, normalizedPath);
+      return fileId;
+    },
+    resolve(fileId) {
+      return idToPath.get(fileId);
+    },
+    clear() {
+      pathToId.clear();
+      idToPath.clear();
+    }
+  });
+}
+
+// src/runtime/runtime-injection-plugin.ts
+var import_node_module = require("module");
+var import_node_fs = require("fs");
+var import_node_path2 = __toESM(require("path"), 1);
+
+// package.json
+var package_default = {
+  name: "@spotpatch/vite",
+  version: "1.0.0",
+  description: "Vite development plugin for SpotPatch.",
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/huanglvjing/spotpatch.git",
+    directory: "packages/vite"
+  },
+  homepage: "https://github.com/huanglvjing/spotpatch#readme",
+  bugs: {
+    url: "https://github.com/huanglvjing/spotpatch/issues"
+  },
+  keywords: [
+    "spotpatch",
+    "vite",
+    "react",
+    "developer-tools",
+    "ai-agent"
+  ],
+  type: "module",
+  sideEffects: false,
+  engines: {
+    node: ">=20.19.0"
+  },
+  files: [
+    "dist"
+  ],
+  main: "./dist/index.cjs",
+  module: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      import: {
+        types: "./dist/index.d.ts",
+        default: "./dist/index.js"
+      },
+      require: {
+        types: "./dist/index.d.cts",
+        default: "./dist/index.cjs"
+      }
+    }
+  },
+  scripts: {
+    build: "tsup src/index.ts --format esm,cjs --dts --sourcemap --clean && tsup --config tsup.runtime-client.config.ts && tsup --config tsup.runtime-react-adapter.config.ts",
+    clean: `node --input-type=module -e "import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true })"`,
+    typecheck: "tsc --noEmit -p tsconfig.json"
+  },
+  dependencies: {
+    "@rollup/pluginutils": "5.4.0",
+    "@spotpatch/agent": "workspace:^",
+    "@spotpatch/react-adapter": "workspace:^",
+    "@spotpatch/runtime": "workspace:^",
+    "@spotpatch/shared": "workspace:^",
+    "launch-editor": "2.14.1",
+    "magic-string": "1.1.0",
+    "oxc-parser": "0.143.0",
+    zod: "4.4.3"
+  },
+  peerDependencies: {
+    vite: "^5.0.0 || ^6.0.0 || ^7.0.0"
+  },
+  publishConfig: {
+    access: "public",
+    registry: "https://registry.npmjs.org/"
+  }
+};
+
+// src/runtime/runtime-injection-plugin.ts
+var import_vite = require("vite");
+var SPOTPATCH_CLIENT_MODULE_ID = "virtual:spotpatch/client";
+var RESOLVED_SPOTPATCH_CLIENT_MODULE_ID = `\0${SPOTPATCH_CLIENT_MODULE_ID}`;
+var SPOTPATCH_REACT_ADAPTER_MODULE_ID = "virtual:spotpatch/react-adapter";
+var RESOLVED_SPOTPATCH_REACT_ADAPTER_MODULE_ID = `\0${SPOTPATCH_REACT_ADAPTER_MODULE_ID}`;
+function readRuntimeBundle(root, fileName) {
+  const resolveFromProject = (0, import_node_module.createRequire)(import_node_path2.default.join(root, "package.json"));
+  const packageEntry = resolveFromProject.resolve("@spotpatch/vite");
+  const bundlePath = import_node_path2.default.join(import_node_path2.default.dirname(packageEntry), fileName);
+  return (0, import_node_fs.readFileSync)(bundlePath, "utf8");
+}
+function readConsumerViteVersion(root) {
+  try {
+    const resolveFromProject = (0, import_node_module.createRequire)(import_node_path2.default.join(root, "package.json"));
+    const manifestPath = resolveFromProject.resolve("vite/package.json");
+    const manifest = JSON.parse((0, import_node_fs.readFileSync)(manifestPath, "utf8"));
+    if (typeof manifest === "object" && manifest !== null && "version" in manifest && typeof manifest.version === "string") {
+      return manifest.version;
+    }
+  } catch {
+  }
+  return import_vite.version;
+}
+function createClientModule(input, clientBundle, viteVersion) {
+  const runtimeConfig = {
+    ai: createRuntimeAiConfig(input.options.ai),
+    budget: input.options.budget,
+    debug: input.options.debug,
+    locale: input.options.locale,
+    maxTargets: input.options.maxTargets,
+    redact: input.options.redact,
+    sessionToken: input.session.token,
+    shortcut: input.options.shortcut,
+    spotPatchVersion: package_default.version,
+    viteVersion
+  };
+  return [
+    `const __SPOTPATCH_RUNTIME_CONFIG__ = ${JSON.stringify(runtimeConfig)};`,
+    clientBundle
+  ].join("\n");
+}
+function createRuntimeInjectionPlugin(input) {
+  let root = process.cwd();
+  let clientBundle = input.clientBundle;
+  let viteVersion = import_vite.version;
+  return {
+    name: "spotpatch:runtime-injection",
+    apply: "serve",
+    enforce: "pre",
+    configResolved(config) {
+      root = import_node_path2.default.resolve(config.root);
+      viteVersion = readConsumerViteVersion(root);
+    },
+    resolveId(id, importer) {
+      if (id === SPOTPATCH_CLIENT_MODULE_ID) {
+        return RESOLVED_SPOTPATCH_CLIENT_MODULE_ID;
+      }
+      if (id === "@spotpatch/react-adapter" && importer === RESOLVED_SPOTPATCH_CLIENT_MODULE_ID) {
+        return RESOLVED_SPOTPATCH_REACT_ADAPTER_MODULE_ID;
+      }
+      return null;
+    },
+    load(id) {
+      if (id === RESOLVED_SPOTPATCH_CLIENT_MODULE_ID) {
+        clientBundle ??= readRuntimeBundle(root, "runtime-client.js");
+        return createClientModule(input, clientBundle, viteVersion);
+      }
+      if (id === RESOLVED_SPOTPATCH_REACT_ADAPTER_MODULE_ID) {
+        return input.reactAdapterBundle ?? readRuntimeBundle(root, "runtime-react-adapter.js");
+      }
+      return null;
+    },
+    transformIndexHtml() {
+      return [
+        {
+          tag: "script",
+          attrs: {
+            type: "module",
+            src: `/@id/${SPOTPATCH_CLIENT_MODULE_ID}`
+          },
+          injectTo: "head"
+        }
+      ];
+    }
+  };
+}
+
+// src/server/server-plugin.ts
+var import_node_path6 = __toESM(require("path"), 1);
+
+// src/agent/job-manager.ts
+var import_node_crypto2 = require("crypto");
+var import_agent = require("@spotpatch/agent");
+var import_shared2 = require("@spotpatch/shared");
+var MAX_RETAINED_JOBS = 32;
+var MAX_RETAINED_EVENTS = 512;
+var JOB_ID_PATTERN = /^[A-Za-z0-9_-]{22,128}$/;
+var ACTIVE_JOB_STATUSES = /* @__PURE__ */ new Set([
+  "queued",
+  "preparing",
+  "running",
+  "validating",
+  "awaiting-review",
+  "applying",
+  "cancelling",
+  "reverting"
+]);
+var CANCELLABLE_JOB_STATUSES = /* @__PURE__ */ new Set([
+  "queued",
+  "preparing",
+  "running",
+  "validating",
+  "awaiting-review"
+]);
+var PRUNABLE_JOB_STATUSES = /* @__PURE__ */ new Set([
+  "completed",
+  "cancelled",
+  "reverted",
+  "failed"
+]);
+var DEFAULT_DEPENDENCIES = Object.freeze({
+  applyChange: import_agent.applyPreparedAgentChange,
+  createJobId: () => (0, import_node_crypto2.randomBytes)(16).toString("base64url"),
+  executeChange: import_agent.executeAgentChange,
+  now: () => (/* @__PURE__ */ new Date()).toISOString(),
+  probeCapability: import_agent.probeProviderCapability,
+  resolveCredential: import_agent.resolveProviderCredential,
+  revertChange: import_agent.revertPreparedAgentChange
+});
+function normalizeError(error) {
+  return error instanceof import_shared2.SpotPatchError ? error : new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
+}
+function isActive(status) {
+  return ACTIVE_JOB_STATUSES.has(status);
+}
+function snapshot(job) {
+  const base = {
+    jobId: job.id,
+    status: job.status,
+    providerProfileId: job.provider.id,
+    providerLabel: job.provider.label,
+    modelProfileId: job.model.id,
+    modelLabel: job.model.label,
+    phaseMessage: job.phaseMessage,
+    createdAt: job.createdAt,
+    updatedAt: job.updatedAt,
+    canCancel: CANCELLABLE_JOB_STATUSES.has(job.status),
+    canApply: job.status === "awaiting-review" && job.preparedChange?.validationPassed === true && job.result !== void 0 && job.result.diff.length > 0,
+    canRevert: job.status === "applied"
+  };
+  return Object.freeze(
+    job.errorCode === void 0 ? base : { ...base, errorCode: job.errorCode }
+  );
+}
+function capabilityCacheKey(provider, model) {
+  const configurationDigest = (0, import_node_crypto2.createHash)("sha256").update(provider.baseURL).update("\0").update(provider.protocol).digest("hex");
+  return `${provider.id}:${model.id}:${configurationDigest}`;
+}
+function freezeEvent(event) {
+  return Object.freeze(event);
+}
+function createAgentJobManager(options) {
+  const dependencies = Object.freeze({
+    ...DEFAULT_DEPENDENCIES,
+    ...options.dependencies
+  });
+  const jobs = /* @__PURE__ */ new Map();
+  const capabilityCache = /* @__PURE__ */ new Map();
+  const providerConsents = /* @__PURE__ */ new Set();
+  let closed = false;
+  const resolveSelection = (providerProfileId, modelProfileId) => {
+    const provider = options.ai.providers[providerProfileId];
+    if (provider === void 0) {
+      throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.PROVIDER_NOT_CONFIGURED);
+    }
+    const model = provider.models[modelProfileId];
+    if (model === void 0) {
+      throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.MODEL_NOT_ALLOWED);
+    }
+    const credential = dependencies.resolveCredential(
+      provider.apiKeyEnv,
+      options.environment
+    );
+    return Object.freeze({ credential, model, provider });
+  };
+  const requireJob = (jobId) => {
+    if (!JOB_ID_PATTERN.test(jobId)) {
+      throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.INVALID_REQUEST);
+    }
+    const job = jobs.get(jobId);
+    if (job === void 0) {
+      throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.INVALID_REQUEST);
+    }
+    return job;
+  };
+  const appendEvent = (job, event) => {
+    job.events.push(event);
+    if (job.events.length > MAX_RETAINED_EVENTS) {
+      job.events.splice(0, job.events.length - MAX_RETAINED_EVENTS);
+    }
+    for (const listener of job.listeners) {
+      listener(event);
+    }
+  };
+  const eventBase = (job) => {
+    job.sequence += 1;
+    return {
+      schemaVersion: 1,
+      sequence: job.sequence,
+      jobId: job.id,
+      status: job.status,
+      timestamp: dependencies.now()
+    };
+  };
+  const emitSnapshot = (job) => {
+    appendEvent(
+      job,
+      freezeEvent({
+        ...eventBase(job),
+        type: "snapshot",
+        data: Object.freeze({ snapshot: snapshot(job) })
+      })
+    );
+  };
+  const emitPhase = (job, message) => {
+    appendEvent(
+      job,
+      freezeEvent({
+        ...eventBase(job),
+        type: "phase",
+        data: Object.freeze({ message })
+      })
+    );
+  };
+  const emitError = (job, code) => {
+    appendEvent(
+      job,
+      freezeEvent({
+        ...eventBase(job),
+        type: "error",
+        data: Object.freeze({ code, message: "The Agent job failed." })
+      })
+    );
+  };
+  const transition = (job, status, phaseMessage, errorCode) => {
+    job.status = status;
+    job.phaseMessage = phaseMessage;
+    job.errorCode = errorCode;
+    job.updatedAt = dependencies.now();
+    emitSnapshot(job);
+    emitPhase(job, phaseMessage);
+  };
+  const probeResolved = async (selection, signal) => {
+    const key = capabilityCacheKey(selection.provider, selection.model);
+    const cached = capabilityCache.get(key);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const capability = await dependencies.probeCapability({
+      provider: selection.provider,
+      modelProfileId: selection.model.id,
+      limits: options.ai.execution.limits,
+      credential: selection.credential,
+      signal,
+      ...options.fetch === void 0 ? {} : { fetch: options.fetch }
+    });
+    if (capability.state !== "agent-ready") {
+      throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED);
+    }
+    capabilityCache.set(key, capability);
+    return capability;
+  };
+  const finishWithError = (job, error) => {
+    const normalized = normalizeError(error);
+    const cancelled = job.controller.signal.aborted || normalized.code === import_shared2.ERROR_CODES.AGENT_CANCELLED;
+    transition(
+      job,
+      cancelled ? "cancelled" : "failed",
+      cancelled ? "Agent job cancelled." : "Agent job failed.",
+      cancelled ? import_shared2.ERROR_CODES.AGENT_CANCELLED : normalized.code
+    );
+    if (!cancelled) {
+      emitError(job, normalized.code);
+    }
+  };
+  const applyChange = async (job, preparedChange) => {
+    transition(job, "applying", "Applying validated changes to the project.");
+    try {
+      await dependencies.applyChange(preparedChange);
+      transition(job, "applied", "Changes were applied to local project files.");
+    } catch (error) {
+      const normalized = normalizeError(error);
+      transition(job, "failed", "Agent change could not be applied.", normalized.code);
+      emitError(job, normalized.code);
+      throw normalized;
+    }
+  };
+  const runJob = async (job) => {
+    try {
+      transition(job, "preparing", "Verifying provider and model capabilities.");
+      await probeResolved(
+        Object.freeze({
+          credential: job.credential,
+          model: job.model,
+          provider: job.provider
+        }),
+        job.controller.signal
+      );
+      const callbacks = {
+        onCheck(result) {
+          appendEvent(
+            job,
+            freezeEvent({
+              ...eventBase(job),
+              type: "check",
+              data: Object.freeze({ result })
+            })
+          );
+        },
+        onPhase(event) {
+          transition(job, event.phase, event.message);
+        },
+        onTool(event) {
+          appendEvent(
+            job,
+            freezeEvent({
+              ...eventBase(job),
+              type: "tool",
+              data: Object.freeze({ ...event })
+            })
+          );
+        }
+      };
+      const preparedChange = await dependencies.executeChange({
+        annotation: job.annotation,
+        callbacks,
+        credential: job.credential,
+        execution: options.ai.execution,
+        jobId: job.id,
+        model: job.model,
+        provider: job.provider,
+        root: options.root,
+        signal: job.controller.signal,
+        ...options.fetch === void 0 ? {} : { fetch: options.fetch }
+      });
+      job.preparedChange = preparedChange;
+      job.result = preparedChange.result;
+      appendEvent(
+        job,
+        freezeEvent({
+          ...eventBase(job),
+          type: "result-ready",
+          data: Object.freeze({ hasResult: true })
+        })
+      );
+      if (!preparedChange.validationPassed) {
+        transition(
+          job,
+          "failed",
+          "Required validation checks failed.",
+          import_shared2.ERROR_CODES.VALIDATION_FAILED
+        );
+        emitError(job, import_shared2.ERROR_CODES.VALIDATION_FAILED);
+        return;
+      }
+      if (preparedChange.result.diff.length === 0) {
+        transition(job, "completed", "No source changes were proposed.");
+        return;
+      }
+      if (options.ai.execution.applyMode === "auto" && preparedChange.autoApplyEligible) {
+        try {
+          await applyChange(job, preparedChange);
+        } catch {
+        }
+        return;
+      }
+      transition(job, "awaiting-review", "Validated changes are ready for review.");
+    } catch (error) {
+      finishWithError(job, error);
+    }
+  };
+  const hasActiveJob = (excludedJobId) => [...jobs.values()].some((job) => job.id !== excludedJobId && isActive(job.status));
+  const pruneJobs = () => {
+    if (jobs.size < MAX_RETAINED_JOBS) {
+      return;
+    }
+    for (const [jobId, job] of jobs) {
+      if (PRUNABLE_JOB_STATUSES.has(job.status)) {
+        jobs.delete(jobId);
+      }
+      if (jobs.size < MAX_RETAINED_JOBS) {
+        return;
+      }
+    }
+  };
+  return Object.freeze({
+    async apply(jobId) {
+      const job = requireJob(jobId);
+      if (job.status !== "awaiting-review" || job.preparedChange === void 0 || !job.preparedChange.validationPassed || job.result?.diff.length === 0) {
+        throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.PATCH_REJECTED);
+      }
+      await applyChange(job, job.preparedChange);
+      return snapshot(job);
+    },
+    cancel(jobId) {
+      const job = requireJob(jobId);
+      if (!CANCELLABLE_JOB_STATUSES.has(job.status)) {
+        return snapshot(job);
+      }
+      if (job.status === "awaiting-review") {
+        job.preparedChange = void 0;
+        job.controller.abort("agent-review-cancelled");
+        transition(
+          job,
+          "cancelled",
+          "Agent review was closed without applying changes.",
+          import_shared2.ERROR_CODES.AGENT_CANCELLED
+        );
+        return snapshot(job);
+      }
+      transition(job, "cancelling", "Cancelling Agent job.");
+      job.controller.abort("agent-job-cancelled");
+      return snapshot(job);
+    },
+    async close() {
+      if (closed) {
+        return;
+      }
+      closed = true;
+      for (const job of jobs.values()) {
+        if (CANCELLABLE_JOB_STATUSES.has(job.status)) {
+          job.controller.abort("vite-server-closed");
+        }
+      }
+      await Promise.allSettled(
+        [...jobs.values()].map((job) => job.runPromise).filter((promise) => promise !== void 0)
+      );
+      capabilityCache.clear();
+      providerConsents.clear();
+      jobs.clear();
+    },
+    create(request) {
+      if (closed) {
+        throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.AI_DISABLED);
+      }
+      if (hasActiveJob()) {
+        throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.AGENT_BUSY);
+      }
+      pruneJobs();
+      if (jobs.size >= MAX_RETAINED_JOBS) {
+        throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.AGENT_BUSY);
+      }
+      const selection = resolveSelection(
+        request.providerProfileId,
+        request.modelProfileId
+      );
+      providerConsents.add(selection.provider.id);
+      const id = dependencies.createJobId();
+      if (!JOB_ID_PATTERN.test(id) || jobs.has(id)) {
+        throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.INTERNAL_ERROR);
+      }
+      const timestamp = dependencies.now();
+      const job = {
+        annotation: request.annotation,
+        controller: new AbortController(),
+        createdAt: timestamp,
+        credential: selection.credential,
+        errorCode: void 0,
+        events: [],
+        id,
+        listeners: /* @__PURE__ */ new Set(),
+        model: selection.model,
+        phaseMessage: "Agent job queued.",
+        preparedChange: void 0,
+        provider: selection.provider,
+        result: void 0,
+        runPromise: void 0,
+        sequence: 0,
+        status: "queued",
+        updatedAt: timestamp
+      };
+      jobs.set(id, job);
+      emitSnapshot(job);
+      emitPhase(job, job.phaseMessage);
+      job.runPromise = Promise.resolve().then(async () => runJob(job));
+      return snapshot(job);
+    },
+    events(jobId) {
+      return Object.freeze([...requireJob(jobId).events]);
+    },
+    async probe(request, signal) {
+      if (closed) {
+        throw new import_shared2.SpotPatchError(import_shared2.ERROR_CODES.AI_DISABLED);
+      }
+      return probeResolved(
+        resolveSelection(request.providerProfileId, request.modelProfileId),
+        signal
+      );
+    },
+    result(jobId) {
+      const job = requireJob(jobId);
+      const response = job.result === void 0 ? { snapshot: snapshot(job) } : { snapshot: snapshot(job), result: job.result };
+      return Object.freeze(response);
+    },
+    async revert(jobId) {
+      const job = requireJob(jobId);
+      if (job.status !== "applied" || job.preparedChange === void 0 || hasActiveJob(job.id)) {
+        throw new import_shared2.SpotPatchError(
+          hasActiveJob(job.id) ? import_shared2.ERROR_CODES.AGENT_BUSY : import_shared2.ERROR_CODES.APPLY_CONFLICT
+        );
+      }
+      transition(job, "reverting", "Reverting the applied Agent change.");
+      try {
+        await dependencies.revertChange(job.preparedChange);
+        transition(job, "reverted", "The Agent change was safely reverted.");
+      } catch (error) {
+        const normalized = normalizeError(error);
+        transition(
+          job,
+          "applied",
+          "Revert was rejected because project files changed.",
+          normalized.code
+        );
+        emitError(job, normalized.code);
+        throw normalized;
+      }
+      return snapshot(job);
+    },
+    subscribe(jobId, listener) {
+      const job = requireJob(jobId);
+      job.listeners.add(listener);
+      return () => {
+        job.listeners.delete(listener);
+      };
+    }
+  });
+}
+
+// src/server/middleware.ts
+var import_shared9 = require("@spotpatch/shared");
+
+// src/server/agent-http.ts
+var import_shared7 = require("@spotpatch/shared");
+
+// src/server/agent-request.ts
+var import_promises3 = require("fs/promises");
+var import_node_path5 = __toESM(require("path"), 1);
+var import_shared5 = require("@spotpatch/shared");
+
+// src/server/source-context.ts
+var import_promises2 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
+var import_shared4 = require("@spotpatch/shared");
+
+// src/server/extract-code-context.ts
+var import_oxc_parser = require("oxc-parser");
+function isComponentName(name) {
+  return /^[A-Z]/u.test(name);
+}
+function unwrapTypeExpression(expression) {
+  switch (expression.type) {
+    case "TSAsExpression":
+    case "TSSatisfiesExpression":
+    case "TSTypeAssertion":
+    case "TSNonNullExpression":
+    case "TSInstantiationExpression":
+      return unwrapTypeExpression(expression.expression);
+    default:
+      return expression;
+  }
+}
+function calleeName(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  if (unwrapped.type === "Identifier") {
+    return unwrapped.name;
+  }
+  if (unwrapped.type === "MemberExpression" && !unwrapped.computed) {
+    return unwrapped.property.type === "Identifier" ? unwrapped.property.name : void 0;
+  }
+  return void 0;
+}
+function isFunctionExpression(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  return unwrapped.type === "ArrowFunctionExpression" || unwrapped.type === "FunctionExpression";
+}
+function isSupportedComponentInitializer(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  if (isFunctionExpression(unwrapped)) {
+    return true;
+  }
+  if (unwrapped.type !== "CallExpression") {
+    return false;
+  }
+  const name = calleeName(unwrapped.callee);
+  if (name !== "memo" && name !== "forwardRef") {
+    return false;
+  }
+  const firstArgument = unwrapped.arguments[0];
+  return firstArgument !== void 0 && firstArgument.type !== "SpreadElement" && (isFunctionExpression(firstArgument) || isSupportedComponentInitializer(firstArgument));
+}
+function variableComponent(node) {
+  if (node.id.type !== "Identifier" || !isComponentName(node.id.name) || node.init === null || !isSupportedComponentInitializer(node.init)) {
+    return void 0;
+  }
+  return Object.freeze({ start: node.start, end: node.end, name: node.id.name });
+}
+function functionComponent(node) {
+  return node.id !== null && isComponentName(node.id.name) && node.body !== null ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
+}
+function isReactComponentSuperclass(expression) {
+  if (expression === null) {
+    return false;
+  }
+  const unwrapped = unwrapTypeExpression(expression);
+  if (unwrapped.type === "Identifier") {
+    return unwrapped.name === "Component" || unwrapped.name === "PureComponent";
+  }
+  return unwrapped.type === "MemberExpression" && !unwrapped.computed && unwrapped.object.type === "Identifier" && unwrapped.object.name === "React" && (unwrapped.property.name === "Component" || unwrapped.property.name === "PureComponent");
+}
+function classComponent(node) {
+  return node.id !== null && isComponentName(node.id.name) && isReactComponentSuperclass(node.superClass) ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
+}
+function selectedOffset(source, line, column) {
+  const lines = source.split(/\r?\n/u);
+  if (line < 1 || line > lines.length) {
+    return void 0;
+  }
+  const lineStart = lines.slice(0, line - 1).reduce((total, value) => total + value.length + 1, 0);
+  const lineLength = lines[line - 1]?.length ?? 0;
+  return lineStart + Math.min(Math.max(0, column - 1), lineLength);
+}
+function findComponentSpan(options) {
+  const offset = selectedOffset(options.source, options.line, options.column);
+  if (offset === void 0) {
+    return void 0;
+  }
+  let parseResult;
+  try {
+    parseResult = (0, import_oxc_parser.parseSync)(options.sourcePath, options.source, {
+      sourceType: "module"
+    });
+  } catch {
+    return void 0;
+  }
+  if (parseResult.errors.length > 0) {
+    return void 0;
+  }
+  const jsxNodes = [];
+  const components = [];
+  const visitor = new import_oxc_parser.Visitor({
+    JSXElement(node) {
+      jsxNodes.push(node);
+    },
+    JSXFragment(node) {
+      jsxNodes.push(node);
+    },
+    FunctionDeclaration(node) {
+      const candidate = functionComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    },
+    VariableDeclarator(node) {
+      const candidate = variableComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    },
+    ClassDeclaration(node) {
+      const candidate = classComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    }
+  });
+  visitor.visit(parseResult.program);
+  const selectedJsx = jsxNodes.filter((node) => node.start <= offset && node.end >= offset).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
+  if (selectedJsx === void 0) {
+    return void 0;
+  }
+  return components.filter(
+    (component) => component.start <= selectedJsx.start && component.end >= selectedJsx.end
+  ).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
+}
+function lineAtOffset(source, offset) {
+  let line = 1;
+  for (let index = 0; index < offset; index += 1) {
+    if (source[index] === "\n") {
+      line += 1;
+    }
+  }
+  return line;
+}
+function componentRange(source, component) {
+  return Object.freeze({
+    startLine: lineAtOffset(source, component.start),
+    endLine: lineAtOffset(source, Math.max(component.start, component.end - 1))
+  });
+}
+function truncateSelectedLine(line, column, maxCharacters) {
+  if (line.length <= maxCharacters) {
+    return line;
+  }
+  if (maxCharacters === 1) {
+    return "\u2026";
+  }
+  const contentCharacters = maxCharacters - 2;
+  const desiredStart = Math.max(0, column - 1 - Math.floor(contentCharacters / 2));
+  const start = Math.min(desiredStart, line.length - contentCharacters);
+  const end = start + contentCharacters;
+  return `${start > 0 ? "\u2026" : ""}${line.slice(start, end)}${end < line.length ? "\u2026" : ""}`.slice(
+    0,
+    maxCharacters
+  );
+}
+function boundedRange(lines, selectedLine, column, initialStart, initialEnd, maxCharacters) {
+  let startLine = initialStart;
+  let endLine = initialEnd;
+  let excerpt = lines.slice(startLine - 1, endLine).join("\n");
+  while (excerpt.length > maxCharacters && startLine < endLine) {
+    if (endLine - selectedLine >= selectedLine - startLine) {
+      endLine -= 1;
+    } else {
+      startLine += 1;
+    }
+    excerpt = lines.slice(startLine - 1, endLine).join("\n");
+  }
+  if (excerpt.length > maxCharacters) {
+    startLine = selectedLine;
+    endLine = selectedLine;
+    excerpt = truncateSelectedLine(
+      lines[selectedLine - 1] ?? "",
+      column,
+      maxCharacters
+    );
+  }
+  return Object.freeze({ startLine, endLine, excerpt });
+}
+function nearbyContext(options) {
+  const lines = options.source.split(/\r?\n/u);
+  const initialStart = Math.max(1, options.line - Math.floor(options.maxLines / 2));
+  const initialEnd = Math.min(lines.length, initialStart + options.maxLines - 1);
+  const startLine = Math.max(1, initialEnd - options.maxLines + 1);
+  const bounded = boundedRange(
+    lines,
+    options.line,
+    options.column,
+    startLine,
+    initialEnd,
+    options.maxCharacters
+  );
+  return Object.freeze({
+    relativePath: options.relativePath,
+    language: options.language,
+    startLine: bounded.startLine,
+    endLine: bounded.endLine,
+    excerpt: bounded.excerpt,
+    boundary: "nearby-lines"
+  });
+}
+function extractCodeContext(options) {
+  const component = findComponentSpan(options);
+  if (component !== void 0) {
+    const range = componentRange(options.source, component);
+    const lineCount = range.endLine - range.startLine + 1;
+    const excerpt = options.source.split(/\r?\n/u).slice(range.startLine - 1, range.endLine).join("\n");
+    if (lineCount <= options.maxLines && excerpt.length <= options.maxCharacters) {
+      return Object.freeze({
+        relativePath: options.relativePath,
+        language: options.language,
+        startLine: range.startLine,
+        endLine: range.endLine,
+        excerpt,
+        boundary: "component"
+      });
+    }
+  }
+  return nearbyContext(options);
+}
+
+// src/server/source-file.ts
+var import_promises = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+var import_shared3 = require("@spotpatch/shared");
+
+// src/server/constants.ts
+var MAX_REQUEST_BODY_BYTES = 32 * 1024;
+var MAX_AGENT_REQUEST_BODY_BYTES = 256 * 1024;
+var MAX_SOURCE_FILE_BYTES = 1024 * 1024;
+
+// src/server/source-file.ts
+var ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([".jsx", ".tsx"]);
+function isMissingFileError(error) {
+  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+async function assertInsideRoot(root, candidate) {
+  let realRoot;
+  let realCandidate;
+  try {
+    [realRoot, realCandidate] = await Promise.all([
+      (0, import_promises.realpath)(root),
+      (0, import_promises.realpath)(candidate)
+    ]);
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
+        cause: error
+      });
+    }
+    throw error;
+  }
+  const relative = import_node_path3.default.relative(realRoot, realCandidate);
+  const outside = relative.startsWith(`..${import_node_path3.default.sep}`) || relative === ".." || import_node_path3.default.isAbsolute(relative);
+  if (outside) {
+    throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_OUTSIDE_ROOT);
+  }
+  return realCandidate;
+}
+async function resolveSourceFile(options) {
+  const registeredPath = options.registry.resolve(options.fileId);
+  if (registeredPath === void 0) {
+    throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_NOT_FOUND);
+  }
+  const sourcePath = await assertInsideRoot(options.root, registeredPath);
+  if (!ALLOWED_EXTENSIONS.has(import_node_path3.default.extname(sourcePath).toLowerCase())) {
+    throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_NOT_FOUND);
+  }
+  let sourceStat;
+  try {
+    sourceStat = await (0, import_promises.stat)(sourcePath);
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
+        cause: error
+      });
+    }
+    throw error;
+  }
+  if (!sourceStat.isFile()) {
+    throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_NOT_FOUND);
+  }
+  if (sourceStat.size > MAX_SOURCE_FILE_BYTES) {
+    throw new import_shared3.SpotPatchError(import_shared3.ERROR_CODES.SOURCE_TOO_LARGE);
+  }
+  return sourcePath;
+}
+
+// src/server/source-context.ts
+function toDisplayPath(root, sourcePath) {
+  return import_node_path4.default.relative(root, sourcePath).split(import_node_path4.default.sep).join("/");
+}
+async function readSourceContext(options) {
+  const sourcePath = await resolveSourceFile({
+    fileId: options.request.fileId,
+    registry: options.registry,
+    root: options.root
+  });
+  let source;
+  try {
+    source = await (0, import_promises2.readFile)(sourcePath, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
+      throw new import_shared4.SpotPatchError(import_shared4.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
+        cause: error
+      });
+    }
+    throw error;
+  }
+  const lines = source.split(/\r?\n/);
+  if (options.request.line > lines.length) {
+    throw new import_shared4.SpotPatchError(import_shared4.ERROR_CODES.INVALID_REQUEST);
+  }
+  const extension = import_node_path4.default.extname(sourcePath).toLowerCase();
+  return extractCodeContext({
+    source,
+    sourcePath,
+    relativePath: toDisplayPath(await (0, import_promises2.realpath)(options.root), sourcePath),
+    language: extension === ".tsx" ? "tsx" : "jsx",
+    line: options.request.line,
+    column: options.request.column,
+    maxLines: Math.min(options.request.maxLines, options.maxLines),
+    maxCharacters: options.maxCharacters
+  });
+}
+
+// src/server/agent-request.ts
+function compactSourceRef(source) {
+  return Object.freeze({
+    origin: source.origin,
+    confidence: source.confidence,
+    ...source.fileId === void 0 ? {} : { fileId: source.fileId },
+    ...source.relativePath === void 0 ? {} : { relativePath: source.relativePath },
+    ...source.line === void 0 ? {} : { line: source.line },
+    ...source.column === void 0 ? {} : { column: source.column }
+  });
+}
+async function authorizeSourceRef(source, registry, root) {
+  const markerOrigin = source.origin === "jsx-host" || source.origin === "dom-ancestor";
+  if (markerOrigin && (source.fileId === void 0 || source.line === void 0 || source.column === void 0)) {
+    throw new import_shared5.SpotPatchError(import_shared5.ERROR_CODES.INVALID_REQUEST);
+  }
+  if (source.fileId === void 0) {
+    if (source.origin === "none" && source.relativePath !== void 0) {
+      throw new import_shared5.SpotPatchError(import_shared5.ERROR_CODES.INVALID_REQUEST);
+    }
+    return compactSourceRef(source);
+  }
+  const sourcePath = await resolveSourceFile({
+    fileId: source.fileId,
+    registry,
+    root
+  });
+  const relativePath = import_node_path5.default.relative(await (0, import_promises3.realpath)(root), sourcePath).split(import_node_path5.default.sep).join("/");
+  if (source.relativePath !== void 0 && source.relativePath !== relativePath) {
+    throw new import_shared5.SpotPatchError(import_shared5.ERROR_CODES.INVALID_REQUEST);
+  }
+  return Object.freeze({
+    ...compactSourceRef(source),
+    relativePath
+  });
+}
+function freezeMatchedRule(rule) {
+  return Object.freeze({
+    selector: rule.selector,
+    declarations: rule.declarations,
+    ...rule.source === void 0 ? {} : { source: rule.source },
+    ...rule.media === void 0 ? {} : { media: rule.media }
+  });
+}
+function targetIdentity(target) {
+  const source = target.source;
+  if (source.fileId !== void 0 && source.line !== void 0 && source.column !== void 0) {
+    return `source:${source.fileId}:${String(source.line)}:${String(source.column)}`;
+  }
+  return [
+    "element",
+    source.origin,
+    source.relativePath ?? "",
+    target.element.selector,
+    target.element.sanitizedHtml
+  ].join("\0");
+}
+async function authorizeTarget(target, input) {
+  const source = await authorizeSourceRef(target.source, input.registry, input.root);
+  const reactSourceInput = target.react.source;
+  const reactSource = reactSourceInput === void 0 ? void 0 : await authorizeSourceRef(reactSourceInput, input.registry, input.root);
+  const marker = source.fileId === void 0 || source.line === void 0 || source.column === void 0 ? void 0 : Object.freeze({
+    fileId: source.fileId,
+    line: source.line,
+    column: source.column,
+    maxLines: input.options.budget.maxCodeLines
+  });
+  if (marker === void 0 && target.code !== void 0) {
+    throw new import_shared5.SpotPatchError(import_shared5.ERROR_CODES.INVALID_REQUEST);
+  }
+  const code = marker === void 0 ? void 0 : await readSourceContext({
+    request: marker,
+    registry: input.registry,
+    root: input.root,
+    maxCharacters: input.options.budget.codeCharacters,
+    maxLines: input.options.budget.maxCodeLines
+  });
+  if (target.code !== void 0 && target.code.relativePath !== code?.relativePath) {
+    throw new import_shared5.SpotPatchError(import_shared5.ERROR_CODES.INVALID_REQUEST);
+  }
+  return Object.freeze({
+    instruction: target.instruction,
+    source,
+    react: Object.freeze({
+      supported: target.react.supported,
+      ...target.react.version === void 0 ? {} : { version: target.react.version },
+      ...target.react.componentName === void 0 ? {} : { componentName: target.react.componentName },
+      componentStack: Object.freeze([...target.react.componentStack]),
+      ...reactSource === void 0 ? {} : { source: reactSource }
+    }),
+    element: Object.freeze({
+      tagName: target.element.tagName,
+      selector: target.element.selector,
+      sanitizedHtml: target.element.sanitizedHtml,
+      ...target.element.textPreview === void 0 ? {} : { textPreview: target.element.textPreview },
+      ...target.element.role === void 0 ? {} : { role: target.element.role },
+      rect: Object.freeze({ ...target.element.rect })
+    }),
+    styles: Object.freeze({
+      classNames: Object.freeze([...target.styles.classNames]),
+      ...target.styles.inlineStyle === void 0 ? {} : { inlineStyle: target.styles.inlineStyle },
+      matchedRules: Object.freeze(target.styles.matchedRules.map(freezeMatchedRule)),
+      computed: Object.freeze({ ...target.styles.computed }),
+      warnings: Object.freeze([...target.styles.warnings])
+    }),
+    ...code === void 0 ? {} : { code: Object.freeze({ ...code }) },
+    warnings: Object.freeze([...target.warnings])
+  });
+}
+async function authorizeAgentJobRequest(input) {
+  const requestedTargets = input.request.annotation.targets;
+  if (requestedTargets.length > input.options.maxTargets) {
+    throw new import_shared5.SpotPatchError(import_shared5.ERROR_CODES.INVALID_REQUEST);
+  }
+  const identities = requestedTargets.map(targetIdentity);
+  if (new Set(identities).size !== identities.length) {
+    throw new import_shared5.SpotPatchError(import_shared5.ERROR_CODES.INVALID_REQUEST);
+  }
+  const targets = Object.freeze(
+    await Promise.all(requestedTargets.map((target) => authorizeTarget(target, input)))
+  );
+  const annotation = Object.freeze({
+    schemaVersion: 3,
+    id: input.request.annotation.id,
+    locale: input.request.annotation.locale,
+    page: Object.freeze({ ...input.request.annotation.page }),
+    targets,
+    createdAt: input.request.annotation.createdAt
+  });
+  return Object.freeze({
+    annotation,
+    providerProfileId: input.request.providerProfileId,
+    modelProfileId: input.request.modelProfileId,
+    providerDataConsent: true
+  });
+}
+
+// src/server/request-body.ts
+var import_shared6 = require("@spotpatch/shared");
+function isJsonContentType(value) {
+  return value?.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
+}
+async function readJsonRequestBody(request, maximumBytes = MAX_REQUEST_BODY_BYTES) {
+  if (!isJsonContentType(request.headers["content-type"])) {
+    throw new import_shared6.SpotPatchError(import_shared6.ERROR_CODES.INVALID_REQUEST);
+  }
+  const declaredLength = Number(request.headers["content-length"]);
+  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {
+    throw new import_shared6.SpotPatchError(import_shared6.ERROR_CODES.INVALID_REQUEST);
+  }
+  const chunks = [];
+  let byteLength = 0;
+  let exceededLimit = false;
+  for await (const rawChunk of request) {
+    const chunk = rawChunk;
+    if (typeof chunk !== "string" && !(chunk instanceof Uint8Array)) {
+      throw new import_shared6.SpotPatchError(import_shared6.ERROR_CODES.INVALID_REQUEST);
+    }
+    const buffer = Buffer.from(chunk);
+    byteLength += buffer.byteLength;
+    if (byteLength > maximumBytes) {
+      exceededLimit = true;
+      continue;
+    }
+    chunks.push(buffer);
+  }
+  if (exceededLimit || byteLength === 0) {
+    throw new import_shared6.SpotPatchError(import_shared6.ERROR_CODES.INVALID_REQUEST);
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch (error) {
+    throw new import_shared6.SpotPatchError(import_shared6.ERROR_CODES.INVALID_REQUEST, void 0, {
+      cause: error
+    });
+  }
+}
+
+// src/server/agent-http.ts
+var AGENT_JOB_ID_PATTERN = /^[A-Za-z0-9_-]{22,128}$/;
+var AGENT_JOB_ACTIONS = /* @__PURE__ */ new Set([
+  "events",
+  "result",
+  "cancel",
+  "apply",
+  "revert"
+]);
+var EVENT_STREAM_END_STATUSES = /* @__PURE__ */ new Set([
+  "awaiting-review",
+  "applied",
+  "completed",
+  "cancelled",
+  "reverted",
+  "failed"
+]);
+function matchAgentRequestPath(path10) {
+  if (path10 === import_shared7.SPOTPATCH_ENDPOINTS.agentCapability) {
+    return Object.freeze({ kind: "capability" });
+  }
+  if (path10 === import_shared7.SPOTPATCH_ENDPOINTS.agentJobs) {
+    return Object.freeze({ kind: "create-job" });
+  }
+  const prefix = `${import_shared7.SPOTPATCH_ENDPOINTS.agentJobs}/`;
+  if (!path10.startsWith(prefix)) {
+    return void 0;
+  }
+  const segments = path10.slice(prefix.length).split("/");
+  const jobId = segments[0];
+  const action = segments[1];
+  if (segments.length !== 2 || jobId === void 0 || !AGENT_JOB_ID_PATTERN.test(jobId) || action === void 0 || !AGENT_JOB_ACTIONS.has(action)) {
+    return void 0;
+  }
+  return Object.freeze({
+    kind: "job-action",
+    action,
+    jobId
+  });
+}
+function requireAgentManager(options) {
+  if (options.agentManager === void 0 || options.options.ai === false) {
+    throw new import_shared7.SpotPatchError(import_shared7.ERROR_CODES.AI_DISABLED);
+  }
+  return options.agentManager;
+}
+function writeNdjsonEvent(response, event) {
+  response.write(`${JSON.stringify(event)}
+`);
+}
+function streamAgentJobEvents(response, manager, jobId) {
+  const events = manager.events(jobId);
+  const current = manager.result(jobId).snapshot;
+  response.statusCode = 200;
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
+  response.setHeader("X-Content-Type-Options", "nosniff");
+  for (const event of events) {
+    writeNdjsonEvent(response, event);
+  }
+  if (EVENT_STREAM_END_STATUSES.has(current.status)) {
+    response.end();
+    return;
+  }
+  let settled = false;
+  let unsubscribe = () => void 0;
+  const heartbeat = setInterval(() => {
+    if (!settled) {
+      response.write("\n");
+    }
+  }, 15e3);
+  heartbeat.unref();
+  const cleanup = () => {
+    if (settled) {
+      return;
+    }
+    settled = true;
+    clearInterval(heartbeat);
+    unsubscribe();
+  };
+  unsubscribe = manager.subscribe(jobId, (event) => {
+    if (settled) {
+      return;
+    }
+    writeNdjsonEvent(response, event);
+    if (event.type === "snapshot" && EVENT_STREAM_END_STATUSES.has(event.data.snapshot.status)) {
+      cleanup();
+      response.end();
+    }
+  });
+  response.once("close", cleanup);
+  response.once("error", cleanup);
+}
+async function handleCapability(request, response, options, writeSuccess) {
+  if (request.method !== "POST") {
+    throw new import_shared7.SpotPatchError(import_shared7.ERROR_CODES.INVALID_REQUEST);
+  }
+  const parsed = import_shared7.agentCapabilityRequestSchema.safeParse(
+    await readJsonRequestBody(request)
+  );
+  if (!parsed.success) {
+    throw new import_shared7.SpotPatchError(import_shared7.ERROR_CODES.INVALID_REQUEST);
+  }
+  const controller = new AbortController();
+  const abort = () => {
+    controller.abort("agent-capability-client-disconnected");
+  };
+  response.once("close", abort);
+  try {
+    const data = await requireAgentManager(options).probe(
+      parsed.data,
+      controller.signal
+    );
+    writeSuccess(response, 200, data);
+  } finally {
+    response.removeListener("close", abort);
+  }
+}
+async function handleCreateJob(request, response, options, writeSuccess) {
+  if (request.method !== "POST") {
+    throw new import_shared7.SpotPatchError(import_shared7.ERROR_CODES.INVALID_REQUEST);
+  }
+  const parsed = import_shared7.agentJobCreateRequestSchema.safeParse(
+    await readJsonRequestBody(request, MAX_AGENT_REQUEST_BODY_BYTES)
+  );
+  if (!parsed.success) {
+    throw new import_shared7.SpotPatchError(import_shared7.ERROR_CODES.INVALID_REQUEST);
+  }
+  const authorizedRequest = await authorizeAgentJobRequest({
+    request: parsed.data,
+    options: options.options,
+    registry: options.registry,
+    root: options.root
+  });
+  const data = requireAgentManager(options).create(authorizedRequest);
+  writeSuccess(response, 202, data);
+}
+async function handleJobAction(request, response, options, route, writeSuccess) {
+  const manager = requireAgentManager(options);
+  if (request.method !== "POST") {
+    throw new import_shared7.SpotPatchError(import_shared7.ERROR_CODES.INVALID_REQUEST);
+  }
+  const parsed = import_shared7.agentJobActionRequestSchema.safeParse(
+    await readJsonRequestBody(request)
+  );
+  if (!parsed.success) {
+    throw new import_shared7.SpotPatchError(import_shared7.ERROR_CODES.INVALID_REQUEST);
+  }
+  if (route.action === "events") {
+    streamAgentJobEvents(response, manager, route.jobId);
+    return;
+  }
+  if (route.action === "result") {
+    writeSuccess(response, 200, manager.result(route.jobId));
+    return;
+  }
+  const data = route.action === "cancel" ? manager.cancel(route.jobId) : route.action === "apply" ? await manager.apply(route.jobId) : await manager.revert(route.jobId);
+  writeSuccess(response, 200, data);
+}
+async function handleAgentRequest(request, response, options, route, writeSuccess) {
+  if (route.kind === "capability") {
+    await handleCapability(request, response, options, writeSuccess);
+    return;
+  }
+  if (route.kind === "create-job") {
+    await handleCreateJob(request, response, options, writeSuccess);
+    return;
+  }
+  await handleJobAction(request, response, options, route, writeSuccess);
+}
+
+// src/server/editor.ts
+var import_launch_editor = __toESM(require("launch-editor"), 1);
+var launchVSCode = (target, onError) => {
+  (0, import_launch_editor.default)(target, "code", onError);
+};
+
+// src/server/request-security.ts
+var import_node_crypto3 = require("crypto");
+var import_node_net = require("net");
+var import_shared8 = require("@spotpatch/shared");
+function getSingleHeader(request, name) {
+  const value = request.headers[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+function tokensMatch(actual, expected) {
+  if (actual === void 0) {
+    return false;
+  }
+  const actualBytes = Buffer.from(actual);
+  const expectedBytes = Buffer.from(expected);
+  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto3.timingSafeEqual)(actualBytes, expectedBytes);
+}
+function isLoopbackHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (normalized === "localhost" || normalized.endsWith(".localhost")) {
+    return true;
+  }
+  if (normalized === "::1") {
+    return true;
+  }
+  if ((0, import_node_net.isIP)(normalized) === 4) {
+    return normalized.split(".")[0] === "127";
+  }
+  return normalized.startsWith("::ffff:127.");
+}
+function parseHost(value) {
+  try {
+    return new URL(`http://${value}`);
+  } catch {
+    return void 0;
+  }
+}
+function parseOrigin(value) {
+  try {
+    const origin = new URL(value);
+    if (origin.protocol !== "http:" && origin.protocol !== "https:" || origin.username.length > 0 || origin.password.length > 0 || origin.origin === "null") {
+      return void 0;
+    }
+    return origin;
+  } catch {
+    return void 0;
+  }
+}
+function assertRequestAuthorized(request, options) {
+  const actualToken = getSingleHeader(request, import_shared8.SPOTPATCH_TOKEN_HEADER);
+  if (!tokensMatch(actualToken, options.sessionToken)) {
+    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.INVALID_TOKEN);
+  }
+  const hostHeader = getSingleHeader(request, "host");
+  const originHeader = getSingleHeader(request, "origin");
+  const host = hostHeader === void 0 ? void 0 : parseHost(hostHeader);
+  const origin = originHeader === void 0 ? void 0 : parseOrigin(originHeader);
+  if (host === void 0 || origin === void 0) {
+    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+  }
+  const hostIsLoopback = isLoopbackHostname(host.hostname);
+  const originIsLoopback = isLoopbackHostname(origin.hostname);
+  if (!options.allowLan) {
+    if (!hostIsLoopback || !originIsLoopback) {
+      throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+    }
+    return;
+  }
+  if (!originIsLoopback && origin.host.toLowerCase() !== host.host.toLowerCase()) {
+    throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+  }
+}
+
+// src/server/middleware.ts
+var STATUS_BY_ERROR = Object.freeze({
+  [import_shared9.ERROR_CODES.INVALID_REQUEST]: 400,
+  [import_shared9.ERROR_CODES.INVALID_TOKEN]: 401,
+  [import_shared9.ERROR_CODES.ORIGIN_NOT_ALLOWED]: 403,
+  [import_shared9.ERROR_CODES.SOURCE_NOT_FOUND]: 404,
+  [import_shared9.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: 403,
+  [import_shared9.ERROR_CODES.SOURCE_TOO_LARGE]: 413,
+  [import_shared9.ERROR_CODES.EDITOR_OPEN_FAILED]: 500,
+  [import_shared9.ERROR_CODES.AI_DISABLED]: 404,
+  [import_shared9.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: 503,
+  [import_shared9.ERROR_CODES.PROVIDER_AUTH_FAILED]: 502,
+  [import_shared9.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
+  [import_shared9.ERROR_CODES.MODEL_NOT_ALLOWED]: 400,
+  [import_shared9.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
+  [import_shared9.ERROR_CODES.PROVIDER_RATE_LIMITED]: 429,
+  [import_shared9.ERROR_CODES.AGENT_BUSY]: 409,
+  [import_shared9.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: 413,
+  [import_shared9.ERROR_CODES.AGENT_CANCELLED]: 409,
+  [import_shared9.ERROR_CODES.WORKTREE_DIRTY]: 409,
+  [import_shared9.ERROR_CODES.TOOL_DENIED]: 403,
+  [import_shared9.ERROR_CODES.PATCH_REJECTED]: 422,
+  [import_shared9.ERROR_CODES.VALIDATION_FAILED]: 422,
+  [import_shared9.ERROR_CODES.APPLY_CONFLICT]: 409,
+  [import_shared9.ERROR_CODES.INTERNAL_ERROR]: 500
+});
+var PUBLIC_MESSAGES = Object.freeze({
+  [import_shared9.ERROR_CODES.INVALID_REQUEST]: "The request is invalid.",
+  [import_shared9.ERROR_CODES.INVALID_TOKEN]: "The session token is invalid.",
+  [import_shared9.ERROR_CODES.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
+  [import_shared9.ERROR_CODES.SOURCE_NOT_FOUND]: "The source file is unavailable.",
+  [import_shared9.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
+  [import_shared9.ERROR_CODES.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
+  [import_shared9.ERROR_CODES.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
+  [import_shared9.ERROR_CODES.AI_DISABLED]: "AI execution is not enabled.",
+  [import_shared9.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
+  [import_shared9.ERROR_CODES.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
+  [import_shared9.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
+  [import_shared9.ERROR_CODES.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
+  [import_shared9.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
+  [import_shared9.ERROR_CODES.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
+  [import_shared9.ERROR_CODES.AGENT_BUSY]: "Another Agent job is already running.",
+  [import_shared9.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
+  [import_shared9.ERROR_CODES.AGENT_CANCELLED]: "The Agent job was cancelled.",
+  [import_shared9.ERROR_CODES.WORKTREE_DIRTY]: "The project worktree must be clean.",
+  [import_shared9.ERROR_CODES.TOOL_DENIED]: "The Agent tool request was denied.",
+  [import_shared9.ERROR_CODES.PATCH_REJECTED]: "The proposed patch was rejected.",
+  [import_shared9.ERROR_CODES.VALIDATION_FAILED]: "The proposed change failed validation.",
+  [import_shared9.ERROR_CODES.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
+  [import_shared9.ERROR_CODES.INTERNAL_ERROR]: "The request could not be completed."
+});
+function writeJson(response, status, payload) {
+  response.statusCode = status;
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.end(JSON.stringify(payload));
+}
+function asSpotPatchError(error) {
+  return error instanceof import_shared9.SpotPatchError ? error : new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
+}
+function writeError(response, error, logger) {
+  const normalized = asSpotPatchError(error);
+  if (normalized.code === import_shared9.ERROR_CODES.INTERNAL_ERROR) {
+    logger?.warn("[spotpatch:server] Internal request failure.");
+  }
+  writeJson(response, STATUS_BY_ERROR[normalized.code], {
+    ok: false,
+    error: {
+      code: normalized.code,
+      message: PUBLIC_MESSAGES[normalized.code]
+    }
+  });
+}
+function requestPath(request) {
+  try {
+    return new URL(request.url ?? "/", "http://spotpatch.invalid").pathname;
+  } catch {
+    return "";
+  }
+}
+async function handleSourceContext(request, options) {
+  const parsed = import_shared9.sourceContextRequestSchema.safeParse(
+    await readJsonRequestBody(request)
+  );
+  if (!parsed.success) {
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INVALID_REQUEST);
+  }
+  return readSourceContext({
+    request: parsed.data,
+    registry: options.registry,
+    root: options.root,
+    maxCharacters: options.options.budget.codeCharacters,
+    maxLines: options.options.budget.maxCodeLines
+  });
+}
+async function handleOpenEditor(request, options) {
+  const parsed = import_shared9.openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
+  if (!parsed.success) {
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INVALID_REQUEST);
+  }
+  const body = parsed.data;
+  const sourcePath = await resolveSourceFile({
+    fileId: body.fileId,
+    registry: options.registry,
+    root: options.root
+  });
+  const target = `${sourcePath}:${String(body.line)}:${String(body.column)}`;
+  const editorLauncher = options.editorLauncher ?? launchVSCode;
+  try {
+    editorLauncher(target, () => {
+      options.logger?.warn("[spotpatch:server] VS Code rejected an editor request.");
+    });
+  } catch (error) {
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.EDITOR_OPEN_FAILED, void 0, {
+      cause: error
+    });
+  }
+  return Object.freeze({});
+}
+function createSpotPatchMiddleware(options) {
+  return (request, response, next) => {
+    const path10 = requestPath(request);
+    const agentRoute = matchAgentRequestPath(path10);
+    if (path10 !== import_shared9.SPOTPATCH_ENDPOINTS.sourceContext && path10 !== import_shared9.SPOTPATCH_ENDPOINTS.openEditor && agentRoute === void 0 && !path10.startsWith(`${import_shared9.SPOTPATCH_API_BASE}/`)) {
+      next();
+      return;
+    }
+    const handle = async () => {
+      assertRequestAuthorized(request, {
+        allowLan: options.options.allowLan,
+        sessionToken: options.session.token
+      });
+      if (path10 === import_shared9.SPOTPATCH_ENDPOINTS.sourceContext) {
+        if (request.method !== "POST") {
+          throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INVALID_REQUEST);
+        }
+        const data = await handleSourceContext(request, options);
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
+      if (path10 === import_shared9.SPOTPATCH_ENDPOINTS.openEditor) {
+        if (request.method !== "POST") {
+          throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INVALID_REQUEST);
+        }
+        const data = await handleOpenEditor(request, options);
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
+      if (agentRoute === void 0) {
+        throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.INVALID_REQUEST);
+      }
+      await handleAgentRequest(
+        request,
+        response,
+        options,
+        agentRoute,
+        (target, status, data) => {
+          writeJson(target, status, { ok: true, data });
+        }
+      );
+    };
+    void handle().catch((error) => {
+      writeError(response, error, options.logger);
+    });
+  };
+}
+
+// src/server/server-plugin.ts
+function createServerPlugin(input) {
+  let agentManager;
+  let config;
+  const closeResources = async () => {
+    input.registry.clear();
+    await agentManager?.close();
+    agentManager = void 0;
+  };
+  return {
+    name: "spotpatch:server",
+    apply: "serve",
+    enforce: "pre",
+    configResolved(resolvedConfig) {
+      config = resolvedConfig;
+    },
+    configureServer(server) {
+      if (config === void 0) {
+        throw new Error("SpotPatch server initialized before Vite config resolution.");
+      }
+      const root = import_node_path6.default.resolve(config.root);
+      agentManager = input.options.ai === false ? void 0 : createAgentJobManager({ ai: input.options.ai, root });
+      server.middlewares.use(
+        createSpotPatchMiddleware({
+          ...agentManager === void 0 ? {} : { agentManager },
+          options: input.options,
+          registry: input.registry,
+          root,
+          session: input.session,
+          logger: config.logger
+        })
+      );
+      server.httpServer?.once("close", () => {
+        void closeResources();
+      });
+      config.logger.info(
+        `[spotpatch:vite] Ready. Toggle picker with ${input.options.shortcut}.`
+      );
+    },
+    async closeBundle() {
+      await closeResources();
+    }
+  };
+}
+
+// src/session/session.ts
+var import_node_crypto4 = require("crypto");
+function createSession() {
+  return Object.freeze({
+    token: (0, import_node_crypto4.randomBytes)(16).toString("base64url")
+  });
+}
+
+// src/transform/transform-plugin.ts
+var import_node_crypto5 = require("crypto");
+var import_node_path9 = __toESM(require("path"), 1);
+
+// src/transform/inject-source-markers.ts
+var import_node_path7 = __toESM(require("path"), 1);
+var import_shared11 = require("@spotpatch/shared");
+var import_magic_string = __toESM(require("magic-string"), 1);
+var import_oxc_parser2 = require("oxc-parser");
+
+// src/transform/intrinsic-element.ts
+var import_shared10 = require("@spotpatch/shared");
+function isIntrinsicOpeningElement(node) {
+  if (node.name.type !== "JSXIdentifier") {
+    return false;
+  }
+  const { name } = node.name;
+  const firstCharacter = name[0];
+  return name.includes("-") || firstCharacter?.toLowerCase() === firstCharacter;
+}
+function hasSourceMarkerAttribute(node) {
+  return node.attributes.some(
+    (attribute) => attribute.type === "JSXAttribute" && attribute.name.type === "JSXIdentifier" && attribute.name.name === import_shared10.SOURCE_MARKER_ATTRIBUTE
+  );
+}
+
+// src/transform/source-position.ts
+function createLineStarts(code) {
+  const starts = [0];
+  for (let index = 0; index < code.length; index += 1) {
+    if (code.charCodeAt(index) === 10) {
+      starts.push(index + 1);
+    }
+  }
+  return starts;
+}
+function getSourcePosition(lineStarts, offset) {
+  let lower = 0;
+  let upper = lineStarts.length - 1;
+  while (lower <= upper) {
+    const middle = Math.floor((lower + upper) / 2);
+    const start = lineStarts[middle];
+    if (start === void 0) {
+      break;
+    }
+    if (start <= offset) {
+      lower = middle + 1;
+    } else {
+      upper = middle - 1;
+    }
+  }
+  const lineIndex = Math.max(0, upper);
+  const lineStart = lineStarts[lineIndex] ?? 0;
+  return Object.freeze({
+    line: lineIndex + 1,
+    column: offset - lineStart + 1
+  });
+}
+
+// src/transform/inject-source-markers.ts
+function findAttributeInsertionOffset(code, node) {
+  let cursor = node.end - 2;
+  while (cursor >= node.start && /\s/u.test(code[cursor] ?? "")) {
+    cursor -= 1;
+  }
+  if (code[cursor] === "/") {
+    cursor -= 1;
+    while (cursor >= node.start && /\s/u.test(code[cursor] ?? "")) {
+      cursor -= 1;
+    }
+  }
+  return cursor + 1;
+}
+function normalizeRelativePath(root, absolutePath) {
+  return import_node_path7.default.relative(root, absolutePath).split(import_node_path7.default.sep).join("/");
+}
+function createMarker(fileId, line, column) {
+  return Object.freeze({ fileId, line, column });
+}
+function injectSourceMarkers(input) {
+  const parseResult = (0, import_oxc_parser2.parseSync)(input.absolutePath, input.code, {
+    sourceType: "module"
+  });
+  const parseError = parseResult.errors[0];
+  if (parseError !== void 0) {
+    throw new SyntaxError(parseError.message);
+  }
+  const magicString = new import_magic_string.default(input.code);
+  const lineStarts = createLineStarts(input.code);
+  let markerCount = 0;
+  const visitor = new import_oxc_parser2.Visitor({
+    JSXOpeningElement(node) {
+      if (!isIntrinsicOpeningElement(node)) {
+        return;
+      }
+      const position = getSourcePosition(lineStarts, node.start);
+      if (hasSourceMarkerAttribute(node)) {
+        input.onWarning?.({
+          code: "EXISTING_SOURCE_MARKER",
+          line: position.line,
+          column: position.column
+        });
+        return;
+      }
+      const value = (0, import_shared11.formatSourceMarker)(
+        createMarker(input.fileId, position.line, position.column)
+      );
+      const insertionOffset = findAttributeInsertionOffset(input.code, node);
+      magicString.appendLeft(
+        insertionOffset,
+        ` ${import_shared11.SOURCE_MARKER_ATTRIBUTE}=${JSON.stringify(value)}`
+      );
+      markerCount += 1;
+    }
+  });
+  visitor.visit(parseResult.program);
+  if (markerCount === 0) {
+    return void 0;
+  }
+  return Object.freeze({
+    code: magicString.toString(),
+    map: magicString.generateMap({
+      hires: true,
+      includeContent: true,
+      source: normalizeRelativePath(input.root, input.absolutePath)
+    }),
+    markerCount
+  });
+}
+
+// src/transform/transform-filter.ts
+var import_node_path8 = __toESM(require("path"), 1);
+var import_pluginutils = require("@rollup/pluginutils");
+var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".jsx", ".tsx"]);
+function stripViteQuery(id) {
+  const queryIndex = id.indexOf("?");
+  return queryIndex === -1 ? id : id.slice(0, queryIndex);
+}
+function isInsideRoot(root, candidate, pathApi = import_node_path8.default) {
+  const relative = pathApi.relative(pathApi.resolve(root), pathApi.resolve(candidate));
+  return relative === "" || !relative.startsWith(`..${pathApi.sep}`) && relative !== ".." && !pathApi.isAbsolute(relative);
+}
+function createTransformFilter(root, options) {
+  const matchesConfiguredFilter = (0, import_pluginutils.createFilter)(options.include, options.exclude);
+  return Object.freeze({
+    shouldTransform(id, code) {
+      if (id.startsWith("\0") || id.includes("virtual:spotpatch")) {
+        return false;
+      }
+      const cleanId = stripViteQuery(id);
+      if (!SUPPORTED_EXTENSIONS.has(import_node_path8.default.extname(cleanId).toLowerCase())) {
+        return false;
+      }
+      if (cleanId.includes("/node_modules/") || cleanId.includes("\\node_modules\\") || cleanId.includes("/packages/vite/") || cleanId.includes("\\packages\\vite\\")) {
+        return false;
+      }
+      if (!isInsideRoot(root, cleanId) || !matchesConfiguredFilter(cleanId)) {
+        return false;
+      }
+      return code.includes("<");
+    }
+  });
+}
+
+// src/transform/transform-plugin.ts
+function createCacheKey(id, code) {
+  const hash = (0, import_node_crypto5.createHash)("sha256").update(code).digest("base64url");
+  return `${id}\0${hash}`;
+}
+function getDisplayPath(root, id) {
+  const relative = import_node_path9.default.relative(root, stripViteQuery(id));
+  return relative.split(import_node_path9.default.sep).join("/");
+}
+function createTransformPlugin(input) {
+  let root = process.cwd();
+  let filter = createTransformFilter(root, input.options);
+  let logger;
+  const warnedFiles = /* @__PURE__ */ new Set();
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    name: "spotpatch:transform",
+    apply: "serve",
+    enforce: "pre",
+    configResolved(config) {
+      root = import_node_path9.default.resolve(config.root);
+      filter = createTransformFilter(root, input.options);
+      logger = config.logger;
+    },
+    transform(code, id) {
+      if (!filter.shouldTransform(id, code)) {
+        return null;
+      }
+      const cleanId = import_node_path9.default.resolve(stripViteQuery(id));
+      const cacheKey = createCacheKey(cleanId, code);
+      if (cache.has(cacheKey)) {
+        return cache.get(cacheKey) ?? null;
+      }
+      const startedAt = performance.now();
+      try {
+        const result = injectSourceMarkers({
+          code,
+          absolutePath: cleanId,
+          root,
+          fileId: input.registry.register(cleanId),
+          onWarning(warning) {
+            logger?.warn(
+              `[spotpatch:transform] Existing source marker at ${getDisplayPath(root, id)}:${String(warning.line)}:${String(warning.column)}; preserving application value.`
+            );
+          }
+        });
+        const output = result === void 0 ? null : Object.freeze({
+          code: result.code,
+          map: result.map.toString()
+        });
+        cache.set(cacheKey, output);
+        if (input.options.debug) {
+          const elapsed = performance.now() - startedAt;
+          logger?.info(
+            `[spotpatch:transform] ${getDisplayPath(root, id)} ${elapsed.toFixed(2)}ms`
+          );
+        }
+        return output;
+      } catch (error) {
+        if (!warnedFiles.has(cleanId)) {
+          warnedFiles.add(cleanId);
+          const detail = input.options.debug && error instanceof Error ? `: ${error.message}` : "";
+          logger?.warn(
+            `[spotpatch:transform] Failed to transform ${getDisplayPath(root, id)}; using original module${detail}`
+          );
+        }
+        return null;
+      }
+    }
+  };
+}
+
+// src/plugin.ts
+function spotPatch(userOptions = {}) {
+  const options = resolveOptions(userOptions);
+  if (!options.enabled) {
+    return [];
+  }
+  const registry = createSourceRegistry();
+  const session = createSession();
+  return [
+    createTransformPlugin({ options, registry }),
+    createRuntimeInjectionPlugin({ options, session }),
+    createServerPlugin({ options, registry, session })
+  ];
+}
+
+// src/index.ts
+var import_shared12 = require("@spotpatch/shared");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_AGENT_LIMITS,
+  DEFAULT_OPTIONS,
+  resolveOptions,
+  spotPatch
+});
+//# sourceMappingURL=index.cjs.map