@spotpatch/vite 1.3.1 → 1.4.1

package/dist/index.js

@@ -1,487 +1,24 @@
 // src/plugin.ts
-import path10 from "path";
-import { loadEnv } from "vite";
-
-// src/environment-ai.ts
-var AI_ENVIRONMENT_NAMES = Object.freeze({
-  authentication: "SPOTPATCH_AI_AUTHENTICATION",
-  baseURL: "SPOTPATCH_AI_BASE_URL",
-  credential: "SPOTPATCH_AI_API_KEY",
-  model: "SPOTPATCH_AI_MODEL",
-  protocol: "SPOTPATCH_AI_PROTOCOL"
-});
-function normalizedValue(environment, name) {
-  const value = environment[name];
-  if (value === void 0 || value.trim().length === 0) {
-    return void 0;
-  }
-  return value.trim();
-}
-function resolveEnvironmentAiConfiguration(environment) {
-  const baseURL = normalizedValue(environment, AI_ENVIRONMENT_NAMES.baseURL);
-  const model = normalizedValue(environment, AI_ENVIRONMENT_NAMES.model);
-  const credential = normalizedValue(environment, AI_ENVIRONMENT_NAMES.credential);
-  const protocol = normalizedValue(environment, AI_ENVIRONMENT_NAMES.protocol);
-  const authentication = normalizedValue(
-    environment,
-    AI_ENVIRONMENT_NAMES.authentication
-  );
-  const configuredValues = [baseURL, model, credential, protocol, authentication];
-  if (configuredValues.every((value) => value === void 0)) {
-    return Object.freeze({ ai: false });
-  }
-  const missing = [
-    [AI_ENVIRONMENT_NAMES.baseURL, baseURL],
-    [AI_ENVIRONMENT_NAMES.model, model],
-    [AI_ENVIRONMENT_NAMES.credential, credential]
-  ].filter((entry) => entry[1] === void 0).map(([name]) => name);
-  if (missing.length > 0) {
-    throw new RangeError(
-      `SpotPatch AI environment configuration is incomplete; missing ${missing.join(", ")}.`
-    );
-  }
-  if (baseURL === void 0 || model === void 0 || credential === void 0) {
-    throw new RangeError("SpotPatch AI environment configuration is incomplete.");
-  }
-  if (protocol !== void 0 && protocol !== "responses" && protocol !== "chat-completions") {
-    throw new RangeError(
-      "SpotPatch SPOTPATCH_AI_PROTOCOL must be responses or chat-completions."
-    );
-  }
-  if (authentication !== void 0 && authentication !== "bearer" && authentication !== "x-api-key") {
-    throw new RangeError(
-      "SpotPatch SPOTPATCH_AI_AUTHENTICATION must be bearer or x-api-key."
-    );
-  }
-  return Object.freeze({
-    ai: Object.freeze({
-      baseURL,
-      model,
-      ...protocol === void 0 ? {} : { protocol },
-      ...authentication === void 0 ? {} : { authentication }
-    })
-  });
-}
-
-// src/options.ts
+import path5 from "path";
 import {
-  DEFAULT_AGENT_LIMITS,
-  MAX_ANNOTATION_TARGETS,
-  SPOTPATCH_EDITOR_PREFERENCES,
-  SPOTPATCH_LOCALE_PREFERENCES
-} from "@spotpatch/shared";
-import { z } from "zod";
-var DEFAULT_EXCLUDE = Object.freeze([
-  /node_modules/,
-  /\.test\.[jt]sx$/,
-  /\.spec\.[jt]sx$/,
-  /\.stories\.[jt]sx$/,
-  /(?:^|\/)dist(?:\/|$)/,
-  /(?:^|\/)coverage(?:\/|$)/
-]);
-var DEFAULT_INCLUDE = Object.freeze([/(?:^|[/\\])src[/\\].+\.(?:jsx|tsx)$/]);
-var DEFAULT_BUDGET = Object.freeze({
-  totalCharacters: 16e3,
-  domCharacters: 3e3,
-  cssCharacters: 4e3,
-  codeCharacters: 7e3,
-  maxCodeLines: 80,
-  maxComponentDepth: 8
-});
-var DEFAULT_OPTIONS = Object.freeze({
-  enabled: true,
-  include: DEFAULT_INCLUDE,
-  exclude: DEFAULT_EXCLUDE,
-  editor: "auto",
-  redact: true,
-  budget: DEFAULT_BUDGET,
-  shortcut: "Mod+Shift+S",
-  allowLan: false,
-  debug: false,
-  locale: "auto",
-  maxTargets: 8,
-  ai: false
-});
-var PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-var ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]{1,127}$/;
-var agentLimitsSchema = z.strictObject({
-  maxTurns: z.number().optional(),
-  maxToolCalls: z.number().optional(),
-  maxChangedFiles: z.number().optional(),
-  maxDiffBytes: z.number().optional(),
-  maxReadBytesPerFile: z.number().optional(),
-  maxToolOutputCharacters: z.number().optional(),
-  maxProviderResponseBytes: z.number().optional(),
-  providerConnectTimeoutMs: z.number().optional(),
-  providerFirstByteTimeoutMs: z.number().optional(),
-  providerIdleTimeoutMs: z.number().optional(),
-  checkTimeoutMs: z.number().optional(),
-  jobTimeoutMs: z.number().optional()
-}).optional();
-var agentCheckSchema = z.strictObject({
-  label: z.string(),
-  command: z.string(),
-  args: z.array(z.string()).optional(),
-  required: z.boolean().optional(),
-  timeoutMs: z.number().optional()
-});
-var aiOptionsSchema = z.strictObject({
-  providers: z.record(
-    z.string(),
-    z.strictObject({
-      type: z.literal("openai-compatible"),
-      label: z.string(),
-      protocol: z.enum(["responses", "chat-completions"]),
-      authentication: z.enum(["bearer", "x-api-key"]).optional(),
-      baseURL: z.string(),
-      apiKeyEnv: z.string(),
-      models: z.record(
-        z.string(),
-        z.strictObject({ label: z.string(), model: z.string() })
-      ),
-      defaultModel: z.string()
-    })
-  ),
-  defaultProvider: z.string(),
-  execution: z.strictObject({
-    isolation: z.literal("git-worktree").optional(),
-    applyMode: z.enum(["review", "auto"]).optional(),
-    checks: z.record(z.string(), agentCheckSchema).optional(),
-    limits: agentLimitsSchema
-  }).optional()
-});
-var simpleAiOptionsSchema = z.strictObject({
-  baseURL: z.string(),
-  model: z.string(),
-  apiKeyEnv: z.string().optional(),
-  protocol: z.enum(["responses", "chat-completions"]).optional(),
-  authentication: z.enum(["bearer", "x-api-key"]).optional(),
-  providerLabel: z.string().optional(),
-  modelLabel: z.string().optional(),
-  execution: aiOptionsSchema.shape.execution
-});
-function assertIdentifier(value, label) {
-  if (!PROFILE_ID_PATTERN.test(value)) {
-    throw new RangeError(
-      `SpotPatch ${label} must contain only letters, numbers, dot, underscore, or hyphen.`
-    );
-  }
-}
-function nonEmpty(value, label, maximum = 256) {
-  const normalized = value.trim();
-  if (normalized.length === 0 || normalized.length > maximum || value.includes("\0")) {
-    throw new RangeError(`SpotPatch ${label} is invalid.`);
-  }
-  return normalized;
-}
-function normalizeProviderBaseURL(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new RangeError("SpotPatch AI provider baseURL must be a valid URL.");
-  }
-  const loopbackHosts = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
-  const allowedProtocol = url.protocol === "https:" || url.protocol === "http:" && loopbackHosts.has(url.hostname);
-  if (!allowedProtocol || url.username.length > 0 || url.password.length > 0 || url.search.length > 0 || url.hash.length > 0) {
-    throw new RangeError("SpotPatch AI provider baseURL violates URL policy.");
-  }
-  url.pathname = url.pathname.replace(/\/{2,}/g, "/").replace(/\/$/, "");
-  return url.toString().replace(/\/$/, "");
-}
-function resolveLimits(limits) {
-  const resolved = Object.freeze({
-    maxTurns: limits?.maxTurns ?? DEFAULT_AGENT_LIMITS.maxTurns,
-    maxToolCalls: limits?.maxToolCalls ?? DEFAULT_AGENT_LIMITS.maxToolCalls,
-    maxChangedFiles: limits?.maxChangedFiles ?? DEFAULT_AGENT_LIMITS.maxChangedFiles,
-    maxDiffBytes: limits?.maxDiffBytes ?? DEFAULT_AGENT_LIMITS.maxDiffBytes,
-    maxReadBytesPerFile: limits?.maxReadBytesPerFile ?? DEFAULT_AGENT_LIMITS.maxReadBytesPerFile,
-    maxToolOutputCharacters: limits?.maxToolOutputCharacters ?? DEFAULT_AGENT_LIMITS.maxToolOutputCharacters,
-    maxProviderResponseBytes: limits?.maxProviderResponseBytes ?? DEFAULT_AGENT_LIMITS.maxProviderResponseBytes,
-    providerConnectTimeoutMs: limits?.providerConnectTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerConnectTimeoutMs,
-    providerFirstByteTimeoutMs: limits?.providerFirstByteTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerFirstByteTimeoutMs,
-    providerIdleTimeoutMs: limits?.providerIdleTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerIdleTimeoutMs,
-    checkTimeoutMs: limits?.checkTimeoutMs ?? DEFAULT_AGENT_LIMITS.checkTimeoutMs,
-    jobTimeoutMs: limits?.jobTimeoutMs ?? DEFAULT_AGENT_LIMITS.jobTimeoutMs
-  });
-  for (const [name, value] of Object.entries(resolved)) {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-      throw new RangeError(`SpotPatch AI limit ${name} must be a positive integer.`);
-    }
-  }
-  return resolved;
-}
-function resolveModels(models) {
-  const entries = Object.entries(models);
-  if (entries.length === 0) {
-    throw new RangeError("SpotPatch AI provider must declare at least one model.");
-  }
-  return Object.freeze(
-    Object.fromEntries(
-      entries.map(([id, model]) => {
-        assertIdentifier(id, "model profile id");
-        return [
-          id,
-          Object.freeze({
-            id,
-            label: nonEmpty(model.label, "model label", 100),
-            model: nonEmpty(model.model, "provider model name")
-          })
-        ];
-      })
-    )
-  );
-}
-function resolveProviders(providers) {
-  const entries = Object.entries(providers);
-  if (entries.length === 0) {
-    throw new RangeError("SpotPatch AI must declare at least one provider.");
-  }
-  return Object.freeze(
-    Object.fromEntries(
-      entries.map(([id, provider]) => {
-        assertIdentifier(id, "provider profile id");
-        if (!ENV_NAME_PATTERN.test(provider.apiKeyEnv) || provider.apiKeyEnv.startsWith("VITE_")) {
-          throw new RangeError(
-            "SpotPatch AI apiKeyEnv must be an uppercase non-VITE environment name."
-          );
-        }
-        const models = resolveModels(provider.models);
-        if (!(provider.defaultModel in models)) {
-          throw new RangeError(
-            "SpotPatch AI provider defaultModel must reference a configured model."
-          );
-        }
-        return [
-          id,
-          Object.freeze({
-            id,
-            type: provider.type,
-            label: nonEmpty(provider.label, "provider label", 100),
-            protocol: provider.protocol,
-            authentication: provider.authentication ?? "bearer",
-            baseURL: normalizeProviderBaseURL(provider.baseURL),
-            apiKeyEnv: provider.apiKeyEnv,
-            models,
-            defaultModel: provider.defaultModel
-          })
-        ];
-      })
-    )
-  );
-}
-function resolveChecks(checks, defaultTimeoutMs) {
-  return Object.freeze(
-    Object.fromEntries(
-      Object.entries(checks ?? {}).map(([id, check]) => {
-        assertIdentifier(id, "check id");
-        const timeoutMs = check.timeoutMs ?? defaultTimeoutMs;
-        if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
-          throw new RangeError("SpotPatch AI check timeout must be positive.");
-        }
-        const args = Object.freeze(
-          [...check.args ?? []].map(
-            (argument) => nonEmpty(argument, "check argument", 4096)
-          )
-        );
-        return [
-          id,
-          Object.freeze({
-            id,
-            label: nonEmpty(check.label, "check label", 100),
-            command: nonEmpty(check.command, "check command", 1024),
-            args,
-            required: check.required ?? true,
-            timeoutMs
-          })
-        ];
-      })
-    )
-  );
-}
-function resolveAiOptions(options) {
-  if (options === void 0 || options === false) {
-    return false;
-  }
-  const expanded = "providers" in options ? options : (() => {
-    const simple = simpleAiOptionsSchema.safeParse(options);
-    if (!simple.success) {
-      throw new RangeError("SpotPatch AI configuration is invalid.");
-    }
-    const providerId = "default";
-    const modelId = "default";
-    return {
-      providers: {
-        [providerId]: {
-          type: "openai-compatible",
-          label: simple.data.providerLabel ?? "AI provider",
-          protocol: simple.data.protocol ?? "chat-completions",
-          authentication: simple.data.authentication ?? "bearer",
-          baseURL: simple.data.baseURL,
-          apiKeyEnv: simple.data.apiKeyEnv ?? "SPOTPATCH_AI_API_KEY",
-          models: {
-            [modelId]: {
-              label: simple.data.modelLabel ?? "AI model",
-              model: simple.data.model
-            }
-          },
-          defaultModel: modelId
-        }
-      },
-      defaultProvider: providerId,
-      ...simple.data.execution === void 0 ? {} : { execution: simple.data.execution }
-    };
-  })();
-  const parsed = aiOptionsSchema.safeParse(expanded);
-  if (!parsed.success) {
-    throw new RangeError("SpotPatch AI configuration is invalid.");
-  }
-  const validated = parsed.data;
-  const limits = resolveLimits(validated.execution?.limits);
-  const checks = resolveChecks(validated.execution?.checks, limits.checkTimeoutMs);
-  const applyMode = validated.execution?.applyMode ?? "review";
-  if (applyMode === "auto" && !Object.values(checks).some((check) => check.required)) {
-    throw new RangeError("SpotPatch AI auto mode requires a required check.");
-  }
-  const providers = resolveProviders(validated.providers);
-  if (!(validated.defaultProvider in providers)) {
-    throw new RangeError(
-      "SpotPatch AI defaultProvider must reference a configured provider."
-    );
-  }
-  return Object.freeze({
-    providers,
-    defaultProvider: validated.defaultProvider,
-    execution: Object.freeze({
-      isolation: "git-worktree",
-      applyMode,
-      checks,
-      limits
-    })
-  });
-}
-function createRuntimeAiConfig(options) {
-  if (options === false) {
-    return Object.freeze({ enabled: false });
-  }
-  return Object.freeze({
-    enabled: true,
-    defaultProvider: options.defaultProvider,
-    applyMode: options.execution.applyMode,
-    providers: Object.freeze(
-      Object.values(options.providers).map(
-        (provider) => Object.freeze({
-          id: provider.id,
-          label: provider.label,
-          protocol: provider.protocol,
-          defaultModel: provider.defaultModel,
-          models: Object.freeze(
-            Object.values(provider.models).map(
-              (model) => Object.freeze({ id: model.id, label: model.label })
-            )
-          )
-        })
-      )
-    )
-  });
-}
-function assertPositiveBudget(budget) {
-  for (const [name, value] of Object.entries(budget)) {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-      throw new RangeError(`SpotPatch budget ${name} must be a positive integer.`);
-    }
-  }
-}
-function resolveOptions(options = {}, environmentAi) {
-  const budget = Object.freeze({
-    ...DEFAULT_OPTIONS.budget,
-    ...options.budget
-  });
-  assertPositiveBudget(budget);
-  const maxTargets = options.maxTargets ?? DEFAULT_OPTIONS.maxTargets;
-  const locale = options.locale ?? DEFAULT_OPTIONS.locale;
-  const editor = options.editor ?? DEFAULT_OPTIONS.editor;
-  if (!SPOTPATCH_LOCALE_PREFERENCES.includes(locale)) {
-    throw new RangeError("SpotPatch locale must be auto, en-US, or zh-CN.");
-  }
-  if (!SPOTPATCH_EDITOR_PREFERENCES.includes(editor)) {
-    throw new RangeError("SpotPatch editor must be auto, vscode, or cursor.");
-  }
-  if (!Number.isSafeInteger(maxTargets) || maxTargets < 1 || maxTargets > MAX_ANNOTATION_TARGETS) {
-    throw new RangeError(
-      `SpotPatch maxTargets must be an integer between 1 and ${String(MAX_ANNOTATION_TARGETS)}.`
-    );
-  }
-  const resolved = {
-    enabled: options.enabled ?? DEFAULT_OPTIONS.enabled,
-    include: Object.freeze([...options.include ?? DEFAULT_OPTIONS.include]),
-    exclude: Object.freeze([...options.exclude ?? DEFAULT_OPTIONS.exclude]),
-    editor,
-    redact: options.redact ?? DEFAULT_OPTIONS.redact,
-    budget,
-    shortcut: options.shortcut ?? DEFAULT_OPTIONS.shortcut,
-    allowLan: options.allowLan ?? DEFAULT_OPTIONS.allowLan,
-    debug: options.debug ?? DEFAULT_OPTIONS.debug,
-    locale,
-    maxTargets,
-    ai: resolveAiOptions(options.ai ?? environmentAi)
-  };
-  if (resolved.shortcut.trim().length === 0) {
-    throw new RangeError("SpotPatch shortcut cannot be empty.");
-  }
-  return Object.freeze(resolved);
-}
-
-// src/registry/source-registry.ts
-import path from "path";
-
-// src/registry/source-id.ts
-import { randomBytes } from "crypto";
-var SOURCE_ID_BYTES = 8;
-var createRandomSourceId = () => randomBytes(SOURCE_ID_BYTES).toString("base64url");
-
-// src/registry/source-registry.ts
-function normalizeAbsolutePath(absolutePath) {
-  return path.normalize(path.resolve(absolutePath));
-}
-function createSourceRegistry(options = {}) {
-  const createId = options.createId ?? createRandomSourceId;
-  const pathToId = /* @__PURE__ */ new Map();
-  const idToPath = /* @__PURE__ */ new Map();
-  return Object.freeze({
-    register(absolutePath) {
-      const normalizedPath = normalizeAbsolutePath(absolutePath);
-      const existingId = pathToId.get(normalizedPath);
-      if (existingId !== void 0) {
-        return existingId;
-      }
-      let fileId = createId();
-      while (idToPath.has(fileId)) {
-        fileId = createId();
-      }
-      pathToId.set(normalizedPath, fileId);
-      idToPath.set(fileId, normalizedPath);
-      return fileId;
-    },
-    resolve(fileId) {
-      return idToPath.get(fileId);
-    },
-    clear() {
-      pathToId.clear();
-      idToPath.clear();
-    }
-  });
-}
+  createSession,
+  createSourceRegistry,
+  resolveCredentialEnvironment,
+  resolveEnvironmentAiConfiguration,
+  resolveOptions
+} from "@spotpatch/dev-server";
+import { loadEnv } from "vite";
 
 // src/runtime/runtime-injection-plugin.ts
 import { createRequire } from "module";
 import { readFileSync } from "fs";
-import path2 from "path";
+import path from "path";
+import { createRuntimeAiConfig } from "@spotpatch/dev-server";
 
 // package.json
 var package_default = {
   name: "@spotpatch/vite",
-  version: "1.3.1",
+  version: "1.4.1",
   description: "Vite development plugin for SpotPatch.",
   license: "MIT",
   repository: {
@@ -529,15 +66,11 @@ var package_default = {
     typecheck: "tsc --noEmit -p tsconfig.json"
   },
   dependencies: {
-    "@rollup/pluginutils": "5.4.0",
-    "@spotpatch/agent": "workspace:^",
+    "@spotpatch/compiler": "workspace:^",
+    "@spotpatch/dev-server": "workspace:^",
     "@spotpatch/react-adapter": "workspace:^",
     "@spotpatch/runtime": "workspace:^",
-    "@spotpatch/shared": "workspace:^",
-    "launch-editor": "2.14.1",
-    "magic-string": "1.1.0",
-    "oxc-parser": "0.143.0",
-    zod: "4.4.3"
+    "@spotpatch/shared": "workspace:^"
   },
   peerDependencies: {
     vite: "^5.0.0 || ^6.0.0 || ^7.0.0"
@@ -555,14 +88,14 @@ var RESOLVED_SPOTPATCH_CLIENT_MODULE_ID = `\0${SPOTPATCH_CLIENT_MODULE_ID}`;
 var SPOTPATCH_REACT_ADAPTER_MODULE_ID = "virtual:spotpatch/react-adapter";
 var RESOLVED_SPOTPATCH_REACT_ADAPTER_MODULE_ID = `\0${SPOTPATCH_REACT_ADAPTER_MODULE_ID}`;
 function readRuntimeBundle(root, fileName) {
-  const resolveFromProject = createRequire(path2.join(root, "package.json"));
+  const resolveFromProject = createRequire(path.join(root, "package.json"));
   const packageEntry = resolveFromProject.resolve("@spotpatch/vite");
-  const bundlePath = path2.join(path2.dirname(packageEntry), fileName);
+  const bundlePath = path.join(path.dirname(packageEntry), fileName);
   return readFileSync(bundlePath, "utf8");
 }
 function readConsumerViteVersion(root) {
   try {
-    const resolveFromProject = createRequire(path2.join(root, "package.json"));
+    const resolveFromProject = createRequire(path.join(root, "package.json"));
     const manifestPath = resolveFromProject.resolve("vite/package.json");
     const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
     if (typeof manifest === "object" && manifest !== null && "version" in manifest && typeof manifest.version === "string") {
@@ -579,13 +112,14 @@ function createClientModule(input, clientBundle, viteVersion) {
     budget: options.budget,
     debug: options.debug,
     editor: options.editor,
+    framework: "vite",
+    frameworkVersion: viteVersion,
     locale: options.locale,
     maxTargets: options.maxTargets,
     redact: options.redact,
     sessionToken: input.session.token,
     shortcut: options.shortcut,
-    spotPatchVersion: package_default.version,
-    viteVersion
+    spotPatchVersion: package_default.version
   };
   return [
     `const __SPOTPATCH_RUNTIME_CONFIG__ = ${JSON.stringify(runtimeConfig)};`,
@@ -601,7 +135,7 @@ function createRuntimeInjectionPlugin(input) {
     apply: "serve",
     enforce: "pre",
     configResolved(config) {
-      root = path2.resolve(config.root);
+      root = path.resolve(config.root);
       viteVersion = readConsumerViteVersion(root);
     },
     resolveId(id, importer) {
@@ -639,1567 +173,11 @@ function createRuntimeInjectionPlugin(input) {
 }
 
 // src/server/server-plugin.ts
-import path6 from "path";
-
-// src/agent/job-manager.ts
-import { createHash, randomBytes as randomBytes2 } from "crypto";
-import {
-  applyPreparedAgentChange,
-  executeAgentChange,
-  inspectAgentWorkspace,
-  probeProviderCapability,
-  resolveProviderCredential,
-  revertPreparedAgentChange
-} from "@spotpatch/agent";
-import {
-  ERROR_CODES,
-  SpotPatchError
-} from "@spotpatch/shared";
-var MAX_RETAINED_JOBS = 32;
-var MAX_RETAINED_EVENTS = 512;
-var JOB_ID_PATTERN = /^[A-Za-z0-9_-]{22,128}$/;
-var ACTIVE_JOB_STATUSES = /* @__PURE__ */ new Set([
-  "queued",
-  "preparing",
-  "running",
-  "validating",
-  "awaiting-review",
-  "applying",
-  "cancelling",
-  "reverting"
-]);
-var CANCELLABLE_JOB_STATUSES = /* @__PURE__ */ new Set([
-  "queued",
-  "preparing",
-  "running",
-  "validating",
-  "awaiting-review"
-]);
-var PRUNABLE_JOB_STATUSES = /* @__PURE__ */ new Set([
-  "completed",
-  "cancelled",
-  "reverted",
-  "failed"
-]);
-var DEFAULT_DEPENDENCIES = Object.freeze({
-  applyChange: applyPreparedAgentChange,
-  createJobId: () => randomBytes2(16).toString("base64url"),
-  executeChange: executeAgentChange,
-  inspectWorkspace: inspectAgentWorkspace,
-  now: () => (/* @__PURE__ */ new Date()).toISOString(),
-  probeCapability: probeProviderCapability,
-  resolveCredential: resolveProviderCredential,
-  revertChange: revertPreparedAgentChange
-});
-function normalizeError(error) {
-  return error instanceof SpotPatchError ? error : new SpotPatchError(ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
-}
-function isActive(status) {
-  return ACTIVE_JOB_STATUSES.has(status);
-}
-function snapshot(job) {
-  const base = {
-    jobId: job.id,
-    status: job.status,
-    providerProfileId: job.provider.id,
-    providerLabel: job.provider.label,
-    modelProfileId: job.model.id,
-    modelLabel: job.model.label,
-    phaseMessage: job.phaseMessage,
-    createdAt: job.createdAt,
-    updatedAt: job.updatedAt,
-    canCancel: CANCELLABLE_JOB_STATUSES.has(job.status),
-    canApply: job.status === "awaiting-review" && job.preparedChange?.validationPassed === true && job.result !== void 0 && job.result.diff.length > 0,
-    canRevert: job.status === "applied"
-  };
-  return Object.freeze(
-    job.errorCode === void 0 ? base : { ...base, errorCode: job.errorCode }
-  );
-}
-function capabilityCacheKey(provider, model) {
-  const configurationDigest = createHash("sha256").update(provider.baseURL).update("\0").update(provider.protocol).update("\0").update(provider.authentication).digest("hex");
-  return `${provider.id}:${model.id}:${configurationDigest}`;
-}
-function freezeEvent(event) {
-  return Object.freeze(event);
-}
-function createAgentJobManager(options) {
-  const dependencies = Object.freeze({
-    ...DEFAULT_DEPENDENCIES,
-    ...options.dependencies
-  });
-  const jobs = /* @__PURE__ */ new Map();
-  const capabilityCache = /* @__PURE__ */ new Map();
-  const providerConsents = /* @__PURE__ */ new Set();
-  let closed = false;
-  const resolveSelection = (providerProfileId, modelProfileId) => {
-    const provider = options.ai.providers[providerProfileId];
-    if (provider === void 0) {
-      throw new SpotPatchError(ERROR_CODES.PROVIDER_NOT_CONFIGURED);
-    }
-    const model = provider.models[modelProfileId];
-    if (model === void 0) {
-      throw new SpotPatchError(ERROR_CODES.MODEL_NOT_ALLOWED);
-    }
-    const credential = dependencies.resolveCredential(
-      provider.apiKeyEnv,
-      options.environment
-    );
-    return Object.freeze({ credential, model, provider });
-  };
-  const requireJob = (jobId) => {
-    if (!JOB_ID_PATTERN.test(jobId)) {
-      throw new SpotPatchError(ERROR_CODES.INVALID_REQUEST);
-    }
-    const job = jobs.get(jobId);
-    if (job === void 0) {
-      throw new SpotPatchError(ERROR_CODES.INVALID_REQUEST);
-    }
-    return job;
-  };
-  const appendEvent = (job, event) => {
-    job.events.push(event);
-    if (job.events.length > MAX_RETAINED_EVENTS) {
-      job.events.splice(0, job.events.length - MAX_RETAINED_EVENTS);
-    }
-    for (const listener of job.listeners) {
-      listener(event);
-    }
-  };
-  const eventBase = (job) => {
-    job.sequence += 1;
-    return {
-      schemaVersion: 1,
-      sequence: job.sequence,
-      jobId: job.id,
-      status: job.status,
-      timestamp: dependencies.now()
-    };
-  };
-  const emitSnapshot = (job) => {
-    appendEvent(
-      job,
-      freezeEvent({
-        ...eventBase(job),
-        type: "snapshot",
-        data: Object.freeze({ snapshot: snapshot(job) })
-      })
-    );
-  };
-  const emitPhase = (job, message) => {
-    appendEvent(
-      job,
-      freezeEvent({
-        ...eventBase(job),
-        type: "phase",
-        data: Object.freeze({ message })
-      })
-    );
-  };
-  const emitError = (job, code) => {
-    appendEvent(
-      job,
-      freezeEvent({
-        ...eventBase(job),
-        type: "error",
-        data: Object.freeze({ code, message: "The Agent job failed." })
-      })
-    );
-  };
-  const transition = (job, status, phaseMessage, errorCode) => {
-    job.status = status;
-    job.phaseMessage = phaseMessage;
-    job.errorCode = errorCode;
-    job.updatedAt = dependencies.now();
-    emitSnapshot(job);
-    emitPhase(job, phaseMessage);
-  };
-  const probeResolved = async (selection, signal) => {
-    const key = capabilityCacheKey(selection.provider, selection.model);
-    const cached = capabilityCache.get(key);
-    if (cached !== void 0) {
-      return cached;
-    }
-    const capability = await dependencies.probeCapability({
-      provider: selection.provider,
-      modelProfileId: selection.model.id,
-      limits: options.ai.execution.limits,
-      credential: selection.credential,
-      signal,
-      ...options.fetch === void 0 ? {} : { fetch: options.fetch }
-    });
-    if (capability.state !== "agent-ready") {
-      throw new SpotPatchError(ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED);
-    }
-    capabilityCache.set(key, capability);
-    return capability;
-  };
-  const finishWithError = (job, error) => {
-    const normalized = normalizeError(error);
-    const cancelled = job.controller.signal.aborted || normalized.code === ERROR_CODES.AGENT_CANCELLED;
-    transition(
-      job,
-      cancelled ? "cancelled" : "failed",
-      cancelled ? "Agent job cancelled." : "Agent job failed.",
-      cancelled ? ERROR_CODES.AGENT_CANCELLED : normalized.code
-    );
-    if (!cancelled) {
-      emitError(job, normalized.code);
-    }
-  };
-  const applyChange = async (job, preparedChange) => {
-    transition(job, "applying", "Applying validated changes to the project.");
-    try {
-      await dependencies.applyChange(preparedChange);
-      transition(job, "applied", "Changes were applied to local project files.");
-    } catch (error) {
-      const normalized = normalizeError(error);
-      transition(job, "failed", "Agent change could not be applied.", normalized.code);
-      emitError(job, normalized.code);
-      throw normalized;
-    }
-  };
-  const runJob = async (job) => {
-    try {
-      transition(job, "preparing", "Verifying provider and model capabilities.");
-      await probeResolved(
-        Object.freeze({
-          credential: job.credential,
-          model: job.model,
-          provider: job.provider
-        }),
-        job.controller.signal
-      );
-      const callbacks = {
-        onCheck(result) {
-          appendEvent(
-            job,
-            freezeEvent({
-              ...eventBase(job),
-              type: "check",
-              data: Object.freeze({ result })
-            })
-          );
-        },
-        onPhase(event) {
-          transition(job, event.phase, event.message);
-        },
-        onTool(event) {
-          appendEvent(
-            job,
-            freezeEvent({
-              ...eventBase(job),
-              type: "tool",
-              data: Object.freeze({ ...event })
-            })
-          );
-        }
-      };
-      const preparedChange = await dependencies.executeChange({
-        annotation: job.annotation,
-        callbacks,
-        credential: job.credential,
-        execution: options.ai.execution,
-        jobId: job.id,
-        model: job.model,
-        provider: job.provider,
-        root: options.root,
-        signal: job.controller.signal,
-        workingTreeMode: job.workingTreeMode,
-        ...options.fetch === void 0 ? {} : { fetch: options.fetch }
-      });
-      job.preparedChange = preparedChange;
-      job.result = preparedChange.result;
-      appendEvent(
-        job,
-        freezeEvent({
-          ...eventBase(job),
-          type: "result-ready",
-          data: Object.freeze({ hasResult: true })
-        })
-      );
-      if (!preparedChange.validationPassed) {
-        transition(
-          job,
-          "failed",
-          "Required validation checks failed.",
-          ERROR_CODES.VALIDATION_FAILED
-        );
-        emitError(job, ERROR_CODES.VALIDATION_FAILED);
-        return;
-      }
-      if (preparedChange.result.diff.length === 0) {
-        transition(job, "completed", "No source changes were proposed.");
-        return;
-      }
-      if (options.ai.execution.applyMode === "auto" && preparedChange.autoApplyEligible) {
-        try {
-          await applyChange(job, preparedChange);
-        } catch {
-        }
-        return;
-      }
-      transition(job, "awaiting-review", "Validated changes are ready for review.");
-    } catch (error) {
-      finishWithError(job, error);
-    }
-  };
-  const hasActiveJob = (excludedJobId) => [...jobs.values()].some((job) => job.id !== excludedJobId && isActive(job.status));
-  const pruneJobs = () => {
-    if (jobs.size < MAX_RETAINED_JOBS) {
-      return;
-    }
-    for (const [jobId, job] of jobs) {
-      if (PRUNABLE_JOB_STATUSES.has(job.status)) {
-        jobs.delete(jobId);
-      }
-      if (jobs.size < MAX_RETAINED_JOBS) {
-        return;
-      }
-    }
-  };
-  return Object.freeze({
-    async apply(jobId) {
-      const job = requireJob(jobId);
-      if (job.status !== "awaiting-review" || job.preparedChange === void 0 || !job.preparedChange.validationPassed || job.result?.diff.length === 0) {
-        throw new SpotPatchError(ERROR_CODES.PATCH_REJECTED);
-      }
-      await applyChange(job, job.preparedChange);
-      return snapshot(job);
-    },
-    cancel(jobId) {
-      const job = requireJob(jobId);
-      if (!CANCELLABLE_JOB_STATUSES.has(job.status)) {
-        return snapshot(job);
-      }
-      if (job.status === "awaiting-review") {
-        job.preparedChange = void 0;
-        job.controller.abort("agent-review-cancelled");
-        transition(
-          job,
-          "cancelled",
-          "Agent review was closed without applying changes.",
-          ERROR_CODES.AGENT_CANCELLED
-        );
-        return snapshot(job);
-      }
-      transition(job, "cancelling", "Cancelling Agent job.");
-      job.controller.abort("agent-job-cancelled");
-      return snapshot(job);
-    },
-    async close() {
-      if (closed) {
-        return;
-      }
-      closed = true;
-      for (const job of jobs.values()) {
-        if (CANCELLABLE_JOB_STATUSES.has(job.status)) {
-          job.controller.abort("vite-server-closed");
-        }
-      }
-      await Promise.allSettled(
-        [...jobs.values()].map((job) => job.runPromise).filter((promise) => promise !== void 0)
-      );
-      capabilityCache.clear();
-      providerConsents.clear();
-      jobs.clear();
-    },
-    create(request) {
-      if (closed) {
-        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
-      }
-      if (hasActiveJob()) {
-        throw new SpotPatchError(ERROR_CODES.AGENT_BUSY);
-      }
-      pruneJobs();
-      if (jobs.size >= MAX_RETAINED_JOBS) {
-        throw new SpotPatchError(ERROR_CODES.AGENT_BUSY);
-      }
-      const selection = resolveSelection(
-        request.providerProfileId,
-        request.modelProfileId
-      );
-      providerConsents.add(selection.provider.id);
-      const id = dependencies.createJobId();
-      if (!JOB_ID_PATTERN.test(id) || jobs.has(id)) {
-        throw new SpotPatchError(ERROR_CODES.INTERNAL_ERROR);
-      }
-      const timestamp = dependencies.now();
-      const job = {
-        annotation: request.annotation,
-        controller: new AbortController(),
-        createdAt: timestamp,
-        credential: selection.credential,
-        errorCode: void 0,
-        events: [],
-        id,
-        listeners: /* @__PURE__ */ new Set(),
-        model: selection.model,
-        phaseMessage: "Agent job queued.",
-        preparedChange: void 0,
-        provider: selection.provider,
-        result: void 0,
-        runPromise: void 0,
-        sequence: 0,
-        status: "queued",
-        updatedAt: timestamp,
-        workingTreeMode: request.workingTreeMode
-      };
-      jobs.set(id, job);
-      emitSnapshot(job);
-      emitPhase(job, job.phaseMessage);
-      job.runPromise = Promise.resolve().then(async () => runJob(job));
-      return snapshot(job);
-    },
-    events(jobId) {
-      return Object.freeze([...requireJob(jobId).events]);
-    },
-    async probe(request, signal) {
-      if (closed) {
-        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
-      }
-      return probeResolved(
-        resolveSelection(request.providerProfileId, request.modelProfileId),
-        signal
-      );
-    },
-    result(jobId) {
-      const job = requireJob(jobId);
-      const response = job.result === void 0 ? { snapshot: snapshot(job) } : { snapshot: snapshot(job), result: job.result };
-      return Object.freeze(response);
-    },
-    async revert(jobId) {
-      const job = requireJob(jobId);
-      if (job.status !== "applied" || job.preparedChange === void 0 || hasActiveJob(job.id)) {
-        throw new SpotPatchError(
-          hasActiveJob(job.id) ? ERROR_CODES.AGENT_BUSY : ERROR_CODES.APPLY_CONFLICT
-        );
-      }
-      transition(job, "reverting", "Reverting the applied Agent change.");
-      try {
-        await dependencies.revertChange(job.preparedChange);
-        transition(job, "reverted", "The Agent change was safely reverted.");
-      } catch (error) {
-        const normalized = normalizeError(error);
-        transition(
-          job,
-          "applied",
-          "Revert was rejected because project files changed.",
-          normalized.code
-        );
-        emitError(job, normalized.code);
-        throw normalized;
-      }
-      return snapshot(job);
-    },
-    subscribe(jobId, listener) {
-      const job = requireJob(jobId);
-      job.listeners.add(listener);
-      return () => {
-        job.listeners.delete(listener);
-      };
-    },
-    workspaceHealth(signal) {
-      if (closed) {
-        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
-      }
-      return dependencies.inspectWorkspace(options.root, signal);
-    }
-  });
-}
-
-// src/server/middleware.ts
-import {
-  ERROR_CODES as ERROR_CODES8,
-  SPOTPATCH_API_BASE,
-  SPOTPATCH_ENDPOINTS as SPOTPATCH_ENDPOINTS2,
-  SpotPatchError as SpotPatchError8,
-  openEditorRequestSchema,
-  sourceContextRequestSchema
-} from "@spotpatch/shared";
-
-// src/server/agent-http.ts
-import {
-  ERROR_CODES as ERROR_CODES6,
-  SPOTPATCH_ENDPOINTS,
-  SpotPatchError as SpotPatchError6,
-  agentCapabilityRequestSchema,
-  agentJobActionRequestSchema,
-  agentJobCreateRequestSchema,
-  agentWorkspaceHealthRequestSchema
-} from "@spotpatch/shared";
-
-// src/server/agent-request.ts
-import { realpath as realpath3 } from "fs/promises";
-import path5 from "path";
-import {
-  ERROR_CODES as ERROR_CODES4,
-  SpotPatchError as SpotPatchError4
-} from "@spotpatch/shared";
-
-// src/server/source-context.ts
-import { readFile, realpath as realpath2 } from "fs/promises";
-import path4 from "path";
-import {
-  ERROR_CODES as ERROR_CODES3,
-  SpotPatchError as SpotPatchError3
-} from "@spotpatch/shared";
-
-// src/server/extract-code-context.ts
+import path2 from "path";
 import {
-  parseSync,
-  Visitor
-} from "oxc-parser";
-function isComponentName(name) {
-  return /^[A-Z]/u.test(name);
-}
-function unwrapTypeExpression(expression) {
-  switch (expression.type) {
-    case "TSAsExpression":
-    case "TSSatisfiesExpression":
-    case "TSTypeAssertion":
-    case "TSNonNullExpression":
-    case "TSInstantiationExpression":
-      return unwrapTypeExpression(expression.expression);
-    default:
-      return expression;
-  }
-}
-function calleeName(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  if (unwrapped.type === "Identifier") {
-    return unwrapped.name;
-  }
-  if (unwrapped.type === "MemberExpression" && !unwrapped.computed) {
-    return unwrapped.property.type === "Identifier" ? unwrapped.property.name : void 0;
-  }
-  return void 0;
-}
-function isFunctionExpression(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  return unwrapped.type === "ArrowFunctionExpression" || unwrapped.type === "FunctionExpression";
-}
-function isSupportedComponentInitializer(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  if (isFunctionExpression(unwrapped)) {
-    return true;
-  }
-  if (unwrapped.type !== "CallExpression") {
-    return false;
-  }
-  const name = calleeName(unwrapped.callee);
-  if (name !== "memo" && name !== "forwardRef") {
-    return false;
-  }
-  const firstArgument = unwrapped.arguments[0];
-  return firstArgument !== void 0 && firstArgument.type !== "SpreadElement" && (isFunctionExpression(firstArgument) || isSupportedComponentInitializer(firstArgument));
-}
-function variableComponent(node) {
-  if (node.id.type !== "Identifier" || !isComponentName(node.id.name) || node.init === null || !isSupportedComponentInitializer(node.init)) {
-    return void 0;
-  }
-  return Object.freeze({ start: node.start, end: node.end, name: node.id.name });
-}
-function functionComponent(node) {
-  return node.id !== null && isComponentName(node.id.name) && node.body !== null ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
-}
-function isReactComponentSuperclass(expression) {
-  if (expression === null) {
-    return false;
-  }
-  const unwrapped = unwrapTypeExpression(expression);
-  if (unwrapped.type === "Identifier") {
-    return unwrapped.name === "Component" || unwrapped.name === "PureComponent";
-  }
-  return unwrapped.type === "MemberExpression" && !unwrapped.computed && unwrapped.object.type === "Identifier" && unwrapped.object.name === "React" && (unwrapped.property.name === "Component" || unwrapped.property.name === "PureComponent");
-}
-function classComponent(node) {
-  return node.id !== null && isComponentName(node.id.name) && isReactComponentSuperclass(node.superClass) ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
-}
-function selectedOffset(source, line, column) {
-  const lines = source.split(/\r?\n/u);
-  if (line < 1 || line > lines.length) {
-    return void 0;
-  }
-  const lineStart = lines.slice(0, line - 1).reduce((total, value) => total + value.length + 1, 0);
-  const lineLength = lines[line - 1]?.length ?? 0;
-  return lineStart + Math.min(Math.max(0, column - 1), lineLength);
-}
-function findComponentSpan(options) {
-  const offset = selectedOffset(options.source, options.line, options.column);
-  if (offset === void 0) {
-    return void 0;
-  }
-  let parseResult;
-  try {
-    parseResult = parseSync(options.sourcePath, options.source, {
-      sourceType: "module"
-    });
-  } catch {
-    return void 0;
-  }
-  if (parseResult.errors.length > 0) {
-    return void 0;
-  }
-  const jsxNodes = [];
-  const components = [];
-  const visitor = new Visitor({
-    JSXElement(node) {
-      jsxNodes.push(node);
-    },
-    JSXFragment(node) {
-      jsxNodes.push(node);
-    },
-    FunctionDeclaration(node) {
-      const candidate = functionComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
-      }
-    },
-    VariableDeclarator(node) {
-      const candidate = variableComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
-      }
-    },
-    ClassDeclaration(node) {
-      const candidate = classComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
-      }
-    }
-  });
-  visitor.visit(parseResult.program);
-  const selectedJsx = jsxNodes.filter((node) => node.start <= offset && node.end >= offset).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
-  if (selectedJsx === void 0) {
-    return void 0;
-  }
-  return components.filter(
-    (component) => component.start <= selectedJsx.start && component.end >= selectedJsx.end
-  ).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
-}
-function lineAtOffset(source, offset) {
-  let line = 1;
-  for (let index = 0; index < offset; index += 1) {
-    if (source[index] === "\n") {
-      line += 1;
-    }
-  }
-  return line;
-}
-function componentRange(source, component) {
-  return Object.freeze({
-    startLine: lineAtOffset(source, component.start),
-    endLine: lineAtOffset(source, Math.max(component.start, component.end - 1))
-  });
-}
-function truncateSelectedLine(line, column, maxCharacters) {
-  if (line.length <= maxCharacters) {
-    return line;
-  }
-  if (maxCharacters === 1) {
-    return "\u2026";
-  }
-  const contentCharacters = maxCharacters - 2;
-  const desiredStart = Math.max(0, column - 1 - Math.floor(contentCharacters / 2));
-  const start = Math.min(desiredStart, line.length - contentCharacters);
-  const end = start + contentCharacters;
-  return `${start > 0 ? "\u2026" : ""}${line.slice(start, end)}${end < line.length ? "\u2026" : ""}`.slice(
-    0,
-    maxCharacters
-  );
-}
-function boundedRange(lines, selectedLine, column, initialStart, initialEnd, maxCharacters) {
-  let startLine = initialStart;
-  let endLine = initialEnd;
-  let excerpt = lines.slice(startLine - 1, endLine).join("\n");
-  while (excerpt.length > maxCharacters && startLine < endLine) {
-    if (endLine - selectedLine >= selectedLine - startLine) {
-      endLine -= 1;
-    } else {
-      startLine += 1;
-    }
-    excerpt = lines.slice(startLine - 1, endLine).join("\n");
-  }
-  if (excerpt.length > maxCharacters) {
-    startLine = selectedLine;
-    endLine = selectedLine;
-    excerpt = truncateSelectedLine(
-      lines[selectedLine - 1] ?? "",
-      column,
-      maxCharacters
-    );
-  }
-  return Object.freeze({ startLine, endLine, excerpt });
-}
-function nearbyContext(options) {
-  const lines = options.source.split(/\r?\n/u);
-  const initialStart = Math.max(1, options.line - Math.floor(options.maxLines / 2));
-  const initialEnd = Math.min(lines.length, initialStart + options.maxLines - 1);
-  const startLine = Math.max(1, initialEnd - options.maxLines + 1);
-  const bounded = boundedRange(
-    lines,
-    options.line,
-    options.column,
-    startLine,
-    initialEnd,
-    options.maxCharacters
-  );
-  return Object.freeze({
-    relativePath: options.relativePath,
-    language: options.language,
-    startLine: bounded.startLine,
-    endLine: bounded.endLine,
-    excerpt: bounded.excerpt,
-    boundary: "nearby-lines"
-  });
-}
-function extractCodeContext(options) {
-  const component = findComponentSpan(options);
-  if (component !== void 0) {
-    const range = componentRange(options.source, component);
-    const lineCount = range.endLine - range.startLine + 1;
-    const excerpt = options.source.split(/\r?\n/u).slice(range.startLine - 1, range.endLine).join("\n");
-    if (lineCount <= options.maxLines && excerpt.length <= options.maxCharacters) {
-      return Object.freeze({
-        relativePath: options.relativePath,
-        language: options.language,
-        startLine: range.startLine,
-        endLine: range.endLine,
-        excerpt,
-        boundary: "component"
-      });
-    }
-  }
-  return nearbyContext(options);
-}
-
-// src/server/source-file.ts
-import { realpath, stat } from "fs/promises";
-import path3 from "path";
-import { ERROR_CODES as ERROR_CODES2, SpotPatchError as SpotPatchError2 } from "@spotpatch/shared";
-
-// src/server/constants.ts
-var MAX_REQUEST_BODY_BYTES = 32 * 1024;
-var MAX_AGENT_REQUEST_BODY_BYTES = 256 * 1024;
-var MAX_SOURCE_FILE_BYTES = 1024 * 1024;
-
-// src/server/source-file.ts
-var ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([".jsx", ".tsx"]);
-function isMissingFileError(error) {
-  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
-}
-async function assertInsideRoot(root, candidate) {
-  let realRoot;
-  let realCandidate;
-  try {
-    [realRoot, realCandidate] = await Promise.all([
-      realpath(root),
-      realpath(candidate)
-    ]);
-  } catch (error) {
-    if (isMissingFileError(error)) {
-      throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND, void 0, {
-        cause: error
-      });
-    }
-    throw error;
-  }
-  const relative = path3.relative(realRoot, realCandidate);
-  const outside = relative.startsWith(`..${path3.sep}`) || relative === ".." || path3.isAbsolute(relative);
-  if (outside) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_OUTSIDE_ROOT);
-  }
-  return realCandidate;
-}
-async function resolveSourceFile(options) {
-  const registeredPath = options.registry.resolve(options.fileId);
-  if (registeredPath === void 0) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
-  }
-  const sourcePath = await assertInsideRoot(options.root, registeredPath);
-  if (!ALLOWED_EXTENSIONS.has(path3.extname(sourcePath).toLowerCase())) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
-  }
-  let sourceStat;
-  try {
-    sourceStat = await stat(sourcePath);
-  } catch (error) {
-    if (isMissingFileError(error)) {
-      throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND, void 0, {
-        cause: error
-      });
-    }
-    throw error;
-  }
-  if (!sourceStat.isFile()) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
-  }
-  if (sourceStat.size > MAX_SOURCE_FILE_BYTES) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_TOO_LARGE);
-  }
-  return sourcePath;
-}
-
-// src/server/source-context.ts
-function toDisplayPath(root, sourcePath) {
-  return path4.relative(root, sourcePath).split(path4.sep).join("/");
-}
-async function readSourceContext(options) {
-  const sourcePath = await resolveSourceFile({
-    fileId: options.request.fileId,
-    registry: options.registry,
-    root: options.root
-  });
-  let source;
-  try {
-    source = await readFile(sourcePath, "utf8");
-  } catch (error) {
-    if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
-      throw new SpotPatchError3(ERROR_CODES3.SOURCE_NOT_FOUND, void 0, {
-        cause: error
-      });
-    }
-    throw error;
-  }
-  const lines = source.split(/\r?\n/);
-  if (options.request.line > lines.length) {
-    throw new SpotPatchError3(ERROR_CODES3.INVALID_REQUEST);
-  }
-  const extension = path4.extname(sourcePath).toLowerCase();
-  return extractCodeContext({
-    source,
-    sourcePath,
-    relativePath: toDisplayPath(await realpath2(options.root), sourcePath),
-    language: extension === ".tsx" ? "tsx" : "jsx",
-    line: options.request.line,
-    column: options.request.column,
-    maxLines: Math.min(options.request.maxLines, options.maxLines),
-    maxCharacters: options.maxCharacters
-  });
-}
-
-// src/server/agent-request.ts
-function compactSourceRef(source) {
-  return Object.freeze({
-    origin: source.origin,
-    confidence: source.confidence,
-    ...source.fileId === void 0 ? {} : { fileId: source.fileId },
-    ...source.relativePath === void 0 ? {} : { relativePath: source.relativePath },
-    ...source.line === void 0 ? {} : { line: source.line },
-    ...source.column === void 0 ? {} : { column: source.column }
-  });
-}
-async function authorizeSourceRef(source, registry, root) {
-  const markerOrigin = source.origin === "jsx-host" || source.origin === "dom-ancestor";
-  if (markerOrigin && (source.fileId === void 0 || source.line === void 0 || source.column === void 0)) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  if (source.fileId === void 0) {
-    if (source.origin === "none" && source.relativePath !== void 0) {
-      throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-    }
-    return compactSourceRef(source);
-  }
-  const sourcePath = await resolveSourceFile({
-    fileId: source.fileId,
-    registry,
-    root
-  });
-  const relativePath = path5.relative(await realpath3(root), sourcePath).split(path5.sep).join("/");
-  if (source.relativePath !== void 0 && source.relativePath !== relativePath) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  return Object.freeze({
-    ...compactSourceRef(source),
-    relativePath
-  });
-}
-function freezeMatchedRule(rule) {
-  return Object.freeze({
-    selector: rule.selector,
-    declarations: rule.declarations,
-    ...rule.source === void 0 ? {} : { source: rule.source },
-    ...rule.media === void 0 ? {} : { media: rule.media }
-  });
-}
-function targetIdentity(target) {
-  const source = target.source;
-  if (source.fileId !== void 0 && source.line !== void 0 && source.column !== void 0) {
-    return `source:${source.fileId}:${String(source.line)}:${String(source.column)}`;
-  }
-  return [
-    "element",
-    source.origin,
-    source.relativePath ?? "",
-    target.element.selector,
-    target.element.sanitizedHtml
-  ].join("\0");
-}
-async function authorizeTarget(target, input) {
-  const source = await authorizeSourceRef(target.source, input.registry, input.root);
-  const reactSourceInput = target.react.source;
-  const reactSource = reactSourceInput === void 0 ? void 0 : await authorizeSourceRef(reactSourceInput, input.registry, input.root);
-  const marker = source.fileId === void 0 || source.line === void 0 || source.column === void 0 ? void 0 : Object.freeze({
-    fileId: source.fileId,
-    line: source.line,
-    column: source.column,
-    maxLines: input.options.budget.maxCodeLines
-  });
-  if (marker === void 0 && target.code !== void 0) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  const code = marker === void 0 ? void 0 : await readSourceContext({
-    request: marker,
-    registry: input.registry,
-    root: input.root,
-    maxCharacters: input.options.budget.codeCharacters,
-    maxLines: input.options.budget.maxCodeLines
-  });
-  if (target.code !== void 0 && target.code.relativePath !== code?.relativePath) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  return Object.freeze({
-    instruction: target.instruction,
-    source,
-    react: Object.freeze({
-      supported: target.react.supported,
-      ...target.react.version === void 0 ? {} : { version: target.react.version },
-      ...target.react.componentName === void 0 ? {} : { componentName: target.react.componentName },
-      componentStack: Object.freeze([...target.react.componentStack]),
-      ...reactSource === void 0 ? {} : { source: reactSource }
-    }),
-    element: Object.freeze({
-      tagName: target.element.tagName,
-      selector: target.element.selector,
-      sanitizedHtml: target.element.sanitizedHtml,
-      ...target.element.textPreview === void 0 ? {} : { textPreview: target.element.textPreview },
-      ...target.element.role === void 0 ? {} : { role: target.element.role },
-      rect: Object.freeze({ ...target.element.rect })
-    }),
-    styles: Object.freeze({
-      classNames: Object.freeze([...target.styles.classNames]),
-      ...target.styles.inlineStyle === void 0 ? {} : { inlineStyle: target.styles.inlineStyle },
-      matchedRules: Object.freeze(target.styles.matchedRules.map(freezeMatchedRule)),
-      computed: Object.freeze({ ...target.styles.computed }),
-      warnings: Object.freeze([...target.styles.warnings])
-    }),
-    ...code === void 0 ? {} : { code: Object.freeze({ ...code }) },
-    warnings: Object.freeze([...target.warnings])
-  });
-}
-async function authorizeAgentJobRequest(input) {
-  const requestedTargets = input.request.annotation.targets;
-  if (requestedTargets.length > input.options.maxTargets) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  const identities = requestedTargets.map(targetIdentity);
-  if (new Set(identities).size !== identities.length) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  const targets = Object.freeze(
-    await Promise.all(requestedTargets.map((target) => authorizeTarget(target, input)))
-  );
-  const annotation = Object.freeze({
-    schemaVersion: 3,
-    id: input.request.annotation.id,
-    locale: input.request.annotation.locale,
-    page: Object.freeze({ ...input.request.annotation.page }),
-    targets,
-    createdAt: input.request.annotation.createdAt
-  });
-  return Object.freeze({
-    annotation,
-    providerProfileId: input.request.providerProfileId,
-    modelProfileId: input.request.modelProfileId,
-    providerDataConsent: true,
-    workingTreeMode: input.request.workingTreeMode
-  });
-}
-
-// src/server/request-body.ts
-import { ERROR_CODES as ERROR_CODES5, SpotPatchError as SpotPatchError5 } from "@spotpatch/shared";
-function isJsonContentType(value) {
-  return value?.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
-}
-async function readJsonRequestBody(request, maximumBytes = MAX_REQUEST_BODY_BYTES) {
-  if (!isJsonContentType(request.headers["content-type"])) {
-    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
-  }
-  const declaredLength = Number(request.headers["content-length"]);
-  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {
-    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
-  }
-  const chunks = [];
-  let byteLength = 0;
-  let exceededLimit = false;
-  for await (const rawChunk of request) {
-    const chunk = rawChunk;
-    if (typeof chunk !== "string" && !(chunk instanceof Uint8Array)) {
-      throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
-    }
-    const buffer = Buffer.from(chunk);
-    byteLength += buffer.byteLength;
-    if (byteLength > maximumBytes) {
-      exceededLimit = true;
-      continue;
-    }
-    chunks.push(buffer);
-  }
-  if (exceededLimit || byteLength === 0) {
-    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
-  }
-  try {
-    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-  } catch (error) {
-    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST, void 0, {
-      cause: error
-    });
-  }
-}
-
-// src/server/agent-http.ts
-var AGENT_JOB_ID_PATTERN = /^[A-Za-z0-9_-]{22,128}$/;
-var AGENT_JOB_ACTIONS = /* @__PURE__ */ new Set([
-  "events",
-  "result",
-  "cancel",
-  "apply",
-  "revert"
-]);
-var EVENT_STREAM_END_STATUSES = /* @__PURE__ */ new Set([
-  "awaiting-review",
-  "applied",
-  "completed",
-  "cancelled",
-  "reverted",
-  "failed"
-]);
-function matchAgentRequestPath(path11) {
-  if (path11 === SPOTPATCH_ENDPOINTS.agentCapability) {
-    return Object.freeze({ kind: "capability" });
-  }
-  if (path11 === SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
-    return Object.freeze({ kind: "workspace-health" });
-  }
-  if (path11 === SPOTPATCH_ENDPOINTS.agentJobs) {
-    return Object.freeze({ kind: "create-job" });
-  }
-  const prefix = `${SPOTPATCH_ENDPOINTS.agentJobs}/`;
-  if (!path11.startsWith(prefix)) {
-    return void 0;
-  }
-  const segments = path11.slice(prefix.length).split("/");
-  const jobId = segments[0];
-  const action = segments[1];
-  if (segments.length !== 2 || jobId === void 0 || !AGENT_JOB_ID_PATTERN.test(jobId) || action === void 0 || !AGENT_JOB_ACTIONS.has(action)) {
-    return void 0;
-  }
-  return Object.freeze({
-    kind: "job-action",
-    action,
-    jobId
-  });
-}
-function requireAgentManager(options) {
-  if (options.agentManager === void 0 || options.options.ai === false) {
-    throw new SpotPatchError6(ERROR_CODES6.AI_DISABLED);
-  }
-  return options.agentManager;
-}
-function writeNdjsonEvent(response, event) {
-  response.write(`${JSON.stringify(event)}
-`);
-}
-function streamAgentJobEvents(response, manager, jobId) {
-  const events = manager.events(jobId);
-  const current = manager.result(jobId).snapshot;
-  response.statusCode = 200;
-  response.setHeader("Cache-Control", "no-store");
-  response.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
-  response.setHeader("X-Content-Type-Options", "nosniff");
-  for (const event of events) {
-    writeNdjsonEvent(response, event);
-  }
-  if (EVENT_STREAM_END_STATUSES.has(current.status)) {
-    response.end();
-    return;
-  }
-  let settled = false;
-  let unsubscribe = () => void 0;
-  const heartbeat = setInterval(() => {
-    if (!settled) {
-      response.write("\n");
-    }
-  }, 15e3);
-  heartbeat.unref();
-  const cleanup = () => {
-    if (settled) {
-      return;
-    }
-    settled = true;
-    clearInterval(heartbeat);
-    unsubscribe();
-  };
-  unsubscribe = manager.subscribe(jobId, (event) => {
-    if (settled) {
-      return;
-    }
-    writeNdjsonEvent(response, event);
-    if (event.type === "snapshot" && EVENT_STREAM_END_STATUSES.has(event.data.snapshot.status)) {
-      cleanup();
-      response.end();
-    }
-  });
-  response.once("close", cleanup);
-  response.once("error", cleanup);
-}
-async function handleCapability(request, response, options, writeSuccess) {
-  if (request.method !== "POST") {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const parsed = agentCapabilityRequestSchema.safeParse(
-    await readJsonRequestBody(request)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const controller = new AbortController();
-  const abort = () => {
-    controller.abort("agent-capability-client-disconnected");
-  };
-  response.once("close", abort);
-  try {
-    const data = await requireAgentManager(options).probe(
-      parsed.data,
-      controller.signal
-    );
-    writeSuccess(response, 200, data);
-  } finally {
-    response.removeListener("close", abort);
-  }
-}
-async function handleCreateJob(request, response, options, writeSuccess) {
-  if (request.method !== "POST") {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const parsed = agentJobCreateRequestSchema.safeParse(
-    await readJsonRequestBody(request, MAX_AGENT_REQUEST_BODY_BYTES)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const authorizedRequest = await authorizeAgentJobRequest({
-    request: parsed.data,
-    options: options.options,
-    registry: options.registry,
-    root: options.root
-  });
-  const data = requireAgentManager(options).create(authorizedRequest);
-  writeSuccess(response, 202, data);
-}
-async function handleWorkspaceHealth(request, response, options, writeSuccess) {
-  if (request.method !== "POST") {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const parsed = agentWorkspaceHealthRequestSchema.safeParse(
-    await readJsonRequestBody(request)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const controller = new AbortController();
-  const abort = () => {
-    controller.abort("agent-workspace-health-client-disconnected");
-  };
-  response.once("close", abort);
-  try {
-    const data = await requireAgentManager(options).workspaceHealth(controller.signal);
-    writeSuccess(response, 200, data);
-  } finally {
-    response.removeListener("close", abort);
-  }
-}
-async function handleJobAction(request, response, options, route, writeSuccess) {
-  const manager = requireAgentManager(options);
-  if (request.method !== "POST") {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const parsed = agentJobActionRequestSchema.safeParse(
-    await readJsonRequestBody(request)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  if (route.action === "events") {
-    streamAgentJobEvents(response, manager, route.jobId);
-    return;
-  }
-  if (route.action === "result") {
-    writeSuccess(response, 200, manager.result(route.jobId));
-    return;
-  }
-  const data = route.action === "cancel" ? manager.cancel(route.jobId) : route.action === "apply" ? await manager.apply(route.jobId) : await manager.revert(route.jobId);
-  writeSuccess(response, 200, data);
-}
-async function handleAgentRequest(request, response, options, route, writeSuccess) {
-  if (route.kind === "capability") {
-    await handleCapability(request, response, options, writeSuccess);
-    return;
-  }
-  if (route.kind === "create-job") {
-    await handleCreateJob(request, response, options, writeSuccess);
-    return;
-  }
-  if (route.kind === "workspace-health") {
-    await handleWorkspaceHealth(request, response, options, writeSuccess);
-    return;
-  }
-  await handleJobAction(request, response, options, route, writeSuccess);
-}
-
-// src/server/editor.ts
-import { spawn } from "child_process";
-import launchEditor from "launch-editor";
-var EDITOR_STARTUP_GRACE_MS = 300;
-function normalizedEditorEnvironment(environment) {
-  return [
-    environment.TERM_PROGRAM,
-    environment.VSCODE_GIT_ASKPASS_NODE,
-    environment.VSCODE_GIT_ASKPASS_MAIN,
-    environment.GIT_ASKPASS
-  ].filter((value) => typeof value === "string").join("\n").replaceAll("\\", "/").toLowerCase();
-}
-function detectIntegratedEditor(environment) {
-  const signature = normalizedEditorEnvironment(environment);
-  if (signature === "cursor" || signature.includes("/cursor")) {
-    return "cursor";
-  }
-  if (signature === "vscode" || signature.includes("visual studio code") || /(^|\/)(code|code-insiders)(\.exe)?($|\/)/u.test(signature)) {
-    return "vscode";
-  }
-  return void 0;
-}
-function editorCommand(editor) {
-  return editor === "cursor" ? "cursor" : "code";
-}
-var DEFAULT_DEPENDENCIES2 = Object.freeze({
-  environment: process.env,
-  fallbackLauncher: launchEditor,
-  processSpawner: (command, arguments_, options) => spawn(command, [...arguments_], options),
-  startupGraceMs: EDITOR_STARTUP_GRACE_MS
-});
-function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
-  return (target, configuredEditor) => {
-    const integratedEditor = detectIntegratedEditor(dependencies.environment);
-    const resolvedEditor = configuredEditor === "auto" ? integratedEditor : configuredEditor;
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const settle = (error, editor = resolvedEditor ?? "auto") => {
-        if (settled) {
-          return;
-        }
-        settled = true;
-        clearTimeout(startupTimer);
-        if (error === void 0) {
-          resolve(editor);
-        } else {
-          reject(error);
-        }
-      };
-      const startupTimer = setTimeout(settle, dependencies.startupGraceMs);
-      const rejectStartup = () => {
-        settle(new Error("The configured editor could not be started."));
-      };
-      try {
-        if (resolvedEditor === void 0) {
-          dependencies.fallbackLauncher(target, void 0, rejectStartup);
-          return;
-        }
-        const child = dependencies.processSpawner(
-          editorCommand(resolvedEditor),
-          ["--goto", target],
-          {
-            env: dependencies.environment,
-            stdio: "ignore",
-            windowsHide: true
-          }
-        );
-        child.once("error", rejectStartup);
-        child.once("exit", (code, signal) => {
-          if (code === 0) {
-            settle(void 0, resolvedEditor);
-            return;
-          }
-          if (code !== null || signal !== null) {
-            rejectStartup();
-          }
-        });
-      } catch {
-        rejectStartup();
-      }
-    });
-  };
-}
-var launchConfiguredEditor = createEditorLauncher();
-
-// src/server/request-security.ts
-import { timingSafeEqual } from "crypto";
-import { isIP } from "net";
-import { ERROR_CODES as ERROR_CODES7, SPOTPATCH_TOKEN_HEADER, SpotPatchError as SpotPatchError7 } from "@spotpatch/shared";
-function getSingleHeader(request, name) {
-  const value = request.headers[name.toLowerCase()];
-  return Array.isArray(value) ? value[0] : value;
-}
-function tokensMatch(actual, expected) {
-  if (actual === void 0) {
-    return false;
-  }
-  const actualBytes = Buffer.from(actual);
-  const expectedBytes = Buffer.from(expected);
-  return actualBytes.byteLength === expectedBytes.byteLength && timingSafeEqual(actualBytes, expectedBytes);
-}
-function isLoopbackHostname(hostname) {
-  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (normalized === "localhost" || normalized.endsWith(".localhost")) {
-    return true;
-  }
-  if (normalized === "::1") {
-    return true;
-  }
-  if (isIP(normalized) === 4) {
-    return normalized.split(".")[0] === "127";
-  }
-  return normalized.startsWith("::ffff:127.");
-}
-function parseHost(value) {
-  try {
-    return new URL(`http://${value}`);
-  } catch {
-    return void 0;
-  }
-}
-function parseOrigin(value) {
-  try {
-    const origin = new URL(value);
-    if (origin.protocol !== "http:" && origin.protocol !== "https:" || origin.username.length > 0 || origin.password.length > 0 || origin.origin === "null") {
-      return void 0;
-    }
-    return origin;
-  } catch {
-    return void 0;
-  }
-}
-function assertRequestAuthorized(request, options) {
-  const actualToken = getSingleHeader(request, SPOTPATCH_TOKEN_HEADER);
-  if (!tokensMatch(actualToken, options.sessionToken)) {
-    throw new SpotPatchError7(ERROR_CODES7.INVALID_TOKEN);
-  }
-  const hostHeader = getSingleHeader(request, "host");
-  const originHeader = getSingleHeader(request, "origin");
-  const host = hostHeader === void 0 ? void 0 : parseHost(hostHeader);
-  const origin = originHeader === void 0 ? void 0 : parseOrigin(originHeader);
-  if (host === void 0 || origin === void 0) {
-    throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
-  }
-  const hostIsLoopback = isLoopbackHostname(host.hostname);
-  const originIsLoopback = isLoopbackHostname(origin.hostname);
-  if (!options.allowLan) {
-    if (!hostIsLoopback || !originIsLoopback) {
-      throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
-    }
-    return;
-  }
-  if (!originIsLoopback && origin.host.toLowerCase() !== host.host.toLowerCase()) {
-    throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
-  }
-}
-
-// src/server/middleware.ts
-var STATUS_BY_ERROR = Object.freeze({
-  [ERROR_CODES8.INVALID_REQUEST]: 400,
-  [ERROR_CODES8.INVALID_TOKEN]: 401,
-  [ERROR_CODES8.ORIGIN_NOT_ALLOWED]: 403,
-  [ERROR_CODES8.SOURCE_NOT_FOUND]: 404,
-  [ERROR_CODES8.SOURCE_OUTSIDE_ROOT]: 403,
-  [ERROR_CODES8.SOURCE_TOO_LARGE]: 413,
-  [ERROR_CODES8.EDITOR_OPEN_FAILED]: 500,
-  [ERROR_CODES8.AI_DISABLED]: 404,
-  [ERROR_CODES8.PROVIDER_NOT_CONFIGURED]: 503,
-  [ERROR_CODES8.PROVIDER_AUTH_FAILED]: 502,
-  [ERROR_CODES8.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
-  [ERROR_CODES8.MODEL_NOT_ALLOWED]: 400,
-  [ERROR_CODES8.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
-  [ERROR_CODES8.PROVIDER_RATE_LIMITED]: 429,
-  [ERROR_CODES8.AGENT_BUSY]: 409,
-  [ERROR_CODES8.AGENT_LIMIT_EXCEEDED]: 413,
-  [ERROR_CODES8.AGENT_CANCELLED]: 409,
-  [ERROR_CODES8.WORKTREE_DIRTY]: 409,
-  [ERROR_CODES8.WORKTREE_NOT_REPOSITORY]: 409,
-  [ERROR_CODES8.WORKTREE_OPERATION_IN_PROGRESS]: 409,
-  [ERROR_CODES8.WORKTREE_CONFLICTED]: 409,
-  [ERROR_CODES8.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
-  [ERROR_CODES8.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
-  [ERROR_CODES8.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
-  [ERROR_CODES8.TOOL_DENIED]: 403,
-  [ERROR_CODES8.TOOL_INPUT_INVALID]: 422,
-  [ERROR_CODES8.TOOL_PATH_DENIED]: 403,
-  [ERROR_CODES8.PATCH_REJECTED]: 422,
-  [ERROR_CODES8.VALIDATION_FAILED]: 422,
-  [ERROR_CODES8.APPLY_CONFLICT]: 409,
-  [ERROR_CODES8.INTERNAL_ERROR]: 500
-});
-var PUBLIC_MESSAGES = Object.freeze({
-  [ERROR_CODES8.INVALID_REQUEST]: "The request is invalid.",
-  [ERROR_CODES8.INVALID_TOKEN]: "The session token is invalid.",
-  [ERROR_CODES8.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
-  [ERROR_CODES8.SOURCE_NOT_FOUND]: "The source file is unavailable.",
-  [ERROR_CODES8.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
-  [ERROR_CODES8.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
-  [ERROR_CODES8.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
-  [ERROR_CODES8.AI_DISABLED]: "AI execution is not enabled.",
-  [ERROR_CODES8.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
-  [ERROR_CODES8.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
-  [ERROR_CODES8.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
-  [ERROR_CODES8.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
-  [ERROR_CODES8.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
-  [ERROR_CODES8.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
-  [ERROR_CODES8.AGENT_BUSY]: "Another Agent job is already running.",
-  [ERROR_CODES8.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
-  [ERROR_CODES8.AGENT_CANCELLED]: "The Agent job was cancelled.",
-  [ERROR_CODES8.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
-  [ERROR_CODES8.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
-  [ERROR_CODES8.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
-  [ERROR_CODES8.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
-  [ERROR_CODES8.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
-  [ERROR_CODES8.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
-  [ERROR_CODES8.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
-  [ERROR_CODES8.TOOL_DENIED]: "The Agent tool request was denied.",
-  [ERROR_CODES8.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
-  [ERROR_CODES8.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
-  [ERROR_CODES8.PATCH_REJECTED]: "The proposed patch was rejected.",
-  [ERROR_CODES8.VALIDATION_FAILED]: "The proposed change failed validation.",
-  [ERROR_CODES8.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
-  [ERROR_CODES8.INTERNAL_ERROR]: "The request could not be completed."
-});
-function writeJson(response, status, payload) {
-  response.statusCode = status;
-  response.setHeader("Cache-Control", "no-store");
-  response.setHeader("Content-Type", "application/json; charset=utf-8");
-  response.end(JSON.stringify(payload));
-}
-function asSpotPatchError(error) {
-  return error instanceof SpotPatchError8 ? error : new SpotPatchError8(ERROR_CODES8.INTERNAL_ERROR, void 0, { cause: error });
-}
-function writeError(response, error, logger) {
-  const normalized = asSpotPatchError(error);
-  if (normalized.code === ERROR_CODES8.INTERNAL_ERROR) {
-    logger?.warn("[spotpatch:server] Internal request failure.");
-  }
-  writeJson(response, STATUS_BY_ERROR[normalized.code], {
-    ok: false,
-    error: {
-      code: normalized.code,
-      message: PUBLIC_MESSAGES[normalized.code]
-    }
-  });
-}
-function requestPath(request) {
-  try {
-    return new URL(request.url ?? "/", "http://spotpatch.invalid").pathname;
-  } catch {
-    return "";
-  }
-}
-async function handleSourceContext(request, options) {
-  const parsed = sourceContextRequestSchema.safeParse(
-    await readJsonRequestBody(request)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-  }
-  return readSourceContext({
-    request: parsed.data,
-    registry: options.registry,
-    root: options.root,
-    maxCharacters: options.options.budget.codeCharacters,
-    maxLines: options.options.budget.maxCodeLines
-  });
-}
-async function handleOpenEditor(request, options) {
-  const parsed = openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
-  if (!parsed.success) {
-    throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-  }
-  const body = parsed.data;
-  const sourcePath = await resolveSourceFile({
-    fileId: body.fileId,
-    registry: options.registry,
-    root: options.root
-  });
-  const target = `${sourcePath}:${String(body.line)}:${String(body.column)}`;
-  const editorLauncher = options.editorLauncher ?? launchConfiguredEditor;
-  try {
-    const editor = await editorLauncher(target, options.options.editor);
-    return Object.freeze({ editor });
-  } catch (error) {
-    options.logger?.warn(
-      `[spotpatch:server] ${options.options.editor === "auto" ? "The detected editor" : options.options.editor} rejected an editor request.`
-    );
-    throw new SpotPatchError8(ERROR_CODES8.EDITOR_OPEN_FAILED, void 0, {
-      cause: error
-    });
-  }
-}
-function createSpotPatchMiddleware(options) {
-  return (request, response, next) => {
-    const path11 = requestPath(request);
-    const agentRoute = matchAgentRequestPath(path11);
-    if (path11 !== SPOTPATCH_ENDPOINTS2.sourceContext && path11 !== SPOTPATCH_ENDPOINTS2.openEditor && agentRoute === void 0 && !path11.startsWith(`${SPOTPATCH_API_BASE}/`)) {
-      next();
-      return;
-    }
-    const handle = async () => {
-      assertRequestAuthorized(request, {
-        allowLan: options.options.allowLan,
-        sessionToken: options.session.token
-      });
-      if (path11 === SPOTPATCH_ENDPOINTS2.sourceContext) {
-        if (request.method !== "POST") {
-          throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-        }
-        const data = await handleSourceContext(request, options);
-        writeJson(response, 200, { ok: true, data });
-        return;
-      }
-      if (path11 === SPOTPATCH_ENDPOINTS2.openEditor) {
-        if (request.method !== "POST") {
-          throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-        }
-        const data = await handleOpenEditor(request, options);
-        writeJson(response, 200, { ok: true, data });
-        return;
-      }
-      if (agentRoute === void 0) {
-        throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-      }
-      await handleAgentRequest(
-        request,
-        response,
-        options,
-        agentRoute,
-        (target, status, data) => {
-          writeJson(target, status, { ok: true, data });
-        }
-      );
-    };
-    void handle().catch((error) => {
-      writeError(response, error, options.logger);
-    });
-  };
-}
-
-// src/server/server-plugin.ts
+  createAgentJobManager,
+  createSpotPatchMiddleware
+} from "@spotpatch/dev-server";
 function createServerPlugin(input) {
   let agentManager;
   let config;
@@ -2219,7 +197,7 @@ function createServerPlugin(input) {
       if (config === void 0) {
         throw new Error("SpotPatch server initialized before Vite config resolution.");
       }
-      const root = path6.resolve(config.root);
+      const root = path2.resolve(config.root);
       const options = input.context.getOptions();
       agentManager = options.ai === false ? void 0 : createAgentJobManager({
         ai: options.ai,
@@ -2249,189 +227,40 @@ function createServerPlugin(input) {
   };
 }
 
-// src/session/session.ts
-import { randomBytes as randomBytes3 } from "crypto";
-function createSession() {
-  return Object.freeze({
-    token: randomBytes3(16).toString("base64url")
-  });
-}
-
 // src/transform/transform-plugin.ts
-import { createHash as createHash2 } from "crypto";
-import path9 from "path";
-
-// src/transform/inject-source-markers.ts
-import path7 from "path";
-import {
-  formatSourceMarker,
-  SOURCE_MARKER_ATTRIBUTE as SOURCE_MARKER_ATTRIBUTE2
-} from "@spotpatch/shared";
-import MagicString from "magic-string";
-import { parseSync as parseSync2, Visitor as Visitor2 } from "oxc-parser";
-
-// src/transform/intrinsic-element.ts
-import { SOURCE_MARKER_ATTRIBUTE } from "@spotpatch/shared";
-function isIntrinsicOpeningElement(node) {
-  if (node.name.type !== "JSXIdentifier") {
-    return false;
-  }
-  const { name } = node.name;
-  const firstCharacter = name[0];
-  return name.includes("-") || firstCharacter?.toLowerCase() === firstCharacter;
-}
-function hasSourceMarkerAttribute(node) {
-  return node.attributes.some(
-    (attribute) => attribute.type === "JSXAttribute" && attribute.name.type === "JSXIdentifier" && attribute.name.name === SOURCE_MARKER_ATTRIBUTE
-  );
-}
-
-// src/transform/source-position.ts
-function createLineStarts(code) {
-  const starts = [0];
-  for (let index = 0; index < code.length; index += 1) {
-    if (code.charCodeAt(index) === 10) {
-      starts.push(index + 1);
-    }
-  }
-  return starts;
-}
-function getSourcePosition(lineStarts, offset) {
-  let lower = 0;
-  let upper = lineStarts.length - 1;
-  while (lower <= upper) {
-    const middle = Math.floor((lower + upper) / 2);
-    const start = lineStarts[middle];
-    if (start === void 0) {
-      break;
-    }
-    if (start <= offset) {
-      lower = middle + 1;
-    } else {
-      upper = middle - 1;
-    }
-  }
-  const lineIndex = Math.max(0, upper);
-  const lineStart = lineStarts[lineIndex] ?? 0;
-  return Object.freeze({
-    line: lineIndex + 1,
-    column: offset - lineStart + 1
-  });
-}
-
-// src/transform/inject-source-markers.ts
-function findAttributeInsertionOffset(code, node) {
-  let cursor = node.end - 2;
-  while (cursor >= node.start && /\s/u.test(code[cursor] ?? "")) {
-    cursor -= 1;
-  }
-  if (code[cursor] === "/") {
-    cursor -= 1;
-    while (cursor >= node.start && /\s/u.test(code[cursor] ?? "")) {
-      cursor -= 1;
-    }
-  }
-  return cursor + 1;
-}
-function normalizeRelativePath(root, absolutePath) {
-  return path7.relative(root, absolutePath).split(path7.sep).join("/");
-}
-function createMarker(fileId, line, column) {
-  return Object.freeze({ fileId, line, column });
-}
-function injectSourceMarkers(input) {
-  const parseResult = parseSync2(input.absolutePath, input.code, {
-    sourceType: "module"
-  });
-  const parseError = parseResult.errors[0];
-  if (parseError !== void 0) {
-    throw new SyntaxError(parseError.message);
-  }
-  const magicString = new MagicString(input.code);
-  const lineStarts = createLineStarts(input.code);
-  let markerCount = 0;
-  const visitor = new Visitor2({
-    JSXOpeningElement(node) {
-      if (!isIntrinsicOpeningElement(node)) {
-        return;
-      }
-      const position = getSourcePosition(lineStarts, node.start);
-      if (hasSourceMarkerAttribute(node)) {
-        input.onWarning?.({
-          code: "EXISTING_SOURCE_MARKER",
-          line: position.line,
-          column: position.column
-        });
-        return;
-      }
-      const value = formatSourceMarker(
-        createMarker(input.fileId, position.line, position.column)
-      );
-      const insertionOffset = findAttributeInsertionOffset(input.code, node);
-      magicString.appendLeft(
-        insertionOffset,
-        ` ${SOURCE_MARKER_ATTRIBUTE2}=${JSON.stringify(value)}`
-      );
-      markerCount += 1;
-    }
-  });
-  visitor.visit(parseResult.program);
-  if (markerCount === 0) {
-    return void 0;
-  }
-  return Object.freeze({
-    code: magicString.toString(),
-    map: magicString.generateMap({
-      hires: true,
-      includeContent: true,
-      source: normalizeRelativePath(input.root, input.absolutePath)
-    }),
-    markerCount
-  });
-}
+import { createHash } from "crypto";
+import path4 from "path";
+import { injectSourceMarkers } from "@spotpatch/compiler";
 
 // src/transform/transform-filter.ts
-import path8 from "path";
-import { createFilter } from "@rollup/pluginutils";
-var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".jsx", ".tsx"]);
+import path3 from "path";
+import { createSourceFilter } from "@spotpatch/compiler";
+import { isInsideRoot } from "@spotpatch/compiler";
 function stripViteQuery(id) {
   const queryIndex = id.indexOf("?");
   return queryIndex === -1 ? id : id.slice(0, queryIndex);
 }
-function isInsideRoot(root, candidate, pathApi = path8) {
-  const relative = pathApi.relative(pathApi.resolve(root), pathApi.resolve(candidate));
-  return relative === "" || !relative.startsWith(`..${pathApi.sep}`) && relative !== ".." && !pathApi.isAbsolute(relative);
-}
 function createTransformFilter(root, options) {
-  const matchesConfiguredFilter = createFilter(options.include, options.exclude);
+  const sourceFilter = createSourceFilter(root, options);
   return Object.freeze({
     shouldTransform(id, code) {
-      if (id.startsWith("\0") || id.includes("virtual:spotpatch")) {
+      if (id.startsWith("\0") || id.includes("virtual:spotpatch") || id.includes("/packages/vite/") || id.includes("\\packages\\vite\\")) {
         return false;
       }
       const cleanId = stripViteQuery(id);
-      if (!SUPPORTED_EXTENSIONS.has(path8.extname(cleanId).toLowerCase())) {
-        return false;
-      }
-      if (cleanId.includes("/node_modules/") || cleanId.includes("\\node_modules\\") || cleanId.includes("/packages/vite/") || cleanId.includes("\\packages\\vite\\")) {
-        return false;
-      }
-      if (!isInsideRoot(root, cleanId) || !matchesConfiguredFilter(cleanId)) {
-        return false;
-      }
-      return code.includes("<");
+      return sourceFilter.shouldTransform(path3.resolve(cleanId), code);
     }
   });
 }
 
 // src/transform/transform-plugin.ts
 function createCacheKey(id, code) {
-  const hash = createHash2("sha256").update(code).digest("base64url");
+  const hash = createHash("sha256").update(code).digest("base64url");
   return `${id}\0${hash}`;
 }
 function getDisplayPath(root, id) {
-  const relative = path9.relative(root, stripViteQuery(id));
-  return relative.split(path9.sep).join("/");
+  const relative = path4.relative(root, stripViteQuery(id));
+  return relative.split(path4.sep).join("/");
 }
 function createTransformPlugin(input) {
   let root = process.cwd();
@@ -2447,7 +276,7 @@ function createTransformPlugin(input) {
       input.configure?.(config, environment);
     },
     configResolved(config) {
-      root = path9.resolve(config.root);
+      root = path4.resolve(config.root);
       filter = createTransformFilter(root, input.context.getOptions());
       logger = config.logger;
     },
@@ -2455,7 +284,7 @@ function createTransformPlugin(input) {
       if (!filter.shouldTransform(id, code)) {
         return null;
       }
-      const cleanId = path9.resolve(stripViteQuery(id));
+      const cleanId = path4.resolve(stripViteQuery(id));
       const cacheKey = createCacheKey(cleanId, code);
       if (cache.has(cacheKey)) {
         return cache.get(cacheKey) ?? null;
@@ -2514,29 +343,11 @@ function spotPatch(userOptions = {}) {
     getOptions: () => options
   });
   const configure = (config, environment) => {
-    const root = path10.resolve(process.cwd(), config.root ?? ".");
-    const loadedEnvironment = config.envDir === false ? process.env : loadEnv(environment.mode, path10.resolve(root, config.envDir ?? "."), "");
+    const root = path5.resolve(process.cwd(), config.root ?? ".");
+    const loadedEnvironment = config.envDir === false ? process.env : loadEnv(environment.mode, path5.resolve(root, config.envDir ?? "."), "");
     const environmentAi = userOptions.ai === void 0 ? resolveEnvironmentAiConfiguration(loadedEnvironment).ai : false;
     options = resolveOptions(userOptions, environmentAi);
-    if (options.ai === false) {
-      credentialEnvironment = Object.freeze({});
-      return;
-    }
-    const names = new Set(
-      Object.values(options.ai.providers).map((provider) => provider.apiKeyEnv)
-    );
-    const missing = [...names].filter((name) => {
-      const value = loadedEnvironment[name];
-      return value === void 0 || value.trim().length === 0;
-    });
-    if (missing.length > 0) {
-      throw new RangeError(
-        `SpotPatch AI credential environment is missing ${missing.join(", ")}.`
-      );
-    }
-    credentialEnvironment = Object.freeze(
-      Object.fromEntries([...names].map((name) => [name, loadedEnvironment[name]]))
-    );
+    credentialEnvironment = resolveCredentialEnvironment(options, loadedEnvironment);
   };
   return [
     createTransformPlugin({ configure, context, registry }),
@@ -2545,14 +356,22 @@ function spotPatch(userOptions = {}) {
   ];
 }
 
+// src/options.ts
+import {
+  createRuntimeAiConfig as createRuntimeAiConfig2,
+  DEFAULT_EXCLUDE,
+  DEFAULT_OPTIONS,
+  resolveOptions as resolveOptions2
+} from "@spotpatch/dev-server";
+
 // src/index.ts
 import {
-  DEFAULT_AGENT_LIMITS as DEFAULT_AGENT_LIMITS2
+  DEFAULT_AGENT_LIMITS
 } from "@spotpatch/shared";
 export {
-  DEFAULT_AGENT_LIMITS2 as DEFAULT_AGENT_LIMITS,
+  DEFAULT_AGENT_LIMITS,
   DEFAULT_OPTIONS,
-  resolveOptions,
+  resolveOptions2 as resolveOptions,
   spotPatch
 };
 //# sourceMappingURL=index.js.map