@spotpatch/vite 1.4.0 → 1.4.2

package/dist/index.js

@@ -1,487 +1,24 @@
 // src/plugin.ts
-import path10 from "path";
-import { loadEnv } from "vite";
-
-// src/environment-ai.ts
-var AI_ENVIRONMENT_NAMES = Object.freeze({
-  authentication: "SPOTPATCH_AI_AUTHENTICATION",
-  baseURL: "SPOTPATCH_AI_BASE_URL",
-  credential: "SPOTPATCH_AI_API_KEY",
-  model: "SPOTPATCH_AI_MODEL",
-  protocol: "SPOTPATCH_AI_PROTOCOL"
-});
-function normalizedValue(environment, name) {
-  const value = environment[name];
-  if (value === void 0 || value.trim().length === 0) {
-    return void 0;
-  }
-  return value.trim();
-}
-function resolveEnvironmentAiConfiguration(environment) {
-  const baseURL = normalizedValue(environment, AI_ENVIRONMENT_NAMES.baseURL);
-  const model = normalizedValue(environment, AI_ENVIRONMENT_NAMES.model);
-  const credential = normalizedValue(environment, AI_ENVIRONMENT_NAMES.credential);
-  const protocol = normalizedValue(environment, AI_ENVIRONMENT_NAMES.protocol);
-  const authentication = normalizedValue(
-    environment,
-    AI_ENVIRONMENT_NAMES.authentication
-  );
-  const configuredValues = [baseURL, model, credential, protocol, authentication];
-  if (configuredValues.every((value) => value === void 0)) {
-    return Object.freeze({ ai: false });
-  }
-  const missing = [
-    [AI_ENVIRONMENT_NAMES.baseURL, baseURL],
-    [AI_ENVIRONMENT_NAMES.model, model],
-    [AI_ENVIRONMENT_NAMES.credential, credential]
-  ].filter((entry) => entry[1] === void 0).map(([name]) => name);
-  if (missing.length > 0) {
-    throw new RangeError(
-      `SpotPatch AI environment configuration is incomplete; missing ${missing.join(", ")}.`
-    );
-  }
-  if (baseURL === void 0 || model === void 0 || credential === void 0) {
-    throw new RangeError("SpotPatch AI environment configuration is incomplete.");
-  }
-  if (protocol !== void 0 && protocol !== "responses" && protocol !== "chat-completions") {
-    throw new RangeError(
-      "SpotPatch SPOTPATCH_AI_PROTOCOL must be responses or chat-completions."
-    );
-  }
-  if (authentication !== void 0 && authentication !== "bearer" && authentication !== "x-api-key") {
-    throw new RangeError(
-      "SpotPatch SPOTPATCH_AI_AUTHENTICATION must be bearer or x-api-key."
-    );
-  }
-  return Object.freeze({
-    ai: Object.freeze({
-      baseURL,
-      model,
-      ...protocol === void 0 ? {} : { protocol },
-      ...authentication === void 0 ? {} : { authentication }
-    })
-  });
-}
-
-// src/options.ts
+import path5 from "path";
 import {
-  DEFAULT_AGENT_LIMITS,
-  MAX_ANNOTATION_TARGETS,
-  SPOTPATCH_EDITOR_PREFERENCES,
-  SPOTPATCH_LOCALE_PREFERENCES
-} from "@spotpatch/shared";
-import { z } from "zod";
-var DEFAULT_EXCLUDE = Object.freeze([
-  /node_modules/,
-  /\.test\.[jt]sx$/,
-  /\.spec\.[jt]sx$/,
-  /\.stories\.[jt]sx$/,
-  /(?:^|\/)dist(?:\/|$)/,
-  /(?:^|\/)coverage(?:\/|$)/
-]);
-var DEFAULT_INCLUDE = Object.freeze([/(?:^|[/\\])src[/\\].+\.(?:jsx|tsx)$/]);
-var DEFAULT_BUDGET = Object.freeze({
-  totalCharacters: 16e3,
-  domCharacters: 3e3,
-  cssCharacters: 4e3,
-  codeCharacters: 7e3,
-  maxCodeLines: 80,
-  maxComponentDepth: 8
-});
-var DEFAULT_OPTIONS = Object.freeze({
-  enabled: true,
-  include: DEFAULT_INCLUDE,
-  exclude: DEFAULT_EXCLUDE,
-  editor: "auto",
-  redact: true,
-  budget: DEFAULT_BUDGET,
-  shortcut: "Mod+Shift+S",
-  allowLan: false,
-  debug: false,
-  locale: "auto",
-  maxTargets: 8,
-  ai: false
-});
-var PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-var ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]{1,127}$/;
-var agentLimitsSchema = z.strictObject({
-  maxTurns: z.number().optional(),
-  maxToolCalls: z.number().optional(),
-  maxChangedFiles: z.number().optional(),
-  maxDiffBytes: z.number().optional(),
-  maxReadBytesPerFile: z.number().optional(),
-  maxToolOutputCharacters: z.number().optional(),
-  maxProviderResponseBytes: z.number().optional(),
-  providerConnectTimeoutMs: z.number().optional(),
-  providerFirstByteTimeoutMs: z.number().optional(),
-  providerIdleTimeoutMs: z.number().optional(),
-  checkTimeoutMs: z.number().optional(),
-  jobTimeoutMs: z.number().optional()
-}).optional();
-var agentCheckSchema = z.strictObject({
-  label: z.string(),
-  command: z.string(),
-  args: z.array(z.string()).optional(),
-  required: z.boolean().optional(),
-  timeoutMs: z.number().optional()
-});
-var aiOptionsSchema = z.strictObject({
-  providers: z.record(
-    z.string(),
-    z.strictObject({
-      type: z.literal("openai-compatible"),
-      label: z.string(),
-      protocol: z.enum(["responses", "chat-completions"]),
-      authentication: z.enum(["bearer", "x-api-key"]).optional(),
-      baseURL: z.string(),
-      apiKeyEnv: z.string(),
-      models: z.record(
-        z.string(),
-        z.strictObject({ label: z.string(), model: z.string() })
-      ),
-      defaultModel: z.string()
-    })
-  ),
-  defaultProvider: z.string(),
-  execution: z.strictObject({
-    isolation: z.literal("git-worktree").optional(),
-    applyMode: z.enum(["review", "auto"]).optional(),
-    checks: z.record(z.string(), agentCheckSchema).optional(),
-    limits: agentLimitsSchema
-  }).optional()
-});
-var simpleAiOptionsSchema = z.strictObject({
-  baseURL: z.string(),
-  model: z.string(),
-  apiKeyEnv: z.string().optional(),
-  protocol: z.enum(["responses", "chat-completions"]).optional(),
-  authentication: z.enum(["bearer", "x-api-key"]).optional(),
-  providerLabel: z.string().optional(),
-  modelLabel: z.string().optional(),
-  execution: aiOptionsSchema.shape.execution
-});
-function assertIdentifier(value, label) {
-  if (!PROFILE_ID_PATTERN.test(value)) {
-    throw new RangeError(
-      `SpotPatch ${label} must contain only letters, numbers, dot, underscore, or hyphen.`
-    );
-  }
-}
-function nonEmpty(value, label, maximum = 256) {
-  const normalized = value.trim();
-  if (normalized.length === 0 || normalized.length > maximum || value.includes("\0")) {
-    throw new RangeError(`SpotPatch ${label} is invalid.`);
-  }
-  return normalized;
-}
-function normalizeProviderBaseURL(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new RangeError("SpotPatch AI provider baseURL must be a valid URL.");
-  }
-  const loopbackHosts = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
-  const allowedProtocol = url.protocol === "https:" || url.protocol === "http:" && loopbackHosts.has(url.hostname);
-  if (!allowedProtocol || url.username.length > 0 || url.password.length > 0 || url.search.length > 0 || url.hash.length > 0) {
-    throw new RangeError("SpotPatch AI provider baseURL violates URL policy.");
-  }
-  url.pathname = url.pathname.replace(/\/{2,}/g, "/").replace(/\/$/, "");
-  return url.toString().replace(/\/$/, "");
-}
-function resolveLimits(limits) {
-  const resolved = Object.freeze({
-    maxTurns: limits?.maxTurns ?? DEFAULT_AGENT_LIMITS.maxTurns,
-    maxToolCalls: limits?.maxToolCalls ?? DEFAULT_AGENT_LIMITS.maxToolCalls,
-    maxChangedFiles: limits?.maxChangedFiles ?? DEFAULT_AGENT_LIMITS.maxChangedFiles,
-    maxDiffBytes: limits?.maxDiffBytes ?? DEFAULT_AGENT_LIMITS.maxDiffBytes,
-    maxReadBytesPerFile: limits?.maxReadBytesPerFile ?? DEFAULT_AGENT_LIMITS.maxReadBytesPerFile,
-    maxToolOutputCharacters: limits?.maxToolOutputCharacters ?? DEFAULT_AGENT_LIMITS.maxToolOutputCharacters,
-    maxProviderResponseBytes: limits?.maxProviderResponseBytes ?? DEFAULT_AGENT_LIMITS.maxProviderResponseBytes,
-    providerConnectTimeoutMs: limits?.providerConnectTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerConnectTimeoutMs,
-    providerFirstByteTimeoutMs: limits?.providerFirstByteTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerFirstByteTimeoutMs,
-    providerIdleTimeoutMs: limits?.providerIdleTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerIdleTimeoutMs,
-    checkTimeoutMs: limits?.checkTimeoutMs ?? DEFAULT_AGENT_LIMITS.checkTimeoutMs,
-    jobTimeoutMs: limits?.jobTimeoutMs ?? DEFAULT_AGENT_LIMITS.jobTimeoutMs
-  });
-  for (const [name, value] of Object.entries(resolved)) {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-      throw new RangeError(`SpotPatch AI limit ${name} must be a positive integer.`);
-    }
-  }
-  return resolved;
-}
-function resolveModels(models) {
-  const entries = Object.entries(models);
-  if (entries.length === 0) {
-    throw new RangeError("SpotPatch AI provider must declare at least one model.");
-  }
-  return Object.freeze(
-    Object.fromEntries(
-      entries.map(([id, model]) => {
-        assertIdentifier(id, "model profile id");
-        return [
-          id,
-          Object.freeze({
-            id,
-            label: nonEmpty(model.label, "model label", 100),
-            model: nonEmpty(model.model, "provider model name")
-          })
-        ];
-      })
-    )
-  );
-}
-function resolveProviders(providers) {
-  const entries = Object.entries(providers);
-  if (entries.length === 0) {
-    throw new RangeError("SpotPatch AI must declare at least one provider.");
-  }
-  return Object.freeze(
-    Object.fromEntries(
-      entries.map(([id, provider]) => {
-        assertIdentifier(id, "provider profile id");
-        if (!ENV_NAME_PATTERN.test(provider.apiKeyEnv) || provider.apiKeyEnv.startsWith("VITE_")) {
-          throw new RangeError(
-            "SpotPatch AI apiKeyEnv must be an uppercase non-VITE environment name."
-          );
-        }
-        const models = resolveModels(provider.models);
-        if (!(provider.defaultModel in models)) {
-          throw new RangeError(
-            "SpotPatch AI provider defaultModel must reference a configured model."
-          );
-        }
-        return [
-          id,
-          Object.freeze({
-            id,
-            type: provider.type,
-            label: nonEmpty(provider.label, "provider label", 100),
-            protocol: provider.protocol,
-            authentication: provider.authentication ?? "bearer",
-            baseURL: normalizeProviderBaseURL(provider.baseURL),
-            apiKeyEnv: provider.apiKeyEnv,
-            models,
-            defaultModel: provider.defaultModel
-          })
-        ];
-      })
-    )
-  );
-}
-function resolveChecks(checks, defaultTimeoutMs) {
-  return Object.freeze(
-    Object.fromEntries(
-      Object.entries(checks ?? {}).map(([id, check]) => {
-        assertIdentifier(id, "check id");
-        const timeoutMs = check.timeoutMs ?? defaultTimeoutMs;
-        if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
-          throw new RangeError("SpotPatch AI check timeout must be positive.");
-        }
-        const args = Object.freeze(
-          [...check.args ?? []].map(
-            (argument) => nonEmpty(argument, "check argument", 4096)
-          )
-        );
-        return [
-          id,
-          Object.freeze({
-            id,
-            label: nonEmpty(check.label, "check label", 100),
-            command: nonEmpty(check.command, "check command", 1024),
-            args,
-            required: check.required ?? true,
-            timeoutMs
-          })
-        ];
-      })
-    )
-  );
-}
-function resolveAiOptions(options) {
-  if (options === void 0 || options === false) {
-    return false;
-  }
-  const expanded = "providers" in options ? options : (() => {
-    const simple = simpleAiOptionsSchema.safeParse(options);
-    if (!simple.success) {
-      throw new RangeError("SpotPatch AI configuration is invalid.");
-    }
-    const providerId = "default";
-    const modelId = "default";
-    return {
-      providers: {
-        [providerId]: {
-          type: "openai-compatible",
-          label: simple.data.providerLabel ?? "AI provider",
-          protocol: simple.data.protocol ?? "chat-completions",
-          authentication: simple.data.authentication ?? "bearer",
-          baseURL: simple.data.baseURL,
-          apiKeyEnv: simple.data.apiKeyEnv ?? "SPOTPATCH_AI_API_KEY",
-          models: {
-            [modelId]: {
-              label: simple.data.modelLabel ?? "AI model",
-              model: simple.data.model
-            }
-          },
-          defaultModel: modelId
-        }
-      },
-      defaultProvider: providerId,
-      ...simple.data.execution === void 0 ? {} : { execution: simple.data.execution }
-    };
-  })();
-  const parsed = aiOptionsSchema.safeParse(expanded);
-  if (!parsed.success) {
-    throw new RangeError("SpotPatch AI configuration is invalid.");
-  }
-  const validated = parsed.data;
-  const limits = resolveLimits(validated.execution?.limits);
-  const checks = resolveChecks(validated.execution?.checks, limits.checkTimeoutMs);
-  const applyMode = validated.execution?.applyMode ?? "review";
-  if (applyMode === "auto" && !Object.values(checks).some((check) => check.required)) {
-    throw new RangeError("SpotPatch AI auto mode requires a required check.");
-  }
-  const providers = resolveProviders(validated.providers);
-  if (!(validated.defaultProvider in providers)) {
-    throw new RangeError(
-      "SpotPatch AI defaultProvider must reference a configured provider."
-    );
-  }
-  return Object.freeze({
-    providers,
-    defaultProvider: validated.defaultProvider,
-    execution: Object.freeze({
-      isolation: "git-worktree",
-      applyMode,
-      checks,
-      limits
-    })
-  });
-}
-function createRuntimeAiConfig(options) {
-  if (options === false) {
-    return Object.freeze({ enabled: false });
-  }
-  return Object.freeze({
-    enabled: true,
-    defaultProvider: options.defaultProvider,
-    applyMode: options.execution.applyMode,
-    providers: Object.freeze(
-      Object.values(options.providers).map(
-        (provider) => Object.freeze({
-          id: provider.id,
-          label: provider.label,
-          protocol: provider.protocol,
-          defaultModel: provider.defaultModel,
-          models: Object.freeze(
-            Object.values(provider.models).map(
-              (model) => Object.freeze({ id: model.id, label: model.label })
-            )
-          )
-        })
-      )
-    )
-  });
-}
-function assertPositiveBudget(budget) {
-  for (const [name, value] of Object.entries(budget)) {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-      throw new RangeError(`SpotPatch budget ${name} must be a positive integer.`);
-    }
-  }
-}
-function resolveOptions(options = {}, environmentAi) {
-  const budget = Object.freeze({
-    ...DEFAULT_OPTIONS.budget,
-    ...options.budget
-  });
-  assertPositiveBudget(budget);
-  const maxTargets = options.maxTargets ?? DEFAULT_OPTIONS.maxTargets;
-  const locale = options.locale ?? DEFAULT_OPTIONS.locale;
-  const editor = options.editor ?? DEFAULT_OPTIONS.editor;
-  if (!SPOTPATCH_LOCALE_PREFERENCES.includes(locale)) {
-    throw new RangeError("SpotPatch locale must be auto, en-US, or zh-CN.");
-  }
-  if (!SPOTPATCH_EDITOR_PREFERENCES.includes(editor)) {
-    throw new RangeError("SpotPatch editor must be auto, vscode, or cursor.");
-  }
-  if (!Number.isSafeInteger(maxTargets) || maxTargets < 1 || maxTargets > MAX_ANNOTATION_TARGETS) {
-    throw new RangeError(
-      `SpotPatch maxTargets must be an integer between 1 and ${String(MAX_ANNOTATION_TARGETS)}.`
-    );
-  }
-  const resolved = {
-    enabled: options.enabled ?? DEFAULT_OPTIONS.enabled,
-    include: Object.freeze([...options.include ?? DEFAULT_OPTIONS.include]),
-    exclude: Object.freeze([...options.exclude ?? DEFAULT_OPTIONS.exclude]),
-    editor,
-    redact: options.redact ?? DEFAULT_OPTIONS.redact,
-    budget,
-    shortcut: options.shortcut ?? DEFAULT_OPTIONS.shortcut,
-    allowLan: options.allowLan ?? DEFAULT_OPTIONS.allowLan,
-    debug: options.debug ?? DEFAULT_OPTIONS.debug,
-    locale,
-    maxTargets,
-    ai: resolveAiOptions(options.ai ?? environmentAi)
-  };
-  if (resolved.shortcut.trim().length === 0) {
-    throw new RangeError("SpotPatch shortcut cannot be empty.");
-  }
-  return Object.freeze(resolved);
-}
-
-// src/registry/source-registry.ts
-import path from "path";
-
-// src/registry/source-id.ts
-import { randomBytes } from "crypto";
-var SOURCE_ID_BYTES = 8;
-var createRandomSourceId = () => randomBytes(SOURCE_ID_BYTES).toString("base64url");
-
-// src/registry/source-registry.ts
-function normalizeAbsolutePath(absolutePath) {
-  return path.normalize(path.resolve(absolutePath));
-}
-function createSourceRegistry(options = {}) {
-  const createId = options.createId ?? createRandomSourceId;
-  const pathToId = /* @__PURE__ */ new Map();
-  const idToPath = /* @__PURE__ */ new Map();
-  return Object.freeze({
-    register(absolutePath) {
-      const normalizedPath = normalizeAbsolutePath(absolutePath);
-      const existingId = pathToId.get(normalizedPath);
-      if (existingId !== void 0) {
-        return existingId;
-      }
-      let fileId = createId();
-      while (idToPath.has(fileId)) {
-        fileId = createId();
-      }
-      pathToId.set(normalizedPath, fileId);
-      idToPath.set(fileId, normalizedPath);
-      return fileId;
-    },
-    resolve(fileId) {
-      return idToPath.get(fileId);
-    },
-    clear() {
-      pathToId.clear();
-      idToPath.clear();
-    }
-  });
-}
+  createSession,
+  createSourceRegistry,
+  resolveCredentialEnvironment,
+  resolveEnvironmentAiConfiguration,
+  resolveOptions
+} from "@spotpatch/dev-server";
+import { loadEnv } from "vite";
 
 // src/runtime/runtime-injection-plugin.ts
 import { createRequire } from "module";
 import { readFileSync } from "fs";
-import path2 from "path";
+import path from "path";
+import { createRuntimeAiConfig } from "@spotpatch/dev-server";
 
 // package.json
 var package_default = {
   name: "@spotpatch/vite",
-  version: "1.4.0",
+  version: "1.4.2",
   description: "Vite development plugin for SpotPatch.",
   license: "MIT",
   repository: {
@@ -529,15 +66,11 @@ var package_default = {
     typecheck: "tsc --noEmit -p tsconfig.json"
   },
   dependencies: {
-    "@rollup/pluginutils": "5.4.0",
-    "@spotpatch/agent": "workspace:^",
+    "@spotpatch/compiler": "workspace:^",
+    "@spotpatch/dev-server": "workspace:^",
     "@spotpatch/react-adapter": "workspace:^",
     "@spotpatch/runtime": "workspace:^",
-    "@spotpatch/shared": "workspace:^",
-    "launch-editor": "2.14.1",
-    "magic-string": "1.1.0",
-    "oxc-parser": "0.143.0",
-    zod: "4.4.3"
+    "@spotpatch/shared": "workspace:^"
   },
   peerDependencies: {
     vite: "^5.0.0 || ^6.0.0 || ^7.0.0"
@@ -550,19 +83,67 @@ var package_default = {
 
 // src/runtime/runtime-injection-plugin.ts
 import { version as VITE_VERSION } from "vite";
+
+// ../runtime/src/ui/brand-mark-content.ts
+var BRAND_MARK_CONTENT = `
+  <defs>
+    <linearGradient id="locator-gradient" x1="76" y1="92" x2="436" y2="374" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#B61CFF" />
+      <stop offset="0.38" stop-color="#6D35FF" />
+      <stop offset="0.72" stop-color="#168EFF" />
+      <stop offset="1" stop-color="#00D9E9" />
+    </linearGradient>
+    <linearGradient id="left-code-gradient" x1="165" y1="166" x2="236" y2="258" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#A51EFF" />
+      <stop offset="1" stop-color="#653BFF" />
+    </linearGradient>
+    <linearGradient id="right-code-gradient" x1="276" y1="166" x2="347" y2="258" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#158DFF" />
+      <stop offset="1" stop-color="#00D8E9" />
+    </linearGradient>
+    <linearGradient id="bolt-gradient" x1="270" y1="111" x2="252" y2="365" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#6840FF" />
+      <stop offset="0.48" stop-color="#257BFF" />
+      <stop offset="1" stop-color="#00CBEF" />
+    </linearGradient>
+  </defs>
+  <path
+    fill="url(#locator-gradient)"
+    fill-rule="evenodd"
+    clip-rule="evenodd"
+    d="M256 52C345.47 52 418 124.53 418 214C418 267.55 391.98 316.24 354.04 348.02L256 468L157.96 348.02C120.02 316.24 94 267.55 94 214C94 124.53 166.53 52 256 52ZM256 88C186.41 88 130 144.41 130 214C130 258.2 152.76 297.08 187.2 319.57L256 403.8L324.8 319.57C359.24 297.08 382 258.2 382 214C382 144.41 325.59 88 256 88Z"
+  />
+  <rect x="238" y="20" width="36" height="84" rx="4" fill="url(#locator-gradient)" />
+  <rect x="62" y="196" width="84" height="36" rx="4" fill="url(#locator-gradient)" />
+  <rect x="366" y="196" width="84" height="36" rx="4" fill="url(#locator-gradient)" />
+  <path
+    d="M213.5 160L158 211.5L213.5 263L238 236.5L211 211.5L238 186.5L213.5 160Z"
+    fill="url(#left-code-gradient)"
+  />
+  <path
+    d="M298.5 160L354 211.5L298.5 263L274 236.5L301 211.5L274 186.5L298.5 160Z"
+    fill="url(#right-code-gradient)"
+  />
+  <path
+    d="M283 108L232 212L266 253L238 369L302 237L267 198L283 108Z"
+    fill="url(#bolt-gradient)"
+  />
+`;
+
+// src/runtime/runtime-injection-plugin.ts
 var SPOTPATCH_CLIENT_MODULE_ID = "virtual:spotpatch/client";
 var RESOLVED_SPOTPATCH_CLIENT_MODULE_ID = `\0${SPOTPATCH_CLIENT_MODULE_ID}`;
 var SPOTPATCH_REACT_ADAPTER_MODULE_ID = "virtual:spotpatch/react-adapter";
 var RESOLVED_SPOTPATCH_REACT_ADAPTER_MODULE_ID = `\0${SPOTPATCH_REACT_ADAPTER_MODULE_ID}`;
 function readRuntimeBundle(root, fileName) {
-  const resolveFromProject = createRequire(path2.join(root, "package.json"));
+  const resolveFromProject = createRequire(path.join(root, "package.json"));
   const packageEntry = resolveFromProject.resolve("@spotpatch/vite");
-  const bundlePath = path2.join(path2.dirname(packageEntry), fileName);
+  const bundlePath = path.join(path.dirname(packageEntry), fileName);
   return readFileSync(bundlePath, "utf8");
 }
 function readConsumerViteVersion(root) {
   try {
-    const resolveFromProject = createRequire(path2.join(root, "package.json"));
+    const resolveFromProject = createRequire(path.join(root, "package.json"));
     const manifestPath = resolveFromProject.resolve("vite/package.json");
     const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
     if (typeof manifest === "object" && manifest !== null && "version" in manifest && typeof manifest.version === "string") {
@@ -579,15 +160,18 @@ function createClientModule(input, clientBundle, viteVersion) {
     budget: options.budget,
     debug: options.debug,
     editor: options.editor,
+    framework: "vite",
+    frameworkVersion: viteVersion,
     locale: options.locale,
     maxTargets: options.maxTargets,
     redact: options.redact,
+    sessionId: input.session.id,
     sessionToken: input.session.token,
     shortcut: options.shortcut,
-    spotPatchVersion: package_default.version,
-    viteVersion
+    spotPatchVersion: package_default.version
   };
   return [
+    `const __SPOTPATCH_BRAND_MARK_CONTENT__ = ${JSON.stringify(BRAND_MARK_CONTENT)};`,
     `const __SPOTPATCH_RUNTIME_CONFIG__ = ${JSON.stringify(runtimeConfig)};`,
     clientBundle
   ].join("\n");
@@ -601,7 +185,7 @@ function createRuntimeInjectionPlugin(input) {
     apply: "serve",
     enforce: "pre",
     configResolved(config) {
-      root = path2.resolve(config.root);
+      root = path.resolve(config.root);
       viteVersion = readConsumerViteVersion(root);
     },
     resolveId(id, importer) {
@@ -639,1571 +223,11 @@ function createRuntimeInjectionPlugin(input) {
 }
 
 // src/server/server-plugin.ts
-import path6 from "path";
-
-// src/agent/job-manager.ts
-import { createHash, randomBytes as randomBytes2 } from "crypto";
-import {
-  applyPreparedAgentChange,
-  executeAgentChange,
-  inspectAgentWorkspace,
-  probeProviderCapability,
-  resolveProviderCredential,
-  revertPreparedAgentChange
-} from "@spotpatch/agent";
-import {
-  ERROR_CODES,
-  SpotPatchError
-} from "@spotpatch/shared";
-var MAX_RETAINED_JOBS = 32;
-var MAX_RETAINED_EVENTS = 512;
-var JOB_ID_PATTERN = /^[A-Za-z0-9_-]{22,128}$/;
-var ACTIVE_JOB_STATUSES = /* @__PURE__ */ new Set([
-  "queued",
-  "preparing",
-  "running",
-  "validating",
-  "awaiting-review",
-  "applying",
-  "cancelling",
-  "reverting"
-]);
-var CANCELLABLE_JOB_STATUSES = /* @__PURE__ */ new Set([
-  "queued",
-  "preparing",
-  "running",
-  "validating",
-  "awaiting-review"
-]);
-var PRUNABLE_JOB_STATUSES = /* @__PURE__ */ new Set([
-  "completed",
-  "cancelled",
-  "reverted",
-  "failed"
-]);
-var DEFAULT_DEPENDENCIES = Object.freeze({
-  applyChange: applyPreparedAgentChange,
-  createJobId: () => randomBytes2(16).toString("base64url"),
-  executeChange: executeAgentChange,
-  inspectWorkspace: inspectAgentWorkspace,
-  now: () => (/* @__PURE__ */ new Date()).toISOString(),
-  probeCapability: probeProviderCapability,
-  resolveCredential: resolveProviderCredential,
-  revertChange: revertPreparedAgentChange
-});
-function normalizeError(error) {
-  return error instanceof SpotPatchError ? error : new SpotPatchError(ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
-}
-function isActive(status) {
-  return ACTIVE_JOB_STATUSES.has(status);
-}
-function snapshot(job) {
-  const base = {
-    jobId: job.id,
-    status: job.status,
-    providerProfileId: job.provider.id,
-    providerLabel: job.provider.label,
-    modelProfileId: job.model.id,
-    modelLabel: job.model.label,
-    phaseMessage: job.phaseMessage,
-    createdAt: job.createdAt,
-    updatedAt: job.updatedAt,
-    canCancel: CANCELLABLE_JOB_STATUSES.has(job.status),
-    canApply: job.status === "awaiting-review" && job.preparedChange?.validationPassed === true && job.result !== void 0 && job.result.diff.length > 0,
-    canRevert: job.status === "applied"
-  };
-  return Object.freeze(
-    job.errorCode === void 0 ? base : { ...base, errorCode: job.errorCode }
-  );
-}
-function capabilityCacheKey(provider, model) {
-  const configurationDigest = createHash("sha256").update(provider.baseURL).update("\0").update(provider.protocol).update("\0").update(provider.authentication).digest("hex");
-  return `${provider.id}:${model.id}:${configurationDigest}`;
-}
-function freezeEvent(event) {
-  return Object.freeze(event);
-}
-function createAgentJobManager(options) {
-  const dependencies = Object.freeze({
-    ...DEFAULT_DEPENDENCIES,
-    ...options.dependencies
-  });
-  const jobs = /* @__PURE__ */ new Map();
-  const capabilityCache = /* @__PURE__ */ new Map();
-  const providerConsents = /* @__PURE__ */ new Set();
-  let closed = false;
-  const resolveSelection = (providerProfileId, modelProfileId) => {
-    const provider = options.ai.providers[providerProfileId];
-    if (provider === void 0) {
-      throw new SpotPatchError(ERROR_CODES.PROVIDER_NOT_CONFIGURED);
-    }
-    const model = provider.models[modelProfileId];
-    if (model === void 0) {
-      throw new SpotPatchError(ERROR_CODES.MODEL_NOT_ALLOWED);
-    }
-    const credential = dependencies.resolveCredential(
-      provider.apiKeyEnv,
-      options.environment
-    );
-    return Object.freeze({ credential, model, provider });
-  };
-  const requireJob = (jobId) => {
-    if (!JOB_ID_PATTERN.test(jobId)) {
-      throw new SpotPatchError(ERROR_CODES.INVALID_REQUEST);
-    }
-    const job = jobs.get(jobId);
-    if (job === void 0) {
-      throw new SpotPatchError(ERROR_CODES.INVALID_REQUEST);
-    }
-    return job;
-  };
-  const appendEvent = (job, event) => {
-    job.events.push(event);
-    if (job.events.length > MAX_RETAINED_EVENTS) {
-      job.events.splice(0, job.events.length - MAX_RETAINED_EVENTS);
-    }
-    for (const listener of job.listeners) {
-      listener(event);
-    }
-  };
-  const eventBase = (job) => {
-    job.sequence += 1;
-    return {
-      schemaVersion: 2,
-      sequence: job.sequence,
-      jobId: job.id,
-      status: job.status,
-      timestamp: dependencies.now()
-    };
-  };
-  const emitSnapshot = (job) => {
-    appendEvent(
-      job,
-      freezeEvent({
-        ...eventBase(job),
-        type: "snapshot",
-        data: Object.freeze({ snapshot: snapshot(job) })
-      })
-    );
-  };
-  const emitPhase = (job, message) => {
-    appendEvent(
-      job,
-      freezeEvent({
-        ...eventBase(job),
-        type: "phase",
-        data: Object.freeze({ message })
-      })
-    );
-  };
-  const emitError = (job, code) => {
-    appendEvent(
-      job,
-      freezeEvent({
-        ...eventBase(job),
-        type: "error",
-        data: Object.freeze({ code, message: "The Agent job failed." })
-      })
-    );
-  };
-  const transition = (job, status, phaseMessage, errorCode) => {
-    job.status = status;
-    job.phaseMessage = phaseMessage;
-    job.errorCode = errorCode;
-    job.updatedAt = dependencies.now();
-    emitSnapshot(job);
-    emitPhase(job, phaseMessage);
-  };
-  const probeResolved = async (selection, signal) => {
-    const key = capabilityCacheKey(selection.provider, selection.model);
-    const cached = capabilityCache.get(key);
-    if (cached !== void 0) {
-      return cached;
-    }
-    const capability = await dependencies.probeCapability({
-      provider: selection.provider,
-      modelProfileId: selection.model.id,
-      limits: options.ai.execution.limits,
-      credential: selection.credential,
-      signal,
-      ...options.fetch === void 0 ? {} : { fetch: options.fetch }
-    });
-    if (capability.state !== "agent-ready") {
-      throw new SpotPatchError(ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED);
-    }
-    capabilityCache.set(key, capability);
-    return capability;
-  };
-  const finishWithError = (job, error) => {
-    const normalized = normalizeError(error);
-    const cancelled = job.controller.signal.aborted || normalized.code === ERROR_CODES.AGENT_CANCELLED;
-    transition(
-      job,
-      cancelled ? "cancelled" : "failed",
-      cancelled ? "Agent job cancelled." : "Agent job failed.",
-      cancelled ? ERROR_CODES.AGENT_CANCELLED : normalized.code
-    );
-    if (!cancelled) {
-      emitError(job, normalized.code);
-    }
-  };
-  const applyChange = async (job, preparedChange) => {
-    transition(job, "applying", "Applying validated changes to the project.");
-    try {
-      await dependencies.applyChange(preparedChange);
-      transition(job, "applied", "Changes were applied to local project files.");
-    } catch (error) {
-      const normalized = normalizeError(error);
-      transition(job, "failed", "Agent change could not be applied.", normalized.code);
-      emitError(job, normalized.code);
-      throw normalized;
-    }
-  };
-  const runJob = async (job) => {
-    try {
-      transition(job, "preparing", "Verifying provider and model capabilities.");
-      await probeResolved(
-        Object.freeze({
-          credential: job.credential,
-          model: job.model,
-          provider: job.provider
-        }),
-        job.controller.signal
-      );
-      const callbacks = {
-        onCheck(result) {
-          appendEvent(
-            job,
-            freezeEvent({
-              ...eventBase(job),
-              type: "check",
-              data: Object.freeze({ result })
-            })
-          );
-        },
-        onPhase(event) {
-          transition(job, event.phase, event.message);
-        },
-        onTool(event) {
-          appendEvent(
-            job,
-            freezeEvent({
-              ...eventBase(job),
-              type: "tool",
-              data: Object.freeze({ ...event })
-            })
-          );
-        }
-      };
-      const preparedChange = await dependencies.executeChange({
-        annotation: job.annotation,
-        callbacks,
-        credential: job.credential,
-        execution: options.ai.execution,
-        jobId: job.id,
-        model: job.model,
-        provider: job.provider,
-        root: options.root,
-        signal: job.controller.signal,
-        workingTreeMode: job.workingTreeMode,
-        ...options.fetch === void 0 ? {} : { fetch: options.fetch }
-      });
-      job.preparedChange = preparedChange;
-      job.result = preparedChange.result;
-      appendEvent(
-        job,
-        freezeEvent({
-          ...eventBase(job),
-          type: "result-ready",
-          data: Object.freeze({ hasResult: true })
-        })
-      );
-      if (!preparedChange.validationPassed) {
-        transition(
-          job,
-          "failed",
-          "Required validation checks failed.",
-          ERROR_CODES.VALIDATION_FAILED
-        );
-        emitError(job, ERROR_CODES.VALIDATION_FAILED);
-        return;
-      }
-      if (preparedChange.result.diff.length === 0) {
-        transition(job, "completed", "No source changes were proposed.");
-        return;
-      }
-      if (options.ai.execution.applyMode === "auto" && preparedChange.autoApplyEligible) {
-        try {
-          await applyChange(job, preparedChange);
-        } catch {
-        }
-        return;
-      }
-      transition(job, "awaiting-review", "Validated changes are ready for review.");
-    } catch (error) {
-      finishWithError(job, error);
-    }
-  };
-  const hasActiveJob = (excludedJobId) => [...jobs.values()].some((job) => job.id !== excludedJobId && isActive(job.status));
-  const pruneJobs = () => {
-    if (jobs.size < MAX_RETAINED_JOBS) {
-      return;
-    }
-    for (const [jobId, job] of jobs) {
-      if (PRUNABLE_JOB_STATUSES.has(job.status)) {
-        jobs.delete(jobId);
-      }
-      if (jobs.size < MAX_RETAINED_JOBS) {
-        return;
-      }
-    }
-  };
-  return Object.freeze({
-    async apply(jobId) {
-      const job = requireJob(jobId);
-      if (job.status !== "awaiting-review" || job.preparedChange === void 0 || !job.preparedChange.validationPassed || job.result?.diff.length === 0) {
-        throw new SpotPatchError(ERROR_CODES.PATCH_REJECTED);
-      }
-      await applyChange(job, job.preparedChange);
-      return snapshot(job);
-    },
-    cancel(jobId) {
-      const job = requireJob(jobId);
-      if (!CANCELLABLE_JOB_STATUSES.has(job.status)) {
-        return snapshot(job);
-      }
-      if (job.status === "awaiting-review") {
-        job.preparedChange = void 0;
-        job.controller.abort("agent-review-cancelled");
-        transition(
-          job,
-          "cancelled",
-          "Agent review was closed without applying changes.",
-          ERROR_CODES.AGENT_CANCELLED
-        );
-        return snapshot(job);
-      }
-      transition(job, "cancelling", "Cancelling Agent job.");
-      job.controller.abort("agent-job-cancelled");
-      return snapshot(job);
-    },
-    async close() {
-      if (closed) {
-        return;
-      }
-      closed = true;
-      for (const job of jobs.values()) {
-        if (CANCELLABLE_JOB_STATUSES.has(job.status)) {
-          job.controller.abort("vite-server-closed");
-        }
-      }
-      await Promise.allSettled(
-        [...jobs.values()].map((job) => job.runPromise).filter((promise) => promise !== void 0)
-      );
-      capabilityCache.clear();
-      providerConsents.clear();
-      jobs.clear();
-    },
-    create(request) {
-      if (closed) {
-        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
-      }
-      if (hasActiveJob()) {
-        throw new SpotPatchError(ERROR_CODES.AGENT_BUSY);
-      }
-      pruneJobs();
-      if (jobs.size >= MAX_RETAINED_JOBS) {
-        throw new SpotPatchError(ERROR_CODES.AGENT_BUSY);
-      }
-      const selection = resolveSelection(
-        request.providerProfileId,
-        request.modelProfileId
-      );
-      providerConsents.add(selection.provider.id);
-      const id = dependencies.createJobId();
-      if (!JOB_ID_PATTERN.test(id) || jobs.has(id)) {
-        throw new SpotPatchError(ERROR_CODES.INTERNAL_ERROR);
-      }
-      const timestamp = dependencies.now();
-      const job = {
-        annotation: request.annotation,
-        controller: new AbortController(),
-        createdAt: timestamp,
-        credential: selection.credential,
-        errorCode: void 0,
-        events: [],
-        id,
-        listeners: /* @__PURE__ */ new Set(),
-        model: selection.model,
-        phaseMessage: "Agent job queued.",
-        preparedChange: void 0,
-        provider: selection.provider,
-        result: void 0,
-        runPromise: void 0,
-        sequence: 0,
-        status: "queued",
-        updatedAt: timestamp,
-        workingTreeMode: request.workingTreeMode
-      };
-      jobs.set(id, job);
-      emitSnapshot(job);
-      emitPhase(job, job.phaseMessage);
-      job.runPromise = Promise.resolve().then(async () => runJob(job));
-      return snapshot(job);
-    },
-    events(jobId) {
-      return Object.freeze([...requireJob(jobId).events]);
-    },
-    async probe(request, signal) {
-      if (closed) {
-        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
-      }
-      return probeResolved(
-        resolveSelection(request.providerProfileId, request.modelProfileId),
-        signal
-      );
-    },
-    result(jobId) {
-      const job = requireJob(jobId);
-      const response = job.result === void 0 ? { snapshot: snapshot(job) } : { snapshot: snapshot(job), result: job.result };
-      return Object.freeze(response);
-    },
-    async revert(jobId) {
-      const job = requireJob(jobId);
-      if (job.status !== "applied" || job.preparedChange === void 0 || hasActiveJob(job.id)) {
-        throw new SpotPatchError(
-          hasActiveJob(job.id) ? ERROR_CODES.AGENT_BUSY : ERROR_CODES.APPLY_CONFLICT
-        );
-      }
-      transition(job, "reverting", "Reverting the applied Agent change.");
-      try {
-        await dependencies.revertChange(job.preparedChange);
-        transition(job, "reverted", "The Agent change was safely reverted.");
-      } catch (error) {
-        const normalized = normalizeError(error);
-        transition(
-          job,
-          "applied",
-          "Revert was rejected because project files changed.",
-          normalized.code
-        );
-        emitError(job, normalized.code);
-        throw normalized;
-      }
-      return snapshot(job);
-    },
-    subscribe(jobId, listener) {
-      const job = requireJob(jobId);
-      job.listeners.add(listener);
-      return () => {
-        job.listeners.delete(listener);
-      };
-    },
-    workspaceHealth(signal) {
-      if (closed) {
-        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
-      }
-      return dependencies.inspectWorkspace(options.root, signal);
-    }
-  });
-}
-
-// src/server/middleware.ts
-import {
-  ERROR_CODES as ERROR_CODES8,
-  SPOTPATCH_API_BASE,
-  SPOTPATCH_ENDPOINTS as SPOTPATCH_ENDPOINTS2,
-  SpotPatchError as SpotPatchError8,
-  openEditorRequestSchema,
-  sourceContextRequestSchema
-} from "@spotpatch/shared";
-
-// src/server/agent-http.ts
-import {
-  ERROR_CODES as ERROR_CODES6,
-  SPOTPATCH_ENDPOINTS,
-  SpotPatchError as SpotPatchError6,
-  agentCapabilityRequestSchema,
-  agentJobActionRequestSchema,
-  agentJobCreateRequestSchema,
-  agentWorkspaceHealthRequestSchema
-} from "@spotpatch/shared";
-
-// src/server/agent-request.ts
-import { realpath as realpath3 } from "fs/promises";
-import path5 from "path";
-import {
-  ERROR_CODES as ERROR_CODES4,
-  SpotPatchError as SpotPatchError4
-} from "@spotpatch/shared";
-
-// src/server/source-context.ts
-import { readFile, realpath as realpath2 } from "fs/promises";
-import path4 from "path";
-import {
-  ERROR_CODES as ERROR_CODES3,
-  SpotPatchError as SpotPatchError3
-} from "@spotpatch/shared";
-
-// src/server/extract-code-context.ts
+import path2 from "path";
 import {
-  parseSync,
-  Visitor
-} from "oxc-parser";
-function isComponentName(name) {
-  return /^[A-Z]/u.test(name);
-}
-function unwrapTypeExpression(expression) {
-  switch (expression.type) {
-    case "TSAsExpression":
-    case "TSSatisfiesExpression":
-    case "TSTypeAssertion":
-    case "TSNonNullExpression":
-    case "TSInstantiationExpression":
-      return unwrapTypeExpression(expression.expression);
-    default:
-      return expression;
-  }
-}
-function calleeName(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  if (unwrapped.type === "Identifier") {
-    return unwrapped.name;
-  }
-  if (unwrapped.type === "MemberExpression" && !unwrapped.computed) {
-    return unwrapped.property.type === "Identifier" ? unwrapped.property.name : void 0;
-  }
-  return void 0;
-}
-function isFunctionExpression(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  return unwrapped.type === "ArrowFunctionExpression" || unwrapped.type === "FunctionExpression";
-}
-function isSupportedComponentInitializer(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  if (isFunctionExpression(unwrapped)) {
-    return true;
-  }
-  if (unwrapped.type !== "CallExpression") {
-    return false;
-  }
-  const name = calleeName(unwrapped.callee);
-  if (name !== "memo" && name !== "forwardRef") {
-    return false;
-  }
-  const firstArgument = unwrapped.arguments[0];
-  return firstArgument !== void 0 && firstArgument.type !== "SpreadElement" && (isFunctionExpression(firstArgument) || isSupportedComponentInitializer(firstArgument));
-}
-function variableComponent(node) {
-  if (node.id.type !== "Identifier" || !isComponentName(node.id.name) || node.init === null || !isSupportedComponentInitializer(node.init)) {
-    return void 0;
-  }
-  return Object.freeze({ start: node.start, end: node.end, name: node.id.name });
-}
-function functionComponent(node) {
-  return node.id !== null && isComponentName(node.id.name) && node.body !== null ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
-}
-function isReactComponentSuperclass(expression) {
-  if (expression === null) {
-    return false;
-  }
-  const unwrapped = unwrapTypeExpression(expression);
-  if (unwrapped.type === "Identifier") {
-    return unwrapped.name === "Component" || unwrapped.name === "PureComponent";
-  }
-  return unwrapped.type === "MemberExpression" && !unwrapped.computed && unwrapped.object.type === "Identifier" && unwrapped.object.name === "React" && (unwrapped.property.name === "Component" || unwrapped.property.name === "PureComponent");
-}
-function classComponent(node) {
-  return node.id !== null && isComponentName(node.id.name) && isReactComponentSuperclass(node.superClass) ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
-}
-function selectedOffset(source, line, column) {
-  const lines = source.split(/\r?\n/u);
-  if (line < 1 || line > lines.length) {
-    return void 0;
-  }
-  const lineStart = lines.slice(0, line - 1).reduce((total, value) => total + value.length + 1, 0);
-  const lineLength = lines[line - 1]?.length ?? 0;
-  return lineStart + Math.min(Math.max(0, column - 1), lineLength);
-}
-function findComponentSpan(options) {
-  const offset = selectedOffset(options.source, options.line, options.column);
-  if (offset === void 0) {
-    return void 0;
-  }
-  let parseResult;
-  try {
-    parseResult = parseSync(options.sourcePath, options.source, {
-      sourceType: "module"
-    });
-  } catch {
-    return void 0;
-  }
-  if (parseResult.errors.length > 0) {
-    return void 0;
-  }
-  const jsxNodes = [];
-  const components = [];
-  const visitor = new Visitor({
-    JSXElement(node) {
-      jsxNodes.push(node);
-    },
-    JSXFragment(node) {
-      jsxNodes.push(node);
-    },
-    FunctionDeclaration(node) {
-      const candidate = functionComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
-      }
-    },
-    VariableDeclarator(node) {
-      const candidate = variableComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
-      }
-    },
-    ClassDeclaration(node) {
-      const candidate = classComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
-      }
-    }
-  });
-  visitor.visit(parseResult.program);
-  const selectedJsx = jsxNodes.filter((node) => node.start <= offset && node.end >= offset).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
-  if (selectedJsx === void 0) {
-    return void 0;
-  }
-  return components.filter(
-    (component) => component.start <= selectedJsx.start && component.end >= selectedJsx.end
-  ).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
-}
-function lineAtOffset(source, offset) {
-  let line = 1;
-  for (let index = 0; index < offset; index += 1) {
-    if (source[index] === "\n") {
-      line += 1;
-    }
-  }
-  return line;
-}
-function componentRange(source, component) {
-  return Object.freeze({
-    startLine: lineAtOffset(source, component.start),
-    endLine: lineAtOffset(source, Math.max(component.start, component.end - 1))
-  });
-}
-function truncateSelectedLine(line, column, maxCharacters) {
-  if (line.length <= maxCharacters) {
-    return line;
-  }
-  if (maxCharacters === 1) {
-    return "\u2026";
-  }
-  const contentCharacters = maxCharacters - 2;
-  const desiredStart = Math.max(0, column - 1 - Math.floor(contentCharacters / 2));
-  const start = Math.min(desiredStart, line.length - contentCharacters);
-  const end = start + contentCharacters;
-  return `${start > 0 ? "\u2026" : ""}${line.slice(start, end)}${end < line.length ? "\u2026" : ""}`.slice(
-    0,
-    maxCharacters
-  );
-}
-function boundedRange(lines, selectedLine, column, initialStart, initialEnd, maxCharacters) {
-  let startLine = initialStart;
-  let endLine = initialEnd;
-  let excerpt = lines.slice(startLine - 1, endLine).join("\n");
-  while (excerpt.length > maxCharacters && startLine < endLine) {
-    if (endLine - selectedLine >= selectedLine - startLine) {
-      endLine -= 1;
-    } else {
-      startLine += 1;
-    }
-    excerpt = lines.slice(startLine - 1, endLine).join("\n");
-  }
-  if (excerpt.length > maxCharacters) {
-    startLine = selectedLine;
-    endLine = selectedLine;
-    excerpt = truncateSelectedLine(
-      lines[selectedLine - 1] ?? "",
-      column,
-      maxCharacters
-    );
-  }
-  return Object.freeze({ startLine, endLine, excerpt });
-}
-function nearbyContext(options) {
-  const lines = options.source.split(/\r?\n/u);
-  const initialStart = Math.max(1, options.line - Math.floor(options.maxLines / 2));
-  const initialEnd = Math.min(lines.length, initialStart + options.maxLines - 1);
-  const startLine = Math.max(1, initialEnd - options.maxLines + 1);
-  const bounded = boundedRange(
-    lines,
-    options.line,
-    options.column,
-    startLine,
-    initialEnd,
-    options.maxCharacters
-  );
-  return Object.freeze({
-    relativePath: options.relativePath,
-    language: options.language,
-    startLine: bounded.startLine,
-    endLine: bounded.endLine,
-    excerpt: bounded.excerpt,
-    boundary: "nearby-lines"
-  });
-}
-function extractCodeContext(options) {
-  const component = findComponentSpan(options);
-  if (component !== void 0) {
-    const range = componentRange(options.source, component);
-    const lineCount = range.endLine - range.startLine + 1;
-    const excerpt = options.source.split(/\r?\n/u).slice(range.startLine - 1, range.endLine).join("\n");
-    if (lineCount <= options.maxLines && excerpt.length <= options.maxCharacters) {
-      return Object.freeze({
-        relativePath: options.relativePath,
-        language: options.language,
-        startLine: range.startLine,
-        endLine: range.endLine,
-        excerpt,
-        boundary: "component"
-      });
-    }
-  }
-  return nearbyContext(options);
-}
-
-// src/server/source-file.ts
-import { realpath, stat } from "fs/promises";
-import path3 from "path";
-import { ERROR_CODES as ERROR_CODES2, SpotPatchError as SpotPatchError2 } from "@spotpatch/shared";
-
-// src/server/constants.ts
-var MAX_REQUEST_BODY_BYTES = 32 * 1024;
-var MAX_AGENT_REQUEST_BODY_BYTES = 256 * 1024;
-var MAX_SOURCE_FILE_BYTES = 1024 * 1024;
-
-// src/server/source-file.ts
-var ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([".jsx", ".tsx"]);
-function isMissingFileError(error) {
-  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
-}
-async function assertInsideRoot(root, candidate) {
-  let realRoot;
-  let realCandidate;
-  try {
-    [realRoot, realCandidate] = await Promise.all([
-      realpath(root),
-      realpath(candidate)
-    ]);
-  } catch (error) {
-    if (isMissingFileError(error)) {
-      throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND, void 0, {
-        cause: error
-      });
-    }
-    throw error;
-  }
-  const relative = path3.relative(realRoot, realCandidate);
-  const outside = relative.startsWith(`..${path3.sep}`) || relative === ".." || path3.isAbsolute(relative);
-  if (outside) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_OUTSIDE_ROOT);
-  }
-  return realCandidate;
-}
-async function resolveSourceFile(options) {
-  const registeredPath = options.registry.resolve(options.fileId);
-  if (registeredPath === void 0) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
-  }
-  const sourcePath = await assertInsideRoot(options.root, registeredPath);
-  if (!ALLOWED_EXTENSIONS.has(path3.extname(sourcePath).toLowerCase())) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
-  }
-  let sourceStat;
-  try {
-    sourceStat = await stat(sourcePath);
-  } catch (error) {
-    if (isMissingFileError(error)) {
-      throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND, void 0, {
-        cause: error
-      });
-    }
-    throw error;
-  }
-  if (!sourceStat.isFile()) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
-  }
-  if (sourceStat.size > MAX_SOURCE_FILE_BYTES) {
-    throw new SpotPatchError2(ERROR_CODES2.SOURCE_TOO_LARGE);
-  }
-  return sourcePath;
-}
-
-// src/server/source-context.ts
-function toDisplayPath(root, sourcePath) {
-  return path4.relative(root, sourcePath).split(path4.sep).join("/");
-}
-async function readSourceContext(options) {
-  const sourcePath = await resolveSourceFile({
-    fileId: options.request.fileId,
-    registry: options.registry,
-    root: options.root
-  });
-  let source;
-  try {
-    source = await readFile(sourcePath, "utf8");
-  } catch (error) {
-    if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
-      throw new SpotPatchError3(ERROR_CODES3.SOURCE_NOT_FOUND, void 0, {
-        cause: error
-      });
-    }
-    throw error;
-  }
-  const lines = source.split(/\r?\n/);
-  if (options.request.line > lines.length) {
-    throw new SpotPatchError3(ERROR_CODES3.INVALID_REQUEST);
-  }
-  const extension = path4.extname(sourcePath).toLowerCase();
-  return extractCodeContext({
-    source,
-    sourcePath,
-    relativePath: toDisplayPath(await realpath2(options.root), sourcePath),
-    language: extension === ".tsx" ? "tsx" : "jsx",
-    line: options.request.line,
-    column: options.request.column,
-    maxLines: Math.min(options.request.maxLines, options.maxLines),
-    maxCharacters: options.maxCharacters
-  });
-}
-
-// src/server/agent-request.ts
-function compactSourceRef(source) {
-  return Object.freeze({
-    origin: source.origin,
-    confidence: source.confidence,
-    ...source.fileId === void 0 ? {} : { fileId: source.fileId },
-    ...source.relativePath === void 0 ? {} : { relativePath: source.relativePath },
-    ...source.line === void 0 ? {} : { line: source.line },
-    ...source.column === void 0 ? {} : { column: source.column }
-  });
-}
-async function authorizeSourceRef(source, registry, root) {
-  const markerOrigin = source.origin === "jsx-host" || source.origin === "dom-ancestor";
-  if (markerOrigin && (source.fileId === void 0 || source.line === void 0 || source.column === void 0)) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  if (source.fileId === void 0) {
-    if (source.origin === "none" && source.relativePath !== void 0) {
-      throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-    }
-    return compactSourceRef(source);
-  }
-  const sourcePath = await resolveSourceFile({
-    fileId: source.fileId,
-    registry,
-    root
-  });
-  const relativePath = path5.relative(await realpath3(root), sourcePath).split(path5.sep).join("/");
-  if (source.relativePath !== void 0 && source.relativePath !== relativePath) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  return Object.freeze({
-    ...compactSourceRef(source),
-    relativePath
-  });
-}
-function freezeMatchedRule(rule) {
-  return Object.freeze({
-    selector: rule.selector,
-    declarations: rule.declarations,
-    ...rule.source === void 0 ? {} : { source: rule.source },
-    ...rule.media === void 0 ? {} : { media: rule.media }
-  });
-}
-function targetIdentity(target) {
-  const source = target.source;
-  if (source.fileId !== void 0 && source.line !== void 0 && source.column !== void 0) {
-    return `source:${source.fileId}:${String(source.line)}:${String(source.column)}`;
-  }
-  return [
-    "element",
-    source.origin,
-    source.relativePath ?? "",
-    target.element.selector,
-    target.element.sanitizedHtml
-  ].join("\0");
-}
-async function authorizeTarget(target, input) {
-  const source = await authorizeSourceRef(target.source, input.registry, input.root);
-  const reactSourceInput = target.react.source;
-  const reactSource = reactSourceInput === void 0 ? void 0 : await authorizeSourceRef(reactSourceInput, input.registry, input.root);
-  const marker = source.fileId === void 0 || source.line === void 0 || source.column === void 0 ? void 0 : Object.freeze({
-    fileId: source.fileId,
-    line: source.line,
-    column: source.column,
-    maxLines: input.options.budget.maxCodeLines
-  });
-  if (marker === void 0 && target.code !== void 0) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  const code = marker === void 0 ? void 0 : await readSourceContext({
-    request: marker,
-    registry: input.registry,
-    root: input.root,
-    maxCharacters: input.options.budget.codeCharacters,
-    maxLines: input.options.budget.maxCodeLines
-  });
-  if (target.code !== void 0 && target.code.relativePath !== code?.relativePath) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  return Object.freeze({
-    instruction: target.instruction,
-    source,
-    react: Object.freeze({
-      supported: target.react.supported,
-      ...target.react.version === void 0 ? {} : { version: target.react.version },
-      ...target.react.componentName === void 0 ? {} : { componentName: target.react.componentName },
-      componentStack: Object.freeze([...target.react.componentStack]),
-      ...reactSource === void 0 ? {} : { source: reactSource }
-    }),
-    element: Object.freeze({
-      tagName: target.element.tagName,
-      selector: target.element.selector,
-      sanitizedHtml: target.element.sanitizedHtml,
-      ...target.element.textPreview === void 0 ? {} : { textPreview: target.element.textPreview },
-      ...target.element.role === void 0 ? {} : { role: target.element.role },
-      rect: Object.freeze({ ...target.element.rect })
-    }),
-    styles: Object.freeze({
-      classNames: Object.freeze([...target.styles.classNames]),
-      ...target.styles.inlineStyle === void 0 ? {} : { inlineStyle: target.styles.inlineStyle },
-      matchedRules: Object.freeze(target.styles.matchedRules.map(freezeMatchedRule)),
-      computed: Object.freeze({ ...target.styles.computed }),
-      warnings: Object.freeze([...target.styles.warnings])
-    }),
-    ...code === void 0 ? {} : { code: Object.freeze({ ...code }) },
-    warnings: Object.freeze([...target.warnings])
-  });
-}
-async function authorizeAgentJobRequest(input) {
-  const requestedTargets = input.request.annotation.targets;
-  if (requestedTargets.length > input.options.maxTargets) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  const identities = requestedTargets.map(targetIdentity);
-  if (new Set(identities).size !== identities.length) {
-    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
-  }
-  const targets = Object.freeze(
-    await Promise.all(requestedTargets.map((target) => authorizeTarget(target, input)))
-  );
-  const annotation = Object.freeze({
-    schemaVersion: 3,
-    id: input.request.annotation.id,
-    locale: input.request.annotation.locale,
-    page: Object.freeze({ ...input.request.annotation.page }),
-    targets,
-    createdAt: input.request.annotation.createdAt
-  });
-  return Object.freeze({
-    annotation,
-    providerProfileId: input.request.providerProfileId,
-    modelProfileId: input.request.modelProfileId,
-    providerDataConsent: true,
-    workingTreeMode: input.request.workingTreeMode
-  });
-}
-
-// src/server/request-body.ts
-import { ERROR_CODES as ERROR_CODES5, SpotPatchError as SpotPatchError5 } from "@spotpatch/shared";
-function isJsonContentType(value) {
-  return value?.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
-}
-async function readJsonRequestBody(request, maximumBytes = MAX_REQUEST_BODY_BYTES) {
-  if (!isJsonContentType(request.headers["content-type"])) {
-    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
-  }
-  const declaredLength = Number(request.headers["content-length"]);
-  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {
-    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
-  }
-  const chunks = [];
-  let byteLength = 0;
-  let exceededLimit = false;
-  for await (const rawChunk of request) {
-    const chunk = rawChunk;
-    if (typeof chunk !== "string" && !(chunk instanceof Uint8Array)) {
-      throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
-    }
-    const buffer = Buffer.from(chunk);
-    byteLength += buffer.byteLength;
-    if (byteLength > maximumBytes) {
-      exceededLimit = true;
-      continue;
-    }
-    chunks.push(buffer);
-  }
-  if (exceededLimit || byteLength === 0) {
-    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
-  }
-  try {
-    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-  } catch (error) {
-    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST, void 0, {
-      cause: error
-    });
-  }
-}
-
-// src/server/agent-http.ts
-var AGENT_JOB_ID_PATTERN = /^[A-Za-z0-9_-]{22,128}$/;
-var AGENT_JOB_ACTIONS = /* @__PURE__ */ new Set([
-  "events",
-  "result",
-  "cancel",
-  "apply",
-  "revert"
-]);
-var EVENT_STREAM_END_STATUSES = /* @__PURE__ */ new Set([
-  "awaiting-review",
-  "applied",
-  "completed",
-  "cancelled",
-  "reverted",
-  "failed"
-]);
-function matchAgentRequestPath(path11) {
-  if (path11 === SPOTPATCH_ENDPOINTS.agentCapability) {
-    return Object.freeze({ kind: "capability" });
-  }
-  if (path11 === SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
-    return Object.freeze({ kind: "workspace-health" });
-  }
-  if (path11 === SPOTPATCH_ENDPOINTS.agentJobs) {
-    return Object.freeze({ kind: "create-job" });
-  }
-  const prefix = `${SPOTPATCH_ENDPOINTS.agentJobs}/`;
-  if (!path11.startsWith(prefix)) {
-    return void 0;
-  }
-  const segments = path11.slice(prefix.length).split("/");
-  const jobId = segments[0];
-  const action = segments[1];
-  if (segments.length !== 2 || jobId === void 0 || !AGENT_JOB_ID_PATTERN.test(jobId) || action === void 0 || !AGENT_JOB_ACTIONS.has(action)) {
-    return void 0;
-  }
-  return Object.freeze({
-    kind: "job-action",
-    action,
-    jobId
-  });
-}
-function requireAgentManager(options) {
-  if (options.agentManager === void 0 || options.options.ai === false) {
-    throw new SpotPatchError6(ERROR_CODES6.AI_DISABLED);
-  }
-  return options.agentManager;
-}
-function writeNdjsonEvent(response, event) {
-  response.write(`${JSON.stringify(event)}
-`);
-}
-function streamAgentJobEvents(response, manager, jobId) {
-  const events = manager.events(jobId);
-  const current = manager.result(jobId).snapshot;
-  response.statusCode = 200;
-  response.setHeader("Cache-Control", "no-store");
-  response.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
-  response.setHeader("X-Content-Type-Options", "nosniff");
-  for (const event of events) {
-    writeNdjsonEvent(response, event);
-  }
-  if (EVENT_STREAM_END_STATUSES.has(current.status)) {
-    response.end();
-    return;
-  }
-  let settled = false;
-  let unsubscribe = () => void 0;
-  const heartbeat = setInterval(() => {
-    if (!settled) {
-      response.write("\n");
-    }
-  }, 15e3);
-  heartbeat.unref();
-  const cleanup = () => {
-    if (settled) {
-      return;
-    }
-    settled = true;
-    clearInterval(heartbeat);
-    unsubscribe();
-  };
-  unsubscribe = manager.subscribe(jobId, (event) => {
-    if (settled) {
-      return;
-    }
-    writeNdjsonEvent(response, event);
-    if (event.type === "snapshot" && EVENT_STREAM_END_STATUSES.has(event.data.snapshot.status)) {
-      cleanup();
-      response.end();
-    }
-  });
-  response.once("close", cleanup);
-  response.once("error", cleanup);
-}
-async function handleCapability(request, response, options, writeSuccess) {
-  if (request.method !== "POST") {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const parsed = agentCapabilityRequestSchema.safeParse(
-    await readJsonRequestBody(request)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const controller = new AbortController();
-  const abort = () => {
-    controller.abort("agent-capability-client-disconnected");
-  };
-  response.once("close", abort);
-  try {
-    const data = await requireAgentManager(options).probe(
-      parsed.data,
-      controller.signal
-    );
-    writeSuccess(response, 200, data);
-  } finally {
-    response.removeListener("close", abort);
-  }
-}
-async function handleCreateJob(request, response, options, writeSuccess) {
-  if (request.method !== "POST") {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const parsed = agentJobCreateRequestSchema.safeParse(
-    await readJsonRequestBody(request, MAX_AGENT_REQUEST_BODY_BYTES)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const authorizedRequest = await authorizeAgentJobRequest({
-    request: parsed.data,
-    options: options.options,
-    registry: options.registry,
-    root: options.root
-  });
-  const data = requireAgentManager(options).create(authorizedRequest);
-  writeSuccess(response, 202, data);
-}
-async function handleWorkspaceHealth(request, response, options, writeSuccess) {
-  if (request.method !== "POST") {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const parsed = agentWorkspaceHealthRequestSchema.safeParse(
-    await readJsonRequestBody(request)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const controller = new AbortController();
-  const abort = () => {
-    controller.abort("agent-workspace-health-client-disconnected");
-  };
-  response.once("close", abort);
-  try {
-    const data = await requireAgentManager(options).workspaceHealth(controller.signal);
-    writeSuccess(response, 200, data);
-  } finally {
-    response.removeListener("close", abort);
-  }
-}
-async function handleJobAction(request, response, options, route, writeSuccess) {
-  const manager = requireAgentManager(options);
-  if (request.method !== "POST") {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  const parsed = agentJobActionRequestSchema.safeParse(
-    await readJsonRequestBody(request)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
-  }
-  if (route.action === "events") {
-    streamAgentJobEvents(response, manager, route.jobId);
-    return;
-  }
-  if (route.action === "result") {
-    writeSuccess(response, 200, manager.result(route.jobId));
-    return;
-  }
-  const data = route.action === "cancel" ? manager.cancel(route.jobId) : route.action === "apply" ? await manager.apply(route.jobId) : await manager.revert(route.jobId);
-  writeSuccess(response, 200, data);
-}
-async function handleAgentRequest(request, response, options, route, writeSuccess) {
-  if (route.kind === "capability") {
-    await handleCapability(request, response, options, writeSuccess);
-    return;
-  }
-  if (route.kind === "create-job") {
-    await handleCreateJob(request, response, options, writeSuccess);
-    return;
-  }
-  if (route.kind === "workspace-health") {
-    await handleWorkspaceHealth(request, response, options, writeSuccess);
-    return;
-  }
-  await handleJobAction(request, response, options, route, writeSuccess);
-}
-
-// src/server/editor.ts
-import { spawn } from "child_process";
-import launchEditor from "launch-editor";
-var EDITOR_STARTUP_GRACE_MS = 300;
-function normalizedEditorEnvironment(environment) {
-  return [
-    environment.TERM_PROGRAM,
-    environment.VSCODE_GIT_ASKPASS_NODE,
-    environment.VSCODE_GIT_ASKPASS_MAIN,
-    environment.GIT_ASKPASS
-  ].filter((value) => typeof value === "string").join("\n").replaceAll("\\", "/").toLowerCase();
-}
-function detectIntegratedEditor(environment) {
-  const signature = normalizedEditorEnvironment(environment);
-  if (signature === "cursor" || signature.includes("/cursor")) {
-    return "cursor";
-  }
-  if (signature === "vscode" || signature.includes("visual studio code") || /(^|\/)(code|code-insiders)(\.exe)?($|\/)/u.test(signature)) {
-    return "vscode";
-  }
-  return void 0;
-}
-function editorCommand(editor) {
-  return editor === "cursor" ? "cursor" : "code";
-}
-var DEFAULT_DEPENDENCIES2 = Object.freeze({
-  environment: process.env,
-  fallbackLauncher: launchEditor,
-  processSpawner: (command, arguments_, options) => spawn(command, [...arguments_], options),
-  startupGraceMs: EDITOR_STARTUP_GRACE_MS
-});
-function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
-  return (target, configuredEditor) => {
-    const integratedEditor = detectIntegratedEditor(dependencies.environment);
-    const resolvedEditor = configuredEditor === "auto" ? integratedEditor : configuredEditor;
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const settle = (error, editor = resolvedEditor ?? "auto") => {
-        if (settled) {
-          return;
-        }
-        settled = true;
-        clearTimeout(startupTimer);
-        if (error === void 0) {
-          resolve(editor);
-        } else {
-          reject(error);
-        }
-      };
-      const startupTimer = setTimeout(settle, dependencies.startupGraceMs);
-      const rejectStartup = () => {
-        settle(new Error("The configured editor could not be started."));
-      };
-      try {
-        if (resolvedEditor === void 0) {
-          dependencies.fallbackLauncher(target, void 0, rejectStartup);
-          return;
-        }
-        const child = dependencies.processSpawner(
-          editorCommand(resolvedEditor),
-          ["--goto", target],
-          {
-            env: dependencies.environment,
-            stdio: "ignore",
-            windowsHide: true
-          }
-        );
-        child.once("error", rejectStartup);
-        child.once("exit", (code, signal) => {
-          if (code === 0) {
-            settle(void 0, resolvedEditor);
-            return;
-          }
-          if (code !== null || signal !== null) {
-            rejectStartup();
-          }
-        });
-      } catch {
-        rejectStartup();
-      }
-    });
-  };
-}
-var launchConfiguredEditor = createEditorLauncher();
-
-// src/server/request-security.ts
-import { timingSafeEqual } from "crypto";
-import { isIP } from "net";
-import { ERROR_CODES as ERROR_CODES7, SPOTPATCH_TOKEN_HEADER, SpotPatchError as SpotPatchError7 } from "@spotpatch/shared";
-function getSingleHeader(request, name) {
-  const value = request.headers[name.toLowerCase()];
-  return Array.isArray(value) ? value[0] : value;
-}
-function tokensMatch(actual, expected) {
-  if (actual === void 0) {
-    return false;
-  }
-  const actualBytes = Buffer.from(actual);
-  const expectedBytes = Buffer.from(expected);
-  return actualBytes.byteLength === expectedBytes.byteLength && timingSafeEqual(actualBytes, expectedBytes);
-}
-function isLoopbackHostname(hostname) {
-  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (normalized === "localhost" || normalized.endsWith(".localhost")) {
-    return true;
-  }
-  if (normalized === "::1") {
-    return true;
-  }
-  if (isIP(normalized) === 4) {
-    return normalized.split(".")[0] === "127";
-  }
-  return normalized.startsWith("::ffff:127.");
-}
-function parseHost(value) {
-  try {
-    return new URL(`http://${value}`);
-  } catch {
-    return void 0;
-  }
-}
-function parseOrigin(value) {
-  try {
-    const origin = new URL(value);
-    if (origin.protocol !== "http:" && origin.protocol !== "https:" || origin.username.length > 0 || origin.password.length > 0 || origin.origin === "null") {
-      return void 0;
-    }
-    return origin;
-  } catch {
-    return void 0;
-  }
-}
-function assertRequestAuthorized(request, options) {
-  const actualToken = getSingleHeader(request, SPOTPATCH_TOKEN_HEADER);
-  if (!tokensMatch(actualToken, options.sessionToken)) {
-    throw new SpotPatchError7(ERROR_CODES7.INVALID_TOKEN);
-  }
-  const hostHeader = getSingleHeader(request, "host");
-  const originHeader = getSingleHeader(request, "origin");
-  const host = hostHeader === void 0 ? void 0 : parseHost(hostHeader);
-  const origin = originHeader === void 0 ? void 0 : parseOrigin(originHeader);
-  if (host === void 0 || origin === void 0) {
-    throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
-  }
-  const hostIsLoopback = isLoopbackHostname(host.hostname);
-  const originIsLoopback = isLoopbackHostname(origin.hostname);
-  if (!options.allowLan) {
-    if (!hostIsLoopback || !originIsLoopback) {
-      throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
-    }
-    return;
-  }
-  if (!originIsLoopback && origin.host.toLowerCase() !== host.host.toLowerCase()) {
-    throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
-  }
-}
-
-// src/server/middleware.ts
-var STATUS_BY_ERROR = Object.freeze({
-  [ERROR_CODES8.INVALID_REQUEST]: 400,
-  [ERROR_CODES8.INVALID_TOKEN]: 401,
-  [ERROR_CODES8.ORIGIN_NOT_ALLOWED]: 403,
-  [ERROR_CODES8.SOURCE_NOT_FOUND]: 404,
-  [ERROR_CODES8.SOURCE_OUTSIDE_ROOT]: 403,
-  [ERROR_CODES8.SOURCE_TOO_LARGE]: 413,
-  [ERROR_CODES8.EDITOR_OPEN_FAILED]: 500,
-  [ERROR_CODES8.AI_DISABLED]: 404,
-  [ERROR_CODES8.PROVIDER_NOT_CONFIGURED]: 503,
-  [ERROR_CODES8.PROVIDER_AUTH_FAILED]: 502,
-  [ERROR_CODES8.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
-  [ERROR_CODES8.MODEL_NOT_ALLOWED]: 400,
-  [ERROR_CODES8.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
-  [ERROR_CODES8.PROVIDER_RATE_LIMITED]: 429,
-  [ERROR_CODES8.AGENT_BUSY]: 409,
-  [ERROR_CODES8.AGENT_LIMIT_EXCEEDED]: 413,
-  [ERROR_CODES8.AGENT_CANCELLED]: 409,
-  [ERROR_CODES8.WORKTREE_DIRTY]: 409,
-  [ERROR_CODES8.WORKTREE_NOT_REPOSITORY]: 409,
-  [ERROR_CODES8.WORKTREE_OPERATION_IN_PROGRESS]: 409,
-  [ERROR_CODES8.WORKTREE_CONFLICTED]: 409,
-  [ERROR_CODES8.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
-  [ERROR_CODES8.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
-  [ERROR_CODES8.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
-  [ERROR_CODES8.TOOL_DENIED]: 403,
-  [ERROR_CODES8.TOOL_INPUT_INVALID]: 422,
-  [ERROR_CODES8.TOOL_ARGUMENTS_INVALID]: 422,
-  [ERROR_CODES8.TOOL_CALL_ID_CONFLICT]: 422,
-  [ERROR_CODES8.TOOL_PATH_DENIED]: 403,
-  [ERROR_CODES8.PATCH_REJECTED]: 422,
-  [ERROR_CODES8.VALIDATION_FAILED]: 422,
-  [ERROR_CODES8.APPLY_CONFLICT]: 409,
-  [ERROR_CODES8.INTERNAL_ERROR]: 500
-});
-var PUBLIC_MESSAGES = Object.freeze({
-  [ERROR_CODES8.INVALID_REQUEST]: "The request is invalid.",
-  [ERROR_CODES8.INVALID_TOKEN]: "The session token is invalid.",
-  [ERROR_CODES8.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
-  [ERROR_CODES8.SOURCE_NOT_FOUND]: "The source file is unavailable.",
-  [ERROR_CODES8.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
-  [ERROR_CODES8.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
-  [ERROR_CODES8.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
-  [ERROR_CODES8.AI_DISABLED]: "AI execution is not enabled.",
-  [ERROR_CODES8.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
-  [ERROR_CODES8.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
-  [ERROR_CODES8.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
-  [ERROR_CODES8.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
-  [ERROR_CODES8.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
-  [ERROR_CODES8.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
-  [ERROR_CODES8.AGENT_BUSY]: "Another Agent job is already running.",
-  [ERROR_CODES8.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
-  [ERROR_CODES8.AGENT_CANCELLED]: "The Agent job was cancelled.",
-  [ERROR_CODES8.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
-  [ERROR_CODES8.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
-  [ERROR_CODES8.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
-  [ERROR_CODES8.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
-  [ERROR_CODES8.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
-  [ERROR_CODES8.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
-  [ERROR_CODES8.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
-  [ERROR_CODES8.TOOL_DENIED]: "The Agent tool request was denied.",
-  [ERROR_CODES8.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
-  [ERROR_CODES8.TOOL_ARGUMENTS_INVALID]: "The Agent tool arguments are invalid.",
-  [ERROR_CODES8.TOOL_CALL_ID_CONFLICT]: "A tool call ID conflicts within one Agent turn.",
-  [ERROR_CODES8.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
-  [ERROR_CODES8.PATCH_REJECTED]: "The proposed patch was rejected.",
-  [ERROR_CODES8.VALIDATION_FAILED]: "The proposed change failed validation.",
-  [ERROR_CODES8.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
-  [ERROR_CODES8.INTERNAL_ERROR]: "The request could not be completed."
-});
-function writeJson(response, status, payload) {
-  response.statusCode = status;
-  response.setHeader("Cache-Control", "no-store");
-  response.setHeader("Content-Type", "application/json; charset=utf-8");
-  response.end(JSON.stringify(payload));
-}
-function asSpotPatchError(error) {
-  return error instanceof SpotPatchError8 ? error : new SpotPatchError8(ERROR_CODES8.INTERNAL_ERROR, void 0, { cause: error });
-}
-function writeError(response, error, logger) {
-  const normalized = asSpotPatchError(error);
-  if (normalized.code === ERROR_CODES8.INTERNAL_ERROR) {
-    logger?.warn("[spotpatch:server] Internal request failure.");
-  }
-  writeJson(response, STATUS_BY_ERROR[normalized.code], {
-    ok: false,
-    error: {
-      code: normalized.code,
-      message: PUBLIC_MESSAGES[normalized.code]
-    }
-  });
-}
-function requestPath(request) {
-  try {
-    return new URL(request.url ?? "/", "http://spotpatch.invalid").pathname;
-  } catch {
-    return "";
-  }
-}
-async function handleSourceContext(request, options) {
-  const parsed = sourceContextRequestSchema.safeParse(
-    await readJsonRequestBody(request)
-  );
-  if (!parsed.success) {
-    throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-  }
-  return readSourceContext({
-    request: parsed.data,
-    registry: options.registry,
-    root: options.root,
-    maxCharacters: options.options.budget.codeCharacters,
-    maxLines: options.options.budget.maxCodeLines
-  });
-}
-async function handleOpenEditor(request, options) {
-  const parsed = openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
-  if (!parsed.success) {
-    throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-  }
-  const body = parsed.data;
-  const sourcePath = await resolveSourceFile({
-    fileId: body.fileId,
-    registry: options.registry,
-    root: options.root
-  });
-  const target = `${sourcePath}:${String(body.line)}:${String(body.column)}`;
-  const editorLauncher = options.editorLauncher ?? launchConfiguredEditor;
-  try {
-    const editor = await editorLauncher(target, options.options.editor);
-    return Object.freeze({ editor });
-  } catch (error) {
-    options.logger?.warn(
-      `[spotpatch:server] ${options.options.editor === "auto" ? "The detected editor" : options.options.editor} rejected an editor request.`
-    );
-    throw new SpotPatchError8(ERROR_CODES8.EDITOR_OPEN_FAILED, void 0, {
-      cause: error
-    });
-  }
-}
-function createSpotPatchMiddleware(options) {
-  return (request, response, next) => {
-    const path11 = requestPath(request);
-    const agentRoute = matchAgentRequestPath(path11);
-    if (path11 !== SPOTPATCH_ENDPOINTS2.sourceContext && path11 !== SPOTPATCH_ENDPOINTS2.openEditor && agentRoute === void 0 && !path11.startsWith(`${SPOTPATCH_API_BASE}/`)) {
-      next();
-      return;
-    }
-    const handle = async () => {
-      assertRequestAuthorized(request, {
-        allowLan: options.options.allowLan,
-        sessionToken: options.session.token
-      });
-      if (path11 === SPOTPATCH_ENDPOINTS2.sourceContext) {
-        if (request.method !== "POST") {
-          throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-        }
-        const data = await handleSourceContext(request, options);
-        writeJson(response, 200, { ok: true, data });
-        return;
-      }
-      if (path11 === SPOTPATCH_ENDPOINTS2.openEditor) {
-        if (request.method !== "POST") {
-          throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-        }
-        const data = await handleOpenEditor(request, options);
-        writeJson(response, 200, { ok: true, data });
-        return;
-      }
-      if (agentRoute === void 0) {
-        throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
-      }
-      await handleAgentRequest(
-        request,
-        response,
-        options,
-        agentRoute,
-        (target, status, data) => {
-          writeJson(target, status, { ok: true, data });
-        }
-      );
-    };
-    void handle().catch((error) => {
-      writeError(response, error, options.logger);
-    });
-  };
-}
-
-// src/server/server-plugin.ts
+  createAgentJobManager,
+  createSpotPatchMiddleware
+} from "@spotpatch/dev-server";
 function createServerPlugin(input) {
   let agentManager;
   let config;
@@ -2223,7 +247,7 @@ function createServerPlugin(input) {
       if (config === void 0) {
         throw new Error("SpotPatch server initialized before Vite config resolution.");
       }
-      const root = path6.resolve(config.root);
+      const root = path2.resolve(config.root);
       const options = input.context.getOptions();
       agentManager = options.ai === false ? void 0 : createAgentJobManager({
         ai: options.ai,
@@ -2253,189 +277,40 @@ function createServerPlugin(input) {
   };
 }
 
-// src/session/session.ts
-import { randomBytes as randomBytes3 } from "crypto";
-function createSession() {
-  return Object.freeze({
-    token: randomBytes3(16).toString("base64url")
-  });
-}
-
 // src/transform/transform-plugin.ts
-import { createHash as createHash2 } from "crypto";
-import path9 from "path";
-
-// src/transform/inject-source-markers.ts
-import path7 from "path";
-import {
-  formatSourceMarker,
-  SOURCE_MARKER_ATTRIBUTE as SOURCE_MARKER_ATTRIBUTE2
-} from "@spotpatch/shared";
-import MagicString from "magic-string";
-import { parseSync as parseSync2, Visitor as Visitor2 } from "oxc-parser";
-
-// src/transform/intrinsic-element.ts
-import { SOURCE_MARKER_ATTRIBUTE } from "@spotpatch/shared";
-function isIntrinsicOpeningElement(node) {
-  if (node.name.type !== "JSXIdentifier") {
-    return false;
-  }
-  const { name } = node.name;
-  const firstCharacter = name[0];
-  return name.includes("-") || firstCharacter?.toLowerCase() === firstCharacter;
-}
-function hasSourceMarkerAttribute(node) {
-  return node.attributes.some(
-    (attribute) => attribute.type === "JSXAttribute" && attribute.name.type === "JSXIdentifier" && attribute.name.name === SOURCE_MARKER_ATTRIBUTE
-  );
-}
-
-// src/transform/source-position.ts
-function createLineStarts(code) {
-  const starts = [0];
-  for (let index = 0; index < code.length; index += 1) {
-    if (code.charCodeAt(index) === 10) {
-      starts.push(index + 1);
-    }
-  }
-  return starts;
-}
-function getSourcePosition(lineStarts, offset) {
-  let lower = 0;
-  let upper = lineStarts.length - 1;
-  while (lower <= upper) {
-    const middle = Math.floor((lower + upper) / 2);
-    const start = lineStarts[middle];
-    if (start === void 0) {
-      break;
-    }
-    if (start <= offset) {
-      lower = middle + 1;
-    } else {
-      upper = middle - 1;
-    }
-  }
-  const lineIndex = Math.max(0, upper);
-  const lineStart = lineStarts[lineIndex] ?? 0;
-  return Object.freeze({
-    line: lineIndex + 1,
-    column: offset - lineStart + 1
-  });
-}
-
-// src/transform/inject-source-markers.ts
-function findAttributeInsertionOffset(code, node) {
-  let cursor = node.end - 2;
-  while (cursor >= node.start && /\s/u.test(code[cursor] ?? "")) {
-    cursor -= 1;
-  }
-  if (code[cursor] === "/") {
-    cursor -= 1;
-    while (cursor >= node.start && /\s/u.test(code[cursor] ?? "")) {
-      cursor -= 1;
-    }
-  }
-  return cursor + 1;
-}
-function normalizeRelativePath(root, absolutePath) {
-  return path7.relative(root, absolutePath).split(path7.sep).join("/");
-}
-function createMarker(fileId, line, column) {
-  return Object.freeze({ fileId, line, column });
-}
-function injectSourceMarkers(input) {
-  const parseResult = parseSync2(input.absolutePath, input.code, {
-    sourceType: "module"
-  });
-  const parseError = parseResult.errors[0];
-  if (parseError !== void 0) {
-    throw new SyntaxError(parseError.message);
-  }
-  const magicString = new MagicString(input.code);
-  const lineStarts = createLineStarts(input.code);
-  let markerCount = 0;
-  const visitor = new Visitor2({
-    JSXOpeningElement(node) {
-      if (!isIntrinsicOpeningElement(node)) {
-        return;
-      }
-      const position = getSourcePosition(lineStarts, node.start);
-      if (hasSourceMarkerAttribute(node)) {
-        input.onWarning?.({
-          code: "EXISTING_SOURCE_MARKER",
-          line: position.line,
-          column: position.column
-        });
-        return;
-      }
-      const value = formatSourceMarker(
-        createMarker(input.fileId, position.line, position.column)
-      );
-      const insertionOffset = findAttributeInsertionOffset(input.code, node);
-      magicString.appendLeft(
-        insertionOffset,
-        ` ${SOURCE_MARKER_ATTRIBUTE2}=${JSON.stringify(value)}`
-      );
-      markerCount += 1;
-    }
-  });
-  visitor.visit(parseResult.program);
-  if (markerCount === 0) {
-    return void 0;
-  }
-  return Object.freeze({
-    code: magicString.toString(),
-    map: magicString.generateMap({
-      hires: true,
-      includeContent: true,
-      source: normalizeRelativePath(input.root, input.absolutePath)
-    }),
-    markerCount
-  });
-}
+import { createHash } from "crypto";
+import path4 from "path";
+import { injectSourceMarkers } from "@spotpatch/compiler";
 
 // src/transform/transform-filter.ts
-import path8 from "path";
-import { createFilter } from "@rollup/pluginutils";
-var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".jsx", ".tsx"]);
+import path3 from "path";
+import { createSourceFilter } from "@spotpatch/compiler";
+import { isInsideRoot } from "@spotpatch/compiler";
 function stripViteQuery(id) {
   const queryIndex = id.indexOf("?");
   return queryIndex === -1 ? id : id.slice(0, queryIndex);
 }
-function isInsideRoot(root, candidate, pathApi = path8) {
-  const relative = pathApi.relative(pathApi.resolve(root), pathApi.resolve(candidate));
-  return relative === "" || !relative.startsWith(`..${pathApi.sep}`) && relative !== ".." && !pathApi.isAbsolute(relative);
-}
 function createTransformFilter(root, options) {
-  const matchesConfiguredFilter = createFilter(options.include, options.exclude);
+  const sourceFilter = createSourceFilter(root, options);
   return Object.freeze({
     shouldTransform(id, code) {
-      if (id.startsWith("\0") || id.includes("virtual:spotpatch")) {
+      if (id.startsWith("\0") || id.includes("virtual:spotpatch") || id.includes("/packages/vite/") || id.includes("\\packages\\vite\\")) {
         return false;
       }
       const cleanId = stripViteQuery(id);
-      if (!SUPPORTED_EXTENSIONS.has(path8.extname(cleanId).toLowerCase())) {
-        return false;
-      }
-      if (cleanId.includes("/node_modules/") || cleanId.includes("\\node_modules\\") || cleanId.includes("/packages/vite/") || cleanId.includes("\\packages\\vite\\")) {
-        return false;
-      }
-      if (!isInsideRoot(root, cleanId) || !matchesConfiguredFilter(cleanId)) {
-        return false;
-      }
-      return code.includes("<");
+      return sourceFilter.shouldTransform(path3.resolve(cleanId), code);
     }
   });
 }
 
 // src/transform/transform-plugin.ts
 function createCacheKey(id, code) {
-  const hash = createHash2("sha256").update(code).digest("base64url");
+  const hash = createHash("sha256").update(code).digest("base64url");
   return `${id}\0${hash}`;
 }
 function getDisplayPath(root, id) {
-  const relative = path9.relative(root, stripViteQuery(id));
-  return relative.split(path9.sep).join("/");
+  const relative = path4.relative(root, stripViteQuery(id));
+  return relative.split(path4.sep).join("/");
 }
 function createTransformPlugin(input) {
   let root = process.cwd();
@@ -2451,7 +326,7 @@ function createTransformPlugin(input) {
       input.configure?.(config, environment);
     },
     configResolved(config) {
-      root = path9.resolve(config.root);
+      root = path4.resolve(config.root);
       filter = createTransformFilter(root, input.context.getOptions());
       logger = config.logger;
     },
@@ -2459,7 +334,7 @@ function createTransformPlugin(input) {
       if (!filter.shouldTransform(id, code)) {
         return null;
       }
-      const cleanId = path9.resolve(stripViteQuery(id));
+      const cleanId = path4.resolve(stripViteQuery(id));
       const cacheKey = createCacheKey(cleanId, code);
       if (cache.has(cacheKey)) {
         return cache.get(cacheKey) ?? null;
@@ -2518,29 +393,11 @@ function spotPatch(userOptions = {}) {
     getOptions: () => options
   });
   const configure = (config, environment) => {
-    const root = path10.resolve(process.cwd(), config.root ?? ".");
-    const loadedEnvironment = config.envDir === false ? process.env : loadEnv(environment.mode, path10.resolve(root, config.envDir ?? "."), "");
+    const root = path5.resolve(process.cwd(), config.root ?? ".");
+    const loadedEnvironment = config.envDir === false ? process.env : loadEnv(environment.mode, path5.resolve(root, config.envDir ?? "."), "");
     const environmentAi = userOptions.ai === void 0 ? resolveEnvironmentAiConfiguration(loadedEnvironment).ai : false;
     options = resolveOptions(userOptions, environmentAi);
-    if (options.ai === false) {
-      credentialEnvironment = Object.freeze({});
-      return;
-    }
-    const names = new Set(
-      Object.values(options.ai.providers).map((provider) => provider.apiKeyEnv)
-    );
-    const missing = [...names].filter((name) => {
-      const value = loadedEnvironment[name];
-      return value === void 0 || value.trim().length === 0;
-    });
-    if (missing.length > 0) {
-      throw new RangeError(
-        `SpotPatch AI credential environment is missing ${missing.join(", ")}.`
-      );
-    }
-    credentialEnvironment = Object.freeze(
-      Object.fromEntries([...names].map((name) => [name, loadedEnvironment[name]]))
-    );
+    credentialEnvironment = resolveCredentialEnvironment(options, loadedEnvironment);
   };
   return [
     createTransformPlugin({ configure, context, registry }),
@@ -2549,14 +406,22 @@ function spotPatch(userOptions = {}) {
   ];
 }
 
+// src/options.ts
+import {
+  createRuntimeAiConfig as createRuntimeAiConfig2,
+  DEFAULT_EXCLUDE,
+  DEFAULT_OPTIONS,
+  resolveOptions as resolveOptions2
+} from "@spotpatch/dev-server";
+
 // src/index.ts
 import {
-  DEFAULT_AGENT_LIMITS as DEFAULT_AGENT_LIMITS2
+  DEFAULT_AGENT_LIMITS
 } from "@spotpatch/shared";
 export {
-  DEFAULT_AGENT_LIMITS2 as DEFAULT_AGENT_LIMITS,
+  DEFAULT_AGENT_LIMITS,
   DEFAULT_OPTIONS,
-  resolveOptions,
+  resolveOptions2 as resolveOptions,
   spotPatch
 };
 //# sourceMappingURL=index.js.map