@verbaly/studio 0.53.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aron Soto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,132 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/AronSoto/verbaly/develop/assets/logo.png" alt="Verbaly" width="300" />
+</p>
+
+<p align="center"><em>A local review server over the translation files already in your repo. No account, no database, no deploy.</em></p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@verbaly/studio"><img src="https://img.shields.io/npm/v/@verbaly/studio?logo=npm&color=cb3837" alt="npm version" /></a>
+  <a href="https://github.com/AronSoto/verbaly/blob/develop/LICENSE"><img src="https://img.shields.io/npm/l/@verbaly/studio?color=blue" alt="MIT" /></a>
+</p>
+
+---
+
+Your JSON catalogs are the database and git is the history. Studio is a window onto them, which is
+why it cannot fall out of sync with your code: it does not own anything.
+
+> **This release ships the server and the state, not the interface.** Every route below is real and
+> tested; the panel that will consume them is not written yet. Useful today as `--json`, as a local
+> API for a script, and as the thing the interface will be built against.
+
+> **Studio edits translations. It never edits the source text.** The source lives in your code and
+> the key derives from it, so editing it here would be undone by the next `verbaly extract`. A write
+> to the source locale is refused, and so is a key the source catalog does not have.
+
+## 🚀 Install
+
+```bash
+pnpm add -D @verbaly/studio
+```
+
+```bash
+npx verbaly-studio
+
+#   Verbaly Studio   http://127.0.0.1:4747/api/state?t=kQ7pVn2XsL4b
+#   Project          /home/you/app
+#   Catalog          1425 messages · 212 untranslated · 187 drafts
+#
+#   Ctrl+C to stop
+```
+
+| Flag | What it does |
+|------|--------------|
+| `--root <path>` | point at another project instead of the working directory |
+| `--port <n>` | start somewhere other than 4747; a busy port climbs to the next free one |
+| `--json` | print the whole state to stdout and exit, no server |
+
+`--json` is the panel without the panel: the same object the interface reads, so it can be piped,
+diffed and scripted.
+
+## 🔒 Security, which is not optional for a server that writes files
+
+Any page open in your browser can talk to a local server, so three defenses ship on by default:
+
+- it binds to `127.0.0.1`, never `0.0.0.0`
+- the `Host` header must be `127.0.0.1:<port>` or `localhost:<port>`, which is what stops a DNS rebind
+- a 72-bit token is minted per boot, rides in the url the command prints and is compared in constant
+  time, and a cross `Origin` is refused even when the token is right
+
+Requests are capped at 1 MB, and the absolute path of your project is stripped out of every error
+before it reaches the browser. On a non-default port the `Host` check requires it; on port 80 it
+accepts the name alone, because that is what a browser sends.
+
+## 🧰 The API
+
+Every route calls the same compiler function the CLI calls, so there is no second implementation to
+keep in step. Every answer is JSON, including the errors, which are `{ "error": "[verbaly] …" }`.
+
+| Method and route | What it does |
+|---|---|
+| `GET /api/state` | the whole project: config, catalogs, origins, status, check, drafts, triage and problems |
+| `GET /api/health` | what `verbaly doctor` reports |
+| `PUT /api/message/:locale/:key` | write a translation **and clear its draft flag**; body `{ "text": "…" }` |
+| `POST /api/approve` | approve drafts; body `{ "locale": "es", "keys": ["…"] }`, and the whole locale when `keys` is omitted |
+
+`GET /api/state` is unpaginated on purpose: the biggest catalog we know is 1425 messages, and over
+localhost that is instant. Its `problems` array is why nothing Studio reads can take the server
+down: a catalog it cannot parse, a drafts sidecar it cannot parse, a source file Babel cannot read,
+and a `--root` with no catalogs in it are all reported there, by a path relative to your project,
+and the rest is served. Studio is what you open to fix those files.
+
+A write runs the same two validations `verbaly check` runs, so a translation that lost a `{param}`,
+a tag, or the `other` case of a plural is refused with the reason instead of failing your CI later.
+Whitespace is stored as the empty string, because that is what untranslated means everywhere else.
+
+**A write clears the draft flag** because a human wrote it, the same rule `verbaly import` already
+applies. Without it you would fix a bad machine translation by hand and `verbaly check --drafts`
+would keep failing on your own text.
+
+## 🔎 Triage: which machine translations are worth reading
+
+Adding a language writes hundreds of drafts at once, and reading them one by one is a wall. Walls
+are how a safeguard turns into something people route around, so Studio ranks instead of queuing.
+
+`check` already caught the structure, so a lost `{param}` or tag never reaches this: what is left is
+meaning, which nothing can measure. These signals do not score a translation, they point at the few
+worth a human eye:
+
+| Signal | What it means |
+|---|---|
+| `divergent` | the same source text was already rendered two ways by a reviewed locale, so the English is ambiguous |
+| `collision` | the fallback when no reviewed locale can tell: one source text came back as two translations here |
+| `echo` | still identical to the source, while every reviewed locale did translate it |
+| `digits` | a number the source has came back changed, ignoring decimal separators and trailing punctuation |
+| `url` | a URL changed |
+| `code` | the contents of a `<code>` span changed |
+
+A locale that still carries drafts is never used as the reviewed control, and neither is a blank:
+an unfinished translation is not a second opinion.
+
+**Every signal here was measured against this project's own site before it shipped, and two of them
+changed because of what the measurement said.** `digits` was reading the comma after a number as
+part of it, and it was flagging a number the translation added where the source had none, which is
+what "refresh" becoming "F5" looks like. Those were **10 of 10** of its hits, all correct text, so
+both are now excluded. The result is **18 of 1425 messages** flagged per language.
+
+## 🧩 Programmatic API
+
+```ts
+import { startStudio } from '@verbaly/studio';
+
+const studio = await startStudio(await loadConfig(process.cwd()), { port: 0 });
+console.log(studio.url);
+await studio.close();
+```
+
+`startStudio(cfg, options)` returns `{ server, port, token, url, close }`, and
+`createStudioApp(cfg, port, token)` is the bare request handler for mounting it somewhere else.
+Nothing else is public.
+
+## License
+
+[MIT](https://github.com/AronSoto/verbaly/blob/develop/LICENSE) © Aron Soto

package/dist/cli.js

@@ -0,0 +1,404 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import { DRAFTS_FILE, check, clearDrafts, collectOrigins, counted, doctor, effectiveDrafts, extractProject, formatCliError, loadConfig, loadDrafts, readCatalog, saveDrafts, status, targetLocales, validateMessage, validatePair, writeCatalog } from "@verbaly/compiler";
+import { existsSync } from "node:fs";
+import { relative } from "node:path";
+import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+//#region src/http.ts
+var HttpError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message.startsWith("[verbaly]") ? message : `[verbaly] ${message}`);
+		this.status = status;
+		this.name = "HttpError";
+	}
+};
+const badRequest = (message) => new HttpError(400, message);
+function scrub(message, root) {
+	return root ? message.split(root).join(".") : message;
+}
+//#endregion
+//#region src/triage.ts
+const DIGITS = /\d[\d.,]*/g;
+const URLS = /https?:\/\/[^\s<)"']+/g;
+const CODE = /<code>([^<]+)<\/code>/g;
+function bag(text, re, normalize) {
+	const found = text.match(re) ?? [];
+	return (normalize ? found.map(normalize) : found).sort();
+}
+function same(a, b) {
+	return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+const trimPunct = (v) => v.replace(/[.,;:!?)\]]+$/, "");
+const bareDigits = (v) => trimPunct(v).replaceAll(/[.,]/g, ".");
+function push(out, key, reason) {
+	(out[key] ??= []).push(reason);
+}
+function triage({ source, target, reviewed }) {
+	const out = Object.create(null);
+	const keys = Object.keys(source);
+	const bySource = Object.create(null);
+	for (const key of keys) {
+		const text = source[key]?.trim();
+		if (text) (bySource[text] ??= []).push(key);
+	}
+	for (const [text, group] of Object.entries(bySource)) {
+		if (group.length < 2) continue;
+		const divergent = reviewed.some((catalog) => new Set(group.map((k) => catalog[k]?.trim() ?? "").filter(Boolean)).size > 1);
+		if (divergent) for (const key of group) push(out, key, {
+			signal: "divergent",
+			text: `"${text}" was already translated two ways`
+		});
+		const targets = new Set(group.map((key) => target[key]?.trim() ?? "").filter(Boolean));
+		if (!divergent && targets.size > 1) for (const key of group) push(out, key, {
+			signal: "collision",
+			text: `"${text}" came back as two different translations`
+		});
+	}
+	for (const key of keys) {
+		const src = source[key]?.trim() ?? "";
+		const trg = target[key]?.trim() ?? "";
+		if (!src || !trg) continue;
+		const opinions = reviewed.map((c) => c[key]?.trim()).filter((v) => v !== void 0 && v !== "");
+		if (trg === src && opinions.length > 0 && opinions.every((v) => v !== src)) push(out, key, {
+			signal: "echo",
+			text: "still identical to the source"
+		});
+		const srcDigits = bag(src, DIGITS, bareDigits);
+		if (srcDigits.length > 0 && !same(srcDigits, bag(trg, DIGITS, bareDigits))) push(out, key, {
+			signal: "digits",
+			text: "the numbers do not match the source"
+		});
+		if (!same(bag(src, URLS, trimPunct), bag(trg, URLS, trimPunct))) push(out, key, {
+			signal: "url",
+			text: "a URL changed"
+		});
+		if (!same(bag(src, CODE), bag(trg, CODE))) push(out, key, {
+			signal: "code",
+			text: "the contents of a <code> span changed"
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/api.ts
+function readAll(cfg) {
+	const catalogs = {};
+	const problems = [];
+	if (!existsSync(cfg.dir)) {
+		const dir = relative(cfg.root, cfg.dir).replaceAll("\\", "/");
+		problems.push({
+			scope: dir,
+			message: "[verbaly] no catalogs here, run npx verbaly init or check --root"
+		});
+	}
+	for (const locale of cfg.locales) try {
+		catalogs[locale] = readCatalog(cfg, locale);
+	} catch (error) {
+		catalogs[locale] = {};
+		problems.push({
+			scope: locale,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+	return {
+		catalogs,
+		problems
+	};
+}
+function readDrafts(cfg) {
+	try {
+		return {
+			drafts: loadDrafts(cfg),
+			problems: []
+		};
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return {
+			drafts: {},
+			problems: [{
+				scope: DRAFTS_FILE,
+				message
+			}]
+		};
+	}
+}
+function relativize(cfg, result) {
+	return {
+		...result,
+		unknown: result.unknown.map((entry) => ({
+			...entry,
+			files: entry.files.map((file) => relative(cfg.root, file).replaceAll("\\", "/"))
+		}))
+	};
+}
+async function buildState(cfg) {
+	const { catalogs, problems } = readAll(cfg);
+	const registry = await extractProject(cfg);
+	const sidecar = readDrafts(cfg);
+	problems.push(...sidecar.problems);
+	const live = effectiveDrafts(sidecar.drafts, catalogs);
+	const source = catalogs[cfg.sourceLocale] ?? {};
+	const targets = targetLocales(cfg);
+	for (const { file, message } of registry.parseErrors()) problems.push({
+		scope: relative(cfg.root, file).replaceAll("\\", "/"),
+		message
+	});
+	const perLocale = {};
+	for (const locale of targets) perLocale[locale] = triage({
+		source,
+		target: catalogs[locale] ?? {},
+		reviewed: targets.filter((other) => other !== locale && !(live[other] ?? []).length).map((other) => catalogs[other] ?? {})
+	});
+	return {
+		root: cfg.root,
+		dir: cfg.dir,
+		sourceLocale: cfg.sourceLocale,
+		locales: cfg.locales,
+		scanning: cfg.include.length > 0,
+		catalogs,
+		origins: await collectOrigins(cfg, registry),
+		status: status(cfg, catalogs, registry, live),
+		check: relativize(cfg, check(cfg, catalogs, registry)),
+		drafts: live,
+		triage: perLocale,
+		problems
+	};
+}
+function health(cfg) {
+	return doctor(cfg);
+}
+function writeMessage(cfg, locale, key, text) {
+	if (locale === cfg.sourceLocale) throw badRequest("the source text lives in your code, Studio never edits it");
+	if (!cfg.locales.includes(locale)) throw badRequest(`${locale} is not one of this project's locales`);
+	const source = readCatalog(cfg, cfg.sourceLocale);
+	if (!Object.hasOwn(source, key)) throw badRequest(`"${key}" is not in the source catalog, so Studio will not create it`);
+	const value = text.trim() ? text : "";
+	const errors = (value ? [...validateMessage(value, locale), ...validatePair(source[key], value)] : []).filter((issue) => issue.severity === "error");
+	if (errors.length) throw badRequest(`${errors.map((issue) => issue.message).join("; ")}`);
+	const catalog = {
+		...readCatalog(cfg, locale),
+		[key]: value
+	};
+	writeCatalog(cfg, locale, catalog);
+	const drafts = loadDrafts(cfg);
+	const clearedDraft = (drafts[locale] ?? []).includes(key);
+	clearDrafts(drafts, locale, [key]);
+	saveDrafts(cfg, drafts);
+	return {
+		locale,
+		key,
+		clearedDraft
+	};
+}
+function approve(cfg, locale, keys) {
+	if (!cfg.locales.includes(locale)) throw badRequest(`${locale} is not one of this project's locales`);
+	const drafts = loadDrafts(cfg);
+	const before = (drafts[locale] ?? []).length;
+	clearDrafts(drafts, locale, keys);
+	const after = (drafts[locale] ?? []).length;
+	saveDrafts(cfg, drafts);
+	return {
+		locale,
+		approved: before - after
+	};
+}
+//#endregion
+//#region src/guard.ts
+function newToken() {
+	return randomBytes(9).toString("base64url");
+}
+function hostAllowed(host, port) {
+	const names = port === 80 ? ["127.0.0.1", "localhost"] : [];
+	return [
+		`127.0.0.1:${port}`,
+		`localhost:${port}`,
+		...names
+	].includes(host ?? "");
+}
+function originAllowed(origin, port) {
+	if (origin === void 0) return true;
+	return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
+}
+function tokenMatches(given, expected) {
+	if (given === null) return false;
+	const a = Buffer.from(given);
+	const b = Buffer.from(expected);
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+const PASS = {
+	ok: true,
+	status: 200,
+	reason: ""
+};
+function guardRequest(headers, url, { port, token }) {
+	if (!hostAllowed(headers.host, port)) return {
+		ok: false,
+		status: 403,
+		reason: "[verbaly] unexpected Host header"
+	};
+	if (!originAllowed(headers.origin, port)) return {
+		ok: false,
+		status: 403,
+		reason: "[verbaly] cross-origin request"
+	};
+	if (!tokenMatches(url.searchParams.get("t"), token)) return {
+		ok: false,
+		status: 401,
+		reason: "[verbaly] missing or wrong token, open the printed url"
+	};
+	return PASS;
+}
+//#endregion
+//#region src/server.ts
+const DEFAULT_PORT = 4747;
+const MAX_BODY = 1e6;
+function send(res, status, body) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify(body));
+}
+async function readJson(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		size += chunk.length;
+		if (size > MAX_BODY) throw new HttpError(413, "request body too large");
+		chunks.push(chunk);
+	}
+	if (!chunks.length) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	} catch {
+		throw badRequest("body is not valid JSON");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw badRequest("body must be a JSON object");
+	return parsed;
+}
+function segment(raw, what) {
+	let value;
+	try {
+		value = decodeURIComponent(raw ?? "");
+	} catch {
+		throw badRequest(`the ${what} in the url is not valid percent-encoding`);
+	}
+	if (!value) throw badRequest(`the url is missing a ${what}`);
+	return value;
+}
+function createStudioApp(cfg, port, token) {
+	return async function handle(req, res) {
+		try {
+			let url;
+			try {
+				url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+			} catch {
+				throw badRequest("the request target is not a valid url");
+			}
+			const verdict = guardRequest({
+				host: req.headers.host,
+				origin: req.headers.origin
+			}, url, {
+				port,
+				token
+			});
+			if (!verdict.ok) {
+				send(res, verdict.status, { error: verdict.reason });
+				return;
+			}
+			if (req.method === "GET" && url.pathname === "/api/state") {
+				send(res, 200, await buildState(cfg));
+				return;
+			}
+			if (req.method === "GET" && url.pathname === "/api/health") {
+				send(res, 200, await health(cfg));
+				return;
+			}
+			if (req.method === "PUT" && url.pathname.startsWith("/api/message/")) {
+				const rest = url.pathname.slice(13).split("/");
+				const locale = segment(rest[0], "locale");
+				const key = segment(rest.slice(1).join("/"), "key");
+				const body = await readJson(req);
+				if (typeof body.text !== "string") throw badRequest("body needs a \"text\" string");
+				send(res, 200, writeMessage(cfg, locale, key, body.text));
+				return;
+			}
+			if (req.method === "POST" && url.pathname === "/api/approve") {
+				const body = await readJson(req);
+				if (typeof body.locale !== "string") throw badRequest("body needs a \"locale\" string");
+				const keys = Array.isArray(body.keys) ? body.keys.filter((k) => typeof k === "string") : void 0;
+				send(res, 200, approve(cfg, body.locale, keys));
+				return;
+			}
+			send(res, 404, { error: `[verbaly] no route for ${req.method} ${url.pathname}` });
+		} catch (error) {
+			send(res, error instanceof HttpError ? error.status : 500, { error: scrub(error instanceof Error ? error.message : String(error), cfg.root) });
+		}
+	};
+}
+function listen(server, port, attemptsLeft) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => {
+			if (error.code === "EADDRINUSE" && attemptsLeft > 0) {
+				server.removeListener("error", onError);
+				resolve(listen(server, port + 1, attemptsLeft - 1));
+				return;
+			}
+			reject(error);
+		};
+		server.once("error", onError);
+		server.listen(port, "127.0.0.1", () => {
+			server.removeListener("error", onError);
+			const bound = server.address();
+			resolve(typeof bound === "object" && bound !== null ? bound.port : port);
+		});
+	});
+}
+async function startStudio(cfg, options = {}) {
+	const token = options.token ?? newToken();
+	const server = createServer();
+	let port = options.port ?? DEFAULT_PORT;
+	server.on("request", (req, res) => void createStudioApp(cfg, port, token)(req, res));
+	port = await listen(server, port, 20);
+	return {
+		server,
+		port,
+		token,
+		url: `http://127.0.0.1:${port}/api/state?t=${token}`,
+		close: () => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
+	};
+}
+//#endregion
+//#region src/cli.ts
+try {
+	const { values } = parseArgs({ options: {
+		root: { type: "string" },
+		port: { type: "string" },
+		json: { type: "boolean" }
+	} });
+	const port = values.port === void 0 ? void 0 : Number(values.port);
+	if (port !== void 0 && !Number.isInteger(port)) throw new Error(`[verbaly] --port needs a number, got "${values.port}"`);
+	const cfg = await loadConfig(values.root ?? process.cwd());
+	if (values.json) console.log(JSON.stringify(await buildState(cfg), null, 2));
+	else {
+		const studio = await startStudio(cfg, { port });
+		const state = await buildState(cfg);
+		const missing = state.status.locales.reduce((n, l) => n + (l.total - l.translated), 0);
+		const drafts = Object.values(state.drafts).reduce((n, keys) => n + keys.length, 0);
+		console.log(`\n  Verbaly Studio   ${studio.url}`);
+		console.log(`  Project          ${cfg.root}`);
+		console.log(`  Catalog          ${counted(state.status.messages, "message")} · ${missing} untranslated · ${counted(drafts, "draft")}`);
+		for (const problem of state.problems) console.log(`  ! ${problem.scope}: ${problem.message}`);
+		console.log("\n  Ctrl+C to stop\n");
+	}
+} catch (error) {
+	console.error(formatCliError(error));
+	process.exitCode = 1;
+}
+//#endregion
+export {};
+
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","names":[],"sources":["../src/http.ts","../src/triage.ts","../src/api.ts","../src/guard.ts","../src/server.ts","../src/cli.ts"],"sourcesContent":["// A client mistake is not a server fault, so the status rides with the error, not a blanket 500.\nexport class HttpError extends Error {\n  readonly status: number;\n\n  constructor(status: number, message: string) {\n    super(message.startsWith('[verbaly]') ? message : `[verbaly] ${message}`);\n    this.status = status;\n    this.name = 'HttpError';\n  }\n}\n\nexport const badRequest = (message: string) => new HttpError(400, message);\n\n// The absolute path of someone's project is not the browser's business.\nexport function scrub(message: string, root: string): string {\n  return root ? message.split(root).join('.') : message;\n}\n","import type { Catalog } from '@verbaly/compiler';\n\nexport type TriageSignal = 'divergent' | 'collision' | 'echo' | 'digits' | 'code' | 'url';\n\nexport interface TriageReason {\n  signal: TriageSignal;\n  text: string;\n}\n\nexport type TriageResult = Record<string, TriageReason[]>;\n\n// check() already caught the structure, so these only point at the few worth reading first.\nexport interface TriageInput {\n  source: Catalog;\n  target: Catalog;\n  reviewed: Catalog[];\n}\n\nconst DIGITS = /\\d[\\d.,]*/g;\nconst URLS = /https?:\\/\\/[^\\s<)\"']+/g;\nconst CODE = /<code>([^<]+)<\\/code>/g;\n\nfunction bag(text: string, re: RegExp, normalize?: (v: string) => string): string[] {\n  const found = text.match(re) ?? [];\n  return (normalize ? found.map(normalize) : found).sort();\n}\n\nfunction same(a: string[], b: string[]): boolean {\n  return a.length === b.length && a.every((v, i) => v === b[i]);\n}\n\n// A number or a url at the end of a clause takes the punctuation with it, and that is not a signal.\nconst trimPunct = (v: string) => v.replace(/[.,;:!?)\\]]+$/, '');\n// A separator is idiomatic (3.09 is 3,09 in Spanish); canonizing keeps 1.5 apart from 15.\nconst bareDigits = (v: string) => trimPunct(v).replaceAll(/[.,]/g, '.');\n\nfunction push(out: TriageResult, key: string, reason: TriageReason): void {\n  (out[key] ??= []).push(reason);\n}\n\nexport function triage({ source, target, reviewed }: TriageInput): TriageResult {\n  // null-prototype: a source text of \"__proto__\" or \"toString\" is a string, not a member of Object\n  const out: TriageResult = Object.create(null);\n  const keys = Object.keys(source);\n\n  // One source text that two humans rendered two ways is ambiguous, so the machine had no chance.\n  const bySource: Record<string, string[]> = Object.create(null);\n  for (const key of keys) {\n    const text = source[key]?.trim();\n    if (text) (bySource[text] ??= []).push(key);\n  }\n  for (const [text, group] of Object.entries(bySource)) {\n    if (group.length < 2) continue;\n    const divergent = reviewed.some(\n      (catalog) => new Set(group.map((k) => catalog[k]?.trim() ?? '').filter(Boolean)).size > 1,\n    );\n    if (divergent) {\n      for (const key of group) {\n        push(out, key, { signal: 'divergent', text: `\"${text}\" was already translated two ways` });\n      }\n    }\n    // The same ambiguity seen from the result instead of from the history.\n    const targets = new Set(group.map((key) => target[key]?.trim() ?? '').filter(Boolean));\n    if (!divergent && targets.size > 1) {\n      for (const key of group) {\n        push(out, key, { signal: 'collision', text: `\"${text}\" came back as two different translations` });\n      }\n    }\n  }\n\n  for (const key of keys) {\n    const src = source[key]?.trim() ?? '';\n    const trg = target[key]?.trim() ?? '';\n    if (!src || !trg) continue;\n\n    // Only the locales with an opinion on this key vote: alone it fires on every do-not-translate.\n    const opinions = reviewed.map((c) => c[key]?.trim()).filter((v) => v !== undefined && v !== '');\n    if (trg === src && opinions.length > 0 && opinions.every((v) => v !== src)) {\n      push(out, key, { signal: 'echo', text: 'still identical to the source' });\n    }\n\n    // a translation that adds a number is idiomatic (\"refresh\" is \"F5\"); one that changes it is not\n    const srcDigits = bag(src, DIGITS, bareDigits);\n    if (srcDigits.length > 0 && !same(srcDigits, bag(trg, DIGITS, bareDigits))) {\n      push(out, key, { signal: 'digits', text: 'the numbers do not match the source' });\n    }\n    if (!same(bag(src, URLS, trimPunct), bag(trg, URLS, trimPunct))) {\n      push(out, key, { signal: 'url', text: 'a URL changed' });\n    }\n    if (!same(bag(src, CODE), bag(trg, CODE))) {\n      push(out, key, { signal: 'code', text: 'the contents of a <code> span changed' });\n    }\n  }\n\n  return out;\n}\n","import { existsSync } from 'node:fs';\nimport { relative } from 'node:path';\nimport {\n  check,\n  clearDrafts,\n  collectOrigins,\n  doctor,\n  effectiveDrafts,\n  extractProject,\n  loadDrafts,\n  readCatalog,\n  saveDrafts,\n  status,\n  targetLocales,\n  validateMessage,\n  validatePair,\n  writeCatalog,\n} from '@verbaly/compiler';\nimport { DRAFTS_FILE } from '@verbaly/compiler';\nimport type {\n  Catalog,\n  Catalogs,\n  CheckResult,\n  DoctorResult,\n  Drafts,\n  ResolvedConfig,\n  StatusResult,\n} from '@verbaly/compiler';\nimport { badRequest } from './http';\nimport { triage, type TriageResult } from './triage';\n\nexport interface StudioProblem {\n  scope: string;\n  message: string;\n}\n\nexport interface StudioState {\n  root: string;\n  dir: string;\n  sourceLocale: string;\n  locales: string[];\n  scanning: boolean;\n  catalogs: Catalogs;\n  origins: Record<string, string[]>;\n  status: StatusResult;\n  check: CheckResult;\n  drafts: Drafts;\n  triage: Record<string, TriageResult>;\n  problems: StudioProblem[];\n}\n\n// A locale nobody can parse must not take the panel down: Studio is what you open to fix it.\nfunction readAll(cfg: ResolvedConfig): { catalogs: Catalogs; problems: StudioProblem[] } {\n  const catalogs: Catalogs = {};\n  const problems: StudioProblem[] = [];\n  // an empty green panel and a wrong --root look identical, and only this line tells them apart\n  if (!existsSync(cfg.dir)) {\n    const dir = relative(cfg.root, cfg.dir).replaceAll('\\\\', '/');\n    problems.push({ scope: dir, message: '[verbaly] no catalogs here, run npx verbaly init or check --root' });\n  }\n  for (const locale of cfg.locales) {\n    try {\n      catalogs[locale] = readCatalog(cfg, locale);\n    } catch (error) {\n      catalogs[locale] = {};\n      problems.push({\n        scope: locale,\n        message: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return { catalogs, problems };\n}\n\n// A sidecar nobody can parse is the other file Studio exists to fix, so it degrades like a catalog.\nfunction readDrafts(cfg: ResolvedConfig): { drafts: Drafts; problems: StudioProblem[] } {\n  try {\n    return { drafts: loadDrafts(cfg), problems: [] };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return { drafts: {}, problems: [{ scope: DRAFTS_FILE, message }] };\n  }\n}\n\n// check() reports the file a stray key was used in as an absolute path, origins already do not.\nfunction relativize(cfg: ResolvedConfig, result: CheckResult): CheckResult {\n  return {\n    ...result,\n    unknown: result.unknown.map((entry) => ({\n      ...entry,\n      files: entry.files.map((file) => relative(cfg.root, file).replaceAll('\\\\', '/')),\n    })),\n  };\n}\n\n// One shot and unpaginated: the biggest catalog we know is 1425 messages, instant over localhost.\nexport async function buildState(cfg: ResolvedConfig): Promise<StudioState> {\n  const { catalogs, problems } = readAll(cfg);\n  const registry = await extractProject(cfg);\n  const sidecar = readDrafts(cfg);\n  problems.push(...sidecar.problems);\n  const live = effectiveDrafts(sidecar.drafts, catalogs);\n  const source = (catalogs[cfg.sourceLocale] ?? {}) as Catalog;\n  const targets = targetLocales(cfg);\n\n  for (const { file, message } of registry.parseErrors()) {\n    problems.push({ scope: relative(cfg.root, file).replaceAll('\\\\', '/'), message });\n  }\n\n  const perLocale: Record<string, TriageResult> = {};\n  for (const locale of targets) {\n    perLocale[locale] = triage({\n      source,\n      target: (catalogs[locale] ?? {}) as Catalog,\n      // a locale still carrying drafts has not been reviewed, so it cannot be the control\n      reviewed: targets\n        .filter((other) => other !== locale && !(live[other] ?? []).length)\n        .map((other) => (catalogs[other] ?? {}) as Catalog),\n    });\n  }\n\n  return {\n    root: cfg.root,\n    dir: cfg.dir,\n    sourceLocale: cfg.sourceLocale,\n    locales: cfg.locales,\n    // with include: [] nothing is scanned, so an empty origins map is off, not \"none found\"\n    scanning: cfg.include.length > 0,\n    catalogs,\n    origins: await collectOrigins(cfg, registry),\n    status: status(cfg, catalogs, registry, live),\n    check: relativize(cfg, check(cfg, catalogs, registry)),\n    drafts: live,\n    triage: perLocale,\n    problems,\n  };\n}\n\nexport function health(cfg: ResolvedConfig): Promise<DoctorResult> {\n  return doctor(cfg);\n}\n\nexport interface WriteMessageResult {\n  locale: string;\n  key: string;\n  clearedDraft: boolean;\n}\n\n// A human wrote it, so it is reviewed: the rule import already applies in run.ts:447.\nexport function writeMessage(\n  cfg: ResolvedConfig,\n  locale: string,\n  key: string,\n  text: string,\n): WriteMessageResult {\n  if (locale === cfg.sourceLocale) {\n    throw badRequest('the source text lives in your code, Studio never edits it');\n  }\n  if (!cfg.locales.includes(locale)) {\n    throw badRequest(`${locale} is not one of this project's locales`);\n  }\n  const source = readCatalog(cfg, cfg.sourceLocale);\n  // hasOwn, not `in`: `in` walks the prototype, so toString and __proto__ would pass this guard\n  if (!Object.hasOwn(source, key)) {\n    throw badRequest(`\"${key}\" is not in the source catalog, so Studio will not create it`);\n  }\n  // '' is untranslated everywhere else, so whitespace is that and not a translation to validate\n  const value = text.trim() ? text : '';\n  // the same two calls check() makes: validatePair alone misses a plural block with no other case\n  const issues = value\n    ? [...validateMessage(value, locale), ...validatePair(source[key] as string, value)]\n    : [];\n  const errors = issues.filter((issue) => issue.severity === 'error');\n  if (errors.length) {\n    throw badRequest(`${errors.map((issue) => issue.message).join('; ')}`);\n  }\n\n  const catalog = { ...readCatalog(cfg, locale), [key]: value };\n  writeCatalog(cfg, locale, catalog);\n\n  const drafts = loadDrafts(cfg);\n  const clearedDraft = (drafts[locale] ?? []).includes(key);\n  clearDrafts(drafts, locale, [key]);\n  saveDrafts(cfg, drafts);\n  return { locale, key, clearedDraft };\n}\n\nexport interface ApproveResult {\n  locale: string;\n  approved: number;\n}\n\n// The sidecar is re-read here: saveDrafts writes every locale, so a stale copy drops another's.\nexport function approve(cfg: ResolvedConfig, locale: string, keys?: string[]): ApproveResult {\n  if (!cfg.locales.includes(locale)) {\n    throw badRequest(`${locale} is not one of this project's locales`);\n  }\n  const drafts = loadDrafts(cfg);\n  const before = (drafts[locale] ?? []).length;\n  clearDrafts(drafts, locale, keys);\n  const after = (drafts[locale] ?? []).length;\n  saveDrafts(cfg, drafts);\n  return { locale, approved: before - after };\n}\n","import { randomBytes, timingSafeEqual } from 'node:crypto';\n\nexport interface GuardOptions {\n  port: number;\n  token: string;\n}\n\n// A local server that writes files is reachable from any page the browser has open.\nexport function newToken(): string {\n  return randomBytes(9).toString('base64url');\n}\n\n// Only the two names that resolve to this machine. A DNS rebind arrives with a foreign Host.\nexport function hostAllowed(host: string | undefined, port: number): boolean {\n  // a browser omits the port when it is the scheme default, so :80 would 403 every real request\n  const names = port === 80 ? ['127.0.0.1', 'localhost'] : [];\n  return [`127.0.0.1:${port}`, `localhost:${port}`, ...names].includes(host ?? '');\n}\n\n// No Origin at all is a same-origin navigation or a curl, both fine; a foreign one never is.\nexport function originAllowed(origin: string | undefined, port: number): boolean {\n  if (origin === undefined) return true;\n  return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;\n}\n\n// Compared in constant time so the token cannot be guessed one character at a time.\nexport function tokenMatches(given: string | null, expected: string): boolean {\n  if (given === null) return false;\n  const a = Buffer.from(given);\n  const b = Buffer.from(expected);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nexport interface GuardVerdict {\n  ok: boolean;\n  status: number;\n  reason: string;\n}\n\nconst PASS: GuardVerdict = { ok: true, status: 200, reason: '' };\n\nexport function guardRequest(\n  headers: { host?: string; origin?: string },\n  url: URL,\n  { port, token }: GuardOptions,\n): GuardVerdict {\n  if (!hostAllowed(headers.host, port)) {\n    return { ok: false, status: 403, reason: '[verbaly] unexpected Host header' };\n  }\n  if (!originAllowed(headers.origin, port)) {\n    return { ok: false, status: 403, reason: '[verbaly] cross-origin request' };\n  }\n  if (!tokenMatches(url.searchParams.get('t'), token)) {\n    return { ok: false, status: 401, reason: '[verbaly] missing or wrong token, open the printed url' };\n  }\n  return PASS;\n}\n","import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport type { ResolvedConfig } from '@verbaly/compiler';\nimport { approve, buildState, health, writeMessage } from './api';\nimport { guardRequest, newToken } from './guard';\nimport { HttpError, badRequest, scrub } from './http';\n\nexport interface StudioServer {\n  server: Server;\n  port: number;\n  token: string;\n  url: string;\n  close: () => Promise<void>;\n}\n\nexport interface StartOptions {\n  port?: number;\n  token?: string;\n}\n\nconst DEFAULT_PORT = 4747;\nconst MAX_BODY = 1_000_000;\n\nfunction send(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, {\n    'content-type': 'application/json; charset=utf-8',\n    'cache-control': 'no-store',\n  });\n  res.end(JSON.stringify(body));\n}\n\nasync function readJson(req: IncomingMessage): Promise<Record<string, unknown>> {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of req) {\n    size += (chunk as Buffer).length;\n    if (size > MAX_BODY) throw new HttpError(413, 'request body too large');\n    chunks.push(chunk as Buffer);\n  }\n  if (!chunks.length) return {};\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));\n  } catch {\n    throw badRequest('body is not valid JSON');\n  }\n  // null and an array both pass typeof 'object', and reading .text off them is a 500\n  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n    throw badRequest('body must be a JSON object');\n  }\n  return parsed as Record<string, unknown>;\n}\n\nfunction segment(raw: string | undefined, what: string): string {\n  let value: string;\n  try {\n    value = decodeURIComponent(raw ?? '');\n  } catch {\n    throw badRequest(`the ${what} in the url is not valid percent-encoding`);\n  }\n  if (!value) throw badRequest(`the url is missing a ${what}`);\n  return value;\n}\n\n// One page, JSON on every route: a framework would only add a dependency to a local tool.\nexport function createStudioApp(cfg: ResolvedConfig, port: number, token: string) {\n  return async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {\n    // The url is built inside the try: `GET //` throws, and out here that would kill the process.\n    try {\n      let url: URL;\n      try {\n        url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);\n      } catch {\n        throw badRequest('the request target is not a valid url');\n      }\n\n      const verdict = guardRequest({ host: req.headers.host, origin: req.headers.origin }, url, {\n        port,\n        token,\n      });\n      if (!verdict.ok) {\n        send(res, verdict.status, { error: verdict.reason });\n        return;\n      }\n\n      if (req.method === 'GET' && url.pathname === '/api/state') {\n        send(res, 200, await buildState(cfg));\n        return;\n      }\n      if (req.method === 'GET' && url.pathname === '/api/health') {\n        send(res, 200, await health(cfg));\n        return;\n      }\n      if (req.method === 'PUT' && url.pathname.startsWith('/api/message/')) {\n        const rest = url.pathname.slice('/api/message/'.length).split('/');\n        const locale = segment(rest[0], 'locale');\n        const key = segment(rest.slice(1).join('/'), 'key');\n        const body = await readJson(req);\n        if (typeof body.text !== 'string') throw badRequest('body needs a \"text\" string');\n        send(res, 200, writeMessage(cfg, locale, key, body.text));\n        return;\n      }\n      if (req.method === 'POST' && url.pathname === '/api/approve') {\n        const body = await readJson(req);\n        if (typeof body.locale !== 'string') throw badRequest('body needs a \"locale\" string');\n        const keys = Array.isArray(body.keys)\n          ? body.keys.filter((k): k is string => typeof k === 'string')\n          : undefined;\n        send(res, 200, approve(cfg, body.locale, keys));\n        return;\n      }\n      send(res, 404, { error: `[verbaly] no route for ${req.method} ${url.pathname}` });\n    } catch (error) {\n      const status = error instanceof HttpError ? error.status : 500;\n      const message = error instanceof Error ? error.message : String(error);\n      send(res, status, { error: scrub(message, cfg.root) });\n    }\n  };\n}\n\n// A busy port climbs instead of failing: this is a local tool, not a service on a fixed address.\nfunction listen(server: Server, port: number, attemptsLeft: number): Promise<number> {\n  return new Promise((resolve, reject) => {\n    const onError = (error: NodeJS.ErrnoException) => {\n      if (error.code === 'EADDRINUSE' && attemptsLeft > 0) {\n        server.removeListener('error', onError);\n        resolve(listen(server, port + 1, attemptsLeft - 1));\n        return;\n      }\n      reject(error);\n    };\n    server.once('error', onError);\n    server.listen(port, '127.0.0.1', () => {\n      server.removeListener('error', onError);\n      // port 0 asks the system to pick, so the bound address is the only place the answer is\n      const bound = server.address() as AddressInfo | string | null;\n      resolve(typeof bound === 'object' && bound !== null ? bound.port : port);\n    });\n  });\n}\n\nexport async function startStudio(\n  cfg: ResolvedConfig,\n  options: StartOptions = {},\n): Promise<StudioServer> {\n  const token = options.token ?? newToken();\n  const server = createServer();\n  // The handler is attached before listen so no request can arrive without one.\n  let port = options.port ?? DEFAULT_PORT;\n  server.on('request', (req, res) => void createStudioApp(cfg, port, token)(req, res));\n  port = await listen(server, port, 20);\n\n  return {\n    server,\n    port,\n    token,\n    url: `http://127.0.0.1:${port}/api/state?t=${token}`,\n    close: () =>\n      new Promise<void>((resolve, reject) =>\n        server.close((error) => (error ? reject(error) : resolve())),\n      ),\n  };\n}\n","#!/usr/bin/env node\nimport { parseArgs } from 'node:util';\nimport { counted, formatCliError, loadConfig } from '@verbaly/compiler';\nimport { buildState } from './api';\nimport { startStudio } from './server';\n\ntry {\n  const { values } = parseArgs({\n    options: {\n      root: { type: 'string' },\n      port: { type: 'string' },\n      json: { type: 'boolean' },\n    },\n  });\n  const port = values.port === undefined ? undefined : Number(values.port);\n  if (port !== undefined && !Number.isInteger(port)) {\n    throw new Error(`[verbaly] --port needs a number, got \"${values.port}\"`);\n  }\n  const cfg = await loadConfig(values.root ?? process.cwd());\n\n  // --json is the state the interface reads, on stdout, before any interface exists.\n  if (values.json) {\n    console.log(JSON.stringify(await buildState(cfg), null, 2));\n  } else {\n    const studio = await startStudio(cfg, { port });\n    const state = await buildState(cfg);\n    const missing = state.status.locales.reduce((n, l) => n + (l.total - l.translated), 0);\n    const drafts = Object.values(state.drafts).reduce((n, keys) => n + keys.length, 0);\n    console.log(`\\n  Verbaly Studio   ${studio.url}`);\n    console.log(`  Project          ${cfg.root}`);\n    console.log(\n      `  Catalog          ${counted(state.status.messages, 'message')} · ` +\n        `${missing} untranslated · ${counted(drafts, 'draft')}`,\n    );\n    for (const problem of state.problems) console.log(`  ! ${problem.scope}: ${problem.message}`);\n    console.log('\\n  Ctrl+C to stop\\n');\n  }\n} catch (error) {\n  console.error(formatCliError(error));\n  process.exitCode = 1;\n}\n"],"mappings":";;;;;;;;AACA,IAAa,YAAb,cAA+B,MAAM;CACnC;CAEA,YAAY,QAAgB,SAAiB;EAC3C,MAAM,QAAQ,WAAW,WAAW,IAAI,UAAU,aAAa,SAAS;EACxE,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAEA,MAAa,cAAc,YAAoB,IAAI,UAAU,KAAK,OAAO;AAGzE,SAAgB,MAAM,SAAiB,MAAsB;CAC3D,OAAO,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI;AAChD;;;ACEA,MAAM,SAAS;AACf,MAAM,OAAO;AACb,MAAM,OAAO;AAEb,SAAS,IAAI,MAAc,IAAY,WAA6C;CAClF,MAAM,QAAQ,KAAK,MAAM,EAAE,KAAK,CAAC;CACjC,QAAQ,YAAY,MAAM,IAAI,SAAS,IAAI,MAAA,CAAO,KAAK;AACzD;AAEA,SAAS,KAAK,GAAa,GAAsB;CAC/C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,MAAM,EAAE,EAAE;AAC9D;AAGA,MAAM,aAAa,MAAc,EAAE,QAAQ,iBAAiB,EAAE;AAE9D,MAAM,cAAc,MAAc,UAAU,CAAC,CAAC,CAAC,WAAW,SAAS,GAAG;AAEtE,SAAS,KAAK,KAAmB,KAAa,QAA4B;CACxE,CAAC,IAAI,SAAS,CAAC,EAAA,CAAG,KAAK,MAAM;AAC/B;AAEA,SAAgB,OAAO,EAAE,QAAQ,QAAQ,YAAuC;CAE9E,MAAM,MAAoB,OAAO,OAAO,IAAI;CAC5C,MAAM,OAAO,OAAO,KAAK,MAAM;CAG/B,MAAM,WAAqC,OAAO,OAAO,IAAI;CAC7D,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,OAAO,OAAO,IAAI,EAAE,KAAK;EAC/B,IAAI,MAAM,CAAC,SAAS,UAAU,CAAC,EAAA,CAAG,KAAK,GAAG;CAC5C;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,GAAG;EACpD,IAAI,MAAM,SAAS,GAAG;EACtB,MAAM,YAAY,SAAS,MACxB,YAAY,IAAI,IAAI,MAAM,KAAK,MAAM,QAAQ,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAC1F;EACA,IAAI,WACF,KAAK,MAAM,OAAO,OAChB,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAa,MAAM,IAAI,KAAK;EAAmC,CAAC;EAI7F,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,OAAO,OAAO,CAAC;EACrF,IAAI,CAAC,aAAa,QAAQ,OAAO,GAC/B,KAAK,MAAM,OAAO,OAChB,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAa,MAAM,IAAI,KAAK;EAA2C,CAAC;CAGvG;CAEA,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,MAAM,OAAO,IAAI,EAAE,KAAK,KAAK;EACnC,MAAM,MAAM,OAAO,IAAI,EAAE,KAAK,KAAK;EACnC,IAAI,CAAC,OAAO,CAAC,KAAK;EAGlB,MAAM,WAAW,SAAS,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,KAAA,KAAa,MAAM,EAAE;EAC9F,IAAI,QAAQ,OAAO,SAAS,SAAS,KAAK,SAAS,OAAO,MAAM,MAAM,GAAG,GACvE,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAQ,MAAM;EAAgC,CAAC;EAI1E,MAAM,YAAY,IAAI,KAAK,QAAQ,UAAU;EAC7C,IAAI,UAAU,SAAS,KAAK,CAAC,KAAK,WAAW,IAAI,KAAK,QAAQ,UAAU,CAAC,GACvE,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAU,MAAM;EAAsC,CAAC;EAElF,IAAI,CAAC,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,IAAI,KAAK,MAAM,SAAS,CAAC,GAC5D,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAO,MAAM;EAAgB,CAAC;EAEzD,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,GACtC,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAQ,MAAM;EAAwC,CAAC;CAEpF;CAEA,OAAO;AACT;;;AC3CA,SAAS,QAAQ,KAAwE;CACvF,MAAM,WAAqB,CAAC;CAC5B,MAAM,WAA4B,CAAC;CAEnC,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG;EACxB,MAAM,MAAM,SAAS,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,MAAM,GAAG;EAC5D,SAAS,KAAK;GAAE,OAAO;GAAK,SAAS;EAAmE,CAAC;CAC3G;CACA,KAAK,MAAM,UAAU,IAAI,SACvB,IAAI;EACF,SAAS,UAAU,YAAY,KAAK,MAAM;CAC5C,SAAS,OAAO;EACd,SAAS,UAAU,CAAC;EACpB,SAAS,KAAK;GACZ,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;CAEF,OAAO;EAAE;EAAU;CAAS;AAC9B;AAGA,SAAS,WAAW,KAAoE;CACtF,IAAI;EACF,OAAO;GAAE,QAAQ,WAAW,GAAG;GAAG,UAAU,CAAC;EAAE;CACjD,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,OAAO;GAAE,QAAQ,CAAC;GAAG,UAAU,CAAC;IAAE,OAAO;IAAa;GAAQ,CAAC;EAAE;CACnE;AACF;AAGA,SAAS,WAAW,KAAqB,QAAkC;CACzE,OAAO;EACL,GAAG;EACH,SAAS,OAAO,QAAQ,KAAK,WAAW;GACtC,GAAG;GACH,OAAO,MAAM,MAAM,KAAK,SAAS,SAAS,IAAI,MAAM,IAAI,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC;EACjF,EAAE;CACJ;AACF;AAGA,eAAsB,WAAW,KAA2C;CAC1E,MAAM,EAAE,UAAU,aAAa,QAAQ,GAAG;CAC1C,MAAM,WAAW,MAAM,eAAe,GAAG;CACzC,MAAM,UAAU,WAAW,GAAG;CAC9B,SAAS,KAAK,GAAG,QAAQ,QAAQ;CACjC,MAAM,OAAO,gBAAgB,QAAQ,QAAQ,QAAQ;CACrD,MAAM,SAAU,SAAS,IAAI,iBAAiB,CAAC;CAC/C,MAAM,UAAU,cAAc,GAAG;CAEjC,KAAK,MAAM,EAAE,MAAM,aAAa,SAAS,YAAY,GACnD,SAAS,KAAK;EAAE,OAAO,SAAS,IAAI,MAAM,IAAI,CAAC,CAAC,WAAW,MAAM,GAAG;EAAG;CAAQ,CAAC;CAGlF,MAAM,YAA0C,CAAC;CACjD,KAAK,MAAM,UAAU,SACnB,UAAU,UAAU,OAAO;EACzB;EACA,QAAS,SAAS,WAAW,CAAC;EAE9B,UAAU,QACP,QAAQ,UAAU,UAAU,UAAU,EAAE,KAAK,UAAU,CAAC,EAAA,CAAG,MAAM,CAAC,CAClE,KAAK,UAAW,SAAS,UAAU,CAAC,CAAa;CACtD,CAAC;CAGH,OAAO;EACL,MAAM,IAAI;EACV,KAAK,IAAI;EACT,cAAc,IAAI;EAClB,SAAS,IAAI;EAEb,UAAU,IAAI,QAAQ,SAAS;EAC/B;EACA,SAAS,MAAM,eAAe,KAAK,QAAQ;EAC3C,QAAQ,OAAO,KAAK,UAAU,UAAU,IAAI;EAC5C,OAAO,WAAW,KAAK,MAAM,KAAK,UAAU,QAAQ,CAAC;EACrD,QAAQ;EACR,QAAQ;EACR;CACF;AACF;AAEA,SAAgB,OAAO,KAA4C;CACjE,OAAO,OAAO,GAAG;AACnB;AASA,SAAgB,aACd,KACA,QACA,KACA,MACoB;CACpB,IAAI,WAAW,IAAI,cACjB,MAAM,WAAW,2DAA2D;CAE9E,IAAI,CAAC,IAAI,QAAQ,SAAS,MAAM,GAC9B,MAAM,WAAW,GAAG,OAAO,sCAAsC;CAEnE,MAAM,SAAS,YAAY,KAAK,IAAI,YAAY;CAEhD,IAAI,CAAC,OAAO,OAAO,QAAQ,GAAG,GAC5B,MAAM,WAAW,IAAI,IAAI,6DAA6D;CAGxF,MAAM,QAAQ,KAAK,KAAK,IAAI,OAAO;CAKnC,MAAM,UAHS,QACX,CAAC,GAAG,gBAAgB,OAAO,MAAM,GAAG,GAAG,aAAa,OAAO,MAAgB,KAAK,CAAC,IACjF,CAAC,EAAA,CACiB,QAAQ,UAAU,MAAM,aAAa,OAAO;CAClE,IAAI,OAAO,QACT,MAAM,WAAW,GAAG,OAAO,KAAK,UAAU,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI,GAAG;CAGvE,MAAM,UAAU;EAAE,GAAG,YAAY,KAAK,MAAM;GAAI,MAAM;CAAM;CAC5D,aAAa,KAAK,QAAQ,OAAO;CAEjC,MAAM,SAAS,WAAW,GAAG;CAC7B,MAAM,gBAAgB,OAAO,WAAW,CAAC,EAAA,CAAG,SAAS,GAAG;CACxD,YAAY,QAAQ,QAAQ,CAAC,GAAG,CAAC;CACjC,WAAW,KAAK,MAAM;CACtB,OAAO;EAAE;EAAQ;EAAK;CAAa;AACrC;AAQA,SAAgB,QAAQ,KAAqB,QAAgB,MAAgC;CAC3F,IAAI,CAAC,IAAI,QAAQ,SAAS,MAAM,GAC9B,MAAM,WAAW,GAAG,OAAO,sCAAsC;CAEnE,MAAM,SAAS,WAAW,GAAG;CAC7B,MAAM,UAAU,OAAO,WAAW,CAAC,EAAA,CAAG;CACtC,YAAY,QAAQ,QAAQ,IAAI;CAChC,MAAM,SAAS,OAAO,WAAW,CAAC,EAAA,CAAG;CACrC,WAAW,KAAK,MAAM;CACtB,OAAO;EAAE;EAAQ,UAAU,SAAS;CAAM;AAC5C;;;ACnMA,SAAgB,WAAmB;CACjC,OAAO,YAAY,CAAC,CAAC,CAAC,SAAS,WAAW;AAC5C;AAGA,SAAgB,YAAY,MAA0B,MAAuB;CAE3E,MAAM,QAAQ,SAAS,KAAK,CAAC,aAAa,WAAW,IAAI,CAAC;CAC1D,OAAO;EAAC,aAAa;EAAQ,aAAa;EAAQ,GAAG;CAAK,CAAC,CAAC,SAAS,QAAQ,EAAE;AACjF;AAGA,SAAgB,cAAc,QAA4B,MAAuB;CAC/E,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,OAAO,WAAW,oBAAoB,UAAU,WAAW,oBAAoB;AACjF;AAGA,SAAgB,aAAa,OAAsB,UAA2B;CAC5E,IAAI,UAAU,MAAM,OAAO;CAC3B,MAAM,IAAI,OAAO,KAAK,KAAK;CAC3B,MAAM,IAAI,OAAO,KAAK,QAAQ;CAC9B,OAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;AAQA,MAAM,OAAqB;CAAE,IAAI;CAAM,QAAQ;CAAK,QAAQ;AAAG;AAE/D,SAAgB,aACd,SACA,KACA,EAAE,MAAM,SACM;CACd,IAAI,CAAC,YAAY,QAAQ,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,QAAQ;EAAK,QAAQ;CAAmC;CAE9E,IAAI,CAAC,cAAc,QAAQ,QAAQ,IAAI,GACrC,OAAO;EAAE,IAAI;EAAO,QAAQ;EAAK,QAAQ;CAAiC;CAE5E,IAAI,CAAC,aAAa,IAAI,aAAa,IAAI,GAAG,GAAG,KAAK,GAChD,OAAO;EAAE,IAAI;EAAO,QAAQ;EAAK,QAAQ;CAAyD;CAEpG,OAAO;AACT;;;ACpCA,MAAM,eAAe;AACrB,MAAM,WAAW;AAEjB,SAAS,KAAK,KAAqB,QAAgB,MAAqB;CACtE,IAAI,UAAU,QAAQ;EACpB,gBAAgB;EAChB,iBAAiB;CACnB,CAAC;CACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAEA,eAAe,SAAS,KAAwD;CAC9E,MAAM,SAAmB,CAAC;CAC1B,IAAI,OAAO;CACX,WAAW,MAAM,SAAS,KAAK;EAC7B,QAAS,MAAiB;EAC1B,IAAI,OAAO,UAAU,MAAM,IAAI,UAAU,KAAK,wBAAwB;EACtE,OAAO,KAAK,KAAe;CAC7B;CACA,IAAI,CAAC,OAAO,QAAQ,OAAO,CAAC;CAC5B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC;CAC5D,QAAQ;EACN,MAAM,WAAW,wBAAwB;CAC3C;CAEA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,MAAM,WAAW,4BAA4B;CAE/C,OAAO;AACT;AAEA,SAAS,QAAQ,KAAyB,MAAsB;CAC9D,IAAI;CACJ,IAAI;EACF,QAAQ,mBAAmB,OAAO,EAAE;CACtC,QAAQ;EACN,MAAM,WAAW,OAAO,KAAK,0CAA0C;CACzE;CACA,IAAI,CAAC,OAAO,MAAM,WAAW,wBAAwB,MAAM;CAC3D,OAAO;AACT;AAGA,SAAgB,gBAAgB,KAAqB,MAAc,OAAe;CAChF,OAAO,eAAe,OAAO,KAAsB,KAAoC;EAErF,IAAI;GACF,IAAI;GACJ,IAAI;IACF,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,MAAM;GAC1D,QAAQ;IACN,MAAM,WAAW,uCAAuC;GAC1D;GAEA,MAAM,UAAU,aAAa;IAAE,MAAM,IAAI,QAAQ;IAAM,QAAQ,IAAI,QAAQ;GAAO,GAAG,KAAK;IACxF;IACA;GACF,CAAC;GACD,IAAI,CAAC,QAAQ,IAAI;IACf,KAAK,KAAK,QAAQ,QAAQ,EAAE,OAAO,QAAQ,OAAO,CAAC;IACnD;GACF;GAEA,IAAI,IAAI,WAAW,SAAS,IAAI,aAAa,cAAc;IACzD,KAAK,KAAK,KAAK,MAAM,WAAW,GAAG,CAAC;IACpC;GACF;GACA,IAAI,IAAI,WAAW,SAAS,IAAI,aAAa,eAAe;IAC1D,KAAK,KAAK,KAAK,MAAM,OAAO,GAAG,CAAC;IAChC;GACF;GACA,IAAI,IAAI,WAAW,SAAS,IAAI,SAAS,WAAW,eAAe,GAAG;IACpE,MAAM,OAAO,IAAI,SAAS,MAAM,EAAsB,CAAC,CAAC,MAAM,GAAG;IACjE,MAAM,SAAS,QAAQ,KAAK,IAAI,QAAQ;IACxC,MAAM,MAAM,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,KAAK;IAClD,MAAM,OAAO,MAAM,SAAS,GAAG;IAC/B,IAAI,OAAO,KAAK,SAAS,UAAU,MAAM,WAAW,8BAA4B;IAChF,KAAK,KAAK,KAAK,aAAa,KAAK,QAAQ,KAAK,KAAK,IAAI,CAAC;IACxD;GACF;GACA,IAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;IAC5D,MAAM,OAAO,MAAM,SAAS,GAAG;IAC/B,IAAI,OAAO,KAAK,WAAW,UAAU,MAAM,WAAW,gCAA8B;IACpF,MAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,IAChC,KAAK,KAAK,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAC1D,KAAA;IACJ,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,QAAQ,IAAI,CAAC;IAC9C;GACF;GACA,KAAK,KAAK,KAAK,EAAE,OAAO,0BAA0B,IAAI,OAAO,GAAG,IAAI,WAAW,CAAC;EAClF,SAAS,OAAO;GAGd,KAAK,KAFU,iBAAiB,YAAY,MAAM,SAAS,KAEzC,EAAE,OAAO,MADX,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAC3B,IAAI,IAAI,EAAE,CAAC;EACvD;CACF;AACF;AAGA,SAAS,OAAO,QAAgB,MAAc,cAAuC;CACnF,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,WAAW,UAAiC;GAChD,IAAI,MAAM,SAAS,gBAAgB,eAAe,GAAG;IACnD,OAAO,eAAe,SAAS,OAAO;IACtC,QAAQ,OAAO,QAAQ,OAAO,GAAG,eAAe,CAAC,CAAC;IAClD;GACF;GACA,OAAO,KAAK;EACd;EACA,OAAO,KAAK,SAAS,OAAO;EAC5B,OAAO,OAAO,MAAM,mBAAmB;GACrC,OAAO,eAAe,SAAS,OAAO;GAEtC,MAAM,QAAQ,OAAO,QAAQ;GAC7B,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,MAAM,OAAO,IAAI;EACzE,CAAC;CACH,CAAC;AACH;AAEA,eAAsB,YACpB,KACA,UAAwB,CAAC,GACF;CACvB,MAAM,QAAQ,QAAQ,SAAS,SAAS;CACxC,MAAM,SAAS,aAAa;CAE5B,IAAI,OAAO,QAAQ,QAAQ;CAC3B,OAAO,GAAG,YAAY,KAAK,QAAQ,KAAK,gBAAgB,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;CACnF,OAAO,MAAM,OAAO,QAAQ,MAAM,EAAE;CAEpC,OAAO;EACL;EACA;EACA;EACA,KAAK,oBAAoB,KAAK,eAAe;EAC7C,aACE,IAAI,SAAe,SAAS,WAC1B,OAAO,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE,CAC7D;CACJ;AACF;;;AC5JA,IAAI;CACF,MAAM,EAAE,WAAW,UAAU,EAC3B,SAAS;EACP,MAAM,EAAE,MAAM,SAAS;EACvB,MAAM,EAAE,MAAM,SAAS;EACvB,MAAM,EAAE,MAAM,UAAU;CAC1B,EACF,CAAC;CACD,MAAM,OAAO,OAAO,SAAS,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,IAAI;CACvE,IAAI,SAAS,KAAA,KAAa,CAAC,OAAO,UAAU,IAAI,GAC9C,MAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,EAAE;CAEzE,MAAM,MAAM,MAAM,WAAW,OAAO,QAAQ,QAAQ,IAAI,CAAC;CAGzD,IAAI,OAAO,MACT,QAAQ,IAAI,KAAK,UAAU,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,CAAC;MACrD;EACL,MAAM,SAAS,MAAM,YAAY,KAAK,EAAE,KAAK,CAAC;EAC9C,MAAM,QAAQ,MAAM,WAAW,GAAG;EAClC,MAAM,UAAU,MAAM,OAAO,QAAQ,QAAQ,GAAG,MAAM,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC;EACrF,MAAM,SAAS,OAAO,OAAO,MAAM,MAAM,CAAC,CAAC,QAAQ,GAAG,SAAS,IAAI,KAAK,QAAQ,CAAC;EACjF,QAAQ,IAAI,wBAAwB,OAAO,KAAK;EAChD,QAAQ,IAAI,sBAAsB,IAAI,MAAM;EAC5C,QAAQ,IACN,sBAAsB,QAAQ,MAAM,OAAO,UAAU,SAAS,EAAE,KAC3D,QAAQ,kBAAkB,QAAQ,QAAQ,OAAO,GACxD;EACA,KAAK,MAAM,WAAW,MAAM,UAAU,QAAQ,IAAI,OAAO,QAAQ,MAAM,IAAI,QAAQ,SAAS;EAC5F,QAAQ,IAAI,sBAAsB;CACpC;AACF,SAAS,OAAO;CACd,QAAQ,MAAM,eAAe,KAAK,CAAC;CACnC,QAAQ,WAAW;AACrB"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+import { IncomingMessage, Server, ServerResponse } from "node:http";
+import { ResolvedConfig } from "@verbaly/compiler";
+//#region src/server.d.ts
+interface StudioServer {
+  server: Server;
+  port: number;
+  token: string;
+  url: string;
+  close: () => Promise<void>;
+}
+interface StartOptions {
+  port?: number;
+  token?: string;
+}
+export declare function createStudioApp(cfg: ResolvedConfig, port: number, token: string): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export declare function startStudio(cfg: ResolvedConfig, options?: StartOptions): Promise<StudioServer>;
+//#endregion
+export type { StartOptions, StudioServer };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,375 @@
+import { createServer } from "node:http";
+import { existsSync } from "node:fs";
+import { relative } from "node:path";
+import { DRAFTS_FILE, check, clearDrafts, collectOrigins, doctor, effectiveDrafts, extractProject, loadDrafts, readCatalog, saveDrafts, status, targetLocales, validateMessage, validatePair, writeCatalog } from "@verbaly/compiler";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+//#region src/http.ts
+var HttpError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message.startsWith("[verbaly]") ? message : `[verbaly] ${message}`);
+		this.status = status;
+		this.name = "HttpError";
+	}
+};
+const badRequest = (message) => new HttpError(400, message);
+function scrub(message, root) {
+	return root ? message.split(root).join(".") : message;
+}
+//#endregion
+//#region src/triage.ts
+const DIGITS = /\d[\d.,]*/g;
+const URLS = /https?:\/\/[^\s<)"']+/g;
+const CODE = /<code>([^<]+)<\/code>/g;
+function bag(text, re, normalize) {
+	const found = text.match(re) ?? [];
+	return (normalize ? found.map(normalize) : found).sort();
+}
+function same(a, b) {
+	return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+const trimPunct = (v) => v.replace(/[.,;:!?)\]]+$/, "");
+const bareDigits = (v) => trimPunct(v).replaceAll(/[.,]/g, ".");
+function push(out, key, reason) {
+	(out[key] ??= []).push(reason);
+}
+function triage({ source, target, reviewed }) {
+	const out = Object.create(null);
+	const keys = Object.keys(source);
+	const bySource = Object.create(null);
+	for (const key of keys) {
+		const text = source[key]?.trim();
+		if (text) (bySource[text] ??= []).push(key);
+	}
+	for (const [text, group] of Object.entries(bySource)) {
+		if (group.length < 2) continue;
+		const divergent = reviewed.some((catalog) => new Set(group.map((k) => catalog[k]?.trim() ?? "").filter(Boolean)).size > 1);
+		if (divergent) for (const key of group) push(out, key, {
+			signal: "divergent",
+			text: `"${text}" was already translated two ways`
+		});
+		const targets = new Set(group.map((key) => target[key]?.trim() ?? "").filter(Boolean));
+		if (!divergent && targets.size > 1) for (const key of group) push(out, key, {
+			signal: "collision",
+			text: `"${text}" came back as two different translations`
+		});
+	}
+	for (const key of keys) {
+		const src = source[key]?.trim() ?? "";
+		const trg = target[key]?.trim() ?? "";
+		if (!src || !trg) continue;
+		const opinions = reviewed.map((c) => c[key]?.trim()).filter((v) => v !== void 0 && v !== "");
+		if (trg === src && opinions.length > 0 && opinions.every((v) => v !== src)) push(out, key, {
+			signal: "echo",
+			text: "still identical to the source"
+		});
+		const srcDigits = bag(src, DIGITS, bareDigits);
+		if (srcDigits.length > 0 && !same(srcDigits, bag(trg, DIGITS, bareDigits))) push(out, key, {
+			signal: "digits",
+			text: "the numbers do not match the source"
+		});
+		if (!same(bag(src, URLS, trimPunct), bag(trg, URLS, trimPunct))) push(out, key, {
+			signal: "url",
+			text: "a URL changed"
+		});
+		if (!same(bag(src, CODE), bag(trg, CODE))) push(out, key, {
+			signal: "code",
+			text: "the contents of a <code> span changed"
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/api.ts
+function readAll(cfg) {
+	const catalogs = {};
+	const problems = [];
+	if (!existsSync(cfg.dir)) {
+		const dir = relative(cfg.root, cfg.dir).replaceAll("\\", "/");
+		problems.push({
+			scope: dir,
+			message: "[verbaly] no catalogs here, run npx verbaly init or check --root"
+		});
+	}
+	for (const locale of cfg.locales) try {
+		catalogs[locale] = readCatalog(cfg, locale);
+	} catch (error) {
+		catalogs[locale] = {};
+		problems.push({
+			scope: locale,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+	return {
+		catalogs,
+		problems
+	};
+}
+function readDrafts(cfg) {
+	try {
+		return {
+			drafts: loadDrafts(cfg),
+			problems: []
+		};
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return {
+			drafts: {},
+			problems: [{
+				scope: DRAFTS_FILE,
+				message
+			}]
+		};
+	}
+}
+function relativize(cfg, result) {
+	return {
+		...result,
+		unknown: result.unknown.map((entry) => ({
+			...entry,
+			files: entry.files.map((file) => relative(cfg.root, file).replaceAll("\\", "/"))
+		}))
+	};
+}
+async function buildState(cfg) {
+	const { catalogs, problems } = readAll(cfg);
+	const registry = await extractProject(cfg);
+	const sidecar = readDrafts(cfg);
+	problems.push(...sidecar.problems);
+	const live = effectiveDrafts(sidecar.drafts, catalogs);
+	const source = catalogs[cfg.sourceLocale] ?? {};
+	const targets = targetLocales(cfg);
+	for (const { file, message } of registry.parseErrors()) problems.push({
+		scope: relative(cfg.root, file).replaceAll("\\", "/"),
+		message
+	});
+	const perLocale = {};
+	for (const locale of targets) perLocale[locale] = triage({
+		source,
+		target: catalogs[locale] ?? {},
+		reviewed: targets.filter((other) => other !== locale && !(live[other] ?? []).length).map((other) => catalogs[other] ?? {})
+	});
+	return {
+		root: cfg.root,
+		dir: cfg.dir,
+		sourceLocale: cfg.sourceLocale,
+		locales: cfg.locales,
+		scanning: cfg.include.length > 0,
+		catalogs,
+		origins: await collectOrigins(cfg, registry),
+		status: status(cfg, catalogs, registry, live),
+		check: relativize(cfg, check(cfg, catalogs, registry)),
+		drafts: live,
+		triage: perLocale,
+		problems
+	};
+}
+function health(cfg) {
+	return doctor(cfg);
+}
+function writeMessage(cfg, locale, key, text) {
+	if (locale === cfg.sourceLocale) throw badRequest("the source text lives in your code, Studio never edits it");
+	if (!cfg.locales.includes(locale)) throw badRequest(`${locale} is not one of this project's locales`);
+	const source = readCatalog(cfg, cfg.sourceLocale);
+	if (!Object.hasOwn(source, key)) throw badRequest(`"${key}" is not in the source catalog, so Studio will not create it`);
+	const value = text.trim() ? text : "";
+	const errors = (value ? [...validateMessage(value, locale), ...validatePair(source[key], value)] : []).filter((issue) => issue.severity === "error");
+	if (errors.length) throw badRequest(`${errors.map((issue) => issue.message).join("; ")}`);
+	const catalog = {
+		...readCatalog(cfg, locale),
+		[key]: value
+	};
+	writeCatalog(cfg, locale, catalog);
+	const drafts = loadDrafts(cfg);
+	const clearedDraft = (drafts[locale] ?? []).includes(key);
+	clearDrafts(drafts, locale, [key]);
+	saveDrafts(cfg, drafts);
+	return {
+		locale,
+		key,
+		clearedDraft
+	};
+}
+function approve(cfg, locale, keys) {
+	if (!cfg.locales.includes(locale)) throw badRequest(`${locale} is not one of this project's locales`);
+	const drafts = loadDrafts(cfg);
+	const before = (drafts[locale] ?? []).length;
+	clearDrafts(drafts, locale, keys);
+	const after = (drafts[locale] ?? []).length;
+	saveDrafts(cfg, drafts);
+	return {
+		locale,
+		approved: before - after
+	};
+}
+//#endregion
+//#region src/guard.ts
+function newToken() {
+	return randomBytes(9).toString("base64url");
+}
+function hostAllowed(host, port) {
+	const names = port === 80 ? ["127.0.0.1", "localhost"] : [];
+	return [
+		`127.0.0.1:${port}`,
+		`localhost:${port}`,
+		...names
+	].includes(host ?? "");
+}
+function originAllowed(origin, port) {
+	if (origin === void 0) return true;
+	return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
+}
+function tokenMatches(given, expected) {
+	if (given === null) return false;
+	const a = Buffer.from(given);
+	const b = Buffer.from(expected);
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+const PASS = {
+	ok: true,
+	status: 200,
+	reason: ""
+};
+function guardRequest(headers, url, { port, token }) {
+	if (!hostAllowed(headers.host, port)) return {
+		ok: false,
+		status: 403,
+		reason: "[verbaly] unexpected Host header"
+	};
+	if (!originAllowed(headers.origin, port)) return {
+		ok: false,
+		status: 403,
+		reason: "[verbaly] cross-origin request"
+	};
+	if (!tokenMatches(url.searchParams.get("t"), token)) return {
+		ok: false,
+		status: 401,
+		reason: "[verbaly] missing or wrong token, open the printed url"
+	};
+	return PASS;
+}
+//#endregion
+//#region src/server.ts
+const DEFAULT_PORT = 4747;
+const MAX_BODY = 1e6;
+function send(res, status, body) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify(body));
+}
+async function readJson(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		size += chunk.length;
+		if (size > MAX_BODY) throw new HttpError(413, "request body too large");
+		chunks.push(chunk);
+	}
+	if (!chunks.length) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	} catch {
+		throw badRequest("body is not valid JSON");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw badRequest("body must be a JSON object");
+	return parsed;
+}
+function segment(raw, what) {
+	let value;
+	try {
+		value = decodeURIComponent(raw ?? "");
+	} catch {
+		throw badRequest(`the ${what} in the url is not valid percent-encoding`);
+	}
+	if (!value) throw badRequest(`the url is missing a ${what}`);
+	return value;
+}
+function createStudioApp(cfg, port, token) {
+	return async function handle(req, res) {
+		try {
+			let url;
+			try {
+				url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+			} catch {
+				throw badRequest("the request target is not a valid url");
+			}
+			const verdict = guardRequest({
+				host: req.headers.host,
+				origin: req.headers.origin
+			}, url, {
+				port,
+				token
+			});
+			if (!verdict.ok) {
+				send(res, verdict.status, { error: verdict.reason });
+				return;
+			}
+			if (req.method === "GET" && url.pathname === "/api/state") {
+				send(res, 200, await buildState(cfg));
+				return;
+			}
+			if (req.method === "GET" && url.pathname === "/api/health") {
+				send(res, 200, await health(cfg));
+				return;
+			}
+			if (req.method === "PUT" && url.pathname.startsWith("/api/message/")) {
+				const rest = url.pathname.slice(13).split("/");
+				const locale = segment(rest[0], "locale");
+				const key = segment(rest.slice(1).join("/"), "key");
+				const body = await readJson(req);
+				if (typeof body.text !== "string") throw badRequest("body needs a \"text\" string");
+				send(res, 200, writeMessage(cfg, locale, key, body.text));
+				return;
+			}
+			if (req.method === "POST" && url.pathname === "/api/approve") {
+				const body = await readJson(req);
+				if (typeof body.locale !== "string") throw badRequest("body needs a \"locale\" string");
+				const keys = Array.isArray(body.keys) ? body.keys.filter((k) => typeof k === "string") : void 0;
+				send(res, 200, approve(cfg, body.locale, keys));
+				return;
+			}
+			send(res, 404, { error: `[verbaly] no route for ${req.method} ${url.pathname}` });
+		} catch (error) {
+			send(res, error instanceof HttpError ? error.status : 500, { error: scrub(error instanceof Error ? error.message : String(error), cfg.root) });
+		}
+	};
+}
+function listen(server, port, attemptsLeft) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => {
+			if (error.code === "EADDRINUSE" && attemptsLeft > 0) {
+				server.removeListener("error", onError);
+				resolve(listen(server, port + 1, attemptsLeft - 1));
+				return;
+			}
+			reject(error);
+		};
+		server.once("error", onError);
+		server.listen(port, "127.0.0.1", () => {
+			server.removeListener("error", onError);
+			const bound = server.address();
+			resolve(typeof bound === "object" && bound !== null ? bound.port : port);
+		});
+	});
+}
+async function startStudio(cfg, options = {}) {
+	const token = options.token ?? newToken();
+	const server = createServer();
+	let port = options.port ?? DEFAULT_PORT;
+	server.on("request", (req, res) => void createStudioApp(cfg, port, token)(req, res));
+	port = await listen(server, port, 20);
+	return {
+		server,
+		port,
+		token,
+		url: `http://127.0.0.1:${port}/api/state?t=${token}`,
+		close: () => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
+	};
+}
+//#endregion
+export { createStudioApp, startStudio };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/http.ts","../src/triage.ts","../src/api.ts","../src/guard.ts","../src/server.ts"],"sourcesContent":["// A client mistake is not a server fault, so the status rides with the error, not a blanket 500.\nexport class HttpError extends Error {\n  readonly status: number;\n\n  constructor(status: number, message: string) {\n    super(message.startsWith('[verbaly]') ? message : `[verbaly] ${message}`);\n    this.status = status;\n    this.name = 'HttpError';\n  }\n}\n\nexport const badRequest = (message: string) => new HttpError(400, message);\n\n// The absolute path of someone's project is not the browser's business.\nexport function scrub(message: string, root: string): string {\n  return root ? message.split(root).join('.') : message;\n}\n","import type { Catalog } from '@verbaly/compiler';\n\nexport type TriageSignal = 'divergent' | 'collision' | 'echo' | 'digits' | 'code' | 'url';\n\nexport interface TriageReason {\n  signal: TriageSignal;\n  text: string;\n}\n\nexport type TriageResult = Record<string, TriageReason[]>;\n\n// check() already caught the structure, so these only point at the few worth reading first.\nexport interface TriageInput {\n  source: Catalog;\n  target: Catalog;\n  reviewed: Catalog[];\n}\n\nconst DIGITS = /\\d[\\d.,]*/g;\nconst URLS = /https?:\\/\\/[^\\s<)\"']+/g;\nconst CODE = /<code>([^<]+)<\\/code>/g;\n\nfunction bag(text: string, re: RegExp, normalize?: (v: string) => string): string[] {\n  const found = text.match(re) ?? [];\n  return (normalize ? found.map(normalize) : found).sort();\n}\n\nfunction same(a: string[], b: string[]): boolean {\n  return a.length === b.length && a.every((v, i) => v === b[i]);\n}\n\n// A number or a url at the end of a clause takes the punctuation with it, and that is not a signal.\nconst trimPunct = (v: string) => v.replace(/[.,;:!?)\\]]+$/, '');\n// A separator is idiomatic (3.09 is 3,09 in Spanish); canonizing keeps 1.5 apart from 15.\nconst bareDigits = (v: string) => trimPunct(v).replaceAll(/[.,]/g, '.');\n\nfunction push(out: TriageResult, key: string, reason: TriageReason): void {\n  (out[key] ??= []).push(reason);\n}\n\nexport function triage({ source, target, reviewed }: TriageInput): TriageResult {\n  // null-prototype: a source text of \"__proto__\" or \"toString\" is a string, not a member of Object\n  const out: TriageResult = Object.create(null);\n  const keys = Object.keys(source);\n\n  // One source text that two humans rendered two ways is ambiguous, so the machine had no chance.\n  const bySource: Record<string, string[]> = Object.create(null);\n  for (const key of keys) {\n    const text = source[key]?.trim();\n    if (text) (bySource[text] ??= []).push(key);\n  }\n  for (const [text, group] of Object.entries(bySource)) {\n    if (group.length < 2) continue;\n    const divergent = reviewed.some(\n      (catalog) => new Set(group.map((k) => catalog[k]?.trim() ?? '').filter(Boolean)).size > 1,\n    );\n    if (divergent) {\n      for (const key of group) {\n        push(out, key, { signal: 'divergent', text: `\"${text}\" was already translated two ways` });\n      }\n    }\n    // The same ambiguity seen from the result instead of from the history.\n    const targets = new Set(group.map((key) => target[key]?.trim() ?? '').filter(Boolean));\n    if (!divergent && targets.size > 1) {\n      for (const key of group) {\n        push(out, key, { signal: 'collision', text: `\"${text}\" came back as two different translations` });\n      }\n    }\n  }\n\n  for (const key of keys) {\n    const src = source[key]?.trim() ?? '';\n    const trg = target[key]?.trim() ?? '';\n    if (!src || !trg) continue;\n\n    // Only the locales with an opinion on this key vote: alone it fires on every do-not-translate.\n    const opinions = reviewed.map((c) => c[key]?.trim()).filter((v) => v !== undefined && v !== '');\n    if (trg === src && opinions.length > 0 && opinions.every((v) => v !== src)) {\n      push(out, key, { signal: 'echo', text: 'still identical to the source' });\n    }\n\n    // a translation that adds a number is idiomatic (\"refresh\" is \"F5\"); one that changes it is not\n    const srcDigits = bag(src, DIGITS, bareDigits);\n    if (srcDigits.length > 0 && !same(srcDigits, bag(trg, DIGITS, bareDigits))) {\n      push(out, key, { signal: 'digits', text: 'the numbers do not match the source' });\n    }\n    if (!same(bag(src, URLS, trimPunct), bag(trg, URLS, trimPunct))) {\n      push(out, key, { signal: 'url', text: 'a URL changed' });\n    }\n    if (!same(bag(src, CODE), bag(trg, CODE))) {\n      push(out, key, { signal: 'code', text: 'the contents of a <code> span changed' });\n    }\n  }\n\n  return out;\n}\n","import { existsSync } from 'node:fs';\nimport { relative } from 'node:path';\nimport {\n  check,\n  clearDrafts,\n  collectOrigins,\n  doctor,\n  effectiveDrafts,\n  extractProject,\n  loadDrafts,\n  readCatalog,\n  saveDrafts,\n  status,\n  targetLocales,\n  validateMessage,\n  validatePair,\n  writeCatalog,\n} from '@verbaly/compiler';\nimport { DRAFTS_FILE } from '@verbaly/compiler';\nimport type {\n  Catalog,\n  Catalogs,\n  CheckResult,\n  DoctorResult,\n  Drafts,\n  ResolvedConfig,\n  StatusResult,\n} from '@verbaly/compiler';\nimport { badRequest } from './http';\nimport { triage, type TriageResult } from './triage';\n\nexport interface StudioProblem {\n  scope: string;\n  message: string;\n}\n\nexport interface StudioState {\n  root: string;\n  dir: string;\n  sourceLocale: string;\n  locales: string[];\n  scanning: boolean;\n  catalogs: Catalogs;\n  origins: Record<string, string[]>;\n  status: StatusResult;\n  check: CheckResult;\n  drafts: Drafts;\n  triage: Record<string, TriageResult>;\n  problems: StudioProblem[];\n}\n\n// A locale nobody can parse must not take the panel down: Studio is what you open to fix it.\nfunction readAll(cfg: ResolvedConfig): { catalogs: Catalogs; problems: StudioProblem[] } {\n  const catalogs: Catalogs = {};\n  const problems: StudioProblem[] = [];\n  // an empty green panel and a wrong --root look identical, and only this line tells them apart\n  if (!existsSync(cfg.dir)) {\n    const dir = relative(cfg.root, cfg.dir).replaceAll('\\\\', '/');\n    problems.push({ scope: dir, message: '[verbaly] no catalogs here, run npx verbaly init or check --root' });\n  }\n  for (const locale of cfg.locales) {\n    try {\n      catalogs[locale] = readCatalog(cfg, locale);\n    } catch (error) {\n      catalogs[locale] = {};\n      problems.push({\n        scope: locale,\n        message: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return { catalogs, problems };\n}\n\n// A sidecar nobody can parse is the other file Studio exists to fix, so it degrades like a catalog.\nfunction readDrafts(cfg: ResolvedConfig): { drafts: Drafts; problems: StudioProblem[] } {\n  try {\n    return { drafts: loadDrafts(cfg), problems: [] };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return { drafts: {}, problems: [{ scope: DRAFTS_FILE, message }] };\n  }\n}\n\n// check() reports the file a stray key was used in as an absolute path, origins already do not.\nfunction relativize(cfg: ResolvedConfig, result: CheckResult): CheckResult {\n  return {\n    ...result,\n    unknown: result.unknown.map((entry) => ({\n      ...entry,\n      files: entry.files.map((file) => relative(cfg.root, file).replaceAll('\\\\', '/')),\n    })),\n  };\n}\n\n// One shot and unpaginated: the biggest catalog we know is 1425 messages, instant over localhost.\nexport async function buildState(cfg: ResolvedConfig): Promise<StudioState> {\n  const { catalogs, problems } = readAll(cfg);\n  const registry = await extractProject(cfg);\n  const sidecar = readDrafts(cfg);\n  problems.push(...sidecar.problems);\n  const live = effectiveDrafts(sidecar.drafts, catalogs);\n  const source = (catalogs[cfg.sourceLocale] ?? {}) as Catalog;\n  const targets = targetLocales(cfg);\n\n  for (const { file, message } of registry.parseErrors()) {\n    problems.push({ scope: relative(cfg.root, file).replaceAll('\\\\', '/'), message });\n  }\n\n  const perLocale: Record<string, TriageResult> = {};\n  for (const locale of targets) {\n    perLocale[locale] = triage({\n      source,\n      target: (catalogs[locale] ?? {}) as Catalog,\n      // a locale still carrying drafts has not been reviewed, so it cannot be the control\n      reviewed: targets\n        .filter((other) => other !== locale && !(live[other] ?? []).length)\n        .map((other) => (catalogs[other] ?? {}) as Catalog),\n    });\n  }\n\n  return {\n    root: cfg.root,\n    dir: cfg.dir,\n    sourceLocale: cfg.sourceLocale,\n    locales: cfg.locales,\n    // with include: [] nothing is scanned, so an empty origins map is off, not \"none found\"\n    scanning: cfg.include.length > 0,\n    catalogs,\n    origins: await collectOrigins(cfg, registry),\n    status: status(cfg, catalogs, registry, live),\n    check: relativize(cfg, check(cfg, catalogs, registry)),\n    drafts: live,\n    triage: perLocale,\n    problems,\n  };\n}\n\nexport function health(cfg: ResolvedConfig): Promise<DoctorResult> {\n  return doctor(cfg);\n}\n\nexport interface WriteMessageResult {\n  locale: string;\n  key: string;\n  clearedDraft: boolean;\n}\n\n// A human wrote it, so it is reviewed: the rule import already applies in run.ts:447.\nexport function writeMessage(\n  cfg: ResolvedConfig,\n  locale: string,\n  key: string,\n  text: string,\n): WriteMessageResult {\n  if (locale === cfg.sourceLocale) {\n    throw badRequest('the source text lives in your code, Studio never edits it');\n  }\n  if (!cfg.locales.includes(locale)) {\n    throw badRequest(`${locale} is not one of this project's locales`);\n  }\n  const source = readCatalog(cfg, cfg.sourceLocale);\n  // hasOwn, not `in`: `in` walks the prototype, so toString and __proto__ would pass this guard\n  if (!Object.hasOwn(source, key)) {\n    throw badRequest(`\"${key}\" is not in the source catalog, so Studio will not create it`);\n  }\n  // '' is untranslated everywhere else, so whitespace is that and not a translation to validate\n  const value = text.trim() ? text : '';\n  // the same two calls check() makes: validatePair alone misses a plural block with no other case\n  const issues = value\n    ? [...validateMessage(value, locale), ...validatePair(source[key] as string, value)]\n    : [];\n  const errors = issues.filter((issue) => issue.severity === 'error');\n  if (errors.length) {\n    throw badRequest(`${errors.map((issue) => issue.message).join('; ')}`);\n  }\n\n  const catalog = { ...readCatalog(cfg, locale), [key]: value };\n  writeCatalog(cfg, locale, catalog);\n\n  const drafts = loadDrafts(cfg);\n  const clearedDraft = (drafts[locale] ?? []).includes(key);\n  clearDrafts(drafts, locale, [key]);\n  saveDrafts(cfg, drafts);\n  return { locale, key, clearedDraft };\n}\n\nexport interface ApproveResult {\n  locale: string;\n  approved: number;\n}\n\n// The sidecar is re-read here: saveDrafts writes every locale, so a stale copy drops another's.\nexport function approve(cfg: ResolvedConfig, locale: string, keys?: string[]): ApproveResult {\n  if (!cfg.locales.includes(locale)) {\n    throw badRequest(`${locale} is not one of this project's locales`);\n  }\n  const drafts = loadDrafts(cfg);\n  const before = (drafts[locale] ?? []).length;\n  clearDrafts(drafts, locale, keys);\n  const after = (drafts[locale] ?? []).length;\n  saveDrafts(cfg, drafts);\n  return { locale, approved: before - after };\n}\n","import { randomBytes, timingSafeEqual } from 'node:crypto';\n\nexport interface GuardOptions {\n  port: number;\n  token: string;\n}\n\n// A local server that writes files is reachable from any page the browser has open.\nexport function newToken(): string {\n  return randomBytes(9).toString('base64url');\n}\n\n// Only the two names that resolve to this machine. A DNS rebind arrives with a foreign Host.\nexport function hostAllowed(host: string | undefined, port: number): boolean {\n  // a browser omits the port when it is the scheme default, so :80 would 403 every real request\n  const names = port === 80 ? ['127.0.0.1', 'localhost'] : [];\n  return [`127.0.0.1:${port}`, `localhost:${port}`, ...names].includes(host ?? '');\n}\n\n// No Origin at all is a same-origin navigation or a curl, both fine; a foreign one never is.\nexport function originAllowed(origin: string | undefined, port: number): boolean {\n  if (origin === undefined) return true;\n  return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;\n}\n\n// Compared in constant time so the token cannot be guessed one character at a time.\nexport function tokenMatches(given: string | null, expected: string): boolean {\n  if (given === null) return false;\n  const a = Buffer.from(given);\n  const b = Buffer.from(expected);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nexport interface GuardVerdict {\n  ok: boolean;\n  status: number;\n  reason: string;\n}\n\nconst PASS: GuardVerdict = { ok: true, status: 200, reason: '' };\n\nexport function guardRequest(\n  headers: { host?: string; origin?: string },\n  url: URL,\n  { port, token }: GuardOptions,\n): GuardVerdict {\n  if (!hostAllowed(headers.host, port)) {\n    return { ok: false, status: 403, reason: '[verbaly] unexpected Host header' };\n  }\n  if (!originAllowed(headers.origin, port)) {\n    return { ok: false, status: 403, reason: '[verbaly] cross-origin request' };\n  }\n  if (!tokenMatches(url.searchParams.get('t'), token)) {\n    return { ok: false, status: 401, reason: '[verbaly] missing or wrong token, open the printed url' };\n  }\n  return PASS;\n}\n","import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport type { ResolvedConfig } from '@verbaly/compiler';\nimport { approve, buildState, health, writeMessage } from './api';\nimport { guardRequest, newToken } from './guard';\nimport { HttpError, badRequest, scrub } from './http';\n\nexport interface StudioServer {\n  server: Server;\n  port: number;\n  token: string;\n  url: string;\n  close: () => Promise<void>;\n}\n\nexport interface StartOptions {\n  port?: number;\n  token?: string;\n}\n\nconst DEFAULT_PORT = 4747;\nconst MAX_BODY = 1_000_000;\n\nfunction send(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, {\n    'content-type': 'application/json; charset=utf-8',\n    'cache-control': 'no-store',\n  });\n  res.end(JSON.stringify(body));\n}\n\nasync function readJson(req: IncomingMessage): Promise<Record<string, unknown>> {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of req) {\n    size += (chunk as Buffer).length;\n    if (size > MAX_BODY) throw new HttpError(413, 'request body too large');\n    chunks.push(chunk as Buffer);\n  }\n  if (!chunks.length) return {};\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));\n  } catch {\n    throw badRequest('body is not valid JSON');\n  }\n  // null and an array both pass typeof 'object', and reading .text off them is a 500\n  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n    throw badRequest('body must be a JSON object');\n  }\n  return parsed as Record<string, unknown>;\n}\n\nfunction segment(raw: string | undefined, what: string): string {\n  let value: string;\n  try {\n    value = decodeURIComponent(raw ?? '');\n  } catch {\n    throw badRequest(`the ${what} in the url is not valid percent-encoding`);\n  }\n  if (!value) throw badRequest(`the url is missing a ${what}`);\n  return value;\n}\n\n// One page, JSON on every route: a framework would only add a dependency to a local tool.\nexport function createStudioApp(cfg: ResolvedConfig, port: number, token: string) {\n  return async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {\n    // The url is built inside the try: `GET //` throws, and out here that would kill the process.\n    try {\n      let url: URL;\n      try {\n        url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);\n      } catch {\n        throw badRequest('the request target is not a valid url');\n      }\n\n      const verdict = guardRequest({ host: req.headers.host, origin: req.headers.origin }, url, {\n        port,\n        token,\n      });\n      if (!verdict.ok) {\n        send(res, verdict.status, { error: verdict.reason });\n        return;\n      }\n\n      if (req.method === 'GET' && url.pathname === '/api/state') {\n        send(res, 200, await buildState(cfg));\n        return;\n      }\n      if (req.method === 'GET' && url.pathname === '/api/health') {\n        send(res, 200, await health(cfg));\n        return;\n      }\n      if (req.method === 'PUT' && url.pathname.startsWith('/api/message/')) {\n        const rest = url.pathname.slice('/api/message/'.length).split('/');\n        const locale = segment(rest[0], 'locale');\n        const key = segment(rest.slice(1).join('/'), 'key');\n        const body = await readJson(req);\n        if (typeof body.text !== 'string') throw badRequest('body needs a \"text\" string');\n        send(res, 200, writeMessage(cfg, locale, key, body.text));\n        return;\n      }\n      if (req.method === 'POST' && url.pathname === '/api/approve') {\n        const body = await readJson(req);\n        if (typeof body.locale !== 'string') throw badRequest('body needs a \"locale\" string');\n        const keys = Array.isArray(body.keys)\n          ? body.keys.filter((k): k is string => typeof k === 'string')\n          : undefined;\n        send(res, 200, approve(cfg, body.locale, keys));\n        return;\n      }\n      send(res, 404, { error: `[verbaly] no route for ${req.method} ${url.pathname}` });\n    } catch (error) {\n      const status = error instanceof HttpError ? error.status : 500;\n      const message = error instanceof Error ? error.message : String(error);\n      send(res, status, { error: scrub(message, cfg.root) });\n    }\n  };\n}\n\n// A busy port climbs instead of failing: this is a local tool, not a service on a fixed address.\nfunction listen(server: Server, port: number, attemptsLeft: number): Promise<number> {\n  return new Promise((resolve, reject) => {\n    const onError = (error: NodeJS.ErrnoException) => {\n      if (error.code === 'EADDRINUSE' && attemptsLeft > 0) {\n        server.removeListener('error', onError);\n        resolve(listen(server, port + 1, attemptsLeft - 1));\n        return;\n      }\n      reject(error);\n    };\n    server.once('error', onError);\n    server.listen(port, '127.0.0.1', () => {\n      server.removeListener('error', onError);\n      // port 0 asks the system to pick, so the bound address is the only place the answer is\n      const bound = server.address() as AddressInfo | string | null;\n      resolve(typeof bound === 'object' && bound !== null ? bound.port : port);\n    });\n  });\n}\n\nexport async function startStudio(\n  cfg: ResolvedConfig,\n  options: StartOptions = {},\n): Promise<StudioServer> {\n  const token = options.token ?? newToken();\n  const server = createServer();\n  // The handler is attached before listen so no request can arrive without one.\n  let port = options.port ?? DEFAULT_PORT;\n  server.on('request', (req, res) => void createStudioApp(cfg, port, token)(req, res));\n  port = await listen(server, port, 20);\n\n  return {\n    server,\n    port,\n    token,\n    url: `http://127.0.0.1:${port}/api/state?t=${token}`,\n    close: () =>\n      new Promise<void>((resolve, reject) =>\n        server.close((error) => (error ? reject(error) : resolve())),\n      ),\n  };\n}\n"],"mappings":";;;;;;AACA,IAAa,YAAb,cAA+B,MAAM;CACnC;CAEA,YAAY,QAAgB,SAAiB;EAC3C,MAAM,QAAQ,WAAW,WAAW,IAAI,UAAU,aAAa,SAAS;EACxE,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAEA,MAAa,cAAc,YAAoB,IAAI,UAAU,KAAK,OAAO;AAGzE,SAAgB,MAAM,SAAiB,MAAsB;CAC3D,OAAO,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI;AAChD;;;ACEA,MAAM,SAAS;AACf,MAAM,OAAO;AACb,MAAM,OAAO;AAEb,SAAS,IAAI,MAAc,IAAY,WAA6C;CAClF,MAAM,QAAQ,KAAK,MAAM,EAAE,KAAK,CAAC;CACjC,QAAQ,YAAY,MAAM,IAAI,SAAS,IAAI,MAAA,CAAO,KAAK;AACzD;AAEA,SAAS,KAAK,GAAa,GAAsB;CAC/C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,MAAM,EAAE,EAAE;AAC9D;AAGA,MAAM,aAAa,MAAc,EAAE,QAAQ,iBAAiB,EAAE;AAE9D,MAAM,cAAc,MAAc,UAAU,CAAC,CAAC,CAAC,WAAW,SAAS,GAAG;AAEtE,SAAS,KAAK,KAAmB,KAAa,QAA4B;CACxE,CAAC,IAAI,SAAS,CAAC,EAAA,CAAG,KAAK,MAAM;AAC/B;AAEA,SAAgB,OAAO,EAAE,QAAQ,QAAQ,YAAuC;CAE9E,MAAM,MAAoB,OAAO,OAAO,IAAI;CAC5C,MAAM,OAAO,OAAO,KAAK,MAAM;CAG/B,MAAM,WAAqC,OAAO,OAAO,IAAI;CAC7D,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,OAAO,OAAO,IAAI,EAAE,KAAK;EAC/B,IAAI,MAAM,CAAC,SAAS,UAAU,CAAC,EAAA,CAAG,KAAK,GAAG;CAC5C;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,GAAG;EACpD,IAAI,MAAM,SAAS,GAAG;EACtB,MAAM,YAAY,SAAS,MACxB,YAAY,IAAI,IAAI,MAAM,KAAK,MAAM,QAAQ,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAC1F;EACA,IAAI,WACF,KAAK,MAAM,OAAO,OAChB,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAa,MAAM,IAAI,KAAK;EAAmC,CAAC;EAI7F,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,OAAO,OAAO,CAAC;EACrF,IAAI,CAAC,aAAa,QAAQ,OAAO,GAC/B,KAAK,MAAM,OAAO,OAChB,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAa,MAAM,IAAI,KAAK;EAA2C,CAAC;CAGvG;CAEA,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,MAAM,OAAO,IAAI,EAAE,KAAK,KAAK;EACnC,MAAM,MAAM,OAAO,IAAI,EAAE,KAAK,KAAK;EACnC,IAAI,CAAC,OAAO,CAAC,KAAK;EAGlB,MAAM,WAAW,SAAS,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,KAAA,KAAa,MAAM,EAAE;EAC9F,IAAI,QAAQ,OAAO,SAAS,SAAS,KAAK,SAAS,OAAO,MAAM,MAAM,GAAG,GACvE,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAQ,MAAM;EAAgC,CAAC;EAI1E,MAAM,YAAY,IAAI,KAAK,QAAQ,UAAU;EAC7C,IAAI,UAAU,SAAS,KAAK,CAAC,KAAK,WAAW,IAAI,KAAK,QAAQ,UAAU,CAAC,GACvE,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAU,MAAM;EAAsC,CAAC;EAElF,IAAI,CAAC,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,IAAI,KAAK,MAAM,SAAS,CAAC,GAC5D,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAO,MAAM;EAAgB,CAAC;EAEzD,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,GACtC,KAAK,KAAK,KAAK;GAAE,QAAQ;GAAQ,MAAM;EAAwC,CAAC;CAEpF;CAEA,OAAO;AACT;;;AC3CA,SAAS,QAAQ,KAAwE;CACvF,MAAM,WAAqB,CAAC;CAC5B,MAAM,WAA4B,CAAC;CAEnC,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG;EACxB,MAAM,MAAM,SAAS,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,MAAM,GAAG;EAC5D,SAAS,KAAK;GAAE,OAAO;GAAK,SAAS;EAAmE,CAAC;CAC3G;CACA,KAAK,MAAM,UAAU,IAAI,SACvB,IAAI;EACF,SAAS,UAAU,YAAY,KAAK,MAAM;CAC5C,SAAS,OAAO;EACd,SAAS,UAAU,CAAC;EACpB,SAAS,KAAK;GACZ,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;CAEF,OAAO;EAAE;EAAU;CAAS;AAC9B;AAGA,SAAS,WAAW,KAAoE;CACtF,IAAI;EACF,OAAO;GAAE,QAAQ,WAAW,GAAG;GAAG,UAAU,CAAC;EAAE;CACjD,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,OAAO;GAAE,QAAQ,CAAC;GAAG,UAAU,CAAC;IAAE,OAAO;IAAa;GAAQ,CAAC;EAAE;CACnE;AACF;AAGA,SAAS,WAAW,KAAqB,QAAkC;CACzE,OAAO;EACL,GAAG;EACH,SAAS,OAAO,QAAQ,KAAK,WAAW;GACtC,GAAG;GACH,OAAO,MAAM,MAAM,KAAK,SAAS,SAAS,IAAI,MAAM,IAAI,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC;EACjF,EAAE;CACJ;AACF;AAGA,eAAsB,WAAW,KAA2C;CAC1E,MAAM,EAAE,UAAU,aAAa,QAAQ,GAAG;CAC1C,MAAM,WAAW,MAAM,eAAe,GAAG;CACzC,MAAM,UAAU,WAAW,GAAG;CAC9B,SAAS,KAAK,GAAG,QAAQ,QAAQ;CACjC,MAAM,OAAO,gBAAgB,QAAQ,QAAQ,QAAQ;CACrD,MAAM,SAAU,SAAS,IAAI,iBAAiB,CAAC;CAC/C,MAAM,UAAU,cAAc,GAAG;CAEjC,KAAK,MAAM,EAAE,MAAM,aAAa,SAAS,YAAY,GACnD,SAAS,KAAK;EAAE,OAAO,SAAS,IAAI,MAAM,IAAI,CAAC,CAAC,WAAW,MAAM,GAAG;EAAG;CAAQ,CAAC;CAGlF,MAAM,YAA0C,CAAC;CACjD,KAAK,MAAM,UAAU,SACnB,UAAU,UAAU,OAAO;EACzB;EACA,QAAS,SAAS,WAAW,CAAC;EAE9B,UAAU,QACP,QAAQ,UAAU,UAAU,UAAU,EAAE,KAAK,UAAU,CAAC,EAAA,CAAG,MAAM,CAAC,CAClE,KAAK,UAAW,SAAS,UAAU,CAAC,CAAa;CACtD,CAAC;CAGH,OAAO;EACL,MAAM,IAAI;EACV,KAAK,IAAI;EACT,cAAc,IAAI;EAClB,SAAS,IAAI;EAEb,UAAU,IAAI,QAAQ,SAAS;EAC/B;EACA,SAAS,MAAM,eAAe,KAAK,QAAQ;EAC3C,QAAQ,OAAO,KAAK,UAAU,UAAU,IAAI;EAC5C,OAAO,WAAW,KAAK,MAAM,KAAK,UAAU,QAAQ,CAAC;EACrD,QAAQ;EACR,QAAQ;EACR;CACF;AACF;AAEA,SAAgB,OAAO,KAA4C;CACjE,OAAO,OAAO,GAAG;AACnB;AASA,SAAgB,aACd,KACA,QACA,KACA,MACoB;CACpB,IAAI,WAAW,IAAI,cACjB,MAAM,WAAW,2DAA2D;CAE9E,IAAI,CAAC,IAAI,QAAQ,SAAS,MAAM,GAC9B,MAAM,WAAW,GAAG,OAAO,sCAAsC;CAEnE,MAAM,SAAS,YAAY,KAAK,IAAI,YAAY;CAEhD,IAAI,CAAC,OAAO,OAAO,QAAQ,GAAG,GAC5B,MAAM,WAAW,IAAI,IAAI,6DAA6D;CAGxF,MAAM,QAAQ,KAAK,KAAK,IAAI,OAAO;CAKnC,MAAM,UAHS,QACX,CAAC,GAAG,gBAAgB,OAAO,MAAM,GAAG,GAAG,aAAa,OAAO,MAAgB,KAAK,CAAC,IACjF,CAAC,EAAA,CACiB,QAAQ,UAAU,MAAM,aAAa,OAAO;CAClE,IAAI,OAAO,QACT,MAAM,WAAW,GAAG,OAAO,KAAK,UAAU,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI,GAAG;CAGvE,MAAM,UAAU;EAAE,GAAG,YAAY,KAAK,MAAM;GAAI,MAAM;CAAM;CAC5D,aAAa,KAAK,QAAQ,OAAO;CAEjC,MAAM,SAAS,WAAW,GAAG;CAC7B,MAAM,gBAAgB,OAAO,WAAW,CAAC,EAAA,CAAG,SAAS,GAAG;CACxD,YAAY,QAAQ,QAAQ,CAAC,GAAG,CAAC;CACjC,WAAW,KAAK,MAAM;CACtB,OAAO;EAAE;EAAQ;EAAK;CAAa;AACrC;AAQA,SAAgB,QAAQ,KAAqB,QAAgB,MAAgC;CAC3F,IAAI,CAAC,IAAI,QAAQ,SAAS,MAAM,GAC9B,MAAM,WAAW,GAAG,OAAO,sCAAsC;CAEnE,MAAM,SAAS,WAAW,GAAG;CAC7B,MAAM,UAAU,OAAO,WAAW,CAAC,EAAA,CAAG;CACtC,YAAY,QAAQ,QAAQ,IAAI;CAChC,MAAM,SAAS,OAAO,WAAW,CAAC,EAAA,CAAG;CACrC,WAAW,KAAK,MAAM;CACtB,OAAO;EAAE;EAAQ,UAAU,SAAS;CAAM;AAC5C;;;ACnMA,SAAgB,WAAmB;CACjC,OAAO,YAAY,CAAC,CAAC,CAAC,SAAS,WAAW;AAC5C;AAGA,SAAgB,YAAY,MAA0B,MAAuB;CAE3E,MAAM,QAAQ,SAAS,KAAK,CAAC,aAAa,WAAW,IAAI,CAAC;CAC1D,OAAO;EAAC,aAAa;EAAQ,aAAa;EAAQ,GAAG;CAAK,CAAC,CAAC,SAAS,QAAQ,EAAE;AACjF;AAGA,SAAgB,cAAc,QAA4B,MAAuB;CAC/E,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,OAAO,WAAW,oBAAoB,UAAU,WAAW,oBAAoB;AACjF;AAGA,SAAgB,aAAa,OAAsB,UAA2B;CAC5E,IAAI,UAAU,MAAM,OAAO;CAC3B,MAAM,IAAI,OAAO,KAAK,KAAK;CAC3B,MAAM,IAAI,OAAO,KAAK,QAAQ;CAC9B,OAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;AAQA,MAAM,OAAqB;CAAE,IAAI;CAAM,QAAQ;CAAK,QAAQ;AAAG;AAE/D,SAAgB,aACd,SACA,KACA,EAAE,MAAM,SACM;CACd,IAAI,CAAC,YAAY,QAAQ,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,QAAQ;EAAK,QAAQ;CAAmC;CAE9E,IAAI,CAAC,cAAc,QAAQ,QAAQ,IAAI,GACrC,OAAO;EAAE,IAAI;EAAO,QAAQ;EAAK,QAAQ;CAAiC;CAE5E,IAAI,CAAC,aAAa,IAAI,aAAa,IAAI,GAAG,GAAG,KAAK,GAChD,OAAO;EAAE,IAAI;EAAO,QAAQ;EAAK,QAAQ;CAAyD;CAEpG,OAAO;AACT;;;ACpCA,MAAM,eAAe;AACrB,MAAM,WAAW;AAEjB,SAAS,KAAK,KAAqB,QAAgB,MAAqB;CACtE,IAAI,UAAU,QAAQ;EACpB,gBAAgB;EAChB,iBAAiB;CACnB,CAAC;CACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAEA,eAAe,SAAS,KAAwD;CAC9E,MAAM,SAAmB,CAAC;CAC1B,IAAI,OAAO;CACX,WAAW,MAAM,SAAS,KAAK;EAC7B,QAAS,MAAiB;EAC1B,IAAI,OAAO,UAAU,MAAM,IAAI,UAAU,KAAK,wBAAwB;EACtE,OAAO,KAAK,KAAe;CAC7B;CACA,IAAI,CAAC,OAAO,QAAQ,OAAO,CAAC;CAC5B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC;CAC5D,QAAQ;EACN,MAAM,WAAW,wBAAwB;CAC3C;CAEA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,MAAM,WAAW,4BAA4B;CAE/C,OAAO;AACT;AAEA,SAAS,QAAQ,KAAyB,MAAsB;CAC9D,IAAI;CACJ,IAAI;EACF,QAAQ,mBAAmB,OAAO,EAAE;CACtC,QAAQ;EACN,MAAM,WAAW,OAAO,KAAK,0CAA0C;CACzE;CACA,IAAI,CAAC,OAAO,MAAM,WAAW,wBAAwB,MAAM;CAC3D,OAAO;AACT;AAGA,SAAgB,gBAAgB,KAAqB,MAAc,OAAe;CAChF,OAAO,eAAe,OAAO,KAAsB,KAAoC;EAErF,IAAI;GACF,IAAI;GACJ,IAAI;IACF,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,MAAM;GAC1D,QAAQ;IACN,MAAM,WAAW,uCAAuC;GAC1D;GAEA,MAAM,UAAU,aAAa;IAAE,MAAM,IAAI,QAAQ;IAAM,QAAQ,IAAI,QAAQ;GAAO,GAAG,KAAK;IACxF;IACA;GACF,CAAC;GACD,IAAI,CAAC,QAAQ,IAAI;IACf,KAAK,KAAK,QAAQ,QAAQ,EAAE,OAAO,QAAQ,OAAO,CAAC;IACnD;GACF;GAEA,IAAI,IAAI,WAAW,SAAS,IAAI,aAAa,cAAc;IACzD,KAAK,KAAK,KAAK,MAAM,WAAW,GAAG,CAAC;IACpC;GACF;GACA,IAAI,IAAI,WAAW,SAAS,IAAI,aAAa,eAAe;IAC1D,KAAK,KAAK,KAAK,MAAM,OAAO,GAAG,CAAC;IAChC;GACF;GACA,IAAI,IAAI,WAAW,SAAS,IAAI,SAAS,WAAW,eAAe,GAAG;IACpE,MAAM,OAAO,IAAI,SAAS,MAAM,EAAsB,CAAC,CAAC,MAAM,GAAG;IACjE,MAAM,SAAS,QAAQ,KAAK,IAAI,QAAQ;IACxC,MAAM,MAAM,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,KAAK;IAClD,MAAM,OAAO,MAAM,SAAS,GAAG;IAC/B,IAAI,OAAO,KAAK,SAAS,UAAU,MAAM,WAAW,8BAA4B;IAChF,KAAK,KAAK,KAAK,aAAa,KAAK,QAAQ,KAAK,KAAK,IAAI,CAAC;IACxD;GACF;GACA,IAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;IAC5D,MAAM,OAAO,MAAM,SAAS,GAAG;IAC/B,IAAI,OAAO,KAAK,WAAW,UAAU,MAAM,WAAW,gCAA8B;IACpF,MAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,IAChC,KAAK,KAAK,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAC1D,KAAA;IACJ,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,QAAQ,IAAI,CAAC;IAC9C;GACF;GACA,KAAK,KAAK,KAAK,EAAE,OAAO,0BAA0B,IAAI,OAAO,GAAG,IAAI,WAAW,CAAC;EAClF,SAAS,OAAO;GAGd,KAAK,KAFU,iBAAiB,YAAY,MAAM,SAAS,KAEzC,EAAE,OAAO,MADX,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAC3B,IAAI,IAAI,EAAE,CAAC;EACvD;CACF;AACF;AAGA,SAAS,OAAO,QAAgB,MAAc,cAAuC;CACnF,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,WAAW,UAAiC;GAChD,IAAI,MAAM,SAAS,gBAAgB,eAAe,GAAG;IACnD,OAAO,eAAe,SAAS,OAAO;IACtC,QAAQ,OAAO,QAAQ,OAAO,GAAG,eAAe,CAAC,CAAC;IAClD;GACF;GACA,OAAO,KAAK;EACd;EACA,OAAO,KAAK,SAAS,OAAO;EAC5B,OAAO,OAAO,MAAM,mBAAmB;GACrC,OAAO,eAAe,SAAS,OAAO;GAEtC,MAAM,QAAQ,OAAO,QAAQ;GAC7B,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,MAAM,OAAO,IAAI;EACzE,CAAC;CACH,CAAC;AACH;AAEA,eAAsB,YACpB,KACA,UAAwB,CAAC,GACF;CACvB,MAAM,QAAQ,QAAQ,SAAS,SAAS;CACxC,MAAM,SAAS,aAAa;CAE5B,IAAI,OAAO,QAAQ,QAAQ;CAC3B,OAAO,GAAG,YAAY,KAAK,QAAQ,KAAK,gBAAgB,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;CACnF,OAAO,MAAM,OAAO,QAAQ,MAAM,EAAE;CAEpC,OAAO;EACL;EACA;EACA;EACA,KAAK,oBAAoB,KAAK,eAAe;EAC7C,aACE,IAAI,SAAe,SAAS,WAC1B,OAAO,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE,CAC7D;CACJ;AACF"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@verbaly/studio",
+  "version": "0.53.0",
+  "description": "Local review server for Verbaly: read, edit and approve translations over the JSON files already in your repo. No account, no database.",
+  "keywords": [
+    "i18n",
+    "translations",
+    "localhost",
+    "editor",
+    "verbaly"
+  ],
+  "license": "MIT",
+  "author": "Aron Soto",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AronSoto/verbaly.git",
+    "directory": "packages/studio"
+  },
+  "homepage": "https://verbaly-web.vercel.app",
+  "bugs": {
+    "url": "https://github.com/AronSoto/verbaly/issues"
+  },
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "verbaly-studio": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@verbaly/compiler": "^0.53.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.4.1"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc --noEmit"
+  }
+}