glotfile 0.8.2 → 0.8.3

package/dist/server/cli.js

@@ -690,7 +690,7 @@ function setSourceValue(state, key, value) {
 function setTargetValue(state, key, locale, value, clock = systemClock) {
   const entry = requireKey(state, key);
   if (entry.plural) throw new GlotfileError(`Key is a plural; use the plural setters: ${key}`);
-  entry.values[locale] = { value: value.trim(), state: "reviewed", updatedAt: clock() };
+  entry.values[canonLocale(locale)] = { value: value.trim(), state: "reviewed", updatedAt: clock() };
 }
 function formSignature(forms) {
   return Object.entries(forms).sort(([a], [b]) => a.localeCompare(b)).map(([cat, val]) => `${cat}:${normalizeSource(val ?? "")}`).join("|");
@@ -713,8 +713,9 @@ function setSourcePluralForms(state, key, forms) {
 }
 function setPluralForms(state, key, locale, forms, clock = systemClock) {
   const entry = requirePlural(state, key);
-  if (locale === state.config.sourceLocale) throw new GlotfileError("Use setSourcePluralForms for the source locale");
-  entry.values[locale] = { forms: normalizeForms(forms), state: "reviewed", updatedAt: clock() };
+  const loc = canonLocale(locale);
+  if (loc === state.config.sourceLocale) throw new GlotfileError("Use setSourcePluralForms for the source locale");
+  entry.values[loc] = { forms: normalizeForms(forms), state: "reviewed", updatedAt: clock() };
 }
 function convertToPlural(state, key, arg) {
   const entry = requireKey(state, key);
@@ -742,12 +743,15 @@ function convertToScalar(state, key) {
 }
 function clearValue(state, key, locale) {
   const entry = requireKey(state, key);
-  if (locale === state.config.sourceLocale) throw new GlotfileError("Cannot clear the source value");
-  delete entry.values[locale];
+  const loc = canonLocale(locale);
+  if (loc === state.config.sourceLocale) throw new GlotfileError("Cannot clear the source value");
+  delete entry.values[loc];
 }
 function setKeyState(state, key, locale, next) {
+  if (!STATES.includes(next)) throw new GlotfileError(`Unknown translation state: ${next}`);
   const entry = requireKey(state, key);
-  const lv = entry.values[locale];
+  const loc = canonLocale(locale);
+  const lv = entry.values[loc];
   if (!lv) throw new GlotfileError(`No value for ${key} @ ${locale}`);
   lv.state = next;
 }
@@ -820,14 +824,16 @@ function removeCustomWord(state, word) {
 function applyMachineTranslation(state, key, locale, value, clock = systemClock, force = false) {
   const entry = requireKey(state, key);
   if (entry.plural) throw new GlotfileError(`Key is a plural; use applyMachineTranslationForms: ${key}`);
-  if (!force && entry.values[locale]?.state === "reviewed") return false;
-  entry.values[locale] = { value: value.trim(), state: "machine", source: "ai", updatedAt: clock() };
+  const loc = canonLocale(locale);
+  if (!force && entry.values[loc]?.state === "reviewed") return false;
+  entry.values[loc] = { value: value.trim(), state: "machine", source: "ai", updatedAt: clock() };
   return true;
 }
 function applyMachineTranslationForms(state, key, locale, forms, clock = systemClock, force = false) {
   const entry = requirePlural(state, key);
-  if (!force && entry.values[locale]?.state === "reviewed") return false;
-  entry.values[locale] = { forms: normalizeForms(forms), state: "machine", source: "ai", updatedAt: clock() };
+  const loc = canonLocale(locale);
+  if (!force && entry.values[loc]?.state === "reviewed") return false;
+  entry.values[loc] = { forms: normalizeForms(forms), state: "machine", source: "ai", updatedAt: clock() };
   return true;
 }
 var systemClock;
@@ -1245,28 +1251,33 @@ var init_i18next_json = __esm({
       export(state, output) {
         const files = [];
         const warnings = [];
-        const fmt = state.config.format;
+        const { indent, finalNewline } = resolveFormat(state, output);
+        const fmt = { indent, sortKeys: true, finalNewline };
+        const emptyAs = resolveEmptyAs(output, "omit");
         const collided = /* @__PURE__ */ new Set();
         warnings.push(...localeCollisionWarnings(output, state.config.locales, DEFAULT_LOCALE_CASE3));
         for (const locale of state.config.locales) {
           const obj = {};
           for (const [key, entry] of Object.entries(state.keys)) {
-            const lv = entry.values[locale];
-            if (!lv) continue;
             const segments = key.split(".");
             const leaf = segments[segments.length - 1];
             const parent = segments.slice(0, -1);
             if (entry.plural) {
-              if (!lv.forms) continue;
+              const forms = resolveForms(entry, locale, state.config.sourceLocale, emptyAs);
+              if (!forms) continue;
               for (const cat of PLURAL_CATEGORIES) {
-                const body = lv.forms[cat];
+                const body = forms[cat];
                 if (body === void 0) continue;
                 if (setNested(obj, [...parent, `${leaf}_${cat}`], toI18next(body))) collided.add(key);
               }
               continue;
             }
-            if (lv.value === void 0) continue;
-            if (setNested(obj, segments, toI18next(lv.value))) collided.add(key);
+            const raw = resolveScalar(entry, locale, state.config.sourceLocale, emptyAs);
+            if (raw === null) continue;
+            if (raw && isIcuPluralOrSelect(raw)) {
+              warnings.push({ code: "lossy-plural", key, locale, message: "i18next-json does not yet convert ICU plural/select; written unconverted" });
+            }
+            if (setNested(obj, segments, toI18next(raw))) collided.add(key);
           }
           files.push({ path: resolvePath(output.path, resolveLocaleToken(output, locale, DEFAULT_LOCALE_CASE3)), contents: serializeJson(obj, fmt) });
         }
@@ -2465,6 +2476,7 @@ var init_anthropic = __esm({
         }, { signal });
         this.recordUsage(res.usage);
         const text = res.content.find((b) => b.type === "text")?.text ?? "";
+        if (res.stop_reason === "max_tokens") throw new MalformedReplyError(text);
         return parseReplyItems(text);
       }
     };
@@ -2558,6 +2570,7 @@ var init_openai = __esm({
           ]
         }, { signal });
         const text = res.choices?.[0]?.message?.content ?? "";
+        if (res.choices?.[0]?.finish_reason === "length") throw new MalformedReplyError(text);
         return parseReplyItems(text);
       }
     };
@@ -2675,8 +2688,11 @@ var init_bedrock = __esm({
         const res = await this.client.send(this.makeCommand(this.buildInput(batch)), { abortSignal: signal });
         const blocks = res.output?.message?.content ?? [];
         const tool = blocks.find((b) => b.toolUse)?.toolUse;
-        if (tool?.input?.items) return tool.input.items;
         const text = blocks.find((b) => b.text)?.text ?? "";
+        if (res.stopReason === "max_tokens") {
+          throw new MalformedReplyError(text || JSON.stringify(tool?.input ?? {}));
+        }
+        if (tool?.input?.items) return tool.input.items;
         return parseReplyItems(text);
       }
     };
@@ -3132,8 +3148,30 @@ function attachScreenshotsForProvider(reqs, state, projectRoot, supportsVision)
   const keys = new Set(reqs.filter((r) => state.keys[r.key]?.screenshot).map((r) => r.key));
   return { skipped: keys.size };
 }
-async function runLocaleParallel(reqs, provider, hooks = {}, concurrency = DEFAULT_LOCALE_CONCURRENCY, signal, batchSize = Infinity) {
+function isTransientError(err) {
+  const e = err;
+  if (e && typeof e.status === "number") return e.status === 429 || e.status >= 500;
+  const code = e?.code;
+  return code === "ECONNRESET" || code === "ETIMEDOUT" || code === "ECONNREFUSED" || code === "EPIPE" || code === "EAI_AGAIN";
+}
+function sleep(ms, signal) {
+  if (ms <= 0 || signal?.aborted) return Promise.resolve();
+  return new Promise((resolve12) => {
+    const t = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve12();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(t);
+      resolve12();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function runLocaleParallel(reqs, provider, hooks = {}, concurrency = DEFAULT_LOCALE_CONCURRENCY, signal, batchSize = Infinity, retry = {}) {
   if (!reqs.length) return [];
+  const maxRetries = retry.retries ?? 3;
+  const delayMs = retry.delayMs ?? ((attempt) => 250 * 2 ** attempt);
   const byLocale = /* @__PURE__ */ new Map();
   for (const req of reqs) {
     let group = byLocale.get(req.targetLocale);
@@ -3168,10 +3206,20 @@ async function runLocaleParallel(reqs, provider, hooks = {}, concurrency = DEFAU
         started.add(locale);
         hooks.onLocaleStart?.(locale);
       }
-      const batchResults = await provider.translate(batch, (_localeDone, _localeTotal, results) => {
-        done += results.length;
-        hooks.onBatchComplete?.(done, total, results, locale);
-      }, signal, (raw, size) => hooks.onMalformedReply?.(raw, size, locale));
+      let batchResults;
+      for (let attempt = 0; ; attempt++) {
+        try {
+          batchResults = await provider.translate(batch, (_localeDone, _localeTotal, results) => {
+            done += results.length;
+            hooks.onBatchComplete?.(done, total, results, locale);
+          }, signal, (raw, size) => hooks.onMalformedReply?.(raw, size, locale));
+          break;
+        } catch (err) {
+          if (attempt >= maxRetries || signal?.aborted || !isTransientError(err)) throw err;
+          hooks.onRetry?.(locale, attempt + 1, err);
+          await sleep(delayMs(attempt), signal);
+        }
+      }
       allResults.push(...batchResults);
       const left = remaining.get(locale) - 1;
       remaining.set(locale, left);
@@ -3262,26 +3310,63 @@ var init_pending_batch = __esm({
 });
 
 // src/server/log.ts
-import { appendFileSync, readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { appendFileSync, existsSync as existsSync7, openSync, fstatSync, readSync, closeSync, statSync as statSync2, readFileSync as readFileSync7 } from "fs";
 import { resolve as resolve5 } from "path";
 function logPath(projectRoot) {
   return resolve5(projectRoot, ".glotfile", "log.jsonl");
 }
 function appendLog(projectRoot, entry) {
   ensureGlotfileDir(projectRoot);
-  appendFileSync(logPath(projectRoot), JSON.stringify(entry) + "\n", "utf8");
-}
-function readLog(projectRoot, limit = 100) {
   const path = logPath(projectRoot);
-  if (!existsSync7(path)) return [];
+  appendFileSync(path, JSON.stringify(entry) + "\n", "utf8");
+  trimLog(path);
+}
+function trimLog(path, maxBytes = MAX_LOG_BYTES, targetBytes = TRIM_LOG_TO_BYTES) {
+  if (!existsSync7(path) || statSync2(path).size <= maxBytes) return;
   const lines = readFileSync7(path, "utf8").split("\n").filter((l) => l.trim() !== "");
-  const entries = lines.map((l) => JSON.parse(l));
-  return entries.reverse().slice(0, limit);
+  const kept = [];
+  let bytes = 0;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const lineBytes = Buffer.byteLength(lines[i], "utf8") + 1;
+    if (kept.length > 0 && bytes + lineBytes > targetBytes) break;
+    kept.unshift(lines[i]);
+    bytes += lineBytes;
+  }
+  writeFileAtomic(path, kept.length ? kept.join("\n") + "\n" : "");
+}
+function readLastLines(path, n, chunkSize = 64 * 1024) {
+  if (n <= 0 || !existsSync7(path)) return [];
+  const fd = openSync(path, "r");
+  try {
+    let pos = fstatSync(fd).size;
+    if (pos === 0) return [];
+    const chunks = [];
+    while (pos > 0) {
+      const size = Math.min(chunkSize, pos);
+      pos -= size;
+      const buf = Buffer.alloc(size);
+      readSync(fd, buf, 0, size, pos);
+      chunks.unshift(buf);
+      const segments = Buffer.concat(chunks).toString("utf8").split("\n");
+      const complete = (pos > 0 ? segments.slice(1) : segments).filter((l) => l.trim() !== "");
+      if (complete.length >= n || pos === 0) return complete.slice(-n);
+    }
+    return [];
+  } finally {
+    closeSync(fd);
+  }
 }
+function readLog(projectRoot, limit = 100) {
+  return readLastLines(logPath(projectRoot), limit).map((l) => JSON.parse(l)).reverse();
+}
+var MAX_LOG_BYTES, TRIM_LOG_TO_BYTES;
 var init_log = __esm({
   "src/server/log.ts"() {
     "use strict";
     init_glotfile_dir();
+    init_atomic_write();
+    MAX_LOG_BYTES = 5 * 1024 * 1024;
+    TRIM_LOG_TO_BYTES = 4 * 1024 * 1024;
   }
 });
 
@@ -3873,7 +3958,7 @@ var init_scan = __esm({
 });
 
 // src/server/scanner.ts
-import { readdirSync as readdirSync3, statSync as statSync2, readFileSync as readFileSync11 } from "fs";
+import { readdirSync as readdirSync3, statSync as statSync3, readFileSync as readFileSync11 } from "fs";
 import { join as join5, extname as extname2, relative } from "path";
 function scannerForExt(ext) {
   return EXT_SCANNER[ext] ?? null;
@@ -4030,7 +4115,7 @@ function* walkFiles(dir, root, exclude) {
     const rel = relative(root, abs);
     let st;
     try {
-      st = statSync2(abs);
+      st = statSync3(abs);
     } catch {
       continue;
     }
@@ -4059,7 +4144,7 @@ function runScan(projectRoot, opts, existing) {
     const abs = join5(projectRoot, relPath);
     let st;
     try {
-      st = statSync2(abs);
+      st = statSync3(abs);
     } catch {
       continue;
     }
@@ -4110,7 +4195,21 @@ var init_scanner = __esm({
         // t('key') — word boundary before t, not preceded by dot (excludes i18n.t which is above)
         /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*'([^']+)'/g,
         /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*"([^"]+)"/g,
-        /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*`([^`$\n]+)`/g
+        /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*`([^`$\n]+)`/g,
+        // vue-i18n pluralization: $tc('key') and the destructured bare tc('key').
+        /\$tc\s*\(\s*'([^']+)'/g,
+        /\$tc\s*\(\s*"([^"]+)"/g,
+        /(?<!\.)(?<![a-zA-Z0-9_$])\btc\s*\(\s*'([^']+)'/g,
+        /(?<!\.)(?<![a-zA-Z0-9_$])\btc\s*\(\s*"([^"]+)"/g,
+        // React-i18next <Trans i18nKey="key" /> (attribute order tolerated).
+        /<Trans\b[^>]*\bi18nKey\s*=\s*'([^']+)'/g,
+        /<Trans\b[^>]*\bi18nKey\s*=\s*"([^"]+)"/g,
+        // A renamed translate() wrapper (covers the common `const { t: translate }`
+        // alias by name; arbitrary aliases aren't resolved). Method `.translate()`
+        // is excluded. Over-matching here only keeps keys "used" — the safe direction
+        // for prune, which deletes only keys with no match at all.
+        /(?<!\.)(?<![a-zA-Z0-9_$])\btranslate\s*\(\s*'([^']+)'/g,
+        /(?<!\.)(?<![a-zA-Z0-9_$])\btranslate\s*\(\s*"([^"]+)"/g
       ],
       gettext: [
         /\b(?:gettext|ngettext)\s*\(\s*'([^']+)'/g,
@@ -4144,7 +4243,7 @@ var init_scanner = __esm({
         /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*`([^`$]*)\$\{/g
       ]
     };
-    CACHE_VERSION = 6;
+    CACHE_VERSION = 7;
     EXT_SCANNER = {
       ".php": "laravel",
       ".vue": "js-i18n",
@@ -4188,11 +4287,11 @@ var init_scanner = __esm({
 });
 
 // src/server/import/detect.ts
-import { existsSync as existsSync11, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync4 } from "fs";
 import { join as join6 } from "path";
 function safeIsDir(p) {
   try {
-    return statSync3(p).isDirectory();
+    return statSync4(p).isDirectory();
   } catch {
     return false;
   }
@@ -4228,7 +4327,7 @@ function detectVue(root, forced = false) {
     if (enough) {
       const sourceLocale = pickSource(locales, (loc) => {
         try {
-          return statSync3(join6(localeRoot, `${loc}.json`)).size;
+          return statSync4(join6(localeRoot, `${loc}.json`)).size;
         } catch {
           return 0;
         }
@@ -4265,7 +4364,7 @@ function detectApple(root) {
         locales,
         sourceLocale: pickSource(locales, (loc) => {
           try {
-            return statSync3(join6(dir, `${loc}.lproj`, "Localizable.strings")).size;
+            return statSync4(join6(dir, `${loc}.lproj`, "Localizable.strings")).size;
           } catch {
             return 0;
           }
@@ -4325,7 +4424,7 @@ function detectI18next(root) {
     if (locales.length === 0) continue;
     const sourceLocale = pickSource(locales, (loc) => {
       try {
-        return readdirSync4(join6(localeRoot, loc)).filter((f) => f.endsWith(".json")).reduce((sum, f) => sum + statSync3(join6(localeRoot, loc, f)).size, 0);
+        return readdirSync4(join6(localeRoot, loc)).filter((f) => f.endsWith(".json")).reduce((sum, f) => sum + statSync4(join6(localeRoot, loc, f)).size, 0);
       } catch {
         return 0;
       }
@@ -4430,10 +4529,9 @@ var init_detect = __esm({
 function flattenObject(value, prefix, warnings) {
   const out = {};
   const walk = (node, path) => {
-    if (typeof node === "string") {
-      out[path] = node;
-    } else if (typeof node === "number" || typeof node === "boolean") {
-      out[path] = String(node);
+    if (typeof node === "string" || typeof node === "number" || typeof node === "boolean") {
+      if (path in out) warnings.push(`duplicate flattened key "${path}" \u2014 keeping the first value`);
+      else out[path] = typeof node === "string" ? node : String(node);
     } else if (Array.isArray(node)) {
       node.forEach((el, i) => walk(el, path ? `${path}.${i}` : String(i)));
     } else if (node && typeof node === "object") {
@@ -4502,18 +4600,18 @@ var init_placeholders2 = __esm({
 });
 
 // src/server/import/parsers/laravel-php.ts
-import { readdirSync as readdirSync6, statSync as statSync4 } from "fs";
+import { readdirSync as readdirSync6, statSync as statSync5 } from "fs";
 import { join as join8, relative as relative2 } from "path";
 import { execFileSync } from "child_process";
 function listDirs2(dir) {
-  return readdirSync6(dir).filter((e) => statSync4(join8(dir, e)).isDirectory());
+  return readdirSync6(dir).filter((e) => statSync5(join8(dir, e)).isDirectory());
 }
 function listPhpFiles(dir) {
   const out = [];
   const walk = (d) => {
     for (const e of readdirSync6(d)) {
       const full = join8(d, e);
-      if (statSync4(full).isDirectory()) walk(full);
+      if (statSync5(full).isDirectory()) walk(full);
       else if (e.endsWith(".php")) out.push(full);
     }
   };
@@ -4648,7 +4746,7 @@ var init_flutter_arb2 = __esm({
 });
 
 // src/server/import/parsers/apple-strings.ts
-import { readdirSync as readdirSync8, readFileSync as readFileSync15, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync8, readFileSync as readFileSync15, statSync as statSync6 } from "fs";
 import { join as join10 } from "path";
 function localeFromLproj(dir) {
   const m = dir.match(/^(.+)\.lproj$/);
@@ -4715,25 +4813,34 @@ function parseStrings(text, file, warnings) {
     while (i < n && !/[\s=;]/.test(text[i])) raw += text[i++];
     return raw.length ? raw : null;
   };
+  const recover = () => {
+    while (i < n && text[i] !== ";") i++;
+    if (i >= n) return false;
+    i++;
+    return true;
+  };
   while (true) {
     skipTrivia();
     if (i >= n) break;
     const key = readToken();
     if (key === null) {
       warnings.push(`apple-strings: malformed entry in ${file} near offset ${i}`);
-      break;
+      if (!recover()) break;
+      continue;
     }
     skipTrivia();
     if (text[i] !== "=") {
       warnings.push(`apple-strings: expected '=' after key "${key}" in ${file}`);
-      break;
+      if (!recover()) break;
+      continue;
     }
     i++;
     skipTrivia();
     const value = readToken();
     if (value === null) {
       warnings.push(`apple-strings: missing value for key "${key}" in ${file}`);
-      break;
+      if (!recover()) break;
+      continue;
     }
     skipTrivia();
     if (text[i] === ";") i++;
@@ -4760,7 +4867,7 @@ var init_apple_strings2 = __esm({
           const file = join10(localeRoot, dir, TABLE);
           let text;
           try {
-            if (!statSync5(file).isFile()) continue;
+            if (!statSync6(file).isFile()) continue;
             text = readFileSync15(file, "utf8");
           } catch {
             continue;
@@ -5053,11 +5160,11 @@ var init_gettext_po2 = __esm({
 });
 
 // src/server/import/parsers/i18next-json.ts
-import { readdirSync as readdirSync11, readFileSync as readFileSync18, statSync as statSync6 } from "fs";
+import { readdirSync as readdirSync11, readFileSync as readFileSync18, statSync as statSync7 } from "fs";
 import { join as join13 } from "path";
 function safeIsDir2(p) {
   try {
-    return statSync6(p).isDirectory();
+    return statSync7(p).isDirectory();
   } catch {
     return false;
   }
@@ -5168,6 +5275,15 @@ function decodeDouble(body) {
     }
     const n = body[++i];
     if (n === void 0) break;
+    const hexLen = n === "x" ? 2 : n === "u" ? 4 : n === "U" ? 8 : 0;
+    if (hexLen) {
+      const hex = body.slice(i + 1, i + 1 + hexLen);
+      if (hex.length === hexLen && /^[0-9a-fA-F]+$/.test(hex)) {
+        out += String.fromCodePoint(parseInt(hex, 16));
+        i += hexLen;
+        continue;
+      }
+    }
     out += n === "n" ? "\n" : n === "r" ? "\r" : n === "t" ? "	" : n;
   }
   return out;
@@ -5391,7 +5507,7 @@ var init_rails_yaml2 = __esm({
 });
 
 // src/server/import/parsers/apple-stringsdict.ts
-import { readdirSync as readdirSync13, readFileSync as readFileSync20, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync13, readFileSync as readFileSync20, statSync as statSync8 } from "fs";
 import { join as join15 } from "path";
 function localeFromLproj2(dir) {
   const m = dir.match(/^(.+)\.lproj$/);
@@ -5537,7 +5653,7 @@ var init_apple_stringsdict2 = __esm({
           const file = join15(localeRoot, dir, TABLE2);
           let text;
           try {
-            if (!statSync7(file).isFile()) continue;
+            if (!statSync8(file).isFile()) continue;
             text = readFileSync20(file, "utf8");
           } catch {
             continue;
@@ -6650,7 +6766,7 @@ var init_events = __esm({
 });
 
 // src/server/watch.ts
-import { statSync as statSync8, readdirSync as readdirSync14 } from "fs";
+import { statSync as statSync9, readdirSync as readdirSync14 } from "fs";
 import { join as join17 } from "path";
 import { createHash as createHash2 } from "crypto";
 function hashState(state) {
@@ -6660,14 +6776,14 @@ function signature(statePath) {
   const fmt = detectFormat(statePath);
   if (fmt === "none") return "none";
   if (fmt === "single") {
-    const s = statSync8(statePath);
+    const s = statSync9(statePath);
     return `single:${s.size}:${s.mtimeMs}`;
   }
   const dir = splitDirFor(statePath);
   const parts = [];
   for (const rel of ["config.json", "keys.json"]) {
     try {
-      const s = statSync8(join17(dir, rel));
+      const s = statSync9(join17(dir, rel));
       parts.push(`${rel}:${s.size}:${s.mtimeMs}`);
     } catch {
     }
@@ -6675,7 +6791,7 @@ function signature(statePath) {
   try {
     for (const name of readdirSync14(join17(dir, "locales")).sort()) {
       if (!name.endsWith(".json")) continue;
-      const s = statSync8(join17(dir, "locales", name));
+      const s = statSync9(join17(dir, "locales", name));
       parts.push(`${name}:${s.size}:${s.mtimeMs}`);
     }
   } catch {
@@ -6754,7 +6870,7 @@ var init_watch = __esm({
 // src/server/api.ts
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
-import { readFileSync as readFileSync23, existsSync as existsSync13, readdirSync as readdirSync15, statSync as statSync9, rmSync as rmSync6 } from "fs";
+import { readFileSync as readFileSync23, existsSync as existsSync13, readdirSync as readdirSync15, statSync as statSync10, rmSync as rmSync6 } from "fs";
 import { dirname as dirname3, resolve as resolve9, basename, relative as relative4, sep as sep2 } from "path";
 function projectName(root) {
   const nameFile = resolve9(root, ".idea", ".name");
@@ -6940,7 +7056,7 @@ function createApi(deps) {
           filePath = abs;
         } else {
           try {
-            if (statSync9(abs).isDirectory()) walk(abs, depth + 1);
+            if (statSync10(abs).isDirectory()) walk(abs, depth + 1);
           } catch {
           }
           continue;
@@ -8006,8 +8122,16 @@ async function readFileResponse(absPath) {
     return null;
   }
 }
+function isLocalHost(hostname) {
+  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost");
+}
 function buildApp(opts) {
   const app = new Hono2();
+  app.use("*", async (c, next) => {
+    if (!isLocalHost(new URL(c.req.url).hostname)) return c.text("Forbidden: non-local Host header", 403);
+    return next();
+  });
   const apiDeps = {
     statePath: opts.statePath,
     autoExport: true,
@@ -8159,7 +8283,7 @@ init_usage();
 init_context();
 init_run2();
 init_outputs();
-import { resolve as resolve11, dirname as dirname5, join as join19 } from "path";
+import { resolve as resolve11, dirname as dirname5, join as join19, basename as basename2 } from "path";
 import { readFileSync as readFileSync24, existsSync as existsSync14, mkdirSync as mkdirSync6, cpSync } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -8200,7 +8324,7 @@ function formatText(report) {
 function formatJson(report) {
   return JSON.stringify(report, null, 2) + "\n";
 }
-function formatSarif(report, rawText) {
+function formatSarif(report, ctx) {
   const ruleIds = [...new Set(report.findings.map((f) => f.ruleId))];
   const sarif = {
     $schema: "https://json.schemastore.org/sarif-2.1.0.json",
@@ -8208,14 +8332,24 @@ function formatSarif(report, rawText) {
     runs: [{
       tool: { driver: { name: "glotfile", rules: ruleIds.map((id) => ({ id })) } },
       results: report.findings.map((f) => {
-        const pos = locate(rawText, f.key);
-        return {
+        const base = {
           ruleId: f.ruleId,
-          level: f.severity === "error" ? "error" : "warning",
+          level: f.severity === "error" ? "error" : "warning"
+        };
+        if (f.ruleId === "output-stale") {
+          return {
+            ...base,
+            message: { text: `${f.key}: ${f.message}` },
+            locations: [{ physicalLocation: { artifactLocation: { uri: f.key } } }]
+          };
+        }
+        const pos = locate(ctx.keysRawText, f.key);
+        return {
+          ...base,
           message: { text: `${f.key}${f.locale ? ` [${f.locale}]` : ""}: ${f.message}` },
           locations: [{
             physicalLocation: {
-              artifactLocation: { uri: "glotfile.json" },
+              artifactLocation: { uri: ctx.keysUri },
               region: { startLine: pos.line, startColumn: pos.column }
             }
           }]
@@ -8630,9 +8764,23 @@ async function runContextBatchAction(args, pending, action, projectRoot) {
   if (outcome.retried) console.log(`${outcome.retried} job(s) re-run synchronously (batch entries failed or were malformed).`);
   for (const e of outcome.errors) console.warn(`skip ${e.key}: ${e.error}`);
 }
-function printReport(report, format, rawText) {
+function sarifContextFor(statePath) {
+  if (detectFormat(statePath) === "split") {
+    const dir = splitDirFor(statePath);
+    const keysPath = join19(dir, "keys.json");
+    return {
+      keysUri: `${basename2(dir)}/keys.json`,
+      keysRawText: existsSync14(keysPath) ? readFileSync24(keysPath, "utf8") : ""
+    };
+  }
+  return {
+    keysUri: basename2(statePath),
+    keysRawText: existsSync14(statePath) ? readFileSync24(statePath, "utf8") : ""
+  };
+}
+function printReport(report, format, statePath) {
   if (format === "json") console.log(formatJson(report).trimEnd());
-  else if (format === "sarif") console.log(formatSarif(report, rawText).trimEnd());
+  else if (format === "sarif") console.log(formatSarif(report, sarifContextFor(statePath)).trimEnd());
   else console.log(formatText(report).trimEnd());
 }
 async function runLintCmd(args) {
@@ -8649,13 +8797,12 @@ async function runLintCmd(args) {
     }
     return;
   }
-  const rawText = existsSync14(args.statePath) ? readFileSync24(args.statePath, "utf8") : "";
   const report = await runLint(state, {
     locales: args.locales,
     ruleIds: args.ruleIds,
     includeSuppressed: args.includeSuppressed
   });
-  printReport(report, args.format, rawText);
+  printReport(report, args.format, args.statePath);
   const tooManyWarnings = args.maxWarnings != null && report.counts.warn > args.maxWarnings;
   if (!report.ok || tooManyWarnings) process.exitCode = 1;
 }
@@ -8669,17 +8816,16 @@ async function runCheck(args) {
       counts: { error: 1, warn: 0, suppressed: 0 },
       ok: false
     };
-    printReport(report2, args.format, "");
+    printReport(report2, args.format, args.statePath);
     process.exitCode = 1;
     return;
   }
-  const rawText = existsSync14(args.statePath) ? readFileSync24(args.statePath, "utf8") : "";
   const root = dirname5(resolve11(args.statePath));
   const lint = await runLint(state, {});
   const findings = sortFindings([...lint.findings, ...checkOutputs(state, root)]);
   const counts = { ...countSeverities(findings), suppressed: lint.counts.suppressed };
   const report = { findings, counts, ok: counts.error === 0 };
-  printReport(report, args.format, rawText);
+  printReport(report, args.format, args.statePath);
   if (!report.ok) process.exitCode = 1;
 }
 async function runImportCmd(args) {
@@ -8880,6 +9026,7 @@ async function runPrune(args) {
   }
   const state = loadState(args.statePath);
   const toRemove = /* @__PURE__ */ new Set();
+  let heuristicUnused = false;
   if (args.emptySource) {
     for (const k of findEmptySourceKeys(state)) toRemove.add(k);
   }
@@ -8895,6 +9042,7 @@ async function runPrune(args) {
       for (const k of Object.keys(state.keys)) {
         if (!used.has(k)) toRemove.add(k);
       }
+      heuristicUnused = true;
     }
   }
   const keys = [...toRemove].sort();
@@ -8902,6 +9050,11 @@ async function runPrune(args) {
     console.log("No keys to prune.");
     return;
   }
+  if (heuristicUnused) {
+    console.warn(
+      "Note: --unused is heuristic \u2014 keys used via an unrecognised wrapper or a fully dynamic key can appear here by mistake. Review the list and add a `scan.keep` glob for any false positive."
+    );
+  }
   if (!args.write) {
     for (const k of keys) console.log(k);
     console.log(`${keys.length} key(s) to prune. Run with --write to remove them.`);