glotfile 0.8.2 → 0.8.3

package/dist/server/server.js

@@ -639,7 +639,7 @@ function setSourceValue(state, key, value) {
 function setTargetValue(state, key, locale, value, clock = systemClock) {
   const entry = requireKey(state, key);
   if (entry.plural) throw new GlotfileError(`Key is a plural; use the plural setters: ${key}`);
-  entry.values[locale] = { value: value.trim(), state: "reviewed", updatedAt: clock() };
+  entry.values[canonLocale(locale)] = { value: value.trim(), state: "reviewed", updatedAt: clock() };
 }
 function formSignature(forms) {
   return Object.entries(forms).sort(([a], [b]) => a.localeCompare(b)).map(([cat, val]) => `${cat}:${normalizeSource(val ?? "")}`).join("|");
@@ -662,8 +662,9 @@ function setSourcePluralForms(state, key, forms) {
 }
 function setPluralForms(state, key, locale, forms, clock = systemClock) {
   const entry = requirePlural(state, key);
-  if (locale === state.config.sourceLocale) throw new GlotfileError("Use setSourcePluralForms for the source locale");
-  entry.values[locale] = { forms: normalizeForms(forms), state: "reviewed", updatedAt: clock() };
+  const loc = canonLocale(locale);
+  if (loc === state.config.sourceLocale) throw new GlotfileError("Use setSourcePluralForms for the source locale");
+  entry.values[loc] = { forms: normalizeForms(forms), state: "reviewed", updatedAt: clock() };
 }
 function convertToPlural(state, key, arg) {
   const entry = requireKey(state, key);
@@ -691,12 +692,15 @@ function convertToScalar(state, key) {
 }
 function clearValue(state, key, locale) {
   const entry = requireKey(state, key);
-  if (locale === state.config.sourceLocale) throw new GlotfileError("Cannot clear the source value");
-  delete entry.values[locale];
+  const loc = canonLocale(locale);
+  if (loc === state.config.sourceLocale) throw new GlotfileError("Cannot clear the source value");
+  delete entry.values[loc];
 }
 function setKeyState(state, key, locale, next) {
+  if (!STATES.includes(next)) throw new GlotfileError(`Unknown translation state: ${next}`);
   const entry = requireKey(state, key);
-  const lv = entry.values[locale];
+  const loc = canonLocale(locale);
+  const lv = entry.values[loc];
   if (!lv) throw new GlotfileError(`No value for ${key} @ ${locale}`);
   lv.state = next;
 }
@@ -769,14 +773,16 @@ function removeCustomWord(state, word) {
 function applyMachineTranslation(state, key, locale, value, clock = systemClock, force = false) {
   const entry = requireKey(state, key);
   if (entry.plural) throw new GlotfileError(`Key is a plural; use applyMachineTranslationForms: ${key}`);
-  if (!force && entry.values[locale]?.state === "reviewed") return false;
-  entry.values[locale] = { value: value.trim(), state: "machine", source: "ai", updatedAt: clock() };
+  const loc = canonLocale(locale);
+  if (!force && entry.values[loc]?.state === "reviewed") return false;
+  entry.values[loc] = { value: value.trim(), state: "machine", source: "ai", updatedAt: clock() };
   return true;
 }
 function applyMachineTranslationForms(state, key, locale, forms, clock = systemClock, force = false) {
   const entry = requirePlural(state, key);
-  if (!force && entry.values[locale]?.state === "reviewed") return false;
-  entry.values[locale] = { forms: normalizeForms(forms), state: "machine", source: "ai", updatedAt: clock() };
+  const loc = canonLocale(locale);
+  if (!force && entry.values[loc]?.state === "reviewed") return false;
+  entry.values[loc] = { forms: normalizeForms(forms), state: "machine", source: "ai", updatedAt: clock() };
   return true;
 }
 
@@ -905,7 +911,21 @@ var PATTERNS = {
     // t('key') — word boundary before t, not preceded by dot (excludes i18n.t which is above)
     /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*'([^']+)'/g,
     /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*"([^"]+)"/g,
-    /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*`([^`$\n]+)`/g
+    /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*`([^`$\n]+)`/g,
+    // vue-i18n pluralization: $tc('key') and the destructured bare tc('key').
+    /\$tc\s*\(\s*'([^']+)'/g,
+    /\$tc\s*\(\s*"([^"]+)"/g,
+    /(?<!\.)(?<![a-zA-Z0-9_$])\btc\s*\(\s*'([^']+)'/g,
+    /(?<!\.)(?<![a-zA-Z0-9_$])\btc\s*\(\s*"([^"]+)"/g,
+    // React-i18next <Trans i18nKey="key" /> (attribute order tolerated).
+    /<Trans\b[^>]*\bi18nKey\s*=\s*'([^']+)'/g,
+    /<Trans\b[^>]*\bi18nKey\s*=\s*"([^"]+)"/g,
+    // A renamed translate() wrapper (covers the common `const { t: translate }`
+    // alias by name; arbitrary aliases aren't resolved). Method `.translate()`
+    // is excluded. Over-matching here only keeps keys "used" — the safe direction
+    // for prune, which deletes only keys with no match at all.
+    /(?<!\.)(?<![a-zA-Z0-9_$])\btranslate\s*\(\s*'([^']+)'/g,
+    /(?<!\.)(?<![a-zA-Z0-9_$])\btranslate\s*\(\s*"([^"]+)"/g
   ],
   gettext: [
     /\b(?:gettext|ngettext)\s*\(\s*'([^']+)'/g,
@@ -939,7 +959,7 @@ var PREFIX_PATTERNS = {
     /(?<!\.)(?<![a-zA-Z0-9_$])\bt\s*\(\s*`([^`$]*)\$\{/g
   ]
 };
-var CACHE_VERSION = 6;
+var CACHE_VERSION = 7;
 var EXT_SCANNER = {
   ".php": "laravel",
   ".vue": "js-i18n",
@@ -2300,28 +2320,33 @@ var i18nextJson = {
   export(state, output) {
     const files = [];
     const warnings = [];
-    const fmt = state.config.format;
+    const { indent, finalNewline } = resolveFormat(state, output);
+    const fmt = { indent, sortKeys: true, finalNewline };
+    const emptyAs = resolveEmptyAs(output, "omit");
     const collided = /* @__PURE__ */ new Set();
     warnings.push(...localeCollisionWarnings(output, state.config.locales, DEFAULT_LOCALE_CASE3));
     for (const locale of state.config.locales) {
       const obj = {};
       for (const [key, entry] of Object.entries(state.keys)) {
-        const lv = entry.values[locale];
-        if (!lv) continue;
         const segments = key.split(".");
         const leaf = segments[segments.length - 1];
         const parent = segments.slice(0, -1);
         if (entry.plural) {
-          if (!lv.forms) continue;
+          const forms = resolveForms(entry, locale, state.config.sourceLocale, emptyAs);
+          if (!forms) continue;
           for (const cat of PLURAL_CATEGORIES) {
-            const body = lv.forms[cat];
+            const body = forms[cat];
             if (body === void 0) continue;
             if (setNested(obj, [...parent, `${leaf}_${cat}`], toI18next(body))) collided.add(key);
           }
           continue;
         }
-        if (lv.value === void 0) continue;
-        if (setNested(obj, segments, toI18next(lv.value))) collided.add(key);
+        const raw = resolveScalar(entry, locale, state.config.sourceLocale, emptyAs);
+        if (raw === null) continue;
+        if (raw && isIcuPluralOrSelect(raw)) {
+          warnings.push({ code: "lossy-plural", key, locale, message: "i18next-json does not yet convert ICU plural/select; written unconverted" });
+        }
+        if (setNested(obj, segments, toI18next(raw))) collided.add(key);
       }
       files.push({ path: resolvePath(output.path, resolveLocaleToken(output, locale, DEFAULT_LOCALE_CASE3)), contents: serializeJson(obj, fmt) });
     }
@@ -2842,7 +2867,7 @@ function checkOutputs(state, root) {
 }
 
 // src/server/api.ts
-import { readFileSync as readFileSync23, existsSync as existsSync13, readdirSync as readdirSync15, statSync as statSync9, rmSync as rmSync6 } from "fs";
+import { readFileSync as readFileSync23, existsSync as existsSync13, readdirSync as readdirSync15, statSync as statSync10, rmSync as rmSync6 } from "fs";
 import { dirname as dirname3, resolve as resolve9, basename, relative as relative4, sep as sep2 } from "path";
 
 // src/server/ai/anthropic.ts
@@ -3317,6 +3342,7 @@ var AnthropicProvider = class {
     }, { signal });
     this.recordUsage(res.usage);
     const text = res.content.find((b) => b.type === "text")?.text ?? "";
+    if (res.stop_reason === "max_tokens") throw new MalformedReplyError(text);
     return parseReplyItems(text);
   }
 };
@@ -3402,6 +3428,7 @@ var OpenAIProvider = class {
       ]
     }, { signal });
     const text = res.choices?.[0]?.message?.content ?? "";
+    if (res.choices?.[0]?.finish_reason === "length") throw new MalformedReplyError(text);
     return parseReplyItems(text);
   }
 };
@@ -3511,8 +3538,11 @@ var BedrockProvider = class {
     const res = await this.client.send(this.makeCommand(this.buildInput(batch)), { abortSignal: signal });
     const blocks = res.output?.message?.content ?? [];
     const tool = blocks.find((b) => b.toolUse)?.toolUse;
-    if (tool?.input?.items) return tool.input.items;
     const text = blocks.find((b) => b.text)?.text ?? "";
+    if (res.stopReason === "max_tokens") {
+      throw new MalformedReplyError(text || JSON.stringify(tool?.input ?? {}));
+    }
+    if (tool?.input?.items) return tool.input.items;
     return parseReplyItems(text);
   }
 };
@@ -3778,8 +3808,30 @@ function attachScreenshotsForProvider(reqs, state, projectRoot, supportsVision)
   return { skipped: keys.size };
 }
 var DEFAULT_LOCALE_CONCURRENCY = 3;
-async function runLocaleParallel(reqs, provider, hooks = {}, concurrency = DEFAULT_LOCALE_CONCURRENCY, signal, batchSize = Infinity) {
+function isTransientError(err) {
+  const e = err;
+  if (e && typeof e.status === "number") return e.status === 429 || e.status >= 500;
+  const code = e?.code;
+  return code === "ECONNRESET" || code === "ETIMEDOUT" || code === "ECONNREFUSED" || code === "EPIPE" || code === "EAI_AGAIN";
+}
+function sleep(ms, signal) {
+  if (ms <= 0 || signal?.aborted) return Promise.resolve();
+  return new Promise((resolve11) => {
+    const t = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve11();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(t);
+      resolve11();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function runLocaleParallel(reqs, provider, hooks = {}, concurrency = DEFAULT_LOCALE_CONCURRENCY, signal, batchSize = Infinity, retry = {}) {
   if (!reqs.length) return [];
+  const maxRetries = retry.retries ?? 3;
+  const delayMs = retry.delayMs ?? ((attempt) => 250 * 2 ** attempt);
   const byLocale = /* @__PURE__ */ new Map();
   for (const req of reqs) {
     let group = byLocale.get(req.targetLocale);
@@ -3814,10 +3866,20 @@ async function runLocaleParallel(reqs, provider, hooks = {}, concurrency = DEFAU
         started.add(locale);
         hooks.onLocaleStart?.(locale);
       }
-      const batchResults = await provider.translate(batch, (_localeDone, _localeTotal, results) => {
-        done += results.length;
-        hooks.onBatchComplete?.(done, total, results, locale);
-      }, signal, (raw, size) => hooks.onMalformedReply?.(raw, size, locale));
+      let batchResults;
+      for (let attempt = 0; ; attempt++) {
+        try {
+          batchResults = await provider.translate(batch, (_localeDone, _localeTotal, results) => {
+            done += results.length;
+            hooks.onBatchComplete?.(done, total, results, locale);
+          }, signal, (raw, size) => hooks.onMalformedReply?.(raw, size, locale));
+          break;
+        } catch (err) {
+          if (attempt >= maxRetries || signal?.aborted || !isTransientError(err)) throw err;
+          hooks.onRetry?.(locale, attempt + 1, err);
+          await sleep(delayMs(attempt), signal);
+        }
+      }
       allResults.push(...batchResults);
       const left = remaining.get(locale) - 1;
       remaining.set(locale, left);
@@ -3882,21 +3944,56 @@ function clearPendingBatch(projectRoot) {
 }
 
 // src/server/log.ts
-import { appendFileSync, readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
+import { appendFileSync, existsSync as existsSync9, openSync, fstatSync, readSync, closeSync, statSync as statSync2, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve6 } from "path";
 function logPath(projectRoot) {
   return resolve6(projectRoot, ".glotfile", "log.jsonl");
 }
+var MAX_LOG_BYTES = 5 * 1024 * 1024;
+var TRIM_LOG_TO_BYTES = 4 * 1024 * 1024;
 function appendLog(projectRoot, entry) {
   ensureGlotfileDir(projectRoot);
-  appendFileSync(logPath(projectRoot), JSON.stringify(entry) + "\n", "utf8");
-}
-function readLog(projectRoot, limit = 100) {
   const path = logPath(projectRoot);
-  if (!existsSync9(path)) return [];
+  appendFileSync(path, JSON.stringify(entry) + "\n", "utf8");
+  trimLog(path);
+}
+function trimLog(path, maxBytes = MAX_LOG_BYTES, targetBytes = TRIM_LOG_TO_BYTES) {
+  if (!existsSync9(path) || statSync2(path).size <= maxBytes) return;
   const lines = readFileSync9(path, "utf8").split("\n").filter((l) => l.trim() !== "");
-  const entries = lines.map((l) => JSON.parse(l));
-  return entries.reverse().slice(0, limit);
+  const kept = [];
+  let bytes = 0;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const lineBytes = Buffer.byteLength(lines[i], "utf8") + 1;
+    if (kept.length > 0 && bytes + lineBytes > targetBytes) break;
+    kept.unshift(lines[i]);
+    bytes += lineBytes;
+  }
+  writeFileAtomic(path, kept.length ? kept.join("\n") + "\n" : "");
+}
+function readLastLines(path, n, chunkSize = 64 * 1024) {
+  if (n <= 0 || !existsSync9(path)) return [];
+  const fd = openSync(path, "r");
+  try {
+    let pos = fstatSync(fd).size;
+    if (pos === 0) return [];
+    const chunks = [];
+    while (pos > 0) {
+      const size = Math.min(chunkSize, pos);
+      pos -= size;
+      const buf = Buffer.alloc(size);
+      readSync(fd, buf, 0, size, pos);
+      chunks.unshift(buf);
+      const segments = Buffer.concat(chunks).toString("utf8").split("\n");
+      const complete = (pos > 0 ? segments.slice(1) : segments).filter((l) => l.trim() !== "");
+      if (complete.length >= n || pos === 0) return complete.slice(-n);
+    }
+    return [];
+  } finally {
+    closeSync(fd);
+  }
+}
+function readLog(projectRoot, limit = 100) {
+  return readLastLines(logPath(projectRoot), limit).map((l) => JSON.parse(l)).reverse();
 }
 
 // src/server/ai/batch-run.ts
@@ -4223,13 +4320,13 @@ function estimateTranslation(state, ai, opts) {
 import { relative as relative3 } from "path";
 
 // src/server/import/detect.ts
-import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync2 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync3 } from "fs";
 import { join as join6 } from "path";
 var LOCALE_RE = /^[a-z]{2,3}([_-][A-Za-z]{2,4}){0,2}$/;
 var VUE_DIR_CANDIDATES = ["src/locale", "src/locales", "src/i18n/locales", "locales", "lang"];
 function safeIsDir(p) {
   try {
-    return statSync2(p).isDirectory();
+    return statSync3(p).isDirectory();
   } catch {
     return false;
   }
@@ -4265,7 +4362,7 @@ function detectVue(root, forced = false) {
     if (enough) {
       const sourceLocale = pickSource(locales, (loc) => {
         try {
-          return statSync2(join6(localeRoot, `${loc}.json`)).size;
+          return statSync3(join6(localeRoot, `${loc}.json`)).size;
         } catch {
           return 0;
         }
@@ -4302,7 +4399,7 @@ function detectApple(root) {
         locales,
         sourceLocale: pickSource(locales, (loc) => {
           try {
-            return statSync2(join6(dir, `${loc}.lproj`, "Localizable.strings")).size;
+            return statSync3(join6(dir, `${loc}.lproj`, "Localizable.strings")).size;
           } catch {
             return 0;
           }
@@ -4364,7 +4461,7 @@ function detectI18next(root) {
     if (locales.length === 0) continue;
     const sourceLocale = pickSource(locales, (loc) => {
       try {
-        return readdirSync3(join6(localeRoot, loc)).filter((f) => f.endsWith(".json")).reduce((sum, f) => sum + statSync2(join6(localeRoot, loc, f)).size, 0);
+        return readdirSync3(join6(localeRoot, loc)).filter((f) => f.endsWith(".json")).reduce((sum, f) => sum + statSync3(join6(localeRoot, loc, f)).size, 0);
       } catch {
         return 0;
       }
@@ -4463,10 +4560,9 @@ import { join as join7 } from "path";
 function flattenObject(value, prefix, warnings) {
   const out = {};
   const walk = (node, path) => {
-    if (typeof node === "string") {
-      out[path] = node;
-    } else if (typeof node === "number" || typeof node === "boolean") {
-      out[path] = String(node);
+    if (typeof node === "string" || typeof node === "number" || typeof node === "boolean") {
+      if (path in out) warnings.push(`duplicate flattened key "${path}" \u2014 keeping the first value`);
+      else out[path] = typeof node === "string" ? node : String(node);
     } else if (Array.isArray(node)) {
       node.forEach((el, i) => walk(el, path ? `${path}.${i}` : String(i)));
     } else if (node && typeof node === "object") {
@@ -4511,7 +4607,7 @@ var vueI18nJson2 = {
 };
 
 // src/server/import/parsers/laravel-php.ts
-import { readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { readdirSync as readdirSync5, statSync as statSync4 } from "fs";
 import { join as join8, relative as relative2 } from "path";
 import { execFileSync } from "child_process";
 
@@ -4522,14 +4618,14 @@ function laravelToCanonical(value) {
 
 // src/server/import/parsers/laravel-php.ts
 function listDirs2(dir) {
-  return readdirSync5(dir).filter((e) => statSync3(join8(dir, e)).isDirectory());
+  return readdirSync5(dir).filter((e) => statSync4(join8(dir, e)).isDirectory());
 }
 function listPhpFiles(dir) {
   const out = [];
   const walk = (d) => {
     for (const e of readdirSync5(d)) {
       const full = join8(d, e);
-      if (statSync3(full).isDirectory()) walk(full);
+      if (statSync4(full).isDirectory()) walk(full);
       else if (e.endsWith(".php")) out.push(full);
     }
   };
@@ -4650,7 +4746,7 @@ var flutterArb2 = {
 };
 
 // src/server/import/parsers/apple-strings.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync4 } from "fs";
+import { readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync5 } from "fs";
 import { join as join10 } from "path";
 var LOCALE_RE4 = /^[a-z]{2,3}([_-][A-Za-z]{2,4}){0,2}$/;
 var TABLE = "Localizable.strings";
@@ -4719,25 +4815,34 @@ function parseStrings(text, file, warnings) {
     while (i < n && !/[\s=;]/.test(text[i])) raw += text[i++];
     return raw.length ? raw : null;
   };
+  const recover = () => {
+    while (i < n && text[i] !== ";") i++;
+    if (i >= n) return false;
+    i++;
+    return true;
+  };
   while (true) {
     skipTrivia();
     if (i >= n) break;
     const key = readToken();
     if (key === null) {
       warnings.push(`apple-strings: malformed entry in ${file} near offset ${i}`);
-      break;
+      if (!recover()) break;
+      continue;
     }
     skipTrivia();
     if (text[i] !== "=") {
       warnings.push(`apple-strings: expected '=' after key "${key}" in ${file}`);
-      break;
+      if (!recover()) break;
+      continue;
     }
     i++;
     skipTrivia();
     const value = readToken();
     if (value === null) {
       warnings.push(`apple-strings: missing value for key "${key}" in ${file}`);
-      break;
+      if (!recover()) break;
+      continue;
     }
     skipTrivia();
     if (text[i] === ";") i++;
@@ -4758,7 +4863,7 @@ var appleStrings2 = {
       const file = join10(localeRoot, dir, TABLE);
       let text;
       try {
-        if (!statSync4(file).isFile()) continue;
+        if (!statSync5(file).isFile()) continue;
         text = readFileSync14(file, "utf8");
       } catch {
         continue;
@@ -5036,7 +5141,7 @@ var gettextPo2 = {
 };
 
 // src/server/import/parsers/i18next-json.ts
-import { readdirSync as readdirSync10, readFileSync as readFileSync17, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync10, readFileSync as readFileSync17, statSync as statSync6 } from "fs";
 import { join as join13 } from "path";
 var LOCALE_RE7 = /^[a-z]{2,3}([_-][A-Za-z]{2,4}){0,2}$/;
 var PLURAL_SUFFIX_RE = /^(.+)_(zero|one|two|few|many|other)$/;
@@ -5044,7 +5149,7 @@ var PLURAL_ARG = "count";
 var DEFAULT_NAMESPACE = "translation";
 function safeIsDir2(p) {
   try {
-    return statSync5(p).isDirectory();
+    return statSync6(p).isDirectory();
   } catch {
     return false;
   }
@@ -5144,6 +5249,15 @@ function decodeDouble(body) {
     }
     const n = body[++i];
     if (n === void 0) break;
+    const hexLen = n === "x" ? 2 : n === "u" ? 4 : n === "U" ? 8 : 0;
+    if (hexLen) {
+      const hex = body.slice(i + 1, i + 1 + hexLen);
+      if (hex.length === hexLen && /^[0-9a-fA-F]+$/.test(hex)) {
+        out += String.fromCodePoint(parseInt(hex, 16));
+        i += hexLen;
+        continue;
+      }
+    }
     out += n === "n" ? "\n" : n === "r" ? "\r" : n === "t" ? "	" : n;
   }
   return out;
@@ -5358,7 +5472,7 @@ var railsYaml2 = {
 };
 
 // src/server/import/parsers/apple-stringsdict.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync6 } from "fs";
+import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync7 } from "fs";
 import { join as join15 } from "path";
 var LOCALE_RE9 = /^[a-z]{2,3}([_-][A-Za-z]{2,4}){0,2}$/;
 var TABLE2 = "Localizable.stringsdict";
@@ -5498,7 +5612,7 @@ var appleStringsdict2 = {
       const file = join15(localeRoot, dir, TABLE2);
       let text;
       try {
-        if (!statSync6(file).isFile()) continue;
+        if (!statSync7(file).isFile()) continue;
         text = readFileSync19(file, "utf8");
       } catch {
         continue;
@@ -5820,7 +5934,7 @@ function refreshLocationUsage(projectRoot, format) {
 }
 
 // src/server/export-run.ts
-import { existsSync as existsSync12, readFileSync as readFileSync20, readdirSync as readdirSync13, rmdirSync, statSync as statSync7, unlinkSync } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync20, readdirSync as readdirSync13, rmdirSync, statSync as statSync8, unlinkSync } from "fs";
 import { dirname as dirname2, resolve as resolve7, sep } from "path";
 function effectiveLocales(config) {
   const limit = config.exportLocales;
@@ -5863,7 +5977,7 @@ function pruneStaleLocaleFiles(output, validTokens, projectRoot) {
     if (!segment.includes("{locale}") && !segment.includes("{namespace}")) {
       const next = resolve7(dir, segment);
       if (isLast) {
-        if (stale(locale) && existsSync12(next) && statSync7(next).isFile()) {
+        if (stale(locale) && existsSync12(next) && statSync8(next).isFile()) {
           unlinkSync(next);
           deleted++;
           removeEmptyDirs(dir, root);
@@ -6069,7 +6183,7 @@ function createEventHub() {
 }
 
 // src/server/watch.ts
-import { statSync as statSync8, readdirSync as readdirSync14 } from "fs";
+import { statSync as statSync9, readdirSync as readdirSync14 } from "fs";
 import { join as join17 } from "path";
 import { createHash as createHash2 } from "crypto";
 function hashState(state) {
@@ -6079,14 +6193,14 @@ function signature(statePath) {
   const fmt = detectFormat(statePath);
   if (fmt === "none") return "none";
   if (fmt === "single") {
-    const s = statSync8(statePath);
+    const s = statSync9(statePath);
     return `single:${s.size}:${s.mtimeMs}`;
   }
   const dir = splitDirFor(statePath);
   const parts = [];
   for (const rel of ["config.json", "keys.json"]) {
     try {
-      const s = statSync8(join17(dir, rel));
+      const s = statSync9(join17(dir, rel));
       parts.push(`${rel}:${s.size}:${s.mtimeMs}`);
     } catch {
     }
@@ -6094,7 +6208,7 @@ function signature(statePath) {
   try {
     for (const name of readdirSync14(join17(dir, "locales")).sort()) {
       if (!name.endsWith(".json")) continue;
-      const s = statSync8(join17(dir, "locales", name));
+      const s = statSync9(join17(dir, "locales", name));
       parts.push(`${name}:${s.size}:${s.mtimeMs}`);
     }
   } catch {
@@ -6349,7 +6463,7 @@ function createApi(deps) {
           filePath = abs;
         } else {
           try {
-            if (statSync9(abs).isDirectory()) walk(abs, depth + 1);
+            if (statSync10(abs).isDirectory()) walk(abs, depth + 1);
           } catch {
           }
           continue;
@@ -7381,8 +7495,16 @@ async function readFileResponse(absPath) {
     return null;
   }
 }
+function isLocalHost(hostname) {
+  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost");
+}
 function buildApp(opts) {
   const app = new Hono2();
+  app.use("*", async (c, next) => {
+    if (!isLocalHost(new URL(c.req.url).hostname)) return c.text("Forbidden: non-local Host header", 403);
+    return next();
+  });
   const apiDeps = {
     statePath: opts.statePath,
     autoExport: true,