localization-mcp-server 1.0.0

package/AUDIT_REPORT.md

@@ -0,0 +1,244 @@
+# Localization Health-Check Audit Report
+
+**Date:** 2026-03-28
+**Project:** travis
+**Namespaces:** backoffice-translations (494 keys), mobile (844 keys)
+**Locales:** en, da-DK, nb-NO, sv, uk
+
+---
+
+## Summary
+
+| Severity | Issue | Count | Safe to auto-fix? |
+|----------|-------|-------|-------------------|
+| 🔴 Critical | Keys with trailing whitespace (lookup failures) | 3 | Yes |
+| 🔴 Critical | `uk` locale registered but 0 translations | all keys | No (needs content) |
+| 🟠 High | Duplicate-value keys with same meaning | 7 (backoffice) + 39 (mobile) | No (requires intent check) |
+| 🟠 High | Case-duplicate key pairs | 3 (backoffice) | Risky (consumer refs unknown) |
+| 🟠 High | Country-prefixed dynamic key pattern | 40 keys (mobile) | No (structural) |
+| 🟡 Medium | Mixed naming conventions (camel/snake/Pascal) | 10+ (backoffice) + 100+ (mobile) | No (consumer refs unknown) |
+| 🟡 Medium | da-DK / nb-NO have keys not in `en` baseline | 42 / 44 (mobile) | Investigate first |
+| 🟡 Medium | Sandbox polluted with ghost test entries | 19 keys | Yes (reset sandbox) |
+| ℹ️ Info | `searchLocale` without `search` is a no-op | API behavior | Document only |
+
+---
+
+## 🔴 CONFIRMED PROBLEMS
+
+### 1. Trailing whitespace in key names (`mobile`)
+
+These three keys have a trailing space in their name. Any consumer code using the exact key string without the trailing space will get a lookup miss and fall back to the key string itself at runtime.
+
+```
+'accountDeleteMessage '  (has trailing space)
+'billable '              (has trailing space)
+'email '                 (has trailing space)
+```
+
+**Impact:** Silent runtime failures — UI shows the raw key name instead of the translated string.
+
+**Fix:** Safe to rename these keys in sandbox (delete old, create new without space). However, this requires verifying that the consumer code references the trimmed version (`accountDeleteMessage`, `billable`, `email`). If consumer code has the space hardcoded, renaming here breaks nothing but also fixes nothing.
+
+**Recommendation:** Fix the keys here AND audit the consumer app for the space variant.
+
+---
+
+### 2. `uk` locale: 0 translations
+
+The `uk` locale is registered in the project but has no content in either namespace. The public endpoint returns 404:
+```
+GET /translations/travis/backoffice-translations/uk → 404 Not Found
+GET /translations/travis/mobile/uk → 404 Not Found
+```
+
+**Impact:** Any consumer code that falls through to `uk` locale will fail completely.
+
+**Fix:** Either:
+- Add Ukrainian translations (content work — not auto-fixable)
+- Remove the `uk` locale from the project until content is ready (Admin UI)
+
+---
+
+## 🟠 HIGH SEVERITY
+
+### 3. Case-duplicate key pairs (`backoffice-translations`)
+
+Three pairs of keys represent the same concept but differ only by casing. **All have identical English values:**
+
+| Pair | Value |
+|------|-------|
+| `logIn` / `login` | "Log in" |
+| `logOut` / `logout` | "Log out" |
+| `Mileage` / `mileage` | "Mileage" |
+
+**Impact:** Consumer code is using one or both. If both are referenced, translations must be kept in sync manually — a maintenance burden and a source of inconsistency across locales.
+
+**Fix:** Cannot auto-fix — need to know which key the consumer app references. Audit the consumer codebase, pick the canonical key (camelCase is the convention), deprecate the other. This is a **breaking change** for the consumer if done without coordination.
+
+---
+
+### 4. Semantic duplicate keys (`backoffice-translations` — 5 confirmed pairs)
+
+Different key names, identical English values. These are almost certainly storing the same concept:
+
+| Keys | Shared value |
+|------|-------------|
+| `equipment_allowance` + `equipmentAllowance` | "Equipment and materials" |
+| `expenseType` + `netlonExpenceType` | "Expense type" |
+| `governmentAllowance` + `governmentRate` | "Government rate" |
+| `dkCustom` + `vismaBusiness` | "Custom" |
+| `employeeId` + `employeeNumber` | "Employee number" |
+
+Note: `netlonExpenceType` contains a typo ("Expence").
+
+**Fix:** Cannot auto-fix. Requires consumer audit to confirm which key is actually used. Likely one of each pair is legacy/dead code.
+
+---
+
+### 5. Semantic duplicates (`mobile` — 39 groups, 5 most critical)
+
+| Keys | Shared value | Risk |
+|------|-------------|------|
+| `approvalApproved` / `approved` / `reportStatusApproved` | "Approved" | Medium — context may differ |
+| `approvalDeclined` / `declined` / `reportStatusDeclined` | "Declined" | Medium |
+| `approvalPending` / `pending` / `reportStatusPending` | "Pending" | Medium |
+| `appOptions` / `settings` | "Settings" | Low — likely different screens |
+| `approvalDecline` / `decline` | "Decline" | Medium |
+
+These are likely intentional duplicates for context separation, but they create a translation maintenance burden: updating "Approved" requires updating 3 separate keys. If any locale translator updates only one, the UI becomes inconsistent.
+
+**Recommendation:** Acceptable if intentional. Document them. Consider consolidating `approvalApproved` → `approved` (action vs state).
+
+---
+
+### 6. Country-prefixed dynamic key pattern (`mobile` — 40 keys)
+
+The `mobile` namespace has 40 keys named `{COUNTRY}-type-of-{vehicle|fuel}-{type}`:
+- 16 `DK-*` keys
+- 12 `NO-*` keys
+- 12 `SE-*` keys
+
+The consumer almost certainly builds these keys dynamically:
+```javascript
+// Consumer likely does something like:
+t(`${countryCode}-type-of-vehicle-${vehicleType}`)
+```
+
+**Why this is risky:**
+
+1. **Country code format mismatch.** The system uses locale codes `da-DK`, `nb-NO`, `sv` — but these keys use abbreviated country codes `DK`, `NO`, `SE`. If the consumer uses the wrong format, all lookups fail silently.
+
+2. **Unsupported dynamic key detection.** No tooling can statically detect missing keys for dynamic patterns. If a new vehicle type is added, there's no guarantee all country variants are added.
+
+3. **Cross-country duplication.** `DK-type-of-fuel-electric`, `NO-type-of-fuel-electric`, and `SE-type-of-fuel-electric` all equal "Electric" in English. Three keys, one concept.
+
+4. **Some DK keys contain `/`** (`DK-type-of-vehicle-bicycle/non-motorized`) which is an invalid character in this system's key naming rules. These likely fail silently or cause routing issues.
+
+**Investigation needed:**
+- Confirm how the consumer constructs these key names (`DK` vs `da-DK`)
+- This is the root cause of the "problem with adding some countries" mentioned in the project
+
+**Fix:** Not auto-fixable. Options:
+- Keep pattern but fix the `/` in key names (safe, small)
+- Normalize to locale codes (`da-DK-type-of-vehicle-car`) — breaking change
+- Restructure as nested: `type-of-vehicle.car.DK` — major restructure
+
+---
+
+## 🟡 MEDIUM SEVERITY
+
+### 7. Mixed naming conventions
+
+**`backoffice-translations`:** Predominantly camelCase with exceptions:
+- 4 PascalCase: `Continue`, `Mileage`, `RemoveCompanyConfirmationText`, `SoftRemoveConfirmation`
+- 5 snake_case: `car_over_20_000km`, `company_admin`, `equipment_allowance`, `first_approver`, `second_approver`
+- 1 dash: `re-inviteAll`
+
+**`mobile`:** No dominant convention — approximately equal split between:
+- camelCase (~713 keys)
+- snake_case (~66 keys)
+- DK/NO/SE prefixed keys (40 keys)
+- `/problems/*` error codes (22 keys)
+- Mixed other patterns (~103 keys)
+
+**Impact:** Makes automated tooling and agent work unreliable — cannot predict key name format.
+
+**Fix:** Convention enforcement going forward. Existing keys: do not rename without consumer audit.
+
+---
+
+### 8. da-DK and nb-NO have keys not in `en` baseline (`mobile`)
+
+```
+da-DK: 886 keys vs en: 844 keys → 42 extra keys in da-DK
+nb-NO: 888 keys vs en: 844 keys → 44 extra keys in nb-NO
+```
+
+The extra keys include content like `aboutPurchaseTitle`, `alreadySubscribed`, `freeTrialUsedUpScrrenTitle` (note typo: "Sccren"). These look like **iOS in-app purchase / subscription strings** that may have been loaded for DK and NO markets but never added to the English baseline.
+
+**Impact:** These keys exist only in certain locales. Consumers relying on English as fallback may not find them, or may find them only in specific locales.
+
+**Recommendation:** Investigate if these are intentional market-specific strings or legacy content. If legacy, clean up. If intentional, add English baseline versions.
+
+---
+
+### 9. Sandbox polluted with ghost test entries
+
+The sandbox currently has 19 keys pending deletion, all with `productionValue: null` — test artifacts from MCP validation sessions. These keys were created in sandbox and then deleted, but they remain in the diff as pending deletions.
+
+```
+backoffice-translations/mcp.e2e.test (5 locales)
+backoffice-translations/mcp.final.test (5 locales)
+backoffice-translations/test.key (2 locales)
+... and 16 more
+```
+
+Also 3 potentially real keys pending deletion:
+```
+backoffice-translations/expense.amount
+backoffice-translations/expense.delete
+backoffice-translations/expense.save
+```
+
+These last 3 were apparently added then deleted in sandbox. Verify if they were intentional.
+
+**Fix:** If `expense.*` keys were intentional but accidentally deleted, recreate them. Then reset sandbox to clear the ghost entries. If not intentional, just reset sandbox.
+
+---
+
+## ℹ️ INFORMATIONAL
+
+### `searchLocale` without `search` is a no-op
+
+Calling `list_translations` with `searchLocale=uk` but no `search` parameter returns all entries, not just those with `uk` values. This is a backend behavior quirk. Documented in AGENT_GUIDE.md.
+
+### Error keys: two conflicting patterns in `mobile`
+
+There are two different slash-based error key formats in the same namespace:
+
+```
+/problems/access_token_invalid    ← 22 keys with LEADING slash
+problems/bad_request              ← 4 keys WITHOUT leading slash
+```
+
+These cannot be the same lookup pattern. The consumer must be doing two different things to hit both. One pattern is likely wrong or legacy.
+
+Additionally, two keys contain embedded slashes that are not error codes:
+```
+DK-type-of-vehicle-bicycle/non-motorized
+DK-type-of-vehicle-short-bicycle/non-motorized
+```
+These are accessible via URL-encoding (`%2F`) but violate the standard key naming rules (`/^[a-zA-Z0-9._-]+$/`). They exist because they were imported via ZIP before the validation rule was in place.
+
+---
+
+## Recommended fix order
+
+1. **Fix trailing whitespace keys** (3 keys in `mobile`) — safe, small, confirmed impact
+2. **Clarify `uk` locale** — remove or fill
+3. **Clean sandbox ghost entries** — reset sandbox after confirming `expense.*` keys
+4. **Investigate `/` in `DK-type-of-vehicle-bicycle/non-motorized`** keys — may cause routing failures
+5. **Investigate da-DK/nb-NO extra keys** — likely legacy, needs product decision
+6. **Audit consumer app for duplicate key usage** — needed before consolidating duplicates
+
+**Do not auto-fix:** naming convention normalization, duplicate key consolidation, country-prefix pattern restructure. All require consumer codebase audit first.

package/PROJECT_OVERVIEW.md

@@ -0,0 +1,140 @@
+# Localization System — Project Overview for Agents
+
+> Read this before starting any work. This is the authoritative reference for how this system works, what environments exist, and how to use them correctly.
+
+---
+
+## What this system is
+
+This is a **localization management backend** that replaces Locize. It stores, serves, and manages translation keys for consumer applications (currently: the TRAVIS app). It is not a translation tool for its own UI — the admin-ui is in English only and has no i18n layer.
+
+The system has two roles:
+1. **API server** — serves translation JSON to consumer apps at runtime
+2. **Management backend** — agents and humans create/edit/review translation keys
+
+---
+
+## Project → Namespace → Locale hierarchy
+
+```
+project (e.g. "travis")
+  └─ namespace (e.g. "backoffice-translations", "mobile")
+       └─ key (e.g. "button.save")
+            └─ locale values (en, da-DK, nb-NO, sv, uk)
+```
+
+Consumers fetch translations by **project + namespace + locale**:
+```
+GET /translations/{projectSlug}/{namespace}/{locale}
+→ { "button.save": "Save", "button.cancel": "Cancel", ... }
+```
+
+This is a **public unauthenticated endpoint**. It serves production data only.
+
+---
+
+## Environments: Sandbox vs Production
+
+### Production
+- What consumers fetch at runtime
+- Served at: `GET /translations/{slug}/{namespace}/{locale}` (no auth)
+- Read-only for agents — no MCP tool writes to it
+- Changed only by: Admin UI → "Push to Production" button
+
+### Sandbox
+- The working copy — all agent writes go here
+- Served at: `GET /translations/projects/{slug}/sandbox/namespaces/{ns}/entries` (auth required)
+- Invisible to consumers until promoted
+- Full CRUD access for agents
+
+### Rule: agents always work in sandbox
+
+```
+Dev work  → Sandbox   ✅
+Production reads → OK ✅  (for review/comparison)
+Production writes → IMPOSSIBLE via MCP (by design)
+```
+
+---
+
+## Environment → URL mapping
+
+| Context | URL pattern | Auth | Consumer-visible? |
+|---------|-------------|------|-------------------|
+| Production read (consumer) | `/translations/{slug}/{ns}/{locale}` | None | ✅ Yes |
+| Production read (MCP) | `/translations/projects/{slug}/namespaces/{ns}/entries` | MCP token | Read only |
+| Sandbox read/write (MCP) | `/translations/projects/{slug}/sandbox/namespaces/{ns}/entries` | MCP token | ❌ No |
+| Sandbox management | `/translations/projects/{slug}/sandbox/{init,reset,diff,status}` | MCP token | ❌ No |
+
+**This is deterministic.** There is no implicit environment detection. The sandbox and production endpoints are different paths. An agent cannot accidentally write to production because no production-write endpoints exist in the MCP server.
+
+### Verifying which environment you're targeting
+
+```
+# Check sandbox state
+get_environment_status({ projectSlug: "travis" })
+
+# Read from sandbox (default)
+list_translations({ projectSlug: "travis", namespace: "mobile", env: "sandbox" })
+
+# Read from production (for comparison only)
+list_translations({ projectSlug: "travis", namespace: "mobile", env: "production" })
+```
+
+---
+
+## ⚠️ If you detect production is being used for dev work
+
+**Production should never be the target for development changes.** If you observe that:
+- Keys are being created directly in production (bypassing sandbox)
+- The consumer app is pointed to this system's production API in a dev environment
+- Someone is using `POST/PATCH/DELETE` on `/translations/projects/*/namespaces/*/entries` (non-sandbox paths) for development
+
+**You must:**
+1. Stop and warn: "This is targeting production directly. Production data will be visible to all users immediately."
+2. Suggest the correct flow: "Use the sandbox workflow — call `init_sandbox`, make changes there, review with `get_translation_diff`, and promote via Admin UI."
+3. Do not proceed with production writes.
+
+---
+
+## Auth setup
+
+Every agent needs a personal MCP token. Tokens are `lmcp_` prefixed, stored as SHA256 hashes in the DB.
+
+**For a new developer:**
+1. Log in to Admin UI → API Tokens
+2. Click "Generate token" → enter a name (e.g. `dev-laptop`)
+3. Copy the token — **shown only once**
+4. Add to `mcp-server/.env`:
+   ```
+   BACKEND_URL=http://localhost:8080
+   MCP_TOKEN=lmcp_your_token_here
+   ```
+5. Restart Claude / reload MCP server
+
+**Token lost or revoked?** Generate a new one via Admin UI. Old one cannot be recovered.
+
+---
+
+## Deployment behavior
+
+Translation keys and code deployments are **decoupled**:
+
+| Change | What to do |
+|--------|-----------|
+| New/updated translation values only | Sandbox → Admin UI "Push to Production" — no code deploy needed |
+| New key referenced in code | Add key to sandbox → push to production → deploy code (order matters!) |
+| New locale added to project | Add via Admin UI → fill translations via MCP → push to production |
+
+**Critical ordering rule:** If code references a key before it exists in production, runtime will return `undefined`. Always push the key to production before deploying code that uses it.
+
+---
+
+## Known issues and limitations
+
+| Issue | Status |
+|-------|--------|
+| `searchLocale` without `search` param is a no-op | Known limitation — documented |
+| `uk` locale registered but has 0 translations | Data gap — needs content |
+| da-DK and nb-NO in `mobile` have 42–44 keys not in `en` | Legacy content — investigate |
+| Sandbox diff shows ghost "deleted" entries with `productionValue: null` | Cosmetic — cleanup on next promote |

package/dist/api-client.d.ts

@@ -0,0 +1,11 @@
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly message: string;
+    readonly details?: unknown | undefined;
+    constructor(status: number, message: string, details?: unknown | undefined);
+}
+export declare function apiGet<T>(path: string, params?: Record<string, unknown>): Promise<T>;
+export declare function apiPost<T>(path: string, data?: unknown): Promise<T>;
+export declare function apiPatch<T>(path: string, data?: unknown): Promise<T>;
+export declare function apiDelete(path: string): Promise<void>;
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAWA,qBAAa,QAAS,SAAQ,KAAK;aAEf,MAAM,EAAE,MAAM;aACd,OAAO,EAAE,MAAM;aACf,OAAO,CAAC,EAAE,OAAO;gBAFjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,OAAO,YAAA;CAKpC;AAcD,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAO1F;AAED,wBAAsB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAOzE;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAO1E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3D"}

package/dist/api-client.js

@@ -0,0 +1,67 @@
+import axios, { AxiosError } from "axios";
+const client = axios.create({
+    baseURL: process.env.BACKEND_URL ?? "http://localhost:8080",
+    headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${process.env.MCP_TOKEN ?? ""}`,
+    },
+    timeout: 30_000,
+});
+export class ApiError extends Error {
+    status;
+    message;
+    details;
+    constructor(status, message, details) {
+        super(message);
+        this.status = status;
+        this.message = message;
+        this.details = details;
+        this.name = "ApiError";
+    }
+}
+function handleError(error) {
+    if (error instanceof AxiosError) {
+        const status = error.response?.status ?? 0;
+        const message = error.response?.data?.message ??
+            error.message ??
+            "Unknown API error";
+        throw new ApiError(status, String(message), error.response?.data);
+    }
+    throw error;
+}
+export async function apiGet(path, params) {
+    try {
+        const response = await client.get(path, { params });
+        return response.data;
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export async function apiPost(path, data) {
+    try {
+        const response = await client.post(path, data);
+        return response.data;
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export async function apiPatch(path, data) {
+    try {
+        const response = await client.patch(path, data);
+        return response.data;
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export async function apiDelete(path) {
+    try {
+        await client.delete(path);
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAE1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,uBAAuB;IAC3D,OAAO,EAAE;QACP,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE;KACvD;IACD,OAAO,EAAE,MAAM;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEf;IACA;IACA;IAHlB,YACkB,MAAc,EACd,OAAe,EACf,OAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAU;QAGjC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GACV,KAAK,CAAC,QAAQ,EAAE,IAA6B,EAAE,OAAO;YACvD,KAAK,CAAC,OAAO;YACb,mBAAmB,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAI,IAAY,EAAE,MAAgC;IAC5E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAI,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAI,IAAY,EAAE,IAAc;IAC3D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,IAAY,EAAE,IAAc;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createServer } from "./server.js";
+// Load .env from the mcp-server directory (one level above dist/)
+if (process.env.NODE_ENV !== "production") {
+    const { default: dotenv } = await import("dotenv");
+    const { fileURLToPath } = await import("url");
+    const { dirname, resolve } = await import("path");
+    const __dirname = dirname(fileURLToPath(import.meta.url));
+    dotenv.config({ path: resolve(__dirname, "..", ".env") });
+}
+if (!process.env.MCP_TOKEN) {
+    process.stderr.write("[localization-mcp] WARNING: MCP_TOKEN is not set. All API calls will fail with 401.\n");
+}
+if (!process.env.BACKEND_URL) {
+    process.stderr.write("[localization-mcp] BACKEND_URL not set, defaulting to http://localhost:3000\n");
+}
+const server = createServer();
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,kEAAkE;AAClE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;IAC1C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uFAAuF,CACxF,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+EAA+E,CAChF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/locale-aliases.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Locale alias resolution for MCP tools.
+ *
+ * The server stores BCP 47 codes (nb-NO, da-DK).
+ * Consumer apps and local translation files often use shorter ISO 639-1 codes (no, da).
+ *
+ * This module normalises alias codes to canonical codes before sending to the backend,
+ * so agents and migration scripts can pass either form without breaking.
+ *
+ * ── Alias table ──────────────────────────────────────────────────────────────
+ *   no  → nb-NO   (Norwegian Bokmål — most common alias)
+ *   nb  → nb-NO
+ *   nn  → nb-NO   (Norwegian Nynorsk — treated as Bokmål in this system)
+ *   da  → da-DK   (Danish)
+ *   dk  → da-DK   (incorrect but common mistake)
+ *
+ * Codes that are already canonical (en, sv, uk, nb-NO, da-DK) pass through unchanged.
+ */
+export declare const LOCALE_ALIASES: Readonly<Record<string, string>>;
+export interface LocaleRemapping {
+    from: string;
+    to: string;
+}
+/**
+ * Resolves locale aliases in a locale→value map.
+ *
+ * Returns the resolved map (with canonical locale codes as keys)
+ * and the list of remappings that were applied, so callers can
+ * inform the agent about what was normalised.
+ *
+ * If two input codes resolve to the same canonical code, the last one wins
+ * (e.g. both "no" and "nb" would map to "nb-NO").
+ */
+export declare function resolveLocaleAliases(values: Record<string, string>): {
+    resolved: Record<string, string>;
+    remapped: LocaleRemapping[];
+};
+/**
+ * Resolves locale aliases across a full translations map (locale → key → value).
+ * Used by bulk_import which receives a top-level locale map.
+ */
+export declare function resolveTranslationLocaleAliases(translations: Record<string, Record<string, string>>): {
+    resolved: Record<string, Record<string, string>>;
+    remapped: LocaleRemapping[];
+};
+//# sourceMappingURL=locale-aliases.d.ts.map

package/dist/locale-aliases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale-aliases.d.ts","sourceRoot":"","sources":["../src/locale-aliases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3D,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B,CAeA;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACnD;IACD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B,CAgBA"}

package/dist/locale-aliases.js

@@ -0,0 +1,71 @@
+/**
+ * Locale alias resolution for MCP tools.
+ *
+ * The server stores BCP 47 codes (nb-NO, da-DK).
+ * Consumer apps and local translation files often use shorter ISO 639-1 codes (no, da).
+ *
+ * This module normalises alias codes to canonical codes before sending to the backend,
+ * so agents and migration scripts can pass either form without breaking.
+ *
+ * ── Alias table ──────────────────────────────────────────────────────────────
+ *   no  → nb-NO   (Norwegian Bokmål — most common alias)
+ *   nb  → nb-NO
+ *   nn  → nb-NO   (Norwegian Nynorsk — treated as Bokmål in this system)
+ *   da  → da-DK   (Danish)
+ *   dk  → da-DK   (incorrect but common mistake)
+ *
+ * Codes that are already canonical (en, sv, uk, nb-NO, da-DK) pass through unchanged.
+ */
+export const LOCALE_ALIASES = {
+    no: "nb-NO",
+    nb: "nb-NO",
+    nn: "nb-NO",
+    da: "da-DK",
+    dk: "da-DK",
+};
+/**
+ * Resolves locale aliases in a locale→value map.
+ *
+ * Returns the resolved map (with canonical locale codes as keys)
+ * and the list of remappings that were applied, so callers can
+ * inform the agent about what was normalised.
+ *
+ * If two input codes resolve to the same canonical code, the last one wins
+ * (e.g. both "no" and "nb" would map to "nb-NO").
+ */
+export function resolveLocaleAliases(values) {
+    const resolved = {};
+    const remapped = [];
+    for (const [locale, value] of Object.entries(values)) {
+        const canonical = LOCALE_ALIASES[locale.toLowerCase()];
+        if (canonical) {
+            remapped.push({ from: locale, to: canonical });
+            resolved[canonical] = value;
+        }
+        else {
+            resolved[locale] = value;
+        }
+    }
+    return { resolved, remapped };
+}
+/**
+ * Resolves locale aliases across a full translations map (locale → key → value).
+ * Used by bulk_import which receives a top-level locale map.
+ */
+export function resolveTranslationLocaleAliases(translations) {
+    const resolved = {};
+    const remapped = [];
+    for (const [locale, keyMap] of Object.entries(translations)) {
+        const canonical = LOCALE_ALIASES[locale.toLowerCase()];
+        if (canonical) {
+            remapped.push({ from: locale, to: canonical });
+            // Merge into existing canonical bucket if it exists (e.g. both "no" and "nb" provided)
+            resolved[canonical] = { ...(resolved[canonical] ?? {}), ...keyMap };
+        }
+        else {
+            resolved[locale] = { ...(resolved[locale] ?? {}), ...keyMap };
+        }
+    }
+    return { resolved, remapped };
+}
+//# sourceMappingURL=locale-aliases.js.map

package/dist/locale-aliases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale-aliases.js","sourceRoot":"","sources":["../src/locale-aliases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAqC;IAC9D,EAAE,EAAE,OAAO;IACX,EAAE,EAAE,OAAO;IACX,EAAE,EAAE,OAAO;IACX,EAAE,EAAE,OAAO;IACX,EAAE,EAAE,OAAO;CACZ,CAAC;AAOF;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA8B;IAIjE,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/C,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC7C,YAAoD;IAKpD,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/C,uFAAuF;YACvF,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,8 @@
+export interface AuditEntry {
+    timestamp: string;
+    operation: string;
+    params: Record<string, unknown>;
+    result: unknown;
+}
+export declare function logWrite(operation: string, params: Record<string, unknown>, result: unknown): void;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,wBAAgB,QAAQ,CACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,OAAO,GACd,IAAI,CAaN"}

package/dist/logger.js

@@ -0,0 +1,19 @@
+import fs from "fs";
+import path from "path";
+const LOG_FILE = process.env.AUDIT_LOG_PATH ?? path.join(process.cwd(), "mcp-audit.log");
+export function logWrite(operation, params, result) {
+    const entry = {
+        timestamp: new Date().toISOString(),
+        operation,
+        params,
+        result,
+    };
+    try {
+        fs.appendFileSync(LOG_FILE, JSON.stringify(entry) + "\n");
+    }
+    catch {
+        // Log to stderr if file write fails — do not crash the MCP server
+        process.stderr.write(`[audit] Failed to write to ${LOG_FILE}: ${JSON.stringify(entry)}\n`);
+    }
+}
+//# sourceMappingURL=logger.js.map