@ffschrattenecker/tm1-mcp-server 6.0.0

package/CHANGELOG.md

@@ -0,0 +1,1211 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [6.0.0] - 2026-09-25
+
+### Breaking
+
+- **Published as `@ffschrattenecker/tm1-mcp-server`.** This fork is no longer released under
+  the unscoped `tm1-mcp-server` npm name, which belongs to upstream (flameY3T1). Install with
+  `npx -y @ffschrattenecker/tm1-mcp-server`. The command is still `tm1-mcp-server`, and the
+  User-Agent keeps the unscoped name.
+- **`tm1_set_cube_rules` preflight.** Before writing, the full resulting text (after `edits`
+  are applied) is checked with `tm1.CheckRules`. Any error returns `VALIDATION_ERROR` with
+  `stage:"preflight"`, `check:"syntax"` and `errors[]`, and nothing is written. The Rules PATCH
+  itself stores syntactically broken text without an error (verified on 11.8.03500), so until
+  now the check was only as good as the caller's discipline. `preflight:false` opts out.
+- **`tm1_write_cells` refuses a `dimensions` list that does not cover the cube.** A dimension
+  left out used to land on its default member without an error. Verified on 11.8.03500: a
+  write that left out the measure dimension overwrote the value at its first element. Unknown and
+  duplicated names are refused too. Nothing is written in any of these cases. The one dimension
+  that may be left out is `Sandboxes` (added to every cube by `EnableSandboxDimension=true`).
+  It is now bound to `Base` explicitly, and the result says so as `sandboxDefaulted: "Base"`,
+  instead of relying on TM1's default member, which is `Base` only while no sandbox has
+  `IncludeInSandboxDimension=true`. `dimensions` may come in any order; each cell's elements
+  follow it. A named sandbox is addressable only once `IncludeInSandboxDimension` is true.
+- **The reference check also resolves element literals in cell functions**, in both
+  `tm1_validate_process_refs` and the install preflight. `CellGetN/S`, `CellPutN/S`,
+  `CellIncrementN`, `CellIsUpdateable` and `CellPutProportionalSpread` on an existing cube: each
+  literal (or literal-bound) element argument is looked up in the dimension at its position. A
+  missing one is an issue of kind `element` with its `dimension`, and the preflight refuses the
+  install. Why: TI does not abort on a missing element. Verified on 11.8.03500, the process ends
+  `HasMinorErrors`, the rest runs, and the value is not written. The rules against false
+  positives were checked live:
+  - The lookup is TM1's own resolution: case- and space-insensitive, aliases accepted,
+    `'Hierarchy:Element'` read against that hierarchy.
+  - TI cell calls never pass the `Sandboxes` dimension, so positions skip it; a call whose
+    argument count doesn't match is skipped.
+  - Elements the same code inserts are excused. A dimension the code inserts computed names
+    into excuses every literal in it.
+  - Variables (datasource fields, parameters) are not checked and do not set `partial`.
+  - `DimIx`/`ElementIndex` stay existence probes.
+  - Lookups are capped at 200 distinct pairs per report; the rest counts as `unresolvableArgs`.
+
+  New output field `elementRefsScanned`.
+- **An overwrite is refused when its backup cannot be written** (see Added). An unwritable
+  `TM1_PROCESS_BACKUP_DIR` used to be irrelevant to a deploy; now it fails with nothing
+  changed on the server. `TM1_PROCESS_BACKUP_DIR=off` restores the old behaviour.
+- **The import tools replace the whole definition on an update.** `tm1_import_pro_file`,
+  `tm1_import_process_from_git` and `tm1_install_pro_bundle` used to skip an empty parameter
+  list, an empty variable layout and a `None` datasource, so the installed values stayed. The
+  code tabs were already replaced in full. The result was that importing an older version
+  of a process did not restore it. Verified on 11.8.03500 while restoring a backup: the
+  parameter the newer version had added was still there. On a create nothing changes.
+  `tm1_upsert_process` still keeps whatever the call leaves out.
+
+### Added
+
+- **Automatic backup before a process is overwritten.** `tm1_upsert_process`, both import
+  tools and `tm1_install_pro_bundle` export the installed version as a tm1-git pair before
+  their first write and return the paths as `backup: { json, ti }`. Restore it with
+  `tm1_import_process_from_git`. Until now the only rollback copy was one the caller had
+  remembered to export first. Details:
+  - The default directory is `~/.tm1-mcp-server/backups`, split per connection and process.
+    Set it with `TM1_PROCESS_BACKUP_DIR`, or turn backups off with `off`.
+  - The directory is chosen by the server, never by the caller, which is why it is on without
+    `TM1_LOCAL_FILE_ROOT`.
+  - The code is written unmasked, because a masked backup restores placeholder literals and
+    fails at runtime. The ODBC password is never written.
+  - The backup runs after the confirm check and the preflight, so a refused call leaves no file.
+  - Live-tested on 11.8.03500: overwrite, then restore from the backup, gives the same export as
+    before the overwrite. The one difference is line endings: the import writes CRLF.
+
+- `tm1_check_writable_coords` takes an optional `dimensions` list, resolved exactly like
+  `tm1_write_cells` (any order, `Sandboxes` bound to `Base`). The documented pre-write check can
+  then check the cell the write will address, instead of refusing the coordinates the write accepts.
+- `tm1_check_cube_rule` takes the same sources as `tm1_set_cube_rules`: `rules`, `edits` or
+  `filePath`. A patch can be validated exactly as it would be installed, without the caller
+  rebuilding the whole file to check it.
+- `tm1_get_server_info` returns `mcpServer: { name, version }`, the MCP server's own package
+  identity. A client can gate on the server version from a tool result instead of guessing it
+  from which schema fields exist.
+
+### Known issues
+
+- `tm1_sample_cells` returns no cells on a cube with a `Sandboxes` dimension even when it holds
+  data (seen on 11.8.03500). Not investigated yet. Use `tm1_execute_mdx` with an explicit
+  `[Sandboxes].[Base]` until it is.
+
+### Fixed
+
+- `tm1_invalidate_callgraph_cache` is annotated `readOnlyHint` and so is available in readonly
+  mode. It only drops an in-memory index and touches no TM1 object. Its description no longer
+  says to call it after every deploy: the server has invalidated on every mutating call since
+  4.x, so the old advice cost a turn for nothing.
+- The preflight's reference-failure hint no longer says "correct the name". It asks the
+  model to report each unresolved name to the user first. A near match (`SalesPlan` for
+  `'Sales Plan'`) is a different object, and swapping it in unasked is the silent
+  substitution the check exists to stop.
+
+## [5.0.0] - 2026-09-24
+
+### Breaking
+
+- **Install preflight also runs the reference check, on the exact payload.**
+  `tm1_import_pro_file`, `tm1_import_process_from_git`, `tm1_install_pro_bundle` and now
+  `tm1_upsert_process` (new `preflight`, default true) run the syntax check and then the
+  `tm1_validate_process_refs` check before writing anything. A literal cube or dimension
+  name that does not exist on the server aborts the install with `VALIDATION_ERROR`
+  (`stage: "preflight"`, `check: "references"`, `issues[]`). Before, preflight ran the syntax
+  check only, and TM1 never resolves names at compile time. `upsert_process` checks the
+  process as it will be after the call: omitted tabs, parameters and variables keep their
+  installed values. `import_process_from_git` deploys the raw `.ti` blob, so it also
+  refuses a blob with code outside the four tab regions, or a tab region that appears
+  twice: that code would install without having been checked. *Action:* a deploy that
+  references an object its own code does not create must create the object first, or pass
+  `preflight: false`, which skips both checks.
+- **Overwriting an installed process needs `confirm`.** `tm1_upsert_process`,
+  `tm1_import_pro_file` and `tm1_import_process_from_git` reject an update of an existing
+  process unless `confirm` repeats the process name, and nothing is written.
+  `tm1_install_pro_bundle` works out every file that would overwrite before the first
+  write, and needs `confirm` set to the directory's last path segment. `dryRun` returns the
+  list (`overwrites[]`) without it. Creating a new process needs no confirm. All four are
+  now annotated `destructiveHint: true`. `tm1_copy_process` is unchanged: TM1 refuses to
+  copy onto an existing name, so it never overwrites. *Action:* pass `confirm` on every
+  update of an existing process, or use `mode: "create"` to refuse overwrites outright.
+- **`tm1_bulk_upsert_elements` needs `confirm` (the dimension name) when `components`
+  would remove existing children.** Components replace a consolidation's child set, so
+  listing `[A]` under a parent that holds `{A, B}` drops `B`. The removals are computed
+  before anything is written: the `$batch` create pass commits as it goes, so they could
+  not be computed afterwards. The call fails with `VALIDATION_ERROR` and
+  `details.removals[{parent, children}]` for the model to show the user. New `dryRun:
+  true` returns the full plan (`creates`, `updates`, `typeChanges`, `removals`) and writes
+  nothing. Calls whose components keep every child need no confirm. *Action:* pass
+  `confirm` when a removal is intended, or list the complete child set.
+
+### Changed
+
+- **`tm1_validate_process_refs` reports its coverage and stops flagging legitimate
+  patterns.** It now returns `tabsChecked`, `unresolvableArgs` and `partial`. `partial` is
+  true when object names are passed as parameters or computed values, so those references
+  were not checked. Existence probes (`DimensionExists`, `CubeExists`, `HierarchyExists`,
+  `SubsetExists`, `ViewExists`) and names the same code creates (`CubeCreate`,
+  `DimensionCreate`) are no longer reported as unresolved, so the
+  `IF(DimensionExists('X') = 0); DimensionCreate('X');` pattern passes. The scan moved to a
+  shared core that the install tools' preflight now also runs.
+- **`tm1_check_process_code` reports `tabsChecked` and `partial`.** Omitted tabs compile as
+  empty, so a clean result on a fragment says nothing about the tabs left out. `partial:
+  true` makes that visible: a validated prolog is not a validated process.
+
+## [4.1.0] - 2026-09-24
+
+### Added
+
+- **`tm1_get_hierarchy` takes `countOnly: true`**: totals by type and level (`counts.byType`,
+  `counts.byLevel`, `counts.maxLevel`) with an empty `elements` array. The filters still
+  apply. It reads only `Type,Level` from the Elements collection, so sizing a dimension no
+  longer means probing with a growing `topN`.
+- **`tm1_get_element_attribute_values` reads every element when `elementName` is
+  omitted**: a name-sorted page of `{elementName, values}` rows in the usual page envelope,
+  with `attributeNames` to narrow the columns. The window is pushed into the MDX row set, so
+  the query text stays short however large the page is. Passing `elementName` returns the
+  same single-element shape as before.
+- **Response-size guard (`TM1_MAX_RESPONSE_CHARS`, default 80000).** A successful result
+  over the limit is replaced by a `RESPONSE_TOO_LARGE` error that gives the size and a
+  hint derived from the tool's own parameters (`offset`/`limit`, `lineRange`/`outline`,
+  `countOnly`, `maxBytes`). The result is never truncated. Before this, 23 recorded
+  results overflowed Claude Code's cap and reached the model as a file offload or nothing.
+- **`tm1_get_cube_rules` has `outline` and `lineRange` modes for large rule files.**
+  `outline: true` returns the section markers (SKIPCHECK, FEEDERS, FEEDSTRINGS, UNDEFVALS,
+  and the first worded line of each comment block) with 1-based line numbers and
+  `lineCount`, capped at 200 entries. `lineRange: [from, to]` returns only those lines,
+  verbatim with no number prefixes, so a slice can be quoted back as a patch `find`. A 130 KB
+  rule file used to overflow the client's result cap.
+- **`tm1_set_cube_rules` takes `edits` (a find/replace patch) or `filePath`** as
+  alternatives to the full `rules` text. Exactly one source is required. Edits apply in
+  order to the current rules. Each `find` must match exactly once, otherwise the call
+  fails with `VALIDATION_ERROR`, the match count and the matching lines, and nothing is
+  written. Line endings are normalized, so an LF slice from `get_cube_rules` matches CRLF
+  stored text. `filePath` reads a host file under `TM1_LOCAL_FILE_ROOT`. `confirm` is still
+  required. This removes the REST fallback that 10–16 KB rule edits needed.
+- **`tm1_delete_elements`**: delete many elements of one hierarchy in one call, through
+  `$batch` where the server has it and per request otherwise. `confirm` is the dimension
+  name. It is not all-or-nothing: the result counts `deleted` and `failed` and lists each
+  failure with its error, and `success` is true only when every element went. It replaces
+  runs of 18–24 single `delete_element` calls.
+
+
+### Changed
+
+- **`hierarchyName` defaults to the dimension name** on the 15 tools that use a hierarchy
+  to locate something: `get_hierarchy`, `get_ancestors`, `get_descendants`, the element and
+  element-attribute tools, and the subset tools. Omitting it was the most common schema
+  error in recorded usage. `create_hierarchy` and `delete_hierarchy` keep it required, since
+  there the hierarchy is the subject and the same-named one can be neither created nor
+  deleted on its own.
+- **`tm1_update_element_attribute_value` takes `value` as a string and an `updates[]`
+  batch.** The value is coerced to the attribute's type on the server: a Numeric attribute
+  takes `"12.5"`, String and Alias attributes take the text. A bare number is still
+  accepted. An unknown attribute or a non-number for a Numeric one fails with
+  `VALIDATION_ERROR` before anything is written. `updates[]` writes many values in one
+  cellset PATCH, instead of one call per value.
+- **A coordinate with the wrong number of elements says which dimension is missing.**
+  `tm1_get_cell_value`, `tm1_write_cells` and `tm1_check_writable_coords` raise
+  `VALIDATION_ERROR` with the cube's dimension order in the hint, the uncovered positions
+  in the message, and a dimension → element pairing in `details`, so a forgotten `Sandboxes`
+  or `Version` shows up at once. `get_cell_value` used to fail here as a "Generic TM1
+  error".
+- Input problems in `tm1_sample_cells`, `tm1_get_cube_stats` and the file upload and delete
+  tools are now `VALIDATION_ERROR`s. They used to be generic errors or ad-hoc `{error}`
+  bodies.
+- `tm1_get_file_content` defaults to `maxBytes` 64 KB (was 256 KB), so the default read
+  fits under the response limit.
+
+### Fixed
+
+- **`tm1_delete_hierarchy` refuses a dimension's default (same-named) hierarchy.** The
+  description always said this could not be done. TM1 11.8 does not refuse it, though: it
+  answers 204 and leaves a dimension listed with no hierarchies at all (verified live).
+  The tool now fails with `VALIDATION_ERROR` and points to `tm1_delete_dimension`.
+- **`tm1_copy_process` onto an existing target fails with `CONFLICT`** instead of a
+  "Generic TM1 error". TM1 already refuses the POST and leaves the target untouched
+  (verified live), so copy never overwrote. It now says so up front.
+
+## [4.0.0] - 2026-08-30
+
+### Breaking
+
+- **`tm1_unload_cube` is v11-only.** v12 answers `tm1.Unload` with "Demand load,
+  loading and unloading of cubes is no longer supported" — the feature is gone with no
+  successor, so the tool is withheld rather than offered and refused. It no longer appears
+  in `tools/list` against v12. *Action:* branch on the server version; on v12 the call
+  never worked.
+- **`tm1_get_audit_log`, `tm1_get_message_log` and `tm1_get_transaction_log` are
+  v11-only.** v12 deprecated the underlying collections in 12.0.0: they answer 200 with
+  nothing and have no successor endpoint. *Action:* as above.
+- **`tm1_execute_chore` reports how the chore ended** instead of always answering
+  `{success: true}` when the HTTP call did not throw. On v12 12.5.0+ it returns
+  `{success, outcome, choreErrorStatus, errorLogFile}`. *Action:* a chore whose step failed
+  now surfaces as a failure; callers that treated every response as success must branch on
+  `outcome`.
+- **`oDBCConnection` removed from the datasource model.** TM1 has no such field — it was
+  always `undefined`. *Action:* none.
+- **`lockType` removed from the thread shape.** No v11 thread ever carried it. *Action:*
+  none.
+
+### Added
+
+- `tm1_get_process_variables` and `tm1_get_process` report `ignoredColumns` — the
+  datasource columns a process ignores. They live only in `VariablesUIData`, which no
+  version declares, so a plain GET never returned them and the tools read the process as if
+  those columns did not exist. Carried through `tm1_copy_process`, both diff tools, and the
+  `.pro` and Git round trips.
+- `tm1_list_dimensions` publishes `lastUpdated` with `includeLastUpdated: true`.
+
+### Fixed
+
+- **`tm1_get_cell_value` no longer reports a non-existent coordinate as an empty cell.**
+  The MDX selects exactly one member, so an empty cell arrives as a cell with a null
+  `Value`; an empty *cellset* means a member did not resolve. v11 refuses such an MDX, but
+  v12 answers 200 with no cells and the service returned `{value: null}` — a typo in an
+  element name read as "this cell is empty". Both versions now raise `NOT_FOUND` naming the
+  cube and coordinate.
+- **`tm1_clear_cube` clears a whole cube on v12 again.** `tm1.Clear` was taken for the v12
+  route; measured against a real cube, neither 11.8 nor 12.5 resolves it and neither
+  declares a clear action in `$metadata`. A full clear now runs `CubeClearData()` through an
+  ephemeral TI on both versions. A partial clear needs `tm1.Clear`, which no reachable
+  server offers, and now fails fast with `UNSUPPORTED_OPERATION` and the bedrock pointer.
+- **`DataSource.usesUnicode` was discarded on the version that supports it.** It was
+  dropped on v11 as "v12-only" and sent on v12 — backwards. TM1 validates datasource
+  properties per *source type*: 11.8 rejects it for ASCII, accepts it for ODBC, returns it
+  from a plain GET and writes it to `.pro` line 559; 12.5 never returns it at all. The gate
+  is now `type === "ODBC"`.
+- **`.pro` round trips no longer lose the ODBC unicode setting.** Line 559 was omitted as
+  carrying "no portable information" while a REST-created process defaults to `559,1`, so
+  export + import silently turned unicode on.
+- **The naming audit's TAB prefilter never matched anything.** The clause carried the
+  literal text `%09`, and its only caller runs the filter through `encodeURIComponent()` —
+  so `%2509` went out and the server searched for three characters no name contains. Every
+  tab-containing element was invisible to `tm1_audit_naming`.
+- **Anonymous sessions no longer break `tm1_list_sessions`.** `GET /Sessions` returns
+  `User: null` for a session with no signed-in user; the response type and the recorded
+  wire contract both admitted only an object.
+- **`errorLogFile` was never filled in** — the execute calls omitted the `$expand`, so the
+  filename was always absent on both versions.
+
+### Changed
+
+- **`tm1_audit_naming` flags TAB in element names on every version, not only v12.** The
+  v12 gate rested on Planning Analytics 3.1 reserving TAB as the name/alias separator, which
+  neither 11.8 nor 12.5 demonstrates: the name round-trips verbatim, no alias appears, and
+  MDX addresses it like any other element. TAB stays a bad character regardless — invisible
+  in UIs, ambiguous against other whitespace, a field separator in TI and CSV round trips.
+  No naming rule differs by version now, so `versionOverride` sets only the reported
+  `appliedMajor`.
+- Two descriptions corrected: `tm1_execute_chore` and `tm1_create_chore` described chore
+  exit codes and `ExecutionMode` in terms that did not match measured behaviour.
+
+### Removed
+
+- `maskSecrets` on `tm1_get_process_datasource`. Its only job was masking, which is now
+  unconditional. Callers still passing it are unaffected — unknown input keys are dropped.
+
+### Internal
+
+No client-visible change: tool metadata now lives in exactly one place per tool
+(`defineTool()`, both metadata maps deleted); each wire shape is defined once and its
+TypeScript type derived; Markdown tables name their fields via `columnsOf()` instead of
+restating them; two spent codemods deleted and `BatchService`'s scope recorded.
+
+## [3.1.0] - 2026-08-18
+
+### Changed
+
+- **`includeDataSourcePassword` is v12-only; on v11 both export tools now refuse it.** The
+  credential the v11 REST API hands out is scoped to one *run* of one server, not to the server.
+  Measured against 11.8.02900.8 across two service restarts: the same cleartext produced three
+  different values, and a value carried across a restart aborts the process at connect time with
+  `Unable to open data source` — on the `.pro` path and the git path alike, with the same file
+  working again once `dataSourcePassword` supplies the password. Nothing fixes that from this side,
+  because the durable form (slot 565 of TM1's own Datadir `.pro`) is never exposed over REST.
+
+  So on v11 the flag could only carry a credential through a window in which `tm1_copy_process`
+  would have worked anyway, and outside that window it failed with no visible sign — the exported
+  file still looks complete. It now refuses and names the two paths that do work: `tm1_copy_process`
+  to clone a process with its password inside one instance, `dataSourcePassword` to deploy anywhere
+  else or later. On v12 the exported value is the plain password, which has no such lifetime, so the
+  flag stays — still opt-in and still requiring a file target, so the credential never enters the
+  response.
+
+- **Corrected what the `.pro` tools claim about passwords.** `tm1_import_pro_file` documented that a
+  password "is never read from the file", which is wrong: slot 565 *is* read from files written by
+  `tm1_export_process_to_pro`, and that is how a password survives an export/import round trip —
+  measured end to end against 11.8, including a negative control (same file with slot 565 removed
+  aborts on connect). What is ignored is slot 565 in TM1's *own* Datadir `.pro` files, which use a
+  different, non-deterministic encoding that cannot be replayed over REST.
+
+  `tm1_export_process_to_pro` now also states that its output is not a Datadir drop-in. TM1 does
+  load such a file at startup and rewrites it in its own dialect, but it decodes slot 565 with its
+  own scheme: an exported password becomes garbage that TM1 then persists, leaving a process that
+  looks configured and fails at runtime.
+
+- **`tm1_write_cells` writes a whole batch in three requests instead of three per cell.** Each cell
+  had its own cellset, PATCH and delete — 120 requests for 40 cells, measured. TM1py (and tm1npm,
+  which ports it) build one cellset over every target coordinate and PATCH the cell array once;
+  verified against 11.8 at **40 cells in 3 requests, 9 ms**, values read back correct.
+
+  Behaviour changes on failure: TM1 refuses a batch containing a non-writable cell **whole**, so
+  nothing in it lands — where the old per-cell loop committed the cells before the offender. The
+  error names only a status code, so the failing batch is then re-walked cell by cell to identify
+  the coordinate and restore the `written`/`failed`/`notAttempted` report. That costs what the old
+  implementation always cost, but only when a write is refused.
+
+- **`tm1_get_hierarchy` reads edge weights from the elements, and filters by type server-side.**
+  Weights came from the hierarchy's entire `Edges` collection — 21.6 MB and 594 ms for a
+  171k-element dimension, in a second round trip. `Element` has an `Edges` navigation carrying its
+  own outgoing edges, so the page that fetches the elements now brings their weights with it: one
+  request, and bounded by the page's fan-out rather than by the dimension.
+
+  `elementType` also stopped being a client-side filter. It pushes down as the ordinal
+  (`Type eq 3`); the name form is accepted by TM1 and matches nothing, silently, which is why it
+  had been left to the client. A consolidated page of a 171k-element dimension went from fetching
+  the whole dimension to **410 KB in one request**.
+
+- **`tm1_audit_naming` checks element names on the server, and now checks all of them.** The audit
+  downloaded every element name of every dimension — 15.2 MB for a single 171k-element dimension,
+  66 MB across a real model — and stopped at `maxElementsPerDim`, beyond which it examined only a
+  prefix. Every element rule is character-based, and TM1 implements the OData functions they need,
+  so the server does the narrowing and returns only candidates: **66 MB → 400 KB** on that model,
+  while the elements examined went from a 100k cap to **1,280,396**, surfacing 64 violations.
+
+  `maxElementsPerDim` now bounds how many offenders are REPORTED, not how many elements are
+  checked, and `scanned.elements` counts what the server examined. The filter is a prefilter only —
+  the same `checkName` still decides on every candidate — and its soundness is asserted live: the
+  suite plants an element whose name contains a reserved character and requires the audit to find
+  it, on v11 and v12.
+
+- **`tm1_audit_complexity` issues one request instead of one per process.** The consistency scan
+  listed every process, then asked each one for its variables — 221 extra round trips on a
+  221-process model, measured. `Variables` is a complex-typed property, so the process list can
+  carry it: `$select=Name,Variables` answers for the whole model at once. 225 requests → 5, and
+  3.4 s → 94 ms on that model. Output is unchanged.
+
+- **`tm1_audit_feeders` takes cube dimensions off the bulk rules request.** The static scan needs
+  each cube's dimension order to score how broadly a feeder is pinned, and asked for it one cube at
+  a time — a GET per rule-bearing cube on top of the bulk rules query. The same request can expand
+  them: `$select=Name,Rules&$expand=Dimensions($select=Name)`. Measured on 11.8 against a 12-cube
+  model, **18 requests → 11**, with the seven per-cube lookups gone and the report identical. The
+  expansion is opt-in, so callers that only read rules text still pay nothing for it. A server that
+  answers without the expansion still falls back to the per-cube lookup, because a missing
+  dimension list would quietly change every ratio the scan computes.
+
+### Added
+
+- **`includeDataSourcePassword` on both export tools carries the ODBC password.** Off by default,
+  and it requires `writeToFile`/`writeToDir`, so the credential goes to a file and never into the
+  response the model sees. `.pro` writes it to slot 565, the Git `.json` keeps the `password` field
+  and reports `credentialsOmitted: false`. Verified against 11.8: export a process, delete it,
+  re-import, and the stored credential is bit-identical (`W0br6scX06nUHxVZQrQC+g==` before and
+  after) — TM1 recognises its own ciphertext and stores it unchanged rather than encrypting it a
+  second time.
+
+  What it is worth depends on the target, and both facts were measured, not assumed. On 11.8 the
+  value is a ciphertext **bound to one server**: the same plain text yields
+  `W0br6scX06nUHxVZQrQC+g==` on one instance and `5QUCtEDCEjECPJ1HIYDlVQ==` on another, so it
+  restores a process on its own instance but is useless for moving one elsewhere — for that, supply
+  the plain password via `dataSourcePassword` on import. On v12 the API returns the password **in
+  plain text**, so an exported file there holds a usable credential; both tools say so in their
+  descriptions. Without the flag nothing changes: the datasource still carries only a `[redacted]`
+  marker, and that marker is now kept out of the file as well.
+
+- **`tm1_import_pro_file` takes a `dataSourcePassword`.** A `.pro` stores the ODBC password only as
+  a server-encrypted blob, so an imported ODBC process arrived with its DSN, user and query but no
+  credential, and there was no way to supply one in the same call — `tm1_import_process_from_git`
+  already had that parameter. Measured on a real model: of 30 ODBC processes, 29 connect through a
+  registered DSN plus credentials and none through a connection string, so the password is the only
+  piece of the connection that a `.pro` cannot carry.
+
+### Fixed
+
+- **`.pro` export and import lost the ODBC query, the datasource name and the subset.** Three line
+  codes were wrong or missing, so `tm1_export_process_to_pro` wrote files without the SQL and
+  `tm1_import_pro_file` silently deployed processes whose datasource had lost its target. The codes
+  were pinned two ways: by scanning 1001 `.pro` files written by TM1 11.8 (30 of them ODBC) and by a
+  write probe — create a process over REST with marker values, then read the file TM1 wrote back.
+
+  - The ODBC query lives in `566,<n>` followed by `n` lines. Every ODBC file carries that header,
+    every non-ODBC file carries `566,0`. It was neither written nor read; the largest query in the
+    scanned corpus is 26 lines.
+  - `586` is `DataSourceNameForServer` and `585` is `DataSourceNameForClient` — the serializer wrote
+    the server name into `585` and the parser read it from there. In files TM1 wrote, `585` is
+    frequently empty, so importing a real `.pro` lost the cube name or file path outright. This hit
+    every datasource type, not just ODBC.
+  - The subset name is `571`; `570` holds view names. The parser read subsets from `570` and
+    therefore never found one.
+
+  Variable byte offsets (`580`/`581`) were not written either, which makes an exported fixed-width
+  process unusable — those offsets *are* the column layout. They now round-trip; TM1 writes zeros
+  for delimited sources and those are dropped again on read.
+
+  Three more mismatches surfaced from write probes over the remaining datasource variants:
+  a fixed-width ASCII source is its own `.pro` type (`562,"POSITIONDELIMITED"`, not a flag on
+  `CHARACTERDELIMITED`) and parsed as *no datasource at all*; view and subset names are written
+  unquoted, so TM1 stores `570,Ansicht, mit "Komma"` verbatim; and `585` stays empty when no client
+  name is set instead of repeating the server name.
+
+  Both directions now use TM1's codes, including the line counts on the code sections (`572,138`),
+  which keeps TI code that looks like a header line inside its section. Files written by earlier
+  versions still parse — `585` and a subset in `570` are accepted as fallbacks. The encrypted
+  password blob (`565`) stays out of the export by design. Verified end to end against 11.8: export
+  a process with a three-line query, delete it, re-import from the `.pro`, and the query, server and
+  client names come back byte-identical; all 1001 corpus files parse without error.
+
+- **`tm1_bulk_upsert_elements` dropped consolidation weights.** The single-element tools were fixed
+  for this in the same release; the bulk path — the one that actually builds hierarchies — was
+  missed, and it is the more consequential of the two. TM1 accepts `Weight` inside the `Components`
+  link payload and ignores it, so every edge landed at 1 no matter what was asked for. Verified by
+  driving the tool against 11.8: a component asked for at `-1` read back as `+1`, and the
+  consolidation then added where it was supposed to subtract — wrong numbers, no error anywhere.
+  Both write paths (`$batch` and the per-request fallback) now PATCH the deviating weights onto the
+  Edge entity once the links exist. Weights of 1 cost nothing, as before. Re-measured after the
+  fix: `Q1 = Jan + Feb − Mar` returns 25 for 10/20/5, where it returned 35 before.
+
+- **A TM1 error body could put a non-string into the error `details` field.** The message was read
+  as `error.message.value ?? error.message ?? raw`, so a body whose `message` was an object without
+  a `value` handed that object to a field typed as a string. Both shapes are now read explicitly
+  and anything else falls back to the raw body. Found by turning on the `no-unsafe-*` lint rules
+  for `src/`, which are now errors: every one of the 25 sites they flagged was unvalidated server
+  data being read as if it had a type.
+
+- **`tm1_set_cube_rules` took a `skipCheck` parameter that did nothing.** It was accepted,
+  defaulted to `true`, forwarded to a service argument that was never read, and echoed back in the
+  success payload — so a caller was told it had switched something on. SKIPCHECK is a line inside
+  the rules text and nothing else; there is no separate switch. The parameter is gone, and the
+  tool description no longer claims the rules text *must* contain SKIPCHECK — it explains what the
+  line does instead. Passing `skipCheck` now has the same effect it always had: none.
+
+- **`tm1_get_cube_stats` fanned out without a limit.** A batch of cube names issued one
+  `}StatsByCube` MDX per cube, all at once, bounded only by how many names the caller sent. It now
+  runs at most ten in flight — the same width `tm1_audit_feeders` uses for the identical call —
+  and `cubeNames` accepts at most 500 entries.
+
+- **`.env.example` advertised a request timeout the code does not use.** It showed
+  `TM1_REQUEST_TIMEOUT=600000` while the built-in default is `30000`, so anyone copying the file
+  as a starting point expected ten minutes and got thirty seconds. It now shows the real default,
+  with a note about which readers justify raising it.
+
+- **`tm1_upsert_process` could create an ODBC data source but not its SQL.** The tool carried its
+  own copy of the data-source schema, and that copy had drifted from the shared one: no `query`,
+  no `oDBCConnection`, no `usesUnicode`. Because the schema is strict, passing `query` was rejected
+  outright — while `tm1_get_process_datasource` read it back happily, and the git round-trip
+  schema had it all along. The tool now uses the shared schema, so what can be read can be written.
+
+- **`tm1_diff_processes` and `tm1_diff_process_with_file` ignored the ODBC query.** Two processes
+  differing only in their SQL were reported identical. Both now compare `query` and
+  `oDBCConnection`; `password` stays out of the comparison, since both sides read back redacted
+  and could only produce noise.
+
+- **Consolidation weights were silently dropped on write.** `tm1_create_element`,
+  `tm1_update_element` and `tm1_move_element` sent `Weight` inside the `Components` link payload.
+  TM1 accepts that body and ignores the field: the edge is created with weight 1 whatever was
+  asked for. Verified live — a consolidation created with weight -1 read back as 1 from the Edges
+  collection itself, so nothing downstream could have recovered the intent.
+
+  A dropped -1 is not cosmetic: it is the weight that nets costs against revenue, and turning it
+  into +1 inverts the consolidation. The weight lives on the Edge entity and is now PATCHed there
+  once the link exists — only for weights that differ from the default, so an all-1 consolidation
+  costs no extra request.
+
+- **`format: "markdown"` now reaches clients that read `structuredContent`.**
+  The rendered table went out in `content[0].text` while `structuredContent` carried the JSON
+  payload. Claude Code discards `content` whenever `structuredContent` is present, so the table
+  never arrived and the caller got the JSON it had asked not to get — a silent no-op across all
+  34 tools that take `format`.
+
+  Markdown responses now send the table both ways: as the text block (for clients like Kiro) and
+  as `structuredContent: { markdown }`. The JSON payload is omitted in that mode.
+
+  This widens the published `outputSchema` of those 34 tools — top-level fields become optional,
+  plus an optional `markdown` — because the MCP SDK cannot express "either shape" (a `z.union`
+  outputSchema makes it publish no schema at all). Responses are still validated strictly: the
+  server selects the matching strict shape per response. Net effect on `tools/list` is 1.3 KB
+  smaller, since the dropped `required` arrays outweigh the added property.
+
+  New gate `npm run lint:markdown-schema` fails the build when a tool accepts `format` without a
+  schema that can carry the table.
+
+## [3.0.1] - 2026-08-10
+
+### Fixed
+
+- **`TM1_RESPONSE_MODE` defaults back to `legacy` — results ship `content[0].text` again.**
+  The 3.0.0 default dropped the text block, which blanks every tool call on clients that read
+  `content[]` and ignore `structuredContent` (Kiro's IDE; verified live). No handshake field
+  identifies them, so the default has to be the shape all clients can read.
+
+  Its 52% saving was measured on the wire, not in context: Claude Code discards `content` whenever
+  `structuredContent` is present, so both-ways costs one copy. Real only for clients that serialize
+  the whole `CallToolResult` into the prompt — `TM1_RESPONSE_MODE=structured` still serves those,
+  and is no longer deprecated.
+
+## [3.0.0] - 2026-08-09
+
+### Security
+
+- **Credential masking moved onto the error path.** pino's key-based `redact` masks a field _named_
+  `password`, never a credential inside a message string — which is exactly what TM1 returns on an
+  ODBC failure (`login failed for PWD=hunter2`). `classifyHttpError` now sanitizes the server's
+  text where it enters the error model, covering both the log and the client exit.
+
+- **ODBC masking is grammar-aware.** The old `[^;]+` value pattern stopped at the first inner `;`,
+  masking `{abc` and leaving `def};` behind — a partial leak that _looked_ masked. Brace-quoted
+  values are now matched whole.
+
+- **`maskSecrets: false` requires operator consent.** The parameter let the **model** switch off a
+  security control. It is now ignored unless `TM1_ALLOW_UNMASKED_SECRETS=true`; the default masks
+  anyway rather than failing. Affects all eleven tools exposing it.
+
+- **Confirmation guards extended beyond deletes** to `tm1_execute_process`, `tm1_execute_chore`,
+  `tm1_write_cells`, `tm1_set_cube_rules` and `tm1_upload_file` — irreversible writes and TI
+  side-effects previously sat outside a guard that only covered object destruction. **Breaking:**
+  these five now require `confirm`. Misuse protection, not access control.
+
+- **Positioning documented (README).** One TM1 identity per process; the HTTP transport is
+  single-tenant and its bearer token authenticates the endpoint, not a caller; `readwrite` with an
+  admin account is a developer configuration. Stated so nobody infers an isolation boundary that
+  does not exist.
+
+- **`fast-uri` override raised to `^3.1.5`, `ip-address` pinned to `^10.4.0`.** Both ship to
+  consumers as runtime dependencies via `@modelcontextprotocol/sdk`. GHSA-7p8r-x3mc-p8w7 grew past
+  the `^3.1.4` override shipped in 2.1.0, which silently stopped being sufficient; `ip-address`
+  `<=10.3.0` carries GHSA-4xrf-jv44-h6hh and GHSA-22jq-vg5j-6vgg (misclassification that can
+  bypass SSRF checks). Neither override is a semver escape. The CI gate
+  `npm audit --omit=dev --audit-level=high` went from exit 1 to exit 0.
+
+### Changed — BREAKING
+
+- **Successful tool results no longer ship their payload twice; `structured` is the new default.**
+  Every tool declares an `outputSchema`, so the payload was parsed into `structuredContent` _and_
+  left in `content[0].text`. Measured: **13898 B → 6612 B, a 52% cut.** Spec-legal, since
+  `CallToolResult.content` may be empty when an `outputSchema` is declared.
+
+  **Breaking for clients that read `content[0].text` and ignore `structuredContent`** — set
+  `TM1_RESPONSE_MODE=legacy` to restore the old wire format. Verified against Claude Code.
+  `legacy` is **deprecated** and will be removed in a future major; it exists only as a
+  transitional escape hatch.
+  Unaffected: `format: "markdown"` and error results.
+
+- **A TI result now says whether the run committed.** `ExecuteWithReturn` answers HTTP 200 whatever
+  happened, so the outcome lives entirely in `ProcessExecuteStatusCode` — and a missing field
+  defaulted to success. Results now carry an `outcome` over all six codes, grouped by commit
+  semantics measured live on v11 11.8 and v12 12.5.9:
+
+  - `succeeded` — `CompletedSuccessfully`
+  - `completed_with_errors` — `CompletedWithMessages`, `QuitCalled`, `HasMinorErrors`. **Changes
+    WERE committed; a blind retry can double-post them.**
+  - `rolled_back` — `Aborted`, `RollbackCalled`. Nothing committed.
+  - `indeterminate` — no status code, an unknown code, or a call that errored mid-run.
+
+  `ProcessResult` is a discriminated union, so `{success: true, processErrorStatus: "Aborted"}` no
+  longer typechecks. Note that `succeeded` is not proof the process reached its intended end —
+  `ProcessBreak` also reports `CompletedSuccessfully` (verified live).
+
+  **Breaking** for `tm1_execute_process` and `tm1_save_data`: new required `outcome` field, and only
+  `succeeded` keeps `success: true`, so a status-less response now yields `success: false` with
+  `isError`. Real servers always send the field, so that is the defensive branch.
+  `tm1_clear_cube` shares the classifier: a rolled-back or unconfirmed clear raises, a
+  committed-with-messages clear stands.
+
+### Changed
+
+- **The unbounded escape hatches are now bounded.** `fetchAll` and `limit=0` opt out of the page
+  _size_, not of every limit — a 200k-element dimension serialized 200k rows into one response.
+  `paginate()` caps them at 5000 and reports the rest via `has_more`/`next_offset`, so a capped
+  call is just a first page. Also: `tm1_get_hierarchy.topN` ceiling 10000,
+  `tm1_analyze_object_usage` without `limit` is bounded bulk, and `tm1_trace_data_flow` — which had
+  no limit at all — gains 500 per direction with `counts` left unclipped.
+
+- **`tm1_audit_complexity` fans out its per-process reads.** The `consistency` scope is in the
+  default scope set and walked one `getVariables` round-trip per process serially — 276ms
+  estimated vs 84ms measured on a 92-process model. Now 8 in flight. Order and fail-fast
+  behaviour unchanged.
+
+- **Annotations: irreversible overwrites now declare `destructiveHint: true`.** The taxonomy meant
+  "deletes an object", so full-replacement writes advertised `false` and a client's
+  confirm-before-destructive prompt never fired. `tm1_write_cells` is now `DESTRUCTIVE`;
+  `tm1_set_cube_rules` and `tm1_bulk_upsert_elements` use a new `IDEMPOTENT_DESTRUCTIVE` class —
+  the two properties are orthogonal. No `readOnlyHint` changed, so `TM1_MODE=readonly` exposes the
+  same tools as before.
+
+- **`tm1_bulk_upsert_elements` folds its element writes into OData `$batch`.** N elements now cost
+  four batched passes (create, type-probe, type-patch, components) instead of N round-trips.
+  Servers without a usable `$batch` fall back transparently; inputs, outputs and error behaviour
+  are unchanged. Live-validated against v11 11.8 and v12 / Planning Analytics Engine 12.5.9.
+
+- **`ViewService.list()` queries the public and private scopes in parallel.** Result order and
+  error handling unchanged. MDX stays in the `$select` — `tm1_list_views` advertises it, so
+  dropping it would be a breaking output change, not an optimisation.
+
+- **CI now runs `npm run lint:format`.** `verify` already ran `prettier --check`, so the local gate
+  was stricter than the one guarding main while the README claimed they matched.
+
+- **`docs/ARCHITECTURE.md` service-conventions table corrected.** The version-branch idiom is
+  `this.http.version === 11`, not the pre-v12 `tm1Version.startsWith("11")`, and the "services hold
+  no state" row now names `BatchService` as the deliberate exception.
+
+### Fixed
+
+- **"This server keeps no statistics" no longer reads as "your model is broken".** TM1 v12 ships no
+  `}Stats*` control cubes (measured on 12.5.9: only security and element-attribute ones), so the
+  shared `}StatsByCube` fetcher handed the model a raw OData error and the user read it as a broken
+  model. The failure is now classified once, for both callers, keeping two cases apart: `absent`
+  (no statistics cubes here) versus `denied` (they exist, this account may not read them — TM1
+  answers that with HTTP 400 `ObjectSecurityNoReadRights`, not 403).
+
+  The classification is **structural, and reads no error text**. The same condition is worded three
+  ways across this project's own servers — `'}StatsByCube' can not be found in collection of type
+  'Cube'` (v11 en), `There is no cube named "}StatsByCube".` (v12), and
+  `Syntaxfehler bei oder in der Nähe von: …` (v11 on a German locale) — so a matcher over prose is
+  correct only on the machine it was written against and fails silently everywhere else. Instead
+  the denial is recognised by its untranslated identifier, and absence is answered by asking the
+  server: new `CubeService.exists()` (`GET Cubes('}StatsByCube')?$select=Name`, 404 → false), run
+  once per connection and only on the failure path. A 200 means the statistics cube is fine and
+  this one query was not, so the original error propagates untouched — a missing *user* cube stays
+  a per-cube error.
+
+  `tm1_get_cube_stats` returns `statsUnavailable {reason, message}` alongside its items;
+  `tm1_audit_feeders` returns `runtimeUnavailable` and still delivers the static findings in
+  `mode: "both"`. `mode: "static"` never touched the cube and is unchanged.
+
+- **The callgraph's four-variant OData fallback no longer swallows the real error.**
+  `fetchForCallgraph()` caught _everything_, so an expired session, a timeout or a denial each
+  bought three more full `/Processes` scans — about `4 × 30 s` — and a later shape that answered
+  masked the first failure. Systemic failures and denials now surface immediately; only TM1
+  refusing the query _shape_ (400/501) advances, and the working shape is cached per connection.
+
+- **A permission denial no longer reads as "this cube has no views".** `ViewService.list()` caught
+  every per-scope error and returned an empty list, making "you may not see them" indistinguishable
+  from "there are none". Denials propagate; a genuinely absent scope (404 on `/PrivateViews`) is
+  still skipped.
+
+- **`$batch` chunks are bounded by payload size, not just request count.** 200 sub-requests with
+  long element names run to megabytes while the counter is still under its cap, and a body past a
+  proxy's limit (nginx defaults to 1 MiB) returns 400/413 — which the service read as "no `$batch`
+  here". A chunk now closes at whichever bound comes first, measured in UTF-8 bytes. An
+  over-budget single request is sent alone rather than dropped. Chunks stay serial.
+
+- **An ambiguous first `$batch` 400 is settled by a counter-probe.** A gateway that does not route
+  the endpoint and a payload TM1 refuses both answer 400; reading the second as the first pinned
+  the connection to "no `$batch`" for the whole session. On a 400, while no batch has yet
+  succeeded and at most once per connection, one minimal envelope is sent: readable means `$batch`
+  works, so the connection is marked supported and the original error propagates unretried.
+  Verified live — v12 rejects duplicate sub-request ids with exactly this 400. Only 400 is probed;
+  404/405/501 concern a constant URL and method, 403 an identity the probe shares, and a 500 can
+  follow a partial commit where the replay-safe fallback is correct.
+
+- **A failed element-type lookup is no longer cached forever.** The feeder audit's type cache
+  stored `null` on any error with no TTL, so one transient timeout marked a whole dimension "type
+  unknown" for the rest of the run. Failures now retry, bounded at three consecutive ones per
+  dimension — unbounded retry would be worse, since a security denial (HTTP 400
+  `ObjectSecurityNoReadRights`) is deterministic and the lookup runs once per feeder entry. The
+  read also moved to `$select=Name,Type`, dropping an `$expand=Parents` and Edges scan.
+
+- **HTTP transport no longer leaks a listener per request.** Each request builds a fresh
+  `McpServer` that attaches a `SubscriptionRegistry` listener to the process-global `tm1Events`
+  emitter, and `server.close()` cannot detach it — so every TM1 mutation fanned out across all
+  historical registries. `buildMcpServer` now returns `{server, dispose}` and every teardown path
+  calls it.
+
+- **The callgraph cache can no longer publish a pre-mutation index.**
+  `invalidateCallgraphCache()` could not reach a build already in flight, which then wrote its
+  stale snapshot back with a fresh timestamp and served it for a full 60s TTL. Builds now capture
+  a generation counter and refuse to publish if an invalidation happened while they ran.
+
+- **`tm1_sample_cells` no longer reports `truncated: true` for an exact-size result.** It asks for
+  one cell more than requested and decides from that sentinel instead of inferring from a full
+  page; the extra row is dropped, so the response contract is unchanged.
+
+- **Timestamp inputs are validated instead of decorated.** `since`/`until` got a bare `"Z"`
+  appended to whatever arrived, so `"yesterday"` became `"yesterdayZ"` in an OData `$filter` and
+  TM1 answered with a parse error naming neither parameter nor value. Now checked against ISO-8601;
+  ambiguous locale formats like `08/06/2026` are rejected rather than silently read as 6 August.
+
+
+## [2.1.0] - 2026-07-26
+
+### Security
+
+- **`fast-uri` pinned to `^3.1.4` via `overrides`.** GHSA-v2hh-gcrm-f6hx and GHSA-4c8g-83qw-93j6
+  (host confusion via a literal backslash authority delimiter, and via failed IDN canonicalization)
+  affect `fast-uri` 3.0.0–3.1.3. It reaches us as a *runtime* dependency through
+  `@modelcontextprotocol/sdk` → `ajv`, so it ships to consumers rather than being a dev-only
+  advisory. The patched 3.1.4 sits inside `ajv`'s own `^3.0.1` range, so the override is not a
+  semver escape. No SDK release carries the fix yet — 1.29.0 is current.
+
+### Added
+
+- **Coverage ratchet gate** (`npm run coverage:check`, wired into `npm run verify` and CI).
+  Coverage floors moved out of `vitest.config.ts` into `coverage-thresholds.json` — one source
+  of truth read by both `vitest` (hard thresholds) and the new
+  `scripts/check-coverage-ratchet.mjs`. The gate fails in **both** directions: below the floor,
+  and more than `slack` (5) points above it, printing the exact JSON to raise the floor with.
+  This closes a 40-point blind spot — the floors said 22% while real coverage had already grown
+  past 65%, so a large regression could have landed green. Floors baselined at the measured
+  level minus 2 points (lines 63 / statements 62 / functions 55 / branches 52); informational
+  targets 75/75/70/62. Coverage reporters switched to `text-summary` + `json-summary` + `html`,
+  and `**/*.d.ts` is excluded from the measured set. See "Coverage Policy" in the README.
+
+- **`tm1_get_hierarchy` is now pageable — `offset`, plus `total`/`has_more` in the response.**
+  Large dimensions were unreachable past `topN`: the tool capped at 1000 elements with no way to
+  ask for the next 1000, so the only route to element 1001 was raising `topN` and pulling the
+  whole set into the context window. `offset` walks the dimension in pages of any size, and
+  `total` reports the filtered element count so a client knows when to stop. Measured on a live
+  211,852-element dimension: 46.7KB per 50-element page against 915.9KB for the old `topN=1000`
+  default and 67MB for the uncapped fetch. `truncated` keeps its meaning but is now exact — it
+  was derived from `elements.length === topN`, which cried truncation whenever the last page
+  happened to be exactly `topN` long.
+
+### Changed
+
+- **`list_*` tools push `$top`/`$skip` down to TM1 instead of fetching the whole collection and
+  slicing it in-process.** This does not change what an agent sees — the `Page<T>` envelope, the
+  `limit=50` default and every field are identical — it changes what crosses the TM1→MCP hop.
+  Measured live at `limit=50`: `tm1_list_dimensions` with `includeElementStats` 213MB → 98MB
+  (340-dimension model; the pathological single JSON string that response used to be is the point
+  of the change, not the milliseconds), `tm1_list_processes` 180.6KB → 15.4KB, `tm1_list_cubes`
+  49.3KB → 13.5KB.
+  - Push-down happens automatically, but only where it is *correct*: `@odata.count` counts rows
+    after `$filter`, so a filter that cannot be expressed in OData (`nameRegex`, `excludePattern`,
+    `changedSince`) would make `total` count rows the caller can never reach and `has_more`
+    promise pages that come back empty. Those requests — plus `fetchAll` and `limit=0` — fall back
+    to the previous full-scan behaviour. Server-expressible filters (`includeControl`, `nameExact`,
+    `nameContains`, `nameNotContains`) move into `$filter`.
+  - Every pushed-down request carries `$orderby=Name`. `$skip` without a sort is undefined in
+    OData and TM1 answers in internal index order, which shifts whenever an object is created or
+    deleted — a page walk would silently duplicate or drop rows.
+  - **Ordering change:** `tm1_list_cubes`, `tm1_list_dimensions` and `tm1_list_processes` now
+    return rows sorted by name on *both* paths (the fallback sorts client-side to match TM1's
+    collation). They previously echoed TM1's internal index order, so a given `offset` can land
+    on a different row than before.
+  - Not included: `tm1_list_views`, `tm1_list_subsets`, `tm1_list_clients`, `tm1_list_error_logs`.
+    Live probing confirmed `$top`/`$skip`/`$orderby`/`$count=true` all work on their endpoints
+    (`/Cubes('c')/Views`, `/PrivateViews`, `.../Subsets`, `/PrivateSubsets`, `/Users`,
+    `/ErrorLogFiles`), so they stay viable follow-ups; views and subsets additionally need a
+    two-scope (public + private) merge, which is why they were not bundled here.
+
+- **Smaller `tools/list` payload — ~28.6KB (12%) off every session's context budget**, with no change to
+  input validation, output validation, or any tool's behaviour:
+  - Advertised JSON Schemas are slimmed on the way out: the `z.number().int()` safe-integer sentinels
+    (`minimum: -9007199254740991` / `maximum: 9007199254740991`) and the redundant `$schema` header are
+    stripped for both input and output schemas (~25.5KB). Real bounds (`limit` max 500, `offset` min 0)
+    are preserved; Zod still validates exactly as before.
+  - Shared pagination/format parameter descriptions no longer restate what the schema already emits as
+    `default` / `minimum` / `maximum` / `enum` — paid back across 33 tools (~2.8KB).
+  - `tm1_analyze_callgraph`'s output schema factors its repeated `EffectiveValue` sub-schema into
+    `definitions` + `$ref` (6.3KB → 4.8KB), keeping the typed drift guard intact.
+
+### Fixed
+
+- `tm1_analyze_callgraph`'s output drift guard now actually bites on the node tree. `tree` is a union
+  of the full and compact node shapes, and a non-strict Zod object strips unknown keys instead of
+  rejecting them — so a full-mode node with a corrupt `incomingEdge` or `env` quietly matched the
+  compact variant with the corrupt keys thrown away. Both variants are strict now, which aligns the
+  runtime check with the `additionalProperties: false` the published schema already advertised. No
+  response data was ever lost by this (the validator's parsed output is discarded; the original
+  payload is what ships).
+
+## [2.0.0] - 2026-07-19
+
+### Added
+
+- **TM1 v12 (Planning Analytics Engine) support** — rerooted REST + `/{instance}/auth/v1/session` login (`s2s` live-validated; `basic`/`access_token`/`oidc`/`iam` unit-validated).
+- **v12 Jobs/Activity monitoring** — `tm1_list_jobs`, `tm1_cancel_job`; monitoring tools version-gated (v11 → thread tools, v12 → job tools).
+- **Element-level data flow** — `tm1_trace_data_flow` gains `element`+`dimension` inputs answering "which processes touch element X of dimension D". Each process is classified `access = source | write | zero-out | indeterminate`, resolved from in-code subset builds, stored view/subset datasources (native-title/static exact, MDX by literal member), and — opt-in `resolveComputed` — live-evaluated computed axis selectors. Unresolved/computed cases are flagged, never silently dropped.
+- `tm1_analyze_callgraph` surfaces dynamic/parameter `ExecuteProcess` targets as `unresolvedCalls`, and folds constant string-concat targets (`'zA'|'zB'` → `zAzB`) into real edges.
+- `tm1_get_message_log` accepts `level` / `since` / `until` inputs and pushes the text/level/time filter server-side, so a match older than the fetched window is still found (was a silent "no error found").
+- `tm1_get_transaction_log` reports `coverage` (`complete` / `partial`) and `scannedFrom` — a capped adaptive backfill is no longer mistaken for a full scan.
+- `tm1_execute_mdx` / `tm1_get_view` set `axes_clipped` when a paginated read clips axis tuples to the returned cell window.
+
+### Changed
+
+- **Breaking:** 14 tools that took a bare top-level `name` input now require an entity-qualified key (`cubeName`, `dimensionName`, `clientName`, `processName`, `objectName`): `tm1_create_cube`/`tm1_delete_cube`, `tm1_create_dimension`/`tm1_delete_dimension`, `tm1_create_client`/`tm1_delete_client`/`tm1_get_client`/`tm1_update_client`, `tm1_analyze_object_usage`, `tm1_upsert_process`/`tm1_compile_process`/`tm1_check_process_code`, `tm1_import_process_from_git`, `tm1_import_pro_file`. Response fields are unchanged.
+- `tm1_execute_mdx` / `tm1_get_view` no longer return the full axis tuple list when the cell count is capped — axes are clipped to the returned window, so a `limit` read of a large view stays small (cell↔tuple mapping preserved).
+- `tm1_list_cubes` no longer pulls full cube `Rules` text on the default list path (`$select=Name`).
+- `tm1_save_data` is hidden on TM1 v12 — Planning Analytics Engine removed `SaveDataAll`/`CubeSaveData`; the cloud engine persists automatically.
+- `tm1_resolve_default_members` reports `confidence: "medium"` for a server-derived (single-root) default; `"high"` is reserved for an explicitly maintained default member.
+- `tm1_bulk_upsert_elements` runs element writes concurrently, and its consolidation `components` list is documented as a full replace of the child set (omit it to leave existing children unchanged).
+
+- **Breaking:** git tools use TM1's native `#region <Tab>` / `#endregion` code format (byte-identical to the server `Code` blob; nested user folds preserved). `.ti` files from earlier versions are no longer importable — re-export.
+- `tm1_analyze_callgraph` output is now a typed, recursive schema.
+- `tm1_get_all_processes_code` / `tm1_get_all_cube_rules` default-cap full-code responses at 50 objects, pushed server-side (`$top`) — the default call no longer dumps the whole model. `limit=0` restores uncapped; summary mode still surveys everything. New `countIsExact` output flag marks `count` as a lower bound when the server omits a total.
+
+### Fixed
+
+- `tm1_execute_process` reports the real TI outcome (via `tm1.ExecuteWithReturn`): runs finishing `CompletedWithMinorErrors` or aborted no longer read as clean success; the error log file is surfaced.
+- `tm1_get_hierarchy` returns real consolidation edge weights from the Edges collection — previously every child weight was reported as `1` (wrong for e.g. P&L dims consolidating costs with `-1`).
+- All user-facing lint/parser/v12-deprecation messages are now English (were German).
+- README documents the actual `.env` resolution order (shell/MCP env > `DOTENV_CONFIG_PATH` > cwd > package root) — the old instructions could not work under `npx`.
+- git import rejects malformed/unbalanced `#region` blobs instead of silently deploying partial code.
+- v12: correct product version (`ProductVersion` scalar fallback); version coerced to 12 when instance-configured; rerooting hardened (instance URL-encode, `$`-injection guard, bounded IAM token exchange); `tm1_list_jobs` null-safe.
+- MDX cell reads/writes escape `]` in cube/dimension/element names, so an element like `Q4]Adj` is addressed correctly instead of breaking or mis-targeting the cell.
+- `tm1_write_cells` honors an explicit alternate hierarchy in a coordinate instead of always addressing the default hierarchy — previously a silent write to a same-named default-hierarchy member.
+
+### Security
+
+- MCP **resources** now mask secrets like the tool surface: `tm1://process/{name}/code` masks credential literals unconditionally; `tm1://server/info` no longer exposes the raw server configuration dump.
+- `tm1_get_server_info` masks credentials in its `_raw` configuration dump.
+- The HTTP transport matches the `/mcp` route exactly — a path like `/mcpFoo` no longer routes as MCP.
+- v12 credentials (`clientSecret`/`accessToken`/`apiKey`/`camPassport`) redacted in logs.
+
+## [1.0.4] - 2026-07-12
+
+### Security
+
+- `tm1_get_all_processes_code` masks credential literals by default (new
+  `maskSecrets` flag) — it was the only code-returning tool without masking.
+- ODBC connection strings (`oDBCConnection`, `PWD=`/`UID=` pairs) are masked
+  by default in `tm1_get_process`, `tm1_get_process_datasource` (new
+  `maskSecrets` flag) and the git-export `.json`; previously only the
+  `password` field was stripped.
+- Local-file confinement (`TM1_LOCAL_FILE_ROOT`) is symlink-aware: targets are
+  `realpath`-checked against the resolved root.
+- HTTP transport refuses a non-loopback bind (`TM1_MCP_HTTP_HOST`) without
+  `TM1_MCP_HTTP_TOKEN`; loopback stays warn-only.
+
+### Added
+
+- `tm1_get_all_processes_code` `summary` mode: per-process line metrics
+  instead of code bodies.
+- Every tool carries an auto-derived human-readable `title`
+  (`tm1_get_process_code` → "Get Process Code").
+
+### Fixed
+
+- Output-schema drift returns an `isError` tool result instead of a raw
+  JSON-RPC protocol error.
+- `tm1_analyze_chore_graph` not-found warning conforms to the output schema
+  again (was rejected by strict validation, so it never reached the client).
+- Git/pro export create missing target directories instead of raw `ENOENT`.
+
+### Changed
+
+- **Breaking:** input params renamed for cross-tool consistency —
+  `tm1_bulk_upsert_elements` `hierarchy` → `hierarchyName`; the chore family
+  (`create/delete/execute/toggle/update_chore`, `analyze_chore_graph`) now
+  uniformly takes `choreName` (was `name`; analyze was `chore`). MCP clients
+  re-read schemas per session and pick the new names up automatically.
+- `tm1_get_process` declares a strict `outputSchema` like its siblings.
+- `tm1_get_descendants`: `topN` cap (default 1000) + `truncated` flag —
+  no more full-dimension dumps from a root consolidation.
+- `tm1_get_process` fetches its enabled sections in parallel (was up to 5
+  sequential REST calls).
+- Publishing runs a clean `prepack` (`rm -rf dist && npm run build`); release
+  flow documented in `RELEASING.md`.
+- `tm1_export_process_to_git` with `writeToDir` returns metadata only (no
+  inline `json`/`ti` echo); inline export unchanged. Mirrors
+  `tm1_import_process_from_git`.
+
+## [1.0.3] - 2026-07-05
+
+Audit + live-sweep release, plus the process `HasSecurityAccess` read-side and
+a git-export format alignment. Bundles the 2026-07-03 "beyond the basics" audit
+fixes (transport lifecycle, cellset leak, error honesty, confirm-guard
+coverage) and tool gaps found while sweeping ~35 tools against a production
+TM1 11.8 server; the read-side of `HasSecurityAccess` (the write path landed in
+the same release); and the git-export `.json` moved to TM1's native OData
+shape. Behavior changes are called out below.
+
+### ⚠️ Behavior change
+
+- `tm1_export_process_to_git` now emits the `.json` in TM1's OData-native
+  shape: top-level order `name, hasSecurityAccess, dataSource, parameters,
+  variables`, and parameter objects as `name, prompt, value, type`. The
+  parameter default uses the OData-native key **`value`** (previously the
+  internal name `defaultValue`). `tm1_import_process_from_git` reads `value`
+  and still accepts legacy `defaultValue` files for back-compat. The change is
+  confined to the git file format; the internal contract and
+  `tm1_upsert_process` input remain `defaultValue`. JSON key order is cosmetic
+  — import parses by key, so the round-trip is unaffected.
+
+- The `confirm: true` guard now covers the **entire** object-destruction
+  surface: `tm1_delete_element`, `tm1_delete_hierarchy`, `tm1_delete_subset`,
+  `tm1_delete_view`, `tm1_delete_chore`, `tm1_delete_client`,
+  `tm1_delete_file`, and `tm1_remove_client_group` join the previously guarded
+  deletes. Calls without `confirm: true` are rejected with a hint (a unit test
+  gates the tool set so new destructive tools cannot ship unguarded).
+- `tm1_write_cells` reports partial failures honestly: `allSettled` semantics
+  with `{ written, failed, notAttempted }` instead of failing the whole batch
+  on the first bad cell.
+
+### Added
+
+- Git-process roundtrip carries `HasSecurityAccess`: `tm1_export_process_to_git`
+  reads and emits it, `tm1_import_process_from_git` applies it (PATCH, only
+  when declared in the file — existing server values are preserved otherwise),
+  and `tm1_upsert_process` accepts it as an input field. `Caption` was
+  evaluated and deliberately left out: TM1 offers no reliable write path
+  (`}ElementAttributes_}Processes` is absent on attribute-less dimensions), so
+  a lossy field is not pretended to be lossless.
+- `tm1_get_process` — a native full read of a TI process, the read-twin of
+  `tm1_upsert_process`. One call returns the four code tabs, parameters,
+  variables, datasource, and the `HasSecurityAccess` flag using the same field
+  names as `upsert_process`. Every part sits behind an include-flag (all
+  default `true`) that gates its REST call, so a caller can skip parts it does
+  not need; `maskSecrets` and `stripComments` mirror `tm1_get_process_code`.
+  For git persistence use `tm1_export_process_to_git` instead — this tool is
+  for reading/understanding a process, not serialization.
+- `tm1_get_all_processes_code` now carries each process's `hasSecurityAccess`
+  flag per row, so the audit bulk-load can answer which processes run elevated
+  (previously the flag was readable only through the git export).
+- `tm1_get_process_code` gains an opt-in `includeSecurityAccess` flag (default
+  `false`, so pure code reads stay a single request); when `true` it adds the
+  `hasSecurityAccess` field via a dedicated metadata GET.
+- `tm1_validate_process_refs` now resolves much more of the real-world TI
+  surface: `DIMIX`, `CellIncrementN`, `CellPutProportionalSpread`,
+  `ViewZeroOut`, `CubeClearData`; cube/dimension args in position 2
+  (`CellPutN/S`, `AttrPutN/S`, `ElementSecurityPut`) are extracted with a
+  paren/quote walker that handles nested function calls, multi-line calls, and
+  TI `''` escapes; and variable object names bound to a single literal
+  (`sCube = 'Sales'; CellGetN(sCube, ...)`) resolve through the per-process
+  variable environment. Params, datasource variables, and reassigned
+  variables stay conservatively unresolved — no false positives.
+- HTTP transport (Streamable) builds an isolated server+transport pair per
+  request instead of sharing one across sessions.
+
+### Fixed
+
+- Read-path cellsets (`tm1_get_view`, `tm1_execute_mdx`, sampling) are freed
+  on the server after use — long-lived sessions no longer leak TM1 memory.
+- Service layer propagates systemic transport errors (auth loss, outages)
+  instead of degrading them to empty results (`exists()` probes pinned to
+  404-only, callgraph/audit tools fail loud on outage).
+- `tm1_execute_process`: client-side aborts are reported as *unconfirmed*
+  (with a list/cancel-thread hint) instead of pretending the process failed;
+  TI failure status keeps the `isError` flag.
+- Session manager: stale-cookie re-auth short-circuits the 401 storm when
+  many parallel requests race; keep-alive no longer clears a fresh cookie.
+- `tm1_check_process_code`: syntax errors return a self-describing
+  `VALIDATION_ERROR` payload (short message + actionable hint) instead of a
+  generic `TM1_ERROR` envelope with the whole payload duplicated into
+  `message`; the isError normalizer no longer falls back to raw-JSON
+  duplication for any tool.
+- OData key segments with embedded quotes are escaped in the rules linter;
+  `]` is escaped in attribute-value MDX.
+- `TM1_MODE` parsing is case-insensitive and fails fast on unknown values
+  (a typo no longer silently granted read-write).
+- Crash exit: `uncaughtException` terminates with exit code 1 (was 0), so
+  supervisors detect the failure.
+- Element "already exists" detection pinned cross-version (v11 HTTP 400 vs
+  409) with a unit test, keeping `tm1_bulk_upsert_elements` idempotent.
+- Masking property tests exercise the real logger construction path (a fake
+  copy had let redaction regressions slip); `Cookie` headers joined the
+  redaction list.
+
+## [1.0.2] - 2026-07-02
+
+Hardening release: security, bounded outputs, robustness, and internal
+layering. Two output-shape changes are noted below — they affect how a client
+reads results, though in practice an MCP agent reads the envelope dynamically.
+
+### ⚠️ Output-shape changes
+
+- `tm1_get_view` now returns a paginated envelope
+  (`{ items, total, count, offset, has_more, next_offset, axes }`) instead of a
+  raw cellset, and paginates by default. Pass `fetchAll: true` (or `limit: 0`)
+  for the full cellset. The cell array moved from `cells` to `items`.
+- `tm1_resolve_default_member` was removed; use `tm1_resolve_default_members`
+  with a single-item array (`items: [{ dimensionName }]`). The resolved member
+  is `results[0].resolved.name` (content is identical to the old tool).
+
+### Added
+
+- `tm1_get_view`: `format='markdown'` pivot-grid/flat-table rendering plus
+  `limit`/`offset`/`fetchAll` pagination (`$top`/`$skip` pushed server-side),
+  reusing the `tm1_execute_mdx` envelope.
+- `tm1_get_hierarchy`: default element cap with a `truncated` flag on cut output.
+- Code-reading TI tools (`tm1_get_process_code`, `tm1_export_process_to_pro`,
+  `tm1_export_process_to_git`, `tm1_diff_processes`, `tm1_diff_process_with_file`)
+  gain a `maskSecrets` flag (default `true`) that masks inline ODBC/connection
+  credentials before returning or writing code.
+- outputSchema byte-budget CI gate (`lint:output-schema-budget`) guarding the
+  tools/list payload against schema bloat; wired into `npm run verify` and CI.
+
+### Changed
+
+- Tool responses now emit compact JSON (disk artifacts stay pretty-printed),
+  cutting every large response body.
+- Trimmed verbose top-level tool descriptions that restated per-field docs.
+- `TM1Client` uses composition over inheritance so the raw transport surface is
+  no longer reachable from the tools layer (compiler-enforced, not just lint).
+
+### Removed
+
+- `tm1_resolve_default_member` (merged into `tm1_resolve_default_members`);
+  tool count 112 → 111.
+
+### Fixed
+
+- Inline ODBC/connection-string credentials in TI code are now masked in the
+  five code-reading tools (previously returned — and for git export, written to
+  disk — in plaintext).
+- Transaction-log windowing/probe paths no longer swallow connection outages or
+  permission denials as an empty "no data in range" result.
+- Network-error classification uses `err.cause.code` (undici) instead of brittle
+  message-substring matching that varied by Node version and locale.
+- `asOutputSchema` no longer reads Zod's private `_def`; uses the public
+  accessor and pins Zod to an exact version with a regression test.
+
+## [1.0.1] - 2026-06-30
+
+### Added
+
+- `tm1_trace_data_flow`: new analysis tool that traces a cube's data flow in one
+  call instead of `analyze_object_usage` + N× `get_process_code`. `downstream`
+  lists processes that read the cube and the cubes they write to; `upstream`
+  lists processes that write the cube and where they source data. Combines
+  code-level CellGet/CellPut/DB access with each process's datasource (one bulk
+  OData fetch), so view-sourced reads with no CellGet are caught too.
+
+- `tm1_get_message_log`: each entry now surfaces an optional `errorFile` field —
+  the TI error filename parsed out of the message text — so it can be passed
+  straight to `tm1_get_error_log_content` without manual string-copying.
+- `tm1_sample_cells`: opt-in `includeStrings` flag to sample String value
+  fields. Swaps NON EMPTY for a `<> ""` FILTER and scans all members including
+  consolidations (string values do not roll up and can sit on C elements). A
+  zero-result numeric run now hints at the flag.
+- `tm1_get_process_code`: opt-in `stripComments` flag that collapses runs of 4+
+  consecutive comment lines into a `# [... N lines commented out ...]` marker to
+  reduce dead-code context. Comment-heavy tabs surface a hint when not stripped.
+
+### Fixed
+
+- Corrected the read/write access taxonomy behind `tm1_analyze_object_usage` and
+  `tm1_trace_data_flow`. Now classified: element/dimension attribute value access
+  (`AttrPutN/S`, `ElementAttrPutN/S` writes; `ATTRN/S`, `AttrNL/SL`,
+  `ElementAttrN/S/NL/SL` reads) and cube attributes (`CubeAttrPutN/S` writes,
+  `CubeATTRNL/SL` reads). Removed classification of functions that do not exist in
+  TM1 TI — `CellIncrement` (only `CellIncrementN`), `CubePutN/S`, `ViewPutN/S`,
+  `CubeGetN/S`, `ViewGetN/S`, `ViewAttr*`, base-form `CubeAttrN/S`, `AttributeGet`,
+  `AttributePut` — so they are no longer mis-counted as reads/writes. The bogus
+  `CellIncrement` TI signature was also dropped.
+
+## [1.0.0] - 2026-06-24
+
+Initial public release.
+
+### Architecture
+
+- Service-composition architecture: all TM1 REST calls go through a service
+  under `src/tm1-client/services/`; the `lint:no-flat-api` CI gate prevents
+  regression to flat-client calls.
+- 111 MCP tools across 12 categories (metadata, model building, dimension
+  management, subsets, views, cell data, TI development, TI lifecycle,
+  process execution, scheduling, security, operations, analysis).
+- Four read-only MCP resources (`tm1://server/info`, `tm1://server/state`,
+  `tm1://process/{name}/code`, `tm1://cube/{name}/rules`) with name-autocomplete
+  completion callbacks.
+
+### Transports
+
+- stdio transport (default) for local Claude Code / Claude Desktop.
+- Streamable HTTP transport (stateless `POST /mcp`) with DNS-rebinding
+  protection, `Host`/`Origin` validation, and configurable bind host/port/origins.
+
+### Authentication
+
+- Native TM1 auth (`TM1_USER` / `TM1_PASSWORD`) is the default.
+- CAM (Cognos Access Manager) login. Set `TM1_NAMESPACE` for namespace auth
+  (sends `Authorization: CAMNamespace base64(user:password:namespace)`) or
+  `TM1_CAM_PASSPORT` for a pre-obtained passport (sends
+  `Authorization: CAMPassport <token>`, takes precedence and needs no
+  user/password).
+
+### Modes
+
+- `TM1_MODE=readonly` (default) restricts tool registration to non-destructive
+  tools for production instances; `readwrite` opts in to the full lifecycle.
+
+### TI analysis
+
+- `tm1_analyze_callgraph` — ExecuteProcess/RunProcess call tree with parameter
+  env propagation, `mode='summary'` aggregates, and global fan-out/fan-in
+  ranking when `start` is omitted.
+- `tm1_audit_feeders` — static overfeeding heuristics S1–S5 plus a runtime
+  fed/populated-ratio metric (`}StatsByCube` evidence) calibrated to the
+  TM1 community (≥50× hint, ≥100× evidence); runtime evidence escalates static
+  findings.
+- `tm1_audit_naming` — bulk-scan TM1 objects against IBM Planning Analytics
+  naming conventions (PA 2.0 + 3.1).
+- `tm1_audit_complexity` — TI/rule complexity metrics plus an opt-in
+  antipatterns lint scope (cognitive-style scoreV2, dead-assignment rule).
+- `tm1_analyze_object_usage` (with `mode='summary'` per-source aggregation),
+  `tm1_analyze_chore_graph`, `tm1_invalidate_callgraph_cache`,
+  `tm1_find_orphan_dimensions`, `tm1_check_v12_readiness`.
+
+### TI lifecycle (.pro)
+
+- `tm1_import_pro_file`, `tm1_diff_process_with_file`, `tm1_install_pro_bundle`,
+  `tm1_export_process_to_pro`, `tm1_upsert_process`, `tm1_diff_processes`.
+
+### Pre-write validation
+
+- `tm1_check_process_code`, `tm1_check_cube_rule`, `tm1_validate_process_refs`,
+  `tm1_check_writable_coords`.
+
+### Cell data and search
+
+- `tm1_execute_mdx` with `format=markdown` pivot/flat rendering.
+- `tm1_search_code` with `deduplicateByLine` and a `groupBy` (`'process'` |
+  `'tab'`) match-count aggregation mode; `tm1_search_rules` regex search across
+  cube rules.
+- `tm1_list_error_logs` with a `groupBy='process'` audit-summary mode
+  (per process `{count, firstSeen, lastSeen, spanDays, perDay}`).
+
+### Reliability and performance
+
+- Removed pretty-print JSON from tool output; gzip responses; method-aware
+  timeout hints; parallel `writeCells`.
+- Transaction-log query hardening: fail-fast preflight probe, Z-normalized
+  `since` filter, and adaptive time-window backfill to avoid full-scan timeouts.
+- TM1 security denials (HTTP 400) classified as `PERMISSION_DENIED`;
+  HTTP transport distinguishes `LOCK_TIMEOUT` from `CONNECTION_FAILED`.
+- Strict (`additionalProperties: false`) output schemas across tools.
+- Secrets masked in tool output.
+- `.env` is loaded from the package/repo root (the directory containing `dist/`)
+  in addition to the current working directory, so MCP clients that spawn the
+  server with their own cwd still pick up a repo `.env`. dotenv v17 startup tips
+  are suppressed (`quiet`) so they cannot corrupt the stdio JSON-RPC stream.
+
+### Security
+
+- Host-file access for the `.pro` round-trip tools (`tm1_diff_process_with_file`,
+  `tm1_validate_process_refs`, `tm1_export_process_to_pro`, `tm1_import_pro_file`,
+  `tm1_install_pro_bundle`) is gated behind the `TM1_LOCAL_FILE_ROOT` environment
+  variable and **disabled by default**. When unset, the `filePath` / `writeToFile`
+  / `directory` parameters are rejected and the tools accept only inline
+  `content`; when set, supplied paths must resolve within that root (no `..`
+  traversal).
+- `.env.example` ships with TLS verification on: `TM1_SSL_REJECT_UNAUTHORIZED`
+  is commented out so the secure code default (`true`) applies unless a user
+  deliberately opts out for self-signed certs.
+
+### Documentation
+
+- README, ARCHITECTURE, CONTRIBUTING, and SECURITY policy for open-source release.
+
+### CI
+
+- Quality gates: strict typecheck, ESLint, `lint:no-flat-api`,
+  annotation-coverage, and tool-registration wiring.
+
+[Unreleased]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v6.0.0...HEAD
+[6.0.0]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v5.0.0...v6.0.0
+[5.0.0]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v4.1.0...v5.0.0
+[4.1.0]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v4.0.0...v4.1.0
+[4.0.0]: https://github.com/flameY3T1/tm1-mcp-server/compare/v3.1.0...v4.0.0
+[3.1.0]: https://github.com/flameY3T1/tm1-mcp-server/compare/v3.0.1...v3.1.0
+[3.0.1]: https://github.com/flameY3T1/tm1-mcp-server/compare/v3.0.0...v3.0.1
+[3.0.0]: https://github.com/flameY3T1/tm1-mcp-server/compare/v2.1.0...v3.0.0
+[2.1.0]: https://github.com/flameY3T1/tm1-mcp-server/compare/v2.0.0...v2.1.0
+[2.0.0]: https://github.com/flameY3T1/tm1-mcp-server/compare/v1.0.4...v2.0.0
+[1.0.4]: https://github.com/flameY3T1/tm1-mcp-server/compare/v1.0.3...v1.0.4
+[1.0.3]: https://github.com/flameY3T1/tm1-mcp-server/compare/v1.0.2...v1.0.3
+[1.0.2]: https://github.com/flameY3T1/tm1-mcp-server/compare/v1.0.1...v1.0.2
+[1.0.1]: https://github.com/flameY3T1/tm1-mcp-server/compare/v1.0.0...v1.0.1
+[1.0.0]: https://github.com/flameY3T1/tm1-mcp-server/releases/tag/v1.0.0