@ffschrattenecker/tm1-mcp-server 6.0.0

package/dist/lib/feeders/static-heuristics.js

@@ -0,0 +1,202 @@
+import { extractDbCalls } from "../callgraph/rulesLinter.js";
+/**
+ * Pull every concrete element name out of a bracket list into a flat set.
+ * Positional, qualified, and set-form entries all contribute their element
+ * value(s). Dimension qualifiers are NOT bagged — only the element side.
+ */
+export function collectElementBag(list) {
+    const out = new Set();
+    for (const e of list.entries) {
+        pushElems(e, out);
+    }
+    return out;
+}
+function pushElems(e, out) {
+    if (e.elem !== undefined)
+        out.add(e.elem);
+    if (e.elems !== undefined) {
+        for (const v of e.elems)
+            out.add(v);
+    }
+}
+/**
+ * S3 · Wildcard / unscoped bracket — bracket has no concrete element
+ * constraints. Either an empty bracket or every entry lacks both `elem` and
+ * `elems`. Such feeders fire across every dim member.
+ */
+export function detectWildcardBracket(list) {
+    if (list.entries.length === 0)
+        return true;
+    return list.entries.every((e) => e.elem === undefined && e.elems === undefined);
+}
+/**
+ * S1 · Feeder broader than rule — feeder LHS pins a small fraction of the
+ * cube's dimensions. Ratio-based to scale across cube widths: an absolute
+ * "2 dims unpinned" threshold flooded findings on 13-dim cubes where
+ * positional feeders idiomatically pin 7–8 dims (live test 2026-05-19:
+ * 114/116 ≈ 98 % noise). The ratio gate restores precision because TM1
+ * fills the unpinned dims with default members — only when the feeder
+ * leaves most of the cube unconstrained is it genuinely too broad.
+ *
+ * Flags when `pinned / cubeTotalDims < minPinnedRatio` (default 0.5).
+ *
+ * Returns false on:
+ *  - empty bracket (S4 territory)
+ *  - missing cube dim count (resolver failure → cubeTotalDims ≤ 0)
+ *  - feeder pinning more entries than cube has dims (malformed; skip)
+ */
+export function detectBroaderThanRule(feeder, cubeTotalDims, minPinnedRatio = 0.5) {
+    if (feeder.entries.length === 0)
+        return false;
+    if (cubeTotalDims <= 0)
+        return false;
+    const pinned = feeder.entries.length;
+    if (pinned > cubeTotalDims)
+        return false;
+    return pinned / cubeTotalDims < minPinnedRatio;
+}
+/**
+ * Pair a feeder LHS with the rule LHS that shares the most element-bag
+ * elements. Returns the best-match rule (overlap ≥ 1) or null. Ties go to
+ * the first match for determinism. Used by S1 so we can compare feeder
+ * pinning against the rule it actually feeds rather than against the
+ * cube-width ratio fallback.
+ */
+export function findMatchingRule(feederLhs, ruleLhsList) {
+    if (ruleLhsList.length === 0)
+        return null;
+    const feederBag = collectElementBag(feederLhs);
+    if (feederBag.size === 0)
+        return null;
+    let best = null;
+    let bestOverlap = 0;
+    for (const r of ruleLhsList) {
+        const rbag = collectElementBag(r);
+        let overlap = 0;
+        for (const v of rbag)
+            if (feederBag.has(v))
+                overlap++;
+        if (overlap > bestOverlap) {
+            bestOverlap = overlap;
+            best = r;
+        }
+    }
+    return bestOverlap > 0 ? best : null;
+}
+/**
+ * S1 (rule-paired variant) · Feeder broader than its matched rule.
+ *
+ * Strict comparison: flag iff `feeder.pinned < matchedRule.pinned`. Equal
+ * pinning is the idiomatic 1:1 TM1 N: pattern (e.g. `[M:A] => [M:B]`
+ * feeding `[M:B] = N: [M:A] - ...;`) and must NOT be flagged — empirical
+ * audits showed ~92 % FP rate before pairing was introduced.
+ */
+export function detectBroaderThanMatchedRule(feeder, matchedRule) {
+    if (feeder.entries.length === 0)
+        return false;
+    return feeder.entries.length < matchedRule.entries.length;
+}
+/**
+ * S2 · Feeder targets consolidated element.
+ *
+ * For each entry in the feeder LHS, resolve `(dim, hier, elem)` and look up
+ * the element type via the cache. Flag on the first consolidated element
+ * encountered. Resolution rules:
+ *  - positional entry at index `i` → `dim = hier = cubeDimNames[i]`
+ *  - qualified entry `'Dim':'Elem'` → `dim = hier = Dim`
+ *  - qualified entry `'Dim:Hier':'Elem'` → split on `:` (only for the dim slot)
+ *  - set entries `'Dim':{'A','B'}` → check each element of the set
+ *
+ * Returns the matching `{dim, elem}` or `null`. The tool layer turns a
+ * non-null result into a finding with severity `hint`.
+ */
+export async function detectFeederToConsolidated(feeder, cubeDimNames, cache) {
+    if (feeder.entries.length === 0)
+        return null;
+    if (cubeDimNames.length === 0)
+        return null;
+    for (let i = 0; i < feeder.entries.length; i++) {
+        const e = feeder.entries[i];
+        const resolved = resolveDimHier(e, i, cubeDimNames);
+        if (!resolved)
+            continue;
+        const elems = entryElems(e);
+        for (const elem of elems) {
+            const t = await cache.getType(resolved.dim, resolved.hier, elem);
+            if (t === "Consolidated") {
+                return { dim: resolved.dim, elem };
+            }
+        }
+    }
+    return null;
+}
+function resolveDimHier(e, positionalIndex, cubeDimNames) {
+    if (e.dim !== undefined) {
+        const colonIdx = e.dim.indexOf(":");
+        if (colonIdx >= 0) {
+            return {
+                dim: e.dim.slice(0, colonIdx),
+                hier: e.dim.slice(colonIdx + 1),
+            };
+        }
+        return { dim: e.dim, hier: e.dim };
+    }
+    const name = cubeDimNames[positionalIndex];
+    if (name === undefined)
+        return null;
+    return { dim: name, hier: name };
+}
+function entryElems(e) {
+    if (e.elem !== undefined)
+        return [e.elem];
+    if (e.elems !== undefined)
+        return e.elems;
+    return [];
+}
+/**
+ * S4 · `DB()` feeder without skipcheck on target. Cross-cube feeders fan out
+ * through the target cube's consolidations; without `skipcheck;` on the
+ * target's rules the engine evaluates every cell. Walk every `DB(...)` call
+ * on the feeder line, ask the lookup whether the target cube has skipcheck.
+ *
+ * Returns the first target-cube name that lacks skipcheck, or `null` on:
+ *  - no `DB()` call on the line
+ *  - dynamic cube name (not a string literal — can't resolve statically)
+ *  - lookup returns `null` (target outside scan scope — be conservative)
+ *  - lookup returns `true` (skipcheck present)
+ */
+export function detectDbFeederWithoutSkipcheck(line, hasSkipcheck) {
+    const calls = extractDbCalls(line);
+    for (const call of calls) {
+        if (call.cubeName === null)
+            continue;
+        const verdict = hasSkipcheck(call.cubeName);
+        if (verdict === false)
+            return call.cubeName;
+    }
+    return null;
+}
+/**
+ * S5 · Orphan feeder — the feeder LHS shares no element name with any rule
+ * LHS in the cube. Pure overhead: it flags cells that no rule populates.
+ * Element comparison is bag-equality on the element-side only (dim
+ * qualifiers ignored), so positional and qualified syntax intermix.
+ */
+export function detectOrphanFeeder(feeder, ruleLhsList) {
+    if (feeder.entries.length === 0)
+        return false;
+    if (ruleLhsList.length === 0)
+        return false;
+    const feederElems = collectElementBag(feeder);
+    if (feederElems.size === 0)
+        return false;
+    for (const rule of ruleLhsList) {
+        const ruleElems = collectElementBag(rule);
+        for (const e of feederElems) {
+            if (ruleElems.has(e))
+                return false;
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=static-heuristics.js.map

package/dist/lib/git-process.d.ts

@@ -0,0 +1,67 @@
+import type { DataSource, ProcessParameter, ProcessVariable } from "../types.js";
+/**
+ * tm1-git two-file representation of a TI process.
+ *
+ * `{name}.json` holds the structure (parameters, variables, datasource,
+ * hasSecurityAccess). `{name}.ti` holds the code as TM1's native `Code`
+ * representation — `#region <Tab>` / `#endregion` blocks (CRLF, empty tabs
+ * omitted), byte-identical to `GET /Processes('x')/Code/$value`. The `.ti`
+ * blob is produced by the server, not built here; this module only parses it
+ * back (for import preflight). The `.json` is built by serializeProcessToGit.
+ *
+ * Credentials: the ODBC `password` is never written to the .json. A committed
+ * password would be a leaked secret; on import it is re-supplied out of band
+ * (see `dataSourcePassword` on the import tool).
+ */
+export interface GitProcessInput {
+    name: string;
+    parameters: ProcessParameter[];
+    variables: ProcessVariable[];
+    /**
+     * Raw `VariablesUIData` — one entry per datasource column, ignored ones
+     * included. Written to the .json as-is because a column set to "Ignore"
+     * appears nowhere in `variables`; leaving it out makes the export lose the
+     * setting on every re-import.
+     */
+    variablesUIData?: string[];
+    dataSource: DataSource;
+    hasSecurityAccess: boolean;
+}
+export interface GitProcessJson {
+    json: string;
+    /** True when an ODBC password was present and stripped from the JSON. */
+    credentialsOmitted: boolean;
+}
+export interface ParsedGitProcess {
+    name: string;
+    prolog: string;
+    metadata: string;
+    data: string;
+    epilog: string;
+    parameters: ProcessParameter[];
+    variables: ProcessVariable[];
+    variablesUIData?: string[];
+    dataSource: DataSource;
+    hasSecurityAccess?: boolean;
+}
+/**
+ * Build only the `{name}.json` (structure). Field order mirrors TM1's OData
+ * Process entity (Name, HasSecurityAccess, DataSource, then Parameters/
+ * Variables); parameter objects follow OData order (Name, Prompt, Value, Type).
+ * Order is cosmetic — parseProcessFromGit reads by key.
+ */
+export declare function serializeProcessToGit(input: GitProcessInput, opts?: {
+    includePassword?: boolean;
+}): GitProcessJson;
+/**
+ * Blob content the tab parser does not place — text outside every top-level
+ * `#region <Tab>` block, and a tab whose region appears more than once (the
+ * parser keeps the last copy). tm1_import_process_from_git deploys the RAW
+ * blob and lets TM1 split it, so its preflight can only vouch for the blob
+ * when this list is empty: otherwise the checked tabs and the installed code
+ * differ. Assumes a blob parseProcessFromGit already accepted.
+ */
+export declare function unplacedBlobContent(ti: string): string[];
+/** Parse a `{name}.json` + `{name}.ti` pair back into deployable process parts. */
+export declare function parseProcessFromGit(jsonContent: string, tiContent: string): ParsedGitProcess;
+//# sourceMappingURL=git-process.d.ts.map

package/dist/lib/git-process.js

@@ -0,0 +1,243 @@
+import { z } from "zod";
+import { parameterSchema, variableSchema, dataSourceSchema, } from "./process-parts-schema.js";
+/**
+ * Build only the `{name}.json` (structure). Field order mirrors TM1's OData
+ * Process entity (Name, HasSecurityAccess, DataSource, then Parameters/
+ * Variables); parameter objects follow OData order (Name, Prompt, Value, Type).
+ * Order is cosmetic — parseProcessFromGit reads by key.
+ */
+export function serializeProcessToGit(input, opts) {
+    const { password, ...dataSourceNoPwd } = input.dataSource;
+    const keepPassword = opts?.includePassword === true && Boolean(password);
+    const credentialsOmitted = !keepPassword && password !== undefined && password !== "";
+    const json = JSON.stringify({
+        name: input.name,
+        hasSecurityAccess: input.hasSecurityAccess,
+        dataSource: keepPassword
+            ? { ...dataSourceNoPwd, password }
+            : dataSourceNoPwd,
+        parameters: input.parameters.map((p) => ({
+            name: p.name,
+            ...(p.prompt !== undefined ? { prompt: p.prompt } : {}),
+            value: p.defaultValue,
+            type: p.type,
+        })),
+        variables: input.variables,
+        ...(input.variablesUIData !== undefined &&
+            input.variablesUIData.length > 0
+            ? { variablesUIData: input.variablesUIData }
+            : {}),
+    }, null, 2) + "\n";
+    return { json, credentialsOmitted };
+}
+const TAB_NAMES = new Set([
+    "prolog",
+    "metadata",
+    "data",
+    "epilog",
+]);
+/** Build a descriptive error naming the structural problem (same "reject, don't guess" shape
+ *  as the pre-existing zero-region error below). */
+function regionBlobError(problem) {
+    return new Error(`TI file has a malformed #region/#endregion code blob: ${problem} ` +
+        "Refusing to parse a structurally invalid blob (this would otherwise silently drop or " +
+        "misattribute code). Re-export from the server, or fix the marker manually.");
+}
+/** Scan every `#region`/`#endregion` marker line, in document order, top-level AND nested. */
+function extractRegionMarkers(ti) {
+    const markerRe = /^[ \t]*#(region|endregion)\b[ \t]*(\S*)[^\r\n]*\r?\n?/gim;
+    const markers = [];
+    let mm;
+    while ((mm = markerRe.exec(ti)) !== null) {
+        markers.push({
+            kind: mm[1].toLowerCase(),
+            name: mm[2],
+            start: mm.index,
+            contentStart: mm.index + mm[0].length,
+        });
+    }
+    return markers;
+}
+/**
+ * Parse a native `#region <Tab>` / `#endregion` code blob into the four tabs.
+ * Case-insensitive on keyword and tab name; a tab whose region is absent
+ * defaults to "". Throws if the blob has no region markers at all (rejects the
+ * pre-1.x `### TM1-TI-TAB:` layout — no longer supported).
+ *
+ * Depth-aware: TM1 users can write their OWN `#region <label>` / `#endregion`
+ * FOLDING COMMENTS inside a tab's TI code (PAW/Arc supports this), and the
+ * server stores them nested inside the tab's region — that is legitimate code
+ * content, not a structural marker. A `#region`/`#endregion` pair encountered
+ * while already inside a tab is therefore just a depth increment/decrement;
+ * its lines stay part of the tab's code, preserved verbatim. Only the
+ * top-level (depth 0→1) `#region` opens a tab, and only the marker that
+ * brings depth back to 0 closes it.
+ *
+ * Still throws on genuine structural corruption:
+ *   - an unclosed tab (depth never returns to 0 by EOF — a missing/typo'd
+ *     #endregion, which would otherwise let the next tab's content get
+ *     silently absorbed into the previous tab)
+ *   - a stray #endregion at the top level (depth would go negative)
+ *   - a top-level `#region` whose name isn't a recognized TI tab
+ *     (Prolog/Metadata/Data/Epilog) — genuinely malformed, not a user fold
+ */
+function parseCodeBlob(ti) {
+    const out = {
+        prolog: "",
+        metadata: "",
+        data: "",
+        epilog: "",
+    };
+    const markers = extractRegionMarkers(ti);
+    if (markers.length === 0) {
+        throw new Error("TI file has no #region markers (expected `#region Prolog` … `#endregion`). " +
+            "Pre-1.x `### TM1-TI-TAB:` files are no longer supported — re-export from the server.");
+    }
+    let depth = 0;
+    let currentTab = null;
+    let contentStart = 0;
+    let found = 0;
+    for (const marker of markers) {
+        if (marker.kind === "region") {
+            if (depth === 0) {
+                // Top-level #region: must be a known tab delimiter, not a user fold.
+                const tabName = marker.name.toLowerCase();
+                if (!TAB_NAMES.has(tabName)) {
+                    throw regionBlobError(`found "#region ${marker.name}" at the top level, which is not a recognized TI tab ` +
+                        "(expected Prolog/Metadata/Data/Epilog).");
+                }
+                currentTab = tabName;
+                contentStart = marker.contentStart;
+            }
+            // depth > 0: a nested user #region fold — part of the tab's code content.
+            depth++;
+        }
+        else {
+            depth--;
+            if (depth < 0) {
+                throw regionBlobError(`found a stray #endregion with no matching #region near offset ${marker.start}.`);
+            }
+            if (depth === 0) {
+                // Back to top level: this #endregion closes the current tab. Strip
+                // the single newline the server places before #endregion; nested
+                // #region/#endregion lines (user folds) stay in the sliced content.
+                out[currentTab] = ti
+                    .slice(contentStart, marker.start)
+                    .replace(/\r?\n$/, "");
+                found++;
+                currentTab = null;
+            }
+        }
+    }
+    if (depth !== 0) {
+        throw regionBlobError(`"#region ${currentTab ?? "?"}" is missing its matching #endregion — the blob is truncated ` +
+            "or a closing #endregion is missing.");
+    }
+    // Structurally unreachable given the checks above, but keep the original
+    // invariant explicit rather than silently returning a default-filled `out`.
+    if (found === 0) {
+        throw regionBlobError("no valid #region <Tab> … #endregion pair was found.");
+    }
+    return out;
+}
+/**
+ * Blob content the tab parser does not place — text outside every top-level
+ * `#region <Tab>` block, and a tab whose region appears more than once (the
+ * parser keeps the last copy). tm1_import_process_from_git deploys the RAW
+ * blob and lets TM1 split it, so its preflight can only vouch for the blob
+ * when this list is empty: otherwise the checked tabs and the installed code
+ * differ. Assumes a blob parseProcessFromGit already accepted.
+ */
+export function unplacedBlobContent(ti) {
+    const problems = [];
+    const seen = new Set();
+    let depth = 0;
+    let outsideFrom = 0;
+    const outside = (from, to) => {
+        const text = ti.slice(from, to).trim();
+        if (text !== "")
+            problems.push(`text outside any tab region: "${text.split(/\r?\n/)[0].slice(0, 60)}"`);
+    };
+    for (const m of extractRegionMarkers(ti)) {
+        if (m.kind === "region") {
+            if (depth === 0) {
+                outside(outsideFrom, m.start);
+                const tab = m.name.toLowerCase();
+                if (seen.has(tab))
+                    problems.push(`#region ${m.name} appears twice`);
+                seen.add(tab);
+            }
+            depth++;
+        }
+        else {
+            depth--;
+            if (depth === 0)
+                outsideFrom = m.contentStart;
+        }
+    }
+    outside(outsideFrom, ti.length);
+    return problems;
+}
+/** Parse a `{name}.json` + `{name}.ti` pair back into deployable process parts. */
+export function parseProcessFromGit(jsonContent, tiContent) {
+    let meta;
+    try {
+        meta = JSON.parse(jsonContent);
+    }
+    catch {
+        throw new Error("Process JSON is not valid JSON");
+    }
+    const name = typeof meta.name === "string" ? meta.name : "";
+    const hasSecurityAccess = typeof meta.hasSecurityAccess === "boolean"
+        ? meta.hasSecurityAccess
+        : undefined;
+    // Git .json uses the OData-native param field name `value`; the internal
+    // schema uses `defaultValue`. Normalize value→defaultValue before validation,
+    // keeping back-compat with legacy files that wrote `defaultValue`.
+    const rawParams = Array.isArray(meta.parameters)
+        ? meta.parameters.map((p) => {
+            if (p &&
+                typeof p === "object" &&
+                "value" in p &&
+                !("defaultValue" in p)) {
+                const { value, ...rest } = p;
+                return { ...rest, defaultValue: value };
+            }
+            return p;
+        })
+        : (meta.parameters ?? []);
+    const paramsResult = z.array(parameterSchema).safeParse(rawParams);
+    if (!paramsResult.success) {
+        throw new Error(`Process JSON has invalid 'parameters': ${paramsResult.error.issues[0]?.message ?? "shape mismatch"}`);
+    }
+    const parameters = paramsResult.data;
+    const varsResult = z.array(variableSchema).safeParse(meta.variables ?? []);
+    if (!varsResult.success) {
+        throw new Error(`Process JSON has invalid 'variables': ${varsResult.error.issues[0]?.message ?? "shape mismatch"}`);
+    }
+    const variables = varsResult.data;
+    const uiResult = z.array(z.string()).safeParse(meta.variablesUIData ?? []);
+    if (!uiResult.success) {
+        throw new Error(`Process JSON has invalid 'variablesUIData': ${uiResult.error.issues[0]?.message ?? "expected an array of strings"}`);
+    }
+    const variablesUIData = uiResult.data;
+    const dsResult = dataSourceSchema.safeParse(meta.dataSource ?? { type: "None" });
+    if (!dsResult.success) {
+        throw new Error(`Process JSON has invalid 'dataSource': ${dsResult.error.issues[0]?.message ?? "shape mismatch"}`);
+    }
+    const dataSource = dsResult.data;
+    const tabs = parseCodeBlob(tiContent);
+    return {
+        name,
+        ...(hasSecurityAccess !== undefined ? { hasSecurityAccess } : {}),
+        prolog: tabs.prolog,
+        metadata: tabs.metadata,
+        data: tabs.data,
+        epilog: tabs.epilog,
+        parameters,
+        variables,
+        ...(variablesUIData.length > 0 ? { variablesUIData } : {}),
+        dataSource,
+    };
+}
+//# sourceMappingURL=git-process.js.map

package/dist/lib/mask-secrets.d.ts

@@ -0,0 +1,10 @@
+export declare const SECRET_NAME_RE: RegExp;
+export declare const MASK = "***";
+export declare function isSecretName(name: string): boolean;
+export declare const CONN_CREDENTIAL_RE: RegExp;
+export declare function maskSecretValues(text: string): string;
+export declare function resolveMaskSecrets(requested: boolean | undefined): boolean;
+export declare function maskCodeLine(line: string): string;
+export declare function maskCode(code: string): string;
+export declare function maskSecretsDeep(value: unknown): unknown;
+//# sourceMappingURL=mask-secrets.d.ts.map

package/dist/lib/mask-secrets.js

@@ -0,0 +1,99 @@
+// Credential redaction helpers shared by call-graph analysis and code search.
+//
+// Param-name regex: matches typical credential identifiers (case-insensitive).
+// Kept conservative — false positives turn legitimate parameter values into
+// "***" in audit reports, so we err on the side of obvious credential names.
+export const SECRET_NAME_RE = /pass(?:wd|word)?|pwd|secret|token|api[_-]?key|^key$|credential|auth/i;
+export const MASK = "***";
+export function isSecretName(name) {
+    return SECRET_NAME_RE.test(name);
+}
+// Credential pair inside a connection string: `PWD=secret;`, `UID=admin;`.
+//
+// The value alternation is grammar-aware, and that is the whole point. ODBC
+// lets a value be brace-quoted precisely so it may contain the delimiter:
+// `PWD={abc;def};`. A plain `[^;]+` stops at the first inner `;`, masks `{abc`
+// and leaves `def};` sitting in the output as cleartext — a partial leak that
+// looks masked. Brace form is therefore matched FIRST and consumed whole.
+//
+// Both branches are single linear quantifiers over a negated class, so there is
+// no nested backtracking to exploit.
+export const CONN_CREDENTIAL_RE = /\b(pwd|password|uid|user\s*id)(\s*=\s*)(\{[^}]*\}|[^;'"\r\n]*)/gi;
+// Value-oriented sanitizer for arbitrary free text — error messages, server
+// responses, log lines. Distinct from maskSecretsDeep, which is KEY-oriented
+// and therefore blind to a credential embedded in a string: pino's redact
+// config masks `{password: "x"}` but never
+// `err.message = "ODBC failed: PWD=hunter2"`.
+//
+// Deliberately narrow: only credential pairs with an explicit key. Guessing at
+// bare tokens would mangle legitimate error text and train readers to ignore
+// the mask.
+export function maskSecretValues(text) {
+    if (!text)
+        return text;
+    return text
+        .replace(CONN_CREDENTIAL_RE, (_m, key, eq) => `${key}${eq}${MASK}`)
+        .replace(/\b(pass(?:wd|word)?|secret|token|api[_-]?key|credential)(\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;)}\]]+)/gi, (_m, key, sep) => `${key}${sep}${MASK}`);
+}
+// Whether a caller may switch credential masking OFF.
+//
+// `maskSecrets: false` is a MODEL-controlled opt-out of a security control —
+// the LLM can ask for raw credentials and, before this gate, got them. Now the
+// operator has to allow it out-of-band. Default is deny, so the tool parameter
+// degrades to "mask anyway" rather than failing the call: an audit that asked
+// for unmasked output still gets its report, just redacted.
+export function resolveMaskSecrets(requested) {
+    if (requested !== false)
+        return true;
+    return process.env.TM1_ALLOW_UNMASKED_SECRETS !== "true";
+}
+// Mask the 3rd argument of ODBCOpen(dsn, user, password) and the 3rd+ args of
+// ExecuteCommand variants where the password tends to live. Also mask any
+// quoted literal that follows a credential keyword.
+export function maskCodeLine(line) {
+    let out = line;
+    // ODBCOpen('dsn','user','password')  → mask 3rd arg
+    out = out.replace(/\b(ODBCOpen\s*\(\s*(?:'[^']*'|"[^"]*"|[^,]*)\s*,\s*(?:'[^']*'|"[^"]*"|[^,]*)\s*,\s*)(?:'[^']*'|"[^"]*")/gi, (_m, prefix) => `${prefix}'${MASK}'`);
+    // <credentialKeyword> = 'value'  → mask the literal
+    // Matches:  pPwd = 'foo'  | sPassword := "bar"  | gToken<-'baz'
+    out = out.replace(/(\b(?:[a-z_][a-z0-9_]*)?(?:pass(?:wd|word)?|pwd|secret|token|api[_-]?key|credential)[a-z0-9_]*\s*(?:=|:=|<-)\s*)(?:'[^']*'|"[^"]*")/gi, (_m, prefix) => `${prefix}'${MASK}'`);
+    // Connection-string credential pairs embedded INSIDE a string literal, e.g.
+    //   'Driver={SQL Server};Server=srv;UID=admin;PWD=hunter2;'
+    // These slip past the arg-position and keyword-before-'=' passes because the
+    // credential lives inside another literal (ODBCOpen 1st arg, or a conn string
+    // assigned to a non-credential-named var). Mask just the VALUE, keep the key.
+    // Value = bare token up to the next ';', quote, or line terminator (unquoted
+    // conn-string syntax); the [^;'"\r\n]+ capture is a single linear quantifier
+    // — no nested backtracking. Excluding \r\n keeps a trailing CR (CRLF line
+    // ending) out of the match so masking a conn-string line never converts
+    // CRLF→LF on the CRLF-sensitive .ti export.
+    out = out.replace(CONN_CREDENTIAL_RE, (_m, key, eq) => `${key}${eq}${MASK}`);
+    return out;
+}
+// Mask credential literals across a whole (possibly multi-line) code blob by
+// applying maskCodeLine to each line. Splits on "\n" only so CRLF/CR endings
+// are preserved byte-for-byte (the trailing "\r" rides along on each line and
+// is untouched by maskCodeLine).
+export function maskCode(code) {
+    return code.split("\n").map(maskCodeLine).join("\n");
+}
+// Deep-mask an arbitrary JSON-ish value: any object entry whose KEY name looks
+// like a credential (isSecretName) has its value replaced with MASK; primitives
+// stay as-is and nested objects/arrays are walked recursively. Used to sanitize
+// raw config dumps (e.g. the full TM1 /Configuration object surfaced under
+// `_raw`) before they leave the server, so a password sitting under
+// Access.LDAP.Password or Access.Authentication.* never leaks unmasked.
+export function maskSecretsDeep(value) {
+    if (Array.isArray(value)) {
+        return value.map((v) => maskSecretsDeep(v));
+    }
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = isSecretName(k) ? MASK : maskSecretsDeep(v);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=mask-secrets.js.map

package/dist/lib/mdx.d.ts

@@ -0,0 +1,3 @@
+/** Escape `]` → `]]` in an MDX bracketed-identifier name component. */
+export declare function escapeMdxName(s: string): string;
+//# sourceMappingURL=mdx.d.ts.map

package/dist/lib/mdx.js

@@ -0,0 +1,13 @@
+// MDX identifier helpers.
+//
+// A bracketed MDX identifier (`[Dimension].[Element]`) is terminated by the
+// first unescaped `]`. A name that itself contains `]` (e.g. `Q4]Adj`) must
+// therefore double it (`]` → `]]`), otherwise the identifier is closed early
+// and the query silently addresses the wrong member (MDX injection /
+// mis-addressed cell). Every name that goes into a bracketed identifier —
+// dimension, hierarchy, element, cube — must be escaped exactly once.
+/** Escape `]` → `]]` in an MDX bracketed-identifier name component. */
+export function escapeMdxName(s) {
+    return s.replace(/]/g, "]]");
+}
+//# sourceMappingURL=mdx.js.map

package/dist/lib/naming/odata-filter.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `$filter` expression selecting elements that may violate a naming rule.
+ *
+ * Mirrors the element branch of `checkName`: empty/whitespace-only, leading or
+ * trailing whitespace, TM1-Server-reserved characters, the `}` control prefix,
+ * a leading `+`/`-`, and — on v12 only — an embedded TAB.
+ */
+export declare function elementViolationFilter(): string;
+/**
+ * The same predicate in TypeScript, for testing soundness against `checkName`
+ * without a server. Kept beside the builder so the two cannot drift: a rule
+ * added to one and forgotten in the other fails the unit test.
+ */
+export declare function matchesElementViolationFilter(name: string): boolean;
+//# sourceMappingURL=odata-filter.d.ts.map