@ffschrattenecker/tm1-mcp-server 6.0.0

package/dist/tm1-client/services/process-status.d.ts

@@ -0,0 +1,21 @@
+import type { ProcessResult } from "../../types.js";
+/**
+ * Turn TM1's `ProcessExecuteStatusCode` into a `ProcessResult`.
+ *
+ * Two fail-open readings this closes, and they are mirror images:
+ *
+ *  1. An ABSENT status code is not success (T-4). The old
+ *     `?? "CompletedSuccessfully"` meant a 200 with an empty body, or a body
+ *     without the field, reached the caller as a clean run.
+ *  2. A present-but-not-`CompletedSuccessfully` code is not a flat failure.
+ *     Collapsing all five remaining members into `failed` told a caller that
+ *     an `ItemReject`ed run had failed when its writes were already committed —
+ *     an invitation to re-run a process that has posted its data once.
+ *
+ * An UNRECOGNISED code (a seventh member in some future TM1, or a server
+ * spelling we have never seen) is `indeterminate`, never a guess: the whole
+ * point of the split is that the groups carry measured commit semantics, and
+ * an unknown code has none.
+ */
+export declare function classifyExecution(statusCode: string | undefined, errorLogFile: string | undefined): ProcessResult;
+//# sourceMappingURL=process-status.d.ts.map

package/dist/tm1-client/services/process-status.js

@@ -0,0 +1,89 @@
+// Classification of TM1's `ProcessExecuteStatusCode` — shared by every path
+// that runs a TI and has to say what it did: ProcessService.execute,
+// ProcessService.saveData and CubeService's 11.x clear-via-TI fallback.
+//
+// See the `ProcessOutcome` doc in src/types.ts for the measurement table this
+// mapping comes from. The short version: the question a caller actually has is
+// "was anything committed", and TM1's six status codes answer it in three ways.
+import { PROCESS_STATUS_UNKNOWN } from "../../types.js";
+/**
+ * Status codes for runs that COMMITTED what they wrote before ending badly.
+ * All three measured on 11.8: a marker cell written in the Prolog survived.
+ *
+ * `CompletedWithMessages` = ItemReject, `QuitCalled` = ProcessQuit.
+ * `HasMinorErrors` normally comes from per-record failures in the Metadata/Data
+ * tabs and so needs a data source; it was measured here without one, by writing
+ * to a consolidated element from the Prolog.
+ */
+const COMMITTED_STATUSES = new Set([
+    "HasMinorErrors",
+    "QuitCalled",
+    "CompletedWithMessages",
+]);
+/**
+ * Status codes for runs whose writes were DISCARDED. Both measured on 11.8:
+ * the marker cell was gone afterwards.
+ */
+const ROLLED_BACK_STATUSES = new Set([
+    "Aborted",
+    "RollbackCalled",
+]);
+/**
+ * Turn TM1's `ProcessExecuteStatusCode` into a `ProcessResult`.
+ *
+ * Two fail-open readings this closes, and they are mirror images:
+ *
+ *  1. An ABSENT status code is not success (T-4). The old
+ *     `?? "CompletedSuccessfully"` meant a 200 with an empty body, or a body
+ *     without the field, reached the caller as a clean run.
+ *  2. A present-but-not-`CompletedSuccessfully` code is not a flat failure.
+ *     Collapsing all five remaining members into `failed` told a caller that
+ *     an `ItemReject`ed run had failed when its writes were already committed —
+ *     an invitation to re-run a process that has posted its data once.
+ *
+ * An UNRECOGNISED code (a seventh member in some future TM1, or a server
+ * spelling we have never seen) is `indeterminate`, never a guess: the whole
+ * point of the split is that the groups carry measured commit semantics, and
+ * an unknown code has none.
+ */
+export function classifyExecution(statusCode, errorLogFile) {
+    if (statusCode === undefined || statusCode === "") {
+        return {
+            success: false,
+            outcome: "indeterminate",
+            processErrorStatus: PROCESS_STATUS_UNKNOWN,
+            errorLogFile,
+        };
+    }
+    if (statusCode === "CompletedSuccessfully") {
+        return {
+            success: true,
+            outcome: "succeeded",
+            processErrorStatus: "CompletedSuccessfully",
+            errorLogFile,
+        };
+    }
+    if (COMMITTED_STATUSES.has(statusCode)) {
+        return {
+            success: false,
+            outcome: "completed_with_errors",
+            processErrorStatus: statusCode,
+            errorLogFile,
+        };
+    }
+    if (ROLLED_BACK_STATUSES.has(statusCode)) {
+        return {
+            success: false,
+            outcome: "rolled_back",
+            processErrorStatus: statusCode,
+            errorLogFile,
+        };
+    }
+    return {
+        success: false,
+        outcome: "indeterminate",
+        processErrorStatus: `${statusCode}: unrecognised ProcessExecuteStatusCode — this build does not know whether a run ending this way commits its changes. Verify server state (error logs, target cube) before re-running.`,
+        errorLogFile,
+    };
+}
+//# sourceMappingURL=process-status.js.map

package/dist/tm1-client/services/security-service.d.ts

@@ -0,0 +1,50 @@
+import type { Client, ClientCreate, ClientUpdate, Group } from "../../types.js";
+import type { TM1HttpClient } from "../http.js";
+export declare class SecurityService {
+    private readonly http;
+    constructor(http: TM1HttpClient);
+    /**
+     * List TM1 users (clients) with their group memberships.
+     * GET /api/v1/Users?$expand=Groups
+     */
+    listClients(): Promise<Client[]>;
+    /**
+     * Get a single user (client) with their groups.
+     * GET /api/v1/Users('{name}')
+     */
+    getClient(name: string): Promise<Client>;
+    /**
+     * Create a new user (client). Optionally seeds groups.
+     * POST /api/v1/Users
+     */
+    createClient(payload: ClientCreate): Promise<void>;
+    /**
+     * Partial update of a user (password / friendlyName / enabled).
+     * PATCH /api/v1/Users('{name}')
+     */
+    updateClient(name: string, payload: ClientUpdate): Promise<void>;
+    /**
+     * Delete a user (client).
+     * DELETE /api/v1/Users('{name}')
+     */
+    deleteClient(name: string): Promise<void>;
+    /**
+     * List all security groups with member users.
+     * TM1 REST exposes Group members under the `Users` navigation property
+     * (NOT `Clients`, despite TM1's user-facing "Client" terminology). Verified
+     * on TM1 v11.8 — `$expand=Clients` returns HTTP 400.
+     * GET /api/v1/Groups?$expand=Users($select=Name)
+     */
+    listGroups(): Promise<Group[]>;
+    /**
+     * Assign a user to a group.
+     * tm1py pattern: PATCH /Users('x') with Name + Groups@odata.bind.
+     */
+    assignClientGroup(clientName: string, groupName: string): Promise<void>;
+    /**
+     * Remove a user from a group.
+     * tm1py pattern: DELETE /Users('x')/Groups?$id=Groups('y').
+     */
+    removeClientGroup(clientName: string, groupName: string): Promise<void>;
+}
+//# sourceMappingURL=security-service.d.ts.map

package/dist/tm1-client/services/security-service.js

@@ -0,0 +1,93 @@
+// OData key encoder: double ' per OData literal rules, then percent-encode.
+const enc = (s) => encodeURIComponent(String(s).replace(/'/g, "''"));
+export class SecurityService {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /**
+     * List TM1 users (clients) with their group memberships.
+     * GET /api/v1/Users?$expand=Groups
+     */
+    async listClients() {
+        const res = await this.http.request("GET", "/api/v1/Users?$select=Name,FriendlyName,Type,Enabled&$expand=Groups");
+        return res.value;
+    }
+    /**
+     * Get a single user (client) with their groups.
+     * GET /api/v1/Users('{name}')
+     */
+    async getClient(name) {
+        return this.http.request("GET", `/api/v1/Users('${enc(name)}')?$select=Name,FriendlyName,Type,Enabled&$expand=Groups`);
+    }
+    /**
+     * Create a new user (client). Optionally seeds groups.
+     * POST /api/v1/Users
+     */
+    async createClient(payload) {
+        const body = {
+            Name: payload.name,
+        };
+        if (payload.password !== undefined)
+            body.Password = payload.password;
+        if (payload.friendlyName !== undefined)
+            body.FriendlyName = payload.friendlyName;
+        if (payload.groups !== undefined) {
+            body["Groups@odata.bind"] = payload.groups.map((g) => `Groups('${enc(g)}')`);
+        }
+        await this.http.request("POST", "/api/v1/Users", body);
+    }
+    /**
+     * Partial update of a user (password / friendlyName / enabled).
+     * PATCH /api/v1/Users('{name}')
+     */
+    async updateClient(name, payload) {
+        const body = {};
+        if (payload.password !== undefined)
+            body.Password = payload.password;
+        if (payload.friendlyName !== undefined)
+            body.FriendlyName = payload.friendlyName;
+        if (payload.enabled !== undefined)
+            body.Enabled = payload.enabled;
+        await this.http.request("PATCH", `/api/v1/Users('${enc(name)}')`, body);
+    }
+    /**
+     * Delete a user (client).
+     * DELETE /api/v1/Users('{name}')
+     */
+    async deleteClient(name) {
+        await this.http.request("DELETE", `/api/v1/Users('${enc(name)}')`);
+    }
+    /**
+     * List all security groups with member users.
+     * TM1 REST exposes Group members under the `Users` navigation property
+     * (NOT `Clients`, despite TM1's user-facing "Client" terminology). Verified
+     * on TM1 v11.8 — `$expand=Clients` returns HTTP 400.
+     * GET /api/v1/Groups?$expand=Users($select=Name)
+     */
+    async listGroups() {
+        const res = await this.http.request("GET", "/api/v1/Groups?$expand=Users($select=Name)");
+        return res.value.map((g) => ({
+            Name: g.Name,
+            Clients: g.Users ?? [],
+        }));
+    }
+    /**
+     * Assign a user to a group.
+     * tm1py pattern: PATCH /Users('x') with Name + Groups@odata.bind.
+     */
+    async assignClientGroup(clientName, groupName) {
+        await this.http.request("PATCH", `/api/v1/Users('${enc(clientName)}')`, {
+            Name: clientName,
+            "Groups@odata.bind": [`Groups('${enc(groupName)}')`],
+        });
+    }
+    /**
+     * Remove a user from a group.
+     * tm1py pattern: DELETE /Users('x')/Groups?$id=Groups('y').
+     */
+    async removeClientGroup(clientName, groupName) {
+        await this.http.request("DELETE", `/api/v1/Users('${enc(clientName)}')/Groups?$id=Groups('${enc(groupName)}')`);
+    }
+}
+//# sourceMappingURL=security-service.js.map

package/dist/tm1-client/services/server-service.d.ts

@@ -0,0 +1,116 @@
+import type { AuditLogEntry, ErrorLogFile, MessageLogEntry, ServerInfo, TransactionLogResult } from "../../types.js";
+import type { TM1HttpClient } from "../http.js";
+/**
+ * Pull the TM1 error log filename out of a message-log entry's free text, so it
+ * can be fed straight into `tm1_get_error_log_content(filename=…)`. Returns the
+ * exact filename (no surrounding brackets) or undefined when none is mentioned.
+ */
+export declare function extractErrorFile(message: string): string | undefined;
+/**
+ * Normalize a user timestamp into an OData v4 DateTimeOffset literal for a
+ * TM1 $filter. TM1 rejects a bare `2026-06-08T00:00:00` ("Syntax error … near
+ * -06") — the value MUST carry a timezone. Verified against TM1 11.8: only the
+ * `Z`-suffixed (or ±hh:mm-offset) form parses. Date-only input expands to
+ * start-of-day UTC; a zoneless datetime gets a `Z`; an already-zoned value is
+ * left untouched.
+ */
+export declare function toOdataDateTime(input: string): string;
+export declare class ServerService {
+    private readonly http;
+    constructor(http: TM1HttpClient);
+    /**
+     * Fetch TM1 server configuration. Merges /Configuration and
+     * /ActiveConfiguration; tolerates ActiveConfiguration being absent on
+     * older builds.
+     */
+    getInfo(): Promise<ServerInfo>;
+    /**
+     * Get recent TM1 server message log entries (newest first).
+     *
+     * The text/level/time filters are pushed to the server via `$filter` so a
+     * match OLDER than the `top`-row window is still found — filtering only the
+     * newest `top` rows client-side produced false negatives ("no error found")
+     * whenever the matching entry had scrolled past that window. TM1 v11 supports
+     * OData `contains`/`tolower`/`eq`/`ge`/`le` on the MessageLogEntries set.
+     *
+     * Text match is case-insensitive (tolower on both sides) to preserve the prior
+     * client-side `.toLowerCase().includes()` contract. If the server rejects the
+     * filtered query (older/limited builds without full string-function support),
+     * we fall back to fetching the newest `top` rows and filtering in-process —
+     * the same best-effort path as before, so the tool degrades rather than errors.
+     *
+     * GET /api/v1/MessageLogEntries?$orderby=TimeStamp desc&$top={top}[&$filter=…]
+     */
+    getMessageLog(opts?: {
+        top?: number | undefined;
+        filter?: string | undefined;
+        level?: string | undefined;
+        logger?: string | undefined;
+        since?: string | undefined;
+        until?: string | undefined;
+    }): Promise<MessageLogEntry[]>;
+    /**
+     * Fetch recent TM1 audit log entries (metadata/security changes), newest
+     * first. Requires AuditLogOn=T in tm1s.cfg — with auditing disabled the
+     * entity set is empty.
+     * GET /api/v1/AuditLogEntries
+     */
+    getAuditLog(opts: {
+        top?: number | undefined;
+        user?: string | undefined;
+        objectType?: string | undefined;
+        objectName?: string | undefined;
+        since?: string | undefined;
+        until?: string | undefined;
+        includeDetails?: boolean | undefined;
+    }): Promise<AuditLogEntry[]>;
+    /**
+     * Fetch recent TM1 transaction log entries (cell writes).
+     * GET /api/v1/TransactionLogEntries
+     */
+    getTransactionLog(opts: {
+        top?: number | undefined;
+        cubeName?: string | undefined;
+        user?: string | undefined;
+        since?: string | undefined;
+        until?: string | undefined;
+    }): Promise<TransactionLogResult>;
+    /**
+     * Single bounded TransactionLogEntries query. Runs once (retry disabled) under
+     * a dedicated timeout: the endpoint is deterministically slow, so a timeout
+     * means "range too large", not a transient blip. Our own timeout (the
+     * controller abort) and other non-systemic failures become an actionable
+     * "narrow the range" error; systemic transport/auth failures propagate
+     * unmasked and permission denials surface as-is.
+     */
+    private queryTransactionLog;
+    /**
+     * Cheap reachability/permission probe for the transaction log. A bare
+     * `$top=1` (no $orderby/$filter) returns at most one row so TM1 can short-
+     * circuit; a dedicated short-timeout AbortController caps the wait. That
+     * timeout (and other non-systemic failures) becomes an actionable TM1_ERROR;
+     * permission denials surface as-is and systemic transport/auth failures
+     * (e.g. CONNECTION_FAILED) propagate unmasked.
+     */
+    private probeTransactionLog;
+    /**
+     * List TI process error log files.
+     *
+     * TM1 v11 OData exposes only `Filename` on this entity set (no LastUpdated /
+     * $select / $orderby support). Sorting is filename-descending — filenames
+     * embed a yyyymmddhhmmss timestamp, so lexical desc sort matches
+     * chronological newest-first. Filters (processName, since, top) are applied
+     * client-side.
+     */
+    listErrorLogFiles(opts?: {
+        processName?: string | undefined;
+        since?: string | undefined;
+        top?: number | undefined;
+    }): Promise<ErrorLogFile[]>;
+    /**
+     * Fetch the raw text content of a single TI error log file.
+     * GET /api/v1/ErrorLogFiles('<filename>')/Content
+     */
+    getErrorLogContent(filename: string): Promise<string>;
+}
+//# sourceMappingURL=server-service.d.ts.map