@ffschrattenecker/tm1-mcp-server 7.0.2 → 8.0.0

package/dist/tm1-client/services/odata-page.js

@@ -55,6 +55,14 @@ export function readNestedCount(response, navigationProperty) {
 export function escapeOdataLiteral(value) {
     return value.replace(/'/g, "''");
 }
+/**
+ * Entity-key segment for a URL path: `Cubes('${odataKey(name)}')`. Doubles `'`,
+ * then percent-encodes, so `#`, `?`, `%`, `&` and `/` in a TM1 name stay inside
+ * the key. The one encoder for every service — see scripts/check-no-local-enc.mjs.
+ */
+export function odataKey(value) {
+    return encodeURIComponent(escapeOdataLiteral(String(value)));
+}
 /** Join filter predicates with `and` into a `&$filter=…` fragment. Empty string when none. */
 export function filterClause(predicates) {
     return predicates.length === 0 ? "" : `&$filter=${predicates.join(" and ")}`;

package/dist/tm1-client/services/process-service.d.ts

@@ -257,7 +257,7 @@ export declare class ProcessService {
      * Required after setting an ASCII DataSource.
      * PATCH /api/v1/Processes('{name}') with Variables array.
      */
-    updateVariables(processName: string, vars: ProcessVariable[], variablesUIData?: string[]): Promise<void>;
+    updateVariables(processName: string, vars: ProcessVariable[] | undefined, variablesUIData?: string[]): Promise<void>;
     /**
      * Update the parameters of a TI process.
      * PATCH /api/v1/Processes('{name}') with Parameters array.

package/dist/tm1-client/services/process-service.js

@@ -7,9 +7,7 @@ import { TM1Error, TM1ErrorCode } from "../../types.js";
 import { isUnsupportedQueryShape, rethrowIfSystemic, rethrowIfSystemicOrDenied, } from "./fallback.js";
 import { classifyExecution } from "./process-status.js";
 import { ignoredColumnsOf } from "../../lib/variables-ui-data.js";
-import { filterClause, nameFilterPredicates, pageClauses, readCount, } from "./odata-page.js";
-// OData key encoder: double ' per OData literal rules, then percent-encode.
-const enc = (s) => encodeURIComponent(String(s).replace(/'/g, "''"));
+import { filterClause, nameFilterPredicates, pageClauses, readCount, odataKey, } from "./odata-page.js";
 function decodeVariable(v) {
     return {
         name: v.Name,
@@ -120,7 +118,7 @@ export class ProcessService {
         // on 11.8.02900.8 and 12.5.9 — both omit the key entirely without it, and both
         // return {"Filename": ...} with it (v11 `TM1ProcessError_*.log`, v12
         // `ProcessLog_*.jsonl`).
-        const path = `/api/v1/Processes('${enc(processName)}')/tm1.ExecuteWithReturn?$expand=ErrorLogFile`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')/tm1.ExecuteWithReturn?$expand=ErrorLogFile`;
         const body = {};
         if (params && Object.keys(params).length > 0) {
             body.Parameters = Object.entries(params).map(([name, value]) => ({
@@ -214,7 +212,7 @@ export class ProcessService {
      * GET /api/v1/Processes('{name}')/Parameters
      */
     async getParameters(processName) {
-        const path = `/api/v1/Processes('${enc(processName)}')/Parameters`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')/Parameters`;
         // TM1 v11 returns Type as the decoded string "Numeric" / "String"
         // (not the legacy int code 1 / 2). The old `=== 1` check silently
         // classified every Numeric parameter as String.
@@ -241,7 +239,7 @@ export class ProcessService {
      */
     async exists(name) {
         try {
-            await this.http.request("GET", `/api/v1/Processes('${enc(name)}')?$select=Name`);
+            await this.http.request("GET", `/api/v1/Processes('${odataKey(name)}')?$select=Name`);
             return true;
         }
         catch (e) {
@@ -255,7 +253,7 @@ export class ProcessService {
      * before re-POSTing to avoid TM1 rejecting the body.
      */
     async copy(sourceName, targetName) {
-        const path = `/api/v1/Processes('${enc(sourceName)}')`;
+        const path = `/api/v1/Processes('${odataKey(sourceName)}')`;
         const source = await this.http.request("GET", path);
         delete source["@odata.context"];
         delete source["@odata.etag"];
@@ -282,7 +280,7 @@ export class ProcessService {
      * rather than an error, since neither is required to use the process.
      */
     async getUIData(processName) {
-        const path = `/api/v1/Processes('${enc(processName)}')` +
+        const path = `/api/v1/Processes('${odataKey(processName)}')` +
             `?$select=UIData,VariablesUIData`;
         try {
             const r = await this.http.request("GET", path);
@@ -413,7 +411,7 @@ export class ProcessService {
      * GET /api/v1/Processes('{name}')
      */
     async getCode(processName) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
         const response = await this.http.request("GET", path);
         return {
             prolog: response.PrologProcedure,
@@ -428,7 +426,7 @@ export class ProcessService {
      * GET /api/v1/Processes('{name}')?$select=HasSecurityAccess
      */
     async getDeployMeta(processName) {
-        const path = `/api/v1/Processes('${enc(processName)}')?$select=HasSecurityAccess`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')?$select=HasSecurityAccess`;
         const response = await this.http.request("GET", path);
         return { hasSecurityAccess: response.HasSecurityAccess === true };
     }
@@ -437,7 +435,7 @@ export class ProcessService {
      * PATCH /api/v1/Processes('{name}') with only the tabs to update.
      */
     async updateCode(processName, code) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
         const body = {};
         if (code.prolog !== undefined)
             body.PrologProcedure = code.prolog;
@@ -455,7 +453,7 @@ export class ProcessService {
      * are omitted by the server; newlines are CRLF.
      */
     async getCodeBlob(processName) {
-        const path = `/api/v1/Processes('${enc(processName)}')/Code/$value`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')/Code/$value`;
         return this.http.requestRaw("GET", path);
     }
     /**
@@ -466,7 +464,7 @@ export class ProcessService {
      * only write path.
      */
     async updateCodeBlob(processName, blob) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
         await this.http.request("PATCH", path, { Code: blob });
     }
     /**
@@ -474,7 +472,7 @@ export class ProcessService {
      * PATCH /api/v1/Processes('{name}') { HasSecurityAccess }.
      */
     async updateSecurityAccess(processName, hasSecurityAccess) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
         await this.http.request("PATCH", path, {
             HasSecurityAccess: hasSecurityAccess,
         });
@@ -494,7 +492,7 @@ export class ProcessService {
      * TM1 v12 returns the password in plain text.
      */
     async getDataSource(processName, opts) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
         const response = await this.http.request("GET", path);
         const ds = response.DataSource;
         // ds.Type is a raw string from the OData response. Surface (don't silently
@@ -588,7 +586,7 @@ export class ProcessService {
      * PATCH /api/v1/Processes('{name}') with DataSource object.
      */
     async updateDataSource(processName, dataSource) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
         const dsBody = { Type: dataSource.type };
         if (dataSource.dataSourceNameForServer !== undefined)
             dsBody.dataSourceNameForServer = dataSource.dataSourceNameForServer;
@@ -645,7 +643,7 @@ export class ProcessService {
      * GET /api/v1/Processes('{name}')?$select=Variables,VariablesUIData
      */
     async getVariableLayout(processName) {
-        const path = `/api/v1/Processes('${enc(processName)}')` +
+        const path = `/api/v1/Processes('${odataKey(processName)}')` +
             `?$select=Variables,VariablesUIData`;
         try {
             const r = await this.http.request("GET", path);
@@ -663,7 +661,7 @@ export class ProcessService {
                 throw e;
             // A server that will not answer the $select still answers the plain
             // collection — variables without the ignore information beat no answer.
-            const response = await this.http.request("GET", `/api/v1/Processes('${enc(processName)}')/Variables`);
+            const response = await this.http.request("GET", `/api/v1/Processes('${odataKey(processName)}')/Variables`);
             return {
                 variables: response.value.map(decodeVariable),
                 ignoredColumns: [],
@@ -702,16 +700,18 @@ export class ProcessService {
      * PATCH /api/v1/Processes('{name}') with Variables array.
      */
     async updateVariables(processName, vars, variablesUIData) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
-        const body = {
-            Variables: vars.map((v) => ({
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
+        const body = {};
+        // undefined = leave the variables alone and patch only the column layout.
+        if (vars !== undefined) {
+            body.Variables = vars.map((v) => ({
                 Name: v.name,
                 Type: v.type,
                 Position: v.position,
                 StartByte: v.startByte ?? 0,
                 EndByte: v.endByte ?? 0,
-            })),
-        };
+            }));
+        }
         // Patching Variables alone leaves whatever VariablesUIData the process
         // already has (measured on 12.5), which is right for an edit that keeps the
         // column layout and wrong for one that changes it — hence the explicit
@@ -725,7 +725,7 @@ export class ProcessService {
      * PATCH /api/v1/Processes('{name}') with Parameters array.
      */
     async updateParameters(processName, params) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
         const body = {
             Parameters: params.map(encodeParameter),
         };
@@ -736,7 +736,7 @@ export class ProcessService {
      * DELETE /api/v1/Processes('{name}')
      */
     async delete(processName) {
-        const path = `/api/v1/Processes('${enc(processName)}')`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')`;
         await this.http.request("DELETE", path);
     }
     /**
@@ -744,7 +744,7 @@ export class ProcessService {
      * POST /api/v1/Processes('{name}')/tm1.Compile
      */
     async compile(processName) {
-        const path = `/api/v1/Processes('${enc(processName)}')/tm1.Compile`;
+        const path = `/api/v1/Processes('${odataKey(processName)}')/tm1.Compile`;
         try {
             const response = await this.http.request("POST", path, {});
             const errors = (response?.value ?? []).map((e) => ({

package/dist/tm1-client/services/security-service.js

@@ -1,5 +1,4 @@
-// OData key encoder: double ' per OData literal rules, then percent-encode.
-const enc = (s) => encodeURIComponent(String(s).replace(/'/g, "''"));
+import { odataKey } from "./odata-page.js";
 export class SecurityService {
     http;
     constructor(http) {
@@ -18,7 +17,7 @@ export class SecurityService {
      * GET /api/v1/Users('{name}')
      */
     async getClient(name) {
-        return this.http.request("GET", `/api/v1/Users('${enc(name)}')?$select=Name,FriendlyName,Type,Enabled&$expand=Groups`);
+        return this.http.request("GET", `/api/v1/Users('${odataKey(name)}')?$select=Name,FriendlyName,Type,Enabled&$expand=Groups`);
     }
     /**
      * Create a new user (client). Optionally seeds groups.
@@ -33,7 +32,7 @@ export class SecurityService {
         if (payload.friendlyName !== undefined)
             body.FriendlyName = payload.friendlyName;
         if (payload.groups !== undefined) {
-            body["Groups@odata.bind"] = payload.groups.map((g) => `Groups('${enc(g)}')`);
+            body["Groups@odata.bind"] = payload.groups.map((g) => `Groups('${odataKey(g)}')`);
         }
         await this.http.request("POST", "/api/v1/Users", body);
     }
@@ -49,14 +48,14 @@ export class SecurityService {
             body.FriendlyName = payload.friendlyName;
         if (payload.enabled !== undefined)
             body.Enabled = payload.enabled;
-        await this.http.request("PATCH", `/api/v1/Users('${enc(name)}')`, body);
+        await this.http.request("PATCH", `/api/v1/Users('${odataKey(name)}')`, body);
     }
     /**
      * Delete a user (client).
      * DELETE /api/v1/Users('{name}')
      */
     async deleteClient(name) {
-        await this.http.request("DELETE", `/api/v1/Users('${enc(name)}')`);
+        await this.http.request("DELETE", `/api/v1/Users('${odataKey(name)}')`);
     }
     /**
      * List all security groups with member users.
@@ -77,9 +76,9 @@ export class SecurityService {
      * tm1py pattern: PATCH /Users('x') with Name + Groups@odata.bind.
      */
     async assignClientGroup(clientName, groupName) {
-        await this.http.request("PATCH", `/api/v1/Users('${enc(clientName)}')`, {
+        await this.http.request("PATCH", `/api/v1/Users('${odataKey(clientName)}')`, {
             Name: clientName,
-            "Groups@odata.bind": [`Groups('${enc(groupName)}')`],
+            "Groups@odata.bind": [`Groups('${odataKey(groupName)}')`],
         });
     }
     /**
@@ -87,7 +86,7 @@ export class SecurityService {
      * tm1py pattern: DELETE /Users('x')/Groups?$id=Groups('y').
      */
     async removeClientGroup(clientName, groupName) {
-        await this.http.request("DELETE", `/api/v1/Users('${enc(clientName)}')/Groups?$id=Groups('${enc(groupName)}')`);
+        await this.http.request("DELETE", `/api/v1/Users('${odataKey(clientName)}')/Groups?$id=Groups('${odataKey(groupName)}')`);
     }
 }
 //# sourceMappingURL=security-service.js.map

package/dist/tm1-client/services/server-service.js

@@ -5,6 +5,7 @@
 // See docs/ARCHITECTURE.md for the layering.
 import { TM1Error, TM1ErrorCode } from "../../types.js";
 import { rethrowIfSystemicOrDenied } from "./fallback.js";
+import { escapeOdataLiteral, odataKey } from "./odata-page.js";
 // TM1 references the per-run TI error file inside the free-text message, either
 // wrapped in angle brackets (e.g. German `Fehlerdatei: <…log>`) or bare
 // (`see TM1ProcessError_…log`). Both regexes are linear (no nested quantifiers,
@@ -85,10 +86,8 @@ export function toOdataDateTime(input) {
     return t;
 }
 // enc stays plain — it also wraps whole $filter/$orderby clauses below, where
-// the inner string literals are already single-quote-escaped via esc().
+// the inner string literals are already single-quote-escaped via escapeOdataLiteral().
 const enc = encodeURIComponent;
-// OData entity-key encoder: double ' per OData literal rules, then percent-encode.
-const encKey = (s) => encodeURIComponent(String(s).replace(/'/g, "''"));
 export class ServerService {
     http;
     constructor(http) {
@@ -163,15 +162,14 @@ export class ServerService {
     async getMessageLog(opts = {}) {
         const top = opts.top ?? 100;
         // Inner-literal single-quote escaping per OData; the whole clause is then
-        // URL-encoded with enc() below (mirrors getAuditLog()'s esc()+enc() pattern).
-        const esc = (s) => s.replace(/'/g, "''");
+        // URL-encoded with enc() below (mirrors getAuditLog()'s escapeOdataLiteral()+enc() pattern).
         const filters = [];
         if (opts.filter)
-            filters.push(`contains(tolower(Message),'${esc(opts.filter.toLowerCase())}')`);
+            filters.push(`contains(tolower(Message),'${escapeOdataLiteral(opts.filter.toLowerCase())}')`);
         if (opts.level)
-            filters.push(`toupper(Level) eq '${esc(opts.level.toUpperCase())}'`);
+            filters.push(`toupper(Level) eq '${escapeOdataLiteral(opts.level.toUpperCase())}'`);
         if (opts.logger)
-            filters.push(`Logger eq '${esc(opts.logger)}'`);
+            filters.push(`Logger eq '${escapeOdataLiteral(opts.logger)}'`);
         if (opts.since)
             filters.push(`TimeStamp ge ${toOdataDateTime(opts.since)}`);
         if (opts.until)
@@ -247,14 +245,13 @@ export class ServerService {
      * GET /api/v1/AuditLogEntries
      */
     async getAuditLog(opts) {
-        const esc = (s) => s.replace(/'/g, "''");
         const filters = [];
         if (opts.user)
-            filters.push(`UserName eq '${esc(opts.user)}'`);
+            filters.push(`UserName eq '${escapeOdataLiteral(opts.user)}'`);
         if (opts.objectType)
-            filters.push(`ObjectType eq '${esc(opts.objectType)}'`);
+            filters.push(`ObjectType eq '${escapeOdataLiteral(opts.objectType)}'`);
         if (opts.objectName)
-            filters.push(`ObjectName eq '${esc(opts.objectName)}'`);
+            filters.push(`ObjectName eq '${escapeOdataLiteral(opts.objectName)}'`);
         if (opts.since)
             filters.push(`TimeStamp ge ${toOdataDateTime(opts.since)}`);
         if (opts.until)
@@ -370,9 +367,9 @@ export class ServerService {
     async queryTransactionLog(q) {
         const filters = [];
         if (q.cubeName)
-            filters.push(`Cube eq '${q.cubeName.replace(/'/g, "''")}'`);
+            filters.push(`Cube eq '${escapeOdataLiteral(q.cubeName)}'`);
         if (q.user)
-            filters.push(`User eq '${q.user.replace(/'/g, "''")}'`);
+            filters.push(`User eq '${escapeOdataLiteral(q.user)}'`);
         if (q.since)
             filters.push(`TimeStamp ge ${toOdataDateTime(q.since)}`);
         if (q.until)
@@ -470,12 +467,14 @@ export class ServerService {
             const proc = opts.processName.toLowerCase();
             // TM1 v11+ pattern with session hash: TM1ProcessError_<ts>_<id>_<proc>_<hash>.log
             // TM1 pattern without hash:           TM1ProcessError_<ts>_<id>_<proc>.log
+            // TM1 v12 pattern:                    ProcessLog_<ts>_<id>_<proc>.jsonl
             // Legacy/manual pattern:              <proc>_<ts>.log
             entries = entries.filter((e) => {
                 const f = e.filename.toLowerCase();
                 return (f === proc ||
                     f.startsWith(`${proc}_`) ||
                     f.endsWith(`_${proc}.log`) ||
+                    f.endsWith(`_${proc}.jsonl`) ||
                     f.includes(`_${proc}_`));
             });
         }
@@ -497,7 +496,7 @@ export class ServerService {
      * GET /api/v1/ErrorLogFiles('<filename>')/Content
      */
     async getErrorLogContent(filename) {
-        const path = `/api/v1/ErrorLogFiles('${encKey(filename)}')/Content`;
+        const path = `/api/v1/ErrorLogFiles('${odataKey(filename)}')/Content`;
         return await this.http.requestRaw("GET", path);
     }
 }

package/dist/tm1-client/services/subset-service.d.ts

@@ -3,6 +3,8 @@ import type { TM1HttpClient } from "../http.js";
 export declare class SubsetService {
     private readonly http;
     constructor(http: TM1HttpClient);
+    private base;
+    private bind;
     /**
      * List public + private subsets of a hierarchy.
      * GET /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets|PrivateSubsets
@@ -14,24 +16,35 @@ export declare class SubsetService {
      */
     get(dimensionName: string, hierarchyName: string, subsetName: string, isPrivate?: boolean): Promise<Subset>;
     /**
-     * Create a public subset. Either MDX-based (expression) or static
-     * (elements). Mixed/empty inputs throw VALIDATION_ERROR.
-     * POST /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets
+     * Create a subset, public or private (owned by the signed-in user). Either
+     * MDX-based (expression) or static (elements). Mixed/empty inputs throw
+     * VALIDATION_ERROR.
+     * POST /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets|PrivateSubsets
      */
-    create(dimensionName: string, hierarchyName: string, subset: SubsetCreate): Promise<void>;
+    create(dimensionName: string, hierarchyName: string, subset: SubsetCreate, isPrivate?: boolean): Promise<void>;
     /**
-     * Update an existing public subset.
-     * PATCH /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets('{s}')
+     * Update an existing subset: its MDX, its static element list, or its alias.
+     *
+     * Measured on 11.8 and 12.5: a PATCH that binds Elements APPENDS to the
+     * list (and freezes an MDX subset's result first), and one that also sends
+     * `Expression: ""` is refused as "both a list of Elements and an
+     * Expression". Replacing the list takes two calls: drop every element
+     * reference, then bind the new ones. That pair is not atomic, and a bind
+     * naming an unknown element fails with 404 after the list is already gone,
+     * so on failure the old definition is written back.
+     *
+     * PATCH /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets|PrivateSubsets('{s}')
+     * DELETE …/Subsets('{s}')/Elements/$ref
      */
     update(dimensionName: string, hierarchyName: string, subsetName: string, update: {
         expression?: string | undefined;
         elements?: string[] | undefined;
         alias?: string | undefined;
-    }): Promise<void>;
+    }, isPrivate?: boolean): Promise<void>;
     /**
-     * Delete a public subset.
-     * DELETE /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets('{s}')
+     * Delete a subset, public or private.
+     * DELETE /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets|PrivateSubsets('{s}')
      */
-    delete(dimensionName: string, hierarchyName: string, subsetName: string): Promise<void>;
+    delete(dimensionName: string, hierarchyName: string, subsetName: string, isPrivate?: boolean): Promise<void>;
 }
 //# sourceMappingURL=subset-service.d.ts.map

package/dist/tm1-client/services/subset-service.js

@@ -6,13 +6,18 @@
 // See docs/ARCHITECTURE.md for the layering.
 import { TM1Error, TM1ErrorCode } from "../../types.js";
 import { rethrowIfSystemic } from "./fallback.js";
-// OData key encoder: double ' per OData literal rules, then percent-encode.
-const enc = (s) => encodeURIComponent(String(s).replace(/'/g, "''"));
+import { odataKey } from "./odata-page.js";
 export class SubsetService {
     http;
     constructor(http) {
         this.http = http;
     }
+    base(dimensionName, hierarchyName) {
+        return `/api/v1/Dimensions('${odataKey(dimensionName)}')/Hierarchies('${odataKey(hierarchyName)}')`;
+    }
+    bind(dimensionName, hierarchyName, elements) {
+        return elements.map((e) => `Dimensions('${odataKey(dimensionName)}')/Hierarchies('${odataKey(hierarchyName)}')/Elements('${odataKey(e)}')`);
+    }
     /**
      * List public + private subsets of a hierarchy.
      * GET /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets|PrivateSubsets
@@ -21,7 +26,7 @@ export class SubsetService {
         const result = [];
         const fetchScope = async (segment, isPrivate) => {
             try {
-                const path = `/api/v1/Dimensions('${enc(dimensionName)}')/Hierarchies('${enc(hierarchyName)}')/${segment}?$select=Name,Expression,Alias`;
+                const path = `/api/v1/Dimensions('${odataKey(dimensionName)}')/Hierarchies('${odataKey(hierarchyName)}')/${segment}?$select=Name,Expression,Alias`;
                 const response = await this.http.request("GET", path);
                 for (const s of response.value) {
                     result.push({
@@ -50,7 +55,7 @@ export class SubsetService {
      */
     async get(dimensionName, hierarchyName, subsetName, isPrivate = false) {
         const segment = isPrivate ? "PrivateSubsets" : "Subsets";
-        const path = `/api/v1/Dimensions('${enc(dimensionName)}')/Hierarchies('${enc(hierarchyName)}')/${segment}('${enc(subsetName)}')?$expand=Elements($select=Name)&$select=Name,Expression,Alias`;
+        const path = `/api/v1/Dimensions('${odataKey(dimensionName)}')/Hierarchies('${odataKey(hierarchyName)}')/${segment}('${odataKey(subsetName)}')?$expand=Elements($select=Name)&$select=Name,Expression,Alias`;
         const response = await this.http.request("GET", path);
         return {
             name: response.Name,
@@ -63,12 +68,13 @@ export class SubsetService {
         };
     }
     /**
-     * Create a public subset. Either MDX-based (expression) or static
-     * (elements). Mixed/empty inputs throw VALIDATION_ERROR.
-     * POST /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets
+     * Create a subset, public or private (owned by the signed-in user). Either
+     * MDX-based (expression) or static (elements). Mixed/empty inputs throw
+     * VALIDATION_ERROR.
+     * POST /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets|PrivateSubsets
      */
-    async create(dimensionName, hierarchyName, subset) {
-        const path = `/api/v1/Dimensions('${enc(dimensionName)}')/Hierarchies('${enc(hierarchyName)}')/Subsets`;
+    async create(dimensionName, hierarchyName, subset, isPrivate = false) {
+        const path = `${this.base(dimensionName, hierarchyName)}/${isPrivate ? "PrivateSubsets" : "Subsets"}`;
         if (subset.expression && subset.elements && subset.elements.length > 0) {
             throw new TM1Error({
                 code: TM1ErrorCode.VALIDATION_ERROR,
@@ -89,34 +95,84 @@ export class SubsetService {
             body.Expression = subset.expression;
         }
         else {
-            body["Elements@odata.bind"] = subset.elements.map((e) => `Dimensions('${enc(dimensionName)}')/Hierarchies('${enc(hierarchyName)}')/Elements('${enc(e)}')`);
+            body["Elements@odata.bind"] = this.bind(dimensionName, hierarchyName, subset.elements);
         }
         await this.http.request("POST", path, body);
     }
     /**
-     * Update an existing public subset.
-     * PATCH /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets('{s}')
+     * Update an existing subset: its MDX, its static element list, or its alias.
+     *
+     * Measured on 11.8 and 12.5: a PATCH that binds Elements APPENDS to the
+     * list (and freezes an MDX subset's result first), and one that also sends
+     * `Expression: ""` is refused as "both a list of Elements and an
+     * Expression". Replacing the list takes two calls: drop every element
+     * reference, then bind the new ones. That pair is not atomic, and a bind
+     * naming an unknown element fails with 404 after the list is already gone,
+     * so on failure the old definition is written back.
+     *
+     * PATCH /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets|PrivateSubsets('{s}')
+     * DELETE …/Subsets('{s}')/Elements/$ref
      */
-    async update(dimensionName, hierarchyName, subsetName, update) {
-        const path = `/api/v1/Dimensions('${enc(dimensionName)}')/Hierarchies('${enc(hierarchyName)}')/Subsets('${enc(subsetName)}')`;
+    async update(dimensionName, hierarchyName, subsetName, update, isPrivate = false) {
+        const { expression, elements, alias } = update;
+        if (expression !== undefined && elements !== undefined) {
+            throw new TM1Error({
+                code: TM1ErrorCode.VALIDATION_ERROR,
+                message: "Pass either expression (MDX) or elements (static list), not both.",
+            });
+        }
+        if (expression === undefined &&
+            elements === undefined &&
+            alias === undefined) {
+            throw new TM1Error({
+                code: TM1ErrorCode.VALIDATION_ERROR,
+                message: "Nothing to update: pass expression, elements or alias.",
+            });
+        }
+        const path = `${this.base(dimensionName, hierarchyName)}/${isPrivate ? "PrivateSubsets" : "Subsets"}('${odataKey(subsetName)}')`;
         const body = {};
-        if (update.alias !== undefined)
-            body.Alias = update.alias;
-        if (update.expression !== undefined) {
-            body.Expression = update.expression;
+        if (alias !== undefined)
+            body.Alias = alias;
+        if (elements === undefined) {
+            if (expression !== undefined)
+                body.Expression = expression;
+            await this.http.request("PATCH", path, body);
+            return;
+        }
+        const before = await this.get(dimensionName, hierarchyName, subsetName, isPrivate);
+        await this.http.request("DELETE", `${path}/Elements/$ref`);
+        if (elements.length > 0)
+            body["Elements@odata.bind"] = this.bind(dimensionName, hierarchyName, elements);
+        if (Object.keys(body).length === 0)
+            return;
+        try {
+            await this.http.request("PATCH", path, body);
         }
-        else if (update.elements !== undefined) {
-            body.Expression = "";
-            body["Elements@odata.bind"] = update.elements.map((e) => `Dimensions('${enc(dimensionName)}')/Hierarchies('${enc(hierarchyName)}')/Elements('${enc(e)}')`);
+        catch (e) {
+            const restore = before.expression
+                ? { Expression: before.expression }
+                : {
+                    "Elements@odata.bind": this.bind(dimensionName, hierarchyName, before.elements),
+                };
+            try {
+                await this.http.request("PATCH", path, restore);
+            }
+            catch {
+                throw new TM1Error({
+                    code: TM1ErrorCode.TM1_ERROR,
+                    message: `Subset '${subsetName}' was emptied and could not be restored after the update failed: ` +
+                        (e instanceof Error ? e.message : String(e)),
+                });
+            }
+            throw e;
         }
-        await this.http.request("PATCH", path, body);
     }
     /**
-     * Delete a public subset.
-     * DELETE /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets('{s}')
+     * Delete a subset, public or private.
+     * DELETE /api/v1/Dimensions('{d}')/Hierarchies('{h}')/Subsets|PrivateSubsets('{s}')
      */
-    async delete(dimensionName, hierarchyName, subsetName) {
-        await this.http.request("DELETE", `/api/v1/Dimensions('${enc(dimensionName)}')/Hierarchies('${enc(hierarchyName)}')/Subsets('${enc(subsetName)}')`);
+    async delete(dimensionName, hierarchyName, subsetName, isPrivate = false) {
+        await this.http.request("DELETE", `${this.base(dimensionName, hierarchyName)}/${isPrivate ? "PrivateSubsets" : "Subsets"}('${odataKey(subsetName)}')`);
     }
 }
 //# sourceMappingURL=subset-service.js.map