@ffschrattenecker/tm1-mcp-server 7.0.2 → 8.1.0

package/dist/tools/model-building/set-cube-rules.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { invalidateCallgraphCache } from "../../lib/callgraph/tm1-adapter.js";
-import { TM1ErrorCode } from "../../types.js";
+import { TM1Error, TM1ErrorCode } from "../../types.js";
 import { withToolHint } from "../error-format.js";
 import { actionResponse } from "../format.js";
 import { CONFIRM_SCHEMA, requireConfirm } from "../confirm.js";
@@ -14,7 +14,8 @@ export const registerSetCubeRules = defineTool({
         "Create or replace the rules for a TM1 cube.",
         "SKIPCHECK; belongs at the top and FEEDERS; before all feeder definitions — SKIPCHECK is what makes feeders take effect, so rules with feeders need it.",
         "Pass exactly one source: rules (the full text — replaces everything), edits (find/replace patch against the current text; each find must match exactly once, else nothing is written), or filePath (full text from a host file under TM1_LOCAL_FILE_ROOT).",
-        "The full resulting text is syntax-checked before anything is written (preflight). The stored text is read back after writing (verified.textMatches), so no separate tm1_get_cube_rules is needed; the callgraph cache is dropped automatically.",
+        "The full resulting text is syntax-checked with tm1.CheckRules before anything is written: TM1 itself stores broken rules without an error, and they then silently compute nothing. Any error aborts the call with VALIDATION_ERROR, the errors with their line numbers in details, and nothing is written; preflight:false skips the check.",
+        "The stored text is read back after writing (verified.textMatches), so no separate tm1_get_cube_rules is needed; the callgraph cache is dropped automatically.",
     ],
     annotations: IDEMPOTENT_DESTRUCTIVE,
     output: MutationResultSchema,
@@ -45,23 +46,15 @@ export const registerSetCubeRules = defineTool({
         if (preflight) {
             const errors = await tm1Client.cubes.checkRule(cubeName, text);
             if (errors.length > 0) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: JSON.stringify({
-                                stage: "preflight",
-                                check: "syntax",
-                                cubeName,
-                                code: TM1ErrorCode.VALIDATION_ERROR,
-                                message: `Preflight rule check failed: ${errors.length} error(s). Nothing was written.`,
-                                hint: "Fix the lines in errors[] (lineNumber is in the full resulting text, after edits are applied). preflight:false skips the check; TM1 would store the broken text.",
-                                errors,
-                            }),
-                        },
-                    ],
-                    isError: true,
-                };
+                throw new TM1Error({
+                    code: TM1ErrorCode.VALIDATION_ERROR,
+                    message: `Rules for '${cubeName}' have ${errors.length} syntax error(s): ${errors
+                        .slice(0, 5)
+                        .map((e) => `line ${e.lineNumber ?? "?"}: ${e.message.trim()}`)
+                        .join("; ")}. Nothing was written.`,
+                    hint: "Fix the reported lines and retry (line numbers are in the full resulting text, after edits are applied). preflight:false writes the text anyway; TM1 stores it, but the broken statements compute nothing.",
+                    details: JSON.stringify({ stage: "preflight", errors }),
+                });
             }
         }
         await withToolHint(tm1Client.cubes.updateRules(cubeName, text), `Inspect details for the offending line.`);
@@ -78,7 +71,7 @@ export const registerSetCubeRules = defineTool({
         }
         const lineCount = text.split("\n").length;
         // Rule changes shift call edges (DB(), feeders) — drop callgraph TTL early.
-        const { cleared: callgraphEntriesCleared } = invalidateCallgraphCache();
+        const { cleared: callgraphEntriesCleared } = invalidateCallgraphCache(tm1Client.connectionId);
         return actionResponse({
             success: true,
             cubeName,

package/dist/tools/model-building/unload-cube.js

@@ -5,7 +5,7 @@ import { MutationResultSchema } from "../schemas/items.js";
 import { defineTool } from "../define-tool.js";
 export const registerUnloadCube = defineTool({
     name: "tm1_unload_cube",
-    description: "Unload a cube from memory. TM1 discards the in-memory fed-cell index and reloads from disk on next access. Required after feeder corrections, since the fed-cell index is cumulative — changes to existing feeders only take effect after an unload. Safe to call: data is preserved (read from .cub on next access). TM1 v11 only.",
+    description: "Unload a cube from memory. TM1 saves the cube to disk first, then discards the in-memory fed-cell index and reloads from .cub on next access. Two reasons to call it: after feeder corrections, since the fed-cell index is cumulative and changes to existing feeders only take effect once the cube reloads; and to give the memory the cube occupies back to the server. TM1 v11 only.",
     annotations: DESTRUCTIVE,
     // v11 only. v12 answers tm1.Unload with "Demand load, loading and unloading
     // of cubes is no longer supported." — the feature is gone, with no successor

package/dist/tools/operations/get-cube-stats.js

@@ -12,7 +12,7 @@ export const registerGetCubeStats = defineTool({
         "Read }StatsByCube metrics for one or more cubes (memory, populated cells, fed cells, feeder efficiency).",
         "Well-known metrics are mapped to typed fields; the full element-name → value map is also returned under `raw` so server-side renames don't break the tool.",
         "Per-cube errors are reported as items[].error without failing the whole call.",
-        "Servers with no }Stats* control cubes (TM1 v12), or accounts not allowed to read them, return `statsUnavailable` {reason: absent|denied} instead of a raw error.",
+        "The }Stats* control cubes are not always there: v12 has none at all, and v11 keeps them only while statistics collection is switched on. That case, and an account not allowed to read them, return `statsUnavailable` {reason: absent|denied} instead of a raw error.",
     ],
     annotations: READ_ONLY,
     output: CubeStatsResultSchema,

package/dist/tools/operations/get-transaction-log.js

@@ -5,7 +5,7 @@ import { TransactionLogEntrySchema } from "../schemas/items.js";
 import { defineTool } from "../define-tool.js";
 export const registerGetTransactionLog = defineTool({
     name: "tm1_get_transaction_log",
-    description: "Fetch recent TM1 transaction log entries (cell writes), newest first. Optional filters: cube, user, and a since/until time range. NOTE: the endpoint scans the log server-side and a full scan can take minutes-to-hours. A cheap preflight probe fails fast on unreachable/no-rights; without `since` the server walks expanding time windows backward (10min→1y) and stops once `top` rows are found, so it never triggers a full scan. Pass since/until (from-to) to bound it explicitly. (v11 only)",
+    description: "Fetch recent TM1 transaction log entries (cell writes), newest first. Optional filters: cube, user, and a since/until time range. NOTE: the endpoint scans the log server-side and a full scan can take minutes-to-hours. A cheap preflight probe fails fast on unreachable/no-rights; without `since` the server walks expanding time windows backward (10min→1y) and stops once `top` rows are found, so the lookback is bounded at one year rather than open-ended — a sparse log still walks all nine windows before it gives up. Pass since/until (from-to) to bound it explicitly. (v11 only)",
     annotations: withVersion(READ_ONLY, "v11"),
     // v12 deprecated TransactionLogEntry/TransactionLogEntries (and the
     // TransactionLog / TailTransactionLog functions) in 12.0.0; all of them serve

package/dist/tools/operations/list-error-logs.js

@@ -8,11 +8,16 @@ import { pageShapeFor } from "../schemas/common.js";
 // Best-effort extraction of {process, ts} from an error-log filename.
 // Two known patterns (see server-service.listErrorLogFiles):
 //   modern v11: TM1ProcessError_<ts>_<id>_<proc>(_<hash>)?.log
+//   v12:        ProcessLog_<ts>_<id>_<proc>.jsonl
 //   legacy:     <proc>_<ts>.log
 // Process names may contain underscores, so the modern parse greedily captures
 // the tail and strips a trailing session-hash token (_<hex6+>). This is a
 // heuristic — good enough for audit triage, not a guaranteed exact split.
 export function parseLogName(filename) {
+    // v12 names carry no session hash, so nothing to strip.
+    const v12 = filename.match(/^ProcessLog_(\d{14})_\d+_(.+)\.jsonl$/i);
+    if (v12)
+        return { ts: v12[1], process: v12[2] };
     const modern = filename.match(/^TM1ProcessError_(\d{14})_\d+_(.+)\.log$/i);
     if (modern) {
         // Strip the trailing TM1 session-hash token. Real-world v11 hashes are
@@ -62,12 +67,32 @@ export const registerListErrorLogs = defineTool({
         "groupBy='process' returns a per-process audit summary instead of individual files.",
     ],
     annotations: READ_ONLY,
-    output: pageShapeFor(z.union([ErrorLogFileSchema, ErrorLogGroupSchema])),
+    output: {
+        // Set only on the groupBy='process' branch, which wraps the page in the
+        // filters it applied and the totals before paging.
+        groupBy: z.literal("process").optional().describe("Echoes groupBy"),
+        processName: z
+            .string()
+            .optional()
+            .describe("Echoes the processName filter"),
+        since: z.string().optional().describe("Echoes the since filter"),
+        totalFiles: z
+            .number()
+            .int()
+            .optional()
+            .describe("Log files aggregated into the groups"),
+        groupCount: z
+            .number()
+            .int()
+            .optional()
+            .describe("Distinct processes before paging"),
+        ...pageShapeFor(z.union([ErrorLogFileSchema, ErrorLogGroupSchema])),
+    },
     input: {
         processName: z
             .string()
             .optional()
-            .describe("Optional process-name filter — matches both modern v11 'TM1ProcessError_<ts>_<id>_<processName>_<hash>.log' and legacy '<processName>_<ts>.log' filename patterns."),
+            .describe("Optional process-name filter — matches modern v11 'TM1ProcessError_<ts>_<id>_<processName>_<hash>.log', v12 'ProcessLog_<ts>_<id>_<processName>.jsonl' and legacy '<processName>_<ts>.log' filename patterns."),
         since: z
             .string()
             .optional()

package/dist/tools/schemas/items-fileops.d.ts

@@ -5,6 +5,10 @@ export declare const FileContentResultSchema: z.ZodObject<{
     returnedBytes: z.ZodNumber;
     truncated: z.ZodBoolean;
     truncationReason: z.ZodOptional<z.ZodString>;
+    encoding: z.ZodEnum<{
+        text: "text";
+        base64: "base64";
+    }>;
     content: z.ZodString;
 }, z.core.$strip>;
 export declare const FilenameItemSchema: z.ZodString;

package/dist/tools/schemas/items-fileops.js

@@ -6,6 +6,7 @@ export const FileContentResultSchema = z.object({
     returnedBytes: z.number().int(),
     truncated: z.boolean(),
     truncationReason: z.string().optional(),
+    encoding: z.enum(["text", "base64"]),
     content: z.string(),
 });
 // listFiles returns bare strings (file/folder names).

package/dist/tools/security/list-clients.js

@@ -30,9 +30,9 @@ function project(clients, fields, groupCount) {
         want.delete("groups");
     }
     return clients.map((c) => {
-        const out = {};
-        if (want.has("name"))
-            out.Name = c.Name;
+        // Name is the item key and required by ClientSchema, so every projection
+        // carries it — fields=['type'] without it failed the output schema.
+        const out = { Name: c.Name };
         if (want.has("friendlyName") && c.FriendlyName !== undefined)
             out.FriendlyName = c.FriendlyName;
         if (want.has("type") && c.Type !== undefined)
@@ -57,7 +57,7 @@ export const registerListClients = defineTool({
         fields: z
             .array(z.enum(FIELD_KEYS))
             .optional()
-            .describe("Projection: subset of ['name','friendlyName','type','enabled','groups','groupCount']. Omit for full default payload."),
+            .describe("Projection: subset of ['name','friendlyName','type','enabled','groups','groupCount']. Name is always included. Omit for full default payload."),
         groupCount: z
             .boolean()
             .optional()
@@ -77,7 +77,7 @@ export const registerListClients = defineTool({
                 header: "Groups",
                 get: (c) => c.groupCount !== undefined
                     ? `${c.groupCount} (count)`
-                    : (c.Groups ?? []).join(", "),
+                    : (c.Groups ?? []).map((g) => g.Name).join(", "),
             },
         ]);
         return pageResponse(projectedPage, format, { title: "Clients", columns });

package/dist/tools/security/list-groups.js

@@ -34,7 +34,7 @@ export const registerListGroups = defineTool({
                 header: "Clients",
                 get: (g) => "clientCount" in g
                     ? `${g.clientCount} (count)`
-                    : (g.Clients ?? []).join(", "),
+                    : (g.Clients ?? []).map((c) => c.Name).join(", "),
             },
         ]);
         return pageResponse(projectedPage, format, { title: "Groups", columns });

package/dist/tools/subsets/create-subset.js

@@ -6,7 +6,7 @@ import { defineTool } from "../define-tool.js";
 import { HIERARCHY_NAME_OPTIONAL, resolveHierarchy } from "../hierarchy.js";
 export const registerCreateSubset = defineTool({
     name: "tm1_create_subset",
-    description: "Create a public TM1 subset. Provide either expression (MDX-based, dynamic) OR elements (static list) — not both. Optional alias attribute name controls the displayed alias.",
+    description: "Create a TM1 subset, public by default or private with isPrivate=true (private subsets belong to the signed-in user and are invisible to others; the same name may exist once public and once private). Provide either expression (MDX-based, dynamic) OR elements (static list) — not both. Optional alias attribute name controls the displayed alias.",
     annotations: WRITE,
     output: MutationResultSchema,
     input: {
@@ -25,15 +25,19 @@ export const registerCreateSubset = defineTool({
             .string()
             .optional()
             .describe("Alias attribute used as display name in the subset"),
+        isPrivate: z
+            .boolean()
+            .optional()
+            .default(false)
+            .describe("Use PrivateSubsets (the signed-in user's) instead of public Subsets"),
     },
-    handler: async ({ dimensionName, hierarchyName, subsetName, expression, elements, alias }, tm1Client) => {
-        const hierarchy = resolveHierarchy(dimensionName, hierarchyName);
-        await tm1Client.subsets.create(dimensionName, hierarchy, {
+    handler: async ({ dimensionName, hierarchyName, subsetName, expression, elements, alias, isPrivate, }, tm1Client) => {
+        await tm1Client.subsets.create(dimensionName, resolveHierarchy(dimensionName, hierarchyName), {
             name: subsetName,
             expression,
             elements,
             alias,
-        });
+        }, isPrivate ?? false);
         return actionResponse({
             success: true,
             subsetName,

package/dist/tools/subsets/delete-subset.js

@@ -7,19 +7,24 @@ import { defineTool } from "../define-tool.js";
 import { HIERARCHY_NAME_OPTIONAL, resolveHierarchy } from "../hierarchy.js";
 export const registerDeleteSubset = defineTool({
     name: "tm1_delete_subset",
-    description: "Delete a public TM1 subset. Fails if the subset is referenced by views/processes (404 if not found). Irreversible — pass confirm=<subset name verbatim>.",
+    description: "Delete a TM1 subset, public by default or private with isPrivate=true. TM1 refuses to delete a subset a view still uses (SubsetIsBeingUsedByView) — change it with tm1_update_subset instead. 404 if not found. Irreversible — pass confirm=<subset name verbatim>.",
     annotations: DESTRUCTIVE,
     output: MutationResultSchema,
     input: {
         dimensionName: z.string().describe("Dimension name"),
         ...HIERARCHY_NAME_OPTIONAL,
         subsetName: z.string().describe("Subset to delete"),
+        isPrivate: z
+            .boolean()
+            .optional()
+            .default(false)
+            .describe("Use PrivateSubsets (the signed-in user's) instead of public Subsets"),
         ...CONFIRM_SCHEMA,
     },
-    handler: async ({ dimensionName, hierarchyName, subsetName, confirm }, tm1Client) => {
+    handler: async ({ dimensionName, hierarchyName, subsetName, isPrivate, confirm }, tm1Client) => {
         const hierarchy = resolveHierarchy(dimensionName, hierarchyName);
         requireConfirm(confirm, subsetName, "subset");
-        await tm1Client.subsets.delete(dimensionName, hierarchy, subsetName);
+        await tm1Client.subsets.delete(dimensionName, hierarchy, subsetName, isPrivate ?? false);
         return actionResponse({ success: true, subsetName });
     },
 });

package/dist/tools/subsets/update-subset.js

@@ -6,7 +6,7 @@ import { defineTool } from "../define-tool.js";
 import { HIERARCHY_NAME_OPTIONAL, resolveHierarchy } from "../hierarchy.js";
 export const registerUpdateSubset = defineTool({
     name: "tm1_update_subset",
-    description: "Update a public TM1 subset (partial). Pass expression to replace the MDX, or elements to switch the subset to a static list (resets Expression to ''). Pass alias to change the alias attribute.",
+    description: "Update an existing TM1 subset in place, public by default or private with isPrivate=true. The way to change a subset a view uses, since TM1 will not delete that one. Pass expression to replace the MDX, OR elements to replace the static list (order kept; an MDX subset becomes static; [] empties it) — not both. Pass alias to change the alias attribute. If the new list names an unknown element, TM1 refuses it and the old definition is written back.",
     annotations: IDEMPOTENT_WRITE,
     output: MutationResultSchema,
     input: {
@@ -17,16 +17,16 @@ export const registerUpdateSubset = defineTool({
         elements: z
             .array(z.string())
             .optional()
-            .describe("New static element list (clears MDX)"),
+            .describe("New static element list; replaces the old one and turns an MDX subset static. Mutually exclusive with expression."),
         alias: z.string().optional().describe("New alias attribute"),
+        isPrivate: z
+            .boolean()
+            .optional()
+            .default(false)
+            .describe("Use PrivateSubsets (the signed-in user's) instead of public Subsets"),
     },
-    handler: async ({ dimensionName, hierarchyName, subsetName, expression, elements, alias }, tm1Client) => {
-        const hierarchy = resolveHierarchy(dimensionName, hierarchyName);
-        await tm1Client.subsets.update(dimensionName, hierarchy, subsetName, {
-            expression,
-            elements,
-            alias,
-        });
+    handler: async ({ dimensionName, hierarchyName, subsetName, expression, elements, alias, isPrivate, }, tm1Client) => {
+        await tm1Client.subsets.update(dimensionName, resolveHierarchy(dimensionName, hierarchyName), subsetName, { expression, elements, alias }, isPrivate ?? false);
         return actionResponse({ success: true, subsetName });
     },
 });

package/dist/tools/ti-development/diff-process-with-file.js

@@ -5,8 +5,9 @@ import { TM1Error, TM1ErrorCode } from "../../types.js";
 import { parseProFile } from "../../lib/pro-parser.js";
 import { ignoredColumnsOf } from "../../lib/variables-ui-data.js";
 import { maskCode, resolveMaskSecrets } from "../../lib/mask-secrets.js";
+import { diffDs } from "./diff-processes.js";
 import { DiffProcessResultSchema } from "../schemas/items.js";
-import { READ_ONLY, withVersion } from "../annotations.js";
+import { READ_ONLY } from "../annotations.js";
 import { defineTool } from "../define-tool.js";
 function tabDiff(name, installed, file) {
     const norm = (s) => s.replace(/\r\n/g, "\n").trimEnd();
@@ -93,36 +94,10 @@ function diffIgnoredColumns(installed, file) {
         renamed,
     };
 }
-function diffDataSource(installed, file) {
-    const diffs = [];
-    if (installed.type !== file.type)
-        diffs.push(`type: ${installed.type} → ${file.type}`);
-    const fields = [
-        "dataSourceNameForServer",
-        "dataSourceNameForClient",
-        "asciiDelimiterChar",
-        "asciiQuoteCharacter",
-        "asciiDecimalSeparator",
-        "asciiThousandSeparator",
-        "asciiHeaderRecords",
-        "view",
-        "subset",
-        "userName",
-        // See diff-processes.ts: the ODBC query is substance, the password is noise.
-        "query",
-    ];
-    for (const f of fields) {
-        const a = installed[f];
-        const b = file[f];
-        if ((a ?? "") !== (b ?? ""))
-            diffs.push(`${String(f)}: ${JSON.stringify(a)} → ${JSON.stringify(b)}`);
-    }
-    return { identical: diffs.length === 0, differences: diffs };
-}
 export const registerDiffProcessWithFile = defineTool({
     name: "tm1_diff_process_with_file",
     description: "Compare an installed TI process on the server against a local .pro file. Returns per-tab identical flags + line counts, parameter diff (added/removed/changed), variable diff, and datasource diff. Use before tm1_import_pro_file to preview what will change.",
-    annotations: withVersion(READ_ONLY, "v11"),
+    annotations: READ_ONLY,
     output: DiffProcessResultSchema,
     input: {
         filePath: z
@@ -177,7 +152,7 @@ export const registerDiffProcessWithFile = defineTool({
         const params = diffParams(installedParams, parsed.parameters);
         const variables = diffVars(installedLayout.variables, parsed.variables);
         const ignoredColumns = diffIgnoredColumns(installedLayout.ignoredColumns, ignoredColumnsOf(parsed.variablesUIData));
-        const dataSource = diffDataSource(installedDs, parsed.dataSource);
+        const dataSource = diffDs(installedDs, parsed.dataSource);
         const allIdentical = tabs.every((t) => t.identical) &&
             params.added.length === 0 &&
             params.removed.length === 0 &&

package/dist/tools/ti-development/diff-processes.js

@@ -204,6 +204,7 @@ function diffIgnoredColumns(a, b) {
         renamed,
     };
 }
+// Shared with tm1_diff_process_with_file so both diffs check the same fields.
 export function diffDs(a, b) {
     const diffs = [];
     const fields = [
@@ -227,6 +228,14 @@ export function diffDs(a, b) {
         if ((a[f] ?? "") !== (b[f] ?? ""))
             diffs.push(`${String(f)}: ${JSON.stringify(a[f])} → ${JSON.stringify(b[f])}`);
     }
+    // Compared with their defaults filled in: the .pro parser sets the
+    // delimiter type only on ASCII sources and v12 never returns usesUnicode,
+    // so a bare comparison would report a difference nobody made.
+    const delimiter = (d) => d.type === "ASCII" ? (d.asciiDelimiterType ?? "Character") : undefined;
+    if (delimiter(a) !== delimiter(b))
+        diffs.push(`asciiDelimiterType: ${JSON.stringify(delimiter(a))} → ${JSON.stringify(delimiter(b))}`);
+    if ((a.usesUnicode ?? false) !== (b.usesUnicode ?? false))
+        diffs.push(`usesUnicode: ${JSON.stringify(a.usesUnicode ?? false)} → ${JSON.stringify(b.usesUnicode ?? false)}`);
     return { identical: diffs.length === 0, differences: diffs };
 }
 // ── tool ──────────────────────────────────────────────────────────────────────

package/dist/tools/ti-development/export-process-to-git.js

@@ -14,8 +14,8 @@ export const registerExportProcessToGit = defineTool({
     description: [
         "Serialize a TM1 process to the tm1-git two-file layout: a '{name}.json' (parameters, variables, ignored datasource columns, datasource) plus a '{name}.ti' (Prolog/Metadata/Data/Epilog as plain code).",
         "The .ti holds the code in TM1's native `Code` representation (#region <Tab> / #endregion, CRLF, empty tabs omitted); the .json holds the structure. Code lives outside the JSON so Git diffs stay readable.",
-        "Returns both file bodies (json + ti) inline by default. Pass writeToDir to persist them to disk instead: the code is then written to files and omitted from the response to avoid duplicating it into the context window; only metadata (filenames, counts, writtenTo paths) comes back. Round-trip safe with tm1_import_process_from_git.",
-        "Security: the ODBC datasource password is stripped unless includeDataSourcePassword is set (which also requires writeToDir); credential literals in the TI code are masked when maskSecrets is on; credentialsOmitted=true flags when a password was stripped.",
+        "Returns both file bodies (json + ti) inline by default. Pass writeToDir to persist them to disk instead: the code is then written to files and omitted from the response to avoid duplicating it into the context window; only metadata (filenames, counts, writtenTo paths) comes back. Files written via writeToDir are round-trip safe with tm1_import_process_from_git; the inline .ti has credential literals masked by default and is for reading, not re-importing.",
+        "Security: the ODBC datasource password is stripped unless includeDataSourcePassword is set (which also requires writeToDir); credential literals in the TI code are masked in the inline response when maskSecrets is on, never in written files (those must re-import intact); credentialsOmitted=true flags when a password was stripped.",
         "includeDataSourcePassword is v12-only: what v11 hands out expires with the server run, so exporting it would produce a file that looks complete and fails later.",
     ],
     annotations: READ_ONLY,
@@ -30,8 +30,7 @@ export const registerExportProcessToGit = defineTool({
             .boolean()
             .optional()
             .default(true)
-            .describe("Redact credential literals in the exported .ti code (inline and written file) and credential pairs (PWD=, UID=) in the datasource's ODBC connection string in the .json. " +
-            "Masks the password arg of ODBCOpen() and quoted values assigned to credential-named identifiers (pPwd, sToken, …). Default: true. Set false only when explicitly auditing credentials."),
+            .describe("Redact credential literals in the .ti code returned INLINE (password arg of ODBCOpen(), quoted values assigned to credential-named identifiers such as pPwd or sToken). Default: true. Files written via writeToDir always hold the code unmasked, so they re-import intact — treat them as containing any password literal the code has."),
         includeDataSourcePassword: z
             .boolean()
             .optional()
@@ -57,8 +56,11 @@ export const registerExportProcessToGit = defineTool({
         const pair = await readProcessAsGit(tm1Client, processName, {
             includePassword: includeDataSourcePassword === true,
         });
-        const mask = resolveMaskSecrets(maskSecrets) ? maskCode : (s) => s;
-        const ti = mask(pair.ti);
+        // The file is the deployable copy and gets the code as it is: a masked
+        // literal would re-import as broken code ('***' instead of the password).
+        // Masking applies to what goes back to the model — the inline body.
+        const ti = pair.ti;
+        const inlineTi = resolveMaskSecrets(maskSecrets) ? maskCode(ti) : ti;
         const { json, credentialsOmitted } = pair;
         const jsonFileName = `${processName}.json`;
         const tiFileName = `${processName}.ti`;
@@ -103,7 +105,7 @@ export const registerExportProcessToGit = defineTool({
                         // Echo the file bodies inline only when NOT persisting to disk. With
                         // writeToDir the caller already has the files, so returning the code
                         // would just duplicate thousands of tokens into the context window.
-                        ...(writeToDir ? {} : { json, ti }),
+                        ...(writeToDir ? {} : { json, ti: inlineTi }),
                     }),
                 },
             ],

package/dist/tools/ti-development/export-process-to-pro.js

@@ -7,7 +7,7 @@ import { maskCode, resolveMaskSecrets } from "../../lib/mask-secrets.js";
 import { supportsCredentialExport } from "../../lib/credential-format.js";
 import { TM1Error, TM1ErrorCode } from "../../types.js";
 import { ExportProcessToProResultSchema } from "../schemas/items.js";
-import { READ_ONLY, withVersion } from "../annotations.js";
+import { READ_ONLY } from "../annotations.js";
 import { defineTool } from "../define-tool.js";
 export const registerExportProcessToPro = defineTool({
     name: "tm1_export_process_to_pro",
@@ -15,10 +15,10 @@ export const registerExportProcessToPro = defineTool({
         "Reverse of tm1_import_pro_file: serialize a TM1 process back to a .pro file body.",
         "Fetches code (Prolog/Metadata/Data/Epilog), parameters, variables (including the columns set to Ignore), and datasource in parallel.",
         "Returns the .pro content inline by default; pass writeToFile to also persist to an absolute path on the MCP host.",
-        "Round-trip safe with tm1_import_pro_file — useful for syncing live server state into a Git repo.",
+        "A file written via writeToFile is round-trip safe with tm1_import_pro_file — useful for syncing live server state into a Git repo. The inline copy has credential literals masked by default and is for reading, not re-importing.",
         "NOT a drop-in replacement for the .pro file in TM1's Datadir: the output omits TM1's BOM, its '601' version header and CRLF line endings. Measured on 11.8: TM1 does load such a file at startup and rewrites it in its own dialect, but it decodes slot 565 with its own scheme — a password written here becomes garbage that TM1 then persists, so the process looks configured and fails at runtime. Deploy via tm1_import_pro_file, not by copying into the Datadir.",
     ],
-    annotations: withVersion(READ_ONLY, "v11"),
+    annotations: READ_ONLY,
     output: ExportProcessToProResultSchema,
     input: {
         processName: z.string().describe("Name of the TI process to export"),
@@ -30,8 +30,9 @@ export const registerExportProcessToPro = defineTool({
             .boolean()
             .optional()
             .default(true)
-            .describe("Redact credential literals in the exported code (inline and written file). Masks the password arg of ODBCOpen() and quoted values " +
-            "assigned to credential-named identifiers (pPwd, sToken, …). Default: true. Set false only when explicitly auditing credentials."),
+            .describe("Redact credential literals in the code returned INLINE (password arg of ODBCOpen(), quoted values assigned to credential-named " +
+            "identifiers such as pPwd or sToken). Default: true. A file written via writeToFile always holds the code unmasked, so it " +
+            "re-imports intact — treat it as containing any password literal the code has."),
         includeDataSourcePassword: z
             .boolean()
             .optional()
@@ -70,8 +71,10 @@ export const registerExportProcessToPro = defineTool({
         if (!includeDataSourcePassword)
             delete dataSource.password;
         const credentialsIncluded = Boolean(includeDataSourcePassword && dataSource.password);
-        const mask = resolveMaskSecrets(maskSecrets) ? maskCode : (s) => s;
-        const proContent = serializeToPro({
+        // The file is the deployable copy and gets the code as it is: a masked
+        // literal would re-import as broken code ('***' instead of the password).
+        // Masking applies to what goes back to the model — the inline body.
+        const build = (mask) => serializeToPro({
             name: processName,
             prolog: mask(code.prolog),
             metadata: mask(code.metadata),
@@ -84,6 +87,10 @@ export const registerExportProcessToPro = defineTool({
                 : {}),
             dataSource,
         });
+        const proContent = build((s) => s);
+        const inlineContent = resolveMaskSecrets(maskSecrets)
+            ? build(maskCode)
+            : proContent;
         let writtenTo = null;
         if (writeToFile) {
             const target = resolveLocalPath(writeToFile, "writeToFile");
@@ -107,7 +114,7 @@ export const registerExportProcessToPro = defineTool({
                         credentialsIncluded,
                         // Written to disk only when credentials are in play — otherwise
                         // the caller already has the body and it stays out of the context.
-                        ...(includeDataSourcePassword ? {} : { content: proContent }),
+                        ...(includeDataSourcePassword ? {} : { content: inlineContent }),
                     }),
                 },
             ],

package/dist/tools/ti-development/import-pro-file.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { TM1Error, TM1ErrorCode } from "../../types.js";
 import { parseProFile } from "../../lib/pro-parser.js";
 import { withToolHint } from "../error-format.js";
-import { IDEMPOTENT_DESTRUCTIVE, withVersion } from "../annotations.js";
+import { IDEMPOTENT_DESTRUCTIVE } from "../annotations.js";
 import { ImportProFileResultSchema } from "../schemas/items.js";
 import { defineTool } from "../define-tool.js";
 import { OVERWRITE_CONFIRM_SCHEMA, requireOverwriteConfirm, } from "../confirm.js";
@@ -13,7 +13,7 @@ import { backupProcess } from "./process-backup.js";
 export const registerImportProFile = defineTool({
     name: "tm1_import_pro_file",
     description: "Parse a TM1 .pro file (Tabs / Parameters / Variables / DataSource) and deploy the process in one call. Provide either filePath (absolute path on the MCP host) or content (the .pro file body as string). Modes: 'create' (fail if exists), 'update' (fail if missing), 'upsert' (default — create or update). A .pro carries an ODBC password only when it came from tm1_export_process_to_pro against a v12 database, which writes it in clear; TM1's own Datadir .pro encodes slot 565 in a form that cannot be replayed over REST, and v11 exports never contain a password at all. Pass dataSourcePassword in every other case.",
-    annotations: withVersion(IDEMPOTENT_DESTRUCTIVE, "v11"),
+    annotations: IDEMPOTENT_DESTRUCTIVE,
     output: ImportProFileResultSchema,
     input: {
         filePath: z
@@ -108,25 +108,14 @@ export const registerImportProFile = defineTool({
             data: parsed.data,
             epilog: parsed.epilog,
         }), `Code update failed after process '${processName}' was ${exists ? "located" : "created"}. PARTIAL APPLY: the process shell exists but tabs are stale/empty. Re-run tm1_import_pro_file with mode=update once root cause fixed, or tm1_delete_process to roll back.`);
-        // On an update the file replaces the whole definition, as the code tabs
-        // already do: an empty parameter list, variable layout or a None
-        // datasource is applied, not skipped. Skipping left the newer values in
-        // place, so importing an older version (a backup) did not restore it.
-        if (exists || parsed.parameters.length > 0) {
-            await withToolHint(tm1Client.processes.updateParameters(processName, parsed.parameters), `Parameter update failed for '${processName}'. Code applied but parameters missing. Inspect parsed parameters and re-run tm1_upsert_process with mode=update + parameters=[...] to recover.`);
-        }
-        // Ignored columns live only in the UI data, so a file can carry column
-        // layout with an empty variable list — patch on either.
-        if (exists ||
-            parsed.variables.length > 0 ||
-            parsed.variablesUIData.length > 0) {
-            await withToolHint(tm1Client.processes.updateVariables(processName, parsed.variables, parsed.variablesUIData.length > 0 || parsed.variables.length === 0
-                ? parsed.variablesUIData
-                : undefined), `Variable update failed for '${processName}'. Code+parameters applied but variables missing. tm1_upsert_process with mode=update + variables=[...] to recover.`);
-        }
-        if (exists || parsed.dataSource.type !== "None") {
-            await withToolHint(tm1Client.processes.updateDataSource(processName, parsed.dataSource), `Datasource update failed for '${processName}' (type=${parsed.dataSource.type}). Code+params+vars applied. Verify datasource credentials/path (ASCII file existence, ODBC DSN, view name) and re-run tm1_upsert_process with mode=update + dataSource={...} to recover.`);
-        }
+        // The file is the whole truth: an empty list or a None source is sent as
+        // well, because TM1 applies both (measured on 11.8 and 12.5) and skipping
+        // them left the removed parameters, variables and source on the server.
+        await withToolHint(tm1Client.processes.updateParameters(processName, parsed.parameters), `Parameter update failed for '${processName}'. Code applied but parameters missing. Inspect parsed parameters and re-run tm1_upsert_process with mode=update + parameters=[...] to recover.`);
+        // A file without a column-layout block leaves the server's layout as it
+        // is; one that carries it replaces it.
+        await withToolHint(tm1Client.processes.updateVariables(processName, parsed.variables, parsed.variablesUIData.length > 0 ? parsed.variablesUIData : undefined), `Variable update failed for '${processName}'. Code+parameters applied but variables missing. tm1_upsert_process with mode=update + variables=[...] to recover.`);
+        await withToolHint(tm1Client.processes.updateDataSource(processName, parsed.dataSource), `Datasource update failed for '${processName}' (type=${parsed.dataSource.type}). Code+params+vars applied. Verify datasource credentials/path (ASCII file existence, ODBC DSN, view name) and re-run tm1_upsert_process with mode=update + dataSource={...} to recover.`);
         return {
             content: [
                 {

package/dist/tools/ti-development/import-process-from-git.js

@@ -148,24 +148,14 @@ export const registerImportProcessFromGit = defineTool({
         // The parsed tabs were preflighted above; unplacedBlobContent() made
         // sure they cover this blob exactly, so what was checked is what deploys.
         await withToolHint(tm1Client.processes.updateCodeBlob(processName, ti.replace(/\r?\n/g, "\r\n")), `Code update failed after process '${processName}' was ${exists ? "located" : "created"}. PARTIAL APPLY: shell exists but tabs are stale/empty. Re-run with mode=update once root cause fixed, or tm1_delete_process to roll back.`);
-        // On an update the file replaces the whole definition, as the code tabs
-        // already do: an empty parameter list, variable layout or a None
-        // datasource is applied, not skipped. Skipping left the newer values in
-        // place, so importing an older version (a backup) did not restore it.
-        if (exists || parsed.parameters.length > 0) {
-            await withToolHint(tm1Client.processes.updateParameters(processName, parsed.parameters), `Parameter update failed for '${processName}'. Code applied but parameters missing. tm1_upsert_process with mode=update + parameters=[...] to recover.`);
-        }
-        // Ignored columns live only in the UI data, so a .json can carry column
-        // layout with an empty variable list — patch on either.
-        if (exists ||
-            parsed.variables.length > 0 ||
-            (parsed.variablesUIData?.length ?? 0) > 0) {
-            await withToolHint(tm1Client.processes.updateVariables(processName, parsed.variables, parsed.variablesUIData ??
-                (parsed.variables.length === 0 ? [] : undefined)), `Variable update failed for '${processName}'. Code+parameters applied but variables missing. tm1_upsert_process with mode=update + variables=[...] to recover.`);
-        }
-        if (exists || dataSource.type !== "None") {
-            await withToolHint(tm1Client.processes.updateDataSource(processName, dataSource), `Datasource update failed for '${processName}' (type=${dataSource.type}). Code+params+vars applied. For ODBC verify dataSourcePassword/DSN and re-run with mode=update.`);
-        }
+        // The file is the whole truth: an empty list or a None source is sent as
+        // well, because TM1 applies both (measured on 11.8 and 12.5) and skipping
+        // them left the removed parameters, variables and source on the server.
+        await withToolHint(tm1Client.processes.updateParameters(processName, parsed.parameters), `Parameter update failed for '${processName}'. Code applied but parameters missing. tm1_upsert_process with mode=update + parameters=[...] to recover.`);
+        // An export without variablesUIData (older format) leaves the server's
+        // column layout as it is; one that carries it replaces it.
+        await withToolHint(tm1Client.processes.updateVariables(processName, parsed.variables, parsed.variablesUIData), `Variable update failed for '${processName}'. Code+parameters applied but variables missing. tm1_upsert_process with mode=update + variables=[...] to recover.`);
+        await withToolHint(tm1Client.processes.updateDataSource(processName, dataSource), `Datasource update failed for '${processName}' (type=${dataSource.type}). Code+params+vars applied. For ODBC verify dataSourcePassword/DSN and re-run with mode=update.`);
         if (parsed.hasSecurityAccess !== undefined) {
             await withToolHint(tm1Client.processes.updateSecurityAccess(processName, parsed.hasSecurityAccess), `HasSecurityAccess update failed for '${processName}'. Code+params+vars+datasource applied. Re-run with mode=update once root cause fixed.`);
         }