apple-icloud-mcp 0.3.2 → 0.3.4

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Unofficial Apple Music, iCloud Calendar/Contacts/Mail, Apple Maps and WeatherKit tools for Claude Code",
-    "version": "0.3.2"
+    "version": "0.3.4"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "Apple iCloud",
       "source": "./",
       "description": "Apple Music playlists and library, iCloud Calendar, Contacts and Mail, Apple Maps, WeatherKit and iTunes search for Claude via MCP — runs anywhere, no Mac required. Unofficial; not affiliated with Apple.",
-      "version": "0.3.2",
+      "version": "0.3.4",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "apple-icloud",
   "displayName": "Apple iCloud",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Apple Music playlists and library, iCloud Calendar, Contacts and Mail, Apple Maps, WeatherKit and iTunes search for Claude via MCP — runs anywhere, no Mac required. Unofficial; not affiliated with Apple.",
   "author": {
     "name": "Chris Chall"
@@ -21,5 +21,5 @@
     "mcp"
   ],
   "skills": "./skills/",
-  "mcp": "./.mcp.json"
+  "mcpServers": "./.mcp.json"
 }

package/README.md

@@ -270,7 +270,7 @@ read in `DISPLAY_TZ` — so are calendar events stored without a time zone of th
 | `apple_music_get_ratings` | Whether you have loved or disliked songs, albums, playlists, music videos or stations — catalog or library ids — returning love, dislike or none per id. | read |  |
 | `apple_music_create_playlist` | Create a new playlist in your Apple Music library, optionally with tracks (up to 500 catalog or library song ids; added 100 at a time), a description, a folder and public visibility (not in APPLE_WRITE_MODE=additive). | additive |  |
 | `apple_music_add_playlist_tracks` | Append songs (up to 500 catalog or library ids) to the end of one of your library playlists. | additive |  |
-| `apple_music_create_folder` | Create a playlist folder in your Apple Music library, at the top level or inside another folder. | additive |  |
+| `apple_music_create_folder` | Create a playlist folder in your Apple Music library, at the top level or inside another folder. | all |  |
 | `apple_music_add_to_library` | Add catalog songs, albums, playlists or music videos to your Apple Music library by catalog id (up to 100 per type). | additive |  |
 | `apple_music_add_favorites` | Mark catalog songs, albums, playlists, artists or music videos as favorites (the star in Apple Music; favorite songs go to your Favorite Songs playlist), by catalog id, up to 100 per type. | additive |  |
 | `apple_music_set_rating` | Set your rating on a song, album, playlist, music video or station (catalog or library id): love, dislike, or none to clear it. | all |  |
@@ -351,7 +351,7 @@ read in `DISPLAY_TZ` — so are calendar events stored without a time zone of th
 | Value | What is registered |
 |---|---|
 | `none` | Read tools only. |
-| `additive` | Reads, plus writes that only **add** to your own account: create a (private) playlist or folder, append tracks, add to library/favorites, create an event (without attendees, and not in a calendar shared with other people) or a contact. Nothing existing is modified or removed and nothing is sent to anyone. |
+| `additive` | Reads, plus writes that only **add** to your own account: create a (private) playlist, append tracks, add to library/favorites, create an event (without attendees, and not in a calendar shared with other people) or a contact. Nothing existing is modified or removed and nothing is sent to anyone. |
 | `all` (default) | Everything. |
 
 Gated tools are not registered at all below their mode, so no prompt or injected instruction can call them.
@@ -363,13 +363,14 @@ An unrecognised value fails closed to `none`. `APPLE_SERVICES` (comma-separated:
 Irreversible actions and anything that reaches another person ask for confirmation first: **sending mail**,
 **deleting** an event, contact, playlist or library item, **removing or reordering** playlist tracks, and
 **creating or changing an event with attendees** (iCloud emails them). A client that can show a prompt
-(Claude Code) asks you directly. One that cannot (claude.ai) gets a two-step flow: the first call does nothing
+(Claude Code) asks you directly, unless `MCP_CONFIRM_ELICITATION=off`. One that cannot (claude.ai) gets a two-step flow: the first call does nothing
 and returns a preview plus a `confirmToken`; only a repeat call with that token acts, and it is refused if the
 target changed in between.
 
 | Variable | Meaning |
 |---|---|
 | `MCP_CONFIRM_MODE` | `ask-user` (default — the model must get your OK before repeating the call), `auto` (the model may confirm after reviewing the preview), `refuse` (never). Unknown values mean `refuse`. |
+| `MCP_CONFIRM_ELICITATION` | `on` (default) or `off`. `off` never shows a prompt, so every client gets the two-step flow under `MCP_CONFIRM_MODE`. Set it for a client that says it can prompt but never does (the gated call hangs — opencode 2.0.x). Any other value stays `on` (with a stderr warning). |
 | `MCP_CONFIRM_TTL_SECONDS` | How long a token is valid (default 600). |
 | `MCP_CONFIRM_SECRET` | Token signing key; random per process by default (on mcp-host, the host's per-child `MCP_HOST_CONFIRM_SECRET` beside an absolute `MCP_DATA_DIR` is used instead). Set it so a token survives a restart; spent tokens are recorded on disk (`confirm-spent.json`), so none can be replayed (unless `APPLE_STATE_CACHE=false` or the directory is unwritable — a warning says so). |
 
@@ -430,6 +431,7 @@ All optional; each service activates when its credentials are present. Values th
 | Variable | Meaning |
 |---|---|
 | `MCP_CONFIRM_MODE` | How confirm-gated writes (send mail, deletes, removing tracks, invitations) behave on a client with no prompt, like claude.ai: "ask-user" (default: preview + confirmToken, the model must get your OK), "auto", or "refuse". Unknown values mean refuse. |
+| `MCP_CONFIRM_ELICITATION` | "off" never shows a confirmation prompt, so every client gets the MCP_CONFIRM_MODE flow. Set it for a client that says it can prompt but never does (the gated call hangs, e.g. opencode 2.0.x). Any other value stays "on" (with a stderr warning). |
 | `MCP_CONFIRM_TTL_SECONDS` | Lifetime of a confirmToken in seconds (default 600). |
 | `MCP_CONFIRM_SECRET` 🔒 | Signing key for confirmTokens. Random per process by default; set it so a token issued just before a restart or redeploy still works (spent tokens are recorded on disk, so none can be replayed). |
 

package/THIRD_PARTY_NOTICES.md

@@ -22,7 +22,7 @@ MPL-2.0 is a file-level license: it covers ical.js's own files and does not exte
 
 | Package | Version | License | Source |
 |---|---|---|---|
-| @chrischall/mcp-utils | 2.13.1 | MIT | https://github.com/chrischall/mcp-utils |
+| @chrischall/mcp-utils | 3.0.0 | MIT | https://github.com/chrischall/mcp-utils |
 | @esbuild/aix-ppc64 | 0.28.2 | MIT | — |
 | @esbuild/android-arm | 0.28.2 | MIT | — |
 | @esbuild/android-arm64 | 0.28.2 | MIT | — |
@@ -113,7 +113,7 @@ MPL-2.0 is a file-level license: it covers ical.js's own files and does not exte
 
 ## License and notice texts
 
-### @chrischall/mcp-utils@2.13.1
+### @chrischall/mcp-utils@3.0.0
 
 - License: MIT
 - Source: https://github.com/chrischall/mcp-utils

package/dist/apple-keys.js

@@ -2,10 +2,14 @@ import { createPrivateKey } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { expandPath, readEnvVar, signEs256Jwt } from '@chrischall/mcp-utils';
 import { ConfigError, rememberSecret } from './errors.js';
-const PREFIX = {
-    music: 'APPLE_MUSIC',
-    maps: 'APPLE_MAPS',
-    weather: 'APPLE_WEATHERKIT',
+/**
+ * Each service's own key pair, spelled out in full (not built from a name
+ * stem) so every variable the server reads appears literally in the code.
+ */
+const OWN_VARS = {
+    music: { keyId: 'APPLE_MUSIC_KEY_ID', privateKey: 'APPLE_MUSIC_PRIVATE_KEY' },
+    maps: { keyId: 'APPLE_MAPS_KEY_ID', privateKey: 'APPLE_MAPS_PRIVATE_KEY' },
+    weather: { keyId: 'APPLE_WEATHERKIT_KEY_ID', privateKey: 'APPLE_WEATHERKIT_PRIVATE_KEY' },
 };
 /**
  * Accept the shapes a .p8 actually arrives in through an env block:
@@ -73,16 +77,16 @@ function readKeyFile(path, varName, service) {
  */
 export function resolveDeveloperKey(service, env = process.env) {
     const svcName = service;
-    const prefix = PREFIX[service];
+    const own = OWN_VARS[service];
     const teamId = readEnvVar('APPLE_TEAM_ID', { env });
-    const ownKeyId = readEnvVar(`${prefix}_KEY_ID`, { env });
-    const ownKey = readEnvVar(`${prefix}_PRIVATE_KEY`, { env });
+    const ownKeyId = readEnvVar(own.keyId, { env });
+    const ownKey = readEnvVar(own.privateKey, { env });
     const keyId = ownKeyId ?? readEnvVar('APPLE_KEY_ID', { env });
     let rawKey;
     let keyVar;
     if (ownKey !== undefined) {
         rawKey = ownKey;
-        keyVar = `${prefix}_PRIVATE_KEY`;
+        keyVar = own.privateKey;
     }
     else if (readEnvVar('APPLE_PRIVATE_KEY', { env }) !== undefined) {
         rawKey = readEnvVar('APPLE_PRIVATE_KEY', { env });
@@ -98,9 +102,9 @@ export function resolveDeveloperKey(service, env = process.env) {
     if (!teamId)
         missing.push('APPLE_TEAM_ID');
     if (!keyId)
-        missing.push(`APPLE_KEY_ID (or ${prefix}_KEY_ID)`);
+        missing.push(`APPLE_KEY_ID (or ${own.keyId})`);
     if (rawKey === undefined)
-        missing.push(`APPLE_PRIVATE_KEY (or ${prefix}_PRIVATE_KEY / APPLE_PRIVATE_KEY_PATH)`);
+        missing.push(`APPLE_PRIVATE_KEY (or ${own.privateKey} / APPLE_PRIVATE_KEY_PATH)`);
     if (missing.length === 0)
         assertPairMatches(service, env);
     if (missing.length > 0) {
@@ -116,7 +120,7 @@ export function resolveDeveloperKey(service, env = process.env) {
         teamId: teamId,
         keyId: keyId,
         privateKeyPem: pem,
-        source: `${ownKeyId ? `${prefix}_KEY_ID` : 'APPLE_KEY_ID'} + ${keyVar}`,
+        source: `${ownKeyId ? own.keyId : 'APPLE_KEY_ID'} + ${keyVar}`,
     };
 }
 /**
@@ -130,9 +134,9 @@ export function resolveDeveloperKey(service, env = process.env) {
  * APPLE_PRIVATE_KEY for one Music key) and is allowed.
  */
 function assertPairMatches(service, env) {
-    const prefix = PREFIX[service];
-    const ownKeyId = readEnvVar(`${prefix}_KEY_ID`, { env });
-    const ownKey = readEnvVar(`${prefix}_PRIVATE_KEY`, { env });
+    const own = OWN_VARS[service];
+    const ownKeyId = readEnvVar(own.keyId, { env });
+    const ownKey = readEnvVar(own.privateKey, { env });
     const sharedKeyId = readEnvVar('APPLE_KEY_ID', { env });
     const sharedKeyVar = readEnvVar('APPLE_PRIVATE_KEY', { env }) !== undefined
         ? 'APPLE_PRIVATE_KEY'
@@ -142,12 +146,12 @@ function assertPairMatches(service, env) {
     if (sharedKeyId === undefined || sharedKeyVar === undefined)
         return;
     if (ownKey !== undefined && ownKeyId === undefined) {
-        throw new ConfigError(service, `${prefix}_PRIVATE_KEY is set but ${prefix}_KEY_ID is not, and APPLE_KEY_ID belongs to the shared key in ${sharedKeyVar} — ` +
-            'a key id must name the key that signs the token.', [`${prefix}_KEY_ID`], `Set ${prefix}_KEY_ID to the Key ID of the key in ${prefix}_PRIVATE_KEY (Apple Developer portal → Keys), or unset ${prefix}_PRIVATE_KEY to use the shared key.`);
+        throw new ConfigError(service, `${own.privateKey} is set but ${own.keyId} is not, and APPLE_KEY_ID belongs to the shared key in ${sharedKeyVar} — ` +
+            'a key id must name the key that signs the token.', [own.keyId], `Set ${own.keyId} to the Key ID of the key in ${own.privateKey} (Apple Developer portal → Keys), or unset ${own.privateKey} to use the shared key.`);
     }
     if (ownKeyId !== undefined && ownKey === undefined && ownKeyId !== sharedKeyId) {
-        throw new ConfigError(service, `${prefix}_KEY_ID is set but ${prefix}_PRIVATE_KEY is not, and the shared key in ${sharedKeyVar} belongs to APPLE_KEY_ID — ` +
-            'a key id must name the key that signs the token.', [`${prefix}_PRIVATE_KEY`], `Set ${prefix}_PRIVATE_KEY to the .p8 contents of key ${prefix}_KEY_ID, or unset ${prefix}_KEY_ID to use the shared key.`);
+        throw new ConfigError(service, `${own.keyId} is set but ${own.privateKey} is not, and the shared key in ${sharedKeyVar} belongs to APPLE_KEY_ID — ` +
+            'a key id must name the key that signs the token.', [own.privateKey], `Set ${own.privateKey} to the .p8 contents of key ${own.keyId}, or unset ${own.keyId} to use the shared key.`);
     }
 }
 function serviceLabel(service) {

package/dist/bundle.js

@@ -35348,17 +35348,30 @@ function redactJsonCookie(quote) {
 function redactSecrets(text2) {
   return text2.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(GOOGLE_OAUTH_TOKEN_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_COOKIE_DQ_RE, redactJsonCookie('"')).replace(JSON_COOKIE_SQ_RE, redactJsonCookie("'")).replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_NUM_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
 }
+function messageOf(err) {
+  if (err instanceof Error)
+    return err.message;
+  return String(err);
+}
 var McpToolError, HEADER_NAME_RUN, BEARER_RE, JWT_RE, BASIC_AUTH_RE, SET_COOKIE_RE, COOKIE_HEADER_RE, API_KEY_RE, GOOGLE_OAUTH_TOKEN_RE, QUERY_SECRET_RE, OAUTH_CODE_RE, FORM_PASSWORD_RE, HEADER_SECRET_RE, AWS_SIGV4_RE, JSON_SECRET_KEYS, JSON_SECRET_DQ_RE, JSON_SECRET_SQ_RE, JSON_SECRET_NUM_RE, JSON_COOKIE_DQ_RE, JSON_COOKIE_SQ_RE, DQ_STRING_RE, SQ_STRING_RE, ERROR_REDACTION_INPUT_MAX;
 var init_errors3 = __esm({
   "node_modules/@chrischall/mcp-utils/dist/errors/index.js"() {
     McpToolError = class extends Error {
       /** Actionable remediation text, when one applies. */
       hint;
+      /** The upstream HTTP status this failure came from, when known. */
+      status;
+      /** What kind of failure this is, when the thrower knows. */
+      kind;
       constructor(message, opts) {
         super(message, opts?.cause !== void 0 ? { cause: opts.cause } : void 0);
         this.name = "McpToolError";
         if (opts?.hint !== void 0)
           this.hint = opts.hint;
+        if (opts?.status !== void 0)
+          this.status = opts.status;
+        if (opts?.kind !== void 0)
+          this.kind = opts.kind;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
@@ -35383,7 +35396,7 @@ var init_errors3 = __esm({
       // webhook signing secret (Stripe-style)
     ].map((p) => `\\b${p}`).join("|"), "g");
     GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-    QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+    QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
     OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
     FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
     HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -35394,6 +35407,8 @@ var init_errors3 = __esm({
       "api[_-]?secret",
       "(?:x[_-])?api[_-]?key",
       "private[_-]?key",
+      "code[_-]?verifier",
+      // PKCE; a bare `verifier` key is too generic for JSON
       `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
       // bounded like HEADER_SECRET_RE
       "(?:proxy-)?authorization",
@@ -35629,6 +35644,15 @@ ${JSON.stringify(preview, null, 2)}`,
   };
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (options.elicitation === false) {
+    return textResult({
+      confirmed: false,
+      dispatched: false,
+      action: options.action,
+      reason: "confirmation-unsupported",
+      note: options.unsupportedNote ? `${DISABLED_NOTE}. ${options.unsupportedNote}` : `${DISABLED_NOTE}.`
+    });
+  }
   if (response.kind === "missing") {
     if (callerAcceptsFormElicitation(ctx) === false) {
       return textResult({
@@ -35659,7 +35683,7 @@ ${JSON.stringify(preview, null, 2)}`,
     note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
   });
 }
-var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, STATE_PREFIX;
+var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, DISABLED_NOTE, STATE_PREFIX;
 var init_confirmation = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirmation.js"() {
     init_dist();
@@ -35670,6 +35694,7 @@ var init_confirmation = __esm({
     DEFAULT_REQUEST_KEY = "confirmation";
     DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
     UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+    DISABLED_NOTE = "Nothing was done because confirmation prompts are turned off for this server, and this action is never taken without one";
     STATE_PREFIX = "mcpu.confirm.v1.";
   }
 });
@@ -35823,7 +35848,7 @@ async function tokenConfirmation(action, fb) {
 }
 async function requireConfirmationWithFallback(ctx, options) {
   const { tokenFallback, ...confirmation } = options;
-  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+  if (tokenFallback && (options.elicitation === false || callerAcceptsFormElicitation(ctx) === false)) {
     return tokenConfirmation(options.action, tokenFallback);
   }
   return requireConfirmation(ctx, confirmation);
@@ -35862,7 +35887,7 @@ function readEnvVar(key, opts = {}) {
   if (typeof raw === "string") {
     const trimmed = raw.trim();
     if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
+      return opts.trim === false ? raw : trimmed;
     }
   }
   return opts.default;
@@ -36030,6 +36055,20 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
+function readConfirmElicitation(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_ELICITATION", { env })?.trim().toLowerCase();
+  if (!raw || raw === "on")
+    return "on";
+  if (raw === "off")
+    return "off";
+  const key = `elicitation:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_ELICITATION="${raw}" is not one of on, off; treating it as on.
+`);
+  }
+  return "on";
+}
 function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
   if (!raw)
@@ -36082,19 +36121,29 @@ function boundArgs(args) {
 }
 function confirmationFromEnv(options) {
   const { tool, account, confirmToken, subject, instruction, args, env = process.env, spent: callerSpent, ...rest } = options;
+  if (args === void 0 || args === null) {
+    throw new TypeError(`confirmationFromEnv: ${tool} passed no args; pass the tool's validated arguments ({} for a tool with none).`);
+  }
   const spent = callerSpent ?? spentTokenStoreFromEnv(env);
   const mode = readConfirmMode(env);
   const ttlSeconds = readConfirmTtl(env);
-  const bound = args === void 0 ? void 0 : boundArgs(args);
-  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const elicitationOff = readConfirmElicitation(env) === "off";
+  const bound = boundArgs(args);
+  const elicitationBound = account === void 0 ? { args: bound } : { account, args: bound };
+  const bindingAdded = rest.binding ? rest : {
+    ...rest,
+    binding: { key: confirmKeyFromEnv(env), args: elicitationBound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 }
+  };
+  const confirmation = elicitationOff ? { ...bindingAdded, elicitation: false } : bindingAdded;
   if (mode === "refuse" || ttlSeconds === void 0) {
-    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const reason = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const hint = elicitationOff ? `${ELICITATION_OFF_HINT} ${reason}` : reason;
     return {
       ...confirmation,
       unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
     };
   }
-  const boundSubject = bound === void 0 ? subject : async () => {
+  const boundSubject = async () => {
     const read = await subject();
     if ("content" in read)
       return read;
@@ -36114,7 +36163,7 @@ function confirmationFromEnv(options) {
     }
   };
 }
-var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, BAD_TTL_HINT;
+var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, ELICITATION_OFF_HINT, BAD_TTL_HINT;
 var init_confirm_env = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js"() {
     init_config();
@@ -36126,6 +36175,7 @@ var init_confirm_env = __esm({
     fileStores = /* @__PURE__ */ new Map();
     CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
     REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+    ELICITATION_OFF_HINT = "MCP_CONFIRM_ELICITATION=off on the server turns confirmation prompts off.";
     BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
   }
 });
@@ -36146,12 +36196,14 @@ var init_merge_write = __esm({
 
 // node_modules/@chrischall/mcp-utils/dist/server/index.js
 function hintResultOrRethrow(err) {
+  if (err instanceof ProtocolError && err.code === ProtocolErrorCode.UrlElicitationRequired)
+    throw err;
   if (err instanceof McpToolError && err.hint) {
     return errorResult(`${err.message}
 
 Hint: ${err.hint}`);
   }
-  throw err;
+  return errorResult(messageOf(err));
 }
 function mcpRequestFrom(args) {
   const ctx = args.at(-1);
@@ -36222,7 +36274,10 @@ function surfaceToolHints(server) {
   ));
 }
 async function createMcpServer(opts) {
-  const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
+  const server = new McpServer({ name: opts.name, version: opts.version }, {
+    supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS],
+    ...opts.maxToolInputElements !== void 0 ? { maxToolInputElements: opts.maxToolInputElements } : {}
+  });
   if (opts.surfaceHints !== false)
     surfaceToolHints(server);
   if (opts.banner !== void 0) {
@@ -36367,6 +36422,7 @@ var init_write = __esm({
 var init_output = __esm({
   "node_modules/@chrischall/mcp-utils/dist/fs/output.js"() {
     init_config();
+    init_errors3();
     init_confine();
     init_write();
   }
@@ -36438,6 +36494,7 @@ var init_scrape = __esm({
 // node_modules/@chrischall/mcp-utils/dist/http/throttle.js
 var init_throttle = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/throttle.js"() {
+    init_cancel();
   }
 });
 
@@ -36446,6 +36503,8 @@ function createResponseCache(opts) {
   const now = opts.now ?? Date.now;
   const maxEntries = opts.maxEntries ?? RESPONSE_CACHE_MAX_ENTRIES;
   const store2 = /* @__PURE__ */ new Map();
+  const inflight2 = /* @__PURE__ */ new Map();
+  let generation = 0;
   const ttlFor = (tier) => opts.ttlMs[tier] ?? 0;
   function evictForInsert() {
     if (store2.size < maxEntries)
@@ -36482,25 +36541,77 @@ function createResponseCache(opts) {
       store2.delete(key);
     store2.set(key, { expiresAt: now() + ttl, value });
   }
-  return {
-    get,
-    set: set2,
-    async fetchThrough(key, load, tier = "dynamic") {
+  function startLoad(key, load, tier, signal) {
+    const gen = generation;
+    const shared = (async () => load())().then((value) => {
+      if (gen === generation)
+        set2(key, value, tier);
+      return value;
+    });
+    const entry = { promise: shared, signal };
+    inflight2.set(key, entry);
+    const drop = () => {
+      if (inflight2.get(key) === entry)
+        inflight2.delete(key);
+    };
+    shared.then(drop, drop);
+    return entry;
+  }
+  async function fetchThrough(key, load, tier = "dynamic", options = {}) {
+    const { signal } = options;
+    for (; ; ) {
+      signal?.throwIfAborted();
       const hit = get(key);
       if (hit !== void 0)
         return hit;
-      const value = await load();
-      set2(key, value, tier);
-      return value;
-    },
+      const pending = inflight2.get(key);
+      if (!pending)
+        return withSignal(startLoad(key, load, tier, signal).promise, signal);
+      try {
+        return await withSignal(pending.promise, signal);
+      } catch (err) {
+        const cancelled = pending.signal?.aborted === true || isCancellation(err);
+        if (cancelled && !signal?.aborted)
+          continue;
+        throw err;
+      }
+    }
+  }
+  return {
+    get,
+    set: set2,
+    fetchThrough,
     clear() {
       store2.clear();
+      inflight2.clear();
+      generation += 1;
     },
     get size() {
       return store2.size;
     }
   };
 }
+function withSignal(promise2, signal) {
+  if (!signal)
+    return promise2;
+  return new Promise((resolve6, reject) => {
+    const onAbort = () => reject(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise2.then((v) => {
+      signal.removeEventListener("abort", onAbort);
+      resolve6(v);
+    }, (e) => {
+      signal.removeEventListener("abort", onAbort);
+      reject(e);
+    });
+  });
+}
+function isCancellation(err) {
+  if (typeof err !== "object" || err === null)
+    return false;
+  const name2 = err.name;
+  return name2 === "AbortError" || name2 === "CancelledError" || name2 === "CanceledError";
+}
 var RESPONSE_CACHE_MAX_ENTRIES;
 var init_response_cache = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/response-cache.js"() {
@@ -36524,6 +36635,31 @@ var init_net_atoms = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/http/body-limit.js
+var init_body_limit = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/http/body-limit.js"() {
+    init_errors3();
+  }
+});
+
+// node_modules/@chrischall/mcp-utils/dist/http/fetch-bounded.js
+var init_fetch_bounded = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/http/fetch-bounded.js"() {
+    init_cancel();
+    init_errors3();
+    init_body_limit();
+    init_http();
+  }
+});
+
+// node_modules/@chrischall/mcp-utils/dist/http/url-safety.js
+var init_url_safety = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/http/url-safety.js"() {
+    init_errors3();
+    init_config();
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/internal/retry-after.js
 var init_retry_after = __esm({
   "node_modules/@chrischall/mcp-utils/dist/internal/retry-after.js"() {
@@ -36566,7 +36702,11 @@ var init_http = __esm({
     init_throttle();
     init_response_cache();
     init_net_atoms();
+    init_fetch_bounded();
+    init_url_safety();
+    init_body_limit();
     init_net_atoms();
+    init_url_safety();
     init_retry_after();
     EDGE_BLOCK_SCAN_MAX = 8 * 1024;
     EDGE_BLOCK_MARKERS = [
@@ -36631,6 +36771,7 @@ var init_concurrency = __esm({
 // node_modules/@chrischall/mcp-utils/dist/dates/index.js
 var init_dates = __esm({
   "node_modules/@chrischall/mcp-utils/dist/dates/index.js"() {
+    init_config();
   }
 });
 
@@ -36664,7 +36805,7 @@ var init_zod2 = __esm({
     NonNegInt = external_exports.number().int().nonnegative();
     NonEmptyString = external_exports.string().min(1);
     IsoDate = external_exports.iso.date();
-    IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30");
+    IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30").overwrite((v) => v.padStart(5, "0"));
     NumericIdString = external_exports.string().regex(/^\d+$/, "must be a numeric id (digits only)").describe("A numeric id string (digits only), safe to interpolate into a URL path.");
     SafePathSegment = external_exports.string().min(1).regex(/^[^/?#\s]+$/, 'must not contain "/", "?", "#", or whitespace').refine((v) => !v.includes(".."), 'must not contain ".."').describe('A single URL path segment, safe to interpolate: no "/", "..", "?", "#", or whitespace.');
     schemaOrigin = external_exports.string().optional().describe("Portal origin (e.g. https://<vendor>.example.co) selecting which active session to use. Optional when only one session is active.");
@@ -36743,6 +36884,7 @@ var init_auth = __esm({
     init_config();
     init_errors3();
     init_http();
+    init_cancel();
     init_cached_token();
     init_es256();
   }
@@ -36772,7 +36914,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "0.3.2";
+    VERSION = "0.3.4";
   }
 });
 
@@ -36793,7 +36935,7 @@ function errorMessage(err) {
   if (err instanceof Error) return scrub(err.message);
   return scrub(String(err));
 }
-var AppleToolError, ConfigError, CredentialsRejectedError, UpstreamError, ResponseTooLargeError, TransportError, InvalidArgumentError, UnconfirmedWriteError, secretLiterals, PEM_PRIVATE_KEY_RE;
+var AppleToolError, ConfigError, CredentialsRejectedError, UpstreamError, ResponseTooLargeError2, TransportError, InvalidArgumentError, UnconfirmedWriteError, secretLiterals, PEM_PRIVATE_KEY_RE;
 var init_errors4 = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -36842,7 +36984,7 @@ var init_errors4 = __esm({
         if (opts.upstreamCode !== void 0) this.upstreamCode = opts.upstreamCode;
       }
     };
-    ResponseTooLargeError = class extends UpstreamError {
+    ResponseTooLargeError2 = class extends UpstreamError {
       constructor(service, status2, message) {
         super(service, status2, message);
         this.name = "ResponseTooLargeError";
@@ -36921,16 +37063,16 @@ function readKeyFile(path2, varName, service) {
 }
 function resolveDeveloperKey(service, env = process.env) {
   const svcName = service;
-  const prefix = PREFIX2[service];
+  const own2 = OWN_VARS[service];
   const teamId = readEnvVar("APPLE_TEAM_ID", { env });
-  const ownKeyId = readEnvVar(`${prefix}_KEY_ID`, { env });
-  const ownKey = readEnvVar(`${prefix}_PRIVATE_KEY`, { env });
+  const ownKeyId = readEnvVar(own2.keyId, { env });
+  const ownKey = readEnvVar(own2.privateKey, { env });
   const keyId = ownKeyId ?? readEnvVar("APPLE_KEY_ID", { env });
   let rawKey;
   let keyVar;
   if (ownKey !== void 0) {
     rawKey = ownKey;
-    keyVar = `${prefix}_PRIVATE_KEY`;
+    keyVar = own2.privateKey;
   } else if (readEnvVar("APPLE_PRIVATE_KEY", { env }) !== void 0) {
     rawKey = readEnvVar("APPLE_PRIVATE_KEY", { env });
     keyVar = "APPLE_PRIVATE_KEY";
@@ -36941,8 +37083,8 @@ function resolveDeveloperKey(service, env = process.env) {
   }
   const missing = [];
   if (!teamId) missing.push("APPLE_TEAM_ID");
-  if (!keyId) missing.push(`APPLE_KEY_ID (or ${prefix}_KEY_ID)`);
-  if (rawKey === void 0) missing.push(`APPLE_PRIVATE_KEY (or ${prefix}_PRIVATE_KEY / APPLE_PRIVATE_KEY_PATH)`);
+  if (!keyId) missing.push(`APPLE_KEY_ID (or ${own2.keyId})`);
+  if (rawKey === void 0) missing.push(`APPLE_PRIVATE_KEY (or ${own2.privateKey} / APPLE_PRIVATE_KEY_PATH)`);
   if (missing.length === 0) assertPairMatches(service, env);
   if (missing.length > 0) {
     throw new ConfigError(
@@ -36967,30 +37109,30 @@ function resolveDeveloperKey(service, env = process.env) {
     teamId,
     keyId,
     privateKeyPem: pem,
-    source: `${ownKeyId ? `${prefix}_KEY_ID` : "APPLE_KEY_ID"} + ${keyVar}`
+    source: `${ownKeyId ? own2.keyId : "APPLE_KEY_ID"} + ${keyVar}`
   };
 }
 function assertPairMatches(service, env) {
-  const prefix = PREFIX2[service];
-  const ownKeyId = readEnvVar(`${prefix}_KEY_ID`, { env });
-  const ownKey = readEnvVar(`${prefix}_PRIVATE_KEY`, { env });
+  const own2 = OWN_VARS[service];
+  const ownKeyId = readEnvVar(own2.keyId, { env });
+  const ownKey = readEnvVar(own2.privateKey, { env });
   const sharedKeyId = readEnvVar("APPLE_KEY_ID", { env });
   const sharedKeyVar = readEnvVar("APPLE_PRIVATE_KEY", { env }) !== void 0 ? "APPLE_PRIVATE_KEY" : readEnvVar("APPLE_PRIVATE_KEY_PATH", { env }) !== void 0 ? "APPLE_PRIVATE_KEY_PATH" : void 0;
   if (sharedKeyId === void 0 || sharedKeyVar === void 0) return;
   if (ownKey !== void 0 && ownKeyId === void 0) {
     throw new ConfigError(
       service,
-      `${prefix}_PRIVATE_KEY is set but ${prefix}_KEY_ID is not, and APPLE_KEY_ID belongs to the shared key in ${sharedKeyVar} \u2014 a key id must name the key that signs the token.`,
-      [`${prefix}_KEY_ID`],
-      `Set ${prefix}_KEY_ID to the Key ID of the key in ${prefix}_PRIVATE_KEY (Apple Developer portal \u2192 Keys), or unset ${prefix}_PRIVATE_KEY to use the shared key.`
+      `${own2.privateKey} is set but ${own2.keyId} is not, and APPLE_KEY_ID belongs to the shared key in ${sharedKeyVar} \u2014 a key id must name the key that signs the token.`,
+      [own2.keyId],
+      `Set ${own2.keyId} to the Key ID of the key in ${own2.privateKey} (Apple Developer portal \u2192 Keys), or unset ${own2.privateKey} to use the shared key.`
     );
   }
   if (ownKeyId !== void 0 && ownKey === void 0 && ownKeyId !== sharedKeyId) {
     throw new ConfigError(
       service,
-      `${prefix}_KEY_ID is set but ${prefix}_PRIVATE_KEY is not, and the shared key in ${sharedKeyVar} belongs to APPLE_KEY_ID \u2014 a key id must name the key that signs the token.`,
-      [`${prefix}_PRIVATE_KEY`],
-      `Set ${prefix}_PRIVATE_KEY to the .p8 contents of key ${prefix}_KEY_ID, or unset ${prefix}_KEY_ID to use the shared key.`
+      `${own2.keyId} is set but ${own2.privateKey} is not, and the shared key in ${sharedKeyVar} belongs to APPLE_KEY_ID \u2014 a key id must name the key that signs the token.`,
+      [own2.privateKey],
+      `Set ${own2.privateKey} to the .p8 contents of key ${own2.keyId}, or unset ${own2.keyId} to use the shared key.`
     );
   }
 }
@@ -37035,16 +37177,16 @@ function decodeJwtPayload(token) {
     return void 0;
   }
 }
-var PREFIX2, PEM_BLOCK_RE, MUSIC_TOKEN_TTL_S, MAPS_AUTH_TOKEN_TTL_S, WEATHERKIT_TOKEN_TTL_S;
+var OWN_VARS, PEM_BLOCK_RE, MUSIC_TOKEN_TTL_S, MAPS_AUTH_TOKEN_TTL_S, WEATHERKIT_TOKEN_TTL_S;
 var init_apple_keys = __esm({
   "src/apple-keys.ts"() {
     "use strict";
     init_dist2();
     init_errors4();
-    PREFIX2 = {
-      music: "APPLE_MUSIC",
-      maps: "APPLE_MAPS",
-      weather: "APPLE_WEATHERKIT"
+    OWN_VARS = {
+      music: { keyId: "APPLE_MUSIC_KEY_ID", privateKey: "APPLE_MUSIC_PRIVATE_KEY" },
+      maps: { keyId: "APPLE_MAPS_KEY_ID", privateKey: "APPLE_MAPS_PRIVATE_KEY" },
+      weather: { keyId: "APPLE_WEATHERKIT_KEY_ID", privateKey: "APPLE_WEATHERKIT_PRIVATE_KEY" }
     };
     PEM_BLOCK_RE = /-----BEGIN ([A-Z0-9 ]+)-----([\s\S]*?)-----END \1-----/;
     MUSIC_TOKEN_TTL_S = 12 * 60 * 60;
@@ -37617,23 +37759,23 @@ function systemTimeZone() {
 function getRequestTimeoutMs(env = process.env) {
   const v = readIntEnv("APPLE_REQUEST_TIMEOUT_MS", {
     env,
-    default: DEFAULT_REQUEST_TIMEOUT_MS,
+    default: DEFAULT_REQUEST_TIMEOUT_MS2,
     min: 1e3,
     max: MAX_REQUEST_TIMEOUT_MS
   });
-  return v ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  return v ?? DEFAULT_REQUEST_TIMEOUT_MS2;
 }
 function isDebugLog(env = process.env) {
   return parseBoolEnv("APPLE_DEBUG_LOG", { env });
 }
-var SERVICES, warnedServices, WRITE_MODES, warnedWriteMode, warnedTz, DEFAULT_REQUEST_TIMEOUT_MS, MAX_REQUEST_TIMEOUT_MS;
+var SERVICES, warnedServices, WRITE_MODES, warnedWriteMode, warnedTz, DEFAULT_REQUEST_TIMEOUT_MS2, MAX_REQUEST_TIMEOUT_MS;
 var init_config2 = __esm({
   "src/config.ts"() {
     "use strict";
     init_dist2();
     SERVICES = ["music", "calendar", "contacts", "mail", "maps", "weather", "itunes"];
     WRITE_MODES = ["none", "additive", "all"];
-    DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+    DEFAULT_REQUEST_TIMEOUT_MS2 = 3e4;
     MAX_REQUEST_TIMEOUT_MS = 6e5;
   }
 });
@@ -38125,7 +38267,7 @@ async function httpRequest(req) {
         if (mayHaveLanded) {
           throw new UnconfirmedWriteError(req.service, `${what} (HTTP ${res.status}); the change may have been applied.`);
         }
-        throw new ResponseTooLargeError(req.service, res.status, `${what}.`);
+        throw new ResponseTooLargeError2(req.service, res.status, `${what}.`);
       }
       const timedOut = controller.signal.aborted;
       const why = timedOut ? `timed out reading the response after ${timeoutMs} ms` : `lost the connection reading the response`;
@@ -38568,6 +38710,7 @@ var init_session = __esm({
   "node_modules/@chrischall/mcp-utils/dist/session/index.js"() {
     init_response();
     init_config();
+    init_errors3();
     init_http();
     init_edge_block();
     init_login_page();
@@ -46129,6 +46272,9 @@ function confirmWrite(ctx, opts) {
       details: opts.preview,
       unsupportedNote: "Make this change in the Apple app (Music, Calendar, Contacts or Mail) instead.",
       tool: opts.tool,
+      // Single-account server: every write acts as the one set of credentials in the env
+      // (ICLOUD_USERNAME / the Apple Music user token), so there is no principal to choose between.
+      account: void 0,
       confirmToken: opts.confirmToken,
       args: opts.args,
       // Built per call: the data dir, APPLE_STATE_CACHE and the key are read now.
@@ -56649,7 +56795,11 @@ function registerCalendarTools(server, deps = {}) {
       attendees: attendeesParam.optional().describe("People to invite. iCloud emails each one an invitation."),
       confirmToken: confirmTokenParam
     }),
-    annotations: ANNOTATIONS.additive,
+    // With APPLE_WRITE_MODE=all it accepts attendees, and iCloud emails each an
+    // invitation: that reaches another person, and apple_calendar_delete_event
+    // cannot un-send it, so it is destructive there. APPLE_WRITE_MODE=additive
+    // refuses attendees and shared calendars, leaving a plain, deletable addition.
+    annotations: accessAllowed("all") ? ANNOTATIONS.send : ANNOTATIONS.additive,
     handler: async (args, ctx) => {
       const zones2 = resolveZones(args.timeZone);
       const { zone } = zones2;
@@ -57853,7 +58003,7 @@ async function downloadInBatches(session, into) {
     try {
       res = await session.client.report(session.bookUrl, addressbookMultigetBody(batch), 1);
     } catch (err) {
-      if (!(err instanceof ResponseTooLargeError)) throw err;
+      if (!(err instanceof ResponseTooLargeError2)) throw err;
       if (batch.length === 1) {
         into.tooLarge += 1;
         return;
@@ -57881,7 +58031,7 @@ async function download(session, version4) {
   try {
     res = await session.client.report(session.bookUrl, addressbookQueryBody(ADDRESS_DATA_PROPS), 1);
   } catch (err) {
-    if (!(err instanceof ResponseTooLargeError)) throw err;
+    if (!(err instanceof ResponseTooLargeError2)) throw err;
   }
   if (res) {
     into.unreadable += res.skipped;
@@ -122577,14 +122727,17 @@ function registerLibraryWriteTools(server, client) {
   defineTool(server, {
     name: "apple_music_create_folder",
     service: "music",
-    access: "additive",
+    // No tool in this server removes a playlist folder (delete_playlist deletes playlists only), so a created
+    // folder cannot be undone here: destructive by the inverse test, and so outside APPLE_WRITE_MODE=additive,
+    // whose promise is that every write it registers is non-destructive.
+    access: "all",
     title: "Create an Apple Music playlist folder",
     description: "Create a playlist folder in your Apple Music library, at the top level or inside another folder. Returns the new folder id (p.\u2026) for apple_music_create_playlist / apple_music_move_playlist. Needs APPLE_MUSIC_USER_TOKEN or web-player mode.",
     inputSchema: external_exports.strictObject({
       name: external_exports.string().trim().min(1).max(200).describe("Folder name."),
       parentFolderId: external_exports.string().min(1).max(140).optional().describe('Create it inside this folder (p.\u2026; default "root", the top level).')
     }),
-    annotations: ANNOTATIONS.additive,
+    annotations: { ...ANNOTATIONS.additive, destructiveHint: true },
     handler: async (args) => {
       const parent = folderIdArg(args.parentFolderId ?? "root");
       assertLibraryPlaylistId(parent, "parentFolderId", "folder");

package/dist/calendar/tools.js

@@ -471,7 +471,11 @@ export function registerCalendarTools(server, deps = {}) {
             attendees: attendeesParam.optional().describe('People to invite. iCloud emails each one an invitation.'),
             confirmToken: confirmTokenParam,
         }),
-        annotations: ANNOTATIONS.additive,
+        // With APPLE_WRITE_MODE=all it accepts attendees, and iCloud emails each an
+        // invitation: that reaches another person, and apple_calendar_delete_event
+        // cannot un-send it, so it is destructive there. APPLE_WRITE_MODE=additive
+        // refuses attendees and shared calendars, leaving a plain, deletable addition.
+        annotations: accessAllowed('all') ? ANNOTATIONS.send : ANNOTATIONS.additive,
         handler: async (args, ctx) => {
             const zones = resolveZones(args.timeZone);
             const { zone } = zones;

package/dist/music/tools-write.js

@@ -302,7 +302,10 @@ export function registerLibraryWriteTools(server, client) {
     defineTool(server, {
         name: 'apple_music_create_folder',
         service: 'music',
-        access: 'additive',
+        // No tool in this server removes a playlist folder (delete_playlist deletes playlists only), so a created
+        // folder cannot be undone here: destructive by the inverse test, and so outside APPLE_WRITE_MODE=additive,
+        // whose promise is that every write it registers is non-destructive.
+        access: 'all',
         title: 'Create an Apple Music playlist folder',
         description: 'Create a playlist folder in your Apple Music library, at the top level or inside another folder. Returns the new ' +
             'folder id (p.…) for apple_music_create_playlist / apple_music_move_playlist. Needs APPLE_MUSIC_USER_TOKEN or web-player mode.',
@@ -310,7 +313,7 @@ export function registerLibraryWriteTools(server, client) {
             name: z.string().trim().min(1).max(200).describe('Folder name.'),
             parentFolderId: z.string().min(1).max(140).optional().describe('Create it inside this folder (p.…; default "root", the top level).'),
         }),
-        annotations: ANNOTATIONS.additive,
+        annotations: { ...ANNOTATIONS.additive, destructiveHint: true },
         handler: async (args) => {
             const parent = folderIdArg(args.parentFolderId ?? 'root');
             assertLibraryPlaylistId(parent, 'parentFolderId', 'folder');

package/dist/tools/_confirm.js

@@ -40,6 +40,9 @@ export function confirmWrite(ctx, opts) {
         details: opts.preview,
         unsupportedNote: 'Make this change in the Apple app (Music, Calendar, Contacts or Mail) instead.',
         tool: opts.tool,
+        // Single-account server: every write acts as the one set of credentials in the env
+        // (ICLOUD_USERNAME / the Apple Music user token), so there is no principal to choose between.
+        account: undefined,
         confirmToken: opts.confirmToken,
         args: opts.args,
         // Built per call: the data dir, APPLE_STATE_CACHE and the key are read now.

package/dist/version.js

@@ -1,4 +1,4 @@
 // The server's self-reported version. release-please bumps this line (it is
 // registered in release-please-config.json `extra-files`); tests/version-sync
 // fails CI if it ever drifts from package.json.
-export const VERSION = '0.3.2'; // x-release-please-version
+export const VERSION = '0.3.4'; // x-release-please-version

package/mint.yaml

@@ -59,6 +59,13 @@ env:
       invitations) behave on a client with no prompt, like claude.ai: "ask-user"
       (default: preview + confirmToken, the model must get your OK), "auto", or
       "refuse". Unknown values mean refuse.
+  - name: MCP_CONFIRM_ELICITATION
+    required: false
+    help: >-
+      "off" never shows a confirmation prompt, so every client gets the
+      MCP_CONFIRM_MODE flow. Set it for a client that says it can prompt but
+      never does (the gated call hangs, e.g. opencode 2.0.x). Any other value
+      stays "on" (with a stderr warning).
   - name: MCP_CONFIRM_SECRET
     secret: true
     required: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-icloud-mcp",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "license": "MIT",
   "mcpName": "io.github.chrischall/apple-icloud-mcp",
   "description": "Unofficial MCP server for Apple's services — Apple Music playlists and library, iCloud Calendar, Contacts and Mail, Apple Maps, WeatherKit and iTunes search — that runs anywhere, no Mac needed. Not affiliated with Apple. Developed and maintained by AI (Claude Code)",
@@ -54,7 +54,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.13.1",
+    "@chrischall/mcp-utils": "^3.0.0",
     "@modelcontextprotocol/server": "^2.3.0",
     "@xmldom/xmldom": "^0.9.12",
     "dotenv": "^18.0.5",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/apple-icloud-mcp",
     "source": "github"
   },
-  "version": "0.3.2",
+  "version": "0.3.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "apple-icloud-mcp",
-      "version": "0.3.2",
+      "version": "0.3.4",
       "transport": {
         "type": "stdio"
       },
@@ -193,6 +193,12 @@
           "isRequired": false,
           "format": "string"
         },
+        {
+          "name": "MCP_CONFIRM_ELICITATION",
+          "description": "\"off\" never shows a confirmation prompt, so every client gets the MCP_CONFIRM_MODE flow. Set it for a client that says it can prompt but never does (the gated call hangs, e.g. opencode 2.0.x). Any other value stays \"on\" (with a stderr warning).",
+          "isRequired": false,
+          "format": "string"
+        },
         {
           "name": "MCP_CONFIRM_TTL_SECONDS",
           "description": "Lifetime of a confirmToken in seconds (default 600).",