apple-icloud-mcp 0.3.5 → 0.3.6

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Unofficial Apple Music, iCloud Calendar/Contacts/Mail, Apple Maps and WeatherKit tools for Claude Code",
-    "version": "0.3.5"
+    "version": "0.3.6"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "Apple iCloud",
       "source": "./",
       "description": "Apple Music playlists and library, iCloud Calendar, Contacts and Mail, Apple Maps, WeatherKit and iTunes search for Claude via MCP — runs anywhere, no Mac required. Unofficial; not affiliated with Apple.",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "apple-icloud",
   "displayName": "Apple iCloud",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Apple Music playlists and library, iCloud Calendar, Contacts and Mail, Apple Maps, WeatherKit and iTunes search for Claude via MCP — runs anywhere, no Mac required. Unofficial; not affiliated with Apple.",
   "author": {
     "name": "Chris Chall"

package/README.md

@@ -244,7 +244,7 @@ read in `DISPLAY_TZ` — so are calendar events stored without a time zone of th
 ## Tools
 
 <!-- TOOLS:START -->
-58 tools. **Mode** is the lowest [`APPLE_WRITE_MODE`](#write-protection-apple_write_mode) that registers the tool; **Confirm** marks tools that ask first ([details](#confirmation-mcp_confirm_mode)); 🌐 marks Apple Music tools that need [web-player mode](#apple-music--web-player-mode-opt-in-unofficial).
+59 tools. **Mode** is the lowest [`APPLE_WRITE_MODE`](#write-protection-apple_write_mode) that registers the tool; **Confirm** marks tools that ask first ([details](#confirmation-mcp_confirm_mode)); 🌐 marks Apple Music tools that need [web-player mode](#apple-music--web-player-mode-opt-in-unofficial).
 
 ### Health
 
@@ -372,7 +372,7 @@ target changed in between.
 | `MCP_CONFIRM_MODE` | `ask-user` (default — the model must get your OK before repeating the call), `auto` (the model may confirm after reviewing the preview), `refuse` (never). Unknown values mean `refuse`. |
 | `MCP_CONFIRM_ELICITATION` | `on` (default) or `off`. `off` never shows a prompt, so every client gets the two-step flow under `MCP_CONFIRM_MODE`. Set it for a client that says it can prompt but never does (the gated call hangs — opencode 2.0.x). Any other value stays `on` (with a stderr warning). |
 | `MCP_CONFIRM_TTL_SECONDS` | How long a token is valid (default 600). |
-| `MCP_CONFIRM_SECRET` | Token signing key; random per process by default (on mcp-host, the host's per-child `MCP_HOST_CONFIRM_SECRET` beside an absolute `MCP_DATA_DIR` is used instead). Set it so a token survives a restart; spent tokens are recorded on disk (`confirm-spent.json`), so none can be replayed (unless `APPLE_STATE_CACHE=false` or the directory is unwritable — a warning says so). |
+| `MCP_CONFIRM_SECRET` | Token signing key; random per process by default (on mcp-host, the host's per-child `MCP_HOST_CONFIRM_SECRET` beside an absolute `MCP_DATA_DIR` is used instead). Set it so a token survives a restart; spent tokens are recorded on disk (mcp-utils' shared store, `$MCP_DATA_DIR/.mcp-confirm/spent/`, or `~/.apple-icloud-mcp/confirm-spent/` without an absolute `MCP_DATA_DIR`), so none can be replayed. With `APPLE_STATE_CACHE=false` they are remembered by the process only (a warning says so); if the directory cannot be written, confirmed writes are refused rather than risk a replay. |
 
 ## Environment variables
 
@@ -498,7 +498,9 @@ source checkout, `node dist/index.js doctor` also reads the repo's `.env`.
   - `mail-login.json` — which IMAP login form iCloud accepted;
   - `icloud-rejected.json` — salted digests of rejected Apple ID/password pairs and when, so a revoked
     password is not re-sent for 24 hours even after a restart;
-  - `confirm-spent.json` — digests of used confirmation tokens, so none can be replayed after a restart.
+  - `confirm-spent/` — one file per used confirmation token (its random id and expiry), so none can be replayed
+    after a restart. Hosted with an absolute `MCP_DATA_DIR`, this lives in mcp-utils' shared
+    `$MCP_DATA_DIR/.mcp-confirm/spent/` instead.
 
   Delete the directory to remove them, or set `APPLE_STATE_CACHE=false` to never write them (the latch and the
   spent-token record then last only as long as the process, and a warning says so).

package/THIRD_PARTY_NOTICES.md

@@ -22,7 +22,7 @@ MPL-2.0 is a file-level license: it covers ical.js's own files and does not exte
 
 | Package | Version | License | Source |
 |---|---|---|---|
-| @chrischall/mcp-utils | 3.0.0 | MIT | https://github.com/chrischall/mcp-utils |
+| @chrischall/mcp-utils | 3.0.3 | MIT | https://github.com/chrischall/mcp-utils |
 | @esbuild/aix-ppc64 | 0.28.2 | MIT | — |
 | @esbuild/android-arm | 0.28.2 | MIT | — |
 | @esbuild/android-arm64 | 0.28.2 | MIT | — |
@@ -109,11 +109,11 @@ MPL-2.0 is a file-level license: it covers ical.js's own files and does not exte
 | split2 | 4.2.0 | ISC | https://github.com/mcollina/split2 |
 | thread-stream | 4.2.0 | MIT | https://github.com/mcollina/thread-stream |
 | timezones-ical-library | 2.3.2 | Apache-2.0 | https://github.com/add2cal/timezones-ical-library |
-| zod | 4.6.5 | MIT | https://github.com/colinhacks/zod |
+| zod | 4.6.7 | MIT | https://github.com/colinhacks/zod |
 
 ## License and notice texts
 
-### @chrischall/mcp-utils@3.0.0
+### @chrischall/mcp-utils@3.0.3
 
 - License: MIT
 - Source: https://github.com/chrischall/mcp-utils
@@ -2899,7 +2899,7 @@ SOFTWARE.
    limitations under the License.
 ```
 
-### zod@4.6.5
+### zod@4.6.7
 
 - License: MIT
 - Source: https://github.com/colinhacks/zod

package/dist/bundle.js

@@ -248,6 +248,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -671,6 +672,18 @@ function prefixIssues(path2, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -2234,7 +2247,7 @@ var init_versions = __esm({
     version = {
       major: 4,
       minor: 6,
-      patch: 5
+      patch: 7
     };
   }
 });
@@ -2396,6 +2409,28 @@ function isValidJWT(token, algorithm = null) {
     return false;
   }
 }
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse5 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse5(payload, ctx);
+  };
+}
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -2896,7 +2931,7 @@ function handleRefineResult(result, payload, input2, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-var $ZodType, toStandardResult, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT, URL_UNPARSEABLE, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, CC_SANITIZE, $ZodCreditCard, $ZodIBAN, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodPreprocess, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom;
+var $ZodType, toStandardResult, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT, URL_UNPARSEABLE, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, CC_SANITIZE, $ZodCreditCard, $ZodIBAN, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, arraySize, mapSize, setSize, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodPreprocess, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom;
 var init_schemas = __esm({
   "node_modules/zod/v4/core/schemas.js"() {
     init_checks();
@@ -3503,6 +3538,9 @@ var init_schemas = __esm({
         return payload;
       };
     });
+    arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+    mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+    setSize = (input2) => input2 instanceof Set ? input2.size : -1;
     $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
       $ZodType.init(inst, def);
       const memo4 = globalConfig.memoizer;
@@ -3540,6 +3578,7 @@ var init_schemas = __esm({
         }
         return payload;
       };
+      capSize(inst, arraySize);
     });
     NO_SYMBOL_KEYS = [];
     $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
@@ -4178,6 +4217,7 @@ var init_schemas = __esm({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize(inst, mapSize);
     });
     $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       $ZodType.init(inst, def);
@@ -4214,6 +4254,7 @@ var init_schemas = __esm({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize(inst, setSize);
     });
     $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
       $ZodType.init(inst, def);
@@ -14003,9 +14044,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -14405,6 +14452,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -14421,6 +14469,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -35396,7 +35445,7 @@ var init_errors3 = __esm({
       // webhook signing secret (Stripe-style)
     ].map((p) => `\\b${p}`).join("|"), "g");
     GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-    QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+    QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
     OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
     FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
     HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -35407,6 +35456,8 @@ var init_errors3 = __esm({
       "api[_-]?secret",
       "(?:x[_-])?api[_-]?key",
       "private[_-]?key",
+      "aws[_-]?secret[_-]?access[_-]?key",
+      // fleet-audit#1297
       "code[_-]?verifier",
       // PKCE; a bare `verifier` key is too generic for JSON
       `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -36083,9 +36134,6 @@ function readConfirmTtl(env) {
   }
   return void 0;
 }
-function confirmTtlFromEnv(env = process.env) {
-  return readConfirmTtl(env) ?? DEFAULT_TTL_SECONDS2;
-}
 function durableDataDir(env) {
   const dir = readEnvVar("MCP_DATA_DIR", { env });
   return dir && isAbsolute2(dir) ? dir : void 0;
@@ -36181,10 +36229,71 @@ var init_confirm_env = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/server/confirm-write.js
+function withoutConfirmToken(args) {
+  if (args === null || typeof args !== "object" || Array.isArray(args) || !("confirmToken" in args))
+    return args;
+  const { confirmToken, ...rest } = args;
+  void confirmToken;
+  return rest;
+}
+async function confirmWrite(ctx, options) {
+  const { tool, action, summary, account, request, payload, willSend, args, confirmToken } = options;
+  if (typeof tool !== "string" || tool.trim() === "")
+    throw new TypeError("confirmWrite: tool must be a non-empty string.");
+  if (typeof action !== "string" || action.trim() === "") {
+    throw new TypeError("confirmWrite: action must be a non-empty string.");
+  }
+  if (request === void 0 && (payload === void 0 || payload === null)) {
+    throw new TypeError(`confirmWrite: ${tool} gave neither a request nor a payload; bind what the write will send.`);
+  }
+  const extra = options.preview ?? {};
+  const spoofed = RESERVED_PREVIEW_KEYS.filter((k) => Object.hasOwn(extra, k));
+  if (spoofed.length > 0) {
+    throw new TypeError(`confirmWrite: preview may not set the reserved field(s) ${spoofed.join(", ")}.`);
+  }
+  const query = request?.query ? Object.fromEntries(Object.entries(request.query).filter(([, v]) => v !== void 0)) : void 0;
+  const hasQuery = query !== void 0 && Object.keys(query).length > 0;
+  const shown = willSend !== void 0 ? willSend : request?.body !== void 0 ? request.body : payload;
+  const preview = {
+    ...summary === void 0 ? {} : { action: summary },
+    ...request === void 0 ? {} : { method: request.method, path: request.path },
+    ...shown === void 0 ? {} : { willSend: shown },
+    ...hasQuery ? { willSendQuery: query } : {},
+    ...extra
+  };
+  const target = options.target === void 0 ? "" : String(options.target);
+  const revision = options.revision ?? void 0;
+  const bound = {
+    ...account === void 0 ? {} : { account },
+    target,
+    ...revision === void 0 ? {} : { revision },
+    ...request === void 0 ? {} : { request: { method: request.method, path: request.path, query: hasQuery ? query : void 0, body: request.body } },
+    ...payload === void 0 ? {} : { payload },
+    shown: preview,
+    ...args === void 0 ? {} : { args: withoutConfirmToken(args) }
+  };
+  return requireConfirmationWithFallback(ctx, confirmationFromEnv({
+    action,
+    message: options.message ?? (summary ? `Review and confirm: ${summary}` : "Review and confirm this change:"),
+    details: preview,
+    ...options.unsupportedNote === void 0 ? {} : { unsupportedNote: options.unsupportedNote },
+    ...options.confirmationLabel === void 0 ? {} : { confirmationLabel: options.confirmationLabel },
+    tool,
+    account,
+    confirmToken,
+    args: bound,
+    subject: () => ({ target, ...revision === void 0 ? {} : { revision }, payload: bound, preview }),
+    ...options.instruction === void 0 ? {} : { instruction: options.instruction },
+    ...options.spent === void 0 ? {} : { spent: options.spent },
+    ...options.env === void 0 ? {} : { env: options.env }
+  }));
+}
+var RESERVED_PREVIEW_KEYS;
 var init_confirm_write = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirm-write.js"() {
     init_confirm_env();
     init_confirm_token();
+    RESERVED_PREVIEW_KEYS = ["action", "method", "path", "willSend", "willSendQuery"];
   }
 });
 
@@ -36467,6 +36576,9 @@ var init_headers = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
+function asciiLower(s) {
+  return s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
 var init_ascii = __esm({
   "node_modules/@chrischall/mcp-utils/dist/internal/ascii.js"() {
   }
@@ -36478,16 +36590,42 @@ var init_code_point = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/internal/tags.js
+var init_tags = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/internal/tags.js"() {
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/scrape/index.js
 function isCloudflareChallenge(html) {
-  return /_cf_chl_opt/.test(html) || /<title[^>]*>\s*Just a moment/i.test(html);
+  return html.includes("_cf_chl_opt") || hasJustAMomentTitle(html);
 }
-var NEXT_DATA_MAX_CHARS;
+function hasJustAMomentTitle(html) {
+  const lower2 = asciiLower(html);
+  let i = 0;
+  for (; ; ) {
+    const open2 = lower2.indexOf("<title", i);
+    if (open2 < 0)
+      return false;
+    const gt = lower2.indexOf(">", open2 + 6);
+    if (gt < 0)
+      return false;
+    let j2 = gt + 1;
+    while (j2 < lower2.length && /\s/.test(lower2[j2]))
+      j2++;
+    if (lower2.startsWith(JUST_A_MOMENT, j2))
+      return true;
+    i = gt + 1;
+  }
+}
+var NEXT_DATA_MAX_CHARS, JUST_A_MOMENT;
 var init_scrape = __esm({
   "node_modules/@chrischall/mcp-utils/dist/scrape/index.js"() {
     init_ascii();
     init_code_point();
+    init_tags();
     NEXT_DATA_MAX_CHARS = 16 * 1024 * 1024;
+    JUST_A_MOMENT = "just a moment";
   }
 });
 
@@ -36639,6 +36777,7 @@ var init_net_atoms = __esm({
 var init_body_limit = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/body-limit.js"() {
     init_errors3();
+    init_headers();
   }
 });
 
@@ -36914,7 +37053,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "0.3.5";
+    VERSION = "0.3.6";
   }
 });
 
@@ -46256,91 +46395,50 @@ var init_time = __esm({
 
 // src/tools/_confirm.ts
 import { createHash as createHash5 } from "node:crypto";
-import { isAbsolute as isAbsolute3 } from "node:path";
-function confirmWrite(ctx, opts) {
-  const subject = {
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join5 } from "node:path";
+function confirmWrite2(ctx, opts) {
+  return confirmWrite(ctx, {
+    tool: opts.tool,
+    action: opts.action,
+    message: opts.message,
+    // Single-account server: every write acts as the one set of credentials in the env
+    // (ICLOUD_USERNAME / the Apple Music user token), so there is no principal to choose between.
+    account: void 0,
     target: opts.target,
     ...opts.revision !== void 0 ? { revision: opts.revision } : {},
     payload: opts.payload,
-    preview: opts.preview
-  };
-  return requireConfirmationWithFallback(
-    ctx,
-    confirmationFromEnv({
-      action: opts.action,
-      message: opts.message,
-      details: opts.preview,
-      unsupportedNote: "Make this change in the Apple app (Music, Calendar, Contacts or Mail) instead.",
-      tool: opts.tool,
-      // Single-account server: every write acts as the one set of credentials in the env
-      // (ICLOUD_USERNAME / the Apple Music user token), so there is no principal to choose between.
-      account: void 0,
-      confirmToken: opts.confirmToken,
-      args: opts.args,
-      // Built per call: the data dir, APPLE_STATE_CACHE and the key are read now.
-      spent: createFileSpentTokenStore2(),
-      subject: () => subject,
-      // A caller-supplied binding replaces the args-only default (and is used as given: strip the token here).
-      binding: {
-        key: confirmKeyFromEnv(),
-        args: { args: withoutConfirmToken(opts.args), ...subject },
-        ttlSeconds: confirmTtlFromEnv()
-      }
-    })
-  );
-}
-function withoutConfirmToken(args) {
-  const { confirmToken, ...rest } = args;
-  void confirmToken;
-  return rest;
-}
-function validateSpent(raw) {
-  const spent = raw?.spent;
-  if (typeof spent !== "object" || spent === null || Array.isArray(spent)) return null;
-  return { spent: Object.fromEntries(Object.entries(spent).filter(([, exp]) => Number.isFinite(exp))) };
+    preview: opts.preview,
+    args: opts.args,
+    confirmToken: opts.confirmToken,
+    unsupportedNote: "Make this change in the Apple app (Music, Calendar, Contacts or Mail) instead.",
+    // Chosen per call: the data dir, APPLE_STATE_CACHE and the key are read now.
+    spent: spentTokenStore()
+  });
 }
 function hasStableConfirmKey(env) {
   if (readEnvVar("MCP_CONFIRM_SECRET", { env }) !== void 0) return true;
   return readEnvVar("MCP_HOST_CONFIRM_SECRET", { env }) !== void 0 && isAbsolute3(readEnvVar("MCP_DATA_DIR", { env }) ?? "");
 }
-function warnOnce(kind, env) {
-  if (warned2.has(kind) || !hasStableConfirmKey(env)) return;
-  warned2.add(kind);
-  console.error(
-    `[apple-icloud-mcp] WARNING: ${kind === "disabled" ? "APPLE_STATE_CACHE=false, so a" : "could not record a"} used confirmToken ${kind === "disabled" ? "is" : "on disk; it is"} remembered by this process only. With MCP_CONFIRM_SECRET (or mcp-host's MCP_HOST_CONFIRM_SECRET) set, a restart before it expires would accept it again.`
-  );
-}
-function createFileSpentTokenStore2(options = {}) {
-  const env = options.env ?? process.env;
-  const memory2 = options.memory ?? processSpent;
-  const key = createHash5("sha256").update(confirmKeyFromEnv(env)).digest("hex");
-  const file2 = stateCache(SPENT_TOKENS_FILE, `confirm-spent-v1:${key}`, validateSpent, env);
-  const onDisk = () => file2.load()?.spent ?? {};
-  return {
-    has: (nonce) => {
-      const d = nonceDigest(nonce);
-      return memory2.has(d) || Object.hasOwn(onDisk(), d);
-    },
-    add: (nonce, expiresAtMs) => {
-      const d = nonceDigest(nonce);
-      memory2.add(d, expiresAtMs);
-      const now = Date.now();
-      const kept = Object.entries(onDisk()).filter(([other, exp]) => other !== d && exp >= now).sort(([, a], [, b]) => b - a).slice(0, MAX_SPENT_TOKENS - 1);
-      if (!file2.save({ spent: Object.fromEntries([[d, expiresAtMs], ...kept]) })) {
-        warnOnce(isStateCacheEnabled(env) ? "write" : "disabled", env);
-      }
-    },
-    prune: (now) => memory2.prune(now),
-    // the file is pruned on every write
-    clear: () => {
-      memory2.clear();
-      file2.clear();
-    },
-    /** Distinct spent tokens known to either copy. */
-    get size() {
-      return memory2.size + Object.keys(onDisk()).filter((d) => !memory2.has(d)).length;
+function spentTokenStore(env = process.env) {
+  if (!isStateCacheEnabled(env)) {
+    if (!warnedDisabled && hasStableConfirmKey(env)) {
+      warnedDisabled = true;
+      console.error(
+        "[apple-icloud-mcp] WARNING: APPLE_STATE_CACHE=false, so a used confirmToken is remembered by this process only. With MCP_CONFIRM_SECRET (or mcp-host's MCP_HOST_CONFIRM_SECRET) set, a restart before it expires would accept it again."
+      );
     }
-  };
+    return processSpent;
+  }
+  const shared = spentTokenStoreFromEnv(env);
+  if (shared) return shared;
+  if (!hasStableConfirmKey(env)) return processSpent;
+  const dir = join5(dirname3(resolveStateFile({ env, subdir: STATE_SUBDIR, fileName: SPENT_TOKENS_DIR })), SPENT_TOKENS_DIR);
+  let store2 = localStores.get(dir);
+  if (!store2) {
+    store2 = createFileSpentTokenStore(dir);
+    localStores.set(dir, store2);
+  }
+  return store2;
 }
 function stateRevision(value) {
   const canonical = JSON.stringify(
@@ -46349,18 +46447,18 @@ function stateRevision(value) {
   );
   return `s1:${createHash5("sha256").update(canonical ?? "undefined").digest("base64url").slice(0, 22)}`;
 }
-var CONFIRM_NOTE, SPENT_TOKENS_FILE, MAX_SPENT_TOKENS, nonceDigest, processSpent, warned2;
+var CONFIRM_NOTE, SPENT_TOKENS_DIR, processSpent, localStores, warnedDisabled;
 var init_confirm = __esm({
   "src/tools/_confirm.ts"() {
     "use strict";
     init_dist2();
+    init_session();
     init_state();
     CONFIRM_NOTE = "Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call performs NO write and returns a preview of exactly what would happen plus a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).";
-    SPENT_TOKENS_FILE = "confirm-spent.json";
-    MAX_SPENT_TOKENS = 500;
-    nonceDigest = (nonce) => createHash5("sha256").update(nonce).digest("base64url");
+    SPENT_TOKENS_DIR = "confirm-spent";
     processSpent = createSpentTokenStore();
-    warned2 = /* @__PURE__ */ new Set();
+    localStores = /* @__PURE__ */ new Map();
+    warnedDisabled = false;
   }
 });
 
@@ -56846,7 +56944,7 @@ function registerCalendarTools(server, deps = {}) {
       const draft = occurrenceFor(eventParts(vcal), void 0, zones2);
       const planned = formatOccurrence(draft, { calendar, baseId: formatEventId(calendar.id, `${uid}.ics`), ...zones2 });
       if (invites.length > 0) {
-        const gate = await confirmWrite(ctx, {
+        const gate = await confirmWrite2(ctx, {
           tool: "apple_calendar_create_event",
           action: "apple.calendar.event.create",
           message: `Create "${args.title}" and have iCloud email an invitation to ${invites.length} ${invites.length === 1 ? "person" : "people"}?`,
@@ -56926,7 +57024,7 @@ function registerCalendarTools(server, deps = {}) {
       if (plan.notifiesAttendees) {
         const people = (list3) => (list3 ?? []).map(personLabel);
         const emailed = [.../* @__PURE__ */ new Set([...people(plan.result.expected.attendees), ...people(plan.before.attendees)])];
-        const gate = await confirmWrite(ctx, {
+        const gate = await confirmWrite2(ctx, {
           tool: "apple_calendar_update_event",
           action: "apple.calendar.event.update",
           message: `Change "${String(plan.before.title)}" (${plan.scope})? It has attendees, so iCloud will email them the update.`,
@@ -57045,7 +57143,7 @@ function registerCalendarTools(server, deps = {}) {
       const loaded = await loadEvent(dav, args.eventId, zones2);
       const span = args.span ?? "thisEvent";
       const plan = planDelete(loaded, span, { ...zones2, now: now() });
-      const gate = await confirmWrite(ctx, {
+      const gate = await confirmWrite2(ctx, {
         tool: "apple_calendar_delete_event",
         action: "apple.calendar.event.delete",
         message: `Permanently delete "${String(plan.preview.event)}" (${plan.scope})? Calendar has no trash; it cannot be undone.`,
@@ -59022,7 +59120,7 @@ function registerContactsTools(server, deps = {}) {
         Addresses: v.addresses.length ? v.addresses.map((a) => a.formatted).join(" | ") : void 0,
         "Contact id": id2
       });
-      const gate = await confirmWrite(ctx, {
+      const gate = await confirmWrite2(ctx, {
         tool: "apple_contacts_delete",
         action: "apple.contacts.contact.delete",
         message: `Permanently delete the contact "${v.name}" from iCloud Contacts on all devices? This cannot be undone here.`,
@@ -62248,7 +62346,7 @@ var require_thread_stream = __commonJS({
     var { version: version4 } = require_package();
     var { EventEmitter: EventEmitter3 } = __require("events");
     var { Worker } = __require("worker_threads");
-    var { join: join6 } = __require("path");
+    var { join: join7 } = __require("path");
     var { pathToFileURL } = __require("url");
     var { wait } = require_wait();
     var {
@@ -62299,7 +62397,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join6(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join7(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -62767,7 +62865,7 @@ var require_transport = __commonJS({
     var { createRequire } = __require("module");
     var { existsSync: existsSync4 } = __require("node:fs");
     var getCallers = require_caller();
-    var { join: join6, isAbsolute: isAbsolute4, sep } = __require("node:path");
+    var { join: join7, isAbsolute: isAbsolute4, sep } = __require("node:path");
     var { fileURLToPath: fileURLToPath2 } = __require("node:url");
     var sleep3 = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -62920,7 +63018,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join6(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join7(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -62938,7 +63036,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline) {
-        target = bundlerOverrides["pino-worker"] || join6(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join7(__dirname, "worker.js");
         options.pipelines = [pipeline.map((dest) => {
           return {
             ...dest,
@@ -62961,7 +63059,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join6(__dirname, "..", "file.js");
+          return join7(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -63941,7 +64039,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join6 = ",";
+            let join7 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -63955,7 +64053,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join6 = `,
+                join7 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -63963,13 +64061,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join6;
+                res += join7;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join6}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join7}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -63990,7 +64088,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join6 = `,
+              join7 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -64004,13 +64102,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join6;
+                separator = join7;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join6;
+              separator = join7;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -64051,7 +64149,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join6 = ",";
+            let join7 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -64064,7 +64162,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join6 = `,
+                join7 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -64072,13 +64170,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join6;
+                res += join7;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join6}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join7}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -64091,7 +64189,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join6 = `,
+              join7 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -64100,7 +64198,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join6;
+                separator = join7;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -64158,20 +64256,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join7 = `,
+              const join8 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join7;
+                res2 += join8;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join7}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join8}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -64187,16 +64285,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join6 = `,
+            const join7 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join6, maximumBreadth);
+              res += stringifyTypedArray(value, join7, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join6;
+              separator = join7;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -64207,13 +64305,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join6;
+                separator = join7;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join6;
+              separator = join7;
             }
             if (separator !== "") {
               res = `
@@ -115433,7 +115531,7 @@ function replaceClosedTags(str5, pattern, replacement) {
   const end = str5.lastIndexOf(">") + 1;
   return str5.slice(0, end).replace(pattern, replacement) + str5.slice(end);
 }
-function replaceTags(str5, prefix, pattern, replacement) {
+function replaceTags2(str5, prefix, pattern, replacement) {
   const parts = [];
   let copied = 0;
   let searchFrom = 0;
@@ -115533,9 +115631,9 @@ function htmlToText(str5) {
   str5 = stripThroughLastTag(str5, /<!doctype\b/gi);
   str5 = stripFromFirstTag(str5, /<\/body\b/gi);
   str5 = stripFromFirstTag(str5, /<\/html\b/gi);
-  str5 = replaceTags(str5, /<a\b/gi, /<a\b[^>]*href\s*=\s*["']?([^\s"']+)[^>]*>/iy, (match, href) => ` (${href}) `);
+  str5 = replaceTags2(str5, /<a\b/gi, /<a\b[^>]*href\s*=\s*["']?([^\s"']+)[^>]*>/iy, (match, href) => ` (${href}) `);
   str5 = replaceClosedTags(str5, /<\/?(span|em|i|strong|b|u|a)\b[^>]*>/gi, "");
-  str5 = replaceTags(str5, /<li\b/gi, /<li\b[^>]*>[\n\u0001\s]*/iy, () => "* ");
+  str5 = replaceTags2(str5, /<li\b/gi, /<li\b[^>]*>[\n\u0001\s]*/iy, () => "* ");
   str5 = replaceClosedTags(str5, /<hr\b[^>]*>/g, "\n-------------\n");
   str5 = replaceClosedTags(str5, /<[^>]*>/g, " ");
   str5 = str5.replace(/\u0001/g, "\n").replace(/[ \t]+/g, " ").replace(/^\s+$/gm, "").replace(/\n\n+/g, "\n\n").replace(/^\n+/, "\n").replace(/\n+$/, "\n");
@@ -119923,7 +120021,7 @@ ${q.quoted}
       assertNotLatched(account.latchCreds, "mail");
       const proxy = mailProxyFor(SMTP_HOST);
       if (proxy !== void 0) assertHttpProxy(proxy);
-      const gate = await confirmWrite(ctx, {
+      const gate = await confirmWrite2(ctx, {
         tool: "apple_mail_send",
         action: "apple.mail.message.send",
         message: `Send this email from ${account.address} to ${count} recipient${count === 1 ? "" : "s"}?`,
@@ -123952,7 +124050,7 @@ function registerExtendedTools(server, client) {
         tracksAfter: n - removing.length,
         ...notInPlaylist.length > 0 ? { notInPlaylist } : {}
       };
-      const gate = await confirmWrite(ctx, {
+      const gate = await confirmWrite2(ctx, {
         tool: "apple_music_remove_playlist_tracks",
         action: "apple.music.playlist.tracks.remove",
         message: `Remove ${removing.length} track(s) from the playlist "${name2}"?`,
@@ -124110,7 +124208,7 @@ function registerExtendedTools(server, client) {
         firstBefore: labels(current),
         firstAfter: labels(next)
       };
-      const gate = await confirmWrite(ctx, {
+      const gate = await confirmWrite2(ctx, {
         tool: "apple_music_reorder_playlist",
         action: "apple.music.playlist.tracks.replace",
         message: `Rewrite the order of "${name2}" (${summary})${removed > 0 ? `, removing ${removed} track(s): ${someNames(dropped)}` : ""}?`,
@@ -124232,7 +124330,7 @@ function registerExtendedTools(server, client) {
       const description = playlistFields(pl).description;
       if (description) preview.description = description;
       if (a.hasCatalog === true) preview.note = "This is a playlist saved from Apple Music's catalog; deleting removes it from your library only.";
-      const gate = await confirmWrite(ctx, {
+      const gate = await confirmWrite2(ctx, {
         tool: "apple_music_delete_playlist",
         action: "apple.music.playlist.delete",
         message: `Delete the playlist "${name2}" (${String(preview.tracks)} tracks)? This cannot be undone.`,
@@ -124290,7 +124388,7 @@ function registerExtendedTools(server, client) {
         const a = attrs(f);
         return { id: f.id, name: nameOf2(f), ...str3(a.artistName) ? { artistName: a.artistName } : {} };
       });
-      const gate = await confirmWrite(ctx, {
+      const gate = await confirmWrite2(ctx, {
         tool: "apple_music_remove_from_library",
         action: "apple.music.library.remove",
         message: `Remove ${removing.length} ${args.type} from your Apple Music library?`,
@@ -125470,10 +125568,10 @@ var init_registry = __esm({
 // src/index.ts
 init_dist2();
 init_version();
-import { dirname as dirname3, join as join5 } from "node:path";
+import { dirname as dirname4, join as join6 } from "node:path";
 import { fileURLToPath } from "node:url";
 try {
-  await loadDotenvSafely({ path: join5(dirname3(fileURLToPath(import.meta.url)), "..", ".env") });
+  await loadDotenvSafely({ path: join6(dirname4(fileURLToPath(import.meta.url)), "..", ".env") });
 } catch {
 }
 if (process.argv[2] === "music-auth") {

package/dist/tools/_confirm.js

@@ -1,7 +1,8 @@
 import { createHash } from 'node:crypto';
-import { isAbsolute } from 'node:path';
-import { confirmKeyFromEnv, confirmTtlFromEnv, confirmationFromEnv, confirmTokenParam, createSpentTokenStore, readEnvVar, requireConfirmationWithFallback, } from '@chrischall/mcp-utils';
-import { isStateCacheEnabled, stateCache } from '../state.js';
+import { dirname, isAbsolute, join } from 'node:path';
+import { confirmTokenParam, confirmWrite as sharedConfirmWrite, createFileSpentTokenStore, createSpentTokenStore, readEnvVar, spentTokenStoreFromEnv, } from '@chrischall/mcp-utils';
+import { resolveStateFile } from '@chrischall/mcp-utils/session';
+import { STATE_SUBDIR, isStateCacheEnabled } from '../state.js';
 export { confirmTokenParam };
 /** The sentence every confirm-gated tool's description ends with. */
 export const CONFIRM_NOTE = 'Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call '
@@ -18,89 +19,65 @@ export const CONFIRM_NOTE = 'Asks the user to confirm first: a confirmation prom
  * before the write, with the freshly built payload and a freshly read
  * revision — the re-read is what makes a stale token fail.
  *
- * Both paths commit to the same thing: the arguments AND the state the user was
- * shown (target, revision, payload, preview). A prompt's acceptance is bound
- * explicitly for that reason — mcp-utils' default binding covers the arguments
- * only, so an acceptance given while "position 1" was one song would have
- * removed whatever song sat there when the retry re-read the playlist. Now a
- * retry whose fresh read differs asks again, with the new preview.
+ * A thin wrapper over mcp-utils' `confirmWrite` (chrischall/fleet-audit#1217),
+ * which binds the arguments AND the state the user was shown (target,
+ * revision, payload, preview) on both rails — so an acceptance given while
+ * "position 1" was one song cannot remove whatever sits there when the retry
+ * re-reads the playlist. The preview gains the shared `willSend` field (the
+ * payload). What this wrapper adds: the single-account `account: undefined`,
+ * the Apple-app refusal hint, and the spent-token store choice below.
  *
  * Returns `undefined` to proceed, otherwise the result to return unchanged.
  */
 export function confirmWrite(ctx, opts) {
-    const subject = {
-        target: opts.target,
-        ...(opts.revision !== undefined ? { revision: opts.revision } : {}),
-        payload: opts.payload,
-        preview: opts.preview,
-    };
-    return requireConfirmationWithFallback(ctx, confirmationFromEnv({
+    return sharedConfirmWrite(ctx, {
+        tool: opts.tool,
         action: opts.action,
         message: opts.message,
-        details: opts.preview,
-        unsupportedNote: 'Make this change in the Apple app (Music, Calendar, Contacts or Mail) instead.',
-        tool: opts.tool,
         // Single-account server: every write acts as the one set of credentials in the env
         // (ICLOUD_USERNAME / the Apple Music user token), so there is no principal to choose between.
         account: undefined,
-        confirmToken: opts.confirmToken,
+        target: opts.target,
+        ...(opts.revision !== undefined ? { revision: opts.revision } : {}),
+        payload: opts.payload,
+        preview: opts.preview,
         args: opts.args,
-        // Built per call: the data dir, APPLE_STATE_CACHE and the key are read now.
-        spent: createFileSpentTokenStore(),
-        subject: () => subject,
-        // A caller-supplied binding replaces the args-only default (and is used as given: strip the token here).
-        binding: {
-            key: confirmKeyFromEnv(),
-            args: { args: withoutConfirmToken(opts.args), ...subject },
-            ttlSeconds: confirmTtlFromEnv(),
-        },
-    }));
-}
-/** The arguments as bound: the token differs between the phases, so it is never part of the commitment. */
-function withoutConfirmToken(args) {
-    const { confirmToken, ...rest } = args;
-    void confirmToken;
-    return rest;
+        confirmToken: opts.confirmToken,
+        unsupportedNote: 'Make this change in the Apple app (Music, Calendar, Contacts or Mail) instead.',
+        // Chosen per call: the data dir, APPLE_STATE_CACHE and the key are read now.
+        spent: spentTokenStore(),
+    });
 }
 // ---------------------------------------------------------------------------
 // Spent tokens: single use that survives a restart
 // ---------------------------------------------------------------------------
 /**
- * mcp-utils remembers a used token's nonce in process memory only (unless its
- * own durable store is in play), while a stable key — MCP_CONFIRM_SECRET, or
- * the MCP_HOST_CONFIRM_SECRET mcp-host derives per child beside an absolute
- * MCP_DATA_DIR — makes the token itself valid in every process that shares it. So after a
- * restart inside the token's lifetime — a crash, a redeploy, the child dying
- * right after the SMTP hand-off — an already-used token verified again. For a
- * target with no revision to rotate (a new mail, an invitation-sending create)
- * that replayed the whole write: a second email nobody approved.
+ * A stable key — MCP_CONFIRM_SECRET, or the MCP_HOST_CONFIRM_SECRET mcp-host
+ * derives per child beside an absolute MCP_DATA_DIR — makes a token valid in
+ * every process that shares it, so a used one must be remembered on disk or a
+ * restart inside its lifetime (a crash, a redeploy, the child dying right
+ * after the SMTP hand-off) would accept it again: for a target with no
+ * revision to rotate (a new mail) that is a second email nobody approved.
  *
- * The store below records each spent token on disk as well
- * (`$MCP_DATA_DIR/.apple-icloud-mcp/confirm-spent.json`, 0600): a SHA-256 of its nonce
- * and the time it would have expired anyway — nothing that could be replayed.
- * The file is bound to (a digest of) the HMAC key, so rotating the secret
- * discards it, and so does a restart without a secret — every earlier token is
- * TOKEN_INVALID under the new random key then anyway. Expired entries are
- * pruned on every write and the file is capped at {@link MAX_SPENT_TOKENS}.
+ * mcp-utils' durable store does this (`$MCP_DATA_DIR/.mcp-confirm/spent`, one
+ * O_EXCL-claimed 0600 file per spent nonce, failing closed when it cannot
+ * look). On top of it this server keeps two things of its own:
  *
- * An in-memory mirror is ALWAYS kept as well, so single use within the process
- * never depends on the disk. With APPLE_STATE_CACHE=false, or when the file
- * cannot be written, only the mirror remains — reported once on stderr when a
- * shared secret makes that matter.
+ * - `APPLE_STATE_CACHE=false` opts out of every on-disk file, this one too:
+ *   spends are then remembered by this process only — reported once on stderr
+ *   when a stable key makes that matter.
+ * - A local install with MCP_CONFIRM_SECRET but no absolute MCP_DATA_DIR keeps
+ *   its spends beside the other state caches
+ *   (`$HOME/.apple-icloud-mcp/confirm-spent/`), in the same shared format.
+ *
+ * Without a stable key a restart invalidates every token anyway, so the
+ * process-wide in-memory store is enough.
  */
-export const SPENT_TOKENS_FILE = 'confirm-spent.json';
-/** Most spent tokens kept on disk; the ones expiring soonest go first. */
-export const MAX_SPENT_TOKENS = 500;
-function validateSpent(raw) {
-    const spent = raw?.spent;
-    if (typeof spent !== 'object' || spent === null || Array.isArray(spent))
-        return null;
-    return { spent: Object.fromEntries(Object.entries(spent).filter(([, exp]) => Number.isFinite(exp))) };
-}
-const nonceDigest = (nonce) => createHash('sha256').update(nonce).digest('base64url');
-/** The process-wide mirror, keyed by nonce digest like the file — and all there is when nothing persists. */
+export const SPENT_TOKENS_DIR = 'confirm-spent';
+/** The process-wide in-memory store, when nothing persists. */
 const processSpent = createSpentTokenStore();
-const warned = new Set();
+const localStores = new Map();
+let warnedDisabled = false;
 /**
  * Whether the confirm key outlives the process — the same rule as mcp-utils'
  * `confirmKeyFromEnv`: the operator's MCP_CONFIRM_SECRET, else mcp-host's
@@ -112,61 +89,33 @@ function hasStableConfirmKey(env) {
         return true;
     return readEnvVar('MCP_HOST_CONFIRM_SECRET', { env }) !== undefined && isAbsolute(readEnvVar('MCP_DATA_DIR', { env }) ?? '');
 }
-function warnOnce(kind, env) {
-    // Without a stable key a restart invalidates every token anyway, so the
-    // memory-only store loses nothing and there is nothing to warn about.
-    if (warned.has(kind) || !hasStableConfirmKey(env))
-        return;
-    warned.add(kind);
-    console.error(`[apple-icloud-mcp] WARNING: ${kind === 'disabled' ? 'APPLE_STATE_CACHE=false, so a' : 'could not record a'} used confirmToken ` +
-        `${kind === 'disabled' ? 'is' : 'on disk; it is'} remembered by this process only. With MCP_CONFIRM_SECRET ` +
-        "(or mcp-host's MCP_HOST_CONFIRM_SECRET) set, a restart before it expires would accept it again.");
-}
-/**
- * A {@link SpentTokenStore} backed by `confirm-spent.json` plus an in-memory
- * mirror. `has` consults both (the file is re-read, so a token spent by an
- * earlier process — or a sibling sharing the data dir — counts); `add` writes
- * both. Only phase-2 calls touch it, so the extra reads cost nothing. With
- * APPLE_STATE_CACHE=false the file side is a no-op and this is the mirror alone.
- */
-export function createFileSpentTokenStore(options = {}) {
-    const env = options.env ?? process.env;
-    const memory = options.memory ?? processSpent;
-    const key = createHash('sha256').update(confirmKeyFromEnv(env)).digest('hex');
-    const file = stateCache(SPENT_TOKENS_FILE, `confirm-spent-v1:${key}`, validateSpent, env);
-    const onDisk = () => file.load()?.spent ?? {};
-    return {
-        has: (nonce) => {
-            const d = nonceDigest(nonce);
-            return memory.has(d) || Object.hasOwn(onDisk(), d);
-        },
-        add: (nonce, expiresAtMs) => {
-            const d = nonceDigest(nonce);
-            memory.add(d, expiresAtMs);
-            const now = Date.now();
-            const kept = Object.entries(onDisk())
-                .filter(([other, exp]) => other !== d && exp >= now)
-                .sort(([, a], [, b]) => b - a)
-                .slice(0, MAX_SPENT_TOKENS - 1);
-            if (!file.save({ spent: Object.fromEntries([[d, expiresAtMs], ...kept]) })) {
-                warnOnce(isStateCacheEnabled(env) ? 'write' : 'disabled', env);
-            }
-        },
-        prune: (now) => memory.prune(now), // the file is pruned on every write
-        clear: () => {
-            memory.clear();
-            file.clear();
-        },
-        /** Distinct spent tokens known to either copy. */
-        get size() {
-            return memory.size + Object.keys(onDisk()).filter((d) => !memory.has(d)).length;
-        },
-    };
+/** The spent-token store for a gated call, per the rules above. */
+export function spentTokenStore(env = process.env) {
+    if (!isStateCacheEnabled(env)) {
+        if (!warnedDisabled && hasStableConfirmKey(env)) {
+            warnedDisabled = true;
+            console.error('[apple-icloud-mcp] WARNING: APPLE_STATE_CACHE=false, so a used confirmToken is remembered by this process only. '
+                + "With MCP_CONFIRM_SECRET (or mcp-host's MCP_HOST_CONFIRM_SECRET) set, a restart before it expires would accept it again.");
+        }
+        return processSpent;
+    }
+    const shared = spentTokenStoreFromEnv(env);
+    if (shared)
+        return shared;
+    if (!hasStableConfirmKey(env))
+        return processSpent;
+    const dir = join(dirname(resolveStateFile({ env, subdir: STATE_SUBDIR, fileName: SPENT_TOKENS_DIR })), SPENT_TOKENS_DIR);
+    let store = localStores.get(dir);
+    if (!store) {
+        store = createFileSpentTokenStore(dir);
+        localStores.set(dir, store);
+    }
+    return store;
 }
-/** Test seam: forget the in-memory spent tokens (what a restart does) and the warnings. */
+/** Test seam: forget the in-memory spent tokens (what a restart does) and the warning. */
 export function resetSpentTokenMemory() {
     processSpent.clear();
-    warned.clear();
+    warnedDisabled = false;
 }
 /**
  * A revision string for a record as just read, for `ConfirmWriteOptions.revision`

package/dist/version.js

@@ -1,4 +1,4 @@
 // The server's self-reported version. release-please bumps this line (it is
 // registered in release-please-config.json `extra-files`); tests/version-sync
 // fails CI if it ever drifts from package.json.
-export const VERSION = '0.3.5'; // x-release-please-version
+export const VERSION = '0.3.6'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-icloud-mcp",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "license": "MIT",
   "mcpName": "io.github.chrischall/apple-icloud-mcp",
   "description": "Unofficial MCP server for Apple's services — Apple Music playlists and library, iCloud Calendar, Contacts and Mail, Apple Maps, WeatherKit and iTunes search — that runs anywhere, no Mac needed. Not affiliated with Apple. Developed and maintained by AI (Claude Code)",
@@ -54,7 +54,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.0.0",
+    "@chrischall/mcp-utils": "^3.0.3",
     "@modelcontextprotocol/server": "^2.3.1",
     "@xmldom/xmldom": "^0.9.12",
     "dotenv": "^18.0.6",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/apple-icloud-mcp",
     "source": "github"
   },
-  "version": "0.3.5",
+  "version": "0.3.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "apple-icloud-mcp",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "transport": {
         "type": "stdio"
       },