apple-notes-mcp 2.8.43 → 2.8.45

package/build/index.js

@@ -3268,8 +3268,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path9) {
-      let input = path9;
+    function removeDotSegments(path10) {
+      let input = path10;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3674,8 +3674,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path9 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path9 && path9 !== "/" ? path9 : void 0;
+        const path10 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path10 && path10 !== "/" ? path10 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -5049,8 +5049,8 @@ var require_multipleOf = __commonJS({
         const { gen, data, schemaCode, it } = cxt;
         const prec = it.opts.multipleOfPrecision;
         const res = gen.let("res");
-        const invalid = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
-        cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid}))`);
+        const invalid2 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
+        cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid2}))`);
       }
     };
     exports.default = def;
@@ -12238,32 +12238,32 @@ var require_URL = __commonJS({
           else
             return basepath.substring(0, lastslash + 1) + refpath;
         }
-        function remove_dot_segments(path9) {
-          if (!path9) return path9;
+        function remove_dot_segments(path10) {
+          if (!path10) return path10;
           var output = "";
-          while (path9.length > 0) {
-            if (path9 === "." || path9 === "..") {
-              path9 = "";
+          while (path10.length > 0) {
+            if (path10 === "." || path10 === "..") {
+              path10 = "";
               break;
             }
-            var twochars = path9.substring(0, 2);
-            var threechars = path9.substring(0, 3);
-            var fourchars = path9.substring(0, 4);
+            var twochars = path10.substring(0, 2);
+            var threechars = path10.substring(0, 3);
+            var fourchars = path10.substring(0, 4);
             if (threechars === "../") {
-              path9 = path9.substring(3);
+              path10 = path10.substring(3);
             } else if (twochars === "./") {
-              path9 = path9.substring(2);
+              path10 = path10.substring(2);
             } else if (threechars === "/./") {
-              path9 = "/" + path9.substring(3);
-            } else if (twochars === "/." && path9.length === 2) {
-              path9 = "/";
-            } else if (fourchars === "/../" || threechars === "/.." && path9.length === 3) {
-              path9 = "/" + path9.substring(4);
+              path10 = "/" + path10.substring(3);
+            } else if (twochars === "/." && path10.length === 2) {
+              path10 = "/";
+            } else if (fourchars === "/../" || threechars === "/.." && path10.length === 3) {
+              path10 = "/" + path10.substring(4);
               output = output.replace(/\/?[^\/]*$/, "");
             } else {
-              var segment = path9.match(/(\/?([^\/]*))/)[0];
+              var segment = path10.match(/(\/?([^\/]*))/)[0];
               output += segment;
-              path9 = path9.substring(segment.length);
+              path10 = path10.substring(segment.length);
             }
           }
           return output;
@@ -24465,14 +24465,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node.nodeType === 1) {
           replacement = replacementForNode.call(self, node);
         }
-        return join23(output, replacement);
+        return join24(output, replacement);
       }, "");
     }
     function postProcess(output) {
       var self = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output = join23(output, rule.append(self.options));
+          output = join24(output, rule.append(self.options));
         }
       });
       return output.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -24484,7 +24484,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node, this.options) + whitespace.trailing;
     }
-    function join23(output, replacement) {
+    function join24(output, replacement) {
       var s1 = trimTrailingNewlines(output);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output.length - s1.length, replacement.length - s2.length);
@@ -24979,8 +24979,8 @@ function getErrorMap() {
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path9, errorMaps, issueData } = params;
-  const fullPath = [...path9, ...issueData.path || []];
+  const { data, path: path10, errorMaps, issueData } = params;
+  const fullPath = [...path10, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -25096,11 +25096,11 @@ var errorUtil;
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path9, key) {
+  constructor(parent, value, path10, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path9;
+    this._path = path10;
     this._key = key;
   }
   get path() {
@@ -28737,10 +28737,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path9) {
-  if (!path9)
+function getElementAtPath(obj, path10) {
+  if (!path10)
     return obj;
-  return path9.reduce((acc, key) => acc?.[key], obj);
+  return path10.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -29060,11 +29060,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path9, issues) {
+function prefixIssues(path10, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path9);
+    iss.path.unshift(path10);
     return iss;
   });
 }
@@ -32475,11 +32475,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path9) {
-  if (path9.length === 0) {
+function getDotPath(path10) {
+  if (path10.length === 0) {
     return "object root";
   }
-  return path9.reduce((acc, seg, index) => {
+  return path10.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -40964,8 +40964,8 @@ function allowedSaveRoots() {
 function deniedSaveRoots() {
   return [join6(homedir6(), "Library/Group Containers/group.com.apple.notes")];
 }
-function canonicalize(path9) {
-  return realpathSync.native(path9);
+function canonicalize(path10) {
+  return realpathSync.native(path10);
 }
 function isWithinRoots(candidate, roots) {
   return roots.some((root) => {
@@ -40987,9 +40987,9 @@ function canonicalRoots(roots) {
   }
   return canonical;
 }
-function entryExists(path9) {
+function entryExists(path10) {
   try {
-    lstatSync(path9);
+    lstatSync(path10);
     return true;
   } catch (e) {
     const code = e.code;
@@ -41363,24 +41363,24 @@ function safeComponent(value) {
   if (value === "." || value === ".." || value.includes("/") || value.includes("\0")) return null;
   return value;
 }
-function realInside(path9, rootReal) {
+function realInside(path10, rootReal) {
   try {
-    const real = realpathSync2.native(path9);
+    const real = realpathSync2.native(path10);
     return real === rootReal || real.startsWith(rootReal + sep2) ? real : null;
   } catch {
     return null;
   }
 }
-function isRegularFile(path9) {
+function isRegularFile(path10) {
   try {
-    return lstatSync2(path9).isFile();
+    return lstatSync2(path10).isFile();
   } catch {
     return false;
   }
 }
-function isDirectory(path9) {
+function isDirectory(path10) {
   try {
-    return lstatSync2(path9).isDirectory();
+    return lstatSync2(path10).isDirectory();
   } catch {
     return false;
   }
@@ -41760,10 +41760,10 @@ function readImageInfoFd(fd) {
   const read = readSync2(fd, buf, 0, buf.length, 0);
   return parseImageHeader(buf.subarray(0, read));
 }
-function readImageInfo(path9) {
+function readImageInfo(path10) {
   let fd;
   try {
-    fd = openSync3(path9, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+    fd = openSync3(path10, constants3.O_RDONLY | constants3.O_NOFOLLOW);
   } catch {
     return null;
   }
@@ -41863,9 +41863,9 @@ function readDrawingRows(noteId3, dbPath2 = join8(NOTES_CONTAINER_DIR, "NoteStor
     throw new AttachmentStoreError("Drawing rows could not be parsed", "query_error");
   }
 }
-function kindOf(path9) {
+function kindOf(path10) {
   try {
-    const st = lstatSync3(path9);
+    const st = lstatSync3(path10);
     return st.isFile() ? "file" : st.isDirectory() ? "dir" : null;
   } catch {
     return null;
@@ -41931,13 +41931,13 @@ function describeDrawings(rows, containerDir = NOTES_CONTAINER_DIR) {
     const previewPath = accountDir ? findLargestPreview(accountDir, row.identifier) : null;
     const bundle = accountDir && id2 && kind === "paper" ? realInside(join8(accountDir, "Paper", "Bundles", `${id2}.bundle`), accountDir) : null;
     let raster = null;
-    for (const [path9, source] of [
+    for (const [path10, source] of [
       [fallbackImagePath, "fallback"],
       [previewPath, "preview"]
     ]) {
-      const info = path9 ? readImageInfo(path9) : null;
-      if (path9 && info) {
-        raster = { path: path9, source, ...info };
+      const info = path10 ? readImageInfo(path10) : null;
+      if (path10 && info) {
+        raster = { path: path10, source, ...info };
         break;
       }
     }
@@ -41954,10 +41954,10 @@ function describeDrawings(rows, containerDir = NOTES_CONTAINER_DIR) {
     };
   });
 }
-function verifyWrittenImage(fd, path9, expected) {
+function verifyWrittenImage(fd, path10, expected) {
   const check2 = readImageInfoFd(fd);
   if (!check2 || check2.format !== expected.format || check2.width !== expected.width || check2.height !== expected.height) {
-    unlinkSync2(path9);
+    unlinkSync2(path10);
     throw new Error("The exported image failed validation and was removed.");
   }
   return check2;
@@ -42053,6 +42053,77 @@ function exportDrawingRaster(drawing, savePath, containerDir = NOTES_CONTAINER_D
   }
 }
 
+// src/utils/scopeGuard.ts
+var SCOPE_FOLDER_ID = /^x-coredata:\/\/[0-9a-f-]+\/ICFolder\/p\d+$/i;
+var MAX_FORBIDDEN_FOLDERS = 50;
+var SCOPE_MARKER = "SAFETY_SCOPE";
+function hasScopeGuard(guard) {
+  return Boolean(
+    guard && (guard.ifFolderId || guard.ifAncestorFolderId || guard.forbiddenAncestorFolderIds && guard.forbiddenAncestorFolderIds.length > 0)
+  );
+}
+function validateScopeGuard(guard) {
+  const ids = [
+    guard.ifFolderId,
+    guard.ifAncestorFolderId,
+    ...guard.forbiddenAncestorFolderIds ?? []
+  ].filter((value) => value !== void 0);
+  for (const id2 of ids) {
+    if (!SCOPE_FOLDER_ID.test(id2)) throw new Error(`Scope guard needs exact folder ids: ${id2}`);
+  }
+  if ((guard.forbiddenAncestorFolderIds?.length ?? 0) > MAX_FORBIDDEN_FOLDERS)
+    throw new Error(`At most ${MAX_FORBIDDEN_FOLDERS} forbidden folder ids are allowed`);
+}
+function chainScript(chainVar, startExpr) {
+  return `
+      set ${chainVar} to {}
+      set ${chainVar}Cursor to ${startExpr}
+      repeat while class of ${chainVar}Cursor is folder
+        set end of ${chainVar} to (id of ${chainVar}Cursor)
+        set ${chainVar}Cursor to container of ${chainVar}Cursor
+      end repeat`;
+}
+function idList(ids) {
+  return `{${ids.map((id2) => `"${id2}"`).join(", ")}}`;
+}
+function buildScopeGuardScript(noteVar, guard, destinationVar) {
+  if (!hasScopeGuard(guard)) return "";
+  validateScopeGuard(guard);
+  const forbidden = guard.forbiddenAncestorFolderIds ?? [];
+  let script = `
+      set scopeFolder to container of ${noteVar}
+      if class of scopeFolder is not folder then return "${SCOPE_MARKER}:the note is not in a folder"`;
+  if (guard.ifFolderId)
+    script += `
+      if (id of scopeFolder) is not "${guard.ifFolderId}" then return "${SCOPE_MARKER}:the note is not in the expected folder"`;
+  if (guard.ifAncestorFolderId || forbidden.length > 0)
+    script += chainScript("scopeChain", "scopeFolder");
+  if (guard.ifAncestorFolderId)
+    script += `
+      if scopeChain does not contain "${guard.ifAncestorFolderId}" then return "${SCOPE_MARKER}:the note is not inside the expected ancestor folder"`;
+  if (forbidden.length > 0) {
+    script += `
+      repeat with forbiddenId in ${idList(forbidden)}
+        if scopeChain contains (contents of forbiddenId) then return "${SCOPE_MARKER}:the note is inside a forbidden folder"
+      end repeat`;
+    if (destinationVar) {
+      script += chainScript("scopeDestChain", destinationVar);
+      script += `
+      repeat with forbiddenId in ${idList(forbidden)}
+        if scopeDestChain contains (contents of forbiddenId) then return "${SCOPE_MARKER}:the destination is inside a forbidden folder"
+      end repeat`;
+    }
+  }
+  return script;
+}
+function parseScopeFailure(output) {
+  const trimmed = output.trim();
+  return trimmed.startsWith(`${SCOPE_MARKER}:`) ? trimmed.slice(SCOPE_MARKER.length + 1) : null;
+}
+function scopeConflictMessage(reason) {
+  return `Scope guard failed: ${reason}. Nothing was changed; read the note's current folder and review before retrying.`;
+}
+
 // src/services/appleNotesManager.ts
 var import_turndown = __toESM(require_turndown_cjs(), 1);
 import { existsSync as existsSync5 } from "fs";
@@ -42302,6 +42373,34 @@ function buildAppLevelScript(command) {
     end tell
   `;
 }
+function folderDeleteFactsScript(id2) {
+  if (!FOLDER_ID_PATTERN.test(id2)) throw new Error("An exact folder ID is required");
+  return `
+      set f to folder id "${id2}"
+      set folderName to name of f
+      set parentRef to container of f
+      set parentId to ""
+      if class of parentRef is folder then set parentId to id of parentRef
+      set sharedAny to (shared of f)
+      set acct to parentRef
+      repeat while class of acct is folder
+        if shared of acct then set sharedAny to true
+        set acct to container of acct
+      end repeat
+      set acctId to id of acct
+      set defaultId to ""
+      try
+        set defaultId to id of default folder of acct
+      end try
+      -- "folders of f" keeps listing a child deleted earlier in this Notes
+      -- session, while "exists folder id" reports it gone, so count only
+      -- children that still exist.
+      set childCount to 0
+      repeat with childRef in folders of f
+        if exists folder id (id of childRef) then set childCount to childCount + 1
+      end repeat
+      set noteCount to count of notes of f`;
+}
 function getNoteLinkFromDB(coreDataId2) {
   const match = coreDataId2.match(/\/p(\d+)$/);
   if (!match) return null;
@@ -42826,7 +42925,7 @@ var AppleNotesManager = class {
    * race that would exist if JavaScript checked the note and then issued a
    * separate unconditional `set body` command.
    */
-  updateNoteByIdIfUnchanged(id2, currentTitle, expectedBody, newTitle, newContent, format = "plaintext", expectedRichRevision) {
+  updateNoteByIdIfUnchanged(id2, currentTitle, expectedBody, newTitle, newContent, format = "plaintext", expectedRichRevision, scope2) {
     const safeId = sanitizeNoteId(id2);
     if (expectedRichRevision) {
       const rich = readRichNote(id2);
@@ -42847,7 +42946,7 @@ var AppleNotesManager = class {
     const safeExpectedBody = escapeHtmlForAppleScript(expectedBody);
     const safeWrittenBody = escapeHtmlForAppleScript(writtenBody);
     const script = buildAppLevelScript(`
-      set noteRef to note id "${safeId}"
+      set noteRef to note id "${safeId}"${buildScopeGuardScript("noteRef", scope2)}
       if (count of attachments of noteRef) is greater than 0 then return "SAFETY_ATTACHMENTS"
       set currentBody to body of noteRef
       considering case
@@ -42861,6 +42960,8 @@ var AppleNotesManager = class {
       console.error(`Failed guarded update for note ID "${id2}":`, result.error);
       return { status: "failed" };
     }
+    const updateScopeFailure = parseScopeFailure(result.output);
+    if (updateScopeFailure) return { status: "scope_conflict", reason: updateScopeFailure };
     const status = result.output.trim();
     if (status === "SAFETY_CONFLICT") return { status: "conflict" };
     if (status === "SAFETY_ATTACHMENTS") return { status: "attachments" };
@@ -42872,12 +42973,12 @@ var AppleNotesManager = class {
    * the caller reviewed. The comparison and delete are one AppleScript action,
    * so a concurrent edit cannot slip between the guard and deletion.
    */
-  deleteNoteByIdIfUnchanged(id2, expectedBody) {
+  deleteNoteByIdIfUnchanged(id2, expectedBody, scope2) {
     const safeId = sanitizeNoteId(id2);
     validateLength(expectedBody, MAX_CONTENT_LENGTH, "Expected note content");
     const safeExpectedBody = escapeHtmlForAppleScript(expectedBody);
     const script = buildAppLevelScript(`
-      set noteRef to note id "${safeId}"
+      set noteRef to note id "${safeId}"${buildScopeGuardScript("noteRef", scope2)}
       set originalFolder to missing value
       try
         set originalFolder to container of noteRef
@@ -42909,12 +43010,31 @@ var AppleNotesManager = class {
       console.error(`Failed guarded delete for note ID "${id2}":`, result.error);
       return { status: "failed" };
     }
+    const deleteScopeFailure = parseScopeFailure(result.output);
+    if (deleteScopeFailure) return { status: "scope_conflict", reason: deleteScopeFailure };
     const status = result.output.trim();
     if (status === "SAFETY_CONFLICT") return { status: "conflict" };
     if (status === "SAFETY_IN_RECENTLY_DELETED") return { status: "in-recently-deleted" };
     if (status === "SAFETY_NOT_DELETED") return { status: "not-deleted" };
     return status === "SAFETY_DELETED" ? { status: "deleted" } : { status: "failed" };
   }
+  /**
+   * Read-only scope pre-check for writes that do not run as AppleScript (the
+   * native Shortcuts operations). Runs the same checks the AppleScript writes
+   * embed, but in a separate script, so it is not atomic with the write.
+   *
+   * @returns null when every precondition holds, otherwise the failure reason
+   */
+  checkNoteScope(id2, scope2) {
+    const safeId = sanitizeNoteId(id2);
+    const result = executeAppleScript(
+      buildAppLevelScript(`
+      set noteRef to note id "${safeId}"${buildScopeGuardScript("noteRef", scope2)}
+      return "SCOPE_OK"`)
+    );
+    if (!result.success) return result.error || "the note's folder could not be read";
+    return parseScopeFailure(result.output);
+  }
   /**
    * Builds the AppleScript body for a bulk note listing.
    *
@@ -43310,18 +43430,134 @@ var AppleNotesManager = class {
       );
     return { id: id2, name: newName, parentId: expectedParentId };
   }
-  /** Read the exact name and parent identity used by guarded folder rename. */
+  /** Read the exact name, parent, and account identity used by guarded folder writes. */
   getFolderById(id2) {
     if (!/^x-coredata:\/\/[0-9a-f-]+\/ICFolder\/p\d+$/i.test(id2))
       throw new Error("An exact folder ID is required");
     const result = executeAppleScript(`tell application "Notes"
       set f to folder id "${id2}"
-      return (name of f) & ${AS_FIELD_SEP} & (id of container of f)
+      set acct to container of f
+      repeat while class of acct is folder
+        set acct to container of acct
+      end repeat
+      return (name of f) & ${AS_FIELD_SEP} & (id of container of f) & ${AS_FIELD_SEP} & (id of acct)
     end tell`);
     if (!result.success) throw new Error(result.error || "Folder not found");
-    const [name, parentId] = result.output.replace(/\n$/, "").split(FIELD_SEP);
+    const [name, parentId, accountId] = result.output.replace(/\n$/, "").split(FIELD_SEP);
     if (!name || !parentId) throw new Error("Incomplete folder metadata");
-    return { id: id2, name, parentId };
+    return accountId ? { id: id2, name, parentId, accountId, isRoot: parentId === accountId } : { id: id2, name, parentId };
+  }
+  /**
+   * Reads, in one AppleScript, everything Notes.app itself knows about a folder
+   * that guarded deletion checks: name, parent (empty at an account root),
+   * account, the account's default folder, shared state of the folder or any
+   * ancestor, and the counts of direct child folders and notes.
+   */
+  readFolderForDelete(id2) {
+    if (!FOLDER_ID_PATTERN.test(id2)) throw new Error("An exact folder ID is required");
+    const result = executeAppleScript(
+      buildAppLevelScript(`${folderDeleteFactsScript(id2)}
+      return folderName & ${AS_FIELD_SEP} & parentId & ${AS_FIELD_SEP} & acctId & ${AS_FIELD_SEP} & defaultId & ${AS_FIELD_SEP} & (sharedAny as text) & ${AS_FIELD_SEP} & (childCount as text) & ${AS_FIELD_SEP} & (noteCount as text)`)
+    );
+    if (!result.success) throw new Error(result.error || "Folder not found");
+    const parts = result.output.replace(/\n$/, "").split(FIELD_SEP);
+    if (parts.length !== 7 || !parts[0] || !parts[2]) throw new Error("Incomplete folder metadata");
+    const count = (value) => {
+      const parsed = Number(value.trim());
+      if (!Number.isInteger(parsed) || parsed < 0) throw new Error("Incomplete folder metadata");
+      return parsed;
+    };
+    return {
+      id: id2,
+      name: parts[0],
+      parentId: parts[1] || null,
+      accountId: parts[2],
+      defaultFolderId: parts[3] || null,
+      shared: parts[4].trim() === "true",
+      childFolderCount: count(parts[5]),
+      noteCount: count(parts[6])
+    };
+  }
+  /**
+   * Deletes one empty folder by exact id, repeating every Notes.app-visible
+   * guard inside the same AppleScript as the `delete` command: exact name
+   * (case-sensitive), parent or account root, account, not the default folder,
+   * not shared (itself or an ancestor), no child folders, no notes.
+   *
+   * Store-only facts (folder type, stable identifier) are checked by the caller
+   * before this runs, so the whole guard is a pre-check followed by an
+   * AppleScript delete, not one atomic transaction.
+   */
+  deleteEmptyFolderIfUnchanged(id2, expected) {
+    if (!FOLDER_ID_PATTERN.test(id2)) throw new Error("An exact folder ID is required");
+    const literal2 = (value) => `"${escapePlainStringForAppleScript(value)}"`;
+    const script = buildAppLevelScript(`${folderDeleteFactsScript(id2)}
+      considering case
+        if folderName is not ${literal2(expected.name)} then return "SAFETY_CONFLICT:name"
+      end considering
+      if parentId is not ${literal2(expected.parentId ?? "")} then return "SAFETY_CONFLICT:parent"
+      if acctId is not ${literal2(expected.accountId)} then return "SAFETY_CONFLICT:account"
+      if defaultId is ${literal2(id2)} then return "SAFETY_REFUSED:default folder"
+      if sharedAny then return "SAFETY_REFUSED:shared folder"
+      if childCount is not 0 then return "SAFETY_REFUSED:folder has child folders"
+      if noteCount is not 0 then return "SAFETY_REFUSED:folder has notes"
+      delete f
+      return "SAFETY_DELETED"`);
+    const result = executeMutationAppleScript(script);
+    if (!result.success) {
+      console.error(`Failed guarded folder delete for "${id2}":`, result.error);
+      return { status: "failed", reason: result.error || "AppleScript failed" };
+    }
+    const output = result.output.trim();
+    const colon = output.indexOf(":");
+    const status = colon === -1 ? output : output.slice(0, colon);
+    const reason = colon === -1 ? "" : output.slice(colon + 1);
+    if (status === "SAFETY_DELETED") return { status: "deleted" };
+    if (status === "SAFETY_CONFLICT") return { status: "conflict", reason };
+    if (status === "SAFETY_REFUSED") return { status: "refused", reason };
+    return { status: "failed", reason: "Unexpected AppleScript result" };
+  }
+  /**
+   * Counts how many of the given notes Notes.app currently places outside the
+   * folder: in another folder, or in Recently Deleted (a note trashed this
+   * session reports a non-folder container). A note Notes.app cannot resolve
+   * is not counted, so the caller keeps treating it as present.
+   *
+   * The local store can keep a just-trashed note in its old folder for
+   * minutes; this lets guarded folder deletion discount such notes using
+   * Notes.app's live view instead of refusing until the store catches up.
+   */
+  countNotesOutsideFolder(folderId2, noteIds) {
+    if (!FOLDER_ID_PATTERN.test(folderId2)) throw new Error("An exact folder ID is required");
+    if (noteIds.length === 0) return 0;
+    const ids = noteIds.map((noteId3) => `"${sanitizeNoteId(noteId3)}"`).join(", ");
+    const result = executeAppleScript(
+      buildAppLevelScript(`
+      set movedCount to 0
+      repeat with noteIdRef in {${ids}}
+        try
+          set c to container of note id (contents of noteIdRef)
+          if class of c is not folder then
+            set movedCount to movedCount + 1
+          else if (id of c) is not "${folderId2}" then
+            set movedCount to movedCount + 1
+          end if
+        end try
+      end repeat
+      return movedCount as text`)
+    );
+    if (!result.success) return 0;
+    const moved = Number(result.output.trim());
+    return Number.isInteger(moved) && moved >= 0 && moved <= noteIds.length ? moved : 0;
+  }
+  /** Whether Notes.app still resolves an exact folder id. */
+  folderExistsById(id2) {
+    if (!FOLDER_ID_PATTERN.test(id2)) throw new Error("An exact folder ID is required");
+    const result = executeAppleScript(
+      buildAppLevelScript(`return (exists folder id "${id2}") as text`)
+    );
+    if (!result.success) throw new Error(result.error || "Could not check folder existence");
+    return result.output.trim() === "true";
   }
   /** Insert one file into an unchanged exact note and return Notes' attachment ID. */
   addAttachmentById(id2, expectedBody, filePath) {
@@ -43501,14 +43737,14 @@ var AppleNotesManager = class {
    * @param account - Account containing the destination folder (defaults to Notes.app's default account)
    * @returns true if the move succeeded, false otherwise
    */
-  moveNoteById(id2, destinationFolder, account) {
+  moveNoteById(id2, destinationFolder, account, scope2) {
     const targetAccount = this.resolveAccount(account);
     const safeId = sanitizeNoteId(id2);
     const destFolderRef = `${buildFolderReference(destinationFolder)} of ${AS_ACCOUNT_REF}`;
     const moveCommand = `
       ${buildAccountResolution(targetAccount)}
       set destFolder to ${destFolderRef}
-      set noteRef to note id "${safeId}"
+      set noteRef to note id "${safeId}"${buildScopeGuardScript("noteRef", scope2, "destFolder")}
       move noteRef to destFolder
       set movedNoteRef to note id "${safeId}"
       set actualFolder to container of movedNoteRef
@@ -43525,6 +43761,8 @@ var AppleNotesManager = class {
       );
       return false;
     }
+    const scopeFailure = parseScopeFailure(result.output);
+    if (scopeFailure) throw new Error(scopeConflictMessage(scopeFailure));
     if (result.output.trim() !== "SAFETY_MOVED") {
       console.error(
         `Move result for note ID "${id2}" did not verify destination "${destinationFolder}"`
@@ -44426,12 +44664,12 @@ var AppleNotesManager = class {
       }
     });
     if (runnable.length > 0) {
-      const idList = runnable.map((r) => `"${r.safe}"`).join(", ");
+      const idList2 = runnable.map((r) => `"${r.safe}"`).join(", ");
       const script = buildAppLevelScript(`
         ${buildAccountResolution(targetAccount)}
         set destFolder to ${destFolderRef}
         set out to ""
-        repeat with rawId in {${idList}}
+        repeat with rawId in {${idList2}}
           set theId to (rawId as text)
           set noteRef to missing value
           try
@@ -46307,12 +46545,12 @@ function resolveFolders(rows) {
     seen.add(pk);
     const parent = row.parent !== null ? resolve5(row.parent, seen) : void 0;
     const name = row.name ?? "";
-    const path9 = parent ? `${parent.path}/${escapeSegment(name)}` : escapeSegment(name);
+    const path10 = parent ? `${parent.path}/${escapeSegment(name)}` : escapeSegment(name);
     const plainPath = parent ? `${parent.plainPath}/${name}` : name;
     const info = {
-      path: path9,
+      path: path10,
       plainPath,
-      keys: [...new Set([name, plainPath, path9].map(normalizeForMatch))],
+      keys: [...new Set([name, plainPath, path10].map(normalizeForMatch))],
       accountPk: row.owner ?? parent?.accountPk ?? null,
       shared: Boolean(row.shared) || Boolean(parent?.shared)
     };
@@ -46653,9 +46891,9 @@ function runNativeTagsShortcut(input) {
     throw new Error(`Import the supplied ${status.shortcut}.shortcut in Shortcuts first`);
   const directory = mkdtempSync2(join15(tmpdir2(), "apple-notes-native-tags-"));
   try {
-    const path9 = join15(directory, "request.json");
-    writeFileSync(path9, JSON.stringify(input), { mode: 384 });
-    execFileSync14("/usr/bin/shortcuts", ["run", status.identifier, "--input-path", path9], {
+    const path10 = join15(directory, "request.json");
+    writeFileSync(path10, JSON.stringify(input), { mode: 384 });
+    execFileSync14("/usr/bin/shortcuts", ["run", status.identifier, "--input-path", path10], {
       encoding: "utf8",
       timeout: 6e4,
       maxBuffer: 1024 * 1024,
@@ -47259,7 +47497,7 @@ function createMarkdownNote(manager, request, run = runBackgroundShortcut) {
     throw new Error(
       `Install the supplied "${status.shortcut}" Shortcut once; Shortcuts must list it exactly once`
     );
-  const segments = (path9) => JSON.stringify(splitFolderPath(path9).map((part) => part.toLocaleLowerCase()));
+  const segments = (path10) => JSON.stringify(splitFolderPath(path10).map((part) => part.toLocaleLowerCase()));
   if (request.folder) {
     const wanted = segments(request.folder);
     if (!manager.listAccounts().some(
@@ -47589,9 +47827,9 @@ function getCapabilityMatrix(probe = probeCapabilityEnvironment) {
   return evaluateFeatures(probe());
 }
 function formatCapabilityMatrix(matrix) {
-  const os9 = matrix.runtimeOS;
+  const os10 = matrix.runtimeOS;
   const lines = [
-    `Feature matrix (macOS ${os9.macOSVersion ?? "unknown"}, Darwin ${os9.darwinRelease}):`
+    `Feature matrix (macOS ${os10.macOSVersion ?? "unknown"}, Darwin ${os10.darwinRelease}):`
   ];
   for (const [name, status] of Object.entries(matrix.features)) {
     lines.push(
@@ -47717,11 +47955,11 @@ function fileConfigPath(env = process.env) {
   if (override && override.trim()) return override.trim();
   return join17(homedir14(), "Library", "Application Support", "apple-notes-mcp", "config.json");
 }
-function loadFileConfig(env = process.env, path9 = fileConfigPath(env)) {
+function loadFileConfig(env = process.env, path10 = fileConfigPath(env)) {
   const applied = [];
   try {
-    if (!existsSync11(path9)) return applied;
-    const parsed = JSON.parse(readFileSync2(path9, "utf8"));
+    if (!existsSync11(path10)) return applied;
+    const parsed = JSON.parse(readFileSync2(path10, "utf8"));
     if (!parsed || typeof parsed !== "object") return applied;
     for (const [k, v] of Object.entries(parsed)) {
       if (typeof v !== "string") continue;
@@ -47731,7 +47969,7 @@ function loadFileConfig(env = process.env, path9 = fileConfigPath(env)) {
       }
     }
   } catch (e) {
-    console.error(`Failed to load apple-notes-mcp config file ${path9}: ${String(e)}`);
+    console.error(`Failed to load apple-notes-mcp config file ${path10}: ${String(e)}`);
   }
   return applied;
 }
@@ -48574,10 +48812,10 @@ function listDirectory(dir, limit) {
     return [];
   }
 }
-function isFile(path9) {
+function isFile(path10) {
   let fd;
   try {
-    fd = openSync4(path9, constants4.O_RDONLY | constants4.O_NOFOLLOW);
+    fd = openSync4(path10, constants4.O_RDONLY | constants4.O_NOFOLLOW);
     return fstatSync4(fd).isFile();
   } catch {
     return false;
@@ -48585,9 +48823,9 @@ function isFile(path9) {
     if (fd !== void 0) closeSync4(fd);
   }
 }
-function isDirectory2(path9) {
+function isDirectory2(path10) {
   try {
-    return statSync3(path9).isDirectory();
+    return statSync3(path10).isDirectory();
   } catch {
     return false;
   }
@@ -48671,8 +48909,8 @@ var AssetLocator = class {
       join19(account, "Media", mediaId, filename)
     ];
     for (const candidate of candidates) {
-      const path9 = confine(candidate, account);
-      if (path9 && isFile(path9)) return { path: path9, name: filename, role: "original" };
+      const path10 = confine(candidate, account);
+      if (path10 && isFile(path10)) return { path: path10, name: filename, role: "original" };
     }
     return void 0;
   }
@@ -48687,8 +48925,8 @@ var AssetLocator = class {
     ];
     for (const g of generations)
       for (const name of names) {
-        const path9 = confine(g ? join19(base, g, name) : join19(base, name), account);
-        if (path9 && isFile(path9)) return path9;
+        const path10 = confine(g ? join19(base, g, name) : join19(base, name), account);
+        if (path10 && isFile(path10)) return path10;
       }
     return void 0;
   }
@@ -48721,16 +48959,16 @@ var AssetLocator = class {
   bundleImage(bundle, account) {
     const found = [];
     for (const child of listDirectory(bundle, MAX_BUNDLE_ENTRIES2)) {
-      const path9 = confine(join19(bundle, child), account);
-      if (!path9) continue;
-      if (isFile(path9)) found.push(path9);
+      const path10 = confine(join19(bundle, child), account);
+      if (!path10) continue;
+      if (isFile(path10)) found.push(path10);
       else
-        for (const grandchild of listDirectory(path9, MAX_BUNDLE_ENTRIES2)) {
-          const inner = confine(join19(path9, grandchild), account);
+        for (const grandchild of listDirectory(path10, MAX_BUNDLE_ENTRIES2)) {
+          const inner = confine(join19(path10, grandchild), account);
           if (inner && isFile(inner)) found.push(inner);
         }
     }
-    return found.find((path9) => basename3(path9) === "Preview.png") ?? found.find((path9) => IMAGE_EXTENSIONS.has(extname3(path9).toLowerCase()));
+    return found.find((path10) => basename3(path10) === "Preview.png") ?? found.find((path10) => IMAGE_EXTENSIONS.has(extname3(path10).toLowerCase()));
   }
 };
 function sniffMime(head, name) {
@@ -48778,8 +49016,8 @@ function safeAssetName(name, mime) {
   if (clean.length > 120) clean = clean.slice(0, 120 - ext.length) + ext;
   return clean;
 }
-function encodePathUrl(path9) {
-  return path9.split("/").map(encodeURIComponent).join("/");
+function encodePathUrl(path10) {
+  return path10.split("/").map(encodeURIComponent).join("/");
 }
 function canonicalForm(abs) {
   let current = abs;
@@ -48798,7 +49036,7 @@ function canonicalForm(abs) {
 }
 function assertExportPath(p, container = NOTES_CONTAINER) {
   const abs = assertSafeSavePath(p);
-  const within = (path9, root) => path9 === root || path9.startsWith(root + sep3);
+  const within = (path10, root) => path10 === root || path10.startsWith(root + sep3);
   const roots = [resolve3(container), canonicalForm(resolve3(container))];
   const forms = [abs, canonicalForm(abs)];
   if (forms.some((form) => roots.some((root) => within(form, root))))
@@ -48808,16 +49046,16 @@ function assertExportPath(p, container = NOTES_CONTAINER) {
 var CREATE_FLAGS = constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW;
 var OutputExistsError = class extends Error {
   code = "output_exists";
-  constructor(path9) {
-    super(`Output file already exists: ${path9}. Choose a new path or remove the old file first.`);
+  constructor(path10) {
+    super(`Output file already exists: ${path10}. Choose a new path or remove the old file first.`);
     this.name = "OutputExistsError";
   }
 };
-function openCreateOnly(path9) {
+function openCreateOnly(path10) {
   try {
-    return openSync4(path9, CREATE_FLAGS, 420);
+    return openSync4(path10, CREATE_FLAGS, 420);
   } catch (error2) {
-    if (error2.code === "EEXIST") throw new OutputExistsError(path9);
+    if (error2.code === "EEXIST") throw new OutputExistsError(path10);
     throw error2;
   }
 }
@@ -48831,8 +49069,8 @@ function writeAllAndClose(fd, content) {
     closeSync4(fd);
   }
 }
-function openSource(path9) {
-  const fd = openSync4(path9, constants4.O_RDONLY | constants4.O_NOFOLLOW);
+function openSource(path10) {
+  const fd = openSync4(path10, constants4.O_RDONLY | constants4.O_NOFOLLOW);
   const stat = fstatSync4(fd);
   if (!stat.isFile()) {
     closeSync4(fd);
@@ -49814,9 +50052,9 @@ var NotesExportError = class extends Error {
   }
   code;
 };
-function validPath(path9, what) {
+function validPath(path10, what) {
   try {
-    return assertExportPath(path9);
+    return assertExportPath(path10);
   } catch (error2) {
     throw new NotesExportError(
       "invalid-path",
@@ -50005,9 +50243,9 @@ function assertExistingContentPreserved(before, after) {
       throw new Error("Existing native object content or presentation changed");
   }
 }
-function localAttachment(path9) {
-  if (!isAbsolute3(path9)) throw new Error("An absolute local file path is required");
-  const descriptor = openSync5(path9, constants5.O_RDONLY | constants5.O_NOFOLLOW);
+function localAttachment(path10) {
+  if (!isAbsolute3(path10)) throw new Error("An absolute local file path is required");
+  const descriptor = openSync5(path10, constants5.O_RDONLY | constants5.O_NOFOLLOW);
   try {
     const stat = fstatSync5(descriptor);
     if (!stat.isFile() || stat.size === 0 || stat.size > 64 * 1024 * 1024)
@@ -50045,7 +50283,7 @@ function registerDirectOperations(server2, manager) {
   }
   tool(
     "get-folder-by-id",
-    "Use when: reading the exact folder name and parent before a guarded rename.\nReturns: folder id, current name, and parent id.\nDo not use when: listing folders by path (list-folders).\nSafety: read-only.",
+    "Use when: reading the exact folder name, parent, and account before a guarded rename or delete-folder-by-id.\nReturns: folder id, current name, parent id, accountId, and isRoot (true when the folder sits at the account root; pass expectedRoot: true to delete-folder-by-id then, otherwise parentId as expectedParentId).\nDo not use when: listing folders by path (list-folders).\nSafety: read-only.",
     { id: folderId },
     ({ id: id2 }) => {
       const folder = manager.getFolderById(id2);
@@ -50129,8 +50367,8 @@ function registerDirectOperations(server2, manager) {
     }
   );
 }
-function attachmentName(path9, filename) {
-  const source = basename5(path9);
+function attachmentName(path10, filename) {
+  const source = basename5(path10);
   if (filename === void 0) return source;
   if (Buffer.byteLength(filename, "utf8") > 255)
     throw new Error("filename must be at most 255 bytes");
@@ -50145,11 +50383,11 @@ function attachmentName(path9, filename) {
   return filename;
 }
 function attachFile(manager, args) {
-  const { id: id2, expectedContentHash, path: path9 } = args;
-  const name = attachmentName(path9, args.filename);
+  const { id: id2, expectedContentHash, path: path10 } = args;
+  const name = attachmentName(path10, args.filename);
   const before = readSnapshot(manager, id2);
   if (before.hash !== expectedContentHash) throw new Error("Note revision changed");
-  const bytes = localAttachment(path9);
+  const bytes = localAttachment(path10);
   const beforeAttachments = manager.listAttachmentsById(id2);
   const directory = mkdtempSync4(join22(tmpdir4(), "notes-attachment-add-"));
   const temporaryFile = join22(directory, name);
@@ -50206,6 +50444,329 @@ function attachFile(manager, args) {
   }
 }
 
+// src/tools/folderDelete.ts
+import { createHash as createHash3 } from "node:crypto";
+
+// src/utils/folderStore.ts
+import { execFileSync as execFileSync19 } from "child_process";
+import * as os9 from "os";
+import * as path9 from "path";
+var NOTE_STORE_PATH = path9.join(
+  os9.homedir(),
+  "Library/Group Containers/group.com.apple.notes/NoteStore.sqlite"
+);
+var NOTE_KEY_LIMIT = 50;
+var FolderStoreError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "FolderStoreError";
+  }
+  reason;
+};
+var REQUIRED_FOLDER_COLUMNS = [
+  "ZFOLDERTYPE",
+  "ZIDENTIFIER",
+  "ZMARKEDFORDELETION",
+  "ZPARENT",
+  "ZOWNER",
+  "ZFOLDER",
+  "ZSERVERSHAREDATA"
+];
+function buildFolderFactsSql(hasSmartQueryColumn) {
+  const smart = hasSmartQueryColumn ? "coalesce(f.ZSMARTFOLDERQUERYJSON, '') <> ''" : "0";
+  return `WITH RECURSIVE anc(pk, depth) AS (
+  SELECT ZPARENT, 1 FROM ZICCLOUDSYNCINGOBJECT WHERE Z_PK = @pk
+  UNION ALL
+  SELECT o.ZPARENT, anc.depth + 1 FROM ZICCLOUDSYNCINGOBJECT o JOIN anc ON o.Z_PK = anc.pk
+  WHERE anc.pk IS NOT NULL AND anc.depth < 64
+)
+SELECT json_object(
+  'pk', f.Z_PK,
+  'entity', e.Z_NAME,
+  'identifier', f.ZIDENTIFIER,
+  'folderType', f.ZFOLDERTYPE,
+  'markedForDeletion', coalesce(f.ZMARKEDFORDELETION, 0),
+  'parentPk', f.ZPARENT,
+  'accountPk', f.ZOWNER,
+  'hasSmartQuery', ${smart},
+  'sharedRecord', f.ZSERVERSHAREDATA IS NOT NULL,
+  'sharedAncestor', (SELECT count(*) FROM ZICCLOUDSYNCINGOBJECT a JOIN anc ON a.Z_PK = anc.pk
+                     WHERE a.ZSERVERSHAREDATA IS NOT NULL) > 0,
+  'childFolderCount', (SELECT count(*) FROM ZICCLOUDSYNCINGOBJECT c
+                       WHERE c.Z_ENT = f.Z_ENT AND c.ZPARENT = f.Z_PK
+                         AND coalesce(c.ZMARKEDFORDELETION, 0) = 0),
+  'noteCount', (SELECT count(*) FROM ZICCLOUDSYNCINGOBJECT n
+                WHERE n.Z_ENT = (SELECT Z_ENT FROM Z_PRIMARYKEY WHERE Z_NAME = 'ICNote')
+                  AND n.ZFOLDER = f.Z_PK AND coalesce(n.ZMARKEDFORDELETION, 0) = 0),
+  'noteKeys', json((SELECT json_group_array(k.Z_PK) FROM (
+                SELECT n.Z_PK FROM ZICCLOUDSYNCINGOBJECT n
+                WHERE n.Z_ENT = (SELECT Z_ENT FROM Z_PRIMARYKEY WHERE Z_NAME = 'ICNote')
+                  AND n.ZFOLDER = f.Z_PK AND coalesce(n.ZMARKEDFORDELETION, 0) = 0
+                ORDER BY n.Z_PK LIMIT ${NOTE_KEY_LIMIT}) k))
+)
+FROM ZICCLOUDSYNCINGOBJECT f JOIN Z_PRIMARYKEY e ON e.Z_ENT = f.Z_ENT
+WHERE f.Z_PK = @pk;`;
+}
+function runSqlite7(dbPath2, sql, pk) {
+  const args = ["-readonly"];
+  if (pk !== void 0) args.push("-cmd", `.parameter set @pk ${pk}`);
+  args.push(dbPath2, sql);
+  return execFileSync19("sqlite3", args, {
+    encoding: "utf8",
+    timeout: 5e3,
+    stdio: ["pipe", "pipe", "pipe"]
+  }).trim();
+}
+function classify(error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
+  if (/authorization denied|unable to open database|not authorized/i.test(message)) {
+    return new FolderStoreError(
+      "Full Disk Access is required to verify folder type and contents before deleting. Grant it to the app that launches this server, then relaunch it.",
+      "no_fda"
+    );
+  }
+  return new FolderStoreError(`Failed to read folder facts: ${message}`, "query_error");
+}
+function numberOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function readFolderStoreFacts(pk, dbPath2 = NOTE_STORE_PATH) {
+  if (!Number.isSafeInteger(pk) || pk <= 0) {
+    throw new FolderStoreError("Folder key must be a positive integer", "query_error");
+  }
+  let columns;
+  let row;
+  try {
+    columns = new Set(
+      runSqlite7(dbPath2, "PRAGMA table_info(ZICCLOUDSYNCINGOBJECT);").split("\n").map((line) => line.split("|")[1]).filter(Boolean)
+    );
+    const missing = REQUIRED_FOLDER_COLUMNS.filter((column) => !columns.has(column));
+    if (missing.length > 0) {
+      throw new FolderStoreError(
+        `This macOS Notes schema lacks ${missing.join(", ")}; folder safety cannot be verified`,
+        "schema"
+      );
+    }
+    row = runSqlite7(dbPath2, buildFolderFactsSql(columns.has("ZSMARTFOLDERQUERYJSON")), pk);
+  } catch (error2) {
+    if (error2 instanceof FolderStoreError) throw error2;
+    throw classify(error2);
+  }
+  if (!row) return null;
+  const raw = JSON.parse(row);
+  if (raw.entity !== "ICFolder") {
+    throw new FolderStoreError("That identifier does not name a folder", "not_folder");
+  }
+  return {
+    pk,
+    identifier: typeof raw.identifier === "string" ? raw.identifier : null,
+    folderType: numberOrNull(raw.folderType),
+    markedForDeletion: raw.markedForDeletion === 1,
+    parentPk: numberOrNull(raw.parentPk),
+    accountPk: numberOrNull(raw.accountPk),
+    hasSmartQuery: raw.hasSmartQuery === 1,
+    sharedRecord: raw.sharedRecord === 1,
+    sharedAncestor: raw.sharedAncestor === 1,
+    childFolderCount: numberOrNull(raw.childFolderCount) ?? 0,
+    noteCount: numberOrNull(raw.noteCount) ?? 0,
+    noteKeys: Array.isArray(raw.noteKeys) ? raw.noteKeys.filter((key) => typeof key === "number") : []
+  };
+}
+
+// src/tools/folderDelete.ts
+var folderIdSchema = external_exports.string().max(2e3).transform(looseIdTransform("ICFolder"));
+var accountIdSchema = external_exports.string().max(2e3).regex(/^x-coredata:\/\/[0-9a-f-]+\/ICAccount\/p\d+$/i, "An exact account ID is required");
+var revisionSchema = external_exports.string().regex(/^sha256:[a-f0-9]{64}$/);
+var defaultDeps = {
+  readStore: (pk) => readFolderStoreFacts(pk),
+  sleep: (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+};
+function conflict(message) {
+  return new CodedError(`Conflict: ${message}`, { code: "revision_conflict", committed: false });
+}
+function refused(message) {
+  return new CodedError(`Refused: ${message}`, { code: "unsupported", committed: false });
+}
+function uncertain(message) {
+  return new CodedError(message, { code: "verification_failed", indeterminate: true });
+}
+function invalid(message) {
+  return new CodedError(message, { code: "validation_error", committed: false });
+}
+function coreDataPk(id2) {
+  const match = /\/p(\d+)$/.exec(id2);
+  if (!match) throw new Error(`Not an x-coredata id: ${id2}`);
+  return Number(match[1]);
+}
+function folderDeleteRefusal(app, store) {
+  if (store.folderType === 1 || store.identifier?.startsWith("TrashFolder-"))
+    return "Refusing to delete the Recently Deleted folder";
+  if (store.folderType === 2 || store.hasSmartQuery) return "Refusing to delete a smart folder";
+  if (store.folderType !== 0)
+    return `Refusing to delete a folder with unsupported folder type ${String(store.folderType)}`;
+  if (!store.identifier)
+    return "Refusing to delete a folder without a stable identifier (it cannot be verified)";
+  if (store.identifier.startsWith("DefaultFolder-") || app.defaultFolderId === app.id)
+    return "Refusing to delete a system or default folder";
+  if (app.shared || store.sharedRecord || store.sharedAncestor)
+    return "Refusing to delete a shared or collaborated folder";
+  return null;
+}
+function folderDeleteRevision(app, store) {
+  const state = [
+    app.id,
+    store.identifier,
+    app.name,
+    app.accountId,
+    app.parentId,
+    app.defaultFolderId === app.id,
+    app.shared,
+    app.childFolderCount,
+    app.noteCount,
+    store.folderType,
+    store.markedForDeletion,
+    store.hasSmartQuery,
+    store.sharedRecord,
+    store.sharedAncestor,
+    store.childFolderCount,
+    store.noteCount
+  ];
+  return `sha256:${createHash3("sha256").update(JSON.stringify(state)).digest("hex")}`;
+}
+function checkFolder(manager, args, deps) {
+  const app = manager.readFolderForDelete(args.id);
+  const store = deps.readStore(coreDataPk(args.id));
+  if (!store)
+    throw conflict(
+      "the folder is not in the local Notes store yet; wait for Notes to save it and plan again"
+    );
+  if (store.markedForDeletion) throw conflict("the folder is already deleted");
+  const expectedParentPk = app.parentId ? coreDataPk(app.parentId) : null;
+  if (store.accountPk !== coreDataPk(app.accountId) || store.parentPk !== expectedParentPk)
+    throw conflict(
+      "Notes.app and the local store disagree about this folder's location; wait a moment and plan again"
+    );
+  if (app.name !== args.expectedName) throw conflict("the folder name changed");
+  if (app.accountId !== args.expectedAccountId)
+    throw conflict("the folder is in a different account");
+  if (args.expectedRoot ? app.parentId !== null : app.parentId !== args.expectedParentId)
+    throw conflict("the folder's parent changed");
+  const refusal = folderDeleteRefusal(app, store);
+  if (refusal) throw refused(refusal);
+  let storeNotes = store.noteCount;
+  if (storeNotes > app.noteCount && store.noteKeys.length === storeNotes) {
+    const notePrefix = args.id.replace(/\/ICFolder\/p\d+$/, "/ICNote/p");
+    storeNotes -= manager.countNotesOutsideFolder(
+      args.id,
+      store.noteKeys.map((key) => `${notePrefix}${key}`)
+    );
+  }
+  const children = Math.max(app.childFolderCount, store.childFolderCount);
+  const notes = Math.max(app.noteCount, storeNotes);
+  if (children > 0 || notes > 0)
+    throw refused(
+      `the folder is not empty (${children} child folder(s), ${notes} note(s)); move or delete them first`
+    );
+  return {
+    app,
+    store,
+    identifier: store.identifier,
+    revision: folderDeleteRevision(app, { ...store, noteCount: storeNotes })
+  };
+}
+function runFolderDelete(manager, args, deps = defaultDeps) {
+  if (Boolean(args.expectedRoot) === (args.expectedParentId !== void 0))
+    throw invalid("Pass exactly one of expectedParentId or expectedRoot: true");
+  if (args.dryRun && args.expectedRevision)
+    throw invalid("expectedRevision belongs to the apply call (dryRun: false)");
+  if (!args.dryRun && !args.expectedRevision)
+    throw invalid("Apply requires expectedRevision from a matching dry run");
+  const checked = checkFolder(manager, args, deps);
+  const base = {
+    ok: true,
+    id: args.id,
+    identifier: checked.identifier,
+    name: checked.app.name,
+    accountId: checked.app.accountId,
+    parentId: checked.app.parentId,
+    folderType: 0,
+    childFolderCount: 0,
+    noteCount: 0,
+    revision: checked.revision
+  };
+  if (args.dryRun)
+    return { ...base, status: "planned", dryRun: true, committed: false, wouldDelete: true };
+  if (checked.revision !== args.expectedRevision)
+    throw conflict("the folder changed since the dry run; plan again");
+  const outcome = manager.deleteEmptyFolderIfUnchanged(args.id, {
+    name: checked.app.name,
+    parentId: checked.app.parentId,
+    accountId: checked.app.accountId
+  });
+  if (outcome.status === "conflict")
+    throw conflict(`the folder ${outcome.reason} changed before deletion; plan again`);
+  if (outcome.status === "refused") throw refused(outcome.reason);
+  if (outcome.status === "failed")
+    throw uncertain(
+      `The delete outcome is uncertain (${outcome.reason}); read folder ${args.id} before retrying`
+    );
+  if (manager.folderExistsById(args.id))
+    throw uncertain(
+      `The delete outcome is uncertain: Notes.app still resolves folder ${args.id}; read it before retrying`
+    );
+  let storeTombstoned = false;
+  for (let attempt = 0; attempt < 5 && !storeTombstoned; attempt++) {
+    if (attempt > 0) deps.sleep(200);
+    const after = deps.readStore(coreDataPk(args.id));
+    storeTombstoned = !after || after.markedForDeletion;
+  }
+  return {
+    ...base,
+    status: "deleted",
+    dryRun: false,
+    committed: true,
+    wouldDelete: true,
+    verified: true,
+    storeTombstoned
+  };
+}
+function registerFolderDelete(server2, manager, deps = defaultDeps) {
+  const inputSchema = {
+    id: folderIdSchema.describe(
+      "Exact folder id (x-coredata://\u2026/ICFolder/pN) from list-folders, or the folder's Notes UUID or numeric key"
+    ),
+    expectedName: external_exports.string().min(1).max(1e3).describe("Current folder name (not a path), matched case-sensitively"),
+    expectedAccountId: accountIdSchema.describe(
+      "Owning account id, from get-folder-by-id or list-accounts"
+    ),
+    expectedParentId: folderIdSchema.optional().describe("Current parent folder id; omit and pass expectedRoot for a top-level folder"),
+    expectedRoot: external_exports.literal(true).optional().describe("Pass true when the folder sits at the account root (no parent folder)"),
+    dryRun: external_exports.boolean().describe("true plans and returns a revision; false applies with expectedRevision"),
+    expectedRevision: revisionSchema.optional().describe("The revision returned by the dry run; required when dryRun is false")
+  };
+  server2.registerTool(
+    "delete-folder-by-id",
+    {
+      description: "Use when: deleting one exact, empty, ordinary folder by id, with a plan-then-apply handshake.\nReturns: a plan (status planned, wouldDelete, identity fields, zero counts, revision) or, on apply, status deleted with verified readback.\nDo not use when: the folder holds notes or subfolders, or you only have a name or path (delete-folder).\nSafety: requires the exact id plus expectedName, expectedAccountId, and expectedParentId or expectedRoot. Call with dryRun true, then repeat the same guards with dryRun false and expectedRevision. Always refuses Recently Deleted, smart folders, the account's default and other system folders, shared folders, and non-empty folders; there is no override. Not atomic: the guard is a pre-check followed by an AppleScript delete. The Notes.app-visible checks repeat inside the delete script, but folder type is read from the local store just before it. Needs Full Disk Access and fails closed without it.",
+      inputSchema,
+      outputSchema: external_exports.object({ ok: external_exports.boolean().optional() }).passthrough(),
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false }
+    },
+    (async (args) => {
+      try {
+        const result = runFolderDelete(manager, args, deps);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }],
+          structuredContent: result
+        };
+      } catch (error2) {
+        return errorResult(error2 instanceof Error ? error2.message : String(error2), error2);
+      }
+    })
+  );
+}
+
 // src/tools/nativeTagsBridge.ts
 var noteId2 = exactIdInput(
   "ICNote",
@@ -50731,15 +51292,15 @@ var shortcutFiles = [
 function setupShortcuts(checkOnly, dependencies = {}) {
   const status = dependencies.status || nativeTagsStatus;
   const exists = dependencies.exists || existsSync13;
-  const open = dependencies.open || ((path9) => {
-    const result = spawnSync2("/usr/bin/open", [path9], { encoding: "utf8" });
+  const open = dependencies.open || ((path10) => {
+    const result = spawnSync2("/usr/bin/open", [path10], { encoding: "utf8" });
     return result.status === 0 ? { ok: true } : { ok: false, error: result.stderr || result.error?.message || "open failed" };
   });
   const baseDirectory = dependencies.baseDirectory || resolve4(dirname5(fileURLToPath(import.meta.url)), "../shortcuts");
   const osRelease = (dependencies.osRelease || release2)();
   const darwinMajor = Number.parseInt(osRelease.split(".")[0], 10);
   const items = shortcutFiles.map(({ name, file, optional: optional2 }) => {
-    const path9 = resolve4(baseDirectory, file);
+    const path10 = resolve4(baseDirectory, file);
     let installed = false;
     let identifier;
     let error2;
@@ -50755,9 +51316,9 @@ function setupShortcuts(checkOnly, dependencies = {}) {
     if (!installed && !checkOnly) {
       if (optional2 && !(darwinMajor >= MARKDOWN_MIN_DARWIN_MAJOR))
         skipped = `requires macOS 26 or later (this Mac reports Darwin ${osRelease})`;
-      else if (!exists(path9)) error2 = `Packaged Shortcut is missing: ${path9}`;
+      else if (!exists(path10)) error2 = `Packaged Shortcut is missing: ${path10}`;
       else {
-        const result = open(path9);
+        const result = open(path10);
         opened = result.ok;
         if (!result.ok) error2 = result.error || `Could not open ${file}`;
       }
@@ -50766,7 +51327,7 @@ function setupShortcuts(checkOnly, dependencies = {}) {
       name,
       installed,
       identifier,
-      file: path9,
+      file: path10,
       opened,
       ...optional2 ? { optional: optional2 } : {},
       ...skipped ? { skipped } : {},
@@ -50813,6 +51374,7 @@ var server = new McpServer({
 });
 var notesManager = new AppleNotesManager();
 registerDirectOperations(server, notesManager);
+registerFolderDelete(server, notesManager);
 registerNativeTagsBridge(server, notesManager);
 registerNativeOperations(server, notesManager);
 function successResponse(message, structured) {
@@ -50879,6 +51441,36 @@ function noteIdentifiers(id2) {
 var expectedContentHashInput = external_exports.string().regex(/^sha256:[a-f0-9]{64}$/, "expectedContentHash must come from get-note-content").describe(
   "Revision token returned by get-note-content for this exact ID. The mutation stops if the note changed since that read."
 );
+var SCOPE_FOLDER_ID_MESSAGE = "An exact folder id is required: x-coredata://.../ICFolder/p..., Notes UUID, or numeric key (from list-folders)";
+var scopeFolderIdInput = exactIdInput("ICFolder", SCOPE_FOLDER_ID, SCOPE_FOLDER_ID_MESSAGE, {
+  maxLength: MAX.ID
+});
+var scopeGuardInputs = {
+  ifFolderId: scopeFolderIdInput.optional().describe(
+    "Precondition: the note must currently be in exactly this folder (id from list-folders). Re-checked immediately before the write."
+  ),
+  ifAncestorFolderId: scopeFolderIdInput.optional().describe(
+    "Precondition: the note must be inside this folder or any of its subfolders. Re-checked immediately before the write."
+  ),
+  forbiddenAncestorFolderIds: exactIdArrayInput(
+    "ICFolder",
+    SCOPE_FOLDER_ID,
+    SCOPE_FOLDER_ID_MESSAGE,
+    {
+      maxLength: MAX.ID,
+      maxItems: MAX_FORBIDDEN_FOLDERS
+    }
+  ).optional().describe(
+    "Precondition: the note must not be inside any of these folders or their subfolders (for move-note, neither may the destination). Re-checked immediately before the write."
+  )
+};
+function scopeFrom(args) {
+  return {
+    ifFolderId: args.ifFolderId,
+    ifAncestorFolderId: args.ifAncestorFolderId,
+    forbiddenAncestorFolderIds: args.forbiddenAncestorFolderIds
+  };
+}
 var timeoutSecondsInput = external_exports.number().int().min(CALL_TIMEOUT_SECONDS.min).max(CALL_TIMEOUT_SECONDS.max).optional().describe(
   `Per-call timeout in seconds (${CALL_TIMEOUT_SECONDS.min}-${CALL_TIMEOUT_SECONDS.max}) for each Notes.app automation step this call runs, overriding APPLE_NOTES_MCP_TIMEOUT_MS. A timed-out write is uncertain, not failed: read the note by id before any retry.`
 );
@@ -51805,7 +52397,7 @@ ${lines.join("\n")}` : ".") + partial2,
 registerTool(
   "update-note",
   {
-    description: "Use when: replacing the body of one exact Apple Note after reading it by id.\nReturns: exact id, new content hash, and visible-text readback verification.\nDo not use when: you only have a title, the note changed since the read, or the note has attachments.\nSafety: requires the exact note id and expectedContentHash from get-note-content. The server checks rich metadata revision, atomically checks the AppleScript body, blocks native objects/checklists, and verifies actual link destinations after saving. Preserve returned HTML links unless allowLinkChanges is explicitly requested. Notes.app normalizes HTML, so rich formatting is not claimed as byte-identical.",
+    description: "Use when: replacing the body of one exact Apple Note after reading it by id.\nReturns: exact id, new content hash, and visible-text readback verification.\nDo not use when: you only have a title, the note changed since the read, or the note has attachments.\nSafety: requires the exact note id and expectedContentHash from get-note-content. The server checks rich metadata revision, atomically checks the AppleScript body, blocks native objects/checklists, and verifies actual link destinations after saving. Optional ifFolderId, ifAncestorFolderId, and forbiddenAncestorFolderIds are re-checked inside the same AppleScript as the write. Preserve returned HTML links unless allowLinkChanges is explicitly requested. Notes.app normalizes HTML, so rich formatting is not claimed as byte-identical.",
     inputSchema: {
       id: noteIdInput,
       expectedContentHash: expectedContentHashInput,
@@ -51819,7 +52411,8 @@ registerTool(
         "New note body. AppleScript cannot produce true Apple Notes checklists; checkbox inputs and `- [ ]` markdown do not render as checkable items. Use a plain list and convert in Notes.app with \u21E7\u2318L."
       ),
       format: external_exports.enum(["plaintext", "html"]).optional().default("plaintext").describe("Content format: 'plaintext' (default) or 'html' for rich formatting"),
-      timeoutSeconds: timeoutSecondsInput
+      timeoutSeconds: timeoutSecondsInput,
+      ...scopeGuardInputs
     },
     outputSchema: {
       ok: external_exports.boolean().optional(),
@@ -51838,7 +52431,8 @@ registerTool(
       newTitle,
       newContent,
       format = "plaintext",
-      allowLinkChanges = false
+      allowLinkChanges = false,
+      ...scopeArgs
     }) => {
       const snapshot = readExactNoteSnapshot(id2);
       if ("error" in snapshot) return errorResponse(snapshot.error);
@@ -51859,11 +52453,15 @@ registerTool(
         newTitle,
         newContent,
         format,
-        snapshot.rich.revision
+        snapshot.rich.revision,
+        scopeFrom(scopeArgs)
       );
       if (result.status === "conflict") {
         return errorResponse(revisionConflictMessage(snapshot.note.title));
       }
+      if (result.status === "scope_conflict") {
+        return errorResponse(scopeConflictMessage(result.reason));
+      }
       if (result.status === "attachments") {
         return errorResponse(
           `Note "${snapshot.note.title}" gained an attachment before saving. No content was replaced.`
@@ -51919,7 +52517,8 @@ function guardedAppend({
   separator = "\n\n",
   format = "plaintext",
   scopeText,
-  htmlSeparator
+  htmlSeparator,
+  ...scopeArgs
 }, onRoute) {
   const contentToHtml = (text2) => {
     if (format === "html") return text2;
@@ -51947,6 +52546,11 @@ function guardedAppend({
       return errorResponse("Provide scopeText: a unique existing phrase for native append");
     if (!VERIFIED_BACKGROUND.has("append-native"))
       return errorResponse("Native append has not passed live validation; see get-capabilities");
+    const nativeScope = scopeFrom(scopeArgs);
+    if (hasScopeGuard(nativeScope)) {
+      const reason = notesManager.checkNoteScope(id2, nativeScope);
+      if (reason) return errorResponse(scopeConflictMessage(reason));
+    }
     onRoute?.("native");
     const result2 = appendNative(notesManager, {
       id: id2,
@@ -51978,11 +52582,15 @@ function guardedAppend({
     void 0,
     combinedBody,
     "html",
-    snapshot.rich.revision
+    snapshot.rich.revision,
+    scopeFrom(scopeArgs)
   );
   if (result.status === "conflict") {
     return errorResponse(revisionConflictMessage(snapshot.note.title));
   }
+  if (result.status === "scope_conflict") {
+    return errorResponse(scopeConflictMessage(result.reason));
+  }
   if (result.status === "attachments") {
     return errorResponse(
       `Note "${snapshot.note.title}" gained an attachment before saving. No content was appended.`
@@ -52023,7 +52631,7 @@ function guardedAppend({
 registerTool(
   "append-to-note",
   {
-    description: "Use when: adding content to one exact note after reading it by id.\nReturns: exact id, new content hash, and visible-text readback verification.\nDo not use when: you only have a title or the note changed since the read.\nSafety: protected native-object notes use native end-append with scopeText; ordinary notes retain guarded HTML editing. Notes.app normalizes HTML, so rich formatting is not claimed as byte-identical.\nNative-append HTML subset (protected notes only; ordinary notes accept any HTML Notes.app renders): " + NATIVE_APPEND_HTML_SUBSET + " Native append also requires scopeText, the default blank-line separator and position 'after'.",
+    description: "Use when: adding content to one exact note after reading it by id.\nReturns: exact id, new content hash, and visible-text readback verification.\nDo not use when: you only have a title or the note changed since the read.\nSafety: protected native-object notes use native end-append with scopeText; ordinary notes retain guarded HTML editing. Optional ifFolderId, ifAncestorFolderId, and forbiddenAncestorFolderIds are re-checked inside the write AppleScript for ordinary notes, and as a separate read just before a native append. Notes.app normalizes HTML, so rich formatting is not claimed as byte-identical.\nNative-append HTML subset (protected notes only; ordinary notes accept any HTML Notes.app renders): " + NATIVE_APPEND_HTML_SUBSET + " Native append also requires scopeText, the default blank-line separator and position 'after'.",
     inputSchema: {
       id: noteIdInput,
       expectedContentHash: expectedContentHashInput,
@@ -52034,7 +52642,8 @@ registerTool(
       ),
       separator: external_exports.string().max(20).optional().default("\n\n").describe("String placed between existing content and new content (default: two newlines)"),
       format: external_exports.enum(["plaintext", "html"]).optional().default("plaintext").describe("Format of the content being appended: 'plaintext' (default) or 'html'"),
-      timeoutSeconds: timeoutSecondsInput
+      timeoutSeconds: timeoutSecondsInput,
+      ...scopeGuardInputs
     },
     outputSchema: {
       ok: external_exports.boolean().optional(),
@@ -52120,11 +52729,12 @@ registerTool(
 registerTool(
   "delete-note",
   {
-    description: "Use when: moving one exact note to Recently Deleted after reading and reviewing it.\nReturns: confirmation with the exact id.\nDo not use when: you only have a title or the note changed since review.\nSafety: requires id and expectedContentHash from get-note-content. The body comparison and delete happen in one AppleScript, so a newer edit is preserved. Refuses a note already in Recently Deleted, where a delete would be permanent.",
+    description: "Use when: moving one exact note to Recently Deleted after reading and reviewing it.\nReturns: confirmation with the exact id.\nDo not use when: you only have a title or the note changed since review.\nSafety: requires id and expectedContentHash from get-note-content. The body comparison and delete happen in one AppleScript, so a newer edit is preserved. Refuses a note already in Recently Deleted, where a delete would be permanent. Optional ifFolderId, ifAncestorFolderId, and forbiddenAncestorFolderIds are re-checked inside that AppleScript too.",
     inputSchema: {
       id: noteIdInput,
       expectedContentHash: expectedContentHashInput,
-      timeoutSeconds: timeoutSecondsInput
+      timeoutSeconds: timeoutSecondsInput,
+      ...scopeGuardInputs
     },
     outputSchema: {
       ok: external_exports.boolean().optional(),
@@ -52134,16 +52744,19 @@ registerTool(
       previousContentHash: external_exports.string().optional()
     }
   },
-  withErrorHandling(({ id: id2, expectedContentHash }) => {
+  withErrorHandling(({ id: id2, expectedContentHash, ...scopeArgs }) => {
     const snapshot = readExactNoteSnapshot(id2);
     if ("error" in snapshot) return errorResponse(snapshot.error);
     if (snapshot.contentHash !== expectedContentHash) {
       return errorResponse(revisionConflictMessage(snapshot.note.title));
     }
-    const result = notesManager.deleteNoteByIdIfUnchanged(id2, snapshot.body);
+    const result = notesManager.deleteNoteByIdIfUnchanged(id2, snapshot.body, scopeFrom(scopeArgs));
     if (result.status === "conflict") {
       return errorResponse(revisionConflictMessage(snapshot.note.title));
     }
+    if (result.status === "scope_conflict") {
+      return errorResponse(scopeConflictMessage(result.reason));
+    }
     if (result.status === "in-recently-deleted") {
       return errorResponse(inRecentlyDeletedMessage(snapshot.note.title));
     }
@@ -52171,12 +52784,13 @@ registerTool(
 registerTool(
   "move-note",
   {
-    description: "Use when: moving one exact note to a different folder by id.\nReturns: confirmation and exact-ID readback.\nDo not use when: you only have a title or want to move many notes (batch-move-notes).\nNote: Notes.app's native move preserves the note id, creation date, body, and attachments. The destination folder must already exist.",
+    description: "Use when: moving one exact note to a different folder by id.\nReturns: confirmation and exact-ID readback.\nDo not use when: you only have a title or want to move many notes (batch-move-notes).\nNote: Notes.app's native move preserves the note id, creation date, body, and attachments. The destination folder must already exist. Optional ifFolderId, ifAncestorFolderId, and forbiddenAncestorFolderIds (which also covers the destination) are re-checked inside the move AppleScript.",
     inputSchema: {
       id: noteIdInput,
       folder: external_exports.string().min(1, "Destination folder is required").max(MAX.FOLDER),
       account: external_exports.string().max(MAX.ACCOUNT).optional().describe("Account containing the note/folder"),
-      timeoutSeconds: timeoutSecondsInput
+      timeoutSeconds: timeoutSecondsInput,
+      ...scopeGuardInputs
     },
     outputSchema: {
       ok: external_exports.boolean().optional(),
@@ -52186,12 +52800,12 @@ registerTool(
       verified: external_exports.boolean().optional()
     }
   },
-  withErrorHandling(({ id: id2, folder, account }) => {
+  withErrorHandling(({ id: id2, folder, account, ...scopeArgs }) => {
     const note = notesManager.getNoteById(id2);
     if (!note) {
       return errorResponse(`Note with ID "${id2}" not found`);
     }
-    const success = notesManager.moveNoteById(id2, folder, account);
+    const success = notesManager.moveNoteById(id2, folder, account, scopeFrom(scopeArgs));
     if (!success) {
       return errorResponse(
         `Failed to move note "${note.title}" to folder "${folder}". Folder may not exist.`