splitwise-mcp 3.4.0 → 3.4.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Splitwise — natural-language expense and group management via the Splitwise API",
-    "version": "3.4.0"
+    "version": "3.4.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Splitwise",
       "source": "./",
       "description": "MCP server for Splitwise — manage expenses, groups, and friends via natural language",
-      "version": "3.4.0",
+      "version": "3.4.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "splitwise-mcp",
   "displayName": "Splitwise",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "MCP server for Splitwise — natural-language expense and group management via the Splitwise API",
   "author": {
     "name": "Chris Hall",

package/.mcp.json

@@ -1,9 +1,10 @@
 {
   "mcpServers": {
     "splitwise": {
-      "command": "node",
+      "command": "npx",
       "args": [
-        "${CLAUDE_PLUGIN_ROOT}/dist/index.js"
+        "-y",
+        "splitwise-mcp"
       ],
       "env": {
         "SPLITWISE_API_KEY": "${SPLITWISE_API_KEY}",

package/dist/bundle.js

@@ -92,6 +92,7 @@ var require_util = __commonJS({
     exports.explicitlyAborted = explicitlyAborted2;
     exports.prefixIssues = prefixIssues2;
     exports.unwrapMessage = unwrapMessage2;
+    exports.sizeCaps = sizeCaps2;
     exports.attachSchema = attachSchema2;
     exports.finalizeIssue = finalizeIssue2;
     exports.getSizableOrigin = getSizableOrigin2;
@@ -626,6 +627,18 @@ var require_util = __commonJS({
     function unwrapMessage2(message) {
       return typeof message === "string" ? message : message?.message;
     }
+    function sizeCaps2(defChecks) {
+      const caps = [];
+      for (const ch2 of defChecks ?? []) {
+        const d2 = ch2._zod.def;
+        if (!/_(length|size)$|_equals$/.test(d2.check))
+          break;
+        const max = d2.maximum ?? d2.length ?? d2.size;
+        if (max >= 0)
+          caps.push([max, ch2]);
+      }
+      return caps;
+    }
     function attachSchema2(issues, start, inst) {
       var _a4;
       for (let i2 = start; i2 < issues.length; i2++) {
@@ -2290,7 +2303,7 @@ var require_versions = __commonJS({
     exports.version = {
       major: 4,
       minor: 6,
-      patch: 5
+      patch: 7
     };
     (function() {
       var keys = Object.getOwnPropertyNames(exports);
@@ -3124,6 +3137,31 @@ var require_schemas = __commonJS({
         return payload;
       };
     });
+    function capSize2(inst, size) {
+      const caps = util.sizeCaps(inst._zod.def.checks);
+      if (!caps.length)
+        return;
+      const cap = Math.min(...caps.map((c2) => c2[0]));
+      const parse3 = inst._zod.parse;
+      inst._zod.parse = (payload, ctx) => {
+        const n2 = size(payload.value);
+        if (n2 > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+          for (const [max, ch2] of util.sizeCaps(inst._zod.def.checks)) {
+            if (n2 > max && ch2._zod.def.when(payload)) {
+              const start = payload.issues.length;
+              ch2._zod.check(payload);
+              payload.issues[start].continue = false;
+              util.attachSchema(payload.issues, start, inst);
+              return payload;
+            }
+          }
+        }
+        return parse3(payload, ctx);
+      };
+    }
+    var arraySize2 = (input2) => Array.isArray(input2) ? input2.length : -1;
+    var mapSize2 = (input2) => input2 instanceof Map ? input2.size : -1;
+    var setSize2 = (input2) => input2 instanceof Set ? input2.size : -1;
     function handleArrayResult2(result, final, index) {
       if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -3167,6 +3205,7 @@ var require_schemas = __commonJS({
         }
         return payload;
       };
+      capSize2(inst, arraySize2);
     });
     function handlePropertyResult2(result, final, key, input2, optin, optout) {
       const isPresent = key in input2;
@@ -4123,6 +4162,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, mapSize2);
     });
     function handleMapResult2(keyResult, valueResult, final, key, input2, inst, ctx) {
       if (keyResult.issues.length) {
@@ -4189,6 +4229,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, setSize2);
     });
     function handleSetResult2(result, final) {
       if (result.issues.length) {
@@ -16293,9 +16334,15 @@ ${code2}
       doc.write(`}`);
       return outputVar;
     }
+    function generateSizeGate2(doc, schema, size) {
+      for (const [max, check2] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand2(max, check2._zod.def.check)}) return INVALID;`);
+      }
+    }
     function generateArrayCheck2(doc, ctx, schema, accessor, buildsValue = true) {
       const def = schema._zod.def;
       doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.length`);
       const outputVar = buildsValue ? newVar2(ctx) : null;
       const iVar = newVar2(ctx);
       const elemVar = newVar2(ctx);
@@ -16695,6 +16742,7 @@ ${code2}
     function generateMapCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const kVar = newVar2(ctx);
       const valVar = newVar2(ctx);
@@ -16711,6 +16759,7 @@ ${code2}
     function generateSetCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const valVar = newVar2(ctx);
       doc.write(`const ${outputVar} = new Set();`);
@@ -78172,7 +78221,7 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p2) => `\\b${p2}`).join("|"), "g");
 var GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+var QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
 var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -78183,6 +78232,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
+  "aws[_-]?secret[_-]?access[_-]?key",
+  // fleet-audit#1297
   "code[_-]?verifier",
   // PKCE; a bare `verifier` key is too generic for JSON
   `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -78880,6 +78931,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -79399,6 +79451,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch2 of defChecks ?? []) {
+    const d2 = ch2._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d2.check))
+      break;
+    const max = d2.maximum ?? d2.length ?? d2.size;
+    if (max >= 0)
+      caps.push([max, ch2]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a4;
   for (let i2 = start; i2 < issues.length; i2++) {
@@ -80819,7 +80883,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -81575,6 +81639,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c2) => c2[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n2 = size(payload.value);
+    if (n2 > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch2] of sizeCaps(inst._zod.def.checks)) {
+        if (n2 > max && ch2._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch2._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -81618,6 +81707,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -82574,6 +82664,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -82640,6 +82731,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -92170,9 +92262,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -92572,6 +92670,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -92588,6 +92687,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -98900,11 +99000,21 @@ function sanitizeBaseName(base) {
   const safe = base.replace(/[/\\]+/g, "_").replace(/\.\.+/g, "_").replace(/^\.+/, "").trim();
   return safe.length > 0 ? safe : "file";
 }
+var SAFE_EXTENSION = /^[A-Za-z0-9][A-Za-z0-9._-]{0,15}$/;
+function isSafeExtension(ext) {
+  return SAFE_EXTENSION.test(ext);
+}
+function assertSafeExtension(ext, caller) {
+  if (!isSafeExtension(ext)) {
+    throw new TypeError(`${caller}: extension must be 1-16 characters of A-Z a-z 0-9 . _ - starting with a letter or digit, got ${JSON.stringify(ext)}.`);
+  }
+}
 function candidate(dir, safeBase, ext, n2) {
   return join4(dir, n2 === 1 ? `${safeBase}.${ext}` : `${safeBase}-${n2}.${ext}`);
 }
 var DEFAULT_MAX_ATTEMPTS = 1e3;
 function writeUniqueFileSync(dir, baseName, ext, bytes, mode) {
+  assertSafeExtension(ext, "writeBinaryOutput");
   mkdirSync2(dir, { recursive: true });
   const safe = sanitizeBaseName(baseName);
   for (let n2 = 1; ; n2++) {
@@ -98959,19 +99069,61 @@ function defaultOutputDir(envVar, name) {
 var MIME_EXT = {
   "image/png": "png",
   "image/jpeg": "jpg",
+  "image/jpg": "jpg",
+  "image/pjpeg": "jpg",
   "image/webp": "webp",
   "image/gif": "gif",
   "image/heic": "heic",
+  "image/heif": "heif",
   "image/avif": "avif",
+  "image/tiff": "tif",
+  "image/bmp": "bmp",
+  "image/svg+xml": "svg",
   "application/pdf": "pdf",
   "application/json": "json",
   "application/zip": "zip",
+  "application/gzip": "gz",
+  "text/plain": "txt",
+  "text/csv": "csv",
+  "text/html": "html",
+  "text/calendar": "ics",
   "audio/midi": "mid",
+  "audio/mpeg": "mp3",
+  "audio/mp3": "mp3",
+  "audio/wav": "wav",
+  "audio/wave": "wav",
+  "audio/x-wav": "wav",
+  "audio/ogg": "ogg",
+  "audio/webm": "webm",
+  "audio/mp4": "m4a",
   "video/mp4": "mp4",
-  "video/quicktime": "mov"
+  "video/quicktime": "mov",
+  "video/webm": "webm"
 };
+var PLAIN_EXT = /^[a-z0-9]{1,5}$/;
+function extensionForMime(mime, opts = {}) {
+  const fallback = opts.fallback ?? "bin";
+  assertSafeExtension(fallback, "extensionForMime");
+  const type = (mime ?? "").split(";", 1)[0].trim().toLowerCase();
+  const known = MIME_EXT[type];
+  if (known !== void 0)
+    return known;
+  const slash = type.indexOf("/");
+  const subtype = slash > 0 && type.indexOf("/", slash + 1) < 0 ? type.slice(slash + 1).replace(/^x-/, "") : "";
+  if (PLAIN_EXT.test(subtype))
+    return subtype;
+  if (opts.url !== void 0) {
+    try {
+      const fromUrl = /\.([a-z0-9]{1,5})$/i.exec(new URL(opts.url).pathname)?.[1]?.toLowerCase();
+      if (fromUrl !== void 0 && isSafeExtension(fromUrl))
+        return fromUrl;
+    } catch {
+    }
+  }
+  return fallback;
+}
 function writeBinaryOutput(opts) {
-  const ext = opts.extension ?? (opts.mimeType ? MIME_EXT[opts.mimeType] : void 0) ?? "bin";
+  const ext = opts.extension ?? extensionForMime(opts.mimeType);
   return writeUniqueFileSync(opts.dir, opts.baseName, ext, Buffer.from(opts.base64, "base64"), opts.mode);
 }
 
@@ -99040,10 +99192,34 @@ function getHeader(headers, name) {
   return typeof value === "string" ? value : null;
 }
 
+// node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
+function asciiLower(s2) {
+  return s2.replace(/[A-Z]+/g, (m2) => m2.toLowerCase());
+}
+
 // node_modules/@chrischall/mcp-utils/dist/scrape/index.js
 var NEXT_DATA_MAX_CHARS = 16 * 1024 * 1024;
 function isCloudflareChallenge(html) {
-  return /_cf_chl_opt/.test(html) || /<title[^>]*>\s*Just a moment/i.test(html);
+  return html.includes("_cf_chl_opt") || hasJustAMomentTitle(html);
+}
+var JUST_A_MOMENT = "just a moment";
+function hasJustAMomentTitle(html) {
+  const lower = asciiLower(html);
+  let i2 = 0;
+  for (; ; ) {
+    const open2 = lower.indexOf("<title", i2);
+    if (open2 < 0)
+      return false;
+    const gt2 = lower.indexOf(">", open2 + 6);
+    if (gt2 < 0)
+      return false;
+    let j2 = gt2 + 1;
+    while (j2 < lower.length && /\s/.test(lower[j2]))
+      j2++;
+    if (lower.startsWith(JUST_A_MOMENT, j2))
+      return true;
+    i2 = gt2 + 1;
+  }
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/net-atoms.js
@@ -99072,7 +99248,7 @@ var ResponseTooLargeError = class extends McpToolError {
 };
 async function readBytesCapped(res, maxBytes, service, bounded) {
   if (maxBytes !== void 0) {
-    const declared = Number(res.headers.get("content-length") ?? NaN);
+    const declared = Number(responseHeader(res, "content-length") ?? NaN);
     if (Number.isFinite(declared) && declared > maxBytes) {
       cancelStream(res.body);
       throw new ResponseTooLargeError(service, maxBytes);
@@ -99162,6 +99338,29 @@ var DEFAULT_RETRY = { count: 1, delayMs: 2e3 };
 var defaultSleep = (ms2) => new Promise((r2) => setTimeout(r2, ms2));
 var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
 var DEFAULT_MAX_REDIRECTS = 5;
+var FETCH_MAX_REDIRECTS = 20;
+var CROSS_ORIGIN_DROPPED_HEADERS = ["authorization", "cookie", "proxy-authorization"];
+function withoutCredentials(headers, tokenHeader) {
+  const drop = new Set(CROSS_ORIGIN_DROPPED_HEADERS);
+  if (tokenHeader !== void 0)
+    drop.add(tokenHeader.toLowerCase());
+  const out = {};
+  for (const [k2, v2] of Object.entries(headers))
+    if (!drop.has(k2.toLowerCase()))
+      out[k2] = v2;
+  return out;
+}
+function joinQuery(path, query) {
+  if (!query)
+    return path;
+  const hashAt = path.indexOf("#");
+  const head = hashAt < 0 ? path : path.slice(0, hashAt);
+  const fragment = hashAt < 0 ? "" : path.slice(hashAt);
+  if (!head.includes("?"))
+    return `${head}${query}${fragment}`;
+  const sep2 = head.endsWith("?") || head.endsWith("&") ? "" : "&";
+  return `${head}${sep2}${query.slice(1)}${fragment}`;
+}
 var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 function cancelBody(res) {
   try {
@@ -99401,7 +99600,9 @@ function createApiClient(opts) {
   const retryStatuses = retry.statuses ?? [429];
   const timeoutMs = opts.timeout === false ? 0 : opts.timeout ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const redirectMode = opts.redirect;
-  const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+  const stripCrossOrigin = redirectMode === void 0 && opts.tokenHeader !== void 0;
+  const manualRedirects = redirectMode === "same-origin" || stripCrossOrigin;
+  const maxRedirects = opts.maxRedirects ?? (stripCrossOrigin ? FETCH_MAX_REDIRECTS : DEFAULT_MAX_REDIRECTS);
   const reportWriteOutcome = opts.writeOutcomeUnknown !== false;
   const defaultMaxBytes = checkMaxBytes("maxResponseBytes", opts.maxResponseBytes);
   if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0) {
@@ -99503,7 +99704,7 @@ function createApiClient(opts) {
         `Refusing request to ${service}: path ${JSON.stringify(path.split(/[?#]/, 1)[0])} contains a ${hazard}, which URL normalisation would rewrite. Build paths with apiPath\`...\` so each value is one encoded segment.`
       );
     }
-    const url4 = `${base}${path}${query}`;
+    const url4 = `${base}${joinQuery(path, query)}`;
     if (baseOrigin === void 0)
       return url4;
     let parsed;
@@ -99517,14 +99718,21 @@ function createApiClient(opts) {
     }
     return url4;
   }
-  function sameOriginHop(location, from) {
-    let next;
+  function resolveLocation(location, from) {
     try {
-      next = new URL(location, from);
+      return new URL(location, from).href;
     } catch {
       throw new RedirectRefusedError(`Refusing redirect from ${service}: the Location header is not a valid URL.`);
     }
-    if (baseOrigin === void 0 || next.origin !== baseOrigin || next.username !== baseParts?.username || next.password !== baseParts?.password) {
+  }
+  function onBaseOrigin(href) {
+    const next = new URL(href);
+    return baseOrigin !== void 0 && next.origin === baseOrigin && next.username === baseParts?.username && next.password === baseParts?.password;
+  }
+  function sameOriginHop(location, from) {
+    const href = resolveLocation(location, from);
+    const next = new URL(href);
+    if (!onBaseOrigin(href)) {
       throw new RedirectRefusedError(`Refusing redirect from ${service} to ${next.origin}: it leaves the base origin ${baseOrigin ?? "(unparseable)"}, and following it would re-send the credential there.`);
     }
     return next.href;
@@ -99534,20 +99742,21 @@ function createApiClient(opts) {
     const query = opt.query ? buildQueryString(opt.query) : "";
     const url4 = resolveUrl(path, query);
     const bodyInit = reqBody !== void 0 ? { body: reqBody } : {};
-    const fetchHop = (hopUrl, hopMethod, withBody, token, signal) => {
+    const fetchHop = (hopUrl, hopMethod, withBody, token, signal, credentialed = true) => {
       if (!signal?.aborted)
         dispatch.sent = true;
+      const headers = {
+        Accept: "application/json",
+        ...withBody && contentType !== void 0 ? { "Content-Type": contentType } : {},
+        ...opts.baseHeaders,
+        ...authHeader(token || void 0),
+        ...opt.headers
+      };
       return doFetch(hopUrl, {
         method: hopMethod,
-        headers: {
-          Accept: "application/json",
-          ...withBody && contentType !== void 0 ? { "Content-Type": contentType } : {},
-          ...opts.baseHeaders,
-          ...authHeader(token || void 0),
-          ...opt.headers
-        },
+        headers: credentialed ? headers : withoutCredentials(headers, opts.tokenHeader),
         ...signal ? { signal } : {},
-        ...redirectMode !== void 0 ? { redirect: redirectMode === "same-origin" ? "manual" : redirectMode } : {},
+        ...manualRedirects ? { redirect: "manual" } : redirectMode !== void 0 ? { redirect: redirectMode } : {},
         ...withBody ? bodyInit : {}
       }).catch((err) => {
         markTransportFailure(err);
@@ -99555,13 +99764,14 @@ function createApiClient(opts) {
       });
     };
     const fetchWith = async (token, signal) => {
-      if (redirectMode !== "same-origin")
+      if (!manualRedirects)
         return fetchHop(url4, method, true, token, signal);
       let hopUrl = url4;
       let hopMethod = method;
       let withBody = true;
+      let credentialed = true;
       for (let hops = 0; ; hops += 1) {
-        const res = await fetchHop(hopUrl, hopMethod, withBody, token, signal);
+        const res = await fetchHop(hopUrl, hopMethod, withBody, token, signal, credentialed);
         const location = REDIRECT_STATUSES.has(res.status) ? responseHeader(res, "location") : void 0;
         if (location === void 0 || location === null)
           return res;
@@ -99569,7 +99779,13 @@ function createApiClient(opts) {
         if (hops >= maxRedirects) {
           throw new RedirectRefusedError(`Refusing request to ${service}: too many redirects (more than ${maxRedirects}).`);
         }
-        hopUrl = sameOriginHop(location, hopUrl);
+        if (stripCrossOrigin) {
+          hopUrl = resolveLocation(location, hopUrl);
+          if (credentialed && !onBaseOrigin(hopUrl))
+            credentialed = false;
+        } else {
+          hopUrl = sameOriginHop(location, hopUrl);
+        }
         if (res.status === 303 || (res.status === 301 || res.status === 302) && hopMethod === "POST") {
           if (hopMethod !== "HEAD")
             hopMethod = "GET";
@@ -101036,16 +101252,6 @@ function resolveMimeType(contentType, bytes) {
   const declared = (contentType ?? "").split(";")[0].trim().toLowerCase();
   return declared && !GENERIC_TYPES.has(declared) ? declared : void 0;
 }
-function extensionFromUrl(url4) {
-  const match = /\.([a-z0-9]{1,5})$/i.exec(new URL(url4).pathname);
-  return match ? match[1].toLowerCase() : void 0;
-}
-function extensionFor(mimeType, url4) {
-  const subtype = mimeType?.split("/")[1];
-  if (subtype === "jpeg") return "jpg";
-  if (subtype && /^[a-z0-9]{1,5}$/.test(subtype)) return subtype;
-  return extensionFromUrl(url4) ?? "bin";
-}
 async function extractPdfText(bytes) {
   const { extractText: extractText2, getDocumentProxy: getDocumentProxy2 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
   const doc = await getDocumentProxy2(Uint8Array.from(bytes));
@@ -101117,7 +101323,8 @@ function registerReceiptTools(server, client2) {
             }),
             baseName: `splitwise-receipt-${id}`,
             base64: base643,
-            extension: extensionFor(mimeType, url4),
+            // The MIME type, else the receipt URL's own extension, else `bin`.
+            extension: extensionForMime(mimeType, { url: url4 }),
             mode: RECEIPT_FILE_MODE
           });
         } catch (err) {
@@ -101323,7 +101530,7 @@ function registerUtilityTools(server, client2) {
 // src/index.ts
 await runMcp({
   name: "splitwise-mcp",
-  version: "3.4.0",
+  version: "3.4.1",
   // x-release-please-version
   deps: client,
   banner: "[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.",

package/dist/index.js

@@ -19,7 +19,7 @@ import { registerUtilityTools } from './tools/utilities.js';
 // client into the same registrars instead of this singleton.
 await runMcp({
     name: 'splitwise-mcp',
-    version: '3.4.0', // x-release-please-version
+    version: '3.4.1', // x-release-please-version
     deps: client,
     banner: '[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.',
     tools: [

package/dist/tools/receipts.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { minifiedResult, imageResult, readEnvVar, resolveOutputDir, writeBinaryOutput, sniffMimeBytes, } from '@chrischall/mcp-utils';
+import { minifiedResult, imageResult, readEnvVar, resolveOutputDir, writeBinaryOutput, sniffMimeBytes, extensionForMime, } from '@chrischall/mcp-utils';
 import { UNTRUSTED_DESCRIPTION_SUFFIX, swUntrustedEnvelope } from './_untrusted.js';
 /** Cap on bytes returned as base64 in the tool result. */
 const MAX_INLINE_BYTES = 4 * 1024 * 1024;
@@ -49,24 +49,6 @@ function resolveMimeType(contentType, bytes) {
     const declared = (contentType ?? '').split(';')[0].trim().toLowerCase();
     return declared && !GENERIC_TYPES.has(declared) ? declared : undefined;
 }
-/** Extension from a URL path (`…/receipt.jpg?sig=…` → `jpg`), when it has one. */
-function extensionFromUrl(url) {
-    const match = /\.([a-z0-9]{1,5})$/i.exec(new URL(url).pathname);
-    return match ? match[1].toLowerCase() : undefined;
-}
-/**
- * File extension for the receipt: the MIME subtype when it looks like a plain
- * one (`application/pdf` → `pdf`, `image/heic` → `heic`), else the URL's own
- * extension, else `bin`.
- */
-function extensionFor(mimeType, url) {
-    const subtype = mimeType?.split('/')[1];
-    if (subtype === 'jpeg')
-        return 'jpg';
-    if (subtype && /^[a-z0-9]{1,5}$/.test(subtype))
-        return subtype;
-    return extensionFromUrl(url) ?? 'bin';
-}
 /**
  * Extract a PDF's text layer. `unpdf` is imported lazily so the cost lands only
  * on calls that ask for text — it is a sizable pdf.js build, and every other
@@ -162,7 +144,8 @@ export function registerReceiptTools(server, client) {
                     }),
                     baseName: `splitwise-receipt-${id}`,
                     base64,
-                    extension: extensionFor(mimeType, url),
+                    // The MIME type, else the receipt URL's own extension, else `bin`.
+                    extension: extensionForMime(mimeType, { url }),
                     mode: RECEIPT_FILE_MODE,
                 });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "splitwise-mcp",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "mcpName": "io.github.chrischall/splitwise-mcp",
   "description": "Splitwise MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,7 +45,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.0.0",
+    "@chrischall/mcp-utils": "^3.0.3",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.2",
     "unpdf": "^1.8.1",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/splitwise-mcp",
     "source": "github"
   },
-  "version": "3.4.0",
+  "version": "3.4.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "splitwise-mcp",
-      "version": "3.4.0",
+      "version": "3.4.1",
       "transport": {
         "type": "stdio"
       },