splitwise-mcp 3.6.0 → 3.7.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Splitwise — natural-language expense and group management via the Splitwise API",
-    "version": "3.6.0"
+    "version": "3.7.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Splitwise",
       "source": "./",
       "description": "MCP server for Splitwise — manage expenses, groups, and friends via natural language",
-      "version": "3.6.0",
+      "version": "3.7.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "splitwise-mcp",
   "displayName": "Splitwise",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "description": "MCP server for Splitwise — natural-language expense and group management via the Splitwise API",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -193,7 +193,7 @@ To save calls on such a client: **`sw_confirm({confirmToken})`** finishes any pr
 | Tool | What it does |
 |------|-------------|
 | `sw_get_receipt` | Download an expense's receipt image/PDF with the server's credentials. Returns it inline (`inline`), as extracted PDF text (`extract_text`), and/or written to a file |
-| `sw_get_upload_url` | Hosted only: a short-lived signed URL to `curl -X PUT` a receipt file to, then pass `receipt: {upload_id, filename}` — no base64 through the conversation |
+| `sw_get_upload_url` | Hosted only: a short-lived signed URL to `curl -X PUT` a receipt file to, then pass `receipt: {upload_id, filename}` — no base64 through the conversation. The upload is deleted from the server once Splitwise has the receipt (`upload_deleted` in the reply); a failed write keeps it for a retry |
 
 ### Utilities
 

package/dist/bundle.js

@@ -100502,6 +100502,88 @@ function cancelStream(body) {
   }
 }
 
+// node_modules/@chrischall/mcp-utils/dist/http/fetch-bounded.js
+async function fetchBounded(url4, init, opts = {}) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const service = opts.service ?? hostOf(url4);
+  const read = opts.read ?? "text";
+  const timeoutMs = opts.timeoutMs === false ? 0 : opts.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const caller = withAmbientCancellation(init?.signal ?? void 0);
+  if (caller?.aborted)
+    throw reasonOf(caller);
+  const timer = timeoutMs > 0 ? new AbortController() : void 0;
+  const signal = combine(timer?.signal, caller);
+  let handle;
+  let detach = () => {
+  };
+  const stop = signal ? new Promise((_resolve, reject) => {
+    const onAbort = () => reject(timer?.signal.aborted ? new RequestTimeoutError(service, timeoutMs) : reasonOf(caller));
+    signal.addEventListener("abort", onAbort, { once: true });
+    detach = () => signal.removeEventListener("abort", onAbort);
+  }) : void 0;
+  stop?.catch(() => {
+  });
+  const bounded = (p2) => stop ? Promise.race([p2, stop]) : p2;
+  if (timer)
+    handle = setTimeout(() => timer.abort(), timeoutMs);
+  try {
+    let res;
+    try {
+      res = await bounded(doFetch(url4, { ...init, ...signal ? { signal } : {} }));
+    } catch (err) {
+      if (timer?.signal.aborted)
+        throw new RequestTimeoutError(service, timeoutMs);
+      if (caller?.aborted)
+        throw reasonOf(caller);
+      throw err;
+    }
+    if (read === "none") {
+      cancelStream(res.body);
+      return done(res, void 0);
+    }
+    const bytes = await readBytesCapped(res, opts.maxBytes, service, bounded);
+    if (read === "bytes")
+      return done(res, bytes);
+    const text = new TextDecoder().decode(bytes);
+    if (read === "text")
+      return done(res, text);
+    if (text.length === 0)
+      return done(res, void 0);
+    try {
+      return done(res, JSON.parse(text));
+    } catch (cause) {
+      const type = res.headers.get("content-type") ?? "no content-type";
+      throw new McpToolError(`${service} returned a non-JSON response (HTTP ${res.status}, ${type}).`, {
+        hint: "The upstream may have served an error or sign-in page instead of data.",
+        cause,
+        status: res.status
+      });
+    }
+  } finally {
+    clearTimeout(handle);
+    detach();
+  }
+  function done(res, body) {
+    return { res, status: res.status, ok: res.ok, headers: res.headers, body };
+  }
+}
+function combine(a2, b2) {
+  if (a2 && b2)
+    return AbortSignal.any([a2, b2]);
+  return a2 ?? b2;
+}
+function reasonOf(signal) {
+  const reason = signal.reason;
+  return reason instanceof Error ? reason : new Error(String(reason));
+}
+function hostOf(url4) {
+  try {
+    return new URL(url4).host;
+  } catch {
+    return String(url4);
+  }
+}
+
 // node_modules/@chrischall/mcp-utils/dist/http/url-safety.js
 function isDotSegment(segment) {
   const s2 = segment.replace(/%2e/gi, ".");
@@ -100973,7 +101055,7 @@ function encodeBody(opt) {
     return { body: JSON.stringify(opt.body), contentType: "application/json" };
   return { body: void 0, contentType: void 0 };
 }
-function hostOf(baseUrl) {
+function hostOf2(baseUrl) {
   try {
     return new URL(baseUrl).host;
   } catch {
@@ -100983,7 +101065,7 @@ function hostOf(baseUrl) {
 function createApiClient(opts) {
   const base = opts.baseUrl.replace(/\/+$/, "");
   const retry = opts.retry ?? DEFAULT_RETRY;
-  const service = opts.serviceName ?? hostOf(opts.baseUrl);
+  const service = opts.serviceName ?? hostOf2(opts.baseUrl);
   const doFetch = opts.fetchImpl ?? fetch;
   const sleep2 = (ms2) => cancellableSleep(ms2, opts.sleep);
   const unauthorized = () => opts.onUnauthorized ? opts.onUnauthorized() : new UnauthorizedError(service);
@@ -102481,6 +102563,7 @@ import { createHash as createHash4 } from "crypto";
 import { createHmac as createHmac3 } from "node:crypto";
 var BLOB_DEFAULT_TTL_MS = 60 * 60 * 1e3;
 var BLOB_MAX_TTL_MS = 24 * 60 * 60 * 1e3;
+var BLOB_MAX_OBJECT_BYTES = 100 * 1024 * 1024;
 var MAX_KEY_LENGTH = 1024;
 var SAFE_SEGMENT = /^[A-Za-z0-9._~-]+$/;
 function configError(reason) {
@@ -102586,7 +102669,60 @@ ${exp}`)), expiresAtMs: exp };
     }
     return { key, bytes: bytes.byteLength };
   };
-  return { baseUrl: base, prefix, signGetUrl, signPutUrl, put };
+  const signDeleteUrl = (key, o2) => {
+    const encoded = encodeKey(key);
+    const exp = expiry(o2);
+    return { url: link(encoded, exp, sign2(`del\0${prefix}/${key}\0${exp}`)), expiresAtMs: exp };
+  };
+  const exchange = async (what, url4, method, read, o2) => {
+    try {
+      return await fetchBounded(url4, { method, ...o2.signal ? { signal: o2.signal } : {} }, {
+        read,
+        service: "the blob store",
+        ...read === "bytes" ? { maxBytes: o2.maxBytes ?? BLOB_MAX_OBJECT_BYTES } : {},
+        ...o2.timeoutMs !== void 0 ? { timeoutMs: o2.timeoutMs } : {},
+        ...o2.fetchImpl ? { fetchImpl: o2.fetchImpl } : {}
+      });
+    } catch (cause) {
+      if (o2.signal?.aborted || cause instanceof McpToolError || cause instanceof RequestTimeoutError)
+        throw cause;
+      throw new McpToolError(`Blob store ${what} did not complete (network error).`, { kind: "transport" });
+    }
+  };
+  const get = async (key, o2 = {}) => {
+    const { url: url4 } = signGetUrl(key, o2);
+    const res = await exchange(`read of ${key}`, url4, "GET", "bytes", o2);
+    if (!res.ok) {
+      const why = res.status === 404 ? " \u2014 not found (never uploaded, expired, or already consumed)" : "";
+      throw new McpToolError(`Blob store read of ${key} failed (HTTP ${res.status})${why}.`, {
+        kind: "http",
+        status: res.status
+      });
+    }
+    const contentType = res.headers.get("content-type") ?? void 0;
+    return { key, bytes: res.body, ...contentType !== void 0 ? { contentType } : {} };
+  };
+  const del = async (key, o2 = {}) => {
+    const { url: url4 } = signDeleteUrl(key, o2);
+    const res = await exchange(`delete of ${key}`, url4, "DELETE", "none", o2);
+    if (!res.ok) {
+      throw new McpToolError(`Blob store delete of ${key} failed (HTTP ${res.status}).`, {
+        kind: "http",
+        status: res.status
+      });
+    }
+  };
+  const consume = async (key, use, o2 = {}) => {
+    const object5 = await get(key, o2);
+    const result = await use(object5);
+    try {
+      await del(key, o2);
+      return { result, deleted: true };
+    } catch (e2) {
+      return { result, deleted: false, deleteError: e2 instanceof Error ? e2.message : String(e2) };
+    }
+  };
+  return { baseUrl: base, prefix, signGetUrl, signPutUrl, put, signDeleteUrl, get, delete: del, consume };
 }
 function blobStoreFromEnv(env = process.env) {
   const baseUrl = readEnvVar("MCP_BLOB_BASE_URL", { env });
@@ -102611,6 +102747,19 @@ var CRC_TABLE = (() => {
 // node_modules/@chrischall/mcp-utils/dist/export/sink.js
 var EXPORT_BLOB_MAX_BYTES = 256 * 1024 * 1024;
 
+// node_modules/@chrischall/mcp-utils/dist/export/upload.js
+var UPLOAD_SLOT_DEFAULT_TTL_MS = 30 * 60 * 1e3;
+var MIB = 1024 * 1024;
+var inlineFileSchema = external_exports.object({
+  filename: external_exports.string().describe("Filename the upstream will show \u2014 a bare name, no path, not starting with a dot. Its extension sets the MIME type when mimeType is omitted."),
+  contentBase64: external_exports.string().describe(`The file's bytes, standard base64 (line breaks and a "data:<type>;base64," prefix are tolerated).`),
+  mimeType: external_exports.string().describe('MIME type, e.g. "image/jpeg". Default: inferred from the filename extension.').optional()
+});
+var uploadSlotRequestSchema = external_exports.object({
+  filename: external_exports.string().describe("Filename the upstream will show \u2014 a bare name, no path, not starting with a dot."),
+  mimeType: external_exports.string().describe("MIME type. Default: inferred from the filename extension. The PUT must send exactly this Content-Type.").optional()
+});
+
 // src/tools/_receipt.ts
 var MAX_RECEIPT_BYTES = 10 * 1024 * 1024;
 var LIMIT_LABEL = "10 MiB";
@@ -102626,7 +102775,7 @@ var receiptSchema = external_exports.object({
   path: external_exports.string().min(1).describe(
     "A file inside SPLITWISE_INPUT_DIR on the machine running this server (relative to it, or absolute). Only works when that variable is set \u2014 never on a hosted server; use upload_id (or base64) there."
   ).optional(),
-  upload_id: external_exports.string().min(1).describe("The upload_id from sw_get_upload_url, after the file was PUT to its upload_url. The way to send a full-size file to the hosted server without base64.").optional(),
+  upload_id: external_exports.string().min(1).describe("The upload_id from sw_get_upload_url, after the file was PUT to its upload_url. The way to send a full-size file to the hosted server without base64. Single use: the upload is deleted once Splitwise has the receipt (the reply says upload_deleted); a failed or declined write keeps it, so the same upload_id can be retried.").optional(),
   filename: external_exports.string().min(1).max(200).describe('Name to store the file under, e.g. "receipt.pdf".'),
   mime_type: external_exports.string().describe("Optional. If given, it must match the type detected from the file contents.").optional()
 }).describe(
@@ -102709,7 +102858,7 @@ async function readUpload(uploadId, client2) {
   } catch (err) {
     if (err instanceof ApiError && (err.status === 404 || err.status === 403)) {
       throw new Error(
-        `No upload found for receipt.upload_id ${uploadId} \u2014 the PUT may not have run, failed, or the upload expired. Get a fresh link with sw_get_upload_url and upload the file again.`
+        `No upload found for receipt.upload_id ${uploadId} \u2014 the PUT may not have run, failed, the upload expired, or it was already used (an upload is deleted once its receipt is attached). Get a fresh link with sw_get_upload_url and upload the file again.`
       );
     }
     if (err.kind === "too_large") {
@@ -102750,9 +102899,23 @@ async function loadReceipt(input2, client2) {
     bytes,
     filename,
     mimeType: type.mime,
-    summary: { filename, mime_type: type.mime, bytes: bytes.length, sha256 }
+    summary: { filename, mime_type: type.mime, bytes: bytes.length, sha256 },
+    ...input2.upload_id !== void 0 ? { uploadId: input2.upload_id } : {}
   };
 }
+var UPLOAD_DELETE_TIMEOUT_MS = 1e4;
+async function releaseUpload(receipt) {
+  if (receipt.uploadId === void 0) return {};
+  try {
+    const store = blobStoreFromEnv();
+    if (!store) throw new Error("no blob store is configured on this server");
+    await store.delete(receipt.uploadId, { timeoutMs: UPLOAD_DELETE_TIMEOUT_MS });
+    return { upload_deleted: true };
+  } catch (err) {
+    if (err.status === 404) return { upload_deleted: true };
+    return { upload_deleted: false, upload_delete_error: err instanceof Error ? err.message : String(err) };
+  }
+}
 function buildReceiptForm(fields, receipt) {
   const form = new FormData();
   for (const [key, value] of Object.entries(fields)) {
@@ -103170,7 +103333,8 @@ function buildExpenseBody(args) {
 async function sendExpenseWrite(client2, path, body, receipt, expenseId) {
   if (!receipt) return client2.request("POST", path, body);
   const data = await client2.requestMultipart("POST", path, buildReceiptForm(body, receipt));
-  return verifyReceiptStored(data, expenseId);
+  const stored = verifyReceiptStored(data, expenseId);
+  return { ...stored, ...await releaseUpload(receipt) };
 }
 function previewBody(body, receipt) {
   return receipt ? { ...body, receipt: receipt.summary } : body;
@@ -103390,7 +103554,7 @@ function registerExpenseTools(server, client2) {
   })));
   withToolMeta(server, moneyMeta("change"), () => registerWrite(server, defineWrite({
     name: "sw_attach_receipt",
-    description: "Attach (or replace) the receipt image or PDF on an existing Splitwise expense. Changes nothing else on the expense \u2014 cost, split and description are not sent. Pass the file as receipt.upload_id (hosted: upload it first via sw_get_upload_url \u2014 no bytes in the tool call), receipt.path (local) or receipt.base64. Fails if Splitwise does not store the file.",
+    description: "Attach (or replace) the receipt image or PDF on an existing Splitwise expense. Changes nothing else on the expense \u2014 cost, split and description are not sent. Pass the file as receipt.upload_id (hosted: upload it first via sw_get_upload_url \u2014 no bytes in the tool call), receipt.path (local) or receipt.base64. Fails if Splitwise does not store the file. An upload_id is deleted from the upload store once the file is stored (upload_deleted in the reply).",
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     inputSchema: external_exports.object({
       expense_id: external_exports.number().describe("ID of the expense to attach the receipt to"),
@@ -103650,7 +103814,7 @@ function registerUploadTools(server, _client) {
   server.registerTool(
     "sw_get_upload_url",
     {
-      description: "Get a short-lived (~10 min) signed URL to upload a receipt file (PNG, JPEG, GIF or PDF, up to 10 MiB) to this server WITHOUT putting its bytes in a tool call: run the returned curl command from a shell or sandbox that has the file and network access to the URL's host, then pass receipt: {upload_id, filename} to sw_attach_receipt, sw_create_expense or sw_update_expense. Send the original file \u2014 no need to shrink it. Only on the hosted server; locally use receipt.path. If you have no shell that can reach the URL, use receipt.base64 instead.",
+      description: "Get a short-lived (~10 min) signed URL to upload a receipt file (PNG, JPEG, GIF or PDF, up to 10 MiB) to this server WITHOUT putting its bytes in a tool call: run the returned curl command from a shell or sandbox that has the file and network access to the URL's host, then pass receipt: {upload_id, filename} to sw_attach_receipt, sw_create_expense or sw_update_expense. Send the original file \u2014 no need to shrink it. The upload is deleted from this server once the receipt is attached (a failed write keeps it for a retry), so each upload_id is used once. Only on the hosted server; locally use receipt.path. If you have no shell that can reach the URL, use receipt.base64 instead.",
       annotations: { readOnlyHint: true, openWorldHint: true },
       _meta: moneyMeta("other"),
       inputSchema: external_exports.object({
@@ -103806,7 +103970,7 @@ function registerUtilityTools(server, client2) {
 // src/index.ts
 await runMcp({
   name: "splitwise-mcp",
-  version: "3.6.0",
+  version: "3.7.0",
   // x-release-please-version
   deps: client,
   banner: "[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.",

package/dist/index.js

@@ -21,7 +21,7 @@ import { registerUtilityTools } from './tools/utilities.js';
 // client into the same registrars instead of this singleton.
 await runMcp({
     name: 'splitwise-mcp',
-    version: '3.6.0', // x-release-please-version
+    version: '3.7.0', // x-release-please-version
     deps: client,
     banner: '[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.',
     tools: [

package/dist/tools/_receipt.js

@@ -33,7 +33,7 @@ export const receiptSchema = z
     upload_id: z
         .string()
         .min(1)
-        .describe('The upload_id from sw_get_upload_url, after the file was PUT to its upload_url. The way to send a full-size file to the hosted server without base64.')
+        .describe('The upload_id from sw_get_upload_url, after the file was PUT to its upload_url. The way to send a full-size file to the hosted server without base64. Single use: the upload is deleted once Splitwise has the receipt (the reply says upload_deleted); a failed or declined write keeps it, so the same upload_id can be retried.')
         .optional(),
     filename: z.string().min(1).max(200).describe('Name to store the file under, e.g. "receipt.pdf".'),
     mime_type: z
@@ -146,7 +146,7 @@ async function readUpload(uploadId, client) {
     }
     catch (err) {
         if (err instanceof ApiError && (err.status === 404 || err.status === 403)) {
-            throw new Error(`No upload found for receipt.upload_id ${uploadId} — the PUT may not have run, failed, or the upload expired. Get a fresh link with sw_get_upload_url and upload the file again.`);
+            throw new Error(`No upload found for receipt.upload_id ${uploadId} — the PUT may not have run, failed, the upload expired, or it was already used (an upload is deleted once its receipt is attached). Get a fresh link with sw_get_upload_url and upload the file again.`);
         }
         if (err.kind === 'too_large') {
             throw new Error(`The uploaded receipt is over the ${LIMIT_LABEL} limit (${MAX_RECEIPT_BYTES} bytes)`);
@@ -198,8 +198,40 @@ export async function loadReceipt(input, client) {
         filename,
         mimeType: type.mime,
         summary: { filename, mime_type: type.mime, bytes: bytes.length, sha256 },
+        ...(input.upload_id !== undefined ? { uploadId: input.upload_id } : {}),
     };
 }
+/** A delete is housekeeping after a write that already landed: never let it hold the reply for long. */
+const UPLOAD_DELETE_TIMEOUT_MS = 10_000;
+/**
+ * Delete the blob-store copy of a receipt Splitwise now holds. Call it only
+ * after the write SUCCEEDED (and the file was verified stored): the preview may
+ * still be declined, and a failed write must leave the upload_id retryable.
+ *
+ * Never throws. The expense is already written, so an error here would read as
+ * a failed write and invite a duplicate; a delete that fails is reported, and
+ * the store's retention prune reclaims the object. A 404 means it is already
+ * gone (e.g. two ops in one batch used the same upload), which is the goal.
+ * Not `BlobStore.consume`: the read happens in `plan` (before the gate) and
+ * the write in `execute`, possibly calls apart, so there is no one callback
+ * to wrap.
+ */
+export async function releaseUpload(receipt) {
+    if (receipt.uploadId === undefined)
+        return {};
+    try {
+        const store = blobStoreFromEnv();
+        if (!store)
+            throw new Error('no blob store is configured on this server');
+        await store.delete(receipt.uploadId, { timeoutMs: UPLOAD_DELETE_TIMEOUT_MS });
+        return { upload_deleted: true };
+    }
+    catch (err) {
+        if (err.status === 404)
+            return { upload_deleted: true };
+        return { upload_deleted: false, upload_delete_error: err instanceof Error ? err.message : String(err) };
+    }
+}
 /**
  * Build the multipart body Splitwise takes when an expense carries a file:
  * every expense field as a form field (the same flat `users__N__*` keys the

package/dist/tools/expenses.js

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { EXPENSE_LIST_VIEWS, SW_VIEWS, viewExpense, viewExpenses } from '../project.js';
 import { buildQueryString, defineWrite, minifiedResult, registerWrite, resolveView, viewParam, } from '@chrischall/mcp-utils';
 import { UNTRUSTED_DESCRIPTION_SUFFIX, swUntrustedResult } from './_untrusted.js';
-import { buildReceiptForm, loadReceipt, receiptParam, receiptSchema, verifyReceiptStored, } from './_receipt.js';
+import { buildReceiptForm, loadReceipt, receiptParam, receiptSchema, releaseUpload, verifyReceiptStored, } from './_receipt.js';
 import { attachComments, decodeCursor, encodeCursor, hasLocalFilters, projectForList, scanExpenses, MAX_COMMENT_ROWS, SCAN_BUDGET, } from './_list.js';
 import { findDuplicates, inferCategory, resolveCategory, resolveEqualSplit } from './_create.js';
 import { assertNotDeleted, explainForbidden, verifyRestored, withPostState } from './_expense-state.js';
@@ -63,13 +63,18 @@ function buildExpenseBody(args) {
  * Send a create/update. With a receipt the whole expense goes as multipart
  * (Splitwise only takes a file that way) and the response must show the file
  * stored; without one it stays JSON and the response passes through, exactly
- * as before.
+ * as before. A receipt that came from `upload_id` is deleted from the blob
+ * store once Splitwise has it (`upload_deleted`), here in `execute` — so a
+ * direct call, `sw_confirm` and `sw_batch` all clean up, and the preview never
+ * does.
  */
 async function sendExpenseWrite(client, path, body, receipt, expenseId) {
     if (!receipt)
         return client.request('POST', path, body);
     const data = await client.requestMultipart('POST', path, buildReceiptForm(body, receipt));
-    return verifyReceiptStored(data, expenseId);
+    // Only past verification: a dropped file keeps the upload for sw_attach_receipt.
+    const stored = verifyReceiptStored(data, expenseId);
+    return { ...stored, ...(await releaseUpload(receipt)) };
 }
 /** The body the confirmation preview shows: the fields, plus the file's identity in place of its bytes. */
 function previewBody(body, receipt) {
@@ -343,7 +348,7 @@ export function registerExpenseTools(server, client) {
     })));
     withToolMeta(server, moneyMeta('change'), () => registerWrite(server, defineWrite({
         name: 'sw_attach_receipt',
-        description: 'Attach (or replace) the receipt image or PDF on an existing Splitwise expense. Changes nothing else on the expense — cost, split and description are not sent. Pass the file as receipt.upload_id (hosted: upload it first via sw_get_upload_url — no bytes in the tool call), receipt.path (local) or receipt.base64. Fails if Splitwise does not store the file.',
+        description: 'Attach (or replace) the receipt image or PDF on an existing Splitwise expense. Changes nothing else on the expense — cost, split and description are not sent. Pass the file as receipt.upload_id (hosted: upload it first via sw_get_upload_url — no bytes in the tool call), receipt.path (local) or receipt.base64. Fails if Splitwise does not store the file. An upload_id is deleted from the upload store once the file is stored (upload_deleted in the reply).',
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
         inputSchema: z.object({
             expense_id: z.number().describe('ID of the expense to attach the receipt to'),

package/dist/tools/uploads.js

@@ -16,7 +16,7 @@ export const UPLOAD_URL_TTL_MS = 10 * 60 * 1000;
  */
 export function registerUploadTools(server, _client) {
     server.registerTool('sw_get_upload_url', {
-        description: 'Get a short-lived (~10 min) signed URL to upload a receipt file (PNG, JPEG, GIF or PDF, up to 10 MiB) to this server WITHOUT putting its bytes in a tool call: run the returned curl command from a shell or sandbox that has the file and network access to the URL\'s host, then pass receipt: {upload_id, filename} to sw_attach_receipt, sw_create_expense or sw_update_expense. Send the original file — no need to shrink it. Only on the hosted server; locally use receipt.path. If you have no shell that can reach the URL, use receipt.base64 instead.',
+        description: 'Get a short-lived (~10 min) signed URL to upload a receipt file (PNG, JPEG, GIF or PDF, up to 10 MiB) to this server WITHOUT putting its bytes in a tool call: run the returned curl command from a shell or sandbox that has the file and network access to the URL\'s host, then pass receipt: {upload_id, filename} to sw_attach_receipt, sw_create_expense or sw_update_expense. Send the original file — no need to shrink it. The upload is deleted from this server once the receipt is attached (a failed write keeps it for a retry), so each upload_id is used once. Only on the hosted server; locally use receipt.path. If you have no shell that can reach the URL, use receipt.base64 instead.',
         annotations: { readOnlyHint: true, openWorldHint: true },
         _meta: moneyMeta('other'),
         inputSchema: z.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "splitwise-mcp",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "mcpName": "io.github.chrischall/splitwise-mcp",
   "description": "Splitwise MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,7 +45,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.3.0",
+    "@chrischall/mcp-utils": "^3.6.0",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.2",
     "unpdf": "^2.0.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/splitwise-mcp",
     "source": "github"
   },
-  "version": "3.6.0",
+  "version": "3.7.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "splitwise-mcp",
-      "version": "3.6.0",
+      "version": "3.7.0",
       "transport": {
         "type": "stdio"
       },

package/skills/splitwise-mcp/SKILL.md

@@ -237,7 +237,7 @@ sw_create_expense(group_id, "Band camp water jug", "54.11", split_equally: true,
 sw_attach_receipt(expense_id, receipt: { base64: "<png/jpeg/gif/pdf bytes>", filename: "order.pdf" })
 ```
 
-`receipt` takes `filename` plus exactly one of `upload_id` (hosted server: from `sw_get_upload_url`, after `curl -X PUT` of the file — keeps the bytes out of the conversation and out of the second, confirming call), `path` (only on a local server with `SPLITWISE_INPUT_DIR` set, and only inside that directory) or `base64` (fallback when you have no shell that can reach the upload URL). PNG, JPEG, GIF or PDF, ≤ 10 MiB, type detected from the bytes. It replaces any existing receipt. Use `sw_attach_receipt` to add a file to an existing expense — it sends nothing but the file. If Splitwise saves the expense but drops the file, the tool returns an error naming the expense: do not re-create it, retry with `sw_attach_receipt`.
+`receipt` takes `filename` plus exactly one of `upload_id` (hosted server: from `sw_get_upload_url`, after `curl -X PUT` of the file — keeps the bytes out of the conversation and out of the second, confirming call), `path` (only on a local server with `SPLITWISE_INPUT_DIR` set, and only inside that directory) or `base64` (fallback when you have no shell that can reach the upload URL). PNG, JPEG, GIF or PDF, ≤ 10 MiB, type detected from the bytes. It replaces any existing receipt. Use `sw_attach_receipt` to add a file to an existing expense — it sends nothing but the file. If Splitwise saves the expense but drops the file, the tool returns an error naming the expense: do not re-create it, retry with `sw_attach_receipt`. An `upload_id` is single use: once the receipt is stored the upload is deleted (`upload_deleted: true`), so attaching the same file again needs a fresh `sw_get_upload_url`. A declined preview or a failed write keeps it — retry with the same `upload_id`. `upload_deleted: false` (with `upload_delete_error`) is not a failure: the receipt is attached; the copy just waits for the server's retention cleanup.
 
 **Log a 50/50 expense the other person paid:**
 ```