@withpica/mcp-sdk 3.16.0 → 3.18.0

package/CHANGELOG.md

@@ -11,6 +11,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.18.0] - 2026-09-17
+
+### Removed
+
+- **`exports.catalogAssetReport()` no longer takes `attestation`.** The
+  report's declaration goes to lenders and insurers, and only a person signed
+  in to PICA may make it (the export panel). The API now refuses an
+  attestation sent with an API key, agent grant or OAuth token (400) and
+  builds those callers an unsigned report, so the parameter could only ever
+  fail. Callers that passed it: drop it.
+- **`sections.audio` on the same method.** The report never read it.
+
+## [3.17.0] - 2026-09-13
+
+### Fixed
+
+- **`credits.atomicUpdate()` now returns what its type declares.** It went
+  through `request()`, whose `return data.data || data` narrowed the route's
+  `{ data, credit_id, work_id, allocation }` envelope to the bare credit row —
+  so `allocation` (the work's writer allocation after the edit, which
+  `pica_credit_update` promises in its description) was always `undefined`,
+  and the tool's `allocation.status` completion hints were dead code. It now
+  uses `requestWithEnvelope` and returns `{ credit_id, work_id, credit,
+allocation }`. Callers that read credit fields off the top-level result
+  should read `result.credit` — the declared shape never promised them there.
+
 ## [3.16.0] - 2026-09-09
 
 ### Added

package/dist/index.d.ts

@@ -1347,6 +1347,22 @@ export interface WorkCreditAtomicAddInput {
     share_pct?: number;
     notes?: string;
 }
+/**
+ * In-place edit of ONE credit (2026-09-11). Every field optional; only the
+ * fields present are written. `share_pct: null` records the share as
+ * UNKNOWN, never as 0. `instrument` applies to a recording (master) credit.
+ */
+export interface WorkCreditAtomicUpdateInput {
+    credit_type?: WorkCreditAtomicAddInput["credit_type"];
+    share_pct?: number | null;
+    credited_name?: string | null;
+    notes?: string | null;
+    instrument?: string | null;
+}
+export interface AtomicCreditUpdateResult extends AtomicCreditResult {
+    /** The work's writer allocation AFTER this change — closed / open / incomplete / no_writers / unscalable. */
+    allocation?: Record<string, unknown>;
+}
 export interface AtomicCreditResult {
     credit_id: string;
     credit?: Record<string, unknown>;
@@ -1375,6 +1391,20 @@ declare class CreditsResource extends BaseResource {
      * semantics — never leaks 404 vs 403 via latency).
      */
     atomicRemove(workId: string, creditId: string): Promise<AtomicCreditResult>;
+    /**
+     * Edit one credit in place — the verb between add and remove.
+     *
+     * Goes through `requestWithEnvelope`, not `request()`: the route answers
+     * `{ success, data: <credit row>, credit_id, work_id, allocation }` with
+     * `allocation` as a SIBLING of `data`, and `request()`'s
+     * `return data.data || data` narrowed that to the bare credit row — so
+     * every caller received an object that matched none of this method's
+     * declared return type, and `allocation` (which `pica_credit_update`
+     * promises in its description) was always undefined. Measured 2026-09-12
+     * on the #2210 preview; pinned by the holdout contract
+     * `scenarios/contracts/credit-update.spec.ts` leg 4.
+     */
+    atomicUpdate(workId: string, creditId: string, patch: WorkCreditAtomicUpdateInput): Promise<AtomicCreditUpdateResult>;
     /**
      * Send pending credits on a work to their recipients for attestation.
      * Lightweight alternative to pica_split_sheet_send — fans out the
@@ -2480,20 +2510,18 @@ declare class SettingsResource extends BaseResource {
 }
 declare class GdprResource extends BaseResource {
     /**
-     * Create a soft-delete request for the authenticated user's account.
+     * Create a pending deletion request for the authenticated user's account.
      * Never accepts a user_id — the subject is derived from the bearer token
-     * (ADR-184 rule 2). Returns the deletion_request_id immediately; actual
-     * erasure runs async through the gdpr-deletion processing path. Matches
-     * the web UI's 30-day reversal window.
+     * (ADR-184 rule 2). Returns the deletion_request_id immediately; nothing
+     * is erased until an org owner/admin or the PICA team confirms the request.
      */
     deleteMyAccount(params?: {
         reason?: string;
     }): Promise<any>;
     /**
      * Queue a GDPR Article 15 / 20 data export for the authenticated user.
-     * Returns a job_id immediately; the signed download link is emailed when
-     * the job completes. Format defaults to JSON (ADR-184 defers format
-     * negotiation to a future parameter).
+     * Returns a job_id immediately; a download link is emailed when the job
+     * completes. Sends `{}`, so the route's defaults apply (JSON, no files).
      */
     exportMyData(): Promise<any>;
 }
@@ -3228,6 +3256,11 @@ declare class ExportResource extends BaseResource {
          */
         format?: "zip" | "json";
     }): Promise<any>;
+    /**
+     * Builds an UNSIGNED catalog asset report. Its declaration can only be
+     * attested by a person signed in to PICA (the export panel), so the API
+     * refuses an attestation sent with an API key, agent grant or OAuth token.
+     */
     catalogAssetReport(params: {
         sections: {
             ownership: true;
@@ -3235,11 +3268,6 @@ declare class ExportResource extends BaseResource {
             assets?: boolean;
             agreements?: boolean;
             intelligence?: boolean;
-            audio?: boolean;
-        };
-        attestation: {
-            signer_name: string;
-            declaration_accepted: boolean;
         };
         work_ids?: string[];
     }): Promise<any>;
@@ -3248,7 +3276,12 @@ declare class ExportResource extends BaseResource {
     }): Promise<any>;
 }
 declare class DuplicatesResource extends BaseResource {
-    findDuplicates(entityType: "works" | "people" | "releases" | "recordings"): Promise<any>;
+    /**
+     * ⚠️ `audio_files` is findable but NOT mergeable — `merge` below keeps the
+     * narrower union deliberately. Re-uploaded audio is resolved by a person
+     * deleting a file, never by a merge (ops issue dcea642b, 2026-09-10).
+     */
+    findDuplicates(entityType: "works" | "people" | "releases" | "recordings" | "audio_files"): Promise<any>;
     merge(entityType: "work" | "person" | "recording" | "release", winnerId: string, loserIds: string[]): Promise<any>;
 }
 declare class EntityContextResource extends BaseResource {