@withpica/mcp-sdk 3.16.0 → 3.18.0

package/dist/index.js

@@ -803,6 +803,28 @@ class CreditsResource extends BaseResource {
     async atomicRemove(workId, creditId) {
         return this.request("DELETE", `/admin/works/${workId}/credits/${creditId}`);
     }
+    /**
+     * Edit one credit in place — the verb between add and remove.
+     *
+     * Goes through `requestWithEnvelope`, not `request()`: the route answers
+     * `{ success, data: <credit row>, credit_id, work_id, allocation }` with
+     * `allocation` as a SIBLING of `data`, and `request()`'s
+     * `return data.data || data` narrowed that to the bare credit row — so
+     * every caller received an object that matched none of this method's
+     * declared return type, and `allocation` (which `pica_credit_update`
+     * promises in its description) was always undefined. Measured 2026-09-12
+     * on the #2210 preview; pinned by the holdout contract
+     * `scenarios/contracts/credit-update.spec.ts` leg 4.
+     */
+    async atomicUpdate(workId, creditId, patch) {
+        const env = await this.requestWithEnvelope("PATCH", `/admin/works/${workId}/credits/${creditId}`, patch);
+        return {
+            credit_id: env.credit_id ?? creditId,
+            work_id: env.work_id ?? workId,
+            credit: env.data,
+            allocation: env.allocation,
+        };
+    }
     /**
      * Send pending credits on a work to their recipients for attestation.
      * Lightweight alternative to pica_split_sheet_send — fans out the
@@ -1904,20 +1926,18 @@ class SettingsResource extends BaseResource {
 // --- GDPR Resource (user self-service delete + export) ---
 class GdprResource extends BaseResource {
     /**
-     * Create a soft-delete request for the authenticated user's account.
+     * Create a pending deletion request for the authenticated user's account.
      * Never accepts a user_id — the subject is derived from the bearer token
-     * (ADR-184 rule 2). Returns the deletion_request_id immediately; actual
-     * erasure runs async through the gdpr-deletion processing path. Matches
-     * the web UI's 30-day reversal window.
+     * (ADR-184 rule 2). Returns the deletion_request_id immediately; nothing
+     * is erased until an org owner/admin or the PICA team confirms the request.
      */
     async deleteMyAccount(params) {
         return this.request("POST", "/admin/gdpr/delete-my-account", params ?? {});
     }
     /**
      * Queue a GDPR Article 15 / 20 data export for the authenticated user.
-     * Returns a job_id immediately; the signed download link is emailed when
-     * the job completes. Format defaults to JSON (ADR-184 defers format
-     * negotiation to a future parameter).
+     * Returns a job_id immediately; a download link is emailed when the job
+     * completes. Sends `{}`, so the route's defaults apply (JSON, no files).
      */
     async exportMyData() {
         return this.request("POST", "/admin/gdpr/export-my-data", {});
@@ -2495,6 +2515,11 @@ class ExportResource extends BaseResource {
         const query = qs.toString();
         return this.request("GET", `/admin/exports/industry-ready${query ? `?${query}` : ""}`);
     }
+    /**
+     * Builds an UNSIGNED catalog asset report. Its declaration can only be
+     * attested by a person signed in to PICA (the export panel), so the API
+     * refuses an attestation sent with an API key, agent grant or OAuth token.
+     */
     async catalogAssetReport(params) {
         return this.request("POST", "/admin/exports/catalog-asset-report", params);
     }
@@ -2510,6 +2535,11 @@ class ExportResource extends BaseResource {
 }
 // --- Duplicates Resource ---
 class DuplicatesResource extends BaseResource {
+    /**
+     * ⚠️ `audio_files` is findable but NOT mergeable — `merge` below keeps the
+     * narrower union deliberately. Re-uploaded audio is resolved by a person
+     * deleting a file, never by a merge (ops issue dcea642b, 2026-09-10).
+     */
     async findDuplicates(entityType) {
         return this.request("GET", `/admin/catalog/duplicates?entity_type=${entityType}`);
     }