@withpica/mcp-sdk 3.17.0 → 3.19.0

package/CHANGELOG.md

@@ -11,6 +11,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.19.0] - 2026-09-18
+
+### Added
+
+- **`exports.songDossiers({ work_ids })`** — `POST /admin/exports/song-dossiers`.
+  One ZIP of the song dossier (PDF + JSON) for each work named, returned as the
+  signed-URL JSON envelope plus a per-work `works[]` account. 1 to 60 ids; a
+  malformed id or a longer list is a 400.
+
+## [3.18.0] - 2026-09-17
+
+### Removed
+
+- **`exports.catalogAssetReport()` no longer takes `attestation`.** The
+  report's declaration goes to lenders and insurers, and only a person signed
+  in to PICA may make it (the export panel). The API now refuses an
+  attestation sent with an API key, agent grant or OAuth token (400) and
+  builds those callers an unsigned report, so the parameter could only ever
+  fail. Callers that passed it: drop it.
+- **`sections.audio` on the same method.** The report never read it.
+
 ## [3.17.0] - 2026-09-13
 
 ### Fixed

package/dist/index.d.ts

@@ -2476,11 +2476,11 @@ declare class SettingsResource extends BaseResource {
      * the auth context — `user_id` is never accepted (ADR-184 rule 2).
      *
      * The route lazy-creates the backing `people` row if the user's
-     * `user_profiles.person_id` is null, then fires
-     * `crossLinkOnIdentifierUpdate` so newly-visible cross-org credits
-     * appear on the next `pica_discoveries_query`. Response includes the
-     * count of new discoveries in each of the 3 typed tables so the
-     * agent can surface "found N more…" in the same conversation.
+     * `user_profiles.person_id` is null. Identifiers are saved on that record
+     * only; this call triggers no cross-org linking (a typed IPI is not
+     * evidence).
+     * Response includes the count of discoveries written in each of the 3
+     * typed tables in the last 10 seconds.
      * ADR-189 Phase 3.
      */
     updateMyIdentity(params: {
@@ -2510,20 +2510,18 @@ declare class SettingsResource extends BaseResource {
 }
 declare class GdprResource extends BaseResource {
     /**
-     * Create a soft-delete request for the authenticated user's account.
+     * Create a pending deletion request for the authenticated user's account.
      * Never accepts a user_id — the subject is derived from the bearer token
-     * (ADR-184 rule 2). Returns the deletion_request_id immediately; actual
-     * erasure runs async through the gdpr-deletion processing path. Matches
-     * the web UI's 30-day reversal window.
+     * (ADR-184 rule 2). Returns the deletion_request_id immediately; nothing
+     * is erased until an org owner/admin or the PICA team confirms the request.
      */
     deleteMyAccount(params?: {
         reason?: string;
     }): Promise<any>;
     /**
      * Queue a GDPR Article 15 / 20 data export for the authenticated user.
-     * Returns a job_id immediately; the signed download link is emailed when
-     * the job completes. Format defaults to JSON (ADR-184 defers format
-     * negotiation to a future parameter).
+     * Returns a job_id immediately; a download link is emailed when the job
+     * completes. Sends `{}`, so the route's defaults apply (JSON, no files).
      */
     exportMyData(): Promise<any>;
 }
@@ -3258,6 +3256,11 @@ declare class ExportResource extends BaseResource {
          */
         format?: "zip" | "json";
     }): Promise<any>;
+    /**
+     * Builds an UNSIGNED catalog asset report. Its declaration can only be
+     * attested by a person signed in to PICA (the export panel), so the API
+     * refuses an attestation sent with an API key, agent grant or OAuth token.
+     */
     catalogAssetReport(params: {
         sections: {
             ownership: true;
@@ -3265,14 +3268,19 @@ declare class ExportResource extends BaseResource {
             assets?: boolean;
             agreements?: boolean;
             intelligence?: boolean;
-            audio?: boolean;
-        };
-        attestation: {
-            signer_name: string;
-            declaration_accepted: boolean;
         };
         work_ids?: string[];
     }): Promise<any>;
+    /**
+     * One ZIP holding the song dossier (PDF + JSON) of each work named — the
+     * work, its recordings, the releases they appear on, people, provenance and
+     * consent — plus a manifest and README. Returns a signed-URL JSON envelope
+     * with a per-work `works[]` account of what was included. 1–60 work ids;
+     * a malformed id or a longer list is refused with a 400.
+     */
+    songDossiers(params: {
+        work_ids: string[];
+    }): Promise<any>;
     aiConsent(params?: {
         work_ids?: string[];
     }): Promise<any>;