@withpica/mcp-sdk 3.17.0 → 3.19.0

package/dist/index.js

@@ -1899,11 +1899,11 @@ class SettingsResource extends BaseResource {
      * the auth context — `user_id` is never accepted (ADR-184 rule 2).
      *
      * The route lazy-creates the backing `people` row if the user's
-     * `user_profiles.person_id` is null, then fires
-     * `crossLinkOnIdentifierUpdate` so newly-visible cross-org credits
-     * appear on the next `pica_discoveries_query`. Response includes the
-     * count of new discoveries in each of the 3 typed tables so the
-     * agent can surface "found N more…" in the same conversation.
+     * `user_profiles.person_id` is null. Identifiers are saved on that record
+     * only; this call triggers no cross-org linking (a typed IPI is not
+     * evidence).
+     * Response includes the count of discoveries written in each of the 3
+     * typed tables in the last 10 seconds.
      * ADR-189 Phase 3.
      */
     async updateMyIdentity(params) {
@@ -1926,20 +1926,18 @@ class SettingsResource extends BaseResource {
 // --- GDPR Resource (user self-service delete + export) ---
 class GdprResource extends BaseResource {
     /**
-     * Create a soft-delete request for the authenticated user's account.
+     * Create a pending deletion request for the authenticated user's account.
      * Never accepts a user_id — the subject is derived from the bearer token
-     * (ADR-184 rule 2). Returns the deletion_request_id immediately; actual
-     * erasure runs async through the gdpr-deletion processing path. Matches
-     * the web UI's 30-day reversal window.
+     * (ADR-184 rule 2). Returns the deletion_request_id immediately; nothing
+     * is erased until an org owner/admin or the PICA team confirms the request.
      */
     async deleteMyAccount(params) {
         return this.request("POST", "/admin/gdpr/delete-my-account", params ?? {});
     }
     /**
      * Queue a GDPR Article 15 / 20 data export for the authenticated user.
-     * Returns a job_id immediately; the signed download link is emailed when
-     * the job completes. Format defaults to JSON (ADR-184 defers format
-     * negotiation to a future parameter).
+     * Returns a job_id immediately; a download link is emailed when the job
+     * completes. Sends `{}`, so the route's defaults apply (JSON, no files).
      */
     async exportMyData() {
         return this.request("POST", "/admin/gdpr/export-my-data", {});
@@ -2517,9 +2515,24 @@ class ExportResource extends BaseResource {
         const query = qs.toString();
         return this.request("GET", `/admin/exports/industry-ready${query ? `?${query}` : ""}`);
     }
+    /**
+     * Builds an UNSIGNED catalog asset report. Its declaration can only be
+     * attested by a person signed in to PICA (the export panel), so the API
+     * refuses an attestation sent with an API key, agent grant or OAuth token.
+     */
     async catalogAssetReport(params) {
         return this.request("POST", "/admin/exports/catalog-asset-report", params);
     }
+    /**
+     * One ZIP holding the song dossier (PDF + JSON) of each work named — the
+     * work, its recordings, the releases they appear on, people, provenance and
+     * consent — plus a manifest and README. Returns a signed-URL JSON envelope
+     * with a per-work `works[]` account of what was included. 1–60 work ids;
+     * a malformed id or a longer list is refused with a 400.
+     */
+    async songDossiers(params) {
+        return this.request("POST", "/admin/exports/song-dossiers", params);
+    }
     async aiConsent(params) {
         // Returns a signed-URL JSON envelope. The inline `?format=json`
         // path stays the default for the SDK; the route also returns the