@withpica/mcp-sdk 3.22.0 → 3.23.1

package/dist/index.js

@@ -245,13 +245,20 @@ class BaseResource {
      * for routes that stream a generated file (e.g. `text/csv`) rather than
      * `{success, data}`. `request()` unconditionally calls `response.json()`,
      * which throws a SyntaxError parsing CSV text; every such route needs this
-     * method instead (see `ImportResource.getTemplate()` for the prior
-     * precedent this generalises).
+     * method instead (`ImportResource.getTemplate()`, `ExportResource.catalogCsv()`).
      *
      * `fetchWithRetry` already throws `ApiError` for non-2xx responses (reading
      * the body as text), so reaching here means `response.ok`. Still guard
      * against a 2xx JSON error envelope (`{success:false}`) via content-type,
      * since a route can commit to status 200 before a later validation step.
+     *
+     * An HTML page is refused. Neither route that uses this
+     * (`/admin/import/template`, `/admin/works/export` CSV formats) answers
+     * `text/html`, so one means something in front of PICA answered (on a
+     * protected Vercel preview, a missing bypass header ends on Vercel's
+     * login page with status 200). Returning that page as the file read as a
+     * success (2026-10-06, pica_import_template). Locked by
+     * `mcp-server/src/__tests__/sdk-request-text-and-bare-fetch.test.ts`.
      */
     async requestText(method, path) {
         const url = `${this.baseUrl}${path}`;
@@ -275,6 +282,9 @@ class BaseResource {
             }
             return typeof data === "string" ? data : JSON.stringify(data);
         }
+        if (contentType.includes("text/html")) {
+            throw new ApiError(`Expected a file from ${path} but got an HTML page; the request did not reach PICA`, response.status, false);
+        }
         return response.text();
     }
     /**
@@ -559,6 +569,25 @@ class PeopleResource extends BaseResource {
     async bulkDelete(ids) {
         return this.request("POST", "/admin/people/bulk-delete", { ids });
     }
+    /**
+     * GET /admin/people/{id}/split-identity — what giving this person a new
+     * global identity would touch: who shares their current one, unattributed
+     * split rows naming it, open custody legs naming it, and which of their
+     * own identifiers equal it. Read-only.
+     */
+    async splitIdentityPreview(id) {
+        return this.request("GET", `/admin/people/${encodeURIComponent(id)}/split-identity`);
+    }
+    /**
+     * POST /admin/people/{id}/split-identity — give this person a NEW global
+     * identity. Body: `{ move_identifiers?, relink_split_ids?,
+     * clear_person_identifiers?, undo_external_ids? }`; every list defaults to
+     * empty (nothing moves, nothing is relinked). A refusal is a 4xx carrying
+     * a `SPLIT_*` code.
+     */
+    async splitIdentity(id, body) {
+        return this.request("POST", `/admin/people/${encodeURIComponent(id)}/split-identity`, body);
+    }
     /**
      * List a person's artist projects — per-stage-name Spotify/YouTube
      * identity + enrichment status (ADR-289 Wave B2 item 4, ports the
@@ -830,6 +859,7 @@ class CreditsResource extends BaseResource {
             work_id: env.work_id ?? workId,
             credit: env.data,
             allocation: env.allocation,
+            ...(env.person_change && { person_change: env.person_change }),
         };
     }
     /**
@@ -1208,8 +1238,13 @@ class SyncPlacementsResource extends BaseResource {
             : "";
         await this.request("DELETE", `/admin/sync-placements/${id}${query}`);
     }
+    /**
+     * Attach a citation source (POST /api/admin/sync-placements/[id]/cite).
+     * This used to post to `/sources`, which has never existed, so every
+     * pica_sync_placements_cite call answered 404.
+     */
     async addSource(id, source) {
-        return this.request("POST", `/admin/sync-placements/${id}/sources`, source);
+        return this.request("POST", `/admin/sync-placements/${id}/cite`, source);
     }
 }
 class WorkspaceResource extends BaseResource {
@@ -1262,9 +1297,24 @@ class AuditResource extends BaseResource {
     }
 }
 class MemoryResource extends BaseResource {
+    /**
+     * The FIRST page of memories only (newest first, the route's default page
+     * size) — since 2026-10-02 the route pages. Kept for existing callers; use
+     * `listPage` to reach the rest.
+     */
     async list() {
         return this.request("GET", "/admin/memory");
     }
+    /** One page of memories, most recently changed first, with the total. */
+    async listPage(params) {
+        const query = new URLSearchParams();
+        if (params?.limit)
+            query.set("limit", String(params.limit));
+        if (params?.offset)
+            query.set("offset", String(params.offset));
+        const qs = query.toString();
+        return this.requestPaginated("GET", `/admin/memory${qs ? `?${qs}` : ""}`);
+    }
     async search(query) {
         return this.request("GET", `/admin/memory/search?q=${encodeURIComponent(query)}`);
     }
@@ -2508,7 +2558,7 @@ class ExportResource extends BaseResource {
         // request() unconditionally calls response.json(), which throws parsing
         // a CSV body — every pro/distributor/nro call 500'd with INTERNAL_ERROR
         // (pica_export_catalog_csv: 5/5 prod errors, ops audit 2026-07-04).
-        // requestText() mirrors the ImportResource.getTemplate() precedent for
+        // requestText() serves ImportResource.getTemplate() too, for
         // the same response shape.
         if (params.format === "sync-pdf") {
             return this.request("GET", path);
@@ -2714,8 +2764,12 @@ class AssetsResource extends BaseResource {
     async exportAll() {
         return this.request("GET", "/admin/assets/export");
     }
+    /**
+     * AI-assisted price estimate for the asset's make/model. The route is
+     * POST-only (it spends an AI call each time); this sent GET and got 405.
+     */
     async marketCheck(id) {
-        return this.request("GET", `/admin/assets/${id}/market-check`);
+        return this.request("POST", `/admin/assets/${id}/market-check`);
     }
     // --- Production-asset links (ADR-156 operating principle #3) ---
     // Typed edges between physical_assets and works/recordings, with
@@ -2803,14 +2857,28 @@ class ImportResource extends BaseResource {
         });
     }
     async getTemplate(domain) {
-        // Template route returns CSV as text/csv — use raw fetch
-        const url = `${this.baseUrl}/admin/import/template?domain=${domain}`;
-        const response = await fetch(url, {
-            headers: { Authorization: `Bearer ${this.apiKey}` },
-        });
-        if (!response.ok)
-            throw new Error(`Template fetch failed: ${response.status}`);
-        return response.text();
+        // The route answers text/csv, so requestText(), not request(). It was a
+        // bare fetch() with no preview-protection bypass header, so on a Vercel
+        // preview it never reached the route (2026-10-06).
+        return this.requestText("GET", `/admin/import/template?domain=${encodeURIComponent(domain)}`);
+    }
+    /**
+     * Emails that reached the organisation's forwarding address, newest first,
+     * with what PICA did with each (stored on arrival, waiting for review,
+     * dismissed, failed). Owners and admins only.
+     */
+    async listForwardedEmails(options) {
+        const params = new URLSearchParams();
+        if (options?.limit !== undefined)
+            params.set("limit", String(options.limit));
+        if (options?.offset !== undefined)
+            params.set("offset", String(options.offset));
+        const qs = params.toString();
+        return this.request("GET", `/admin/email-intake/forwarded${qs ? `?${qs}` : ""}`);
+    }
+    /** One forwarded email, with its text body when PICA kept one. */
+    async getForwardedEmail(id) {
+        return this.request("GET", `/admin/email-intake/forwarded/${encodeURIComponent(id)}`);
     }
 }
 // --- Documents Resource ---
@@ -3349,6 +3417,22 @@ class RecordingSplitsResource extends BaseResource {
     async delete(recordingId, splitId) {
         return this.request("DELETE", `/admin/recordings/${recordingId}/splits/${splitId}`);
     }
+    /**
+     * Edit a split and keep the route's whole envelope: `data` is the row, and
+     * `previous` / `changed_fields` / `verification_cleared` sit beside it —
+     * `request()` would drop them. verification_cleared is true when the edit
+     * cleared the holder's confirmation.
+     */
+    async edit(recordingId, splitId, data) {
+        return this.requestWithEnvelope("PATCH", `/admin/recordings/${recordingId}/splits/${splitId}`, data);
+    }
+    /**
+     * End a split: sets end_date (default today) so it stops counting toward
+     * the 100% total; the row is kept. Same envelope as `edit`.
+     */
+    async end(recordingId, splitId, data = {}) {
+        return this.requestWithEnvelope("POST", `/admin/recordings/${recordingId}/splits/${splitId}/end`, data);
+    }
     async verify(recordingId, splitId) {
         return this.request("POST", `/admin/recordings/${recordingId}/splits/${splitId}/verify`);
     }
@@ -3430,6 +3514,36 @@ class PartyClaimsResource extends BaseResource {
         return (res?.data ?? []);
     }
 }
+/**
+ * Claim your profile: invite people to claim their profile (a preview
+ * unless `confirm`), and read where people stand.
+ */
+class ProfileClaimsResource extends BaseResource {
+    async invite(params) {
+        const res = await this.request("POST", "/admin/people/claim-invites", params);
+        if (res && typeof res === "object" && "data" in res && res.data) {
+            return res.data;
+        }
+        return (res ?? null);
+    }
+    async status(params) {
+        const q = new URLSearchParams();
+        for (const id of params?.person_ids ?? [])
+            q.append("person_id", id);
+        if (params?.state)
+            q.set("state", params.state);
+        if (params?.limit)
+            q.set("limit", String(params.limit));
+        const qs = q.toString();
+        const res = await this.request("GET", `/admin/profile-claims${qs ? `?${qs}` : ""}`);
+        const body = res;
+        const inner = body?.people ? body : body?.data;
+        return {
+            people: inner?.people ?? [],
+            truncated: inner?.truncated === true,
+        };
+    }
+}
 class ReleasesResource extends BaseResource {
     async list(params) {
         const parts = [];
@@ -4199,6 +4313,7 @@ export class PicaClient {
     publishers;
     labels;
     partyClaims;
+    profileClaims;
     agreementTemplates;
     producerAgreements;
     workForHire;
@@ -4237,24 +4352,15 @@ export class PicaClient {
     // Registration Integrity Floor (spec 2026-07-09, Task 8).
     integrity;
     async catalogStats(params) {
-        const baseUrl = this.works["baseUrl"];
-        const apiKey = this.works["apiKey"];
         const qp = new URLSearchParams();
         if (params?.entity)
             qp.set("entity", params.entity);
         if (params?.group_by)
             qp.set("group_by", params.group_by);
         const suffix = qp.toString() ? `?${qp.toString()}` : "";
-        const res = await fetch(`${baseUrl}/admin/catalog/stats${suffix}`, {
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                "Content-Type": "application/json",
-            },
-        });
-        if (!res.ok)
-            throw new Error(`Catalog stats failed: ${res.status}`);
-        const json = (await res.json());
-        return (json.data || json);
+        // Through the shared request path (bypass header, timeout, retry, typed
+        // errors) rather than a bare fetch() that skipped all four (2026-10-06).
+        return this.works["request"]("GET", `/admin/catalog/stats${suffix}`);
     }
     constructor(config) {
         if (!config.apiKey) {
@@ -4317,6 +4423,7 @@ export class PicaClient {
         this.publishers = new PublishersResource(baseUrl, config.apiKey, debug);
         this.labels = new LabelsResource(baseUrl, config.apiKey, debug);
         this.partyClaims = new PartyClaimsResource(baseUrl, config.apiKey, debug);
+        this.profileClaims = new ProfileClaimsResource(baseUrl, config.apiKey, debug);
         this.agreementTemplates = new AgreementTemplatesResource(baseUrl, config.apiKey, debug);
         this.producerAgreements = new ProducerAgreementsResource(baseUrl, config.apiKey, debug);
         this.workForHire = new WorkForHireResource(baseUrl, config.apiKey, debug);