@withpica/mcp-server 2.103.0 → 2.105.0

package/CHANGELOG.md

@@ -11,6 +11,97 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.105.0] - 2026-10-15
+
+### Added
+
+- `pica_physical_assets_market_check` — an AI market price estimate for a physical
+  asset, from the organisation's own AI provider. A write (`write:catalog`), so a
+  client confirms before it runs.
+- A tool definition can declare `alsoRequires`: scopes a credential must hold as
+  well as `scope`. `pica_tool_details` reports them as `also_requires`.
+
+### Fixed
+
+- `pica_export_snapshot`, `pica_export_song_dossiers` and
+  `pica_export_catalog_asset_report` declare both scopes their routes need
+  (`write:catalog` and `write:files`). Each declared one, so a credential
+  holding only what the tool advertised was refused 403 underneath.
+- `pica_run_person_cascade` and `pica_split_sheet_send` also require
+  `write:people`, which their routes already needed.
+- `pica_share_links_create`, `_update`, `_delete` and `pica_upload` require
+  `write:files` (a share or an upload is a file operation), as their routes now do.
+- `pica_audio_assign`, `_bulk_assign_suggested`, `_dismiss_match`, `_update` and
+  `_bulk_update` require `write:catalog`: they attach or edit audio against the
+  catalogue, and their routes are floored there. Upload, analyse and identify
+  stay `write:files`, and their routes' floor is now `write:files` too.
+- `pica_notification_acknowledge` requires `write:catalog`: it acknowledges
+  catalogue discoveries, which is what its route requires.
+- `pica_physical_assets_query`, `pica_physical_assets_inspect`,
+  `pica_audio_pipeline_status`, `pica_count_explain`, `pica_notifications_list`
+  and `pica_send_query` require `read:catalog`, which their routes require.
+- `pica_notifications_recent` requires `read:catalog`; its route, and
+  `pica_discoveries_query`'s, no longer require `write:catalog` for a read.
+- `pica_physical_assets_inspect` no longer has a `market` section: a read never
+  calls an AI provider. Use `pica_physical_assets_market_check`.
+- `pica_import_analyze` is a write tool (`write:catalog`): it spends PICA's
+  paid AI model on the file, so a client asks before running it.
+
+- The seven physical-asset write tools (`pica_physical_assets_create`,
+  `_update`, `_delete`, `_link_work`, `_link_recording`, `_unlink_work`,
+  `_unlink_recording`) declare `write:catalog`, the scope their routes and the
+  REST write floor require. They declared `write:files`, so a credential holding
+  exactly that passed MCP dispatch and was refused 403 underneath.
+
+## [2.104.0] - 2026-10-14
+
+### Added
+
+- Three tools for preparing a catalogue for a client who will own it:
+  `pica_handover_create` (an organisation creates the catalogue; nothing is sent),
+  `pica_handover_send` (emails the client, who has 60 days to accept; from a connected app the
+  person approves it first) and `pica_handover_answer` (gives the client the link to accept on
+  screen; it never accepts or declines, because taking ownership is the person's own act).
+- Tools that read or change a catalogue's records take an optional `catalogue` argument: the id of
+  a client catalogue your organisation looks after. The call then acts for that client, within what
+  the relationship allows, and the app refuses anything outside it with the reason. A tool that
+  can't act for a client (account, keys, billing, feedback, and the relationship tools themselves)
+  refuses the argument rather than ignoring it, and a confirmation token issued for one client
+  can't be used for another.
+- Nine tools for who looks after whose catalogue:
+  - for a catalogue's owner: `pica_relationships_list` (who looks after it, what each may do, and
+    invitations waiting), `pica_relationships_answer` (accept, decline or change a request, or
+    accept an invitation), `pica_relationships_grant` (invite an organisation by email),
+    `pica_relationships_revoke` and `pica_relationships_activity` (what was done through a
+    relationship);
+  - for an organisation: `pica_portfolio_list` (the client catalogues it looks after, with each
+    one's id for `catalogue`), `pica_portfolio_briefing` (what needs doing across them),
+    `pica_portfolio_invite` (ask a client by email) and `pica_relationships_step_down`.
+    Accepting, changing, revoking and an owner's invitation are the person's own decision: from a
+    connected app they ask the person to approve first, and from PICA's own assistant they give the
+    link to do it on screen. Every step sends the version of the terms that was read; if the terms
+    changed since, nothing happens and the current terms come back. A check PICA couldn't make says
+    so, never 0. New resource: `pica://schemas/relationship-required`.
+- Two skills: `look-after-clients` (an organisation sees every client, finds what needs doing and
+  fixes it in the right client's catalogue, within what each allowed) and
+  `who-can-see-my-catalogue` (an owner sees who looks after their catalogue, what each can do and
+  has done, and answers, changes or ends it). `first-session` routes to them, and the server
+  instructions say how to act for a client catalogue.
+- `pica_duplicates_mark_different` — when the user says recordings or releases that
+  `pica_find_duplicates` grouped are not the same, `action: "mark"` records it for every pair
+  among 2–25 ids and they are not offered as duplicates again; `action: "unmark"` takes it back.
+  Nothing is merged, deleted or edited. Works are still dismissed in the catalog duplicates view.
+
+### Changed
+
+- `pica_export_snapshot` says it is for an owner or admin of the catalogue only;
+  its route now refuses anyone else.
+
+- `pica_find_duplicates`: recording and release groups no longer include a pair the owner marked
+  different, and their "keep them separate" option now says how to stop them coming back
+  (it used to say they would keep appearing). A group never holds a marked pair, even through a
+  third copy matching both.
+
 ## [2.103.0] - 2026-10-09
 
 ### Security

package/README.md

@@ -65,7 +65,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ## Tools
 
-354 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
+368 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
 
 **works** — manage your musical works
 
@@ -119,9 +119,9 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 `pica_notes_query`, `pica_notes_inspect`, `pica_notes_create`, `pica_notes_delete`
 
-**duplicates** — detect duplicate records and merge them (audio_files can be found but not merged — a duplicate file is deleted)
+**duplicates** — detect duplicate records and merge them, or mark recordings and releases as different so they stop being offered (audio_files can be found but not merged — a duplicate file is deleted)
 
-`pica_find_duplicates`, `pica_merge_duplicates`
+`pica_find_duplicates`, `pica_merge_duplicates`, `pica_duplicates_mark_different`
 
 **import** — import catalog data from files and streaming services, and see what happened to emails forwarded to PICA
 
@@ -225,7 +225,11 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 **physical assets** — manage physical assets (master tapes, hardware, artefacts)
 
-`pica_physical_assets_query`, `pica_physical_assets_inspect`, `pica_physical_assets_create`, `pica_physical_assets_update`, `pica_physical_assets_delete`, `pica_physical_assets_export`, `pica_physical_assets_stats`, `pica_physical_assets_link_work`, `pica_physical_assets_link_recording`, `pica_physical_assets_unlink_work`, `pica_physical_assets_unlink_recording`
+`pica_physical_assets_query`, `pica_physical_assets_inspect`, `pica_physical_assets_create`, `pica_physical_assets_update`, `pica_physical_assets_market_check`, `pica_physical_assets_delete`, `pica_physical_assets_export`, `pica_physical_assets_stats`, `pica_physical_assets_link_work`, `pica_physical_assets_link_recording`, `pica_physical_assets_unlink_work`, `pica_physical_assets_unlink_recording`
+
+**portfolio** — who looks after a catalogue — see and answer requests, invite an organisation or a client by email, end access, see what was done through a relationship, (for organisations) the client catalogues you look after with what needs doing, and preparing a catalogue for a client to take over
+
+`pica_relationships_list`, `pica_relationships_answer`, `pica_relationships_grant`, `pica_relationships_revoke`, `pica_relationships_activity`, `pica_relationships_step_down`, `pica_portfolio_list`, `pica_portfolio_briefing`, `pica_portfolio_invite`, `pica_handover_create`, `pica_handover_send`, `pica_handover_answer`
 
 **recording splits** — manage recording (master) splits between contributors
 
@@ -293,4 +297,4 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ---
 
-Generated for `@withpica/mcp-server@2.103.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.
+Generated for `@withpica/mcp-server@2.105.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.