@withpica/mcp-server 2.108.0 → 2.110.0

package/CHANGELOG.md

@@ -11,6 +11,83 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.110.0] - 2026-10-23
+
+> **Publish order:** `@withpica/mcp-sdk` 4.0.0, `@withpica/mcp-utils` 2.0.1, then this package
+> (it needs SDK 4's `people.restore` and `removed.list`; the SDK floor is `^4.0.0`). Needs the web
+> app with the S1 changes on the server a stdio install points at (migrations 20261013093400,
+> 20261013093500 and 20261013093700 among them); against an older app the new waiver codes are
+> refused (400 NOT_WAIVABLE), the new tools are refused, and the new health fields read as absent.
+
+### Security
+
+- `@modelcontextprotocol/sdk` 1.31.0 → 1.32.1, fixing GHSA-46jr-4wx8-v453 (one HTTP request could
+  exhaust server memory during validation), GHSA-22jm-h49p-29qw (experimental tasks were not tied
+  to the session that created them) and GHSA-6prh-2h8m-c8cw (client transports followed
+  cross-origin redirects with headers). `hono` (pulled in by the SDK) 4.13.13, fixing
+  GHSA-5r4p-p66f-jhc7.
+
+### Share links
+
+- `pica_share_links_create` `access_type` takes `anyone`, `specific_people` (each recipient gets their own URL, returned as `recipients[].share_url`; the main URL opens nothing) and `collaborators_only` (one song; opens only for a signed-in account credited on it). The lists need `specific_people`.
+- `pica_share_links_update` takes `revoke_recipient_ids`.
+- `pica_share_trace` reports share links as `anyone_with_the_link`, `named_recipients` (with each live recipient) or `song_collaborators`.
+- `pica_access_simulate` takes the share_links words and refuses the old private / limited / public.
+
+### Added
+
+- `pica_works_inspect` `health` returns whether the song is complete — `complete`, `tests_passed`,
+  `tests` (identified, owned, registered, findable, each with its reason) and `next_step` — plus
+  `detail_score` (the weighted score). The completeness hints lead with the next step. Null when
+  the app could not answer, never a guessed "no".
+- `pica_integrity_waive` accepts `DETAIL_ALBUM_NAME`, `DETAIL_RELEASE_DATE` and `DETAIL_LABEL` (an
+  album, release date or label that does not apply) and `PLATFORM_NOT_INTENDED` (a song the owner
+  never means to release; it then counts as findable). Codes and registrations stay unwaivable.
+- `pica_removed_list`: one page of the songs (default) or people removed from the catalogue, with
+  when, by whom and why, and for a person what still sits with them (credits, splits in force,
+  agreement parties, main-artist songs and recordings).
+- `pica_works_restore` and `pica_people_restore` bring back a removed song or person. Removing
+  never deletes; a restore is refused (409) when a live song now holds the same title and artist or
+  tunecode, or when the record was merged into another.
+- `pica_people_delete` takes `move_to`: the live person a removed person's credits belong to. The
+  agent asks the user; it never picks `move_to` itself.
+
+### Changed
+
+- `pica_catalog_health`: completeness is described as the share of songs that are complete, with
+  recordings missing fields as their own item.
+- `pica_catalog_health` returns `recordings` — each kind of recording (`released_master`,
+  `unreleased_master`, `demo`, `alternate`, `video`) with its total and how many are missing
+  fields — and one `missing_recording_fields` item per kind, each carrying `recordingKind`. A
+  master counts as released only when it is on a release. Against an older app `recordings` is
+  absent and there is one item for all recordings.
+- `pica_works_query`: `missing_field_count` is described as a gap count for sorting (still without
+  the MusicBrainz benchmark), not "complete".
+- `pica_works_delete` and `pica_works_bulk_delete` say what removal does: the song is hidden from
+  the catalogue, share links and public page, everything it carries is kept, and it can be brought
+  back from "removed". They no longer call it permanent.
+- `pica_integrity_waive`: a field marked not applicable is credited in the work's completeness, not
+  dropped from it.
+- `pica_collaborators_invite_revoke` can withdraw a **disputed** invite too (the person said
+  the credit is wrong). That closes the dispute in the bell, "needs you" and the song's
+  writers table, for a "not me" or a credit the user stands by. Needs the web app with the
+  same change; against an older app the call is refused `INVITE_NOT_PENDING` as before.
+
+## [2.109.0] - 2026-10-19
+
+> **Publish order:** `@withpica/mcp-sdk` 3.28.0 (`feedback.list`), then this package. Needs the
+> web app with migration 20261013094300 and `GET /api/feedback`; against an older app
+> `pica_feedback_list` gets a 405 and `your_feedback` is simply absent from the briefing.
+
+### Added
+
+- `pica_feedback_list` (read, `write:feedback` like its sibling `pica_submit_feedback`): your
+  own reports to PICA and what the team did about each — open, fixed, answered or won't fix,
+  with the note they wrote for you. Only your own reports in this organisation.
+- `pica_dashboard_briefing` carries a `your_feedback` block when the team closed any of your
+  reports in the last 30 days — `line` reads e.g. "2 of your reports were fixed in the last 30
+  days."
+
 ## [2.108.0] - 2026-10-19
 
 > Needs `@withpica/mcp-sdk` 3.27.0 (`statements.listImports` / `statements.getImport`): publish the SDK first.

package/README.md

@@ -65,15 +65,15 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ## Tools
 
-369 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
+373 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
 
 **works** — manage your musical works
 
-`pica_works_query`, `pica_works_inspect`, `pica_works_create`, `pica_register_set`, `pica_works_update`, `pica_works_delete`, `pica_works_bulk_delete`, `pica_works_bulk_update`, `pica_works_bulk_link_artist`, `pica_works_bulk_add_collaborator`, `pica_work_writers_add`, `pica_topics_untagged`, `pica_topics_inspect`, `pica_topics_propose`, `pica_topics_review`, `pica_works_bulk_copy_credits`, `pica_works_bulk_move_to_performances`, `pica_works_verify`, `pica_works_verify_registrations`, `pica_works_attest`, `pica_catalog_diligence`
+`pica_works_query`, `pica_works_inspect`, `pica_works_create`, `pica_register_set`, `pica_works_update`, `pica_works_delete`, `pica_works_restore`, `pica_removed_list`, `pica_works_bulk_delete`, `pica_works_bulk_update`, `pica_works_bulk_link_artist`, `pica_works_bulk_add_collaborator`, `pica_work_writers_add`, `pica_topics_untagged`, `pica_topics_inspect`, `pica_topics_propose`, `pica_topics_review`, `pica_works_bulk_copy_credits`, `pica_works_bulk_move_to_performances`, `pica_works_verify`, `pica_works_verify_registrations`, `pica_works_attest`, `pica_catalog_diligence`
 
 **people** — manage people in your catalog
 
-`pica_people_query`, `pica_people_inspect`, `pica_people_create`, `pica_people_update`, `pica_people_delete`, `pica_people_bulk_delete`, `pica_people_split_identity`, `pica_people_bulk_update_roles`, `pica_people_bulk_add_tags`, `pica_group_add_member`, `pica_group_remove_member`, `pica_group_list_members`, `pica_person_list_groups`, `pica_artist_projects`, `pica_profile_claims_invite`, `pica_profile_claims_status`
+`pica_people_query`, `pica_people_inspect`, `pica_people_create`, `pica_people_update`, `pica_people_delete`, `pica_people_restore`, `pica_people_bulk_delete`, `pica_people_split_identity`, `pica_people_bulk_update_roles`, `pica_people_bulk_add_tags`, `pica_group_add_member`, `pica_group_remove_member`, `pica_group_list_members`, `pica_person_list_groups`, `pica_artist_projects`, `pica_profile_claims_invite`, `pica_profile_claims_status`
 
 **groups** — manage group → member relationships on people
 
@@ -161,7 +161,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 **feedback** — report problems and submit feedback to the PICA team — call proactively when you hit a workflow gap or the user says 'this is broken'
 
-`pica_report_issue`, `pica_my_reported_issues`, `pica_submit_feedback`
+`pica_report_issue`, `pica_my_reported_issues`, `pica_submit_feedback`, `pica_feedback_list`
 
 **onboarding** — acknowledge MCP onboarding for OAuth-arrived users — call after walking the user through identity, security, and intent
 
@@ -297,4 +297,4 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ---
 
-Generated for `@withpica/mcp-server@2.108.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.
+Generated for `@withpica/mcp-server@2.110.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.