@withpica/mcp-server 2.111.0 → 2.113.0

package/CHANGELOG.md

@@ -11,6 +11,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.113.0] - 2026-10-31
+
+> Needs `@withpica/mcp-sdk` 4.2.0 (SDK floor `^4.2.0`) for `pica_statement_import_remove`.
+> `@withpica/mcp-utils` (2.0.2) and the directory are unchanged.
+
+### Added
+
+- `pica_statement_import_remove`: undoes an imported royalty statement — its lines come out of the
+  royalties and its total goes, together or not at all; an uploaded statement document it came from
+  stays, so the file can be imported again. Take `import_batch_id` from `pica_statements_query`.
+  Refused while the statement is still importing. Destructive: delegated agents (OAuth or grant)
+  create a pending human approval for the owner; a signed-in or first-party-key caller takes the
+  normal confirmation-token path.
+- `pica_audio_attach`: stores an audio file the user attached in ChatGPT. The tool declares
+  `_meta["openai/fileParams"]: ["file"]`, so ChatGPT passes the attachment as
+  `{ download_url, file_id, mime_type?, file_name? }`. PICA fetches it, checks it is audio (WAV, MP3,
+  FLAC, AIFF, OGG, WebM; max 800MB), stores it through the usual upload steps, links it to `work_id`
+  if given, and starts analysis. It fetches only https links on hosts listed in
+  `PICA_FILE_PARAM_HOSTS` and connects only to public addresses; with that setting empty it refuses
+  and points at `pica_upload`. Listed on every surface like every other tool; a stdio install has no
+  allowed hosts unless its own `PICA_FILE_PARAM_HOSTS` is set, so there it refuses the same way.
+- Skill `register-a-suno-song`: keeps a song made with Suno as a private record — the work and its
+  recording, a note quoting what Suno's terms allow for the user's plan, `ai_disclosure` on both, and
+  a credit only for a part the user wrote. It never claims ownership, records master ownership only
+  for a paid plan with a download from Suno, and never lists the song publicly unless the user wrote
+  part of it and asks.
+
+### Fixed
+
+- `pica_upload_file` and `pica_audio_presigned_upload` no longer tell agents that users cannot
+  upload through the chat: they point at `pica_upload` (the upload card, or an upload page).
+
+## [2.112.0] - 2026-10-30
+
+> Server only: `@withpica/mcp-sdk`, `@withpica/mcp-utils` and the directory are unchanged (SDK floor
+> stays `^4.1.0`). The hosted `/api/mcp` already serves this text; this release brings npm (stdio)
+> installs level with it.
+
+### Fixed
+
+- `pica_recording_custody_assign` on a recording whose master split is locked (ADR-321) answers
+  409 `SPLIT_LOCKED`. It now carries a recovery hint, and the description says so: the owner must
+  start a change, signed in, on the recording's page (`details.page`); an agent cannot, so tell the
+  user and do not retry. An agent retried this refusal four times in two minutes.
+
 ## [2.111.0] - 2026-10-29
 
 > **Publish order:** `@withpica/mcp-sdk` 4.1.0, `@withpica/mcp-utils` 2.0.2, then this package

package/README.intro.md

@@ -104,7 +104,7 @@ Every entry is published deliberately by its rights holder, with attested credit
 
 ## Before you train on any of this
 
-withpica.com publishes a blanket TDM reservation at <https://withpica.com/.well-known/tdmrep.json> (`"tdm-reservation": 1`). Nothing here is licensed for text-and-data mining or model training by default.
+withpica.com reserves its users' data (the directory, artist sites and every API except PICA's own open metrics, this server's endpoint included) against text-and-data mining at <https://withpica.com/.well-known/tdmrep.json> (`"tdm-reservation": 1`). Nothing here is licensed for text-and-data mining or model training by default.
 
 The `consent` endpoint above is the granular counterpart: ask it about an identifier and it reports what the rights holders have actually cleared, and at what level. A work is cleared at a level only when every credited contributor has granted at least that level; one refusal blocks it. Read `no_assertion_published` literally — it means no permission is published for that identifier, which is not a maybe.
 

package/README.md

@@ -65,7 +65,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ## Tools
 
-374 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
+376 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
 
 **works** — manage your musical works
 
@@ -101,7 +101,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 **audio** — manage and analyze audio files
 
-`pica_audio_query`, `pica_audio_inspect`, `pica_audio_presigned_upload`, `pica_audio_complete_upload`, `pica_audio_analyze`, `pica_audio_identify`, `pica_audio_assign`, `pica_audio_bulk_assign_suggested`, `pica_audio_dismiss_match`, `pica_audio_update`, `pica_audio_bulk_update`, `pica_audio_delete`, `pica_upload`, `pica_audio_pipeline_status`
+`pica_audio_query`, `pica_audio_inspect`, `pica_audio_attach`, `pica_audio_presigned_upload`, `pica_audio_complete_upload`, `pica_audio_analyze`, `pica_audio_identify`, `pica_audio_assign`, `pica_audio_bulk_assign_suggested`, `pica_audio_dismiss_match`, `pica_audio_update`, `pica_audio_bulk_update`, `pica_audio_delete`, `pica_upload`, `pica_audio_pipeline_status`
 
 **projects** — manage albums, EPs, and work groupings
 
@@ -237,7 +237,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 **royalties statements** — view royalties and ingested statements
 
-`pica_royalties_list`, `pica_royalties_get`, `pica_statements_query`, `pica_statements_inspect`, `pica_ingest_statement`, `pica_statements_pending`, `pica_statement_ingest_document`, `pica_statement_imports`, `pica_royalties_blockers`, `pica_royalties_unmatched`, `pica_royalties_attribute`
+`pica_royalties_list`, `pica_royalties_get`, `pica_statements_query`, `pica_statements_inspect`, `pica_ingest_statement`, `pica_statements_pending`, `pica_statement_ingest_document`, `pica_statement_imports`, `pica_statement_import_remove`, `pica_royalties_blockers`, `pica_royalties_unmatched`, `pica_royalties_attribute`
 
 **rights** — programmable rights — propose a song, master or share rule for the parties to confirm, check who has confirmed, see what money would be held and why, and what income would pay each party (computed, never paid)
 
@@ -297,4 +297,4 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ---
 
-Generated for `@withpica/mcp-server@2.111.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.
+Generated for `@withpica/mcp-server@2.113.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.