@withpica/mcp-server 2.63.0 → 2.63.1

package/dist/lib/changelog.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"changelog.generated.js","sourceRoot":"","sources":["../../src/lib/changelog.generated.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,yDAAyD;AAEzD,MAAM,CAAC,MAAM,YAAY,GAAG,g2nJAAg2nJ,CAAC;AAC73nJ,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"changelog.generated.js","sourceRoot":"","sources":["../../src/lib/changelog.generated.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,yDAAyD;AAEzD,MAAM,CAAC,MAAM,YAAY,GAAG,o4oJAAo4oJ,CAAC;AACj6oJ,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC"}

package/dist/server-instructions.d.ts

@@ -18,9 +18,9 @@
  * Block playbook: "document the high level of your server"
  * Lowin: "instructions are context — design them as context"
  */
-export declare const SERVER_INSTRUCTIONS = "withPICA manages music catalog metadata \u2014 works, recordings, people, credits, agreements, rights. Tools are pica_<domain>_<verb>, 200+ of them, from npm as @withpica/mcp-server. Distinct from @picahq/mcp (picaos.com) \u2014 same short name, unrelated.\n\nOn the first user message of a session \u2014 unless it names a single concrete action (e.g. \"register work X\") \u2014 call pica_skill_get(\"first-session\") and follow it.\n\nStart here:\n- pica_dashboard_briefing \u2014 daily summary of what needs attention\n- pica_search_all \u2014 find any entity by name, ISWC, ISRC, or IPI\n- pica_works_query / pica_people_query \u2014 browse the catalog\n\nThe catalog is ALWAYS accessible via the tools above \u2014 zero setup, no integration required. Peer-service data (Gmail, Drive, etc.) is reached via cross-MCP composition in the user's AI client, not via PICA \u2014 call pica_works_query directly for catalog content.\n\nSpotify/YouTube URLs: call pica_import_streaming_link (Spotify/Deezer) or pica_import_youtube_link directly.\n\nAfter 3-5 catalog mutations or major state changes, call pica_dashboard_briefing and surface the delta to the user.\n\nKey patterns:\n- Read tools are safe to call freely (readOnlyHint=true)\n- _inspect tools take sections (e.g., pica_works_inspect sections: [\"health\", \"completeness\"])\n- Write tools confirm what changed \u2014 share https://withpica.com/workspace?type=<entity>&id=<id> so the user can review (entity: work, person, recording, release, agreement, audio_file). Destructive tools (delete/merge) need two-step confirmation with a token\n- Errors include \"suggestion\" and \"next_tool\" for recovery\n- Enrichment: use pica_resolve_work / pica_resolve_person / pica_resolve_recording \u2014 fan out over Spotify, MusicBrainz, MLC, ISNI, Discogs, YouTube\n\nQuery endpoints accept \"limit\" (default 50) and paginate. IDs are UUIDs \u2014 use a _query tool first when unsure.\n\nSkills: pica_skill_list discovers methodologies (catalog-audit, register-my-works, prepare-for-sync). pica_skill_get(name) loads one. Trigger phrases like \"audit my catalog\" map directly. Bodies load lazily \u2014 not at handshake.\n\nPeer MCPs (mail, drive, notes, calendar, DAW): when PICA shows gaps, check peers before asking the user; cite via pica_enrichment_propose sources[].url (URI shapes: docs/mcp-source-uri-conventions.md). Citations persist verbatim and propagate to applied entities.";
+export declare const SERVER_INSTRUCTIONS = "withPICA manages music catalog metadata \u2014 works, recordings, people, credits, agreements, rights. Tools are pica_<domain>_<verb>, 200+ of them, from npm as @withpica/mcp-server. Distinct from @picahq/mcp (picaos.com) \u2014 same short name, unrelated.\n\nFirst-call identity (ADR-247): If your auth is a Bearer API key (not a cookie session and not a pica_grant_* token), call pica_introduce_self FIRST with agent_name + optional agent_role / on_behalf_of / model_hint. PICA stamps the declaration onto every audit row that follows so the user can later reconstruct what their agent did. Cookie and pica_grant_* callers are exempt \u2014 your identity is already on file. Declaration is valid 24h per credential.\n\nOn the first user message of a session \u2014 unless it names a single concrete action (e.g. \"register work X\") \u2014 call pica_skill_get(\"first-session\") and follow it.\n\nStart here:\n- pica_dashboard_briefing \u2014 daily summary of what needs attention\n- pica_search_all \u2014 find any entity by name, ISWC, ISRC, or IPI\n- pica_works_query / pica_people_query \u2014 browse the catalog\n\nThe catalog is ALWAYS accessible via the tools above \u2014 zero setup, no integration required. Peer-service data (Gmail, Drive, etc.) is reached via cross-MCP composition in the user's AI client, not via PICA \u2014 call pica_works_query directly for catalog content.\n\nSpotify/YouTube URLs: call pica_import_streaming_link (Spotify/Deezer) or pica_import_youtube_link directly.\n\nAfter 3-5 catalog mutations or major state changes, call pica_dashboard_briefing and surface the delta to the user.\n\nKey patterns:\n- Read tools are safe to call freely (readOnlyHint=true)\n- _inspect tools take sections (e.g., pica_works_inspect sections: [\"health\", \"completeness\"])\n- Write tools confirm what changed \u2014 share https://withpica.com/workspace?type=<entity>&id=<id> so the user can review (entity: work, person, recording, release, agreement, audio_file). Destructive tools (delete/merge) need two-step confirmation with a token\n- Errors include \"suggestion\" and \"next_tool\" for recovery\n- Enrichment: use pica_resolve_work / pica_resolve_person / pica_resolve_recording \u2014 fan out over Spotify, MusicBrainz, MLC, ISNI, Discogs, YouTube\n\nQuery endpoints accept \"limit\" (default 50) and paginate. IDs are UUIDs \u2014 use a _query tool first when unsure.\n\nSkills: pica_skill_list discovers methodologies (catalog-audit, register-my-works, prepare-for-sync). pica_skill_get(name) loads one. Trigger phrases like \"audit my catalog\" map directly. Bodies load lazily \u2014 not at handshake.\n\nPeer MCPs (mail, drive, notes, calendar, DAW): when PICA shows gaps, check peers before asking the user; cite via pica_enrichment_propose sources[].url (URI shapes: docs/mcp-source-uri-conventions.md). Citations persist verbatim and propagate to applied entities.";
 /** Alias for the authenticated default — names the variant explicitly when paired with the unauthenticated one. */
-export declare const SERVER_INSTRUCTIONS_AUTHENTICATED = "withPICA manages music catalog metadata \u2014 works, recordings, people, credits, agreements, rights. Tools are pica_<domain>_<verb>, 200+ of them, from npm as @withpica/mcp-server. Distinct from @picahq/mcp (picaos.com) \u2014 same short name, unrelated.\n\nOn the first user message of a session \u2014 unless it names a single concrete action (e.g. \"register work X\") \u2014 call pica_skill_get(\"first-session\") and follow it.\n\nStart here:\n- pica_dashboard_briefing \u2014 daily summary of what needs attention\n- pica_search_all \u2014 find any entity by name, ISWC, ISRC, or IPI\n- pica_works_query / pica_people_query \u2014 browse the catalog\n\nThe catalog is ALWAYS accessible via the tools above \u2014 zero setup, no integration required. Peer-service data (Gmail, Drive, etc.) is reached via cross-MCP composition in the user's AI client, not via PICA \u2014 call pica_works_query directly for catalog content.\n\nSpotify/YouTube URLs: call pica_import_streaming_link (Spotify/Deezer) or pica_import_youtube_link directly.\n\nAfter 3-5 catalog mutations or major state changes, call pica_dashboard_briefing and surface the delta to the user.\n\nKey patterns:\n- Read tools are safe to call freely (readOnlyHint=true)\n- _inspect tools take sections (e.g., pica_works_inspect sections: [\"health\", \"completeness\"])\n- Write tools confirm what changed \u2014 share https://withpica.com/workspace?type=<entity>&id=<id> so the user can review (entity: work, person, recording, release, agreement, audio_file). Destructive tools (delete/merge) need two-step confirmation with a token\n- Errors include \"suggestion\" and \"next_tool\" for recovery\n- Enrichment: use pica_resolve_work / pica_resolve_person / pica_resolve_recording \u2014 fan out over Spotify, MusicBrainz, MLC, ISNI, Discogs, YouTube\n\nQuery endpoints accept \"limit\" (default 50) and paginate. IDs are UUIDs \u2014 use a _query tool first when unsure.\n\nSkills: pica_skill_list discovers methodologies (catalog-audit, register-my-works, prepare-for-sync). pica_skill_get(name) loads one. Trigger phrases like \"audit my catalog\" map directly. Bodies load lazily \u2014 not at handshake.\n\nPeer MCPs (mail, drive, notes, calendar, DAW): when PICA shows gaps, check peers before asking the user; cite via pica_enrichment_propose sources[].url (URI shapes: docs/mcp-source-uri-conventions.md). Citations persist verbatim and propagate to applied entities.";
+export declare const SERVER_INSTRUCTIONS_AUTHENTICATED = "withPICA manages music catalog metadata \u2014 works, recordings, people, credits, agreements, rights. Tools are pica_<domain>_<verb>, 200+ of them, from npm as @withpica/mcp-server. Distinct from @picahq/mcp (picaos.com) \u2014 same short name, unrelated.\n\nFirst-call identity (ADR-247): If your auth is a Bearer API key (not a cookie session and not a pica_grant_* token), call pica_introduce_self FIRST with agent_name + optional agent_role / on_behalf_of / model_hint. PICA stamps the declaration onto every audit row that follows so the user can later reconstruct what their agent did. Cookie and pica_grant_* callers are exempt \u2014 your identity is already on file. Declaration is valid 24h per credential.\n\nOn the first user message of a session \u2014 unless it names a single concrete action (e.g. \"register work X\") \u2014 call pica_skill_get(\"first-session\") and follow it.\n\nStart here:\n- pica_dashboard_briefing \u2014 daily summary of what needs attention\n- pica_search_all \u2014 find any entity by name, ISWC, ISRC, or IPI\n- pica_works_query / pica_people_query \u2014 browse the catalog\n\nThe catalog is ALWAYS accessible via the tools above \u2014 zero setup, no integration required. Peer-service data (Gmail, Drive, etc.) is reached via cross-MCP composition in the user's AI client, not via PICA \u2014 call pica_works_query directly for catalog content.\n\nSpotify/YouTube URLs: call pica_import_streaming_link (Spotify/Deezer) or pica_import_youtube_link directly.\n\nAfter 3-5 catalog mutations or major state changes, call pica_dashboard_briefing and surface the delta to the user.\n\nKey patterns:\n- Read tools are safe to call freely (readOnlyHint=true)\n- _inspect tools take sections (e.g., pica_works_inspect sections: [\"health\", \"completeness\"])\n- Write tools confirm what changed \u2014 share https://withpica.com/workspace?type=<entity>&id=<id> so the user can review (entity: work, person, recording, release, agreement, audio_file). Destructive tools (delete/merge) need two-step confirmation with a token\n- Errors include \"suggestion\" and \"next_tool\" for recovery\n- Enrichment: use pica_resolve_work / pica_resolve_person / pica_resolve_recording \u2014 fan out over Spotify, MusicBrainz, MLC, ISNI, Discogs, YouTube\n\nQuery endpoints accept \"limit\" (default 50) and paginate. IDs are UUIDs \u2014 use a _query tool first when unsure.\n\nSkills: pica_skill_list discovers methodologies (catalog-audit, register-my-works, prepare-for-sync). pica_skill_get(name) loads one. Trigger phrases like \"audit my catalog\" map directly. Bodies load lazily \u2014 not at handshake.\n\nPeer MCPs (mail, drive, notes, calendar, DAW): when PICA shows gaps, check peers before asking the user; cite via pica_enrichment_propose sources[].url (URI shapes: docs/mcp-source-uri-conventions.md). Citations persist verbatim and propagate to applied entities.";
 /** Minimal billing-slice shape consumed by the trial-ending clause. Structurally
  *  compatible with `OrgBillingSlice` from lib/services/subscription so callers
  *  can pass either. Local declaration keeps mcp-server's copy self-contained

package/dist/server-instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-instructions.d.ts","sourceRoot":"","sources":["../src/server-instructions.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,i5EA0BwO,CAAC;AAEzQ,mHAAmH;AACnH,eAAO,MAAM,iCAAiC,i5EAAsB,CAAC;AAErE;;;oEAGoE;AACpE,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,eAAe,GAAG,IAAI,GAC5B,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,CAO1E;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC,mwBAM2M,CAAC"}
+{"version":3,"file":"server-instructions.d.ts","sourceRoot":"","sources":["../src/server-instructions.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,81FA4BwO,CAAC;AAEzQ,mHAAmH;AACnH,eAAO,MAAM,iCAAiC,81FAAsB,CAAC;AAErE;;;oEAGoE;AACpE,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,eAAe,GAAG,IAAI,GAC5B,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,CAO1E;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC,mwBAM2M,CAAC"}

package/dist/server-instructions.js

@@ -21,6 +21,8 @@
  */
 export const SERVER_INSTRUCTIONS = `withPICA manages music catalog metadata — works, recordings, people, credits, agreements, rights. Tools are pica_<domain>_<verb>, 200+ of them, from npm as @withpica/mcp-server. Distinct from @picahq/mcp (picaos.com) — same short name, unrelated.
 
+First-call identity (ADR-247): If your auth is a Bearer API key (not a cookie session and not a pica_grant_* token), call pica_introduce_self FIRST with agent_name + optional agent_role / on_behalf_of / model_hint. PICA stamps the declaration onto every audit row that follows so the user can later reconstruct what their agent did. Cookie and pica_grant_* callers are exempt — your identity is already on file. Declaration is valid 24h per credential.
+
 On the first user message of a session — unless it names a single concrete action (e.g. "register work X") — call pica_skill_get("first-session") and follow it.
 
 Start here:

package/dist/server-instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-instructions.js","sourceRoot":"","sources":["../src/server-instructions.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;wQA0BqO,CAAC;AAEzQ,mHAAmH;AACnH,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;AAWrE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAA6B;IAE7B,OAAO,iCAAiC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA6B;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,oBAAoB,CAAC;IACxC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,gCAAgC,IAAI,IAAI,OAAO,yGAAyG,CAAC;AAClK,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG;;;;;;2PAMwM,CAAC"}
+{"version":3,"file":"server-instructions.js","sourceRoot":"","sources":["../src/server-instructions.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;wQA4BqO,CAAC;AAEzQ,mHAAmH;AACnH,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;AAWrE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAA6B;IAE7B,OAAO,iCAAiC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA6B;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,oBAAoB,CAAC;IACxC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,gCAAgC,IAAI,IAAI,OAAO,yGAAyG,CAAC;AAClK,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG;;;;;;2PAMwM,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@withpica/mcp-server",
   "mcpName": "io.github.withpica/pica",
-  "version": "2.63.0",
+  "version": "2.63.1",
   "description": "MCP Server for withPICA — enables AI assistants to interact with your withPICA music catalog",
   "type": "module",
   "main": "dist/index.js",