@withpica/mcp-server 2.68.0 → 2.72.0

package/CHANGELOG.md

@@ -11,6 +11,149 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **`pica_works_verify_registrations`** — ADR-264 WS2 truthful diagnosis. Verify
+  the registration status of up to 25 works. `mode: "check"` looks each work up
+  at the MLC (ISWC → title + writer IPI → title + primary-artist name) and
+  records what the lookup PROVED: a found registration is written as a positive
+  society fact (and any stale negative assertion is cleared); a clean not-found
+  becomes a `verified_absent` assertion with a lookup receipt. Lookup errors and
+  works with no usable identifiers write NOTHING (`lookup_failed` /
+  `insufficient_identifiers`). `mode: "confirm_unregistered"` records the user's
+  own confirmation (optional `society_code`; omitted = "not registered with any
+  society"). `works_without_registrations` rows on `pica_dashboard_attention`
+  now carry an `evidence` block (`unverified_absent` / `verified_absent` /
+  `user_confirmed_absent` with `verified_via` + `checked_at`) reflecting these
+  assertions.
+
+## [2.72.0] - 2026-06-10
+
+ADR-264 WS1.3 — recordings/releases dedup + merge (last trust-floor gap).
+
+### Changed
+
+- **`pica_find_duplicates`** — `entity_type` now covers `releases` and
+  `recordings` (added in 2.72.0); description explicitly names the UPC and
+  ISRC grouping keys so callers understand the detection basis.
+- **`pica_merge_duplicates`** — extended to cover `recordings` and `releases`
+  (+ singular aliases `recording` / `release` for backwards compatibility).
+  - `recordings`: merges via `merge_recording_atomic` RPC — credits, splits,
+    and release-track links are deduped by their natural keys; winner's NULL
+    fields (ISRC, duration, streaming IDs, artist name, artwork) are back-filled
+    from the first loser that has a value.
+  - `releases`: merges via `merge_release_atomic` RPC — tracks are rehomed
+    (dedup by recording_id within the winner's tracklist); UPC, release date,
+    artwork, and label/distributor org links are gap-filled from losers.
+  - **PROVENANCE BLOCK**: a recording loser with `recording_custodians` rows
+    (ADR-262 append-only custody chain) blocks the merge. The tool returns a
+    structured `MERGE_BLOCKED_PROVENANCE` error with `blocked_ids`, the `remedy`
+    ("custody chains are append-only; transfer custody first or keep both
+    recordings"), and `next_tool: "pica_recording_custody_assign"` so the AI can
+    route directly to the safe resolution path.
+
+### Recovery hints
+
+- `MERGE_BLOCKED_PROVENANCE` added to the `pica_merge_duplicates` hint registry
+  → `pica_recording_custody_assign`.
+
+## [2.71.0] - 2026-06-10
+
+ADR-265 release parties and invites — label/distributor org creation + recording/release-grain invite targets. Requires `@withpica/mcp-sdk@^1.39.0`.
+
+### Added
+
+- **`pica_labels_create`** — create an unclaimed label or distributor organisation.
+  Accepts `name`, `org_type` (`label` | `distributor`), and optional `country` /
+  `website` / `contact_email`. Server-side deduplication is catalog-wide across
+  both party types: a case-insensitive name match returns the existing record
+  with `already_existed: true` rather than creating a duplicate. The returned
+  `id` can be assigned to `releases.label_organization_id` (via
+  `pica_releases_update`) or `releases.distributor_organization_id` to formally
+  link a release's label or distributor.
+- **`recording_id` / `release_id` targets on `pica_collaborators_invite`** — in
+  addition to the existing `work_id`, invite calls now accept exactly one of three
+  target ids (`work_id` | `recording_id` | `release_id`). Recording-grain invites
+  surface a claim scoped to the named recording's credits; release-grain invites
+  surface a claim that verifies all the invitee's credits across every recording on
+  the release. Exactly-one-of validation is enforced server-side (400 if zero or
+  multiple targets are supplied).
+
+### Fixed
+
+- **`pica_labels_query` always returned "Found 0 labels"** — an SDK envelope
+  double-unwrap (`labels.list` read `.data` off the already-unwrapped array)
+  meant the tool had returned empty results regardless of catalog state since
+  it shipped (2026-04-14). Fixed in `@withpica/mcp-sdk@1.39.0`.
+- **`pica_labels_create` dedup messaging now sees `already_existed`** — the
+  same envelope unwrap stripped the `already_existed` sibling flag, so every
+  successful create tripped the no-data guard and the "already exists — link
+  it instead" guidance never fired. The SDK now returns the label object
+  directly with `already_existed` inside it.
+
+## [2.70.0] - 2026-06-10
+
+ADR-264 WS1 trust floor — conservative-by-default enrichment, truthful tool
+outputs, and the reviewable enrichment queue. Requires `@withpica/mcp-sdk@^1.38.0`.
+
+### Added
+
+- `pica_enrichment_proposals_bulk_reject` (mutating, `dry_run` preview):
+  reject up to 100 pending enrichment proposals by explicit ids OR a filter
+  (`rule_id` / `source` / `max_confidence`). Per-proposal effects identical to
+  `pica_enrichment_proposal_reject` (permanent content-hash suppression).
+  `dry_run` resolves the real affected set — the filter path queries the live
+  list, no fake previews.
+- `pica_enrichment_proposals_list` gains `min_confidence`, `max_confidence`,
+  and `created_after` filters, so a caller can isolate the batch they just
+  triggered from accumulated stale low-confidence noise.
+- `pica_releases_list` gains `offset` pagination with an honest envelope
+  (`count`, `offset`, `has_more`, `next_offset`) — every release is reachable;
+  no more mid-array ~100KB truncation dead-end.
+
+### Changed
+
+- Enrichment behaviour (backend, surfaced through proposals): official
+  YouTube " - Topic" channel uploads now classify as `master` and the
+  `artist_title_to_youtube` rule defaults to enriching the existing master
+  recording (UPDATE proposal attaching `youtube_video_id`/`youtube_url`)
+  instead of minting a phantom `alternate` recording; creating a new
+  recording now requires affirmative low-sameness evidence (version markers
+  or >3s duration delta). Proposals carry a `sameness_evidence` signal.
+- `pica_import_from_spotify` preview wording: duplicates are reported as
+  "already in catalog (will be skipped, not modified)" — the preview no
+  longer promises an enrichment the executor does not perform.
+- `pica_execute` hardening: the `WRAPPED_ARGS_MISSING` transport error now
+  fires when ANY required field of the wrapped tool is missing (partial
+  client-side argument strips included), naming `missing_required_fields`.
+  The nested `args` object is the canonical call shape.
+
+### Fixed
+
+- `pica_enrichment_proposals_list` no longer renders the literal
+  `"? pending proposal(s)"` when the backend returns an unexpected shape —
+  that case is now a structured `UNEXPECTED_RESPONSE_SHAPE` error (with
+  `structuredContent`), not a fake count.
+
+### Removed
+
+- Dropped the unused `mppx` runtime dependency. No `src/` consumer has existed
+  since the MPP unit tests were deleted; the earlier cleanup left it in place
+  "to avoid lockfile churn" and asked the next publisher to drop it — done.
+
+## [2.69.0] - 2026-06-08
+
+### Added
+
+- Recording custody tools (ADR-262 — master-side control chain):
+  `pica_recording_custody_assign` (transfer custody of a recording; admin/owner,
+  control/possession transfer types only) and `pica_recording_provenance` (read
+  the ordered custody legs + immutable origin credits). Thin wrappers over the
+  live `/api/admin/recording-custody/*` routes via the new SDK
+  `recordingCustody` resource (requires `@withpica/mcp-sdk@^1.37.0`).
+- `pica_releases_create` / `pica_releases_update` accept an `availability`
+  write param (`available` | `withdrawn`) to mark a release live or taken down.
+
 ## [2.68.0] - 2026-06-07
 
 Adds a structured-metadata escape hatch to work creation. No SDK bump required (`@withpica/mcp-sdk` ^1.36.0).