@withpica/mcp-server 2.76.0 → 2.78.0

package/CHANGELOG.md

@@ -11,6 +11,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **`pica_execute` annotations** now advertise `readOnlyHint: false` and
+  `openWorldHint: true`, matching the dispatcher's real behaviour — it can route
+  to write/destructive/external tools, so claiming read-only / closed-world was
+  wrong (and was flagged in OpenAI app review). The scope `tier` stays `"read"`
+  so a read-scoped key can still dispatch read tools through it; real scope and
+  destructive confirmation remain enforced on the **wrapped** tool, not the
+  wrapper. Implemented via a new advisory-only `annotationOverrides` field on the
+  tool definition (completes the ADR-230 tier→hint coupling for the one tool
+  whose client-facing hint must differ from its scope tier). No enforcement
+  change.
+
+## [2.78.0] - 2026-06-15
+
+Carries the uniform deletion contract MCP rendering (originally 2.76.0) forward
+on top of 2.77.0's `pica_import_from_spotify` removal. 2.76.0 (deletion contract)
+and 2.77.0 (import removal) were published from parallel branches; 2.77.0 was
+built before this branch merged, so it did not include the deletion rendering —
+this release re-establishes it on top of the removal.
+
+### Changed
+
+- **`pica_works_delete` / `pica_recordings_delete`** render the uniform delete
+  outcome via `formatDeletion` (status `deleted`/`archived`/refused + what was
+  unlinked + how to fully delete); descriptions state the contract. Re-applied
+  here after 2.77.0 (parallel branch) shipped without them.
+
 ## [2.76.0] - 2026-06-15
 
 Uniform deletion contract surfaced to agents. `pica_works_delete` and
@@ -30,6 +58,19 @@ what was auto-unlinked, and — when refused — exactly what to remove first.
   `spotify_album_id` (exact) lookup filters — locate a release by
   title/UPC/album instead of paging the whole catalogue (feedback 9a7a50f7).
 
+## [2.77.0] - 2026-06-15
+
+### Removed
+
+- **`pica_import_from_spotify`** (BREAKING) — removed after a multi-release
+  deprecation window. It was superseded by **`pica_import_streaming_link`**,
+  which offers the same two-step preview/confirm flow and output and also
+  supports Deezer. Callers passing a Spotify URL should switch to
+  `pica_import_streaming_link` with the `url` argument (the only rename is
+  `spotify_url` → `url`). Shipped as its own deliberate breaking PR rather than
+  bundled into an unrelated release, per the standing removal plan recorded in
+  `TOOL_METADATA`. (2.76.0 = the uniform deletion contract, shipped separately.)
+
 ## [2.75.0] - 2026-06-15
 
 ### Added