@withpica/mcp-server 2.91.1 → 2.93.0

package/CHANGELOG.md

@@ -9,6 +9,153 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > matching entry here in the same commit. See the project's "npm publish
 > discipline" memory entry for the enforcement rationale.
 
+## [2.93.0] - 2026-07-12
+
+### Removed
+
+- **WS5 removal sweep — 6 zero-traffic deprecated aliases DELETED** after a
+  30-day prod-telemetry gate (`agent_events`): `pica_projects_get`,
+  `pica_notes_get`, `pica_sessions_list`, `pica_sessions_get`,
+  `pica_statements_get`, `pica_share_links_list`. Each had 0 calls in the last
+  30 days in production. Their standalone `ToolDefinition`, `TOOL_METADATA`,
+  cost-model, discovery, and required-schemas rows were all removed; the shared
+  executors (getProject, getNote, listSessions, getSession, getStatement,
+  listShareLinks) stay because they back the canonical `_query` / `_inspect`
+  tools. The 10 deprecated aliases that still carry live traffic
+  (`pica_releases_list/_get`, `pica_releases_attach_track_by_identifier`,
+  `pica_releases_bulk_attach_tracks`, `pica_projects_list`, `pica_notes_list`,
+  `pica_documents_list/_read`, `pica_statements_list`,
+  `pica_recording_credits_bulk_update`) STAY callable — their `removal_target`
+  is consciously extended from 2.93.0 to 2.95.0 so the "expire loudly" lint
+  does not block this publish. Re-run the traffic gate before 2.95.0.
+
+### Changed
+
+- **Royalty / statement read tools re-scoped to finance visibility.** The
+  `pica_royalties_*` read tools (`_list`, `_get`, `_summary`, `_unmatched`) and
+  the `pica_statements_query` / `_inspect` / `_list` reads move from
+  `read:catalog` to `read:finances`; `pica_royalties_attribute` moves from
+  `write:catalog` to `write:finances`. This aligns the MCP tool declaration
+  with the backing routes' `callerHasFinanceAccess` gate (#1623) and the proxy
+  bearer-write floor — gated callers are now filtered from `tools/list` at
+  discovery instead of getting a 403 after calling. `read:finances` /
+  `write:finances` are admin-tier (not user-grantable); admin satisfies both.
+
+### Added
+
+- **`dossier` section on `pica_works_inspect`.** `sections: ["dossier"]`
+  returns the full song dossier — everything PICA holds about a song
+  (recordings, releases, composition credits, people, provenance, AI
+  disclosure, consent) in one structured payload, via
+  `WorksResource.dossier()` (SDK 3.7.0). Rendered as a compact one-line text
+  summary plus the full JSON under `structuredContent.data.dossier`. Opt-in
+  only (never part of the default all-sections response, as it is a heavy
+  superset); a downloadable PDF of the same dossier is available from the web
+  UI. Not a new tool — folded onto the existing inspect tool per the
+  tool-surface-consolidation preference so it rides the batched OpenAI
+  resubmission rather than forcing a new one.
+
+## [2.92.0] - 2026-07-09
+
+### Added
+
+- **`pica_find_duplicates` (works) surfaces fuzzy near-title duplicate groups**
+  (WS4 agentic fixes, 2026-07-10). The backing service adds a conservative
+  Levenshtein pass (≥85% on version-stripped base titles ≥5 chars,
+  exclusion-aware, only among works no exact key grouped); groups arrive
+  labelled `match_kind: "fuzzy_title"` with a `similarity` score (exact-key
+  groups are labelled `match_kind: "exact"`), and fuzzy groups get a
+  confidence-honest decision question ("look very similar … are they the same
+  song?") with the safe default unchanged at "keep them separate". No
+  inputSchema change — the fields are additive on the existing response.
+- **`pica_catalog_health_plan` / `pica_catalog_health_fix` can now carry two
+  new action shapes** (WS4): `merge_pair` with `preview.grain: "release"`
+  (duplicate releases by normalized UPC, survivor = oldest, applied via the
+  same engine as `pica_merge_duplicates`) and `normalize_work_splits`
+  (work-collaborator splits summing ≠ 100 proportionally rescaled to exactly
+  100.00 — propose-only, per-collaborator before→after preview, live-row
+  recompute + post-apply verification at apply time). Replaces the previously
+  un-appliable work-grain `set_splits_to_template` emission. Tool descriptions
+  updated; schemas unchanged.
+
+- **`pica_people_create` / `pica_people_update` gain `affiliation_kind` on
+  `society_affiliations` items and a new `origin_countries` field** (ADR-292).
+  `affiliation_kind` distinguishes a society the person is a current _member_
+  of from their home-country _origin_ society for that code (defaults to
+  `member`). `origin_countries` is an array of ISO 3166-1 alpha-2 heritage
+  countries — the creator's self-identified origin, stored on a real
+  `public.people` column and sanitized server-side.
+
+- **New tool `pica_integrity_waive`** (registration integrity floor, PR
+  #1595). Waives a registration-integrity gap the user has confirmed is
+  intentional or unresolvable (cover writer, deceased collaborator,
+  unreleased demo) — requires explicit user confirmation, and waivers are
+  reversible. Completes the integrity-assess surface the write-tool
+  pressure hints and dashboard-briefing nag point at.
+
+- **`pica_works_create` / `pica_recordings_create` gain a `create_twin`
+  flag + twin completion hints** (auto-twin, commit 689298e3c). The
+  backing create routes auto-mint the twin entity (work↔recording);
+  agents can now opt out via `create_twin: false`, and when a twin WAS
+  minted the executor appends a completion hint ("also created the
+  linked <recording|work> <id> — pass create_twin: false to skip").
+  Backed by the SDK's new `requestWithEnvelope()` so the routes'
+  `twin`/`twin_error` sibling fields survive the response unwrap.
+
+### Fixed
+
+- **`pica_enrichment_proposals_list` failed 100% of real calls with
+  `UNEXPECTED_RESPONSE_SHAPE`** (since 2026-06-10; ops_issues
+  18f25b41/20c76911). The route returns `{success, data: {proposals,
+count, filters}}` and the SDK narrows to `.data`, so the tool receives
+  the OBJECT — the `Array.isArray` guard rejected every real response.
+  The tool now unwraps `.proposals` (guard retained for genuinely bad
+  shapes). The `pica_enrichment_proposals_bulk_reject` dry-run filter preview had
+  the sibling bug (normalised via a `.data` key that never exists —
+  always previewed 0 ids) and is fixed in the same stroke.
+- **`pica_releases_detach_track` reported "preview — call again with
+  confirm:true" AFTER the delete executed** (ops_issue 0137b1b8,
+  user_feedback e6320d08). The tool checked `result.data.confirmed` on a
+  response the SDK had already unwrapped — always undefined — so an
+  executed destructive mutation rendered as a pending preview. Now checks
+  the unwrapped `{confirmed, preview|removed}` shape; both paths render
+  correctly.
+- **`pica_notes_list` / `pica_notes_query` silently returned an empty
+  list on every call** (same envelope-unwrap class, found in the sweep).
+  `GET /admin/notes` nests `{data, count, pagination}` under `data`; the
+  tool's bare-array check discarded the object. Now unwraps the inner
+  `data` array.
+
+### Changed
+
+- Deprecation `removal_target` on the 16 ADR-149/tool-consolidation aliases
+  in `TOOL_ALIASES` / `TOOL_METADATA` extended from `2.92.0` to `2.93.0` —
+  this release reaches `2.92.0`, so the prior target would have tripped the
+  ADR-180 deprecation-expiry lint. No removal decision made; purely
+  housekeeping to keep the aliases alive one more minor.
+
+## [2.91.2] - 2026-07-09
+
+### Added
+
+- **WS3 "Confident Recall" — ambiguity signalling on `pica_search_all`.** When the top fuzzy matches
+  are too close to call, the response carries an additive `ambiguity` block
+  (`ambiguous: true`, the close candidates with confidences, and guidance)
+  and the text content leads with an "⚠ AMBIGUOUS MATCH" banner — the agent
+  is told to ask the user which entity they mean instead of acting on a
+  guess. Absent on clear wins; identifier-exact lookups (ISRC/ISWC/IPI)
+  never signal.
+- **`pica_people_inspect` gains a `connections` section** — the one-call
+  org-catalog neighbourhood of a person: works, recordings, releases, and
+  agreements as `{kind, id, name, via}` with per-kind counts and a capped
+  flag. Answers "everything connected to X" / "what have I done with X"
+  without stitching sections. Creator Question Atlas backing added;
+  `pica_graph_traverse` (global graph, identifier-only) cross-references it.
+- **Accent parity, last mile.** The releases free-text query and the
+  collaborator/contributor searches now match accent-insensitively
+  ("fez" finds "Féz"), completing the parity the catalog entity searches
+  gained on 2026-07-06.
+
 ## [2.91.1] - 2026-07-08
 
 ### Added