@withpica/mcp-server 2.92.0 → 2.93.1

package/CHANGELOG.md

@@ -9,6 +9,64 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > matching entry here in the same commit. See the project's "npm publish
 > discipline" memory entry for the enforcement rationale.
 
+## [2.93.1] - 2026-07-14
+
+### Fixed
+
+- **`pica_works_bulk_link_artist` dry-run no longer returns a false preview.**
+  The preview now routes through the same endpoint (with `dryRun=true`) as the
+  commit, so it shares the commit's person-resolution and validation — a person
+  the commit cannot find is refused at preview time instead of reporting an
+  optimistic "would link N". Requires `@withpica/mcp-sdk@^3.7.1`. The tool's
+  input schema is unchanged, so this does not trigger an OpenAI connector
+  resubmission.
+
+## [2.93.0] - 2026-07-12
+
+### Removed
+
+- **WS5 removal sweep — 6 zero-traffic deprecated aliases DELETED** after a
+  30-day prod-telemetry gate (`agent_events`): `pica_projects_get`,
+  `pica_notes_get`, `pica_sessions_list`, `pica_sessions_get`,
+  `pica_statements_get`, `pica_share_links_list`. Each had 0 calls in the last
+  30 days in production. Their standalone `ToolDefinition`, `TOOL_METADATA`,
+  cost-model, discovery, and required-schemas rows were all removed; the shared
+  executors (getProject, getNote, listSessions, getSession, getStatement,
+  listShareLinks) stay because they back the canonical `_query` / `_inspect`
+  tools. The 10 deprecated aliases that still carry live traffic
+  (`pica_releases_list/_get`, `pica_releases_attach_track_by_identifier`,
+  `pica_releases_bulk_attach_tracks`, `pica_projects_list`, `pica_notes_list`,
+  `pica_documents_list/_read`, `pica_statements_list`,
+  `pica_recording_credits_bulk_update`) STAY callable — their `removal_target`
+  is consciously extended from 2.93.0 to 2.95.0 so the "expire loudly" lint
+  does not block this publish. Re-run the traffic gate before 2.95.0.
+
+### Changed
+
+- **Royalty / statement read tools re-scoped to finance visibility.** The
+  `pica_royalties_*` read tools (`_list`, `_get`, `_summary`, `_unmatched`) and
+  the `pica_statements_query` / `_inspect` / `_list` reads move from
+  `read:catalog` to `read:finances`; `pica_royalties_attribute` moves from
+  `write:catalog` to `write:finances`. This aligns the MCP tool declaration
+  with the backing routes' `callerHasFinanceAccess` gate (#1623) and the proxy
+  bearer-write floor — gated callers are now filtered from `tools/list` at
+  discovery instead of getting a 403 after calling. `read:finances` /
+  `write:finances` are admin-tier (not user-grantable); admin satisfies both.
+
+### Added
+
+- **`dossier` section on `pica_works_inspect`.** `sections: ["dossier"]`
+  returns the full song dossier — everything PICA holds about a song
+  (recordings, releases, composition credits, people, provenance, AI
+  disclosure, consent) in one structured payload, via
+  `WorksResource.dossier()` (SDK 3.7.0). Rendered as a compact one-line text
+  summary plus the full JSON under `structuredContent.data.dossier`. Opt-in
+  only (never part of the default all-sections response, as it is a heavy
+  superset); a downloadable PDF of the same dossier is available from the web
+  UI. Not a new tool — folded onto the existing inspect tool per the
+  tool-surface-consolidation preference so it rides the batched OpenAI
+  resubmission rather than forcing a new one.
+
 ## [2.92.0] - 2026-07-09
 
 ### Added