@withpica/mcp-server 2.95.0 → 2.95.2

package/CHANGELOG.md

@@ -9,6 +9,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > matching entry here in the same commit. See the project's "npm publish
 > discipline" memory entry for the enforcement rationale.
 
+## [Unreleased]
+
+## [2.95.2] - 2026-07-28
+
+### Added
+
+- **`pica_consent_readiness` (ADR-300)** — the read side of ADR-292's consent ledger. Returns an org-scoped readiness verdict: a `rungs` map giving cleared / partial / blocked / unset asset counts at each consent level, a `blockers` list naming credited people with no decision recorded or an explicit refusal (refusals first, then by catalogue reach), and `blockedAssets`. `truncated` reports honestly when a list was capped. An asset is cleared at a level only when EVERY credited contributor has granted at least that level; one live revocation blocks it at every level. Read tier, free, all three audiences. Deliberately read-only — consent WRITES stay human-session only, because a consent decision has to be made by the person whose rights it binds, not by an agent acting for them.
+
+### Changed
+
+- **`pica_export_ai_consent` description corrected.** It claimed to show "which works are human-made, AI-assisted, or AI-generated" — that is `works.ai_disclosure_level` (ADR-086), a different field the AI-consent service has never read. Agents were being pointed at the wrong feature. The description now says what the tool does (produces the consent FILE) and routes intent for the ANSWER to `pica_consent_readiness`.
+- The consent file's per-asset `use_cases_allowed` now reflects the consent LEVEL, and `assets.csv` gains a `cleared_level` column. This narrows what the export claims: a work whose contributors granted only `tracking_only`, or where any contributor has not answered, no longer reports training/generation/commercial as permitted. See the app repo's FIX_LOG 2026-07-27 entry — a previously downloaded ZIP will disagree with the next one, and the next one is right.
+
+> Patch, not minor, on purpose: `2.96.0` stays reserved for the WS5 deprecated-alias removals.
+
+## [2.95.1] - 2026-07-27
+
+### Added
+
+- `pica_works_bulk_move_to_performances` now carries the `http` audience, matching its sibling `pica_works_bulk_delete` — the tool becomes reachable on the hosted connector surface at the next release. No auth change: the backing route already gated on `write:catalog` + `destructive:*`, identical to bulk-delete, and `risk: "destructive"` keeps it off unauthenticated public discovery. (Lands the branch parked 2026-07-13 to fold the connector-surface change into a batch; the WS5 batch shipped in 2.95.0, expiring the parking condition.)
+
+### Fixed
+
+- **Bulk reads over the 100KB cap now return complete records plus a real
+  resume cursor, never a mid-record cut** (ops 41ff656c / 893e3e29). The
+  dispatcher routes every result through `guardToolResult`
+  (`@withpica/mcp-utils@1.27.0`): oversized LIST responses are trimmed to
+  whole items and stamped with `truncated`, `items_dropped`, `next_offset`
+  (offset-paging tools) and `recovery_hint` — in both the text view (still
+  valid JSON) and `structuredContent`, which previously escaped the cap
+  entirely. Non-list shapes keep the legacy text truncation.
+
 ## [2.95.0] - 2026-07-24
 
 ### Added

package/dist/apps/download.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2024-2026 Withpica Ltd. All rights reserved.
+// Copyright (c) 2025-2026 Withpica Ltd. All rights reserved.
 /**
  * pica_download MCP App card — file delivery.
  *

package/dist/apps/release.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2024-2026 Withpica Ltd. All rights reserved.
+// Copyright (c) 2025-2026 Withpica Ltd. All rights reserved.
 /**
  * pica_release_show MCP App card — Phase 3 stub render.
  *

package/dist/apps/shared.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2024-2026 Withpica Ltd. All rights reserved.
+// Copyright (c) 2025-2026 Withpica Ltd. All rights reserved.
 import { INSTRUMENT_SERIF_REGULAR_BASE64, INSTRUMENT_SERIF_ITALIC_BASE64, GEIST_SANS_LIGHT_BASE64, APP_BRIDGE_JS, } from "./generated/shared-bundle.js";
 // ---------------------------------------------------------------------------
 // Design system CSS — embedded fonts + full PICA dark/light theme

package/dist/apps/upload.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2024-2026 Withpica Ltd. All rights reserved.
+// Copyright (c) 2025-2026 Withpica Ltd. All rights reserved.
 /**
  * pica_upload MCP App card — generic drop zone.
  *

package/dist/config.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2024-2026 Withpica Ltd. All rights reserved.
+// Copyright (c) 2025-2026 Withpica Ltd. All rights reserved.
 /**
  * MCP Server Configuration
  */

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Copyright (c) 2024-2026 Withpica Ltd. All rights reserved.
+// Copyright (c) 2025-2026 Withpica Ltd. All rights reserved.
 /**
  * PICA MCP Server
  * Entry point for the Model Context Protocol server