@withpica/mcp-server 2.96.2 → 2.97.0

package/CHANGELOG.md

@@ -11,6 +11,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+PR #2118 (`fix/avatar-import-path-2026-09-03`) is merged into the release branch, so its changes ship in the version below; publish in the order mcp-utils → mcp-sdk → mcp-server.
+
+## [2.97.0] - 2026-09-04
+
+⚠️ Publish order: `@withpica/mcp-sdk` 3.14.0 and `@withpica/mcp-utils` 1.29.0
+must be on npm before this release — the dependency floors are now
+`^3.14.0` / `^1.29.0` (this release imports `pageEnvelope`, which only
+exists from mcp-utils 1.29.0; a clean install against 1.28.0 breaks at
+runtime — the 2.96.2 uninstallable incident).
+
+### Added
+
+- `pica_multimedia_import_url` accepts `person_id` (sets the person's profile image) and its summary names the outcome — `Imported from URL (via)`, profile-image set/NOT set, work link (PR #2118, merged into this release). Page URLs are followed to their `og:image`.
+
+- **Per-tool argument aliasing for `pica_execute`** (`arg-aliases.ts`, D1
+  2026-09-03) — `applyArgAliases` renames a tool's OWN entity id (or an
+  explicit `TOOL_ARG_ALIASES` entry, e.g. `pica_skill_get`'s `skill` /
+  `skill_name`) to the schema's real required field name, structurally by
+  domain (`DOMAIN_ID_ALIASES`) — never a foreign entity's id, never
+  overwriting a value already present, and left untouched when more than
+  one candidate is present. Fixes the wrong diagnosis `pica_execute` gave in
+  all 36 logged cases since July, where an agent sent e.g. `audio_file_id`
+  to `pica_audio_update` and was told the client had dropped the field in
+  transit.
+- **Shared `WRAPPED_ARGS_MISSING` envelope builder**
+  (`wrapped-args-envelope.ts`) — both guards that can reject a
+  `pica_execute` call before dispatch (the plain `required`-list guard, and
+  the `requiredOneOf` one-of-N guard covering `*_inspect` / `pica_search` /
+  bookings / licensing / shows / royalties tools) now build their message
+  and `structuredContent` through one function, naming
+  `unrecognised_fields` and `aliases_applied` in **both** the text block and
+  `structuredContent` instead of asserting "client-side transport loss" for
+  a non-empty args object. Empty args still name transport loss — there's
+  nothing else an empty resolved-args object could be.
+- **`offset` on `pica_audio_query`, `pica_notes_query`, `pica_sessions_query`**
+  (Task 10), each returning a `page` envelope built with
+  `@withpica/mcp-utils`'s `pageEnvelope()`. Audio and sessions fall back to
+  "page was full" (no total available); notes uses the route's real
+  `COUNT` for an exact `has_more`. A new `query-offset-parity` registry
+  guard test pins which remaining `_query` tools still lack `offset` so
+  each can be fixed and measured in isolation.
+
+### Changed
+
+- **Duplicate-release recovery hints point at a fix, not a dead end.**
+  `RELEASE_ALREADY_EXISTS` on `pica_releases_create` /
+  `pica_releases_create_with_tracks` now names `pica_releases_update` /
+  `pica_releases_attach_track` (the message already carries the existing
+  release's id) instead of `pica_releases_query`; `pica_releases_attach_track`'s
+  own `RELEASE_ALREADY_EXISTS` (a different release already holds the UPC)
+  points at `pica_releases_inspect`.
+- **Deprecated alias removal deferred to 2.98.0** — see `metadata.ts`.
+
 ## [2.96.2] - 2026-09-02
 
 The MPP pay rail (spec 2026-08-24 WS-B): a new tool that mints a pay link,

package/README.md

@@ -285,4 +285,4 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ---
 
-Generated for `@withpica/mcp-server@2.96.2`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.
+Generated for `@withpica/mcp-server@2.97.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.