@rolino/cli 0.4.0 → 0.5.0-beta.0

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @rolino/cli
 
+## 0.5.0-beta.0
+
+### Minor Changes
+
+- 4f9e790: Add the optional `blog:manage` capability and synchronized agent-first Blog
+  setup, import, cadence planning, plan review, article creation, confirmed
+  connection provisioning, and safe verification operations.
+- 1edd1e7: Add published Blog Studio delivery contracts and the server-only Next.js 16 Blog Studio package.
+- 74a13ea: Expose immediate versus scheduled delivery and destination lifecycle stages,
+  preserve YouTube visibility for immediate publishing, and clarify remote
+  schedule confirmation across public clients.
+- 4a893dd: Add provider-neutral Blog publishing destinations, safe delivery inspection,
+  and exact destination binding across public agent interfaces.
+- 843a1db: Add the exact optional `seo:read` capability and bounded read-only SEO
+  opportunity and weekly-report parity across public agent contracts, clients,
+  CLI commands, and closed-world MCP tools. SEO reads now use the version 3 task
+  contract with the exact Ready, Research, or Rejected decision, selected format,
+  complete deliverables, bounded evidence, safe URLs, limitations, and no-publish
+  rules. Public output uses readable topic names and separate topic-relevance and
+  action-readiness confidence. Research tasks compare all supported formats and
+  must validate or reject the finding before a separate draft action is allowed.
+
+### Patch Changes
+
+- Updated dependencies [4f9e790]
+- Updated dependencies [1edd1e7]
+- Updated dependencies [74a13ea]
+- Updated dependencies [4a893dd]
+- Updated dependencies [843a1db]
+  - @rolino/contracts@0.5.0-beta.0
+  - @rolino/sdk@0.5.0-beta.0
+  - @rolino/local-auth@0.5.0-beta.0
+
+## Unreleased
+
+### Minor Changes
+
+- Add Blog destination discovery, delivery inspection, and exact destination selection for publication commands.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -51,16 +51,34 @@ rolino posts publish execute POST_ID --project PROJECT_ID --expected-version VER
 rolino integrations health --project PROJECT_ID
 rolino integrations delivery-options --project PROJECT_ID --provider TIKTOK|LINKEDIN
 rolino calendar list --project PROJECT_ID [--from ISO_DATE --to ISO_DATE] [--limit 50] [--cursor CURSOR]
-rolino doctor
+rolino seo opportunities list --project PROJECT_ID [--limit 20] [--cursor CURSOR] [--kind KIND] [--impact HIGH|MEDIUM|LOW]
+rolino seo opportunities show OPPORTUNITY_ID --project PROJECT_ID
+rolino seo reports list --project PROJECT_ID [--limit 10] [--cursor CURSOR] [--status COMPLETE|PARTIAL]
+rolino seo reports show REPORT_ID --project PROJECT_ID
+rolino blog destinations providers --project PROJECT_ID
+rolino blog destinations list --project PROJECT_ID
+rolino blog destinations deliveries --project PROJECT_ID [--article ARTICLE_ID]
+rolino doctor
 ```
 
 Interactive login opens the configured Rolino instance in a browser, obtains
 explicit workspace approval, and exchanges a single-use code with PKCE S256.
 The approval screen always includes identity and workspace reads and lets the
 user independently opt into project creation, draft writing, confirmed
-scheduling, and confirmed immediate publishing. Optional permissions start off,
+scheduling, confirmed immediate publishing, and read-only SEO Intelligence.
+The SEO option explains that it permits reading opportunities, evidence,
+complete tasks, and weekly reports. It cannot run analysis or change SEO settings.
+Opportunity detail prints the exact decision, selected format, target,
+deliverables, research, safe URLs, separate topic-relevance and action-readiness
+confidence, limitations, and no-publish rules. A Ready
+task can request complete final deliverables for review. A Research task must
+select only `RESEARCH_TASK`, compare all reasonable formats without a preferred
+final format, and return `VALIDATED` with a complete next task or `REJECTED`
+with evidence. It cannot create a final draft in the same action.
+Optional permissions start off,
 and existing credentials never gain a newly selected permission. Revoke and
-reauthorize an existing connection to grant project creation. The bearer
+reauthorize an existing connection to grant project creation or `seo:read`.
+Existing credentials never receive `seo:read` automatically. The bearer
 credential never passes through a browser URL. Saved credentials are scoped by
 base URL and stored in the operating-system configuration directory;
 `ROLINO_CONFIG_DIR` overrides that location. `auth logout` revokes the calling
@@ -107,9 +125,11 @@ rolino posts create --project PROJECT_ID --caption "Launch description" --platfo
 ```
 
 Google may restrict uploads from unaudited API projects to Private. Rolino does
-not infer audit approval from configuration. A scheduled YouTube post must
-target Public; confirmed scheduling starts its private resumable upload
-immediately so processing can finish before the target time.
+not infer audit approval from configuration. `posts publish` preserves the
+chosen Public, Unlisted, or Private visibility and does not create a schedule.
+A future `posts schedule` delivery must target Public; confirmed scheduling
+starts its private resumable upload immediately so processing can finish before
+the target time.
 
 TikTok drafts require account-specific choices. Refresh them immediately before
 preparing the draft:
@@ -134,23 +154,23 @@ images. Use `--bluesky-caption` for a destination-specific override of up to
 rolino posts create --project PROJECT_ID --caption "Shared launch" --platform BLUESKY --bluesky-caption "Launch day 🦋" --yes
 ```
 
-LinkedIn drafts can be text-only, include up to ten stored JPEG/PNG images, or
-contain exactly one stored MP4 without mixing images and video. Native video
-must be 75 KB to 500 MB and 3 seconds to 30 minutes. Refresh the connected
-member and server policy before preparing the draft, and use
-`--linkedin-caption` for a destination override:
+LinkedIn drafts can be text-only, include up to ten stored JPEG/PNG images, or
+contain exactly one stored MP4 without mixing images and video. Native video
+must be 75 KB to 500 MB and 3 seconds to 30 minutes. Refresh the connected
+member and server policy before preparing the draft, and use
+`--linkedin-caption` for a destination override:
 
 ```text
-rolino integrations delivery-options --project PROJECT_ID --provider LINKEDIN
-rolino posts create --project PROJECT_ID --caption "Shared launch" --platform LINKEDIN --linkedin-caption "Launch day for our LinkedIn network" --media IMAGE_ASSET_ID --yes
-rolino posts create --project PROJECT_ID --caption "Product demo" --platform LINKEDIN --media VIDEO_ASSET_ID --yes
+rolino integrations delivery-options --project PROJECT_ID --provider LINKEDIN
+rolino posts create --project PROJECT_ID --caption "Shared launch" --platform LINKEDIN --linkedin-caption "Launch day for our LinkedIn network" --media IMAGE_ASSET_ID --yes
+rolino posts create --project PROJECT_ID --caption "Product demo" --platform LINKEDIN --media VIDEO_ASSET_ID --yes
 ```
 
-The connected OAuth member is the author; the developer app's associated
-Company Page is not a publishing target. Native video publish and schedule
-execution remains in preparation until LinkedIn confirms upload and processing.
-If final post creation has an unknown outcome, inspect that member's LinkedIn
-feed before retrying.
+The connected OAuth member is the author; the developer app's associated
+Company Page is not a publishing target. Native video publish and schedule
+execution remains in preparation until LinkedIn confirms upload and processing.
+If final post creation has an unknown outcome, inspect that member's LinkedIn
+feed before retrying.
 
 Project creation also requires interactive confirmation or `--yes`. It
 atomically saves a project and its paired brand, but does not start research,
@@ -170,8 +190,10 @@ server confirmation.
 
 When YouTube is selected, the preview states whether confirmed execution starts
 or resumes early private preparation. A schedule execution may return
-`PENDING` while YouTube confirms a remote schedule change; that result is not a
-published state, and the same idempotency key is safe to replay.
+`PENDING` with phase `REMOTE_SCHEDULE_CONFIRMATION` after the upload completes
+while YouTube acknowledges the requested Public publish time. The video remains
+private, no second publish action is required, and the same idempotency key is
+safe to replay.
 
 Immediate publishing uses the same server-enforced pattern. `posts publish
 preview` validates the current version, exact destination set, readiness, live
@@ -182,8 +204,9 @@ delivery; Rolino's worker performs provider calls and reconciles ambiguous
 network results so an unsafe retry cannot duplicate a post. Use
 `ROLINO_CONFIRMATION_TOKEN` for scripts instead of putting the token in process
 arguments. YouTube remains `PREPARING` while its resumable upload and provider
-processing are incomplete; only provider-confirmed visibility becomes
-published.
+processing are incomplete. The preview identifies the delivery as `IMMEDIATE`,
+shows the exact visibility, and confirms that no schedule will be created; only
+provider-confirmed visibility becomes published.
 
 The CLI cannot enable YouTube, Bluesky, or LinkedIn, or infer provider approval.
 Those are server-side deployment controls. Self-hosted operators should
@@ -229,3 +252,36 @@ issues through the repository's
 [security policy](https://github.com/deifos/rolino/security/policy).
 
 `@rolino/cli` is available under the MIT License.
+## Agent-first Blog Studio setup
+
+Authorize the optional `blog:manage` capability separately from Blog reading,
+draft writing, and approved-revision publishing. Existing credentials never
+gain it automatically. Start every setup with:
+
+```bash
+rolino --agent blog setup status --project PROJECT_ID
+```
+
+The `blog site`, `blog plan`, `blog article`, `blog connection`, and
+`blog destinations` command groups mirror the versioned API. Use these safe
+publishing reads before setup or publication:
+
+```bash
+rolino --agent blog destinations providers --project PROJECT_ID
+rolino --agent blog destinations list --project PROJECT_ID
+rolino --agent blog destinations deliveries --project PROJECT_ID
+rolino --agent blog destinations deliveries --project PROJECT_ID --article ARTICLE_ID
+```
+
+The provider catalog requires `blog:manage`. It returns only providers enabled
+for the workspace, safe capabilities, and official documentation. Destination
+and delivery-attempt reads require `blog:read`. They omit draft content,
+prompts, evidence, secrets, and raw provider responses. A returned remote URL
+is not proof that a queued or failed delivery is live.
+
+Mutations require a stable idempotency key.
+Connection provisioning also requires preview, explicit confirmation, and
+execute. A first successful execute can return a delivery token or webhook
+secret once; save it only in server-side environment configuration. Replays
+do not reveal it again. Blog publication remains the separate approved exact
+revision preview/execute workflow.

package/dist/bin.cjs

@@ -34,7 +34,7 @@ var import_commander = require("commander");
 // package.json
 var package_default = {
   name: "@rolino/cli",
-  version: "0.4.0",
+  version: "0.5.0-beta.0",
   description: "Agent-friendly command-line interface for Rolino",
   type: "module",
   license: "MIT",
@@ -91,9 +91,9 @@ var package_default = {
     dev: "tsx src/bin.ts"
   },
   dependencies: {
-    "@rolino/contracts": "0.4.0",
-    "@rolino/local-auth": "0.4.0",
-    "@rolino/sdk": "0.4.0",
+    "@rolino/contracts": "0.5.0-beta.0",
+    "@rolino/local-auth": "0.5.0-beta.0",
+    "@rolino/sdk": "0.5.0-beta.0",
     commander: "^15.0.0",
     open: "^11.0.0"
   },
@@ -464,7 +464,6 @@ function formatPosts(data) {
   return ["ID	STATUS	SCHEDULED	CAPTION", ...rows].join("\n");
 }
 function formatPost(post) {
-  const queued = post.status === "PUBLISHING";
   return [
     `Post ${post.id}`,
     `Project: ${post.projectId}`,
@@ -473,11 +472,11 @@ function formatPost(post) {
     `Caption: ${post.caption || "-"}`,
     ...post.campaign ? [`Campaign: ${post.campaign.title} (${post.campaign.id})`] : [],
     ...post.scheduledAt ? [
-      `${queued ? "Queued for publishing" : "Scheduled"}: ${post.scheduledAt}${post.timezone ? ` (${post.timezone})` : ""}`
+      `Scheduled: ${post.scheduledAt}${post.timezone ? ` (${post.timezone})` : ""}`
     ] : [],
     ...post.publishedAt ? [`Published: ${post.publishedAt}`] : [],
     `Media: ${post.media.length}`,
-    `Destinations: ${post.destinations.map((destination) => `${destination.provider}:${queued && destination.status === "SCHEDULED" ? "QUEUED" : destination.status}`).join(", ") || "none"}`,
+    `Destinations: ${post.destinations.map((destination) => `${destination.provider}:${destination.deliveryMode}:${destination.stage}`).join(", ") || "none"}`,
     ...post.providerSettings?.TIKTOK ? [
       `TikTok: ${post.providerSettings.TIKTOK.postMode}, ${post.providerSettings.TIKTOK.privacyLevel ?? "visibility not set"}, settings ${post.providerSettings.TIKTOK.consentedAt ? "reviewed" : "not reviewed"}`
     ] : [],
@@ -488,7 +487,8 @@ function formatPost(post) {
 }
 function formatPostSchedulePending(pending) {
   return [
-    `YouTube schedule change pending for post ${pending.postId}.`,
+    `YouTube publish-time confirmation pending for post ${pending.postId}.`,
+    "Video upload: complete (the video remains private).",
     pending.message,
     `Mutation: ${pending.mutationId}`
   ].join("\n");
@@ -534,8 +534,14 @@ function formatPostSchedulePreview(preview) {
   return [
     `Schedule preview for post ${preview.post.id}`,
     `Current version: ${preview.post.version}`,
+    `Delivery mode: ${preview.deliveryMode}`,
     `Publish at: ${preview.schedule.scheduledAt} (${preview.schedule.timezone})`,
     `Destinations: ${preview.destinations.join(", ")}`,
+    ...preview.youtube ? [
+      "YouTube preparation: starts immediately as PRIVATE.",
+      `YouTube scheduled visibility: ${preview.youtube.publishVisibility}.`,
+      `YouTube confirmation: ${preview.youtube.confirmationMeaning}`
+    ] : [],
     ...preview.providerReconciliation ? [`Provider reconciliation: ${preview.providerReconciliation.message}`] : [],
     `Confirmation expires: ${preview.confirmation.expiresAt}`,
     `Confirmation token: ${preview.confirmation.token}`,
@@ -547,9 +553,10 @@ function formatPostPublishPreview(preview) {
   return [
     `Immediate publish preview for post ${preview.post.id}`,
     `Current version: ${preview.post.version}`,
+    `Delivery mode: ${preview.deliveryMode}`,
     `Destinations: ${preview.destinations.join(", ")}`,
     "Effect: confirmed execution queues these destinations for immediate publishing.",
-    ...preview.destinations.includes("YOUTUBE") ? ["YouTube effect: execution starts a resumable upload; PREPARING remains visible until upload, processing, and configured visibility are provider-confirmed."] : [],
+    ...preview.youtube ? [`YouTube effect: execution starts a resumable upload using ${preview.youtube.visibility}; it does not create a schedule. PREPARING remains visible until upload, processing, and visibility are provider-confirmed.`] : [],
     `Confirmation expires: ${preview.confirmation.expiresAt}`,
     `Confirmation token: ${preview.confirmation.token}`,
     ...attention.length ? ["Readiness notes:", ...attention.map((check) => `${check.status.toUpperCase()}	${check.provider ?? "POST"}	${check.code}	${check.message}`)] : ["All required readiness checks passed."]
@@ -562,6 +569,65 @@ function formatCalendarEvents(data) {
   const rows = data.items.map((event) => `${event.postId}	${event.scheduledAt}	${event.status}	${event.destinations.map((item) => item.provider).join(",") || "-"}	${event.title}`);
   return ["POST ID	SCHEDULED	STATUS	DESTINATIONS	TITLE", ...rows].join("\n");
 }
+function formatSeoOpportunities(data) {
+  if (!data.items.length) return "No active SEO tasks found.";
+  return [
+    "ID	DECISION	FORMAT	SCORE	TOPIC RELEVANCE	ACTION READINESS	TITLE",
+    ...data.items.map((item) => `${item.id}	${item.task.decision}	${item.task.primaryFormat}	${item.score}	${item.confidence.topicRelevance.label}	${item.confidence.actionReadiness.label}	${item.title}`)
+  ].join("\n");
+}
+function formatSeoOpportunity(opportunity) {
+  return [
+    `${opportunity.title} (${opportunity.id})`,
+    `Project: ${opportunity.projectId}`,
+    `Decision: ${opportunity.task.decision}`,
+    `Primary format: ${opportunity.task.primaryFormat}`,
+    `Objective: ${opportunity.task.objective}`,
+    `Next step: ${opportunity.task.nextStep}`,
+    `Priority: ${opportunity.score}/100`,
+    `Topic relevance: ${opportunity.confidence.topicRelevance.label}${opportunity.confidence.topicRelevance.score === null ? "" : ` (${opportunity.confidence.topicRelevance.score}/100)`}`,
+    `Topic relevance explanation: ${opportunity.confidence.topicRelevance.explanation}`,
+    `Action readiness: ${opportunity.confidence.actionReadiness.label}${opportunity.confidence.actionReadiness.score === null ? "" : ` (${opportunity.confidence.actionReadiness.score}/100)`}`,
+    `Action readiness explanation: ${opportunity.confidence.actionReadiness.explanation}`,
+    "",
+    opportunity.brief
+  ].join("\n");
+}
+function formatSeoReports(data) {
+  if (!data.items.length) return "No weekly SEO reports found.";
+  return [
+    "ID	PERIOD START	PERIOD END	STATUS	READY	RESEARCH	REJECTED	LEGACY",
+    ...data.items.map((item) => `${item.id}	${item.periodStart}	${item.periodEnd}	${item.completeness}	${item.readyTaskCount}	${item.researchTaskCount}	${item.rejectedFindingCount}	${item.legacy}`)
+  ].join("\n");
+}
+function formatSeoReport(report) {
+  return [
+    `Weekly SEO report ${report.id}`,
+    `Project: ${report.projectId}`,
+    `Period: ${report.periodStart} to ${report.periodEnd}`,
+    `Schedule: day ${report.deliveryDay} in ${report.timeZone}`,
+    `Status: ${report.completeness}`,
+    ...report.partialLabel ? [`Note: ${report.partialLabel}`] : [],
+    `Ready tasks: ${report.readyTaskCount}`,
+    `Research tasks: ${report.researchTaskCount}`,
+    `Rejected or filtered findings: ${report.rejectedFindingCount}`,
+    `Legacy report: ${report.legacy}`,
+    "",
+    ...report.opportunities.flatMap((item, index) => [
+      `${index + 1}. ${item.title}`,
+      `   Decision: ${item.task.decision}`,
+      `   Format: ${item.task.primaryFormat}`,
+      `   Objective: ${item.task.objective}`,
+      `   Next step: ${item.task.nextStep}`,
+      `   Topic relevance: ${item.confidence.topicRelevance.label}${item.confidence.topicRelevance.score === null ? "" : ` (${item.confidence.topicRelevance.score}/100)`}`,
+      `   Action readiness: ${item.confidence.actionReadiness.label}${item.confidence.actionReadiness.score === null ? "" : ` (${item.confidence.actionReadiness.score}/100)`}`
+    ]),
+    ...report.rejectedFindings.flatMap((item, index) => [
+      `Rejected ${index + 1}: ${item.query}`,
+      `   Reason: ${item.reason}`
+    ])
+  ].join("\n");
+}
 
 // src/mcp-setup.ts
 var import_node_child_process = require("child_process");
@@ -845,6 +911,21 @@ function postStatus(value) {
     `Status must be one of ${import_contracts2.PostStatusSchema.options.join(", ")}.`
   );
 }
+function seoOpportunityKind(value) {
+  const parsed = import_contracts2.SeoOpportunityKindSchema.safeParse(value.toUpperCase());
+  if (parsed.success) return parsed.data;
+  throw new import_commander.InvalidArgumentError(`SEO kind must be one of ${import_contracts2.SeoOpportunityKindSchema.options.join(", ")}.`);
+}
+function seoExpectedImpact(value) {
+  const parsed = import_contracts2.SeoExpectedImpactSchema.safeParse(value.toUpperCase());
+  if (parsed.success) return parsed.data;
+  throw new import_commander.InvalidArgumentError("SEO impact must be HIGH, MEDIUM, or LOW.");
+}
+function seoReportCompleteness(value) {
+  const parsed = import_contracts2.SeoReportCompletenessSchema.safeParse(value.toUpperCase());
+  if (parsed.success) return parsed.data;
+  throw new import_commander.InvalidArgumentError("Report status must be COMPLETE or PARTIAL.");
+}
 function projectType(value) {
   const parsed = import_contracts2.ProjectTypeSchema.safeParse(value.toUpperCase());
   if (parsed.success) return parsed.data;
@@ -1862,6 +1943,274 @@ async function runCli(argv = process.argv, overrides = {}) {
       }
     });
   });
+  const blog = program.command("blog").description("Read and manage Blog Studio");
+  const blogPublishing = blog.command("destinations").description("Inspect Blog publishing providers, destinations, and delivery attempts");
+  blogPublishing.command("providers").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog destinations providers", global, runtime, async action(context, client) {
+      const data = await client.blog.publishing.providers(local.project, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogPublishing.command("list").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog destinations list", global, runtime, async action(context, client) {
+      const data = await client.blog.publishing.destinations(local.project, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogPublishing.command("deliveries").requiredOption("--project <project-id>", "exact Rolino project ID").option("--article <article-id>", "filter by exact Blog article ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog destinations deliveries", global, runtime, async action(context, client) {
+      const data = await client.blog.publishing.deliveries(local.project, local.article, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const blogSetup = blog.command("setup").description("Inspect agent-first Blog setup readiness");
+  blogSetup.command("status").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog setup status", global, runtime, async action(context, client) {
+      const data = await client.blog.setup.status(local.project, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const blogSite = blog.command("site").description("Initialize or retry the Blog website import");
+  blogSite.command("import").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--idempotency-key <key>", "stable retry key").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog site import", global, runtime, async action(context, client) {
+      const data = await client.blog.site.import(local.project, local.idempotencyKey, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2), [`rolino blog job ${data.id} --project ${local.project} --agent`]);
+    } });
+  });
+  blogSite.command("retry").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--idempotency-key <key>", "stable retry key").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog site retry", global, runtime, async action(context, client) {
+      const data = await client.blog.site.retry(local.project, local.idempotencyKey, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2), [`rolino blog job ${data.id} --project ${local.project} --agent`]);
+    } });
+  });
+  blog.command("plans").description("List Blog Studio plans").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog plans", global, runtime, async action(context, client) {
+      const data = await client.blog.plans.list(local.project, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const blogPlan = blog.command("plan").description("Create, retry, and review a Blog cadence plan");
+  blogPlan.command("create").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--start <date>", "local start date as YYYY-MM-DD").requiredOption("--weekdays <days>", "comma-separated weekday names such as mon,wed,fri").option("--time-zone <zone>", "IANA time zone", "UTC").requiredOption("--idempotency-key <key>", "stable retry key").action(async (local) => {
+    const weekdayMap = { sun: 0, mon: 1, tue: 2, wed: 3, thu: 4, fri: 5, sat: 6 };
+    const weekdays = local.weekdays.split(",").map((day) => weekdayMap[day.trim().toLowerCase()]).filter((day) => day !== void 0);
+    if (!weekdays.length || weekdays.length !== local.weekdays.split(",").length) throw new TypeError("--weekdays must contain comma-separated sun,mon,tue,wed,thu,fri,sat values.");
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog plan create", global, runtime, async action(context, client) {
+      const data = await client.blog.plans.create(local.project, { startsOn: local.start, weekdays, timeZone: local.timeZone }, local.idempotencyKey, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2), [`rolino blog job ${data.job.id} --project ${local.project} --agent`]);
+    } });
+  });
+  blogPlan.command("retry").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--plan <plan-id>", "exact Blog plan ID").requiredOption("--idempotency-key <key>", "stable retry key").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog plan retry", global, runtime, async action(context, client) {
+      const data = await client.blog.plans.retry(local.project, local.plan, local.idempotencyKey, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogPlan.command("items").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--plan <plan-id>", "exact Blog plan ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog plan items", global, runtime, async action(context, client) {
+      const data = await client.blog.plans.items.list(local.project, local.plan, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const blogPlanItem = blogPlan.command("item").description("Accept or dismiss a reviewed Blog plan item");
+  for (const state of ["accept", "dismiss"]) {
+    blogPlanItem.command(state).requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--plan <plan-id>", "exact Blog plan ID").requiredOption("--item <item-id>", "exact plan item ID").requiredOption("--expected-state <state>", "state returned by the latest item read").requiredOption("--expected-version <version>", "version returned by the latest item read", Number).requiredOption("--idempotency-key <key>", "stable retry key").action(async (local) => {
+      const global = program.opts();
+      commandExitCode = await execute({ command: `blog plan item ${state}`, global, runtime, async action(context, client) {
+        const data = await client.blog.plans.items.setState(local.project, local.plan, local.item, { state: state === "accept" ? "ACCEPTED" : "DISMISSED", expectedState: local.expectedState, expectedVersion: local.expectedVersion, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+        writeSuccess(context, data, JSON.stringify(data, null, 2));
+      } });
+    });
+  }
+  const blogArticle = blog.command("article").description("Create an editable Blog article from an accepted item");
+  blogArticle.command("create").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--plan <plan-id>", "exact Blog plan ID").requiredOption("--item <item-id>", "exact accepted item ID").requiredOption("--expected-version <version>", "version returned by the latest item read", Number).requiredOption("--idempotency-key <key>", "stable retry key").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog article create", global, runtime, async action(context, client) {
+      const data = await client.blog.plans.items.createArticle(local.project, local.plan, local.item, { expectedState: "ACCEPTED", expectedVersion: local.expectedVersion, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const blogConnection = blog.command("connection").description("Configure and verify the server-only Next.js Blog connection");
+  blogConnection.command("status").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog connection status", global, runtime, async action(context, client) {
+      const data = await client.blog.connection.status(local.project, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const addConnectionOptions = (command, execute2) => {
+    command.requiredOption("--project <project-id>", "exact Rolino project ID").option("--endpoint <url>", "same-host signed revalidation endpoint").option("--credential-action <action>", "KEEP, CREATE, ROTATE, or REVOKE", "KEEP").option("--credential-id <id>", "credential to rotate or revoke").option("--secret-action <action>", "KEEP, CREATE, or ROTATE", "KEEP");
+    if (execute2) command.requiredOption("--confirmation-token <token>", "short-lived token returned by preview").requiredOption("--idempotency-key <key>", "stable retry key").option("--yes", "confirm the exact connection change");
+    return command;
+  };
+  addConnectionOptions(blogConnection.command("preview"), false).action(async (local) => {
+    const input = { endpoint: local.endpoint ?? null, credentialAction: local.credentialAction.toUpperCase(), credentialId: local.credentialId ?? null, secretAction: local.secretAction.toUpperCase() };
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog connection preview", global, runtime, async action(context, client) {
+      const data = await client.blog.connection.preview(local.project, input, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  addConnectionOptions(blogConnection.command("execute"), true).action(async (local) => {
+    const input = { endpoint: local.endpoint ?? null, credentialAction: local.credentialAction.toUpperCase(), credentialId: local.credentialId ?? null, secretAction: local.secretAction.toUpperCase() };
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog connection execute", global, runtime, async action(context, client) {
+      await requireWriteConsent({ yes: local.yes, global, runtime, preview: `Apply the previewed Blog connection change for project ${local.project}? One-time secrets may be returned and must stay server-only.` });
+      const data = await client.blog.connection.execute(local.project, { ...input, confirmationToken: local.confirmationToken, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogConnection.command("test").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--idempotency-key <key>", "stable retry key").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog connection test", global, runtime, async action(context, client) {
+      const data = await client.blog.connection.test(local.project, local.idempotencyKey, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const blogArticles = blog.command("articles").description("Read and edit Blog Studio articles");
+  blogArticles.command("list").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog articles list", global, runtime, async action(context, client) {
+      const data = await client.blog.articles.list(local.project, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogArticles.command("show").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog articles show", global, runtime, async action(context, client) {
+      const data = await client.blog.articles.get(local.project, articleId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogArticles.command("update").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--input <json-file>", "complete Blog draft JSON file").option("--yes", "confirm the draft save").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog articles update", global, runtime, async action(context, client) {
+      const draft = import_contracts2.AgentBlogDraftUpdateSchema.parse(JSON.parse(await (0, import_promises2.readFile)((0, import_node_path2.resolve)(runtime.cwd, local.input), "utf8")));
+      await requireWriteConsent({ yes: local.yes, global, runtime, preview: `Save a new immutable Blog draft revision?
+Project: ${local.project}
+Article: ${articleId}
+This will not publish.` });
+      const data = await client.blog.articles.updateDraft(local.project, articleId, draft, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogArticles.command("generate").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").option("--idempotency-key <key>", "stable retry key; defaults to request ID").option("--yes", "confirm the generation request").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog articles generate", global, runtime, async action(context, client) {
+      await requireWriteConsent({ yes: local.yes, global, runtime, preview: `Queue durable Blog article generation?
+Project: ${local.project}
+Article: ${articleId}` });
+      const data = await client.blog.articles.generate(local.project, articleId, local.idempotencyKey ?? context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blog.command("job").argument("<job-id>").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (jobId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog job", global, runtime, async action(context, client) {
+      const data = await client.blog.jobs.get(local.project, jobId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const blogPublish = blog.command("publish").description("Preview or execute exact approved Blog publication");
+  blogPublish.command("preview").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--revision <revision-id>", "exact user-approved revision ID").option("--destination <destination-id...>", "exact destination IDs; defaults to the current primary").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog publish preview", global, runtime, async action(context, client) {
+      const data = await client.blog.articles.previewPublish(local.project, articleId, local.revision, { requestId: context.requestId }, local.destination);
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogPublish.command("execute").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--revision <revision-id>", "same exact revision used for preview").requiredOption("--confirmation-token <token>", "short-lived token returned by preview").option("--destination <destination-id...>", "same exact destination IDs used for preview").option("--idempotency-key <key>", "stable retry key; defaults to request ID").option("--yes", "confirm publication").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog publish execute", global, runtime, async action(context, client) {
+      await requireWriteConsent({ yes: local.yes, global, runtime, preview: `Publish the exact approved Blog revision?
+Project: ${local.project}
+Article: ${articleId}
+Revision: ${local.revision}` });
+      const data = await client.blog.articles.executePublish(local.project, articleId, { revisionId: local.revision, destinationIds: local.destination, confirmationToken: local.confirmationToken, idempotencyKey: local.idempotencyKey ?? context.requestId }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const seo = program.command("seo").description("Read authorized SEO opportunities and weekly reports");
+  const seoOpportunities = seo.command("opportunities").description("Read accepted SEO opportunities");
+  seoOpportunities.command("list").description("List bounded SEO opportunities").requiredOption("--project <project-id>", "exact Rolino project ID").option("--limit <number>", "maximum opportunities to return", (value) => {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 50) {
+      throw new import_commander.InvalidArgumentError("Limit must be an integer from 1 to 50.");
+    }
+    return parsed;
+  }).option("--cursor <cursor>", "continue from an SEO opportunity cursor").option("--kind <kind>", "filter by exact SEO opportunity kind", seoOpportunityKind).option("--impact <impact>", "filter by HIGH, MEDIUM, or LOW impact", seoExpectedImpact).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({
+      command: "seo opportunities list",
+      global,
+      runtime,
+      async action(context, client) {
+        const data = await client.seo.opportunities.list(local.project, {
+          limit: local.limit,
+          cursor: local.cursor,
+          kind: local.kind,
+          expectedImpact: local.impact
+        }, { requestId: context.requestId });
+        writeSuccess(context, data, formatSeoOpportunities(data), data.items.slice(0, 3).map((item) => `rolino seo opportunities show ${item.id} --project ${local.project} --agent`));
+      }
+    });
+  });
+  seoOpportunities.command("show").description("Show one canonical SEO opportunity task").argument("<opportunity-id>").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (opportunityId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({
+      command: "seo opportunities show",
+      global,
+      runtime,
+      async action(context, client) {
+        const opportunity = await client.seo.opportunities.get(local.project, opportunityId, { requestId: context.requestId });
+        writeSuccess(context, opportunity, formatSeoOpportunity(opportunity));
+      }
+    });
+  });
+  const seoReports = seo.command("reports").description("Read immutable weekly SEO report snapshots");
+  seoReports.command("list").description("List bounded weekly SEO reports").requiredOption("--project <project-id>", "exact Rolino project ID").option("--limit <number>", "maximum reports to return", (value) => {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 26) {
+      throw new import_commander.InvalidArgumentError("Limit must be an integer from 1 to 26.");
+    }
+    return parsed;
+  }).option("--cursor <cursor>", "continue from an SEO report cursor").option("--status <status>", "filter by COMPLETE or PARTIAL", seoReportCompleteness).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({
+      command: "seo reports list",
+      global,
+      runtime,
+      async action(context, client) {
+        const data = await client.seo.reports.list(local.project, {
+          limit: local.limit,
+          cursor: local.cursor,
+          completeness: local.status
+        }, { requestId: context.requestId });
+        writeSuccess(context, data, formatSeoReports(data), data.items.slice(0, 3).map((item) => `rolino seo reports show ${item.id} --project ${local.project} --agent`));
+      }
+    });
+  });
+  seoReports.command("show").description("Show one weekly SEO report snapshot").argument("<report-id>").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (reportId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({
+      command: "seo reports show",
+      global,
+      runtime,
+      async action(context, client) {
+        const report = await client.seo.reports.get(local.project, reportId, { requestId: context.requestId });
+        writeSuccess(context, report, formatSeoReport(report));
+      }
+    });
+  });
   program.command("doctor").description("Check configuration, compatibility, and authentication").action(async () => {
     const global = program.opts();
     commandExitCode = await execute({