@rolino/cli 0.5.0-beta.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @rolino/cli
 
+## 0.5.0
+
+### Minor Changes
+
+- 4f9e790: Add the optional `blog:manage` capability and synchronized agent-first Blog
+  setup, import, cadence planning, plan review, article creation, confirmed
+  connection provisioning, and safe verification operations.
+- 1edd1e7: Add published Blog Studio delivery contracts and the server-only Next.js 16 Blog Studio package.
+- 74a13ea: Expose immediate versus scheduled delivery and destination lifecycle stages,
+  preserve YouTube visibility for immediate publishing, and clarify remote
+  schedule confirmation across public clients.
+- 4af607d: Add independent exact-bundle Blog approval, reviewed image upload and generation,
+  confirmed publication scheduling and cancellation, and the complete authorized
+  agent workflow without widening existing credentials.
+- 4a893dd: Add provider-neutral Blog publishing destinations, safe delivery inspection,
+  and exact destination binding across public agent interfaces.
+- 843a1db: Add the exact optional `seo:read` capability and bounded read-only SEO
+  opportunity and weekly-report parity across public agent contracts, clients,
+  CLI commands, and closed-world MCP tools. SEO reads now use the version 3 task
+  contract with the exact Ready, Research, or Rejected decision, selected format,
+  complete deliverables, bounded evidence, safe URLs, limitations, and no-publish
+  rules. Public output uses readable topic names and separate topic-relevance and
+  action-readiness confidence. Research tasks compare all supported formats and
+  must validate or reject the finding before a separate draft action is allowed.
+
+### Patch Changes
+
+- Updated dependencies [4f9e790]
+- Updated dependencies [1edd1e7]
+- Updated dependencies [74a13ea]
+- Updated dependencies [4af607d]
+- Updated dependencies [4a893dd]
+- Updated dependencies [843a1db]
+  - @rolino/contracts@0.5.0
+  - @rolino/sdk@0.5.0
+  - @rolino/local-auth@0.5.0
+
 ## 0.5.0-beta.0
 
 ### Minor Changes
@@ -37,6 +74,10 @@
 
 ### Minor Changes
 
+- Add Blog image generation, exact local-file upload, image review, confirmed
+  exact-bundle approval, future scheduling, and schedule cancellation commands
+  with deterministic agent output, stable idempotency, safe errors, and
+  independent `blog:write`, `blog:approve`, and `blog:publish` boundaries.
 - Add Blog destination discovery, delivery inspection, and exact destination selection for publication commands.
 
 ## 0.4.0

package/README.md

@@ -53,12 +53,21 @@ rolino integrations delivery-options --project PROJECT_ID --provider TIKTOK|LINK
 rolino calendar list --project PROJECT_ID [--from ISO_DATE --to ISO_DATE] [--limit 50] [--cursor CURSOR]
 rolino seo opportunities list --project PROJECT_ID [--limit 20] [--cursor CURSOR] [--kind KIND] [--impact HIGH|MEDIUM|LOW]
 rolino seo opportunities show OPPORTUNITY_ID --project PROJECT_ID
-rolino seo reports list --project PROJECT_ID [--limit 10] [--cursor CURSOR] [--status COMPLETE|PARTIAL]
-rolino seo reports show REPORT_ID --project PROJECT_ID
-rolino blog destinations providers --project PROJECT_ID
-rolino blog destinations list --project PROJECT_ID
-rolino blog destinations deliveries --project PROJECT_ID [--article ARTICLE_ID]
-rolino doctor
+rolino seo reports list --project PROJECT_ID [--limit 10] [--cursor CURSOR] [--status COMPLETE|PARTIAL]
+rolino seo reports show REPORT_ID --project PROJECT_ID
+rolino blog destinations providers --project PROJECT_ID
+rolino blog destinations list --project PROJECT_ID
+rolino blog destinations deliveries --project PROJECT_ID [--article ARTICLE_ID]
+rolino blog images generate ARTICLE_ID --project PROJECT_ID --revision REVISION_ID
+rolino blog images upload ARTICLE_ID FILE --project PROJECT_ID --revision REVISION_ID --alt-text TEXT
+rolino blog images review ARTICLE_ID IMAGE_ID --project PROJECT_ID --decision APPROVED|REJECTED --expected-version VERSION [--alt-text TEXT]
+rolino blog approve preview ARTICLE_ID --project PROJECT_ID --revision REVISION_ID
+rolino blog approve execute ARTICLE_ID --project PROJECT_ID --revision REVISION_ID --confirmation-token TOKEN --idempotency-key KEY --yes
+rolino blog schedule preview ARTICLE_ID --project PROJECT_ID --revision REVISION_ID --at ISO --timezone IANA [--destination ID...]
+rolino blog schedule execute ARTICLE_ID --project PROJECT_ID --revision REVISION_ID --at ISO --timezone IANA --confirmation-token TOKEN --idempotency-key KEY --yes
+rolino blog schedule cancel preview ARTICLE_ID --project PROJECT_ID
+rolino blog schedule cancel execute ARTICLE_ID --project PROJECT_ID --confirmation-token TOKEN --idempotency-key KEY --yes
+rolino doctor
 ```
 
 Interactive login opens the configured Rolino instance in a browser, obtains
@@ -262,26 +271,54 @@ gain it automatically. Start every setup with:
 rolino --agent blog setup status --project PROJECT_ID
 ```
 
-The `blog site`, `blog plan`, `blog article`, `blog connection`, and
-`blog destinations` command groups mirror the versioned API. Use these safe
-publishing reads before setup or publication:
-
-```bash
-rolino --agent blog destinations providers --project PROJECT_ID
-rolino --agent blog destinations list --project PROJECT_ID
-rolino --agent blog destinations deliveries --project PROJECT_ID
-rolino --agent blog destinations deliveries --project PROJECT_ID --article ARTICLE_ID
-```
-
-The provider catalog requires `blog:manage`. It returns only providers enabled
-for the workspace, safe capabilities, and official documentation. Destination
-and delivery-attempt reads require `blog:read`. They omit draft content,
-prompts, evidence, secrets, and raw provider responses. A returned remote URL
-is not proof that a queued or failed delivery is live.
-
-Mutations require a stable idempotency key.
-Connection provisioning also requires preview, explicit confirmation, and
-execute. A first successful execute can return a delivery token or webhook
+The `blog site`, `blog plan`, `blog article`, `blog connection`, and
+`blog destinations` command groups mirror the versioned API. Use these safe
+publishing reads before setup or publication:
+
+```bash
+rolino --agent blog destinations providers --project PROJECT_ID
+rolino --agent blog destinations list --project PROJECT_ID
+rolino --agent blog destinations deliveries --project PROJECT_ID
+rolino --agent blog destinations deliveries --project PROJECT_ID --article ARTICLE_ID
+```
+
+The provider catalog requires `blog:manage`. It returns only providers enabled
+for the workspace, safe capabilities, and official documentation. Destination
+and delivery-attempt reads require `blog:read`. They omit draft content,
+prompts, evidence, secrets, and raw provider responses. A returned remote URL
+is not proof that a queued or failed delivery is live.
+
+Mutations require a stable idempotency key.
+Connection provisioning also requires preview, explicit confirmation, and
+execute. A first successful execute can return a delivery token or webhook
 secret once; save it only in server-side environment configuration. Replays
 do not reveal it again. Blog publication remains the separate approved exact
 revision preview/execute workflow.
+
+Blog image commands require `blog:write`; they cannot approve an article or
+publish it. Image upload reads only the path in the command, accepts JPEG, PNG,
+or WebP, and keeps its signed upload URL and storage key private. Approving an
+exact revision and image bundle requires the independent `blog:approve`
+capability and cannot publish. Scheduling, rescheduling, or canceling a future
+publication requires the independent `blog:publish` capability and does not
+grant approval.
+
+Approval, schedule, and cancellation execution bind the short-lived token from
+the matching preview and a stable idempotency key. Human output requires
+`--yes`. JSON mode does not prompt, but it still requires the confirmation
+token and idempotency key. A safe replay uses the same exact input and key.
+
+Use this order for complete Blog work:
+
+1. Read setup status and current article or plan state.
+2. Ask for any missing website, cadence, destination, and access level.
+3. Import and plan through durable jobs, then poll instead of retrying blindly.
+4. Present evidence before accepting a plan item unless the user already authorized that exact bounded action.
+5. Create or update one immutable revision with catalog-backed links.
+6. Generate or upload one approved image, review it, and verify alt text.
+7. Without `blog:approve`, stop and ask the user to approve in Rolino.
+8. With `blog:approve`, preview and execute the unchanged exact bundle with confirmation and a stable idempotency key.
+9. Without `blog:publish`, stop after approval.
+10. With `blog:publish`, preview and execute unchanged immediate publication or scheduling with a stable idempotency key.
+11. Poll delivery attempts and verify the live remote URL; queued is not published.
+12. After any content or image change, restart from approval preview.

package/dist/bin.cjs

@@ -34,7 +34,7 @@ var import_commander = require("commander");
 // package.json
 var package_default = {
   name: "@rolino/cli",
-  version: "0.5.0-beta.0",
+  version: "0.5.0",
   description: "Agent-friendly command-line interface for Rolino",
   type: "module",
   license: "MIT",
@@ -91,9 +91,9 @@ var package_default = {
     dev: "tsx src/bin.ts"
   },
   dependencies: {
-    "@rolino/contracts": "0.5.0-beta.0",
-    "@rolino/local-auth": "0.5.0-beta.0",
-    "@rolino/sdk": "0.5.0-beta.0",
+    "@rolino/contracts": "0.5.0",
+    "@rolino/local-auth": "0.5.0",
+    "@rolino/sdk": "0.5.0",
     commander: "^15.0.0",
     open: "^11.0.0"
   },
@@ -1053,6 +1053,10 @@ async function requireWriteConsent(options) {
     );
   }
 }
+function requireBlogExecutionConsent(options) {
+  if (options.yes || resolveFormat(options.global, options.runtime) !== "human") return;
+  throw new TypeError("This Blog execute command requires explicit consent. Review the confirmed operation and pass --yes.");
+}
 function formatMcpSetupPreview(result) {
   return [
     `Client: ${result.client === "codex" ? "Codex" : "Claude Code"}`,
@@ -2113,6 +2117,103 @@ Article: ${articleId}` });
       writeSuccess(context, data, JSON.stringify(data, null, 2));
     } });
   });
+  const blogImages = blog.command("images").description("Create and review Blog images with blog:write; cannot approve or publish");
+  blogImages.command("generate").description("Queue one exact-revision featured image with blog:write; cannot approve or publish").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--revision <revision-id>", "exact Blog revision ID").option("--editorial-brief <text>", "bounded visual direction; provider controls stay on the server").option("--idempotency-key <key>", "stable retry key; defaults to request ID").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog images generate", global, runtime, async action(context, client) {
+      const data = await client.blog.articles.generateImage(local.project, articleId, { revisionId: local.revision, idempotencyKey: local.idempotencyKey ?? context.requestId, editorialBrief: local.editorialBrief }, { requestId: context.requestId });
+      writeSuccess(context, data, `Blog image generation queued.
+Image: ${data.image.id}
+Job: ${data.job.id}`);
+    } });
+  });
+  blogImages.command("upload").description("Upload one JPEG, PNG, or WebP for an exact Blog revision with blog:write; cannot approve or publish").argument("<article-id>").argument("<file-path>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--revision <revision-id>", "exact Blog revision ID").requiredOption("--alt-text <text>", "reviewable image alt text").action(async (articleId, filePath, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog images upload", global, runtime, async action(context, client) {
+      const absolutePath = (0, import_node_path2.resolve)(runtime.cwd, filePath);
+      const details = await (0, import_promises2.stat)(absolutePath).catch(() => null);
+      if (!details?.isFile()) throw new TypeError("The Blog image path must point to a readable file.");
+      const contentTypes = { ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".webp": "image/webp" };
+      const extension = (0, import_node_path2.extname)(absolutePath).toLowerCase();
+      const contentType = contentTypes[extension];
+      if (!contentType) throw new TypeError("Use a JPEG, PNG, or WebP Blog image.");
+      const body = await (0, import_node_fs2.openAsBlob)(absolutePath, { type: contentType });
+      const data = await client.blog.articles.uploadImage(local.project, articleId, { revisionId: local.revision, fileName: (0, import_node_path2.basename)(absolutePath), contentType, fileSize: details.size, altText: local.altText, body }, { requestId: context.requestId });
+      writeSuccess(context, data, `Blog image uploaded for review.
+Image: ${data.id}
+State: ${data.state}`);
+    } });
+  });
+  blogImages.command("review").description("Review one exact Blog image with blog:write; does not approve the article or publish").argument("<article-id>").argument("<image-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--decision <decision>", "APPROVED or REJECTED").requiredOption("--expected-version <version>", "current image version", positiveInteger).option("--alt-text <text>", "final image alt text; required by the server for approval").option("--idempotency-key <key>", "stable retry key; defaults to request ID").action(async (articleId, imageId, local) => {
+    const decision = local.decision.toUpperCase();
+    if (decision !== "APPROVED" && decision !== "REJECTED") throw new TypeError("--decision must be APPROVED or REJECTED.");
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog images review", global, runtime, async action(context, client) {
+      const data = await client.blog.articles.reviewImage(local.project, articleId, imageId, { decision, expectedVersion: local.expectedVersion, altText: local.altText ?? "", idempotencyKey: local.idempotencyKey ?? context.requestId }, { requestId: context.requestId });
+      writeSuccess(context, data, `Blog image review saved.
+Image: ${data.id}
+State: ${data.state}`);
+    } });
+  });
+  const blogApprove = blog.command("approve").description("Approve one exact Blog bundle with blog:approve; cannot publish");
+  blogApprove.command("preview").description("Preview one exact approval bundle with blog:approve; creates a confirmation but cannot publish").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--revision <revision-id>", "exact Blog revision ID").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog approve preview", global, runtime, async action(context, client) {
+      const data = await client.blog.articles.previewApproval(local.project, articleId, { revisionId: local.revision }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogApprove.command("execute").description("Approve the confirmed exact bundle with blog:approve; separate blog:publish access is still required").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--revision <revision-id>", "same exact revision used for preview").requiredOption("--confirmation-token <token>", "short-lived token returned by preview").requiredOption("--idempotency-key <key>", "stable retry key").option("--yes", "confirm exact bundle approval").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog approve execute", global, runtime, async action(context, client) {
+      requireBlogExecutionConsent({ yes: local.yes, global, runtime });
+      const data = await client.blog.articles.executeApproval(local.project, articleId, { revisionId: local.revision, confirmationToken: local.confirmationToken, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+      writeSuccess(context, data, `Exact Blog bundle approved.
+Revision: ${data.revisionId}
+Publishing still requires blog:publish.`);
+    } });
+  });
+  const blogSchedule = blog.command("schedule").description("Schedule exact approved Blog bundles with blog:publish; does not grant approval");
+  const addScheduleOptions = (command, executeSchedule) => {
+    command.argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--revision <revision-id>", "exact approved Blog revision ID").requiredOption("--at <iso>", "future ISO date-time with UTC offset").requiredOption("--timezone <iana>", "explicit IANA timezone").option("--destination <destination-id...>", "exact destination IDs; defaults to the current primary");
+    if (executeSchedule) command.requiredOption("--confirmation-token <token>", "short-lived token returned by preview").requiredOption("--idempotency-key <key>", "stable retry key").option("--yes", "confirm future external publication");
+    return command;
+  };
+  addScheduleOptions(blogSchedule.command("preview").description("Preview an exact future Blog schedule with blog:publish; does not publish now"), false).action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog schedule preview", global, runtime, async action(context, client) {
+      const data = await client.blog.articles.previewSchedule(local.project, articleId, { revisionId: local.revision, scheduledAt: local.at, timezone: local.timezone, destinationIds: local.destination }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  addScheduleOptions(blogSchedule.command("execute").description("Execute a confirmed future Blog schedule with blog:publish; causes future external publication"), true).action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog schedule execute", global, runtime, async action(context, client) {
+      requireBlogExecutionConsent({ yes: local.yes, global, runtime });
+      const data = await client.blog.articles.executeSchedule(local.project, articleId, { revisionId: local.revision, scheduledAt: local.at, timezone: local.timezone, destinationIds: local.destination, confirmationToken: local.confirmationToken, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+      writeSuccess(context, data, `Blog article scheduled.
+Time: ${data.scheduledAt}
+Timezone: ${data.timezone}`);
+    } });
+  });
+  const blogScheduleCancel = blogSchedule.command("cancel").description("Cancel one future Blog schedule with blog:publish; never unpublishes a live article");
+  blogScheduleCancel.command("preview").description("Preview exact schedule cancellation with blog:publish; does not unpublish").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog schedule cancel preview", global, runtime, async action(context, client) {
+      const data = await client.blog.articles.previewScheduleCancellation(local.project, articleId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogScheduleCancel.command("execute").description("Cancel the confirmed future schedule with blog:publish; never unpublishes a live article").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--confirmation-token <token>", "short-lived token returned by preview").requiredOption("--idempotency-key <key>", "stable retry key").option("--yes", "confirm schedule cancellation").action(async (articleId, local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog schedule cancel execute", global, runtime, async action(context, client) {
+      requireBlogExecutionConsent({ yes: local.yes, global, runtime });
+      const data = await client.blog.articles.executeScheduleCancellation(local.project, articleId, { confirmationToken: local.confirmationToken, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+      writeSuccess(context, data, `Future Blog schedule canceled.
+Article: ${data.articleId}
+A live article was not unpublished.`);
+    } });
+  });
   blog.command("job").argument("<job-id>").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (jobId, local) => {
     const global = program.opts();
     commandExitCode = await execute({ command: "blog job", global, runtime, async action(context, client) {