@rolino/cli 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/CHANGELOG.md +19 -0
  2. package/README.md +44 -12
  3. package/dist/bin.cjs +244 -237
  4. package/dist/bin.cjs.map +1 -1
  5. package/dist/bin.js +1 -1
  6. package/dist/{chunk-MBZL2CK6.js → chunk-3WBZCTM5.js} +230 -222
  7. package/dist/chunk-3WBZCTM5.js.map +1 -0
  8. package/dist/index.cjs +244 -237
  9. package/dist/index.cjs.map +1 -1
  10. package/dist/index.js +1 -1
  11. package/package.json +5 -5
  12. package/dist/chunk-MBZL2CK6.js.map +0 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,24 @@
1
1
  # @rolino/cli
2
2
 
3
+ ## 0.6.0
4
+
5
+ ### Minor Changes
6
+
7
+ - d162f85: Add safe Blog editorial cadence preview and apply operations across contracts, SDK, CLI, and MCP.
8
+ - 50cb9fc: Add Google Business Profile as a disabled-by-default standard text and single-image publishing destination across shared public clients.
9
+ - 1ac7ed5: Add signed custom Blog webhook setup, connection testing, one-time secret rotation, and safe idempotent replay parity.
10
+ - a56f834: Replace custom interactive CLI authorization with exact-resource OAuth, add the stateless MCP 2026-07-28 transport foundation, and provide safe connection instructions for workspace discovery and confirmed actions.
11
+
12
+ ### Patch Changes
13
+
14
+ - Updated dependencies [d162f85]
15
+ - Updated dependencies [50cb9fc]
16
+ - Updated dependencies [1ac7ed5]
17
+ - Updated dependencies [a56f834]
18
+ - @rolino/contracts@0.6.0
19
+ - @rolino/sdk@0.6.0
20
+ - @rolino/local-auth@0.6.0
21
+
3
22
  ## 0.5.0
4
23
 
5
24
  ### Minor Changes
package/README.md CHANGED
@@ -39,15 +39,15 @@ rolino projects list [--limit 50] [--cursor ID]
39
39
  rolino projects show PROJECT_ID
40
40
  rolino media list --project PROJECT_ID [--type IMAGE|VIDEO] [--query TEXT] [--limit 50] [--cursor ID]
41
41
  rolino media upload FILE_PATH --project PROJECT_ID --yes
42
- rolino posts create --project PROJECT_ID --caption TEXT [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN] [--media ASSET_ID] --yes
43
- rolino posts update POST_ID --project PROJECT_ID --expected-version VERSION [--caption TEXT] [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN] [--media ASSET_ID] [--clear-platforms] [--clear-media] --yes
42
+ rolino posts create --project PROJECT_ID --caption TEXT [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE] [--media ASSET_ID] --yes
43
+ rolino posts update POST_ID --project PROJECT_ID --expected-version VERSION [--caption TEXT] [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE] [--media ASSET_ID] [--clear-platforms] [--clear-media] --yes
44
44
  rolino posts list --project PROJECT_ID [--limit 50] [--cursor ID] [--status STATUS]
45
45
  rolino posts show POST_ID --project PROJECT_ID
46
46
  rolino posts readiness POST_ID --project PROJECT_ID
47
47
  rolino posts schedule preview POST_ID --project PROJECT_ID --expected-version VERSION --at ISO_DATE --timezone IANA_TIMEZONE
48
48
  rolino posts schedule execute POST_ID --project PROJECT_ID --expected-version VERSION --at ISO_DATE --timezone IANA_TIMEZONE --confirmation-token TOKEN [--idempotency-key KEY]
49
- rolino posts publish preview POST_ID --project PROJECT_ID --expected-version VERSION --platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN
50
- rolino posts publish execute POST_ID --project PROJECT_ID --expected-version VERSION --platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN --confirmation-token TOKEN [--idempotency-key KEY]
49
+ rolino posts publish preview POST_ID --project PROJECT_ID --expected-version VERSION --platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE
50
+ rolino posts publish execute POST_ID --project PROJECT_ID --expected-version VERSION --platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE --confirmation-token TOKEN [--idempotency-key KEY]
51
51
  rolino integrations health --project PROJECT_ID
52
52
  rolino integrations delivery-options --project PROJECT_ID --provider TIKTOK|LINKEDIN
53
53
  rolino calendar list --project PROJECT_ID [--from ISO_DATE --to ISO_DATE] [--limit 50] [--cursor CURSOR]
@@ -70,8 +70,10 @@ rolino blog schedule cancel execute ARTICLE_ID --project PROJECT_ID --confirmati
70
70
  rolino doctor
71
71
  ```
72
72
 
73
- Interactive login opens the configured Rolino instance in a browser, obtains
74
- explicit workspace approval, and exchanges a single-use code with PKCE S256.
73
+ Interactive login uses standard OAuth Authorization Code with PKCE S256. It
74
+ opens the configured Rolino instance, requests the exact \`/api/v1\` resource,
75
+ uses the fixed \`http://127.0.0.1:48391/oauth/callback\` redirect, and obtains
76
+ explicit workspace approval.
75
77
  The approval screen always includes identity and workspace reads and lets the
76
78
  user independently opt into project creation, draft writing, confirmed
77
79
  scheduling, confirmed immediate publishing, and read-only SEO Intelligence.
@@ -87,11 +89,13 @@ with evidence. It cannot create a final draft in the same action.
87
89
  Optional permissions start off,
88
90
  and existing credentials never gain a newly selected permission. Revoke and
89
91
  reauthorize an existing connection to grant project creation or `seo:read`.
90
- Existing credentials never receive `seo:read` automatically. The bearer
91
- credential never passes through a browser URL. Saved credentials are scoped by
92
- base URL and stored in the operating-system configuration directory;
92
+ Existing grants never receive `seo:read` automatically. OAuth tokens never
93
+ pass through a browser URL. The CLI stores a short-lived access token and a
94
+ rotating refresh token by host, issuer, client, and resource in the
95
+ operating-system configuration directory. It does not read or migrate the old
96
+ interactive credential, so the first use after this cutover requires sign-in;
93
97
  `ROLINO_CONFIG_DIR` overrides that location. `auth logout` revokes the calling
94
- credential before deleting its local copy.
98
+ workspace grant and OAuth refresh token before deleting its local copy.
95
99
 
96
100
  The terminal waits five minutes for browser approval. If that request expires,
97
101
  close the old approval page and run `rolino auth login` again; refreshing the
@@ -181,6 +185,19 @@ execution remains in preparation until LinkedIn confirms upload and processing.
181
185
  If final post creation has an unknown outcome, inspect that member's LinkedIn
182
186
  feed before retrying.
183
187
 
188
+ Google Business Profile drafts can be text-only or include one stored JPEG or
189
+ PNG image with a stable public URL. Use `--google-business-profile-caption`
190
+ for a destination override of up to 1,500 characters:
191
+
192
+ ```text
193
+ rolino posts create --project PROJECT_ID --caption "Store update" --platform GOOGLE_BUSINESS_PROFILE --google-business-profile-caption "Visit us to see what is new." --media IMAGE_ASSET_ID --yes
194
+ ```
195
+
196
+ Rolino owns the schedule and publishes only a standard update to the location
197
+ selected in Integrations. The CLI cannot select a location or enable the
198
+ provider. If a create result is unknown, inspect the selected Business Profile
199
+ before you try again.
200
+
184
201
  Project creation also requires interactive confirmation or `--yes`. It
185
202
  atomically saves a project and its paired brand, but does not start research,
186
203
  connect accounts, schedule posts, or publish. A fresh CLI invocation generates
@@ -217,13 +234,16 @@ processing are incomplete. The preview identifies the delivery as `IMMEDIATE`,
217
234
  shows the exact visibility, and confirms that no schedule will be created; only
218
235
  provider-confirmed visibility becomes published.
219
236
 
220
- The CLI cannot enable YouTube, Bluesky, or LinkedIn, or infer provider approval.
237
+ The CLI cannot enable YouTube, Bluesky, LinkedIn, or Google Business Profile,
238
+ or infer provider approval.
221
239
  Those are server-side deployment controls. Self-hosted operators should
222
240
  complete the
223
241
  [YouTube operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/youtube.md)
224
242
  and
225
- [Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md), and
243
+ [Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md),
226
244
  [LinkedIn operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/linkedin.md)
245
+ and the
246
+ [Google Business Profile operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/google-business-profile.md)
227
247
  before live testing.
228
248
 
229
249
  Configuration is read from `ROLINO_URL`, `ROLINO_TOKEN`, `ROLINO_CONFIG_DIR`,
@@ -303,6 +323,18 @@ capability and cannot publish. Scheduling, rescheduling, or canceling a future
303
323
  publication requires the independent `blog:publish` capability and does not
304
324
  grant approval.
305
325
 
326
+ Active-plan editorial calendar commands also require `blog:write`:
327
+
328
+ ```bash
329
+ rolino --agent blog plan cadence preview --project PROJECT_ID --plan PLAN_ID --weekdays 1,3,5 --expected-plan-version VERSION
330
+ rolino --agent blog plan cadence apply --project PROJECT_ID --plan PLAN_ID --weekdays 1,3,5 --expected-plan-version VERSION --expected-schedule-digest DIGEST --confirmation-token TOKEN --idempotency-key KEY --yes
331
+ ```
332
+
333
+ Preview a cadence change first and show every date change and locked item. Apply only
334
+ the unchanged preview values. These commands do not change `scheduledPublishAt` and never schedule, publish,
335
+ or unpublish an article. Image generation already accepts optional direction
336
+ with `blog images generate --editorial-brief TEXT` (maximum 500 characters).
337
+
306
338
  Approval, schedule, and cancellation execution bind the short-lived token from
307
339
  the matching preview and a stable idempotency key. Human output requires
308
340
  `--yes`. JSON mode does not prompt, but it still requires the confirmation