@rolino/cli 0.5.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/CHANGELOG.md +39 -0
  2. package/README.md +71 -21
  3. package/dist/bin.cjs +428 -251
  4. package/dist/bin.cjs.map +1 -1
  5. package/dist/bin.js +1 -1
  6. package/dist/{chunk-MBZL2CK6.js → chunk-PEJ2WA66.js} +415 -236
  7. package/dist/chunk-PEJ2WA66.js.map +1 -0
  8. package/dist/index.cjs +428 -251
  9. package/dist/index.cjs.map +1 -1
  10. package/dist/index.d.cts +21 -10
  11. package/dist/index.d.ts +21 -10
  12. package/dist/index.js +1 -1
  13. package/package.json +5 -5
  14. package/dist/chunk-MBZL2CK6.js.map +0 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,40 @@
1
1
  # @rolino/cli
2
2
 
3
+ ## 0.7.0
4
+
5
+ ### Minor Changes
6
+
7
+ - f78e0ff: Prefer advertised Streamable HTTP MCP with client-owned OAuth, add explicit HTTP and STDIO transport selection, and keep local MCP as a fallback.
8
+ - 358f37a: Expose additive safe Blog preparation, next-action, and quality summaries through the shared read contracts and existing clients.
9
+
10
+ ### Patch Changes
11
+
12
+ - Updated dependencies [358f37a]
13
+ - @rolino/contracts@0.7.0
14
+ - @rolino/sdk@0.7.0
15
+ - @rolino/local-auth@0.7.0
16
+
17
+ ## 0.6.0
18
+
19
+ ### Minor Changes
20
+
21
+ - Add matching backlink prospecting commands with safe JSON output and formula-safe contact CSV export. Rolino does not send email.
22
+
23
+ - d162f85: Add safe Blog editorial cadence preview and apply operations across contracts, SDK, CLI, and MCP.
24
+ - 50cb9fc: Add Google Business Profile as a disabled-by-default standard text and single-image publishing destination across shared public clients.
25
+ - 1ac7ed5: Add signed custom Blog webhook setup, connection testing, one-time secret rotation, and safe idempotent replay parity.
26
+ - a56f834: Replace custom interactive CLI authorization with exact-resource OAuth, add the stateless MCP 2026-07-28 transport foundation, and provide safe connection instructions for workspace discovery and confirmed actions.
27
+
28
+ ### Patch Changes
29
+
30
+ - Updated dependencies [d162f85]
31
+ - Updated dependencies [50cb9fc]
32
+ - Updated dependencies [1ac7ed5]
33
+ - Updated dependencies [a56f834]
34
+ - @rolino/contracts@0.6.0
35
+ - @rolino/sdk@0.6.0
36
+ - @rolino/local-auth@0.6.0
37
+
3
38
  ## 0.5.0
4
39
 
5
40
  ### Minor Changes
@@ -74,6 +109,10 @@
74
109
 
75
110
  ### Minor Changes
76
111
 
112
+ - Show additive safe Blog preparation and quality state in existing JSON reads.
113
+
114
+ ### Minor Changes
115
+
77
116
  - Add Blog image generation, exact local-file upload, image review, confirmed
78
117
  exact-bundle approval, future scheduling, and schedule cancellation commands
79
118
  with deterministic agent output, stable idempotency, safe errors, and
package/README.md CHANGED
@@ -14,16 +14,17 @@ The supported installation keeps the CLI independent from MCP:
14
14
  npm install --global @rolino/cli
15
15
  ```
16
16
 
17
- Users who also want local MCP will install both packages explicitly:
17
+ Users who need local STDIO MCP will install both packages explicitly:
18
18
 
19
19
  ```bash
20
20
  npm install --global @rolino/cli @rolino/mcp
21
21
  ```
22
22
 
23
- The CLI-only installation does not include `@rolino/mcp` or the MCP SDK. If a
24
- CLI-only user runs `rolino setup mcp`, the command explains how to install the
25
- separate MCP package and then retry. Rolino never downloads or installs MCP
26
- silently.
23
+ The default `rolino setup mcp` mode checks the selected Rolino instance. It
24
+ uses hosted Streamable HTTP when the instance advertises it. This mode does
25
+ not need `@rolino/mcp`. If remote MCP is not available, the command uses local
26
+ STDIO and explains how to install the separate MCP package. Rolino never
27
+ downloads or installs MCP silently.
27
28
 
28
29
  Initial commands:
29
30
 
@@ -31,23 +32,35 @@ Initial commands:
31
32
  rolino auth login
32
33
  rolino auth status
33
34
  rolino auth logout
34
- rolino setup mcp --client codex [--scope user|project]
35
- rolino setup mcp --client claude-code [--scope user|project]
35
+ rolino setup mcp --client codex [--transport auto|http|stdio] [--scope user|project]
36
+ rolino setup mcp --client claude-code [--transport auto|http|stdio] [--scope user|project]
36
37
  rolino whoami
37
38
  rolino projects create --name NAME [--type PRODUCT|SERVICE|PERSONAL|COMPANY] [--website URL] [--description TEXT] [--idempotency-key KEY] --yes
38
39
  rolino projects list [--limit 50] [--cursor ID]
39
40
  rolino projects show PROJECT_ID
41
+ rolino backlinks targets list --project PROJECT_ID
42
+ rolino backlinks targets add --project PROJECT_ID --url URL --label LABEL
43
+ rolino backlinks discover --project PROJECT_ID --limit 20
44
+ rolino backlinks runs get --project PROJECT_ID --run RUN_ID
45
+ rolino backlinks prospects list --project PROJECT_ID [--stage STAGE]
46
+ rolino backlinks prospects get --project PROJECT_ID --prospect PROSPECT_ID
47
+ rolino backlinks prospects approve --project PROJECT_ID --prospect PROSPECT_ID --expected-version VERSION
48
+ rolino backlinks contacts research --project PROJECT_ID --prospect PROSPECT_ID
49
+ rolino backlinks contacts list --project PROJECT_ID
50
+ rolino backlinks contacts export --project PROJECT_ID --format csv
51
+ rolino backlinks outreach update --project PROJECT_ID --prospect PROSPECT_ID --file DRAFT.json --expected-version VERSION
52
+ rolino backlinks verify --project PROJECT_ID --prospect PROSPECT_ID --url PUBLIC_URL --expected-version VERSION
40
53
  rolino media list --project PROJECT_ID [--type IMAGE|VIDEO] [--query TEXT] [--limit 50] [--cursor ID]
41
54
  rolino media upload FILE_PATH --project PROJECT_ID --yes
42
- rolino posts create --project PROJECT_ID --caption TEXT [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN] [--media ASSET_ID] --yes
43
- rolino posts update POST_ID --project PROJECT_ID --expected-version VERSION [--caption TEXT] [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN] [--media ASSET_ID] [--clear-platforms] [--clear-media] --yes
55
+ rolino posts create --project PROJECT_ID --caption TEXT [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE] [--media ASSET_ID] --yes
56
+ rolino posts update POST_ID --project PROJECT_ID --expected-version VERSION [--caption TEXT] [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE] [--media ASSET_ID] [--clear-platforms] [--clear-media] --yes
44
57
  rolino posts list --project PROJECT_ID [--limit 50] [--cursor ID] [--status STATUS]
45
58
  rolino posts show POST_ID --project PROJECT_ID
46
59
  rolino posts readiness POST_ID --project PROJECT_ID
47
60
  rolino posts schedule preview POST_ID --project PROJECT_ID --expected-version VERSION --at ISO_DATE --timezone IANA_TIMEZONE
48
61
  rolino posts schedule execute POST_ID --project PROJECT_ID --expected-version VERSION --at ISO_DATE --timezone IANA_TIMEZONE --confirmation-token TOKEN [--idempotency-key KEY]
49
- rolino posts publish preview POST_ID --project PROJECT_ID --expected-version VERSION --platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN
50
- rolino posts publish execute POST_ID --project PROJECT_ID --expected-version VERSION --platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN --confirmation-token TOKEN [--idempotency-key KEY]
62
+ rolino posts publish preview POST_ID --project PROJECT_ID --expected-version VERSION --platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE
63
+ rolino posts publish execute POST_ID --project PROJECT_ID --expected-version VERSION --platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE --confirmation-token TOKEN [--idempotency-key KEY]
51
64
  rolino integrations health --project PROJECT_ID
52
65
  rolino integrations delivery-options --project PROJECT_ID --provider TIKTOK|LINKEDIN
53
66
  rolino calendar list --project PROJECT_ID [--from ISO_DATE --to ISO_DATE] [--limit 50] [--cursor CURSOR]
@@ -70,8 +83,10 @@ rolino blog schedule cancel execute ARTICLE_ID --project PROJECT_ID --confirmati
70
83
  rolino doctor
71
84
  ```
72
85
 
73
- Interactive login opens the configured Rolino instance in a browser, obtains
74
- explicit workspace approval, and exchanges a single-use code with PKCE S256.
86
+ Interactive login uses standard OAuth Authorization Code with PKCE S256. It
87
+ opens the configured Rolino instance, requests the exact \`/api/v1\` resource,
88
+ uses the fixed \`http://127.0.0.1:48391/oauth/callback\` redirect, and obtains
89
+ explicit workspace approval.
75
90
  The approval screen always includes identity and workspace reads and lets the
76
91
  user independently opt into project creation, draft writing, confirmed
77
92
  scheduling, confirmed immediate publishing, and read-only SEO Intelligence.
@@ -87,18 +102,25 @@ with evidence. It cannot create a final draft in the same action.
87
102
  Optional permissions start off,
88
103
  and existing credentials never gain a newly selected permission. Revoke and
89
104
  reauthorize an existing connection to grant project creation or `seo:read`.
90
- Existing credentials never receive `seo:read` automatically. The bearer
91
- credential never passes through a browser URL. Saved credentials are scoped by
92
- base URL and stored in the operating-system configuration directory;
105
+ Existing grants never receive `seo:read` automatically. OAuth tokens never
106
+ pass through a browser URL. The CLI stores a short-lived access token and a
107
+ rotating refresh token by host, issuer, client, and resource in the
108
+ operating-system configuration directory. It does not read or migrate the old
109
+ interactive credential, so the first use after this cutover requires sign-in;
93
110
  `ROLINO_CONFIG_DIR` overrides that location. `auth logout` revokes the calling
94
- credential before deleting its local copy.
111
+ workspace grant and OAuth refresh token before deleting its local copy.
95
112
 
96
113
  The terminal waits five minutes for browser approval. If that request expires,
97
114
  close the old approval page and run `rolino auth login` again; refreshing the
98
115
  page cannot restart the closed loopback listener.
99
116
 
100
- `setup mcp` finds the built Rolino stdio server, previews the exact token-free
101
- configuration, and asks before changing anything. User scope is the default.
117
+ `setup mcp` checks `/api/v1/meta` and prefers hosted Streamable HTTP when it is
118
+ available. Remote setup writes the `/mcp` URL and OAuth mode, does not start a
119
+ local MCP process, and does not reuse `rolino auth login`. Run
120
+ `codex mcp login rolino` after remote Codex setup. Use `--transport http` to
121
+ require remote MCP or `--transport stdio` to require the local package and its
122
+ shared CLI OAuth session. The command previews the exact token-free
123
+ configuration and asks before changing anything. User scope is the default.
102
124
  Codex configuration is written to `CODEX_HOME/config.toml` or
103
125
  `~/.codex/config.toml`; Claude Code user scope is applied through its official
104
126
  CLI. Project scope writes `.codex/config.toml` or `.mcp.json` in the current
@@ -181,6 +203,19 @@ execution remains in preparation until LinkedIn confirms upload and processing.
181
203
  If final post creation has an unknown outcome, inspect that member's LinkedIn
182
204
  feed before retrying.
183
205
 
206
+ Google Business Profile drafts can be text-only or include one stored JPEG or
207
+ PNG image with a stable public URL. Use `--google-business-profile-caption`
208
+ for a destination override of up to 1,500 characters:
209
+
210
+ ```text
211
+ rolino posts create --project PROJECT_ID --caption "Store update" --platform GOOGLE_BUSINESS_PROFILE --google-business-profile-caption "Visit us to see what is new." --media IMAGE_ASSET_ID --yes
212
+ ```
213
+
214
+ Rolino owns the schedule and publishes only a standard update to the location
215
+ selected in Integrations. The CLI cannot select a location or enable the
216
+ provider. If a create result is unknown, inspect the selected Business Profile
217
+ before you try again.
218
+
184
219
  Project creation also requires interactive confirmation or `--yes`. It
185
220
  atomically saves a project and its paired brand, but does not start research,
186
221
  connect accounts, schedule posts, or publish. A fresh CLI invocation generates
@@ -217,13 +252,16 @@ processing are incomplete. The preview identifies the delivery as `IMMEDIATE`,
217
252
  shows the exact visibility, and confirms that no schedule will be created; only
218
253
  provider-confirmed visibility becomes published.
219
254
 
220
- The CLI cannot enable YouTube, Bluesky, or LinkedIn, or infer provider approval.
255
+ The CLI cannot enable YouTube, Bluesky, LinkedIn, or Google Business Profile,
256
+ or infer provider approval.
221
257
  Those are server-side deployment controls. Self-hosted operators should
222
258
  complete the
223
259
  [YouTube operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/youtube.md)
224
260
  and
225
- [Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md), and
261
+ [Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md),
226
262
  [LinkedIn operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/linkedin.md)
263
+ and the
264
+ [Google Business Profile operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/google-business-profile.md)
227
265
  before live testing.
228
266
 
229
267
  Configuration is read from `ROLINO_URL`, `ROLINO_TOKEN`, `ROLINO_CONFIG_DIR`,
@@ -303,6 +341,18 @@ capability and cannot publish. Scheduling, rescheduling, or canceling a future
303
341
  publication requires the independent `blog:publish` capability and does not
304
342
  grant approval.
305
343
 
344
+ Active-plan editorial calendar commands also require `blog:write`:
345
+
346
+ ```bash
347
+ rolino --agent blog plan cadence preview --project PROJECT_ID --plan PLAN_ID --weekdays 1,3,5 --expected-plan-version VERSION
348
+ rolino --agent blog plan cadence apply --project PROJECT_ID --plan PLAN_ID --weekdays 1,3,5 --expected-plan-version VERSION --expected-schedule-digest DIGEST --confirmation-token TOKEN --idempotency-key KEY --yes
349
+ ```
350
+
351
+ Preview a cadence change first and show every date change and locked item. Apply only
352
+ the unchanged preview values. These commands do not change `scheduledPublishAt` and never schedule, publish,
353
+ or unpublish an article. Image generation already accepts optional direction
354
+ with `blog images generate --editorial-brief TEXT` (maximum 500 characters).
355
+
306
356
  Approval, schedule, and cancellation execution bind the short-lived token from
307
357
  the matching preview and a stable idempotency key. Human output requires
308
358
  `--yes`. JSON mode does not prompt, but it still requires the confirmation