@rolino/cli 0.5.0 → 0.7.0

package/dist/{chunk-MBZL2CK6.js → chunk-PEJ2WA66.js}

@@ -123,12 +123,18 @@ function removeExistingCodexEntry(source, newline) {
   return kept.join(newline).trimEnd();
 }
 function codexBlock(server, newline) {
+  const configuration = server.transport === "http" ? [
+    `url = ${tomlString(server.url)}`,
+    `auth = ${tomlString(server.auth)}`
+  ] : [
+    `command = ${tomlString(server.command)}`,
+    `args = [${server.args.map(tomlString).join(", ")}]`,
+    `env = { ROLINO_URL = ${tomlString(server.env.ROLINO_URL)} }`
+  ];
   return [
     CODEX_BEGIN,
     "[mcp_servers.rolino]",
-    `command = ${tomlString(server.command)}`,
-    `args = [${server.args.map(tomlString).join(", ")}]`,
-    `env = { ROLINO_URL = ${tomlString(server.env.ROLINO_URL)} }`,
+    ...configuration,
     CODEX_END
   ].join(newline);
 }
@@ -168,7 +174,12 @@ function updateClaudeProjectConfig(source, server) {
     ...parsed,
     mcpServers: {
       ...currentServers,
-      rolino: { type: "stdio", ...server }
+      rolino: server.transport === "http" ? { type: "http", url: server.url } : {
+        type: "stdio",
+        command: server.command,
+        args: server.args,
+        env: server.env
+      }
     }
   }, null, 2)}
 `;
@@ -200,6 +211,7 @@ async function setupCodex(options, server) {
     backupPath,
     changed,
     dryRun: options.dryRun ?? false,
+    transport: server.transport,
     server
   };
 }
@@ -220,6 +232,7 @@ async function setupClaudeCode(options, server) {
       backupPath,
       changed,
       dryRun: options.dryRun ?? false,
+      transport: server.transport,
       server
     };
   }
@@ -232,6 +245,7 @@ async function setupClaudeCode(options, server) {
       backupPath: null,
       changed: true,
       dryRun: true,
+      transport: server.transport,
       server
     };
   }
@@ -245,7 +259,12 @@ async function setupClaudeCode(options, server) {
     "mcp",
     "add-json",
     "rolino",
-    JSON.stringify({ type: "stdio", ...server }),
+    JSON.stringify(server.transport === "http" ? { type: "http", url: server.url } : {
+      type: "stdio",
+      command: server.command,
+      args: server.args,
+      env: server.env
+    }),
     "--scope",
     "user"
   ], options);
@@ -261,14 +280,51 @@ async function setupClaudeCode(options, server) {
     backupPath: null,
     changed: true,
     dryRun: false,
+    transport: server.transport,
     server
   };
 }
+function remoteMcpUrl(baseUrl) {
+  return new URL("mcp", `${baseUrl.replace(/\/$/, "")}/`).toString();
+}
+async function advertisedRemoteMcp(options) {
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  try {
+    const response = await fetchImplementation(
+      new URL("api/v1/meta", `${options.baseUrl.replace(/\/$/, "")}/`),
+      {
+        headers: { accept: "application/json" },
+        signal: AbortSignal.timeout(5e3)
+      }
+    );
+    if (!response.ok) return false;
+    const payload = await response.json();
+    return payload.data?.mcp?.streamableHttp === true;
+  } catch {
+    return false;
+  }
+}
+async function resolveTransport(options) {
+  const requested = options.transport ?? "stdio";
+  if (requested === "stdio") return "stdio";
+  if (await advertisedRemoteMcp(options)) return "http";
+  if (requested === "http") {
+    throw new TypeError(
+      "This Rolino instance does not advertise Streamable HTTP MCP. Use --transport stdio, or enable and verify remote MCP on the server."
+    );
+  }
+  return "stdio";
+}
 async function setupMcp(options) {
-  const serverPath = await resolveServerPath(options);
-  const server = {
+  const transport = await resolveTransport(options);
+  const server = transport === "http" ? {
+    transport: "http",
+    url: remoteMcpUrl(options.baseUrl),
+    auth: "oauth"
+  } : {
+    transport: "stdio",
     command: options.nodePath,
-    args: [serverPath],
+    args: [await resolveServerPath(options)],
     env: { ROLINO_URL: options.baseUrl }
   };
   return options.client === "codex" ? setupCodex(options, server) : setupClaudeCode(options, server);
@@ -285,7 +341,7 @@ import { Command, CommanderError, InvalidArgumentError } from "commander";
 // package.json
 var package_default = {
   name: "@rolino/cli",
-  version: "0.5.0",
+  version: "0.7.0",
   description: "Agent-friendly command-line interface for Rolino",
   type: "module",
   license: "MIT",
@@ -342,14 +398,14 @@ var package_default = {
     dev: "tsx src/bin.ts"
   },
   dependencies: {
-    "@rolino/contracts": "0.5.0",
-    "@rolino/local-auth": "0.5.0",
-    "@rolino/sdk": "0.5.0",
+    "@rolino/contracts": "0.7.0",
+    "@rolino/local-auth": "0.7.0",
+    "@rolino/sdk": "0.7.0",
     commander: "^15.0.0",
     open: "^11.0.0"
   },
   devDependencies: {
-    tsx: "^4.21.0"
+    tsx: "^4.23.12"
   },
   engines: {
     node: ">=20.19.0"
@@ -360,6 +416,7 @@ var package_default = {
 import {
   PostStatusSchema,
   AgentBlogDraftUpdateSchema,
+  BacklinkProspectStageSchema,
   ProjectCreateInputSchema,
   ProjectTypeSchema,
   ProviderDeliveryOptionsProviderSchema,
@@ -381,19 +438,21 @@ import {
 // src/browser-login.ts
 import { createHash, randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
-import { hostname } from "os";
 import {
-  CLI_BROWSER_AUTHORIZATION_TIMEOUT_MS
-} from "@rolino/contracts";
+  oauthConfiguration
+} from "@rolino/local-auth";
 import open from "open";
-var PAGE_HEADERS = {
-  "cache-control": "no-store",
-  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
-  "content-type": "text/html; charset=utf-8",
-  "referrer-policy": "no-referrer",
-  "x-content-type-options": "nosniff"
-};
-var ROLINO_MASCOT_SVG = '<svg viewBox="0 0 512 512" aria-hidden="true" focusable="false"><path fill="#34C78A" d="M256 142c-48-29-71-58-62-84 28-4 52 11 62 36 10-25 34-40 62-36 9 26-14 55-62 84Z"/><path fill="#FACC15" stroke="#0F172A" stroke-width="12" stroke-linejoin="round" d="M256 112c-89 0-156 74-156 176v57c0 31 19 54 50 54h212c31 0 50-23 50-54v-57c0-102-67-176-156-176Z"/><circle cx="204" cy="272" r="18" fill="#0F172A"/><circle cx="308" cy="272" r="18" fill="#0F172A"/><path fill="none" stroke="#0F172A" stroke-linecap="round" stroke-width="16" d="M226 318c18 25 42 25 60 0"/></svg>';
+var OAUTH_CALLBACK_PORT = 48391;
+var OAUTH_CALLBACK_PATH = "/oauth/callback";
+var OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;
+var DEFAULT_SCOPES = [
+  "offline_access",
+  "identity:read",
+  "projects:read",
+  "posts:read",
+  "integrations:read",
+  "calendar:read"
+];
 function escapeHtml(value) {
   return value.replace(/[&<>"']/g, (character) => ({
     "&": "&amp;",
@@ -403,86 +462,18 @@ function escapeHtml(value) {
     "'": "&#039;"
   })[character]);
 }
-function renderCliAuthorizationResultPage(options) {
-  const tone = options.success ? "success" : "failure";
-  const eyebrow = options.success ? "CLI handoff complete" : "CLI handoff paused";
-  const detail = options.success ? '<div class="terminal" aria-label="Terminal authentication status"><div class="terminal-bar"><i></i><i></i><i></i><span>ROLINO CLI</span></div><div class="command"><b>$</b> rolino whoami</div><div class="terminal-result"><span>\u2713</span> Authenticated. Ready for your next command.</div></div>' : '<div class="return-note"><span>\u2192</span><div><strong>Return to your terminal</strong><small>Start the login flow again when you are ready.</small></div></div>';
-  return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width,initial-scale=1">
-  <meta name="color-scheme" content="light">
-  <title>${escapeHtml(options.title)} \xB7 Rolino</title>
-  <style>
-    *{box-sizing:border-box}
-    html,body{height:100%;margin:0}
-    body{min-height:100svh;overflow:hidden;background:#faf9f1;color:#0f172a;font-family:"Poppins","Avenir Next","Trebuchet MS",ui-rounded,system-ui,sans-serif}
-    .shell{position:relative;isolation:isolate;display:grid;min-height:100svh;grid-template-rows:auto 1fr auto;padding:clamp(18px,3vw,38px);overflow:hidden}
-    .shape{position:absolute;z-index:-1;border-radius:999px;pointer-events:none}
-    .shape-a{top:-160px;left:-130px;width:390px;height:390px;background:#facc1530;filter:blur(2px)}
-    .shape-b{right:-100px;bottom:-160px;width:360px;height:360px;background:#34c78a20}
-    .shape-c{right:9%;top:14%;width:22px;height:22px;background:#ef6a5b;transform:rotate(18deg);border-radius:7px}
-    .topbar,.footer{display:flex;width:min(100%,1100px);margin:auto;align-items:center;justify-content:space-between}
-    .brand{display:flex;align-items:center;gap:10px;color:#0f172a;font-size:22px;font-weight:800;letter-spacing:-.04em}
-    .brand svg{display:block;width:36px;height:36px}
-    .secure{display:flex;align-items:center;gap:8px;color:#52607a;font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase}
-    .secure-dot{display:block;width:8px;height:8px;border-radius:50%;background:#34c78a;box-shadow:0 0 0 5px #34c78a1f}
-    .stage{display:grid;min-height:0;place-items:center;padding:12px 0}
-    .panel{width:min(100%,590px);padding:clamp(26px,4vw,46px);text-align:center;background:#fffefa;border:1px solid #e3e6ed;border-radius:32px;box-shadow:0 36px 90px -52px #0f172a73;animation:arrive .55s cubic-bezier(.22,1,.36,1) both}
-    .mascot-wrap{position:relative;display:grid;width:112px;height:96px;margin:0 auto 12px;place-items:center}
-    .mascot-wrap:before{position:absolute;width:88px;height:88px;border-radius:50%;background:#fff4a8;content:"";box-shadow:0 0 0 14px #fff9d8}
-    .mascot-wrap svg{position:relative;width:78px;height:78px;filter:drop-shadow(0 10px 12px #c58e0026);animation:mascot-arrive .65s .08s cubic-bezier(.22,1,.36,1) both}
-    .eyebrow{display:inline-flex;align-items:center;gap:7px;margin:0 0 12px;padding:6px 11px;border-radius:999px;background:#fff8b8;color:#7a4d00;font-size:10px;font-weight:900;letter-spacing:.14em;text-transform:uppercase}
-    .eyebrow:before{width:7px;height:7px;border-radius:50%;background:#34c78a;content:""}
-    .failure .eyebrow{background:#fee6df;color:#9f2f24}
-    .failure .eyebrow:before{background:#ef6a5b}
-    h1{margin:0;color:#0f172a;font-family:"Outfit","Avenir Next","Trebuchet MS",ui-rounded,system-ui,sans-serif;font-size:clamp(34px,5vw,48px);line-height:1;letter-spacing:-.045em}
-    .message{max-width:450px;margin:14px auto 0;color:#52607a;font-size:15px;line-height:1.65}
-    .terminal{max-width:450px;margin:24px auto 0;padding:14px 16px 16px;text-align:left;background:#111b30;color:#eff3fa;border:1px solid #293550;border-radius:18px;box-shadow:0 18px 42px -26px #0f172acc}
-    .terminal-bar{display:flex;align-items:center;gap:6px;padding-bottom:12px;color:#8f9bb1;font-size:9px;font-weight:800;letter-spacing:.13em}
-    .terminal-bar i{display:block;width:7px;height:7px;border-radius:50%;background:#ef6a5b}
-    .terminal-bar i:nth-child(2){background:#facc15}
-    .terminal-bar i:nth-child(3){margin-right:5px;background:#34c78a}
-    .command{font-family:"Cascadia Code",Consolas,monospace;font-size:13px}
-    .command b{color:#facc15}
-    .terminal-result{display:flex;align-items:center;gap:8px;margin-top:9px;color:#aeb9ca;font-size:12px}
-    .terminal-result span{color:#52d49e;font-weight:900}
-    .return-note{display:flex;max-width:420px;margin:24px auto 0;padding:14px 16px;align-items:center;gap:12px;text-align:left;background:#fff2ed;border:1px solid #f6c9bd;border-radius:18px;color:#7e2f29}
-    .return-note>span{font-size:24px}
-    .return-note strong,.return-note small{display:block}
-    .return-note small{margin-top:3px;color:#875b56}
-    .footer{justify-content:center;color:#6f788a;font-size:11px}
-    @keyframes arrive{from{opacity:0;transform:translateY(12px) scale(.985)}to{opacity:1;transform:none}}
-    @keyframes mascot-arrive{from{opacity:0;transform:translateY(10px) rotate(-4deg) scale(.88)}to{opacity:1;transform:none}}
-    @media(max-width:600px){.secure{display:none}.panel{border-radius:24px}.shape-c{display:none}}
-    @media(max-height:700px){.shell{padding:16px}.stage{padding:6px 0}.panel{padding:20px 26px}.mascot-wrap{width:88px;height:72px;margin-bottom:6px}.mascot-wrap:before{width:68px;height:68px;box-shadow:0 0 0 10px #fff9d8}.mascot-wrap svg{width:60px;height:60px}.eyebrow{margin-bottom:8px}h1{font-size:32px}.message{margin-top:10px}.terminal,.return-note{margin-top:14px}}
-    @media(prefers-reduced-motion:reduce){.panel,.mascot-wrap svg{animation:none}}
-  </style>
-</head>
-<body class="${tone}">
-  <main class="shell">
-    <span class="shape shape-a"></span><span class="shape shape-b"></span><span class="shape shape-c"></span>
-    <header class="topbar">
-      <div class="brand">${ROLINO_MASCOT_SVG}<span>Rolino</span></div>
-      <div class="secure"><span class="secure-dot"></span>Secure CLI authorization</div>
-    </header>
-    <section class="stage">
-      <div class="panel">
-        <div class="mascot-wrap">${ROLINO_MASCOT_SVG}</div>
-        <p class="eyebrow">${eyebrow}</p>
-        <h1>${escapeHtml(options.title)}</h1>
-        <p class="message">${escapeHtml(options.message)}</p>
-        ${detail}
-      </div>
-    </section>
-    <footer class="footer">Secure browser handoff \xB7 no password shared</footer>
-  </main>
-</body>
-</html>`;
+function renderOAuthAuthorizationResultPage(options) {
+  const color = options.success ? "#087f5b" : "#b42318";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="light dark"><title>${escapeHtml(options.title)} \xB7 Rolino</title><style>body{min-height:100vh;margin:0;display:grid;place-items:center;background:#faf9f1;color:#0f172a;font:16px/1.5 system-ui,sans-serif}.card{width:min(34rem,calc(100% - 2rem));box-sizing:border-box;padding:2.5rem;border:1px solid #dfe3ea;border-radius:1.5rem;background:#fff;text-align:center;box-shadow:0 24px 70px #0f172a20}h1{margin:0 0 .75rem;color:${color};font-size:2rem}p{margin:0;color:#52607a}@media(prefers-color-scheme:dark){body{background:#111827;color:#f8fafc}.card{background:#182235;border-color:#344258}p{color:#cbd5e1}}</style></head><body><main class="card"><h1>${escapeHtml(options.title)}</h1><p>${escapeHtml(options.message)}</p></main></body></html>`;
 }
 function writePage(response, status, html) {
-  response.writeHead(status, PAGE_HEADERS);
+  response.writeHead(status, {
+    "cache-control": "no-store",
+    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'",
+    "content-type": "text/html; charset=utf-8",
+    "referrer-policy": "no-referrer",
+    "x-content-type-options": "nosniff"
+  });
   response.end(html);
 }
 function secretsMatch(left, right) {
@@ -490,41 +481,63 @@ function secretsMatch(left, right) {
   const rightBytes = Buffer.from(right);
   return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
 }
-function createBrowserAuthorizationRequest(options) {
+function createBrowserAuthorizationRequest(baseUrl) {
+  const configuration = oauthConfiguration(baseUrl);
   const state = randomBytes(32).toString("base64url");
   const codeVerifier = randomBytes(32).toString("base64url");
   const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
-  const url = new URL("/cli/authorize", options.baseUrl);
-  const requestExpiresAt = new Date(
-    Date.now() + CLI_BROWSER_AUTHORIZATION_TIMEOUT_MS
-  ).toISOString();
-  url.searchParams.set("redirect_uri", options.redirectUri);
+  const redirectUri = `http://127.0.0.1:${OAUTH_CALLBACK_PORT}${OAUTH_CALLBACK_PATH}`;
+  const url = new URL(`${configuration.issuer}/oauth2/authorize`);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", configuration.clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("scope", DEFAULT_SCOPES.join(" "));
+  url.searchParams.set("resource", configuration.resource);
   url.searchParams.set("state", state);
   url.searchParams.set("code_challenge", codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set(
-    "client_name",
-    (options.clientName ?? `Rolino CLI on ${hostname()}`).slice(0, 32)
-  );
-  url.searchParams.set("request_expires_at", requestExpiresAt);
-  return {
-    url: url.toString(),
-    state,
-    codeVerifier,
-    codeChallenge,
-    requestExpiresAt
-  };
+  return { configuration, url: url.toString(), redirectUri, state, codeVerifier, codeChallenge };
 }
-var CliAuthorizationDeniedError = class extends Error {
+var OAuthAuthorizationDeniedError = class extends Error {
   constructor() {
     super("Authorization was denied.");
-    this.name = "CliAuthorizationDeniedError";
+    this.name = "OAuthAuthorizationDeniedError";
   }
 };
+async function exchangeAuthorizationCode(options) {
+  const { authorization } = options;
+  const response = await options.fetch(`${authorization.configuration.issuer}/oauth2/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: options.code,
+      redirect_uri: authorization.redirectUri,
+      client_id: authorization.configuration.clientId,
+      code_verifier: authorization.codeVerifier,
+      resource: authorization.configuration.resource
+    })
+  });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok || !payload || typeof payload.access_token !== "string" || typeof payload.refresh_token !== "string") throw new Error("Rolino could not exchange the OAuth authorization code.");
+  const expiresIn = typeof payload.expires_in === "number" ? payload.expires_in : 300;
+  return {
+    host: authorization.configuration.host,
+    issuer: authorization.configuration.issuer,
+    clientId: authorization.configuration.clientId,
+    resource: authorization.configuration.resource,
+    accessToken: payload.access_token,
+    accessTokenExpiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString(),
+    refreshToken: payload.refresh_token,
+    refreshTokenExpiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3).toISOString(),
+    scopes: typeof payload.scope === "string" ? payload.scope.split(/\s+/).filter(Boolean) : [...DEFAULT_SCOPES]
+  };
+}
 async function loginWithBrowser(options) {
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
   return new Promise((resolve3, reject) => {
     let settled = false;
-    let authorization = null;
+    const authorization = createBrowserAuthorizationRequest(options.baseUrl);
     const finish = (callback) => {
       if (settled) return;
       settled = true;
@@ -534,82 +547,46 @@ async function loginWithBrowser(options) {
     };
     const server = createServer((request, response) => {
       const url = new URL(request.url ?? "/", "http://127.0.0.1");
-      if (request.method !== "GET" || url.pathname !== "/callback") {
+      if (request.method !== "GET" || url.pathname !== OAUTH_CALLBACK_PATH) {
         response.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
         response.end("Not found");
         return;
       }
       void (async () => {
-        if (!authorization) {
-          writePage(response, 503, renderCliAuthorizationResultPage({
-            title: "Authorization is starting",
-            message: "Return to your terminal and try the browser link again in a moment.",
-            success: false
-          }));
-          return;
-        }
         if (!secretsMatch(url.searchParams.get("state") ?? "", authorization.state)) {
-          writePage(response, 400, renderCliAuthorizationResultPage({
-            title: "Authorization failed",
-            message: "The callback state did not match. Return to your terminal and try again.",
-            success: false
-          }));
-          finish(() => reject(new Error("The browser callback state did not match.")));
+          writePage(response, 400, renderOAuthAuthorizationResultPage({ title: "Authorization failed", message: "The callback state did not match.", success: false }));
+          finish(() => reject(new Error("The OAuth callback state did not match.")));
           return;
         }
         if (url.searchParams.get("error") === "access_denied") {
-          writePage(response, 200, renderCliAuthorizationResultPage({
-            title: "Access denied",
-            message: "No credential was created. You can close this window and return to your terminal.",
-            success: false
-          }));
-          finish(() => reject(new CliAuthorizationDeniedError()));
+          writePage(response, 200, renderOAuthAuthorizationResultPage({ title: "Access denied", message: "No OAuth token was saved.", success: false }));
+          finish(() => reject(new OAuthAuthorizationDeniedError()));
+          return;
+        }
+        if (url.searchParams.get("iss") !== authorization.configuration.issuer) {
+          writePage(response, 400, renderOAuthAuthorizationResultPage({ title: "Authorization failed", message: "The authorization server did not match.", success: false }));
+          finish(() => reject(new Error("The OAuth callback issuer did not match.")));
           return;
         }
         const code = url.searchParams.get("code");
-        if (!code || !/^[A-Za-z0-9_-]{43,128}$/.test(code)) {
-          writePage(response, 400, renderCliAuthorizationResultPage({
-            title: "Authorization failed",
-            message: "Rolino did not return a valid one-time code. Return to your terminal and try again.",
-            success: false
-          }));
-          finish(() => reject(new Error("The browser callback did not include a valid code.")));
+        if (!code || code.length > 2048) {
+          writePage(response, 400, renderOAuthAuthorizationResultPage({ title: "Authorization failed", message: "Rolino did not return a valid code.", success: false }));
+          finish(() => reject(new Error("The OAuth callback did not include a valid code.")));
           return;
         }
         try {
-          const credential = await options.exchange({
-            code,
-            codeVerifier: authorization.codeVerifier
-          });
-          writePage(response, 200, renderCliAuthorizationResultPage({
-            title: "Terminal connected",
-            message: "Rolino is ready in your terminal. You can close this window.",
-            success: true
-          }));
-          finish(() => resolve3(credential));
+          const tokenSet = await exchangeAuthorizationCode({ authorization, code, fetch: fetchImplementation });
+          writePage(response, 200, renderOAuthAuthorizationResultPage({ title: "Terminal connected", message: "You can close this window and return to your terminal.", success: true }));
+          finish(() => resolve3(tokenSet));
         } catch (error) {
-          writePage(response, 502, renderCliAuthorizationResultPage({
-            title: "Authorization failed",
-            message: "The CLI could not exchange its one-time code. Return to your terminal and try again.",
-            success: false
-          }));
+          writePage(response, 502, renderOAuthAuthorizationResultPage({ title: "Authorization failed", message: "The CLI could not exchange the code.", success: false }));
           finish(() => reject(error));
         }
       })();
     });
     server.once("error", (error) => finish(() => reject(error)));
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        finish(() => reject(new Error("Rolino could not start the local authorization callback.")));
-        return;
-      }
-      authorization = createBrowserAuthorizationRequest({
-        baseUrl: options.baseUrl,
-        redirectUri: `http://127.0.0.1:${address.port}/callback`
-      });
-      options.stderr.write(`Opening Rolino in your browser\u2026
-`);
+    server.listen(OAUTH_CALLBACK_PORT, "127.0.0.1", () => {
+      options.stderr.write("Opening Rolino OAuth sign-in in your browser\u2026\n");
       options.stderr.write(`If it does not open, visit:
 ${authorization.url}
 `);
@@ -617,16 +594,17 @@ ${authorization.url}
       void open(authorization.url).catch(() => void 0);
     });
     const timeout = setTimeout(() => {
-      finish(() => reject(new Error("Browser authorization timed out after 5 minutes.")));
-    }, CLI_BROWSER_AUTHORIZATION_TIMEOUT_MS);
+      finish(() => reject(new Error("OAuth sign-in timed out after 5 minutes.")));
+    }, OAUTH_TIMEOUT_MS);
   });
 }
 
 // src/cli.ts
 import {
-  clearStoredCredential,
-  resolveCredential,
-  saveStoredCredential
+  clearOAuthTokenSet,
+  createOAuthAccessTokenProvider,
+  resolveLocalAuthentication,
+  saveOAuthTokenSet
 } from "@rolino/local-auth";
 
 // src/output.ts
@@ -1022,6 +1000,10 @@ function mcpScope(value) {
   if (value === "user" || value === "project") return value;
   throw new InvalidArgumentError("MCP setup scope must be user or project.");
 }
+function mcpTransport(value) {
+  if (value === "auto" || value === "http" || value === "stdio") return value;
+  throw new InvalidArgumentError("MCP transport must be auto, http, or stdio.");
+}
 function isoDateTime(value) {
   const date = new Date(value);
   if (Number.isNaN(date.getTime())) {
@@ -1060,18 +1042,43 @@ async function requireWriteConsent(options) {
     );
   }
 }
+var BLOG_WEEKDAY_VALUES = {
+  sun: 0,
+  mon: 1,
+  tue: 2,
+  wed: 3,
+  thu: 4,
+  fri: 5,
+  sat: 6
+};
+function parseBlogWeekdays(value) {
+  const names = value.split(",").map((day) => day.trim().toLowerCase());
+  const weekdays = names.map((day) => BLOG_WEEKDAY_VALUES[day]).filter((day) => day !== void 0);
+  if (!weekdays.length || weekdays.length !== names.length || new Set(weekdays).size !== weekdays.length) {
+    throw new TypeError("--weekdays must contain unique comma-separated sun,mon,tue,wed,thu,fri,sat values.");
+  }
+  return weekdays;
+}
 function requireBlogExecutionConsent(options) {
   if (options.yes || resolveFormat(options.global, options.runtime) !== "human") return;
   throw new TypeError("This Blog execute command requires explicit consent. Review the confirmed operation and pass --yes.");
 }
 function formatMcpSetupPreview(result) {
+  const connection = result.server.transport === "http" ? [
+    `Transport: Streamable HTTP`,
+    `Endpoint: ${result.server.url}`,
+    "Authentication: OAuth in the MCP client"
+  ] : [
+    "Transport: local STDIO",
+    `Command: ${result.server.command}`,
+    `Arguments: ${result.server.args.join(" ")}`,
+    `Rolino URL: ${result.server.env.ROLINO_URL}`
+  ];
   return [
     `Client: ${result.client === "codex" ? "Codex" : "Claude Code"}`,
     `Scope: ${result.scope}`,
     `Target: ${result.target}`,
-    `Command: ${result.server.command}`,
-    `Arguments: ${result.server.args.join(" ")}`,
-    `Rolino URL: ${result.server.env.ROLINO_URL}`,
+    ...connection,
     "No token will be written to MCP configuration."
   ].join("\n");
 }
@@ -1090,16 +1097,16 @@ function baseUrlFor(options, runtime) {
 function clientFor(options, runtime) {
   const timeoutMs = options.timeout ?? (runtime.env.ROLINO_TIMEOUT ? duration(runtime.env.ROLINO_TIMEOUT) : 15e3);
   const baseUrl = baseUrlFor(options, runtime);
-  const credential = resolveCredential(baseUrl, runtime.env);
+  const token = runtime.env.ROLINO_TOKEN ?? createOAuthAccessTokenProvider({ baseUrl, env: runtime.env, fetch: runtime.fetch });
   return new RolinoClient({
     baseUrl,
-    token: credential.token ?? void 0,
+    token,
     timeoutMs,
     fetch: runtime.fetch
   });
 }
 function exitCodeFor(error) {
-  if (error instanceof CliAuthorizationDeniedError || error instanceof CliUserCancelledError) {
+  if (error instanceof OAuthAuthorizationDeniedError || error instanceof CliUserCancelledError) {
     return EXIT_CODES.cancelled;
   }
   if (error instanceof RolinoNetworkError) {
@@ -1132,7 +1139,7 @@ function exitCodeFor(error) {
   return EXIT_CODES.unexpected;
 }
 function errorForOutput(error) {
-  if (error instanceof CliAuthorizationDeniedError || error instanceof CliUserCancelledError) {
+  if (error instanceof OAuthAuthorizationDeniedError || error instanceof CliUserCancelledError) {
     return { code: "CANCELLED", message: error.message };
   }
   if (error instanceof RolinoApiError) {
@@ -1393,22 +1400,14 @@ async function runCli(argv = process.argv, overrides = {}) {
             "ROLINO_TOKEN is set and overrides browser login. Unset it before saving a CLI credential."
           );
         }
-        const meta = await client.meta({ requestId: context.requestId });
-        if (!meta.authentication.cliBrowserAuthorization) {
-          throw new TypeError(
-            "This Rolino server does not support browser CLI authorization."
-          );
-        }
-        const credential = await loginWithBrowser({
+        const tokenSet = await loginWithBrowser({
           baseUrl: client.baseUrl,
           stderr: runtime.stderr,
-          exchange: (input) => client.auth.exchangeCliAuthorization(input, {
-            requestId: context.requestId
-          })
+          fetch: runtime.fetch
         });
         const authenticatedClient = new RolinoClient({
           baseUrl: client.baseUrl,
-          token: credential.token,
+          token: tokenSet.accessToken,
           timeoutMs: client.timeoutMs,
           fetch: runtime.fetch
         });
@@ -1417,12 +1416,7 @@ async function runCli(argv = process.argv, overrides = {}) {
           const actor = await authenticatedClient.whoami({
             requestId: context.requestId
           });
-          const path = saveStoredCredential(client.baseUrl, {
-            token: credential.token,
-            createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-            expiresAt: credential.expiresAt,
-            organization: credential.organization
-          }, runtime.env);
+          const path = saveOAuthTokenSet(tokenSet, runtime.env);
           credentialSaved = true;
           writeSuccess(
             context,
@@ -1431,23 +1425,20 @@ async function runCli(argv = process.argv, overrides = {}) {
               user: actor.user,
               organization: actor.organization,
               capabilities: actor.capabilities,
-              expiresAt: credential.expiresAt
+              expiresAt: tokenSet.accessTokenExpiresAt
             },
             [
               `Authenticated as ${actor.user.email}.`,
               `Workspace: ${actor.organization.name}`,
-              `Expires: ${credential.expiresAt}`,
+              `Access token expires: ${tokenSet.accessTokenExpiresAt}`,
               `Credential saved in a permission-restricted file at ${path}`
             ].join("\n"),
             ["rolino whoami --agent", "rolino projects list --agent"]
           );
         } catch (error) {
           if (credentialSaved) {
-            clearStoredCredential(client.baseUrl, runtime.env);
+            clearOAuthTokenSet(client.baseUrl, runtime.env);
           }
-          await authenticatedClient.auth.revokeCurrentCredential({
-            requestId: context.requestId
-          }).catch(() => void 0);
           throw error;
         }
       }
@@ -1460,7 +1451,7 @@ async function runCli(argv = process.argv, overrides = {}) {
       global,
       runtime,
       async action(context, client) {
-        const credential = resolveCredential(client.baseUrl, runtime.env);
+        const credential = resolveLocalAuthentication(client.baseUrl, runtime.env);
         if (credential.source === "none") {
           writeSuccess(
             context,
@@ -1479,7 +1470,7 @@ async function runCli(argv = process.argv, overrides = {}) {
             baseUrl: client.baseUrl,
             user: actor.user,
             organization: actor.organization,
-            ...credential.source === "stored" ? { expiresAt: credential.credential.expiresAt } : {}
+            ...credential.source === "oauth" && credential.tokenSet ? { expiresAt: credential.tokenSet.accessTokenExpiresAt } : {}
           },
           [
             `Authenticated as ${actor.user.email}.`,
@@ -1497,7 +1488,7 @@ async function runCli(argv = process.argv, overrides = {}) {
       global,
       runtime,
       async action(context, client) {
-        const credential = resolveCredential(client.baseUrl, runtime.env);
+        const credential = resolveLocalAuthentication(client.baseUrl, runtime.env);
         if (credential.source === "environment") {
           throw new TypeError(
             "ROLINO_TOKEN is set. Remove it from the environment instead of using auth logout."
@@ -1511,15 +1502,36 @@ async function runCli(argv = process.argv, overrides = {}) {
           );
           return;
         }
-        try {
-          await client.auth.revokeCurrentCredential({
-            requestId: context.requestId
+        const tokenSet = credential.tokenSet;
+        const fetchImplementation = runtime.fetch ?? globalThis.fetch;
+        const accessToken = await createOAuthAccessTokenProvider({
+          baseUrl: client.baseUrl,
+          env: runtime.env,
+          fetch: fetchImplementation
+        })();
+        if (accessToken) {
+          const disconnect = await fetchImplementation(`${client.baseUrl}/api/v1/oauth/logout`, {
+            method: "POST",
+            headers: {
+              authorization: `Bearer ${accessToken}`,
+              accept: "application/json",
+              "x-request-id": context.requestId
+            }
           });
-        } catch (error) {
-          const alreadyUnavailable = error instanceof RolinoApiError && (error.code === "AUTH_REQUIRED" || error.code === "NOT_FOUND");
-          if (!alreadyUnavailable) throw error;
+          if (!disconnect.ok && disconnect.status !== 401 && disconnect.status !== 404) {
+            throw new TypeError("Rolino could not disconnect the OAuth workspace grant.");
+          }
         }
-        clearStoredCredential(client.baseUrl, runtime.env);
+        await fetchImplementation(`${tokenSet.issuer}/oauth2/revoke`, {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            token: tokenSet.refreshToken,
+            token_type_hint: "refresh_token",
+            client_id: tokenSet.clientId
+          })
+        }).catch(() => void 0);
+        clearOAuthTokenSet(client.baseUrl, runtime.env);
         writeSuccess(
           context,
           { revoked: true, baseUrl: client.baseUrl },
@@ -1529,7 +1541,7 @@ async function runCli(argv = process.argv, overrides = {}) {
     });
   });
   const setup = program.command("setup").description("Configure local agent tools for Rolino");
-  setup.command("mcp").description("Configure the Rolino stdio MCP server for a supported client").requiredOption("--client <client>", "codex or claude-code", mcpClient).option("--scope <scope>", "user or project", mcpScope, "user").option("--server-path <path>", "absolute or working-directory-relative MCP server path").option("--dry-run", "show the intended configuration without writing it").option("--yes", "apply without an interactive confirmation").option("--force", "replace an existing Claude Code user-scoped Rolino server").action(async (local) => {
+  setup.command("mcp").description("Configure Rolino MCP with Streamable HTTP or local STDIO").requiredOption("--client <client>", "codex or claude-code", mcpClient).option("--scope <scope>", "user or project", mcpScope, "user").option("--transport <transport>", "auto, http, or stdio", mcpTransport, "auto").option("--server-path <path>", "absolute or working-directory-relative MCP server path").option("--dry-run", "show the intended configuration without writing it").option("--yes", "apply without an interactive confirmation").option("--force", "replace an existing Claude Code user-scoped Rolino server").action(async (local) => {
     const global = program.opts();
     commandExitCode = await execute({
       command: "setup mcp",
@@ -1542,7 +1554,8 @@ async function runCli(argv = process.argv, overrides = {}) {
           cwd: runtime.cwd,
           env: runtime.env,
           nodePath: runtime.nodePath,
-          cliEntryPath: runtime.cliEntryPath
+          cliEntryPath: runtime.cliEntryPath,
+          fetch: runtime.fetch
         };
         const preview = await setupMcp({ ...setupOptions, dryRun: true });
         let result = preview;
@@ -1569,11 +1582,12 @@ async function runCli(argv = process.argv, overrides = {}) {
             `${state} Rolino MCP for ${clientLabel}.`,
             `Scope: ${result.scope}`,
             `Target: ${result.target}`,
+            `Transport: ${result.transport === "http" ? "Streamable HTTP" : "local STDIO"}`,
             ...result.backupPath && !result.dryRun ? [`Backup: ${result.backupPath}`] : [],
             `Rolino URL: ${client.baseUrl}`,
             "No token was written to MCP configuration."
           ].join("\n"),
-          result.client === "codex" ? ["codex mcp list", "rolino auth login"] : ["claude mcp get rolino", "rolino auth login"]
+          result.client === "codex" ? result.transport === "http" ? ["codex mcp login rolino", "codex mcp list"] : ["rolino auth login", "codex mcp list"] : result.transport === "http" ? ["claude mcp get rolino", "Complete OAuth when Claude prompts you"] : ["rolino auth login", "claude mcp get rolino"]
         );
       }
     });
@@ -1598,7 +1612,7 @@ async function runCli(argv = process.argv, overrides = {}) {
     });
   });
   const posts = program.command("posts").description("Read and prepare posts in a Rolino project");
-  posts.command("create").description("Create a draft post without scheduling or publishing it").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--caption <text>", "draft caption; use an empty string for media-only drafts").option("--platform <provider>", "INSTAGRAM, TIKTOK, YOUTUBE, BLUESKY, or LINKEDIN; repeat as needed", collectPublishingProvider, []).option("--media <asset-id>", "existing project media asset ID; repeat for multiple", collectString, []).option("--instagram-caption <text>", "Instagram-specific caption override").option("--tiktok-caption <text>", "TikTok-specific caption override").option("--tiktok-mode <mode>", "direct publishing or inbox draft delivery", tiktokPostMode).option("--tiktok-visibility <value>", "exact visibility returned by integrations delivery-options").option("--tiktok-comments <yes|no>", "allow TikTok comments", yesOrNo).option("--tiktok-duet <yes|no>", "allow TikTok duets", yesOrNo).option("--tiktok-stitch <yes|no>", "allow TikTok stitches", yesOrNo).option("--tiktok-commercial-content <yes|no>", "declare commercial TikTok content", yesOrNo).option("--tiktok-promotes-own-brand <yes|no>", "declare own-brand promotion", yesOrNo).option("--tiktok-promotes-third-party <yes|no>", "declare third-party promotion", yesOrNo).option("--tiktok-ai-generated <yes|no>", "declare AI-generated TikTok content", yesOrNo).option("--tiktok-cover-timestamp-ms <number>", "video cover timestamp in milliseconds", nonnegativeInteger).option("--tiktok-settings-reviewed", "confirm the TikTok account choices were reviewed; separate from --yes").option("--youtube-caption <text>", "YouTube description override; otherwise the shared caption is used").option("--bluesky-caption <text>", "Bluesky-specific caption override; limited to 300 graphemes").option("--linkedin-caption <text>", "LinkedIn-specific caption override; limited to 3,000 characters").option("--youtube-title <text>", "required YouTube video title").option("--youtube-category-id <id>", "required numeric YouTube video category ID").option("--youtube-privacy <status>", "required PUBLIC, UNLISTED, or PRIVATE visibility", youtubePrivacy).option("--youtube-made-for-kids <yes|no>", "required explicit YouTube audience declaration", yesOrNo).option("--youtube-synthetic-media", "declare realistic altered or synthetic media to YouTube").option("--no-youtube-notify-subscribers", "disable eligible YouTube subscriber notifications").option("--youtube-tag <tag>", "YouTube tag; repeat as needed", collectString, []).option("--idempotency-key <key>", "stable retry key; defaults to the request ID").option("--yes", "confirm creation without an interactive prompt").action(async (local) => {
+  posts.command("create").description("Create a draft post without scheduling or publishing it").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--caption <text>", "draft caption; use an empty string for media-only drafts").option("--platform <provider>", "INSTAGRAM, TIKTOK, YOUTUBE, BLUESKY, LINKEDIN, or GOOGLE_BUSINESS_PROFILE; repeat as needed", collectPublishingProvider, []).option("--media <asset-id>", "existing project media asset ID; repeat for multiple", collectString, []).option("--instagram-caption <text>", "Instagram-specific caption override").option("--tiktok-caption <text>", "TikTok-specific caption override").option("--tiktok-mode <mode>", "direct publishing or inbox draft delivery", tiktokPostMode).option("--tiktok-visibility <value>", "exact visibility returned by integrations delivery-options").option("--tiktok-comments <yes|no>", "allow TikTok comments", yesOrNo).option("--tiktok-duet <yes|no>", "allow TikTok duets", yesOrNo).option("--tiktok-stitch <yes|no>", "allow TikTok stitches", yesOrNo).option("--tiktok-commercial-content <yes|no>", "declare commercial TikTok content", yesOrNo).option("--tiktok-promotes-own-brand <yes|no>", "declare own-brand promotion", yesOrNo).option("--tiktok-promotes-third-party <yes|no>", "declare third-party promotion", yesOrNo).option("--tiktok-ai-generated <yes|no>", "declare AI-generated TikTok content", yesOrNo).option("--tiktok-cover-timestamp-ms <number>", "video cover timestamp in milliseconds", nonnegativeInteger).option("--tiktok-settings-reviewed", "confirm the TikTok account choices were reviewed; separate from --yes").option("--youtube-caption <text>", "YouTube description override; otherwise the shared caption is used").option("--bluesky-caption <text>", "Bluesky-specific caption override; limited to 300 graphemes").option("--linkedin-caption <text>", "LinkedIn-specific caption override; limited to 3,000 characters").option("--google-business-profile-caption <text>", "Google Business Profile update override; limited to 1,500 characters").option("--youtube-title <text>", "required YouTube video title").option("--youtube-category-id <id>", "required numeric YouTube video category ID").option("--youtube-privacy <status>", "required PUBLIC, UNLISTED, or PRIVATE visibility", youtubePrivacy).option("--youtube-made-for-kids <yes|no>", "required explicit YouTube audience declaration", yesOrNo).option("--youtube-synthetic-media", "declare realistic altered or synthetic media to YouTube").option("--no-youtube-notify-subscribers", "disable eligible YouTube subscriber notifications").option("--youtube-tag <tag>", "YouTube tag; repeat as needed", collectString, []).option("--idempotency-key <key>", "stable retry key; defaults to the request ID").option("--yes", "confirm creation without an interactive prompt").action(async (local) => {
     const global = program.opts();
     commandExitCode = await execute({
       command: "posts create",
@@ -1625,7 +1639,8 @@ async function runCli(argv = process.argv, overrides = {}) {
             ...local.tiktokCaption === void 0 ? {} : { TIKTOK: local.tiktokCaption },
             ...local.youtubeCaption === void 0 ? {} : { YOUTUBE: local.youtubeCaption },
             ...local.blueskyCaption === void 0 ? {} : { BLUESKY: local.blueskyCaption },
-            ...local.linkedinCaption === void 0 ? {} : { LINKEDIN: local.linkedinCaption }
+            ...local.linkedinCaption === void 0 ? {} : { LINKEDIN: local.linkedinCaption },
+            ...local.googleBusinessProfileCaption === void 0 ? {} : { GOOGLE_BUSINESS_PROFILE: local.googleBusinessProfileCaption }
           },
           tiktokSettings: tiktokSettings(local) ?? null,
           youtubeSettings: youtubeSettings(local)
@@ -1643,7 +1658,7 @@ async function runCli(argv = process.argv, overrides = {}) {
       }
     });
   });
-  posts.command("update").description("Update selected draft fields using optimistic concurrency").argument("<post-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--expected-version <number>", "current post version from posts show", positiveInteger).option("--caption <text>", "replacement draft caption; omitted fields are preserved").option("--platform <provider>", "replacement destinations; repeat as needed", collectPublishingProvider).option("--clear-platforms", "remove every draft destination").option("--media <asset-id>", "replacement media asset ID; repeat for multiple", collectString).option("--clear-media", "remove every media asset from the draft").option("--instagram-caption <text>", "Instagram-specific caption override").option("--tiktok-caption <text>", "TikTok-specific caption override").option("--tiktok-mode <mode>", "direct publishing or inbox draft delivery", tiktokPostMode).option("--tiktok-visibility <value>", "exact visibility returned by integrations delivery-options").option("--tiktok-comments <yes|no>", "allow TikTok comments", yesOrNo).option("--tiktok-duet <yes|no>", "allow TikTok duets", yesOrNo).option("--tiktok-stitch <yes|no>", "allow TikTok stitches", yesOrNo).option("--tiktok-commercial-content <yes|no>", "declare commercial TikTok content", yesOrNo).option("--tiktok-promotes-own-brand <yes|no>", "declare own-brand promotion", yesOrNo).option("--tiktok-promotes-third-party <yes|no>", "declare third-party promotion", yesOrNo).option("--tiktok-ai-generated <yes|no>", "declare AI-generated TikTok content", yesOrNo).option("--tiktok-cover-timestamp-ms <number>", "video cover timestamp in milliseconds", nonnegativeInteger).option("--tiktok-settings-reviewed", "confirm the TikTok account choices were reviewed; separate from --yes").option("--youtube-caption <text>", "YouTube description override; otherwise the shared caption is used").option("--bluesky-caption <text>", "Bluesky-specific caption override; limited to 300 graphemes").option("--linkedin-caption <text>", "LinkedIn-specific caption override; limited to 3,000 characters").option("--youtube-title <text>", "required YouTube video title").option("--youtube-category-id <id>", "required numeric YouTube video category ID").option("--youtube-privacy <status>", "required PUBLIC, UNLISTED, or PRIVATE visibility", youtubePrivacy).option("--youtube-made-for-kids <yes|no>", "required explicit YouTube audience declaration", yesOrNo).option("--youtube-synthetic-media", "declare realistic altered or synthetic media to YouTube").option("--no-youtube-notify-subscribers", "disable eligible YouTube subscriber notifications").option("--youtube-tag <tag>", "replacement YouTube tag; repeat as needed", collectString).option("--idempotency-key <key>", "stable retry key; defaults to the request ID").option("--yes", "confirm the update without an interactive prompt").action(async (postId, local) => {
+  posts.command("update").description("Update selected draft fields using optimistic concurrency").argument("<post-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--expected-version <number>", "current post version from posts show", positiveInteger).option("--caption <text>", "replacement draft caption; omitted fields are preserved").option("--platform <provider>", "replacement destinations; repeat as needed", collectPublishingProvider).option("--clear-platforms", "remove every draft destination").option("--media <asset-id>", "replacement media asset ID; repeat for multiple", collectString).option("--clear-media", "remove every media asset from the draft").option("--instagram-caption <text>", "Instagram-specific caption override").option("--tiktok-caption <text>", "TikTok-specific caption override").option("--tiktok-mode <mode>", "direct publishing or inbox draft delivery", tiktokPostMode).option("--tiktok-visibility <value>", "exact visibility returned by integrations delivery-options").option("--tiktok-comments <yes|no>", "allow TikTok comments", yesOrNo).option("--tiktok-duet <yes|no>", "allow TikTok duets", yesOrNo).option("--tiktok-stitch <yes|no>", "allow TikTok stitches", yesOrNo).option("--tiktok-commercial-content <yes|no>", "declare commercial TikTok content", yesOrNo).option("--tiktok-promotes-own-brand <yes|no>", "declare own-brand promotion", yesOrNo).option("--tiktok-promotes-third-party <yes|no>", "declare third-party promotion", yesOrNo).option("--tiktok-ai-generated <yes|no>", "declare AI-generated TikTok content", yesOrNo).option("--tiktok-cover-timestamp-ms <number>", "video cover timestamp in milliseconds", nonnegativeInteger).option("--tiktok-settings-reviewed", "confirm the TikTok account choices were reviewed; separate from --yes").option("--youtube-caption <text>", "YouTube description override; otherwise the shared caption is used").option("--bluesky-caption <text>", "Bluesky-specific caption override; limited to 300 graphemes").option("--linkedin-caption <text>", "LinkedIn-specific caption override; limited to 3,000 characters").option("--google-business-profile-caption <text>", "Google Business Profile update override; limited to 1,500 characters").option("--youtube-title <text>", "required YouTube video title").option("--youtube-category-id <id>", "required numeric YouTube video category ID").option("--youtube-privacy <status>", "required PUBLIC, UNLISTED, or PRIVATE visibility", youtubePrivacy).option("--youtube-made-for-kids <yes|no>", "required explicit YouTube audience declaration", yesOrNo).option("--youtube-synthetic-media", "declare realistic altered or synthetic media to YouTube").option("--no-youtube-notify-subscribers", "disable eligible YouTube subscriber notifications").option("--youtube-tag <tag>", "replacement YouTube tag; repeat as needed", collectString).option("--idempotency-key <key>", "stable retry key; defaults to the request ID").option("--yes", "confirm the update without an interactive prompt").action(async (postId, local) => {
     const global = program.opts();
     commandExitCode = await execute({
       command: "posts update",
@@ -1672,7 +1687,8 @@ async function runCli(argv = process.argv, overrides = {}) {
           ...local.tiktokCaption === void 0 ? {} : { TIKTOK: local.tiktokCaption },
           ...local.youtubeCaption === void 0 ? {} : { YOUTUBE: local.youtubeCaption },
           ...local.blueskyCaption === void 0 ? {} : { BLUESKY: local.blueskyCaption },
-          ...local.linkedinCaption === void 0 ? {} : { LINKEDIN: local.linkedinCaption }
+          ...local.linkedinCaption === void 0 ? {} : { LINKEDIN: local.linkedinCaption },
+          ...local.googleBusinessProfileCaption === void 0 ? {} : { GOOGLE_BUSINESS_PROFILE: local.googleBusinessProfileCaption }
         };
         const resolvedTikTokSettings = tiktokSettings(local);
         const resolvedYouTubeSettings = youtubeSettings(local);
@@ -1820,7 +1836,7 @@ async function runCli(argv = process.argv, overrides = {}) {
     });
   });
   const publish = posts.command("publish").description("Preview and queue server-confirmed immediate publishing");
-  publish.command("preview").description("Validate exact destinations and issue a five-minute confirmation").argument("<post-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--expected-version <number>", "current post version from posts show", positiveInteger).requiredOption("--platform <provider>", "INSTAGRAM, TIKTOK, YOUTUBE, BLUESKY, or LINKEDIN; repeat as needed", collectPublishingProvider).action(async (postId, local) => {
+  publish.command("preview").description("Validate exact destinations and issue a five-minute confirmation").argument("<post-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--expected-version <number>", "current post version from posts show", positiveInteger).requiredOption("--platform <provider>", "INSTAGRAM, TIKTOK, YOUTUBE, BLUESKY, LINKEDIN, or GOOGLE_BUSINESS_PROFILE; repeat as needed", collectPublishingProvider).action(async (postId, local) => {
     const global = program.opts();
     commandExitCode = await execute({
       command: "posts publish preview",
@@ -1977,6 +1993,52 @@ async function runCli(argv = process.argv, overrides = {}) {
       writeSuccess(context, data, JSON.stringify(data, null, 2));
     } });
   });
+  const blogWebhook = blogPublishing.command("webhook").description("Configure a signed custom Blog publishing webhook");
+  const addWebhookChangeOptions = (command, executeChange) => {
+    command.requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--site <site-id>", "exact Blog site ID").requiredOption("--name <name>", "destination name").requiredOption("--endpoint <https-url>", "public HTTPS receiver URL").requiredOption("--semantics <mode>", "DRAFT or LIVE").option("--destination <destination-id>", "saved destination to update");
+    if (executeChange) command.requiredOption("--confirmation-token <token>", "short-lived token returned by preview").requiredOption("--idempotency-key <key>", "stable retry key").option("--yes", "confirm the exact webhook change");
+    return command;
+  };
+  addWebhookChangeOptions(blogWebhook.command("preview"), false).action(async (local) => {
+    const input = { destinationId: local.destination, siteId: local.site, name: local.name, endpoint: local.endpoint, semantics: local.semantics.toUpperCase() };
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog destinations webhook preview", global, runtime, async action(context, client) {
+      const data = await client.blog.publishing.webhook.preview(local.project, input, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  addWebhookChangeOptions(blogWebhook.command("execute"), true).action(async (local) => {
+    const input = { destinationId: local.destination, siteId: local.site, name: local.name, endpoint: local.endpoint, semantics: local.semantics.toUpperCase() };
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog destinations webhook execute", global, runtime, async action(context, client) {
+      await requireWriteConsent({ yes: local.yes, global, runtime, preview: `Apply the previewed custom webhook change for project ${local.project}? Store a returned signing secret only in the receiver's server environment. Test the connection before publication.` });
+      const data = await client.blog.publishing.webhook.execute(local.project, { ...input, confirmationToken: local.confirmationToken, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogWebhook.command("test").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--site <site-id>", "exact Blog site ID").requiredOption("--destination <destination-id>", "saved destination ID").option("--make-primary", "make a successful LIVE destination primary").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog destinations webhook test", global, runtime, async action(context, client) {
+      const data = await client.blog.publishing.webhook.test(local.project, { siteId: local.site, destinationId: local.destination, makePrimary: local.makePrimary }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const blogWebhookRotate = blogWebhook.command("rotate").description("Rotate the server-only signing secret");
+  blogWebhookRotate.command("preview").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--site <site-id>", "exact Blog site ID").requiredOption("--destination <destination-id>", "saved destination ID").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog destinations webhook rotate preview", global, runtime, async action(context, client) {
+      const data = await client.blog.publishing.webhook.previewRotation(local.project, { siteId: local.site, destinationId: local.destination }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogWebhookRotate.command("execute").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--site <site-id>", "exact Blog site ID").requiredOption("--destination <destination-id>", "saved destination ID").requiredOption("--confirmation-token <token>", "short-lived token returned by rotation preview").requiredOption("--idempotency-key <key>", "stable retry key").option("--yes", "confirm immediate secret invalidation").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog destinations webhook rotate execute", global, runtime, async action(context, client) {
+      await requireWriteConsent({ yes: local.yes, global, runtime, preview: `Rotate the signing secret for destination ${local.destination}? The old secret stops working at once. Store the new secret only in the receiver's server environment, then test before publication.` });
+      const data = await client.blog.publishing.webhook.executeRotation(local.project, { siteId: local.site, destinationId: local.destination, confirmationToken: local.confirmationToken, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
   const blogSetup = blog.command("setup").description("Inspect agent-first Blog setup readiness");
   blogSetup.command("status").requiredOption("--project <project-id>", "exact Rolino project ID").action(async (local) => {
     const global = program.opts();
@@ -2009,9 +2071,7 @@ async function runCli(argv = process.argv, overrides = {}) {
   });
   const blogPlan = blog.command("plan").description("Create, retry, and review a Blog cadence plan");
   blogPlan.command("create").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--start <date>", "local start date as YYYY-MM-DD").requiredOption("--weekdays <days>", "comma-separated weekday names such as mon,wed,fri").option("--time-zone <zone>", "IANA time zone", "UTC").requiredOption("--idempotency-key <key>", "stable retry key").action(async (local) => {
-    const weekdayMap = { sun: 0, mon: 1, tue: 2, wed: 3, thu: 4, fri: 5, sat: 6 };
-    const weekdays = local.weekdays.split(",").map((day) => weekdayMap[day.trim().toLowerCase()]).filter((day) => day !== void 0);
-    if (!weekdays.length || weekdays.length !== local.weekdays.split(",").length) throw new TypeError("--weekdays must contain comma-separated sun,mon,tue,wed,thu,fri,sat values.");
+    const weekdays = parseBlogWeekdays(local.weekdays);
     const global = program.opts();
     commandExitCode = await execute({ command: "blog plan create", global, runtime, async action(context, client) {
       const data = await client.blog.plans.create(local.project, { startsOn: local.start, weekdays, timeZone: local.timeZone }, local.idempotencyKey, { requestId: context.requestId });
@@ -2025,6 +2085,25 @@ async function runCli(argv = process.argv, overrides = {}) {
       writeSuccess(context, data, JSON.stringify(data, null, 2));
     } });
   });
+  const blogPlanCadence = blogPlan.command("cadence").description("Preview or apply editorial cadence changes without publishing");
+  blogPlanCadence.command("preview").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--plan <plan-id>", "exact Blog plan ID").requiredOption("--weekdays <days>", "unique comma-separated weekday names such as mon,wed,fri").requiredOption("--expected-plan-version <version>", "version returned by the latest plan read", Number).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog plan cadence preview", global, runtime, async action(context, client) {
+      const data = await client.blog.plans.previewCadence(local.project, local.plan, { weekdays: parseBlogWeekdays(local.weekdays), expectedPlanVersion: local.expectedPlanVersion }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  blogPlanCadence.command("apply").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--plan <plan-id>", "exact Blog plan ID").requiredOption("--weekdays <days>", "unchanged weekdays from cadence preview").requiredOption("--expected-plan-version <version>", "unchanged plan version from cadence preview", Number).requiredOption("--expected-schedule-digest <digest>", "unchanged schedule digest from cadence preview").requiredOption("--confirmation-token <token>", "short-lived token returned by cadence preview").requiredOption("--idempotency-key <key>", "stable retry key").option("--yes", "confirm the editorial cadence change").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "blog plan cadence apply", global, runtime, async action(context, client) {
+      await requireWriteConsent({ yes: local.yes, global, runtime, preview: `Apply the previewed editorial cadence change?
+Project: ${local.project}
+Plan: ${local.plan}
+This moves eligible editorial dates only. It does not schedule, publish, or unpublish an article.` });
+      const data = await client.blog.plans.executeCadence(local.project, local.plan, { weekdays: parseBlogWeekdays(local.weekdays), expectedPlanVersion: local.expectedPlanVersion, expectedScheduleDigest: local.expectedScheduleDigest, confirmationToken: local.confirmationToken, idempotencyKey: local.idempotencyKey }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
   blogPlan.command("items").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--plan <plan-id>", "exact Blog plan ID").action(async (local) => {
     const global = program.opts();
     commandExitCode = await execute({ command: "blog plan items", global, runtime, async action(context, client) {
@@ -2247,6 +2326,106 @@ Revision: ${local.revision}` });
       writeSuccess(context, data, JSON.stringify(data, null, 2));
     } });
   });
+  const backlinks = program.command("backlinks").description("Review backlink prospects and public contact drafts. Rolino never sends email.");
+  const backlinkTargets = backlinks.command("targets");
+  backlinkTargets.command("list").requiredOption("--project <project-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks targets list", global, runtime, async action(context, client) {
+      const data = await client.backlinks.targets.list(local.project, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkTargets.command("add").requiredOption("--project <project-id>").requiredOption("--url <url>").requiredOption("--label <label>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks targets add", global, runtime, async action(context, client) {
+      const data = await client.backlinks.targets.add(local.project, { url: local.url, label: local.label }, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinks.command("discover").requiredOption("--project <project-id>").option("--limit <number>", "maximum saved prospects", Number, 20).option("--idempotency-key <key>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks discover", global, runtime, async action(context, client) {
+      const data = await client.backlinks.discoveries.start(local.project, { limit: local.limit }, local.idempotencyKey ?? context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const backlinkRuns = backlinks.command("runs");
+  backlinkRuns.command("get").requiredOption("--project <project-id>").requiredOption("--run <run-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks runs get", global, runtime, async action(context, client) {
+      const data = await client.backlinks.discoveries.get(local.project, local.run, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const backlinkProspects = backlinks.command("prospects");
+  backlinkProspects.command("list").requiredOption("--project <project-id>").option("--stage <stage>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks prospects list", global, runtime, async action(context, client) {
+      const stage = local.stage ? BacklinkProspectStageSchema.parse(local.stage.toUpperCase()) : void 0;
+      const data = await client.backlinks.prospects.list(local.project, { stage }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkProspects.command("get").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks prospects get", global, runtime, async action(context, client) {
+      const data = await client.backlinks.prospects.get(local.project, local.prospect, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkProspects.command("approve").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").requiredOption("--expected-version <number>", "current optimistic version", Number).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks prospects approve", global, runtime, async action(context, client) {
+      const data = await client.backlinks.prospects.updateStage(local.project, local.prospect, { stage: "APPROVED", expectedVersion: local.expectedVersion }, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const backlinkContacts = backlinks.command("contacts");
+  backlinkContacts.command("research").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks contacts research", global, runtime, async action(context, client) {
+      const data = await client.backlinks.prospects.researchContact(local.project, local.prospect, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkContacts.command("list").requiredOption("--project <project-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks contacts list", global, runtime, async action(context, client) {
+      const data = await client.backlinks.contacts.list(local.project, { limit: 50 }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkContacts.command("export").requiredOption("--project <project-id>").option("--format <format>", "json or csv", "csv").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks contacts export", global, runtime, async action(context, client) {
+      const data = await client.backlinks.contacts.list(local.project, { limit: 50 }, { requestId: context.requestId });
+      if (local.format !== "csv") return writeSuccess(context, data, JSON.stringify(data, null, 2));
+      const cell = (value) => {
+        let text = String(value ?? "").replace(/[\r\n]+/g, " ");
+        if (/^[=+\-@\t]/.test(text)) text = `'${text}`;
+        return `"${text.replaceAll('"', '""')}"`;
+      };
+      const csv = ["prospectId,name,role,email,sourceUrl,checkedAt", ...data.items.map((item) => [item.prospectId, item.name, item.role, item.email, item.sourceUrl, item.checkedAt].map(cell).join(","))].join("\n");
+      context.stdout.write(`${csv}
+`);
+    } });
+  });
+  const backlinkOutreach = backlinks.command("outreach");
+  backlinkOutreach.command("update").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").requiredOption("--file <file>").requiredOption("--expected-version <number>", "current draft version", Number).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks outreach update", global, runtime, async action(context, client) {
+      const payload = JSON.parse(await readFile2(resolve2(runtime.cwd, local.file), "utf8"));
+      const data = await client.backlinks.prospects.updateOutreach(local.project, local.prospect, { ...payload, expectedVersion: local.expectedVersion }, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinks.command("verify").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").requiredOption("--url <url>").requiredOption("--expected-version <number>", "current prospect version", Number).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks verify", global, runtime, async action(context, client) {
+      const data = await client.backlinks.prospects.verify(local.project, local.prospect, { url: local.url, expectedVersion: local.expectedVersion }, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
   const seo = program.command("seo").description("Read authorized SEO opportunities and weekly reports");
   const seoOpportunities = seo.command("opportunities").description("Read accepted SEO opportunities");
   seoOpportunities.command("list").description("List bounded SEO opportunities").requiredOption("--project <project-id>", "exact Rolino project ID").option("--limit <number>", "maximum opportunities to return", (value) => {
@@ -2344,7 +2523,7 @@ Revision: ${local.revision}` });
             message: meta.mcp.streamableHttp ? "Remote Streamable HTTP is available." : "Remote MCP is gated; use the stdio server."
           }
         ];
-        const credential = resolveCredential(client.baseUrl, runtime.env);
+        const credential = resolveLocalAuthentication(client.baseUrl, runtime.env);
         if (credential.source !== "none") {
           const actor = await client.whoami({ requestId: context.requestId });
           checks.push({
@@ -2412,4 +2591,4 @@ export {
   ROLINO_CLI_VERSION,
   runCli
 };
-//# sourceMappingURL=chunk-MBZL2CK6.js.map
+//# sourceMappingURL=chunk-PEJ2WA66.js.map