@rolino/contracts 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # @rolino/contracts
 
+## 0.5.0
+
+### Minor Changes
+
+- 4f9e790: Add the optional `blog:manage` capability and synchronized agent-first Blog
+  setup, import, cadence planning, plan review, article creation, confirmed
+  connection provisioning, and safe verification operations.
+- 1edd1e7: Add published Blog Studio delivery contracts and the server-only Next.js 16 Blog Studio package.
+- 74a13ea: Expose immediate versus scheduled delivery and destination lifecycle stages,
+  preserve YouTube visibility for immediate publishing, and clarify remote
+  schedule confirmation across public clients.
+- 4af607d: Add independent exact-bundle Blog approval, reviewed image upload and generation,
+  confirmed publication scheduling and cancellation, and the complete authorized
+  agent workflow without widening existing credentials.
+- 4a893dd: Add provider-neutral Blog publishing destinations, safe delivery inspection,
+  and exact destination binding across public agent interfaces.
+- 843a1db: Add the exact optional `seo:read` capability and bounded read-only SEO
+  opportunity and weekly-report parity across public agent contracts, clients,
+  CLI commands, and closed-world MCP tools. SEO reads now use the version 3 task
+  contract with the exact Ready, Research, or Rejected decision, selected format,
+  complete deliverables, bounded evidence, safe URLs, limitations, and no-publish
+  rules. Public output uses readable topic names and separate topic-relevance and
+  action-readiness confidence. Research tasks compare all supported formats and
+  must validate or reject the finding before a separate draft action is allowed.
+
+## 0.5.0-beta.0
+
+### Minor Changes
+
+- 4f9e790: Add the optional `blog:manage` capability and synchronized agent-first Blog
+  setup, import, cadence planning, plan review, article creation, confirmed
+  connection provisioning, and safe verification operations.
+- 1edd1e7: Add published Blog Studio delivery contracts and the server-only Next.js 16 Blog Studio package.
+- 74a13ea: Expose immediate versus scheduled delivery and destination lifecycle stages,
+  preserve YouTube visibility for immediate publishing, and clarify remote
+  schedule confirmation across public clients.
+- 4a893dd: Add provider-neutral Blog publishing destinations, safe delivery inspection,
+  and exact destination binding across public agent interfaces.
+- 843a1db: Add the exact optional `seo:read` capability and bounded read-only SEO
+  opportunity and weekly-report parity across public agent contracts, clients,
+  CLI commands, and closed-world MCP tools. SEO reads now use the version 3 task
+  contract with the exact Ready, Research, or Rejected decision, selected format,
+  complete deliverables, bounded evidence, safe URLs, limitations, and no-publish
+  rules. Public output uses readable topic names and separate topic-relevance and
+  action-readiness confidence. Research tasks compare all supported formats and
+  must validate or reject the finding before a separate draft action is allowed.
+
+## Unreleased
+
+### Minor Changes
+
+- Add exact Blog image, approval-bundle, scheduling, cancellation, provenance,
+  idempotency, and safe public-state contracts while keeping `blog:write`,
+  `blog:approve`, and `blog:publish` independent.
+- Add the independent optional `blog:approve` capability without widening existing Blog credentials or combining draft, approval, and publication access.
+- Add safe Blog publishing provider, destination, delivery-attempt, and exact destination-selection contracts.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -4,7 +4,7 @@ Zod schemas and TypeScript types for Rolino's versioned public API. This package
 contains transport-safe DTOs only; it must not depend on Prisma, Next.js, auth
 providers, or server implementation details.
 
-Contract 0.14 covers discovery, identity, capabilities, project reads and
+Contract 0.15 covers discovery, identity, capabilities, project reads and
 idempotent project creation, safe post and calendar reads, idempotent draft
 writes, and server-confirmed Instagram, TikTok, YouTube, Bluesky, and LinkedIn scheduling
 and immediate publishing. YouTube additions include explicit draft settings,
@@ -13,14 +13,57 @@ reconciliation. Bluesky additions include 300-grapheme caption overrides,
 text-only and image readiness, health, scheduling, and publishing. TikTok
 additions include separately reviewed draft choices, secret-safe account-level
 delivery options, server-stamped review time, and exact interaction enforcement.
-LinkedIn additions include a 3,000-character destination override, text,
-single/multi-image, and single-video readiness, plus a strict member-delivery-options
-variant that exposes JPEG/PNG and native MP4 limits without credentials.
+LinkedIn additions include a 3,000-character destination override, text,
+single/multi-image, and single-video readiness, plus a strict member-delivery-options
+variant that exposes JPEG/PNG and native MP4 limits without credentials.
 Draft updates are partial, and post reads expose reusable asset IDs plus
 provider-keyed sanitized settings so future provider variants remain additive.
+It also adds the exact optional `seo:read` capability plus bounded read-only
+opportunity and weekly-report DTOs. These SEO DTOs contain canonical versioned tasks,
+safe evidence, neutral provenance, separate topic-relevance and action-readiness
+confidence, and recommended actions. They
+exclude credentials, provider names, raw responses, provider request IDs, cost
+data, signal IDs, and integration IDs.
+The additive task has an exact `READY`, `NEEDS_REVIEW`, or `REJECTED` decision,
+selected format, unbiased format options for Research, keyword target, exact deliverables, research, safe URLs,
+evidence, limitations, success metric, and execution boundaries. Accepted
+opportunities expose `READY` or `NEEDS_REVIEW`; a rejected finding has no active
+task. A Research task selects only `RESEARCH_TASK`, names no preferred final
+format, and returns `VALIDATED` with a complete next task or `REJECTED` with
+evidence before any separate draft action. Older stored reports receive a review-only compatibility task
+when read; their saved snapshots are not changed.
+
+Blog Studio contracts include provider catalog entries, safe publishing
+destination readiness, delivery-attempt summaries, and exact destination
+selection for approval, publication, scheduling, and cancellation preview and
+execution. The independent `blog:approve` capability binds one immutable
+revision and reviewed-image snapshot. `blog:publish` does not grant approval,
+and `blog:write` cannot approve or publish. Existing credentials do not gain a
+new capability. Provider catalog reads require
+`blog:manage`. Destination and delivery-attempt reads require `blog:read`.
+These DTOs omit draft content, prompts, evidence, secrets, encrypted values,
+and raw provider responses. A contract type does not make a hidden provider
+available; the server rollout registry remains authoritative.
+
+Clients must read current setup and article or plan state, resolve missing
+website, cadence, destination, and access-level choices, poll import and plan
+jobs, present evidence, create one immutable revision with catalog-backed
+links, review one generated or approved uploaded image and its alt text, stop
+when approval or publication scope is missing, use confirmation-bound and
+idempotent approval before publication, verify live delivery, and restart from
+approval preview after any content or image change. A queued delivery is not a
+published delivery.
+
 Project and post DTOs intentionally omit storage credentials, upload sessions,
 tokens, and other publishing-provider internals.
 
+Every destination reports an explicit `deliveryMode` (`IMMEDIATE` or
+`SCHEDULED`) and lifecycle `stage`. For YouTube, immediate delivery preserves
+the requested Public, Unlisted, or Private visibility and never creates a
+schedule. Scheduled delivery requires Public visibility; Rolino uploads the
+video privately first, and `CONFIRMING_SCHEDULE` means the upload is complete
+while YouTube acknowledges the requested future publish time.
+
 Contract support does not imply that a deployment enabled YouTube, Bluesky, or LinkedIn,
 or completed Google/YouTube review. Servers remain authoritative for provider
 gates, readiness, confirmation, and reconciliation. Operators should follow the