@rolino/contracts 0.5.0-beta.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @rolino/contracts
 
+## 0.6.0
+
+### Minor Changes
+
+- d162f85: Add safe Blog editorial cadence preview and apply operations across contracts, SDK, CLI, and MCP.
+- 50cb9fc: Add Google Business Profile as a disabled-by-default standard text and single-image publishing destination across shared public clients.
+- 1ac7ed5: Add signed custom Blog webhook setup, connection testing, one-time secret rotation, and safe idempotent replay parity.
+- a56f834: Replace custom interactive CLI authorization with exact-resource OAuth, add the stateless MCP 2026-07-28 transport foundation, and provide safe connection instructions for workspace discovery and confirmed actions.
+
+## 0.5.0
+
+### Minor Changes
+
+- 4f9e790: Add the optional `blog:manage` capability and synchronized agent-first Blog
+  setup, import, cadence planning, plan review, article creation, confirmed
+  connection provisioning, and safe verification operations.
+- 1edd1e7: Add published Blog Studio delivery contracts and the server-only Next.js 16 Blog Studio package.
+- 74a13ea: Expose immediate versus scheduled delivery and destination lifecycle stages,
+  preserve YouTube visibility for immediate publishing, and clarify remote
+  schedule confirmation across public clients.
+- 4af607d: Add independent exact-bundle Blog approval, reviewed image upload and generation,
+  confirmed publication scheduling and cancellation, and the complete authorized
+  agent workflow without widening existing credentials.
+- 4a893dd: Add provider-neutral Blog publishing destinations, safe delivery inspection,
+  and exact destination binding across public agent interfaces.
+- 843a1db: Add the exact optional `seo:read` capability and bounded read-only SEO
+  opportunity and weekly-report parity across public agent contracts, clients,
+  CLI commands, and closed-world MCP tools. SEO reads now use the version 3 task
+  contract with the exact Ready, Research, or Rejected decision, selected format,
+  complete deliverables, bounded evidence, safe URLs, limitations, and no-publish
+  rules. Public output uses readable topic names and separate topic-relevance and
+  action-readiness confidence. Research tasks compare all supported formats and
+  must validate or reject the finding before a separate draft action is allowed.
+
 ## 0.5.0-beta.0
 
 ### Minor Changes
@@ -26,6 +60,10 @@
 
 ### Minor Changes
 
+- Add exact Blog image, approval-bundle, scheduling, cancellation, provenance,
+  idempotency, and safe public-state contracts while keeping `blog:write`,
+  `blog:approve`, and `blog:publish` independent.
+- Add the independent optional `blog:approve` capability without widening existing Blog credentials or combining draft, approval, and publication access.
 - Add safe Blog publishing provider, destination, delivery-attempt, and exact destination-selection contracts.
 
 ## 0.4.0

package/README.md

@@ -31,17 +31,30 @@ opportunities expose `READY` or `NEEDS_REVIEW`; a rejected finding has no active
 task. A Research task selects only `RESEARCH_TASK`, names no preferred final
 format, and returns `VALIDATED` with a complete next task or `REJECTED` with
 evidence before any separate draft action. Older stored reports receive a review-only compatibility task
-when read; their saved snapshots are not changed.
-
-Blog Studio contracts include provider catalog entries, safe publishing
-destination readiness, delivery-attempt summaries, and exact destination
-selection for publication preview and execution. Provider catalog reads require
-`blog:manage`. Destination and delivery-attempt reads require `blog:read`.
-These DTOs omit draft content, prompts, evidence, secrets, encrypted values,
-and raw provider responses. A contract type does not make a hidden provider
-available; the server rollout registry remains authoritative.
-
-Project and post DTOs intentionally omit storage credentials, upload sessions,
+when read; their saved snapshots are not changed.
+
+Blog Studio contracts include provider catalog entries, safe publishing
+destination readiness, delivery-attempt summaries, and exact destination
+selection for approval, publication, scheduling, and cancellation preview and
+execution. The independent `blog:approve` capability binds one immutable
+revision and reviewed-image snapshot. `blog:publish` does not grant approval,
+and `blog:write` cannot approve or publish. Existing credentials do not gain a
+new capability. Provider catalog reads require
+`blog:manage`. Destination and delivery-attempt reads require `blog:read`.
+These DTOs omit draft content, prompts, evidence, secrets, encrypted values,
+and raw provider responses. A contract type does not make a hidden provider
+available; the server rollout registry remains authoritative.
+
+Clients must read current setup and article or plan state, resolve missing
+website, cadence, destination, and access-level choices, poll import and plan
+jobs, present evidence, create one immutable revision with catalog-backed
+links, review one generated or approved uploaded image and its alt text, stop
+when approval or publication scope is missing, use confirmation-bound and
+idempotent approval before publication, verify live delivery, and restart from
+approval preview after any content or image change. A queued delivery is not a
+published delivery.
+
+Project and post DTOs intentionally omit storage credentials, upload sessions,
 tokens, and other publishing-provider internals.
 
 Every destination reports an explicit `deliveryMode` (`IMMEDIATE` or