@rolino/mcp 0.3.0 → 0.5.0-beta.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # @rolino/mcp
 
+## 0.5.0-beta.0
+
+### Minor Changes
+
+- 4f9e790: Add the optional `blog:manage` capability and synchronized agent-first Blog
+  setup, import, cadence planning, plan review, article creation, confirmed
+  connection provisioning, and safe verification operations.
+- 1edd1e7: Add published Blog Studio delivery contracts and the server-only Next.js 16 Blog Studio package.
+- 74a13ea: Expose immediate versus scheduled delivery and destination lifecycle stages,
+  preserve YouTube visibility for immediate publishing, and clarify remote
+  schedule confirmation across public clients.
+- 4a893dd: Add provider-neutral Blog publishing destinations, safe delivery inspection,
+  and exact destination binding across public agent interfaces.
+- 843a1db: Add the exact optional `seo:read` capability and bounded read-only SEO
+  opportunity and weekly-report parity across public agent contracts, clients,
+  CLI commands, and closed-world MCP tools. SEO reads now use the version 3 task
+  contract with the exact Ready, Research, or Rejected decision, selected format,
+  complete deliverables, bounded evidence, safe URLs, limitations, and no-publish
+  rules. Public output uses readable topic names and separate topic-relevance and
+  action-readiness confidence. Research tasks compare all supported formats and
+  must validate or reject the finding before a separate draft action is allowed.
+
+### Patch Changes
+
+- Updated dependencies [4f9e790]
+- Updated dependencies [1edd1e7]
+- Updated dependencies [74a13ea]
+- Updated dependencies [4a893dd]
+- Updated dependencies [843a1db]
+  - @rolino/contracts@0.5.0-beta.0
+  - @rolino/sdk@0.5.0-beta.0
+  - @rolino/local-auth@0.5.0-beta.0
+
+## Unreleased
+
+### Minor Changes
+
+- Add safe Blog provider, destination, and delivery tools plus destination-bound publication inputs.
+
+## 0.4.0
+
+### Minor Changes
+
+- 6d5cefc: Add LinkedIn native video capability, limits, and delivery-options parity across public agent surfaces.
+- 4149259: Add platform-aware media-adjustment readiness actions and align LinkedIn publishing guidance across agent packages.
+
+### Patch Changes
+
+- Updated dependencies [6d5cefc]
+- Updated dependencies [4149259]
+  - @rolino/contracts@0.4.0
+  - @rolino/sdk@0.4.0
+  - @rolino/local-auth@0.4.0
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -37,6 +37,10 @@ Initial tools:
 - `execute_post_publish`
 - `list_integration_health`
 - `refresh_delivery_options`
+- `list_seo_opportunities`
+- `get_seo_opportunity`
+- `list_seo_reports`
+- `get_seo_report`
 - `list_calendar_events`
 
 The media tools discover reusable project assets and stream one explicitly
@@ -46,6 +50,19 @@ Uploading never creates, schedules, or publishes a post; the returned
 asset ID is passed into a later draft operation.
 
 The tool set includes discovery and inspection tools that are read-only.
+The four SEO tools require the exact optional `seo:read` capability. They are
+bounded, read-only, idempotent, and closed-world. They return canonical tasks,
+evidence, neutral provenance, separate topic-relevance and action-readiness
+confidence, and recommended actions. They cannot
+run analysis, change settings, delete data, enable reports, send email, or call
+an external provider.
+Opportunity detail also returns the bounded versioned task: exact decision,
+format, target, deliverables, research, safe URLs, evidence, limitations, and
+success metric. Ready can request final deliverables for human review. Research
+selects only `RESEARCH_TASK`, compares all reasonable formats without a
+preferred final format, and must return `VALIDATED` with a complete next task
+or `REJECTED` with evidence before any separately allowed draft
+action. Every copied task forbids publishing and other Rolino writes.
 `create_project` is an additive, closed-world mutation that requires
 `projects:write` and a caller-supplied idempotency key. It atomically saves the
 project and its paired brand without starting research, connecting accounts,
@@ -71,10 +88,14 @@ reviewed only after inspecting this result. That review is distinct from MCP
 mutation consent. Changing TikTok content clears the prior review, and Rolino
 never silently turns off a requested interaction.
 For LinkedIn, `refresh_delivery_options` returns the connected member plus the
-strict text/single-image/multi-image and JPEG/PNG limits. LinkedIn drafts can be
-text-only or contain up to ten stored images, with an optional 3,000-character
-LINKEDIN caption override. The connected member is always the author; Company
-Page publishing is outside this contract.
+strict text/single-image/multi-image/video policy and JPEG/PNG/MP4 limits.
+LinkedIn drafts can be text-only, contain up to ten stored images, or contain
+exactly one stored MP4 without mixing images and video. Native video must be
+75 KB to 500 MB and 3 seconds to 30 minutes, and execution remains in
+preparation until LinkedIn confirms upload and processing. An optional
+3,000-character LINKEDIN caption override uses the shared caption as fallback.
+The connected member is always the author; Company Page publishing is outside
+this contract.
 Integration health is cached and secret-safe, post
 readiness reuses Rolino's publishing checks, and calendar reads use bounded
 date windows with cursor pagination. After `rolino auth login`, configure `ROLINO_URL` and
@@ -95,8 +116,10 @@ idempotency key. The server repeats readiness and live-health checks and rejects
 expired, consumed, stale, cross-credential, or mismatched confirmation.
 For YouTube, the preview explains that confirmed scheduling starts or resumes a
 private upload immediately so processing can complete before the Public target.
-Execution may return a typed `PENDING` result while the remote schedule is
-being confirmed; it does not report the video as published.
+Execution may return a typed `PENDING` result with phase
+`REMOTE_SCHEDULE_CONFIRMATION` after the upload completes while YouTube
+acknowledges the requested publish time. The video remains private, the result
+does not report it as published, and no second publish tool call is required.
 
 Immediate publishing also uses two tools. `preview_post_publish` checks the
 exact destination set, post version, readiness, live provider health, and retry
@@ -106,7 +129,10 @@ then durably queues the selected destinations for immediate delivery. Provider
 calls happen after that database commit, and Rolino's existing reconciliation
 rules block blind retries after ambiguous external results. YouTube remains
 `PREPARING` until upload and processing are provider-confirmed, and its exact
-configured visibility is reconciled before publication is reported.
+configured Public, Unlisted, or Private visibility is reconciled before
+publication is reported. The preview reports `deliveryMode: "IMMEDIATE"` and
+`createsSchedule: false`; immediate publishing never enters schedule
+confirmation.
 
 MCP tools cannot enable YouTube, Bluesky, or LinkedIn or bypass a deployment's
 provider approval boundary. Self-hosted operators should complete the
@@ -125,3 +151,31 @@ issues through the repository's
 [security policy](https://github.com/deifos/rolino/security/policy).
 
 `@rolino/mcp` is available under the MIT License.
+## Agent-first Blog Studio tools
+
+The local stdio server exposes Blog readiness, import, cadence planning,
+plan-item evidence and state, editable article creation, connection status,
+confirmed provisioning, signed revalidation testing, and these provider-neutral
+publishing reads:
+
+- `list_blog_publishing_providers` requires `blog:manage` and returns only
+  enabled providers, safe capabilities, and official documentation.
+- `list_blog_publishing_destinations` requires `blog:read` and returns safe
+  connection readiness without credentials or private provider data.
+- `list_blog_delivery_attempts` requires `blog:read`, accepts an optional exact
+  article ID, and returns safe delivery states, retry times, error codes, and
+  remote URLs.
+
+These three tools are closed-world reads. They do not contact a provider or
+change content. They do not return draft content, prompts, evidence, secrets,
+or raw provider responses. Setup requires the
+independent optional `blog:manage` capability; it is never inferred from
+`blog:write` or `blog:publish` and is not added to existing credentials.
+
+Read tools are closed-world. The signed revalidation test is accurately marked
+as an open-world write. Connection execute is confirmed, destructive, and
+idempotent; its first success may return one-time values that must be written
+only to server-side environment configuration. Errors and replays never reveal
+those values. These are local stdio tools—Rolino does not expose hosted remote
+MCP. Publication still requires a user-approved exact revision and the
+separate publish preview/execute tools.