@rolino/mcp 0.5.0-beta.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @rolino/mcp
 
+## 0.5.0
+
+### Minor Changes
+
+- 4f9e790: Add the optional `blog:manage` capability and synchronized agent-first Blog
+  setup, import, cadence planning, plan review, article creation, confirmed
+  connection provisioning, and safe verification operations.
+- 1edd1e7: Add published Blog Studio delivery contracts and the server-only Next.js 16 Blog Studio package.
+- 74a13ea: Expose immediate versus scheduled delivery and destination lifecycle stages,
+  preserve YouTube visibility for immediate publishing, and clarify remote
+  schedule confirmation across public clients.
+- 4af607d: Add independent exact-bundle Blog approval, reviewed image upload and generation,
+  confirmed publication scheduling and cancellation, and the complete authorized
+  agent workflow without widening existing credentials.
+- 4a893dd: Add provider-neutral Blog publishing destinations, safe delivery inspection,
+  and exact destination binding across public agent interfaces.
+- 843a1db: Add the exact optional `seo:read` capability and bounded read-only SEO
+  opportunity and weekly-report parity across public agent contracts, clients,
+  CLI commands, and closed-world MCP tools. SEO reads now use the version 3 task
+  contract with the exact Ready, Research, or Rejected decision, selected format,
+  complete deliverables, bounded evidence, safe URLs, limitations, and no-publish
+  rules. Public output uses readable topic names and separate topic-relevance and
+  action-readiness confidence. Research tasks compare all supported formats and
+  must validate or reject the finding before a separate draft action is allowed.
+
+### Patch Changes
+
+- Updated dependencies [4f9e790]
+- Updated dependencies [1edd1e7]
+- Updated dependencies [74a13ea]
+- Updated dependencies [4af607d]
+- Updated dependencies [4a893dd]
+- Updated dependencies [843a1db]
+  - @rolino/contracts@0.5.0
+  - @rolino/sdk@0.5.0
+  - @rolino/local-auth@0.5.0
+
 ## 0.5.0-beta.0
 
 ### Minor Changes
@@ -37,6 +74,9 @@
 
 ### Minor Changes
 
+- Add exact Blog image generation and upload, image review, confirmed
+  exact-bundle approval, scheduling, and schedule cancellation tools with
+  shared contracts, safe errors, and truthful capability and safety annotations.
 - Add safe Blog provider, destination, and delivery tools plus destination-bound publication inputs.
 
 ## 0.4.0

package/README.md

@@ -153,24 +153,37 @@ issues through the repository's
 `@rolino/mcp` is available under the MIT License.
 ## Agent-first Blog Studio tools
 
-The local stdio server exposes Blog readiness, import, cadence planning,
-plan-item evidence and state, editable article creation, connection status,
-confirmed provisioning, signed revalidation testing, and these provider-neutral
-publishing reads:
-
-- `list_blog_publishing_providers` requires `blog:manage` and returns only
-  enabled providers, safe capabilities, and official documentation.
-- `list_blog_publishing_destinations` requires `blog:read` and returns safe
-  connection readiness without credentials or private provider data.
-- `list_blog_delivery_attempts` requires `blog:read`, accepts an optional exact
-  article ID, and returns safe delivery states, retry times, error codes, and
-  remote URLs.
-
-These three tools are closed-world reads. They do not contact a provider or
-change content. They do not return draft content, prompts, evidence, secrets,
-or raw provider responses. Setup requires the
-independent optional `blog:manage` capability; it is never inferred from
-`blog:write` or `blog:publish` and is not added to existing credentials.
+The local stdio server exposes Blog readiness, import, cadence planning,
+plan-item evidence and state, editable article creation, connection status,
+confirmed provisioning, signed revalidation testing, and these provider-neutral
+publishing reads:
+
+- `list_blog_publishing_providers` requires `blog:manage` and returns only
+  enabled providers, safe capabilities, and official documentation.
+- `list_blog_publishing_destinations` requires `blog:read` and returns safe
+  connection readiness without credentials or private provider data.
+- `list_blog_delivery_attempts` requires `blog:read`, accepts an optional exact
+  article ID, and returns safe delivery states, retry times, error codes, and
+  remote URLs.
+- `generate_blog_image`, `upload_blog_image`, and `review_blog_image` require
+  `blog:write`. They cannot approve an article or publish it. Upload reads only
+  the exact local JPEG, PNG, or WebP path supplied to the tool.
+- `preview_blog_revision_approval` and `execute_blog_revision_approval` require
+  the independent `blog:approve` capability. Execution makes the confirmed
+  exact bundle eligible for a separate publication operation; it cannot
+  publish.
+- `preview_blog_schedule`, `execute_blog_schedule`,
+  `preview_blog_schedule_cancellation`, and
+  `execute_blog_schedule_cancellation` require the independent `blog:publish`
+  capability. Scheduling causes future external publication but does not grant
+  approval. Cancellation removes only the confirmed future schedule and never
+  unpublishes a live article.
+
+The three publishing-read tools are closed-world reads. They do not contact a provider or
+change content. They do not return draft content, prompts, evidence, secrets,
+or raw provider responses. Setup requires the
+independent optional `blog:manage` capability; it is never inferred from
+`blog:write` or `blog:publish` and is not added to existing credentials.
 
 Read tools are closed-world. The signed revalidation test is accurately marked
 as an open-world write. Connection execute is confirmed, destructive, and
@@ -179,3 +192,15 @@ only to server-side environment configuration. Errors and replays never reveal
 those values. These are local stdio tools—Rolino does not expose hosted remote
 MCP. Publication still requires a user-approved exact revision and the
 separate publish preview/execute tools.
+
+Use the Blog tools in this order: read setup and current article or plan state;
+ask for a missing website, cadence, destination, or access level; import and
+plan through polled durable jobs; present evidence before bounded plan
+acceptance; create one immutable revision with catalog-backed links; generate
+or upload and review one image with alt text; stop for user approval when
+`blog:approve` is missing; otherwise preview and execute exact-bundle approval
+with its confirmation token and a stable idempotency key; stop after approval
+when `blog:publish` is missing; otherwise preview and execute unchanged
+publication or scheduling; poll delivery and verify the live URL; and restart
+from approval preview after any content or image change. Existing credentials
+do not gain `blog:approve`, and a queued delivery is not published.

package/dist/bin.cjs

@@ -52,7 +52,7 @@ var z = __toESM(require("zod/v4"), 1);
 // package.json
 var package_default = {
   name: "@rolino/mcp",
-  version: "0.5.0-beta.0",
+  version: "0.5.0",
   description: "Model Context Protocol server for Rolino",
   type: "module",
   license: "MIT",
@@ -111,9 +111,9 @@ var package_default = {
   dependencies: {
     "@hono/node-server": "2.0.12",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@rolino/contracts": "0.5.0-beta.0",
-    "@rolino/local-auth": "0.5.0-beta.0",
-    "@rolino/sdk": "0.5.0-beta.0",
+    "@rolino/contracts": "0.5.0",
+    "@rolino/local-auth": "0.5.0",
+    "@rolino/sdk": "0.5.0",
     zod: "^4.4.3"
   },
   devDependencies: {
@@ -318,6 +318,30 @@ var revalidationTestAnnotations = {
   idempotentHint: true,
   openWorldHint: true
 };
+var blogImageWriteAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+var blogConfirmationPreviewAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: false
+};
+var blogConfirmedWriteAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+var blogScheduleExecuteAnnotations = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
 function defaultClient(options) {
   return new import_sdk2.RolinoClient({
     baseUrl: options.baseUrl ?? "https://getrolino.com",
@@ -1029,6 +1053,169 @@ function createRolinoMcpServer(options = {}) {
       return errorResult(error);
     }
   });
+  server.registerTool("generate_blog_image", {
+    title: "Generate a Blog image candidate",
+    description: "Requires blog:write. Queue a bounded featured-image candidate for one exact article revision. This cannot approve an image or article and cannot publish.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID."),
+      ...import_contracts.AgentBlogImageGenerateRequestSchema.shape
+    },
+    outputSchema: import_contracts.AgentBlogImageGenerationResponseSchema.shape.data,
+    annotations: blogImageWriteAnnotations
+  }, async ({ projectId, articleId, ...input }) => {
+    try {
+      return jsonResult(await blogApi().articles.generateImage(projectId, articleId, input));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("upload_blog_image", {
+    title: "Upload a local Blog image candidate",
+    description: "Requires blog:write. Read only one exact caller-supplied local JPEG, PNG, or WebP path and upload it for one exact article revision. This cannot approve an image or article and cannot publish.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID."),
+      revisionId: import_contracts.AgentBlogImageUploadPrepareRequestSchema.shape.revisionId,
+      filePath: z.string().min(1).describe("Exact local path of the user-approved Blog image."),
+      altText: import_contracts.AgentBlogImageUploadCompleteRequestSchema.shape.altText
+    },
+    outputSchema: import_contracts.AgentBlogImageSchema,
+    annotations: blogImageWriteAnnotations
+  }, async ({ projectId, articleId, revisionId, filePath, altText }) => {
+    try {
+      const absolutePath = (0, import_node_path.resolve)(filePath);
+      const details = await (0, import_promises.stat)(absolutePath).catch(() => null);
+      if (!details?.isFile()) throw new TypeError("The Blog image path must point to a readable file.");
+      const contentTypes = { ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".webp": "image/webp" };
+      const extension = (0, import_node_path.extname)(absolutePath).toLowerCase();
+      const contentType = contentTypes[extension];
+      if (!contentType) throw new TypeError("Use a JPEG, PNG, or WebP Blog image.");
+      const body = await (0, import_node_fs.openAsBlob)(absolutePath, { type: contentType });
+      return jsonResult(await blogApi().articles.uploadImage(projectId, articleId, { revisionId, fileName: (0, import_node_path.basename)(absolutePath), contentType, fileSize: details.size, altText, body }));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("review_blog_image", {
+    title: "Review a Blog image candidate",
+    description: "Requires blog:write. Approve or reject one exact image version with reviewable alt text and idempotency. This does not approve the article and cannot publish.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID."),
+      imageId: import_contracts.SeoEntityIdSchema.describe("Exact Blog image ID."),
+      ...import_contracts.AgentBlogImageReviewRequestSchema.shape
+    },
+    outputSchema: import_contracts.AgentBlogImageSchema,
+    annotations: blogImageWriteAnnotations
+  }, async ({ projectId, articleId, imageId, ...input }) => {
+    try {
+      return jsonResult(await blogApi().articles.reviewImage(projectId, articleId, imageId, input));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("preview_blog_revision_approval", {
+    title: "Preview exact Blog revision approval",
+    description: "Requires blog:approve. Validate one exact revision, its approved image bundle, live links, warnings, and bundle hash, then create a short-lived confirmation. This cannot publish.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID."),
+      ...import_contracts.AgentBlogApprovalPreviewRequestSchema.shape
+    },
+    outputSchema: import_contracts.AgentBlogApprovalPreviewSchema,
+    annotations: blogConfirmationPreviewAnnotations
+  }, async ({ projectId, articleId, ...input }) => {
+    try {
+      return jsonResult(await blogApi().articles.previewApproval(projectId, articleId, input));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("execute_blog_revision_approval", {
+    title: "Approve an exact Blog revision bundle",
+    description: "Requires blog:approve. Consume the matching confirmation and idempotently approve the exact revision and image bundle, which makes that bundle eligible for a separate publication operation. This cannot publish.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID."),
+      ...import_contracts.AgentBlogApprovalExecuteRequestSchema.shape
+    },
+    outputSchema: import_contracts.AgentBlogApprovalExecuteSchema,
+    annotations: blogConfirmedWriteAnnotations
+  }, async ({ projectId, articleId, ...input }) => {
+    try {
+      return jsonResult(await blogApi().articles.executeApproval(projectId, articleId, input));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("preview_blog_schedule", {
+    title: "Preview an exact Blog schedule",
+    description: "Requires blog:publish. Bind one already-approved exact bundle, future instant, IANA timezone, and destination set to a short-lived confirmation. This does not grant approval or publish now.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID."),
+      ...import_contracts.AgentBlogSchedulePreviewRequestSchema.shape
+    },
+    outputSchema: import_contracts.AgentBlogSchedulePreviewSchema,
+    annotations: blogConfirmationPreviewAnnotations
+  }, async ({ projectId, articleId, ...input }) => {
+    try {
+      return jsonResult(await blogApi().articles.previewSchedule(projectId, articleId, input));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("execute_blog_schedule", {
+    title: "Schedule an exact approved Blog bundle",
+    description: "Requires blog:publish. Consume the matching confirmation and idempotently schedule or reschedule one already-approved exact bundle for future external publication. This does not grant approval.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID."),
+      ...import_contracts.AgentBlogScheduleExecuteRequestSchema.shape
+    },
+    outputSchema: import_contracts.AgentBlogScheduleExecuteSchema,
+    annotations: blogScheduleExecuteAnnotations
+  }, async ({ projectId, articleId, ...input }) => {
+    try {
+      return jsonResult(await blogApi().articles.executeSchedule(projectId, articleId, input));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("preview_blog_schedule_cancellation", {
+    title: "Preview Blog schedule cancellation",
+    description: "Requires blog:publish. Bind the exact current future schedule to a short-lived cancellation confirmation. This does not unpublish a live article and does not grant approval.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID.")
+    },
+    outputSchema: import_contracts.AgentBlogScheduleCancelPreviewSchema,
+    annotations: blogConfirmationPreviewAnnotations
+  }, async ({ projectId, articleId }) => {
+    try {
+      return jsonResult(await blogApi().articles.previewScheduleCancellation(projectId, articleId));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("execute_blog_schedule_cancellation", {
+    title: "Cancel an exact future Blog schedule",
+    description: "Requires blog:publish. Consume the matching confirmation and idempotently cancel the exact future schedule. This is destructive, but it never unpublishes a live article and does not grant approval.",
+    inputSchema: {
+      projectId: import_contracts.SeoEntityIdSchema.describe("Exact Rolino project ID."),
+      articleId: import_contracts.SeoEntityIdSchema.describe("Exact Blog article ID."),
+      ...import_contracts.AgentBlogScheduleCancelExecuteRequestSchema.shape
+    },
+    outputSchema: import_contracts.AgentBlogScheduleCancelExecuteSchema,
+    annotations: destructiveIdempotentAnnotations
+  }, async ({ projectId, articleId, ...input }) => {
+    try {
+      return jsonResult(await blogApi().articles.executeScheduleCancellation(projectId, articleId, input));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
   server.registerTool("get_blog_job", {
     title: "Read one Blog job",
     description: "Read truthful durable job state without exposing prompts, provider details, or secrets.",