@rolino/mcp 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @rolino/mcp
 
+## 0.6.0
+
+### Minor Changes
+
+- d162f85: Add safe Blog editorial cadence preview and apply operations across contracts, SDK, CLI, and MCP.
+- 50cb9fc: Add Google Business Profile as a disabled-by-default standard text and single-image publishing destination across shared public clients.
+- 1ac7ed5: Add signed custom Blog webhook setup, connection testing, one-time secret rotation, and safe idempotent replay parity.
+- a56f834: Replace custom interactive CLI authorization with exact-resource OAuth, add the stateless MCP 2026-07-28 transport foundation, and provide safe connection instructions for workspace discovery and confirmed actions.
+
+### Patch Changes
+
+- Updated dependencies [d162f85]
+- Updated dependencies [50cb9fc]
+- Updated dependencies [1ac7ed5]
+- Updated dependencies [a56f834]
+  - @rolino/contracts@0.6.0
+  - @rolino/sdk@0.6.0
+  - @rolino/local-auth@0.6.0
+
 ## 0.5.0
 
 ### Minor Changes

package/README.md

@@ -13,7 +13,7 @@ installation so CLI-only users do not receive MCP runtime dependencies:
 npm install --global @rolino/cli @rolino/mcp
 ```
 
-The CLI handles browser authorization and writes token-free Codex or Claude
+The CLI handles standard OAuth Authorization Code with PKCE and writes token-free Codex or Claude
 Code configuration that points to this package's installed stdio entry point.
 Headless operators may install only `@rolino/mcp` and provide a scoped
 `ROLINO_TOKEN` explicitly.
@@ -96,10 +96,16 @@ preparation until LinkedIn confirms upload and processing. An optional
 3,000-character LINKEDIN caption override uses the shared caption as fallback.
 The connected member is always the author; Company Page publishing is outside
 this contract.
+Google Business Profile drafts can be text-only or contain one stored JPEG or
+PNG image with a stable public URL. The optional 1,500-character
+GOOGLE_BUSINESS_PROFILE update override uses the shared caption as fallback.
+The tools use the location selected in Rolino, create only standard updates,
+and never choose or change a Business Profile location. If final creation has
+an unknown outcome, inspect the selected Business Profile before retrying.
 Integration health is cached and secret-safe, post
 readiness reuses Rolino's publishing checks, and calendar reads use bounded
 date windows with cursor pagination. After `rolino auth login`, configure `ROLINO_URL` and
-the server automatically reuses the browser-authorized credential saved for
+the server automatically obtains and refreshes the API-resource OAuth token saved for
 that exact host. `ROLINO_TOKEN` remains an explicit override for CI and other
 headless environments. `ROLINO_CONFIG_DIR` can override the portable credential
 directory, and `ROLINO_TIMEOUT` is optional. Stdout is reserved for MCP
@@ -134,12 +140,15 @@ publication is reported. The preview reports `deliveryMode: "IMMEDIATE"` and
 `createsSchedule: false`; immediate publishing never enters schedule
 confirmation.
 
-MCP tools cannot enable YouTube, Bluesky, or LinkedIn or bypass a deployment's
-provider approval boundary. Self-hosted operators should complete the
+MCP tools cannot enable YouTube, Bluesky, LinkedIn, or Google Business Profile,
+or bypass a deployment's provider approval boundary. Self-hosted operators
+should complete the
 [YouTube operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/youtube.md)
 and
-[Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md), and
+[Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md),
 [LinkedIn operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/linkedin.md)
+and the
+[Google Business Profile operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/google-business-profile.md)
 before live testing.
 
 ## Support, security, and license
@@ -168,6 +177,14 @@ publishing reads:
 - `generate_blog_image`, `upload_blog_image`, and `review_blog_image` require
   `blog:write`. They cannot approve an article or publish it. Upload reads only
   the exact local JPEG, PNG, or WebP path supplied to the tool.
+- `preview_blog_plan_cadence` and `apply_blog_plan_cadence` require
+  `blog:write`. Preview first, show every editorial move and locked item, then
+  apply only the unchanged preview values with its confirmation and a stable
+  idempotency key.
+- These cadence tools never change `scheduledPublishAt` and never schedule,
+  publish, or unpublish an article.
+- `generate_blog_image` already accepts optional editorial direction through
+  `editorialBrief` with a 500-character limit.
 - `preview_blog_revision_approval` and `execute_blog_revision_approval` require
   the independent `blog:approve` capability. Execution makes the confirmed
   exact bundle eligible for a separate publication operation; it cannot
@@ -189,8 +206,9 @@ Read tools are closed-world. The signed revalidation test is accurately marked
 as an open-world write. Connection execute is confirmed, destructive, and
 idempotent; its first success may return one-time values that must be written
 only to server-side environment configuration. Errors and replays never reveal
-those values. These are local stdio tools—Rolino does not expose hosted remote
-MCP. Publication still requires a user-approved exact revision and the
+those values. These tools remain available over local stdio. The remote profile
+omits both caller-local media and Blog image uploads, and the hosted route stays hidden while its
+deployment gate is off. Publication still requires a user-approved exact revision and the
 separate publish preview/execute tools.
 
 Use the Blog tools in this order: read setup and current article or plan state;