@rolino/mcp 0.7.1 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @rolino/mcp
 
+## 0.9.0
+
+### Minor Changes
+
+- 592d4f2: Add existing-delivery checks and confirmed YouTube recovery across the API, SDK, CLI, and MCP. Preserve exact video and version bindings, action-specific permissions, and stable retry results without uploading another copy. Show saved remote IDs in CLI post details.
+
+### Patch Changes
+
+- Updated dependencies [b4ebe20]
+- Updated dependencies [592d4f2]
+  - @rolino/contracts@0.9.0
+  - @rolino/sdk@0.9.0
+  - @rolino/local-auth@0.9.0
+
+## 0.8.0
+
+### Minor Changes
+
+- 4e123ef: Add exact storage usage, bounded workspace media listing with required project context, and entitlement-checked, confirmation-bound Media Library cleanup across the shared contracts, SDK, and MCP tools. Cleanup status now reports a safe changed-asset skip when the confirmed workspace, project, storage identity, or asset version no longer matches.
+
+### Patch Changes
+
+- Updated dependencies [4e123ef]
+  - @rolino/contracts@0.8.0
+  - @rolino/sdk@0.8.0
+  - @rolino/local-auth@0.8.0
+
 ## 0.7.1
 
 ### Patch Changes

package/README.md

@@ -1,24 +1,24 @@
 # `@rolino/mcp`
 
-Rolino's Model Context Protocol adapter. Rolino supports hosted Streamable HTTP
-with client-owned OAuth and local STDIO with the shared CLI OAuth session. The
-hosted route is stateless and does not need this package on the caller's
-computer. This package supplies the local STDIO process and the shared MCP tool
-definitions used by both transports.
+Rolino's Model Context Protocol adapter. Rolino supports hosted Streamable HTTP
+with client-owned OAuth and local STDIO with the shared CLI OAuth session. The
+hosted route is stateless and does not need this package on the caller's
+computer. This package supplies the local STDIO process and the shared MCP tool
+definitions used by both transports.
 
 ## Installation
 
-Local STDIO MCP remains a separate, explicit installation so CLI-only and
-remote users do not receive MCP runtime dependencies:
+Local STDIO MCP remains a separate, explicit installation so CLI-only and
+remote users do not receive MCP runtime dependencies:
 
 ```bash
 npm install --global @rolino/cli @rolino/mcp
 ```
 
-For hosted Streamable HTTP, run `rolino setup mcp --client codex --transport
-http`, then `codex mcp login rolino`. For local STDIO, the CLI handles standard
-OAuth Authorization Code with PKCE and writes token-free Codex or Claude Code
-configuration that points to this package's installed entry point.
+For hosted Streamable HTTP, run `rolino setup mcp --client codex --transport
+http`, then `codex mcp login rolino`. For local STDIO, the CLI handles standard
+OAuth Authorization Code with PKCE and writes token-free Codex or Claude Code
+configuration that points to this package's installed entry point.
 Headless operators may install only `@rolino/mcp` and provide a scoped
 `ROLINO_TOKEN` explicitly.
 
@@ -29,6 +29,10 @@ Initial tools:
 - `get_project`
 - `create_project`
 - `list_media_assets`
+- `get_storage_usage`
+- `preview_media_cleanup`
+- `execute_media_cleanup`
+- `get_media_cleanup_status`
 - `upload_media_asset`
 - `list_posts`
 - `get_post`
@@ -64,6 +68,16 @@ storage. Rolino derives dimensions and video duration from the stored object.
 Uploading never creates, schedules, or publishes a post; the returned
 asset ID is passed into a later draft operation.
 
+`get_storage_usage` and `list_media_assets` are bounded closed-world reads.
+Cleanup requires the separate `media:delete` permission. Preview creates an
+exact confirmation but deletes nothing. Before execute, show the upload-age
+cutoff, candidate count, excluded in-use count, unknown-size count, and estimated
+space. A general request to free space is not execute approval. Execute queues
+only the unchanged confirmed files with an idempotency key. In-use files are
+never detached, and queued bytes remain counted until physical deletion succeeds.
+The deletion worker skips a file without contacting storage if its confirmed
+workspace, project, asset, storage identity, or version changed.
+
 The tool set includes discovery and inspection tools that are read-only.
 The four SEO tools require the exact optional `seo:read` capability. They are
 bounded, read-only, idempotent, and closed-world. They return canonical tasks,
@@ -237,3 +251,12 @@ when `blog:publish` is missing; otherwise preview and execute unchanged
 publication or scheduling; poll delivery and verify the live URL; and restart
 from approval preview after any content or image change. Existing credentials
 do not gain `blog:approve`, and a queued delivery is not published.
+
+
+## Existing delivery recovery
+
+`check_post_delivery` reads an existing upload and updates Rolino. It requires `posts:write` and does not publish. `UNKNOWN` requires manual review.
+
+`preview_post_recovery` verifies an existing YouTube video and returns the account, consequence, and a short-lived confirmation. After the user approves it, `execute_post_recovery` accepts identical action, video ID, publication time, post version, and token with a stable idempotency key. `ATTACH` cannot publish; `RESUME` requires an explicit future `publishAt` or `null` for publication now, plus `posts:schedule` or `posts:publish`. `QUEUED` is pending, not published. All recovery tools are marked as writes because they change local records. No recovery tool uploads another copy.
+
+The same tools are available through packaged and hosted MCP. Upgrade the server and packaged client before using them.