webcake-landing-mcp 1.0.49 → 1.0.50

package/README.md

@@ -89,7 +89,7 @@ persists it (source-only — the page opens in the editor where re-saving render
 | **npx (local)** — runs on your machine | Personal daily use, full control | browser `login`, a JWT, or none (reference tools) |
 | **Hosted URL** — use our live server, nothing to install | No Node.js, teams, the claude.ai dialog | your personal `?jwt=` link / `x-webcake-jwt` header |
 
-The **reference + generation tools** (`get_generation_guide`, `list_elements`, `validate_page`, …) and the **ingest tools** (`ingest_html`, `ingest_url` — turn an existing HTML or URL into a layout anchor so the AI can recreate or adapt it) work with **zero config**; only the **persistence tools** (`create_page`, `update_page`, `add_section`, `patch_page`, `list_pages`, `find_pages`, `get_page`, `list_organizations`) need a token. Credentials resolve in order: **per-request header → env var → saved `auth.json`** (`login`).
+The **reference + generation tools** (`get_generation_guide`, `list_elements`, `validate_page`, …) and the **ingest tools** (`ingest_html`, `ingest_url` — turn an existing HTML or URL into a layout anchor so the AI can recreate or adapt it) work with **zero config**; only the **persistence tools** (`create_page`, `update_page`, `add_section`, `patch_page`, `publish_page`, `list_pages`, `find_pages`, `get_page`, `list_organizations`) need a token. Credentials resolve in order: **per-request header → env var → saved `auth.json`** (`login`).
 
 > 🛠️ Prefer a shell-script installer (`install.sh`/`install.ps1`), a cloned local build, or hand-written per-IDE config? See **[docs/manual-install.md](docs/manual-install.md)**.
 
@@ -222,7 +222,8 @@ lands in logs). Any header that's missing falls back to the matching env var:
 | `x-webcake-org-id` | `WEBCAKE_ORG_ID` | default org |
 | `x-webcake-api-base` | `WEBCAKE_API_BASE` | overrides the env preset's API base |
 | `x-webcake-app-base` | `WEBCAKE_APP_BASE` | overrides the env preset's SPA base (login connect page) |
-| `x-webcake-builder-base` | `WEBCAKE_BUILDER_BASE` | overrides the builder host used for editor/preview links |
+| `x-webcake-builder-base` | `WEBCAKE_BUILDER_BASE` | overrides the builder host used for editor links |
+| `x-webcake-preview-base` | `WEBCAKE_PREVIEW_BASE` | overrides the public preview host used for `/preview/<id>` links |
 
 > The reference + generation tools (`get_generation_guide`, `list_elements`, `validate_page`, …) need **no
 > token** — only the persistence tools (`create_page`, `update_page`, …) use it. Without a JWT, those return
@@ -292,7 +293,8 @@ flow can also be done entirely in the SPA, no backend route needed.)
 | `WEBCAKE_JWT` | No* | Account JWT (dashboard auth). Required to persist — expires, refresh when needed. |
 | `WEBCAKE_ORG_ID` | No | Default organization id for `create_page` (overridden by its `organization_id` arg). Omit → personal page. |
 | `WEBCAKE_APP_BASE` | No | Optional SPA base — used for the browser `login` connect page. |
-| `WEBCAKE_BUILDER_BASE` | No | Optional builder host for the editor/preview links in the result. Defaults to the env preset, else derived from the API host (`api.x`→`builder.x`). |
+| `WEBCAKE_BUILDER_BASE` | No | Optional builder host for the editor links in the result. Defaults to the env preset, else derived from the API host (`api.x`→`builder.x`). |
+| `WEBCAKE_PREVIEW_BASE` | No | Optional public preview host for the `/preview/<id>` links — NOT the builder subdomain. Defaults to the env preset (`preview.localhost:5800` local / `staging.webcake.me` staging / `www.webcake.me` prod). |
 | `WEBCAKE_CONFIG_DIR` | No | Dir for the saved `auth.json` written by `login` (default `~/.webcake-landing-mcp`). |
 
 > \* `WEBCAKE_API_BASE` and `WEBCAKE_JWT` are only needed for the persistence tools. The reference and
@@ -419,6 +421,9 @@ update_page({ page_id, source, dry_run: false })         # overwrite (dry_run=tr
 create_page({ source: smallSkeleton, dry_run: false })   # → page_id
 add_section({ page_id, sections: heroSection, dry_run: false })   # backend appends server-side (no whole-source get+put)
 add_section({ page_id, sections: [formSection, footerSection], dry_run: false })
+
+# Go LIVE (the preview link works without this — publish to attach a domain / set live status)
+publish_page({ page_id, custom_domain: "shop.example.com", custom_path: "sale", dry_run: false })
 ```
 
 `create_page` calls **`POST {WEBCAKE_API_BASE}/api/v1/ai/create_page_from_source`** on the backend.
@@ -467,6 +472,7 @@ Both `create_page` and `update_page` **default to `dry_run=true`** (validate and
 | `find_pages` | Search the account's pages by name, domain, and/or page id (AND-combined) to locate one to edit; returns id, name, org, custom/default domain, updated_at. |
 | `get_page` | Fetch an existing page's decoded source tree, COMPACTED to the sparse authoring shape (factory-default boilerplate stripped — far fewer tokens; `compact:false` for the raw tree). Edit and send back as-is. |
 | `update_page` | Overwrite an existing page's source with an edited tree. **Defaults to `dry_run=true`.** |
+| `publish_page` | Publish a page (live status, optional custom domain/path). The preview link works WITHOUT publishing — publish only to go live. **Defaults to `dry_run=true`.** |
 
 ---
 

package/dist/changelog.json

@@ -1,4 +1,11 @@
 [
+  {
+    "v": "1.0.50",
+    "d": "10/06/2026",
+    "type": "Added",
+    "en": "New publish_page tool makes a page live: reads the page's current stored source, saves it as a new version, and creates or updates the…",
+    "vi": "Công cụ publish_page mới giúp đưa trang lên live: đọc source đang lưu của trang, lưu thành phiên bản mới và tạo hoặc cập nhật bản ghi…"
+  },
   {
     "v": "1.0.49",
     "d": "10/06/2026",
@@ -33,12 +40,5 @@
     "type": "Changed",
     "en": "get_generation_guide workflow condensed to four steps: element-type reads and image fetches are now batched into single calls…",
     "vi": "Workflow trong get_generation_guide được rút gọn xuống còn bốn bước: việc đọc loại phần tử và tìm ảnh nay được gộp thành các lần gọi batch duy nhất…"
-  },
-  {
-    "v": "1.0.44",
-    "d": "09/06/2026",
-    "type": "Added",
-    "en": "New find_pages tool searches the account's pages by name, domain (matches custom_domain or default_domain), and/or page id (filters are…",
-    "vi": "Công cụ find_pages mới tìm kiếm các trang trong tài khoản theo tên, domain (khớp với custom_domain hoặc default_domain), và/hoặc page id (các bộ lọc…"
   }
 ]

package/dist/domains/landing/instructions.js

@@ -32,4 +32,6 @@ MODEL (essentials):
 - Visible content lives in specials (text, src, field_name…), never in styles. Colors as rgba(). Animation in config.animation={name,delay,duration,repeat}. Form inputs need a unique specials.field_name (use canonical keys: full_name, phone_number, email, address, quantity).
 - IMAGES: include them (hero/product, feature icons, about photo). PREFER REAL PHOTOS — call search_images with a short English subject (e.g. 'fresh coffee cup') and put a returned URL (src.large for a hero/banner, src.medium for a card/thumb) into the image-block specials.src; it works out of the box (a shared proxy supplies images). Only if search_images returns ok:false, FALL BACK to a PLACEHOLDER sized to the box: https://placehold.co/<width>x<height>. (gallery.media = array of OBJECTS {type:'image',link:'<url>',linkVideo:'',typeVideo:'youtube',imageCompression:true} — NOT plain strings, the gallery reads item.link; video.specials.img = poster). NEVER leave src empty (renders blank). Ensure text contrasts with its section background.
 
-Start by calling get_generation_guide. Tools: get_generation_guide, list_elements, get_element, new_element, new_page_skeleton, get_page_schema, validate_page, search_images, ingest_html, ingest_url, list_organizations, create_page, list_pages, find_pages, get_page, update_page, add_section, patch_page.`;
+- PREVIEW vs PUBLISH: the preview_url returned by create_page/update_page/add_section lives on the PREVIEW host (preview.localhost:5800 local / staging.webcake.me staging / www.webcake.me prod — NOT the builder subdomain) and renders the stored source immediately — share it as-is for review. When the user wants the page LIVE (public/published, optionally on their custom domain), call publish_page({ page_id, custom_domain?, custom_path?, dry_run:false }).
+
+Start by calling get_generation_guide. Tools: get_generation_guide, list_elements, get_element, new_element, new_page_skeleton, get_page_schema, validate_page, search_images, ingest_html, ingest_url, list_organizations, create_page, list_pages, find_pages, get_page, update_page, add_section, patch_page, publish_page.`;

package/dist/persistence/config.js

@@ -19,8 +19,11 @@
  *   WEBCAKE_JWT       the account JWT               (required to call the backend)
  *   WEBCAKE_ORG_ID    optional default organization id for create_page
  *   WEBCAKE_APP_BASE  optional SPA base (used for the login connect page)
- *   WEBCAKE_BUILDER_BASE  optional builder host for editor/preview URLs in the result
+ *   WEBCAKE_BUILDER_BASE  optional builder host for the editor URLs in the result
  *                     (defaults to the env preset, else derived from the API host)
+ *   WEBCAKE_PREVIEW_BASE  optional public preview host for the /preview/<id> links —
+ *                     NOT the builder subdomain (defaults to the env preset:
+ *                     preview.localhost:5800 / staging.webcake.me / www.webcake.me)
  *   WEBCAKE_CONFIG_DIR  optional dir for the saved auth.json (default ~/.webcake-landing-mcp)
  */
 import { homedir } from "node:os";
@@ -36,9 +39,9 @@ import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
  * after create/update (a distinct host — NOT the API and NOT the SPA).
  */
 export const ENVIRONMENTS = {
-    local: { apiBase: "http://localhost:5800", appBase: "http://localhost:5173", builderBase: "http://builder.localhost:5800" },
-    staging: { apiBase: "https://api.staging.webcake.io", appBase: "https://staging.webcake.io", builderBase: "https://builder.staging.webcake.io" },
-    prod: { apiBase: "https://api.webcake.io", appBase: "https://webcake.io", builderBase: "https://builder.webcake.io" },
+    local: { apiBase: "http://localhost:5800", appBase: "http://localhost:5173", builderBase: "http://builder.localhost:5800", previewBase: "http://preview.localhost:5800" },
+    staging: { apiBase: "https://api.staging.webcake.io", appBase: "https://staging.webcake.io", builderBase: "https://builder.staging.webcake.io", previewBase: "https://staging.webcake.me" },
+    prod: { apiBase: "https://api.webcake.io", appBase: "https://webcake.io", builderBase: "https://builder.webcake.io", previewBase: "https://www.webcake.me" },
 };
 export const ENV_NAMES = Object.keys(ENVIRONMENTS);
 /** True when `v` names a known environment (local|staging|prod). */
@@ -88,6 +91,16 @@ export function readConfig(overrides = {}) {
         preset?.builderBase ??
         saved.builderBase ??
         deriveBuilderBase(cleanBase))?.replace(/\/+$/, "");
+    // The public preview link (/preview/<id>) is served on its OWN root host — NOT
+    // the builder subdomain (preview.localhost:5800 / staging.webcake.me /
+    // www.webcake.me). When nothing matches, default to the backend's own preview
+    // domain (its @preview_domain) so the link still lands on a host that serves
+    // the /preview/:id route.
+    const previewBase = (overrides.previewBase ??
+        process.env.WEBCAKE_PREVIEW_BASE ??
+        preset?.previewBase ??
+        saved.previewBase ??
+        "https://www.webcake.me").replace(/\/+$/, "");
     return {
         config: {
             base: cleanBase,
@@ -95,6 +108,7 @@ export function readConfig(overrides = {}) {
             orgId: overrides.orgId ?? process.env.WEBCAKE_ORG_ID ?? saved.orgId,
             appBase: (overrides.appBase ?? process.env.WEBCAKE_APP_BASE ?? preset?.appBase ?? saved.appBase)?.replace(/\/+$/, ""),
             builderBase,
+            previewBase,
         },
         missing: [],
     };
@@ -111,7 +125,8 @@ function header(headers, name) {
  *   x-webcake-env        named environment (local|staging|prod) for the base URLs
  *   x-webcake-api-base   backend base URL (overrides the env preset)
  *   x-webcake-app-base   SPA base used for the login connect page (overrides the preset)
- *   x-webcake-builder-base  builder host for editor/preview URLs (overrides the preset)
+ *   x-webcake-builder-base  builder host for editor URLs (overrides the preset)
+ *   x-webcake-preview-base  public preview host for /preview/<id> links (overrides the preset)
  * Any header that is absent falls back to the corresponding env var in readConfig.
  */
 export function configFromHeaders(headers) {
@@ -123,6 +138,7 @@ export function configFromHeaders(headers) {
         orgId: header(headers, "x-webcake-org-id"),
         appBase: header(headers, "x-webcake-app-base"),
         builderBase: header(headers, "x-webcake-builder-base"),
+        previewBase: header(headers, "x-webcake-preview-base"),
         env: header(headers, "x-webcake-env"),
     };
 }

package/dist/persistence/webcake-client.js

@@ -5,6 +5,13 @@ const SEARCH_PAGES_ENDPOINT = "/api/v1/ai/search_pages";
 const PAGE_SOURCE_ENDPOINT = "/api/v1/ai/page_source";
 const UPDATE_ENDPOINT = "/api/v1/ai/update_page_source";
 const APPEND_ENDPOINT = "/api/v1/ai/append_section";
+// The editor's own publish route (NOT under /api/v1/ai): saves the source as a
+// new version and creates/updates the page_published record (+ optional custom
+// domain/path) so the page goes live. NOTE: this scope is host-constrained to
+// the BUILDER host (router scope `host: "builder."`), so the request goes to
+// config.builderBase, not the API base.
+const publishEndpoint = (pageId) => `/api/pages/${encodeURIComponent(pageId)}/edit/publish`;
+const publishUrl = (config, pageId) => `${(config.builderBase ?? config.base).replace(/\/+$/, "")}${publishEndpoint(pageId)}`;
 function authHeaders(config, orgId) {
     const headers = {
         "Content-Type": "application/json",
@@ -44,6 +51,33 @@ export function toEditorUrl(config, raw) {
         pathQuery = `/${pathQuery}`;
     return `${builder.replace(/\/+$/, "")}${pathQuery}`;
 }
+/**
+ * Resolve the public preview link (`/preview/<page_id>`) onto the PREVIEW host
+ * (config.previewBase) — NOT the builder subdomain. The /preview/:id route only
+ * exists on the root preview hosts (preview.localhost:5800 local /
+ * staging.webcake.me staging / www.webcake.me prod); the v4 renderer there reads
+ * the stored page_source directly, so the link works without publishing.
+ */
+export function toPreviewUrl(config, raw) {
+    if (!raw)
+        return raw;
+    const preview = config.previewBase;
+    if (!preview)
+        return toEditorUrl(config, raw); // legacy fallback
+    let pathQuery = raw;
+    if (/^https?:\/\//i.test(raw)) {
+        try {
+            const u = new URL(raw);
+            pathQuery = u.pathname + u.search + u.hash;
+        }
+        catch {
+            /* not a parseable URL — use as-is */
+        }
+    }
+    if (!pathQuery.startsWith("/"))
+        pathQuery = `/${pathQuery}`;
+    return `${preview.replace(/\/+$/, "")}${pathQuery}`;
+}
 /** Build (but do not send) the create request — used for dry-run previews. */
 export function buildRequest(config, name, source, orgId) {
     return {
@@ -134,7 +168,7 @@ export async function createPage(config, name, source, orgId) {
         status: res.status,
         page_id: pageId,
         editor_url: toEditorUrl(config, editorPath),
-        preview_url: toEditorUrl(config, previewPath),
+        preview_url: toPreviewUrl(config, previewPath),
         organization_id: (orgId ?? config.orgId) ?? null,
         raw: data,
     };
@@ -278,7 +312,7 @@ export async function appendSection(config, pageId, sections) {
         status: res.status,
         page_id: pageIdOut,
         editor_url: toEditorUrl(config, data?.editor_url),
-        preview_url: toEditorUrl(config, data?.preview_url),
+        preview_url: toPreviewUrl(config, data?.preview_url),
         organization_id: data?.organization_id ?? null,
         section_count: data?.section_count,
         sections_added: data?.sections_added,
@@ -323,8 +357,111 @@ export async function updatePageSource(config, pageId, source) {
         status: res.status,
         page_id: pageIdOut,
         editor_url: toEditorUrl(config, data?.editor_url),
-        preview_url: toEditorUrl(config, data?.preview_url),
+        preview_url: toPreviewUrl(config, data?.preview_url),
         organization_id: data?.organization_id ?? null,
         raw: data,
     };
 }
+function publishBody(sourceString, opts = {}) {
+    // The publish action expects `source` as a JSON STRING (it Jason.decode!s it),
+    // plus optional custom_domain/custom_path. is_publish marks the save as a
+    // publish in save_page_with_source.
+    return JSON.stringify({
+        source: sourceString,
+        custom_domain: opts.customDomain ?? "",
+        custom_path: opts.customPath ?? "",
+        is_publish: true,
+    });
+}
+/** Build (but do not send) the publish request with the token masked — for dry-run previews. */
+export function buildPublishRequestRedacted(config, pageId, sourceString, opts = {}) {
+    const body = publishBody(sourceString, opts);
+    return {
+        method: "POST",
+        url: publishUrl(config, pageId),
+        headers: { ...authHeaders(config), Authorization: "Bearer ***JWT***", Cookie: "jwt=***JWT***" },
+        body: body.replace(config.jwt, "***JWT***").slice(0, 400) + (body.length > 400 ? `… (${body.length} bytes)` : ""),
+    };
+}
+/**
+ * POST to a host-scoped route. Node's fetch cannot reach `*.localhost` hosts
+ * (browsers special-case .localhost; Node's DNS does not, and undici forbids a
+ * manual Host header) — so for those we connect to loopback via node:http and
+ * carry the real host in the Host header. Everything else uses plain fetch.
+ */
+async function postToHost(url, headers, body) {
+    const u = new URL(url);
+    if (!u.hostname.endsWith(".localhost")) {
+        const res = await fetch(url, { method: "POST", headers, body });
+        return { status: res.status, text: await res.text() };
+    }
+    const { request } = await import("node:http");
+    return new Promise((resolve, reject) => {
+        const req = request({
+            host: "127.0.0.1",
+            port: u.port || 80,
+            path: u.pathname + u.search,
+            method: "POST",
+            headers: { ...headers, Host: u.host },
+        }, (res) => {
+            let data = "";
+            res.on("data", (c) => (data += c));
+            res.on("end", () => resolve({ status: res.statusCode ?? 0, text: data }));
+        });
+        req.on("error", reject);
+        req.end(body);
+    });
+}
+/**
+ * Publish a page: saves the source as a new version and creates/updates the
+ * page_published record (live status + optional custom domain/path). Returns the
+ * resulting public URL — `https://<domain>/<path>` when a custom domain is
+ * attached, else the preview-host link (`<previewBase>/preview/<page_id>`).
+ */
+export async function publishPage(config, pageId, sourceString, opts = {}) {
+    const url = publishUrl(config, pageId);
+    let status;
+    let text;
+    try {
+        // The builder-host pipeline runs an `accepts ["html"]` plug (it serves the
+        // editor SPA); a literal application/json Accept gets a 406, so send */*
+        // like the browser does — the action still returns JSON.
+        ({ status, text } = await postToHost(url, { ...authHeaders(config), Accept: "*/*" }, publishBody(sourceString, opts)));
+    }
+    catch (e) {
+        return { ok: false, status: 0, error: `Network error calling ${url}: ${e?.message ?? e}` };
+    }
+    let json = null;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        /* non-JSON */
+    }
+    const resOk = status >= 200 && status < 300;
+    const success = json?.success !== false && resOk;
+    if (!success) {
+        const backendMsg = json?.message ?? json?.reason ?? (json ? undefined : text.slice(0, 200));
+        return {
+            ok: false,
+            status,
+            raw: json ?? text.slice(0, 600),
+            error: `Backend returned ${status}${backendMsg ? `: ${backendMsg}` : ""}`,
+        };
+    }
+    const data = json?.data ?? json;
+    const domain = data?.domain ?? null;
+    const path = data?.path ?? null;
+    const previewUrl = toPreviewUrl(config, `/preview/${pageId}`);
+    const publishedUrl = domain ? `https://${domain}${path ? `/${String(path).replace(/^\/+/, "")}` : ""}` : previewUrl;
+    return {
+        ok: true,
+        status,
+        page_id: pageId,
+        published_url: publishedUrl,
+        preview_url: previewUrl,
+        domain,
+        path,
+        raw: data,
+    };
+}

package/dist/smoke.js

@@ -7,8 +7,8 @@ import { validatePage, pageSchema } from "./domains/landing/validate.js";
 import { expandSource } from "./core/expand.js";
 import { compactSource, deepEq, sparseTemplate } from "./core/compact.js";
 import { parseHtml } from "./persistence/html-ingest.js";
-import { readConfig, resolveEnv, ENV_NAMES } from "./persistence/config.js";
-import { toEditorUrl } from "./persistence/webcake-client.js";
+import { readConfig, resolveEnv, ENV_NAMES, configFromHeaders } from "./persistence/config.js";
+import { toEditorUrl, toPreviewUrl, buildPublishRequestRedacted } from "./persistence/webcake-client.js";
 import { normalizePhoto, resolvePexelsKey, pexelsKeyFromHeaders, resolvePexelsProxyBase, buildSearchQuery, PEXELS_PROXY_DEFAULT } from "./persistence/pexels-client.js";
 let failures = 0;
 const check = (name, cond, extra) => {
@@ -327,7 +327,7 @@ check("clean form has no binding warnings", rbg.warnings.length === 0, rbg.warni
 console.log("== config: named environment presets (local/staging/prod) ==");
 {
     // Deterministic: isolate from any ambient WEBCAKE_* and the saved auth.json on the dev box.
-    for (const k of ["WEBCAKE_API_BASE", "WEBCAKE_APP_BASE", "WEBCAKE_BUILDER_BASE", "WEBCAKE_ENV", "WEBCAKE_JWT", "WEBCAKE_ORG_ID"])
+    for (const k of ["WEBCAKE_API_BASE", "WEBCAKE_APP_BASE", "WEBCAKE_BUILDER_BASE", "WEBCAKE_PREVIEW_BASE", "WEBCAKE_ENV", "WEBCAKE_JWT", "WEBCAKE_ORG_ID"])
         delete process.env[k];
     process.env.WEBCAKE_CONFIG_DIR = "/nonexistent/webcake-smoke";
     check("env names are local/staging/prod", setEq(new Set(ENV_NAMES), ["local", "staging", "prod"]), ENV_NAMES);
@@ -353,6 +353,23 @@ console.log("== config: named environment presets (local/staging/prod) ==");
     check("editor url from a path → builder host", toEditorUrl(localCfg, "/editor/v2/abc") === "http://builder.localhost:5800/editor/v2/abc");
     check("editor url from an absolute api url → builder host", toEditorUrl(localCfg, "http://localhost:5800/editor/v2/abc?x=1") === "http://builder.localhost:5800/editor/v2/abc?x=1");
     check("editor url passthrough when empty", toEditorUrl(localCfg, undefined) === undefined);
+    // The PREVIEW link lives on its own root host (NOT the builder subdomain):
+    // preview.localhost:5800 / staging.webcake.me / www.webcake.me.
+    check("env presets carry preview bases", resolveEnv("local")?.previewBase === "http://preview.localhost:5800" && resolveEnv("staging")?.previewBase === "https://staging.webcake.me" && resolveEnv("prod")?.previewBase === "https://www.webcake.me");
+    check("readConfig(env=local) sets previewBase", localCfg.previewBase === "http://preview.localhost:5800", localCfg);
+    check("readConfig(env=prod) sets previewBase", readConfig({ env: "prod", jwt: "t" }).config?.previewBase === "https://www.webcake.me");
+    check("previewBase defaults to www.webcake.me without a preset", readConfig({ base: "https://api.example.com", jwt: "t" }).config?.previewBase === "https://www.webcake.me");
+    check("explicit previewBase overrides the preset", readConfig({ env: "prod", previewBase: "https://p.test/", jwt: "t" }).config?.previewBase === "https://p.test");
+    check("x-webcake-preview-base header parsed", configFromHeaders({ "x-webcake-preview-base": "https://p.example" }).previewBase === "https://p.example");
+    check("preview url from a path → preview host (not builder)", toPreviewUrl(localCfg, "/preview/abc") === "http://preview.localhost:5800/preview/abc");
+    check("preview url from an absolute api url → preview host", toPreviewUrl(localCfg, "http://localhost:5800/preview/abc?x=1") === "http://preview.localhost:5800/preview/abc?x=1");
+    check("preview url passthrough when empty", toPreviewUrl(localCfg, undefined) === undefined);
+    check("preview url falls back to builder when previewBase missing", toPreviewUrl({ ...localCfg, previewBase: undefined }, "/preview/abc") === "http://builder.localhost:5800/preview/abc");
+    // publish request preview: JWT must be masked everywhere.
+    const pub = buildPublishRequestRedacted({ ...localCfg, jwt: "SECRETJWT" }, "pg1", JSON.stringify({ page: [] }), { customDomain: "shop.example.com", customPath: "sale" });
+    check("publish request hits the editor publish route on the BUILDER host", pub.url === "http://builder.localhost:5800/api/pages/pg1/edit/publish", pub.url);
+    check("publish request masks the JWT", !JSON.stringify(pub).includes("SECRETJWT"), pub);
+    check("publish request carries domain/path + source string", pub.body.includes("shop.example.com") && pub.body.includes("custom_path") && pub.body.includes("is_publish"), pub.body);
 }
 console.log("== pexels: key resolution + photo normalization (offline, no network) ==");
 {

package/dist/tools/persistence.js

@@ -12,7 +12,7 @@
 import { z } from "zod";
 import { text } from "../mcp/response.js";
 import { readConfig, configFromHeaders } from "../persistence/config.js";
-import { buildRequestRedacted, buildUpdateRequestRedacted, buildAppendRequestRedacted, createPage, listOrganizations, listPages, searchPages, getPageSource, updatePageSource, appendSection, } from "../persistence/webcake-client.js";
+import { buildRequestRedacted, buildUpdateRequestRedacted, buildAppendRequestRedacted, buildPublishRequestRedacted, createPage, listOrganizations, listPages, searchPages, getPageSource, updatePageSource, appendSection, publishPage, toPreviewUrl, } from "../persistence/webcake-client.js";
 import { putDraft, getDraft, updateDraft, deleteDraft } from "../persistence/draft-cache.js";
 export function registerPersistenceTools(server, domain) {
     // Resolve config from THIS request's headers (remote per-user JWT) first, then env.
@@ -691,4 +691,51 @@ export function registerPersistenceTools(server, domain) {
             warnings: result.warnings,
         });
     });
+    // 15) Publish page (go live) -------------------------------------------------
+    server.tool("publish_page", "Publishes an EXISTING page: saves the stored source as a new version and creates/updates its page_published record (live status), optionally attaching a custom domain/path. NOT needed for the preview link — /preview/<page_id> on the preview host renders the stored source directly; publish when the user wants the page LIVE (custom domain, or the public published URL). Note: this publishes source-only (no editor-rendered HTML); pages last published from the editor with custom head/body should be re-published there. DEFAULTS to dry_run=true. Needs WEBCAKE_API_BASE + WEBCAKE_JWT.", {
+        page_id: z.string().describe("The page id to publish (must be owned by the account)."),
+        custom_domain: z
+            .string()
+            .optional()
+            .describe("Optional custom domain to serve the page at (e.g. 'shop.example.com' — must already point at Webcake). Omit to publish without a domain (served at the preview-host URL)."),
+        custom_path: z.string().optional().describe("Optional path under the custom domain (e.g. 'sale')."),
+        dry_run: z.boolean().optional().describe("Default TRUE — preview the request without sending. Set false to actually publish."),
+    }, { title: "Publish Webcake Page", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async ({ page_id, custom_domain, custom_path, dry_run }, extra) => {
+        const isDry = dry_run !== false; // default true (safe)
+        const { config, missing } = cfgFor(extra);
+        if (!config)
+            return text({ published: false, reason: "missing_env", missing_env: missing });
+        // Publish re-saves the page's CURRENT stored source (the publish endpoint
+        // requires the source in the request), so read it first — even on dry_run,
+        // to show the real payload.
+        const res = await getPageSource(config, page_id);
+        if (!res.ok || res.source == null) {
+            return text({ published: false, reason: "page_not_found", status: res.status, error: res.error ?? "No source on this page." });
+        }
+        const sourceString = JSON.stringify(res.source);
+        const opts = { customDomain: custom_domain, customPath: custom_path };
+        if (isDry) {
+            return text({
+                dry_run: true,
+                page_id,
+                name: res.name,
+                would_publish_to: custom_domain
+                    ? `https://${custom_domain}${custom_path ? `/${custom_path}` : ""}`
+                    : toPreviewUrl(config, `/preview/${page_id}`),
+                request: buildPublishRequestRedacted(config, page_id, sourceString, opts),
+                hint: "Re-run with dry_run=false to actually publish.",
+            });
+        }
+        const outcome = await publishPage(config, page_id, sourceString, opts);
+        return text({
+            published: outcome.ok,
+            page_id,
+            url: outcome.published_url,
+            preview_url: outcome.preview_url,
+            domain: outcome.domain,
+            path: outcome.path,
+            status: outcome.status,
+            error: outcome.error,
+        });
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webcake-landing-mcp",
-  "version": "1.0.49",
+  "version": "1.0.50",
   "description": "MCP server exposing Webcake landing-page element schemas + AI usage hints, and persisting LLM-generated page sources to a Webcake backend.",
   "mcpName": "io.github.vuluu2k/webcake-landing-mcp",
   "type": "module",