# v0.4.0 Safe Pages Plan

Status: published in `v0.4.0` on 2026-07-21 after Ghost 5 and Ghost 6 integration, npm provenance publication, and official MCP Registry verification passed.

## Tool surface

Add `list_pages`, `get_page`, `create_page_drafts`, `update_page_draft`, `update_published_page`, `publish_pages`, `unpublish_pages`, and `check_live_pages`. Normal mode exposes 23 tools; read-only mode exposes 9.

Page list/read responses mirror relevant post fields. Page inputs support title, Markdown, slug, excerpt, feature-image, SEO, Open Graph, and Twitter metadata, but not tags, authors, featured state, templates, code injection, newsletters, scheduling, duplication, or deletion.

## Write contracts

Creation accepts 1–10 pages and always creates drafts. Draft updates require current `updated_at`; Markdown replacement requires `body_replacement_confirmed: true`. Published updates are metadata-only, require `user_confirmed: true`, save a revision, preserve status, and never replace the body.

Publish/unpublish accepts 1–25 unique `{id, updated_at}` targets, requires `user_confirmed: true`, preflights the complete batch, and stops remaining writes after the first remote failure. A fully successful batch invokes the configured deployment hook once; preflight/write failure skips deployment. Published metadata updates use the existing separately approved `trigger_deploy` path.

## Public verification

Add optional `GHOST_PUBLIC_PAGE_URL_TEMPLATE`, which requires HTTPS outside localhost and exactly one `{slug}` in the URL path. `check_live_pages` accepts exact `{id, updated_at}` targets, reads each current published page, and uses the configured template for headless sites or Ghost's returned URL otherwise. Callers never supply arbitrary URLs. Ghost-returned URLs resolving to private or loopback networks are rejected unless the configured Ghost site is explicitly local development.

Verification checks HTTP success, title, canonical URL, and configured SEO metadata once without retrying. Response bodies are capped at 2 MB. This supports both Ghost-rendered and headless/static sites.

## Acceptance

- Production code calls the stable Ghost Pages browse/read/add/edit surface and contains no delete path.
- Stale, wrong-status, duplicate, malformed, or unconfirmed writes make no change.
- Published page body and status survive metadata updates.
- Ghost-rendered and headless URL selection prevent caller-directed requests.
- Ghost 5/6 integration creates, updates, publishes, verifies, unpublishes, and test-harness-cleans a disposable page.