@topy-ai/maggie 0.7.35 → 0.7.37

package/README-zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.35 init --agent all
+npx @topy-ai/maggie@0.7.37 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,7 +25,7 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 release 是 `0.7.35`，完成下一批已驗證 feedback：production fixture isolation、MaggieDash project-id inference、responsive/background asset extraction、穩定 SEO structure hash、decorative alt、明確 site URL/build validation、真正 404、Tailwind v4 starter、portable CLI scripts，以及不含 local dependencies/cache 的 Astro starter bundle。延後功能記錄在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 release 是 `0.7.37`，加入可安裝的 `maggie-booking` workflow：MaggieDash Booking host bootstrap、傳統 email/password 團隊登入與 granular permissions、Stripe payment boundary、Resend outbox/template 管理、public customer booking flow、runtime/ops evidence checks，以及完整的 Booking 維護文件。Production activation 仍會 fail-closed，直到 host migration、owner、Stripe、scheduler 和 authenticated runtime evidence 都完成。上一版 `0.7.36` 完成下一批已驗證 feedback：修正 doctor placeholder scope、Tailwind renderable source scope、internal link/fragment audit、unstable baseline classification、site-wide baseline reason、base64url asset hash、installed-file hash update safety，並加入 provider-routed Gemini v2、venue timezone/DST booking parsing、social-card release path、notification lifecycle contract 和 mobile hero video playback contract。provider-bound video generation 與 transactional delivery 已記錄在 issue #39；前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及
@@ -57,6 +57,49 @@ section registry、短期 agent content bridge，以及 translation out-of-band
 browser evidence、rendered canary 與 deployment preflight。缺少必要 adapter 時
 回傳 `inconclusive`，只有五組 evidence 全部通過才回傳 `passed`。
 
+Booking 也有 tenant-scoped 的 Notifications 畫面，管理 Resend transactional
+delivery outbox：可查看去識別化的狀態與 sanitized error；owner/manager 只有
+在填寫 reason 並使用 idempotency key 時，才可以 replay `dead_letter` 項目。
+這是 Maggie 的 server-side delivery queue 與 audit 管理，不取代 Resend 自己的
+domain、audience、campaign 或 analytics console。
+
+在全新的 Astro 專案中，可以讓安裝流程補上缺少的 Booking runtime 套件：
+
+```bash
+maggie booking install --project . --confirm --install-dependencies
+```
+
+這個選項會依照專案現有的 npm/pnpm/yarn/bun lockfile，只安裝缺少的
+React、Phosphor、Tailwind、PostgreSQL 和 Stripe 套件，保留已存在的版本，
+並更新相對應的 lockfile；它不能和 `--dry-run` 或 `--diff` 一起使用。
+
+Booking 的 browser evidence gate 現在涵蓋全部 15 個 manager routes，在 mobile、
+tablet、desktop 三種 viewport 共需要 45 個 screens，包含 waitlist、locations、
+notifications、reports 和 audit。Production release 仍需要 authenticated HTTPS
+capture，並且 console、request、layout errors 都必須為空。
+
+可在不連線資料庫或 provider 的情況下，獨立驗證管理員設定員工登入的 access
+contract：
+
+```bash
+maggie booking access-contract
+```
+
+Booking Team access 支援透過 Resend 發送傳統 email/password 邀請、`manager`、
+`staff`、`finance` 角色、細粒度 permissions、staff profile 綁定、密碼重設、
+撤銷權限與 audit；不使用 passkey，也不會自動重新啟用 disabled account。
+
+可用以下命令獨立驗證 tenant-scoped Booking email template contract：
+
+```bash
+maggie booking email-templates-contract
+```
+
+Booking 內置七種 Resend 事件模板。Owner、administrator 和 Booking manager
+可以編輯 draft、用 sandbox sample data 預覽、發佈 audited version，或 rollback
+舊版本。每個事件只接受核准的 placeholder，worker 發送前會 escape value；
+provider credentials 和 recipient address 只留在 server/worker，不會返回瀏覽器。
+
 新版 release gates：
 
 ```bash

package/README.md

@@ -60,14 +60,30 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 19 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.35`. It closes the next validated feedback batch:
+The current release is `0.7.37`. It adds the installable `maggie-booking`
+workflow for MaggieDash Booking: host bootstrap, traditional email/password
+team access with granular permissions, Stripe payment boundaries, Resend
+outbox and tenant email-template management, public customer booking flow,
+runtime/ops evidence checks, and the maintained Booking implementation docs.
+Production activation remains fail-closed until the host migration, owner,
+Stripe, scheduler, and authenticated runtime evidence are supplied.
+
+The previous `0.7.36` release closed the next validated feedback batch:
 production demo fixtures are development-only, Dash infers the persisted
 project id, clone asset extraction includes responsive/background assets, SEO
 structure hashes ignore content-hashed asset names, decorative empty alt text
 is accepted, and missing starter routes return a real 404. It also adds a
 Tailwind v4 starter entry point, explicit `PUBLIC_SITE_URL` validation, a
 portable installed-CLI script path, and a bundled Astro starter without local
-dependencies or build caches. Deferred feature requests are tracked in
+dependencies or build caches. Batch 20 also adds rendered-output placeholder
+scoping, Tailwind renderable source boundaries, same-origin link/fragment
+checks, unstable baseline classification, site-wide baseline reasons,
+base64url asset-hash normalization, installed-file update hashes, provider-
+routed Gemini v2, venue-timezone/DST booking parsing, social-card release-path
+discovery, a booking notification lifecycle contract, and mobile hero-video
+playback guidance. Provider-bound video generation and transactional delivery
+are tracked in [issue #39](https://github.com/TOPY-AI-LTD/ai-cmo-skills/issues/39).
+Deferred feature requests from the prior batch remain in
 [issue #38](https://github.com/TOPY-AI-LTD/ai-cmo-skills/issues/38), not active
 memory. The 0.7.33 release records the reviewed correction for the
 batch-index feedback workflow while keeping the verified 0.7.32 behavior
@@ -509,8 +525,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.35 update --project . --force
-npx @topy-ai/maggie@0.7.35 cleanup --project .
+npx @topy-ai/maggie@0.7.37 update --project . --force
+npx @topy-ai/maggie@0.7.37 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -607,6 +623,94 @@ for local development or a configured private Git URL. The host project keeps
 ownership of routes, email/password auth, database, provider credentials, and
 the `/api/maggie/*` adapter.
 
+For an Astro project that also needs Booking, use the Booking installer. It
+installs the separate `./_maggie/booking` workspace plus missing email/password
+routes, first-owner registration, PostgreSQL/Stripe host adapter, public
+booking route, middleware scaffold, schema command, Resend worker, and an
+`.env.maggie-booking.example`:
+
+```bash
+maggie booking install --project . --confirm
+```
+
+For a fresh Astro host, let the explicit install also add only the missing
+Booking runtime packages through the host's existing npm/pnpm/yarn/bun
+package manager:
+
+```bash
+maggie booking install --project . --confirm --install-dependencies
+```
+
+Existing dependency versions are preserved. This option updates the matching
+lockfile and is intentionally incompatible with `--dry-run` and `--diff`.
+
+For a reviewed new host, `--bootstrap` also applies the installed idempotent
+Booking schema using the host's existing `DATABASE_URL`:
+
+```bash
+maggie booking install --project . --confirm --bootstrap
+```
+
+This remains opt-in and does not create the owner, configure Stripe, send
+email, or deploy. If the host has no `BOOKING_TOKEN_SECRET`, bootstrap creates
+one in the local `.env` without printing it. Existing secrets are preserved;
+short configured values fail closed. External secret stores must provision the
+key themselves.
+
+Run the read-only onboarding checklist after installation:
+
+```bash
+maggie booking setup --project .
+```
+
+Validate the administrator-managed staff access boundary independently of a
+database or provider:
+
+```bash
+maggie booking access-contract
+```
+
+The installed Booking workspace includes a Team access panel. An owner or
+administrator can invite email/password accounts through Resend, assign
+`manager`, `staff`, or `finance`, link a staff profile, edit granular
+permissions, reset or resend setup credentials, and revoke Booking access.
+The access contract is tenant-scoped, audited, and never silently reactivates
+a disabled account.
+
+Validate the tenant-scoped Booking email-template contract independently:
+
+```bash
+maggie booking email-templates-contract
+```
+
+The Booking workspace includes seven Resend event templates. Owner,
+administrator, and Booking managers can edit drafts, preview sandboxed sample
+data, publish audited versions, and roll back earlier versions. Event-specific
+placeholders are allowlisted and escaped before the host worker sends through
+Resend; provider credentials and recipient addresses remain server-only.
+
+The default `--host auto` only selects Astro when detected. Existing host files
+are preserved; a conventional `src/middleware.ts` receives the generated
+`/_maggie` rewrite block automatically, while unsupported middleware is
+preserved and reported for manual integration. This command does not apply migrations,
+create the owner, or configure Stripe/Resend secrets. The setup checklist
+reports required environment-key presence and the explicit schema,
+owner-registration, Stripe webhook, and Resend-worker steps without printing
+secret values or mutating the host.
+
+Booking also includes a tenant-scoped Notifications screen for the Resend
+delivery outbox. It shows redacted delivery state and sanitized errors through
+`GET /api/maggie/booking/notifications.json`; an owner or manager can replay a
+`dead_letter` item through the UI only with a reason and idempotency key. This
+manages Maggie's server-side transactional delivery queue and audit trail; it
+does not replace Resend's own domain, audience, campaign, or analytics console.
+
+The Booking browser-evidence gate covers all 15 manager routes at mobile,
+tablet, and desktop viewports (45 required screens), including waitlist,
+locations, notifications, reports, and audit. A production release still
+requires an authenticated HTTPS capture with zero console, request, and
+layout errors.
+
 Compare an existing dashboard before replacing it:
 
 ```bash

package/bin/maggie.js

@@ -3,7 +3,7 @@
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -58,6 +58,7 @@ Usage:
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
+  maggie booking install|inspect|setup|contract|runtime-validate|ops-validate|release-gate|stripe-audit|tasks --project PATH [options]
   maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|variant-copy-validate|media-validate|bindings-validate|idempotency-validate|reconcile> [options]
   maggie dash inventory --pages-file FILE [--require-page-kinds] [--require-source-coverage]
   maggie dash api-contract --spec FILE
@@ -132,9 +133,9 @@ Usage:
   maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
   maggie feedback <collect|preview|batch|batch-review|submit|list> [options]
   maggie qa <start|record|summary|export|assertion-audit> [options]
-  maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang]
+  maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
-  maggie site-audit URL --crawl --baseline FILE
+  maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]
   maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR]
   maggie verification coverage --contract FILE --evidence FILE
   maggie ops audit|preflight|verify|lockfiles|seed-manifest|google-capabilities|favicon-check --project PATH
@@ -282,21 +283,25 @@ function diffSummary(source, target) {
   return `${added} local additions, ${removed} package lines removed across ${blocks} changed blocks (${localLines.length} local lines vs ${packageLines.length} package lines)`;
 }
 
-function syncTree(source, target, force) {
+function syncTree(source, target, force, root = null, managedFiles = {}) {
   let changed = 0;
   for (const entry of readdirSync(source, { withFileTypes: true })) {
     const sourcePath = join(source, entry.name);
     const targetPath = join(target, entry.name);
     if (entry.isDirectory()) {
-      changed += syncTree(sourcePath, targetPath, force);
+      changed += syncTree(sourcePath, targetPath, force, root, managedFiles);
       continue;
     }
+    const managedPath = root ? relative(root, targetPath) : targetPath;
+    const localDigest = existsSync(targetPath) ? digest(targetPath) : null;
+    const packageDigest = digest(sourcePath);
+    const wasManaged = managedFiles && managedFiles[managedPath] === localDigest;
     if (!existsSync(targetPath)) {
       mkdirSync(dirname(targetPath), { recursive: true });
       writeFileSync(targetPath, readFileSync(sourcePath));
       console.log(`installed ${targetPath}`);
       changed++;
-    } else if (force || digest(sourcePath) === digest(targetPath)) {
+    } else if (force || packageDigest === localDigest || wasManaged) {
       writeFileSync(targetPath, readFileSync(sourcePath));
       console.log(`updated ${targetPath}`);
       changed++;
@@ -307,6 +312,59 @@ function syncTree(source, target, force) {
   return changed;
 }
 
+function collectManagedFiles(source, target, root, managedFiles, previousManagedFiles = {}) {
+  if (!existsSync(source) || !existsSync(target)) return;
+  const sourceStat = readdirSync;
+  let entries;
+  try {
+    entries = sourceStat(source, { withFileTypes: true });
+  } catch {
+    const targetDigest = digest(target);
+    const relativePath = relative(root, target);
+    if (targetDigest === digest(source) || previousManagedFiles[relativePath] === targetDigest) managedFiles[relativePath] = targetDigest;
+    return;
+  }
+  for (const entry of entries) {
+    collectManagedFiles(join(source, entry.name), join(target, entry.name), root, managedFiles, previousManagedFiles);
+  }
+}
+
+function managedPairs(root, roots, skills) {
+  const pairs = [];
+  const add = (source, target) => { if (existsSync(source) && existsSync(target)) pairs.push([source, target]); };
+  for (const agentRoot of roots) {
+    for (const skill of skills) add(join(SKILLS_ROOT, skill), join(agentRoot, "skills", skill));
+    add(REFERENCES_ROOT, join(agentRoot, "references"));
+  }
+  for (const group of ["clis", "runtime", "integrations"]) add(join(TOOLS_ROOT, group), join(root, "tools", group));
+  add(DESIGN_ROOT, join(root, ".maggie", "design-reference"));
+  add(MARKETPLACE_ROOT, join(root, "marketplace"));
+  add(CONTRACTS_ROOT, join(root, "contracts"));
+  add(join(TEMPLATES_ROOT, "maggiedash"), join(root, "templates", "maggiedash"));
+  return pairs;
+}
+
+function managedFileDigests(root, roots, skills, previousManagedFiles = {}) {
+  const managedFiles = {};
+  for (const [source, target] of managedPairs(root, roots, skills)) collectManagedFiles(source, target, root, managedFiles, previousManagedFiles);
+  return Object.fromEntries(Object.entries(managedFiles).sort(([a], [b]) => a.localeCompare(b)));
+}
+
+function readInstallManifest(root) {
+  try {
+    const path = join(root, STATE_DIR, "install.json");
+    return existsSync(path) ? JSON.parse(readFileSync(path, "utf8")) : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeInstallManifest(root, data) {
+  const stateDir = join(root, STATE_DIR);
+  mkdirSync(stateDir, { recursive: true });
+  writeFileSync(join(stateDir, "install.json"), JSON.stringify(data, null, 2) + "\n");
+}
+
 function install(args) {
   const root = projectRoot(args);
   const skills = selectedSkills(args);
@@ -336,9 +394,7 @@ function install(args) {
   if (existsSync(MARKETPLACE_ROOT)) copyIfMissing(MARKETPLACE_ROOT, join(root, "marketplace"));
   if (existsSync(CONTRACTS_ROOT)) copyIfMissing(CONTRACTS_ROOT, join(root, "contracts"));
   if (existsSync(join(TEMPLATES_ROOT, "maggiedash"))) copyIfMissing(join(TEMPLATES_ROOT, "maggiedash"), join(root, "templates", "maggiedash"));
-  const stateDir = join(root, ".maggie");
-  mkdirSync(stateDir, { recursive: true });
-  writeFileSync(join(stateDir, "install.json"), JSON.stringify({ version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills: mergedSkillNames(root, skills), installed_at: new Date().toISOString() }, null, 2) + "\n");
+  writeInstallManifest(root, { version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills: mergedSkillNames(root, skills), managedFiles: managedFileDigests(root, roots, skills), installed_at: new Date().toISOString() });
   console.log(`Maggie installed in ${root}`);
   console.log("Run `maggie doctor --project .` before using mutating workflows.");
 }
@@ -348,6 +404,8 @@ function update(args) {
   const skills = selectedSkills(args);
   const force = args.includes("--force");
   const roots = agentRoots(args, root);
+  const previousManifest = readInstallManifest(root);
+  const previousManagedFiles = previousManifest.managedFiles && typeof previousManifest.managedFiles === "object" ? previousManifest.managedFiles : {};
   if (!existsSync(SKILLS_ROOT)) throw new Error("bundled skills are missing; run npm pack from the package source");
   let updated = 0;
   for (const agentRoot of roots) {
@@ -358,24 +416,22 @@ function update(args) {
         console.log(`absent ${target} (run install to add it)`);
         continue;
       }
-      updated += syncTree(source, target, force);
+      updated += syncTree(source, target, force, root, previousManagedFiles);
     }
-    if (existsSync(REFERENCES_ROOT) && existsSync(join(agentRoot, "references"))) updated += syncTree(REFERENCES_ROOT, join(agentRoot, "references"), force);
+    if (existsSync(REFERENCES_ROOT) && existsSync(join(agentRoot, "references"))) updated += syncTree(REFERENCES_ROOT, join(agentRoot, "references"), force, root, previousManagedFiles);
   }
   const tools = join(root, "tools");
   if (existsSync(TOOLS_ROOT)) for (const group of ["clis", "runtime", "integrations"]) if (existsSync(join(TOOLS_ROOT, group))) {
     const target = join(tools, group);
-    if (existsSync(target)) updated += syncTree(join(TOOLS_ROOT, group), target, force);
+    if (existsSync(target)) updated += syncTree(join(TOOLS_ROOT, group), target, force, root, previousManagedFiles);
   }
   if (existsSync(join(DESIGN_ROOT, "SPA-DESIGN.md")) && existsSync(join(root, ".maggie", "design-reference"))) {
-    updated += syncTree(DESIGN_ROOT, join(root, ".maggie", "design-reference"), force);
+    updated += syncTree(DESIGN_ROOT, join(root, ".maggie", "design-reference"), force, root, previousManagedFiles);
   }
-  if (existsSync(MARKETPLACE_ROOT) && existsSync(join(root, "marketplace"))) updated += syncTree(MARKETPLACE_ROOT, join(root, "marketplace"), force);
-  if (existsSync(CONTRACTS_ROOT) && existsSync(join(root, "contracts"))) updated += syncTree(CONTRACTS_ROOT, join(root, "contracts"), force);
-  if (existsSync(join(TEMPLATES_ROOT, "maggiedash")) && existsSync(join(root, "templates", "maggiedash"))) updated += syncTree(join(TEMPLATES_ROOT, "maggiedash"), join(root, "templates", "maggiedash"), force);
-  const stateDir = join(root, STATE_DIR);
-  mkdirSync(stateDir, { recursive: true });
-  writeFileSync(join(stateDir, "install.json"), JSON.stringify({ version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills: mergedSkillNames(root, skills), updated_at: new Date().toISOString() }, null, 2) + "\n");
+  if (existsSync(MARKETPLACE_ROOT) && existsSync(join(root, "marketplace"))) updated += syncTree(MARKETPLACE_ROOT, join(root, "marketplace"), force, root, previousManagedFiles);
+  if (existsSync(CONTRACTS_ROOT) && existsSync(join(root, "contracts"))) updated += syncTree(CONTRACTS_ROOT, join(root, "contracts"), force, root, previousManagedFiles);
+  if (existsSync(join(TEMPLATES_ROOT, "maggiedash")) && existsSync(join(root, "templates", "maggiedash"))) updated += syncTree(join(TEMPLATES_ROOT, "maggiedash"), join(root, "templates", "maggiedash"), force, root, previousManagedFiles);
+  writeInstallManifest(root, { version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills: mergedSkillNames(root, skills), managedFiles: managedFileDigests(root, roots, skills, previousManagedFiles), updated_at: new Date().toISOString() });
   console.log(`Maggie update complete: ${updated} files changed`);
   if (!force) console.log("Local files with changes were preserved. Review the output and rerun with --force only when replacement is intended.");
 }
@@ -535,6 +591,7 @@ try {
   else if (command === "browser-audit") workflowCli("maggie_browser_audit.py", args);
   else if (command === "verification") workflowCli("maggie_verification.py", args);
   else if (command === "dash") workflowCli("maggie_dash.py", args);
+  else if (command === "booking") workflowCli("maggie_booking.py", args);
   else if (command === "agent-content") workflowCli("maggie_agent_content.py", args);
   else if (command === "content") workflowCli("maggie_content.py", args);
   else if (command === "init" || command === "install") install(args);

package/bundled-contracts/maggie-seo/model-policy-v2.schema.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-seo/model-policy-v2.schema.json",
+  "title": "Maggie provider-routed Gemini model policy v2",
+  "type": "object",
+  "required": ["policyVersion", "model", "fallbackModel", "promptVersion", "schemaVersion", "locale", "sourceRevision", "providerRoute"],
+  "properties": {
+    "policyVersion": {"const": "maggie-gemini-model-policy.v2"},
+    "model": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{1,99}$"},
+    "fallbackModel": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{1,99}$"},
+    "promptVersion": {"type": "string", "minLength": 1},
+    "schemaVersion": {"type": "string", "minLength": 1},
+    "locale": {"type": ["string", "null"]},
+    "sourceRevision": {"type": ["string", "null"]},
+    "providerRoute": {
+      "type": "object",
+      "required": ["provider", "endpointEnv", "apiKeyEnv", "billingMode", "maxTokens"],
+      "properties": {
+        "provider": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{1,63}$"},
+        "endpointEnv": {"type": "string", "pattern": "^[A-Z][A-Z0-9_]{2,63}$"},
+        "apiKeyEnv": {"type": "string", "pattern": "^[A-Z][A-Z0-9_]{2,63}$"},
+        "billingMode": {"enum": ["byok", "managed"]},
+        "maxTokens": {"type": "integer", "minimum": 1, "maximum": 32768}
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-service-booking/notification-lifecycle-v1.schema.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-service-booking/notification-lifecycle-v1.schema.json",
+  "title": "Maggie booking notification lifecycle v1",
+  "type": "object",
+  "required": ["schemaVersion", "bookingId", "state", "events"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-booking-notification-lifecycle.v1"},
+    "bookingId": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$"},
+    "state": {"enum": ["received", "pending-confirmation", "confirmed", "alternative-proposed", "cancelled", "failed"]},
+    "events": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["eventId", "type", "occurredAt", "idempotencyKey", "status", "recipientRole"],
+        "properties": {
+          "eventId": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$"},
+          "type": {"enum": ["acknowledgement", "studio-notification", "confirmation", "alternative", "cancellation"]},
+          "occurredAt": {"type": "string", "format": "date-time"},
+          "idempotencyKey": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$"},
+          "status": {"enum": ["pending", "sent", "failed", "suppressed"]},
+          "recipientRole": {"enum": ["customer", "studio"]}
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/README.md

@@ -24,6 +24,9 @@ frontend framework.
   for translation keys and ordered migration;
 - [`translation-cache-policy-v1.json`](translation-cache-policy-v1.json):
   restart-after-out-of-band-write evidence.
+- [`booking-email-templates-v1.json`](booking-email-templates-v1.json):
+  tenant-scoped Booking/Resend event templates, approved variables, and
+  server-only provider/recipient policy.
 - [`quality-contracts.md`](quality-contracts.md): reviewable inputs for
   disjoint page inventory, variant/media checks, binding resolution, repair
   convergence, and database target identity.

package/bundled-contracts/maggiedash/booking-access-v1.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-access-v1.json",
+  "title": "MaggieDash Booking access management v1",
+  "schemaVersion": "maggiedash-booking-access.v1",
+  "apiPrefix": "/api/maggie/booking/access.json",
+  "auth": { "administratorSession": "host-session-cookie", "emailPassword": true, "passkeys": false, "resendInvitation": true },
+  "roles": ["manager", "staff", "finance"],
+  "permissions": [
+    "calendar.read", "bookings.read", "bookings.manage", "customers.read",
+    "catalog.read", "catalog.manage", "staff.read", "staff.manage",
+    "resources.read", "resources.manage", "schedule.read", "schedule.manage",
+    "payments.read", "payments.manage", "refunds.manage", "settings.read",
+    "settings.manage", "reports.read", "audit.read"
+  ],
+  "endpointIds": ["booking.access.read", "booking.access.create", "booking.access.update", "booking.access.revoke"],
+  "canonicalRoutes": {
+    "booking.access.read": "GET /access.json",
+    "booking.access.create": "POST /access.json",
+    "booking.access.update": "PATCH /access.json",
+    "booking.access.revoke": "DELETE /access.json"
+  },
+  "policy": {
+    "tenantScoped": true,
+    "disabledAccountsStayDisabled": true,
+    "passwordMinimumLength": 12,
+    "auditActions": ["booking.access.created", "booking.access.updated", "booking.access.invited", "booking.access.password-reset", "booking.access.revoked"]
+  }
+}

package/bundled-contracts/maggiedash/booking-customer-surface-v1.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-customer-surface-v1.json",
+  "title": "MaggieDash Booking customer surface v1",
+  "schemaVersion": "maggiedash-booking-customer-surface.v1",
+  "apiPrefix": "/api/maggie/booking/public",
+  "pagePath": "/_maggie/booking/book",
+  "auth": "public-noindex",
+  "noindex": true,
+  "hostResponsibilities": ["tenant-binding", "origin-and-csrf", "rate-limit", "bot-protection", "opaque-payment-return-token", "sealed-customer-manage-token", "provider-and-notification-adapters"],
+  "endpointIds": [
+    "booking.public.catalog.read",
+    "booking.public.availability.read",
+    "booking.public.waitlist.join",
+    "booking.public.hold.create",
+    "booking.public.checkout.start",
+    "booking.public.payment-return.read",
+    "booking.public.manage.read",
+    "booking.public.booking-cancel",
+    "booking.public.booking-reschedule"
+  ],
+  "canonicalRoutes": {
+    "booking.public.catalog.read": "GET /catalog.json",
+    "booking.public.availability.read": "GET /availability.json?serviceVariantId={serviceVariantId}&date={date}",
+    "booking.public.waitlist.join": "POST /waitlist.json",
+    "booking.public.hold.create": "POST /holds.json",
+    "booking.public.checkout.start": "POST /checkout.json",
+    "booking.public.payment-return.read": "GET /payment-return.json?token={token}",
+    "booking.public.manage.read": "GET /manage.json?token={token}",
+    "booking.public.booking-cancel": "POST /bookings/{id}/cancel.json",
+    "booking.public.booking-reschedule": "POST /bookings/{id}/reschedule.json"
+  },
+  "responsePolicy": {
+    "cacheControl": "no-store",
+    "robots": "noindex",
+    "paymentRedirectProof": false,
+    "mutationPolicy": "all-public-mutations-require-idempotency-key-and-replay-original-result",
+    "holdInputPolicy": ["valid-email", "booking-update-consent"],
+    "sensitiveFields": ["projectId", "customerId", "providerPaymentRef", "token", "secret", "rawPayload"]
+  },
+  "tokenPolicy": {
+    "paymentReturn": "short-lived",
+    "customerManage": "30-day-sealed",
+    "rawTokenStorage": false
+  }
+}

package/bundled-contracts/maggiedash/booking-email-templates-v1.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-email-templates-v1.json",
+  "title": "MaggieDash Booking email templates v1",
+  "schemaVersion": "maggiedash-booking-email-templates.v1",
+  "apiPrefix": "/api/maggie/booking/email-templates.json",
+  "auth": {
+    "managerSession": "host-session-cookie",
+    "emailPassword": true,
+    "passkeys": false
+  },
+  "roles": ["owner", "admin", "manager"],
+  "events": [
+    { "id": "booking.confirmed", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
+    { "id": "booking.rescheduled", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
+    { "id": "booking.cancelled", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "reason", "siteName"] },
+    { "id": "booking.reminder", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
+    { "id": "payment.action_required", "variables": ["customerName", "serviceName", "bookingId", "actionUrl", "siteName"] },
+    { "id": "payment.refunded", "variables": ["customerName", "serviceName", "bookingId", "siteName"] },
+    { "id": "booking.waitlist.available", "variables": ["customerName", "serviceName", "when", "locationName", "bookingUrl", "siteName"] }
+  ],
+  "endpointIds": ["booking.email-templates.read", "booking.email-templates.draft", "booking.email-templates.publish", "booking.email-templates.rollback"],
+  "canonicalRoutes": {
+    "booking.email-templates.read": "GET /email-templates.json",
+    "booking.email-templates.draft": "PATCH /email-templates.json?action=draft",
+    "booking.email-templates.publish": "PATCH /email-templates.json?action=publish",
+    "booking.email-templates.rollback": "PATCH /email-templates.json?action=rollback"
+  },
+  "policy": {
+    "tenantScoped": true,
+    "auditRequired": true,
+    "idempotencyRequiredForMutations": true,
+    "syntax": "{{variable}}",
+    "maxHtmlLength": 50000,
+    "providerCredentialsRemainServerOnly": true,
+    "recipientDataNeverReturned": true
+  }
+}