@topy-ai/maggie 0.7.35 → 0.7.37

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -10,7 +10,9 @@ metadata:
 ## Versioned Gemini policy
 
 AI-assisted SEO, localization, and content generation must resolve models
-through one explicit policy: `maggie-gemini-model-policy.v1`. Pin the primary
+through one explicit policy: `maggie-gemini-model-policy.v1` for legacy local
+routes or `contracts/maggie-seo/model-policy-v2.schema.json` for provider-routed
+work. Pin the primary
 model, declare a separate fallback, and record the policy version, exact
 prompt/schema versions, locale, and source revision with generated evidence.
 Only model availability failures (retired model, quota, timeout, or provider
@@ -18,6 +20,13 @@ Only model availability failures (retired model, quota, timeout, or provider
 invalid output remain errors. Do not scatter retired model defaults across
 routes.
 
+Provider-routed work must use policy v2 and declare the provider, endpoint
+environment variable, API-key environment variable, billing mode (`byok` or
+`managed`), and a finite `maxTokens` limit. A route is not considered BYOK
+merely because a key exists in the process; the selected endpoint and billing
+path must be recorded in the policy evidence. Never print key values or send a
+provider secret in a report.
+
 ## Static audit and sitemap evidence
 
 Run `maggie site-audit https://example.com --crawl --json` for sitemap-listed
@@ -129,6 +138,13 @@ maggie site-audit https://example.com --crawl --json \
   --reason 'https://example.com/pricing=approved pricing refresh'
 ```
 
+When the same approved reason applies to every drift, use `--reason-all` or
+`--reason '*=approved site-wide stylesheet rebuild'`. A URL-specific reason can
+still override the site-wide reason. If a page changes between its first and
+second fetch, the comparison reports it as `unstable` rather than silently
+calling it a content or markup change; review that page and supply a reason
+before recapture.
+
 The command fails closed when the current crawl is incomplete, a drift has no
 reason, a reason names a URL without a reported drift, or the destination file
 already exists. The new contract records its `baselineId`, `supersedes` value,
@@ -249,7 +265,9 @@ accepts JPEG, PNG, GIF, and ICO responses. It reports missing, unreachable,
 undersized, unreadable, or unsupported images and warns when one source is
 used for at least 75% of a sample of three or more pages. Page-specific
 first-band images remain an editorial choice and should be declared by the
-host manifest.
+host manifest. When `docs/social-cards-pages.json` or
+`docs/public-urls.json` exists, `maggie release` includes the social-card audit
+in its read-only release path.
 
 Head-tag auditing consumes a host-produced JSON manifest with `url`, `shell`,
 and normalized `tags`. It compares structural declarations for icons,
@@ -281,6 +299,10 @@ is intended; the report then says `"declared-origin"`.
 Use `--output <project>/docs/site-audit.json` to persist the evidence used by
 the release review.
 
+For a full crawl, add `--check-internal-links` to follow same-origin HTML links
+and check HTTP 200 targets plus `#fragment` IDs. External, mailto, and other
+non-site links are intentionally out of scope.
+
 - **Plan:** combine Project Context, GSC/search signals, competitor gaps, and
   AI visibility prompts into topic clusters and briefs.
 - **Audit:** inspect robots, sitemap, canonical URLs, metadata, JSON-LD,

package/bundled-skills/maggie-service-booking/SKILL.md

@@ -186,6 +186,25 @@ evidence artifact and validates the selected ending (`pending`, `redirect`,
 signals, and sitemap exclusion. It never stores response bodies or decides a
 redirect destination for the host.
 
+## Appointment time contract
+
+Any booking or seasonal variant that receives a timezone-naive wall-clock
+timestamp must carry an IANA `venueTimezone` such as `Europe/London`. The
+shared parser in `tools/clis/maggie_service_booking.py` applies venue DST rules
+instead of the server timezone. An ambiguous DST time must also declare
+`venueTimeFold: 0` or `1`; nonexistent local times are rejected. Prefer an
+offset-bearing timestamp when the provider already supplies one. This is a
+validation contract only: it does not claim that a provider supports booking
+creation or confirmation.
+
+When a host implements its own notification adapter, use
+[`notification-lifecycle-v1.schema.json`](../../bundled-contracts/maggie-service-booking/notification-lifecycle-v1.schema.json)
+to represent acknowledgement, studio notification, confirmation, alternative,
+and cancellation events. Every event needs an idempotency key and explicit
+status. A request must remain `pending-confirmation` until the host/provider
+actually confirms it; an email or UI receipt must never imply an appointment
+was booked. The contract is provider-neutral and does not send mail by itself.
+
 ## Asynchronous onboarding contract
 
 Provider onboarding is three independent state machines: `import` owns the

package/bundled-templates/astro-blog/starter/README.md

@@ -88,6 +88,10 @@ with `WORDPRESS_API_TOKEN` or a server-only application-password pair.
 The starter includes a Tailwind v4 Vite entry point for projects that choose
 Tailwind during bootstrap. It remains compatible with the existing contract
 surface and does not require replacing the host's design system.
+The entry point explicitly scopes Tailwind v4 scanning to renderable Astro
+pages, layouts, and components. API/lib fixtures and prose in server-only files
+are not treated as utility-class sources; keep that scope when adding a host
+component.
 
 `npm run maggie:*` uses the installed `maggie` binary. It is portable after the
 starter is copied out of this monorepo; it no longer depends on repository-

package/bundled-templates/astro-blog/starter/src/styles/global.css

@@ -1,4 +1,10 @@
 @import "tailwindcss";
 
+/* Scan renderable Astro surfaces only. Server fixtures and prose in API/lib
+   files must not become accidental utility classes in the shipped bundle. */
+@source "../pages/**/*.astro";
+@source "../layouts/**/*.astro";
+@source "../components/**/*.{astro,jsx,tsx}";
+
 /* The starter keeps its contract UI framework-neutral while providing a
    working Tailwind v4 entry point for projects that select Tailwind. */

package/bundled-tools/clis/maggie.py

@@ -23,6 +23,7 @@ STATE_FILE = "bootstrap-state.json"
 IGNORED_DIRS = {".git", ".next", "node_modules", "dist", "build", "coverage", "generated"}
 TEXT_SUFFIXES = {".css", ".html", ".js", ".jsx", ".md", ".mdx", ".svelte", ".ts", ".tsx", ".vue", ".astro", ".njk", ".liquid", ".json", ".yaml", ".yml"}
 DOCTOR_NON_SITE_DIRS = {".agents", ".claude", "__tests__", "contracts", "docs", "examples", "fixtures", "marketplace", "references", "scripts", "test", "tests", "tools"}
+DOCTOR_SERVER_DIRS = {"api", "data", "lib", "server", "services"}
 WORKFLOW_PHASES = (
     "maggiedash-foundation",
     "project-research",
@@ -81,6 +82,26 @@ def doctor_source_files(root: Path, files: list[Path]) -> list[Path]:
     return result
 
 
+def doctor_placeholder_files(root: Path, source_files: list[Path], rendered_dir: str | None = None) -> tuple[list[Path], str]:
+    """Choose rendered output first, with a narrow public-source fallback.
+
+    Server fixtures and CLI examples are not shipped page metadata and must not
+    fail a public-site placeholder check. A build output directory is the
+    strongest evidence; ``--rendered-dir`` makes that choice explicit for CI.
+    """
+    candidates = [Path(rendered_dir).expanduser().resolve()] if rendered_dir else [root / name for name in ("dist", "build", "out", "public")]
+    for candidate in candidates:
+        if not candidate.is_dir():
+            continue
+        files = sorted(path for path in candidate.rglob("*") if path.is_file() and path.suffix.lower() in TEXT_SUFFIXES)
+        return files, "rendered-output"
+    fallback = [
+        path for path in source_files
+        if not any(part.lower() in DOCTOR_SERVER_DIRS for part in path.relative_to(root).parts[:-1])
+    ]
+    return fallback, "public-site-source"
+
+
 def package_info(root: Path) -> tuple[dict, Path | None]:
     candidates = [root / "package.json"] + sorted(path for path in root.glob("*/package.json") if path.parent.name not in IGNORED_DIRS)
     parsed: list[tuple[int, dict, Path]] = []
@@ -819,6 +840,8 @@ def command_doctor(args: argparse.Namespace) -> int:
     files = list(files_for(root))
     source_files = doctor_source_files(root, files)
     text = "\n".join(read_text(path) for path in source_files)
+    placeholder_files, placeholder_scope = doctor_placeholder_files(root, source_files, getattr(args, "rendered_dir", None))
+    placeholder_text = "\n".join(read_text(path) for path in placeholder_files)
     paths = [evidence(path, root).lower() for path in source_files]
 
     checks = {
@@ -838,7 +861,7 @@ def command_doctor(args: argparse.Namespace) -> int:
         "jsonld_dates": "datePublished" in text and ("dateModified" in text or "updatedAt" in text),
         "published_only_guard": "published" in text.lower() and any(token in text.lower() for token in {"sitemap", "post"}),
         "no_public_api_key": not bool(re.search(r"(?:PUBLIC|NEXT_PUBLIC)[A-Z0-9_]*(?:API|KEY|TOKEN)", text, re.IGNORECASE)),
-        "no_placeholder_metadata": not any(token in text.lower() for token in {"your-domain.com", "example.com", "lorem ipsum", "replace-me"}),
+        "no_placeholder_metadata": not any(token in placeholder_text.lower() for token in {"your-domain.com", "example.com", "lorem ipsum", "replace-me"}),
     }
     if args.strict:
         checks.update({
@@ -886,7 +909,7 @@ def command_doctor(args: argparse.Namespace) -> int:
             safe_skips.append("robots route requires framework confirmation")
         for check, reason in (("canonical_metadata", "canonical metadata needs a site-specific URL"), ("meta_description", "metadata content needs editorial input"), ("article_jsonld", "JSON-LD shape needs content-specific fields")):
             if not checks[check]: safe_skips.append(reason)
-    result = {"project_root": str(root), "placeholder_scan": {"scope": "public-site-source", "files": len(source_files)}, "checks": {key: {"ok": value} for key, value in checks.items()}, "passed": all(checks.values())}
+    result = {"project_root": str(root), "placeholder_scan": {"scope": placeholder_scope, "files": len(placeholder_files)}, "checks": {key: {"ok": value} for key, value in checks.items()}, "passed": all(checks.values())}
     if getattr(args, "fix_safe", False): result["safe_fixes"] = {"applied": safe_fixes, "skipped_requires_confirmation": safe_skips}
     print(json.dumps(result, indent=2))
     return 0 if result["passed"] else 1
@@ -940,6 +963,13 @@ def command_feedback(args: argparse.Namespace) -> int:
     return completed.returncode
 
 
+def command_booking(args: argparse.Namespace) -> int:
+    """Dispatch Booking contract checks through the canonical Booking CLI."""
+    cli = Path(__file__).with_name("maggie_booking.py")
+    completed = subprocess.run([sys.executable, str(cli), *args.booking_args], cwd=Path.cwd(), check=False)
+    return completed.returncode
+
+
 def parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(prog="maggie", description=__doc__)
     sub = p.add_subparsers(dest="command", required=True)
@@ -994,12 +1024,16 @@ def parser() -> argparse.ArgumentParser:
     feedback = sub.add_parser("feedback", help="collect, review, and submit privacy-safe feedback")
     feedback.add_argument("feedback_args", nargs=argparse.REMAINDER, help="arguments for maggie_feedback.py")
     feedback.set_defaults(func=command_feedback)
+    booking = sub.add_parser("booking", help="inspect and validate the MaggieDash Booking workspace")
+    booking.add_argument("booking_args", nargs=argparse.REMAINDER, help="arguments for maggie_booking.py")
+    booking.set_defaults(func=command_booking)
     doctor = sub.add_parser("doctor", help="check blog routes and SEO output invariants")
     doctor.add_argument("project", nargs="?", default=".")
     doctor.add_argument("--require-bootstrap", action="store_true")
     doctor.add_argument("--strict", action="store_true", help="also require the complete AI-native blog and Ops surface")
     doctor.add_argument("--ci", action="store_true", help="CI alias for strict checks")
     doctor.add_argument("--fix-safe", action="store_true", help="apply only low-risk route fixes; never changes schema, slugs, canonical URLs or publishing state")
+    doctor.add_argument("--rendered-dir", help="scan this build output for placeholder metadata instead of source fixtures")
     doctor.set_defaults(func=command_doctor)
     for name in ("routes", "schema", "seo", "migration", "env"):
         check = sub.add_parser(name, help=f"run Maggie {name} contract checks")