@topy-ai/maggie 0.7.36 → 0.7.38

package/README-zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.36 init --agent all
+npx @topy-ai/maggie@0.7.38 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,7 +25,7 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 release 是 `0.7.36`，完成下一批已驗證 feedback：修正 doctor placeholder scope、Tailwind renderable source scope、internal link/fragment audit、unstable baseline classification、site-wide baseline reason、base64url asset hash、installed-file hash update safety，並加入 provider-routed Gemini v2、venue timezone/DST booking parsing、social-card release path、notification lifecycle contract 和 mobile hero video playback contract。provider-bound video generation 與 transactional delivery 已記錄在 issue #39；前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 release 是 `0.7.38`，加入可安裝的 `maggie-booking` workflow：MaggieDash Booking host bootstrap、傳統 email/password 團隊登入與 granular permissions、Stripe payment boundary、Resend outbox/template 管理、public customer booking flow、runtime/ops evidence checks，以及完整的 Booking 維護文件。全新的 Astro host 會自動補上可攜的 Node SSR adapter；已有 Cloudflare、Vercel、Netlify 或 Deno adapter 的專案會保留原本的部署選擇。Production activation 仍會 fail-closed，直到 host migration、owner、Stripe、scheduler 和 authenticated runtime evidence 都完成。上一版 `0.7.36` 完成下一批已驗證 feedback：修正 doctor placeholder scope、Tailwind renderable source scope、internal link/fragment audit、unstable baseline classification、site-wide baseline reason、base64url asset hash、installed-file hash update safety，並加入 provider-routed Gemini v2、venue timezone/DST booking parsing、social-card release path、notification lifecycle contract 和 mobile hero video playback contract。provider-bound video generation 與 transactional delivery 已記錄在 issue #39；前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及
@@ -57,6 +57,56 @@ section registry、短期 agent content bridge，以及 translation out-of-band
 browser evidence、rendered canary 與 deployment preflight。缺少必要 adapter 時
 回傳 `inconclusive`，只有五組 evidence 全部通過才回傳 `passed`。
 
+Booking 也有 tenant-scoped 的 Notifications 畫面，管理 Resend transactional
+delivery outbox：可查看去識別化的狀態與 sanitized error；owner/manager 只有
+在填寫 reason 並使用 idempotency key 時，才可以 replay `dead_letter` 項目。
+這是 Maggie 的 server-side delivery queue 與 audit 管理，不取代 Resend 自己的
+domain、audience、campaign 或 analytics console。
+
+在全新的 Astro 專案中，可以讓安裝流程補上缺少的 Booking runtime 套件：
+
+```bash
+maggie booking install --project . --confirm --install-dependencies
+```
+
+這個選項會依照專案現有的 npm/pnpm/yarn/bun lockfile，只安裝缺少的
+React、Phosphor、Tailwind、PostgreSQL、Stripe 和 SSR adapter 套件，保留已存在的
+版本，並更新相對應的 lockfile。空白 Astro 專案會補上可攜的
+`@astrojs/node` 與 `astro.config.mjs`；已有 `astro.config.*` 或
+Cloudflare/Vercel/Netlify/Deno adapter 的專案會保留原本的部署選擇。
+它不能和 `--dry-run` 或 `--diff` 一起使用。
+
+Booking 的 browser evidence gate 現在涵蓋全部 15 個 manager routes，在 mobile、
+tablet、desktop 三種 viewport 共需要 45 個 screens，包含 waitlist、locations、
+notifications、reports 和 audit。Production release 仍需要 authenticated HTTPS
+capture，並且 console、request、layout errors 都必須為空。
+
+可在不連線資料庫或 provider 的情況下，獨立驗證管理員設定員工登入的 access
+contract：
+
+```bash
+maggie booking access-contract
+```
+
+Booking Team access 支援透過 Resend 發送傳統 email/password 邀請、`manager`、
+`staff`、`finance` 角色、細粒度 permissions、staff profile 綁定、密碼重設、
+撤銷權限與 audit；不使用 passkey，也不會自動重新啟用 disabled account。
+
+可用以下命令獨立驗證 tenant-scoped Booking email template contract：
+
+```bash
+maggie booking email-templates-contract
+```
+
+Booking 內置七種 Resend 事件模板。Owner、administrator 和 Booking manager
+可以編輯 draft、用 sandbox sample data 預覽、發佈 audited version，或 rollback
+舊版本。每個事件只接受核准的 placeholder，worker 發送前會 escape value；
+provider credentials 和 recipient address 只留在 server/worker，不會返回瀏覽器。
+
+Owner 設定 Stripe secrets 後，Booking Overview 會提供 server-side 的
+「Verify Stripe connection」操作：檢查帳號與 webhook 設定，只保存不含 secrets
+的 capability 狀態，並寫入 audited、可安全重試的結果；Stripe keys 不會進入瀏覽器。
+
 新版 release gates：
 
 ```bash

package/README.md

@@ -60,7 +60,17 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 19 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.36`. It closes the next validated feedback batch:
+The current release is `0.7.38`. It adds adapter-aware fresh Astro Booking
+installation: blank hosts receive a portable Node SSR config while existing
+deployment adapters remain host-owned. It also adds the installable `maggie-booking`
+workflow for MaggieDash Booking: host bootstrap, traditional email/password
+team access with granular permissions, Stripe payment boundaries, Resend
+outbox and tenant email-template management, public customer booking flow,
+runtime/ops evidence checks, and the maintained Booking implementation docs.
+Production activation remains fail-closed until the host migration, owner,
+Stripe, scheduler, and authenticated runtime evidence are supplied.
+
+The previous `0.7.36` release closed the next validated feedback batch:
 production demo fixtures are development-only, Dash infers the persisted
 project id, clone asset extraction includes responsive/background assets, SEO
 structure hashes ignore content-hashed asset names, decorative empty alt text
@@ -517,8 +527,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.36 update --project . --force
-npx @topy-ai/maggie@0.7.36 cleanup --project .
+npx @topy-ai/maggie@0.7.38 update --project . --force
+npx @topy-ai/maggie@0.7.38 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -615,6 +625,103 @@ for local development or a configured private Git URL. The host project keeps
 ownership of routes, email/password auth, database, provider credentials, and
 the `/api/maggie/*` adapter.
 
+For an Astro project that also needs Booking, use the Booking installer. It
+installs the separate `./_maggie/booking` workspace plus missing email/password
+routes, first-owner registration, PostgreSQL/Stripe host adapter, public
+booking route, middleware scaffold, schema command, Resend worker, and an
+`.env.maggie-booking.example`:
+
+```bash
+maggie booking install --project . --confirm
+```
+
+For a fresh Astro host, let the explicit install also add only the missing
+Booking runtime packages through the host's existing npm/pnpm/yarn/bun
+package manager. This includes the server-rendering adapter when the project
+has no existing Astro deployment adapter:
+
+```bash
+maggie booking install --project . --confirm --install-dependencies
+```
+
+Existing dependency versions are preserved. A blank Astro project receives a
+portable `@astrojs/node` adapter and `astro.config.mjs`; an existing
+`astro.config.*` and Cloudflare/Vercel/Netlify/Deno adapter remain untouched.
+This option updates the matching lockfile and is intentionally incompatible
+with `--dry-run` and `--diff`.
+
+For a reviewed new host, `--bootstrap` also applies the installed idempotent
+Booking schema using the host's existing `DATABASE_URL`:
+
+```bash
+maggie booking install --project . --confirm --bootstrap
+```
+
+This remains opt-in and does not create the owner, configure Stripe, send
+email, or deploy. If the host has no `BOOKING_TOKEN_SECRET`, bootstrap creates
+one in the local `.env` without printing it. Existing secrets are preserved;
+short configured values fail closed. External secret stores must provision the
+key themselves.
+
+Run the read-only onboarding checklist after installation:
+
+```bash
+maggie booking setup --project .
+```
+
+Validate the administrator-managed staff access boundary independently of a
+database or provider:
+
+```bash
+maggie booking access-contract
+```
+
+The installed Booking workspace includes a Team access panel. An owner or
+administrator can invite email/password accounts through Resend, assign
+`manager`, `staff`, or `finance`, link a staff profile, edit granular
+permissions, reset or resend setup credentials, and revoke Booking access.
+The access contract is tenant-scoped, audited, and never silently reactivates
+a disabled account.
+
+Validate the tenant-scoped Booking email-template contract independently:
+
+```bash
+maggie booking email-templates-contract
+```
+
+The Booking workspace includes seven Resend event templates. Owner,
+administrator, and Booking managers can edit drafts, preview sandboxed sample
+data, publish audited versions, and roll back earlier versions. Event-specific
+placeholders are allowlisted and escaped before the host worker sends through
+Resend; provider credentials and recipient addresses remain server-only.
+
+The default `--host auto` only selects Astro when detected. Existing host files
+are preserved; a conventional `src/middleware.ts` receives the generated
+`/_maggie` rewrite block automatically, while unsupported middleware is
+preserved and reported for manual integration. This command does not apply migrations,
+create the owner, or configure Stripe/Resend secrets. The setup checklist
+reports required environment-key presence and the explicit schema,
+owner-registration, Stripe webhook, and Resend-worker steps without printing
+secret values or mutating the host.
+
+After the owner adds the Stripe secrets, the Booking Overview includes a
+server-side “Verify Stripe connection” action. It checks the account and
+webhook configuration, stores only non-secret capability status, and records
+an audited idempotent result; Stripe keys never enter the browser.
+
+Booking also includes a tenant-scoped Notifications screen for the Resend
+delivery outbox. It shows redacted delivery state and sanitized errors through
+`GET /api/maggie/booking/notifications.json`; an owner or manager can replay a
+`dead_letter` item through the UI only with a reason and idempotency key. This
+manages Maggie's server-side transactional delivery queue and audit trail; it
+does not replace Resend's own domain, audience, campaign, or analytics console.
+
+The Booking browser-evidence gate covers all 15 manager routes at mobile,
+tablet, and desktop viewports (45 required screens), including waitlist,
+locations, notifications, reports, and audit. A production release still
+requires an authenticated HTTPS capture with zero console, request, and
+layout errors.
+
 Compare an existing dashboard before replacing it:
 
 ```bash

package/bin/maggie.js

@@ -58,6 +58,7 @@ Usage:
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
+  maggie booking install|inspect|setup|contract|runtime-validate|ops-validate|release-gate|stripe-audit|tasks --project PATH [options]
   maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|variant-copy-validate|media-validate|bindings-validate|idempotency-validate|reconcile> [options]
   maggie dash inventory --pages-file FILE [--require-page-kinds] [--require-source-coverage]
   maggie dash api-contract --spec FILE
@@ -590,6 +591,7 @@ try {
   else if (command === "browser-audit") workflowCli("maggie_browser_audit.py", args);
   else if (command === "verification") workflowCli("maggie_verification.py", args);
   else if (command === "dash") workflowCli("maggie_dash.py", args);
+  else if (command === "booking") workflowCli("maggie_booking.py", args);
   else if (command === "agent-content") workflowCli("maggie_agent_content.py", args);
   else if (command === "content") workflowCli("maggie_content.py", args);
   else if (command === "init" || command === "install") install(args);

package/bundled-contracts/maggiedash/README.md

@@ -24,6 +24,9 @@ frontend framework.
   for translation keys and ordered migration;
 - [`translation-cache-policy-v1.json`](translation-cache-policy-v1.json):
   restart-after-out-of-band-write evidence.
+- [`booking-email-templates-v1.json`](booking-email-templates-v1.json):
+  tenant-scoped Booking/Resend event templates, approved variables, and
+  server-only provider/recipient policy.
 - [`quality-contracts.md`](quality-contracts.md): reviewable inputs for
   disjoint page inventory, variant/media checks, binding resolution, repair
   convergence, and database target identity.
@@ -50,7 +53,7 @@ import.
   items with stable ordering, nesting, and safe destinations;
 - [`dashboard-runtime-v1.json`](dashboard-runtime-v1.json) defines evidence
   that an admin screen mounted, ran its checks, and completed its data calls.
-- MaggieDash 0.2.6 also ships a screen-level host adapter contract and
+- MaggieDash 0.2.7 also ships a screen-level host adapter contract and
   provider-neutral install starters in the first-party distribution. The
   `host-adapter-v2` contract lists endpoint methods, public routes, response
   content types, and required fields; `maggie dash conformance` validates

package/bundled-contracts/maggiedash/booking-access-v1.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-access-v1.json",
+  "title": "MaggieDash Booking access management v1",
+  "schemaVersion": "maggiedash-booking-access.v1",
+  "apiPrefix": "/api/maggie/booking/access.json",
+  "auth": { "administratorSession": "host-session-cookie", "emailPassword": true, "passkeys": false, "resendInvitation": true },
+  "roles": ["manager", "staff", "finance"],
+  "permissions": [
+    "calendar.read", "bookings.read", "bookings.manage", "customers.read",
+    "catalog.read", "catalog.manage", "staff.read", "staff.manage",
+    "resources.read", "resources.manage", "schedule.read", "schedule.manage",
+    "payments.read", "payments.manage", "refunds.manage", "settings.read",
+    "settings.manage", "reports.read", "audit.read"
+  ],
+  "endpointIds": ["booking.access.read", "booking.access.create", "booking.access.update", "booking.access.revoke"],
+  "canonicalRoutes": {
+    "booking.access.read": "GET /access.json",
+    "booking.access.create": "POST /access.json",
+    "booking.access.update": "PATCH /access.json",
+    "booking.access.revoke": "DELETE /access.json"
+  },
+  "policy": {
+    "tenantScoped": true,
+    "disabledAccountsStayDisabled": true,
+    "passwordMinimumLength": 12,
+    "auditActions": ["booking.access.created", "booking.access.updated", "booking.access.invited", "booking.access.password-reset", "booking.access.revoked"]
+  }
+}

package/bundled-contracts/maggiedash/booking-customer-surface-v1.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-customer-surface-v1.json",
+  "title": "MaggieDash Booking customer surface v1",
+  "schemaVersion": "maggiedash-booking-customer-surface.v1",
+  "apiPrefix": "/api/maggie/booking/public",
+  "pagePath": "/_maggie/booking/book",
+  "auth": "public-noindex",
+  "noindex": true,
+  "hostResponsibilities": ["tenant-binding", "origin-and-csrf", "rate-limit", "bot-protection", "opaque-payment-return-token", "sealed-customer-manage-token", "provider-and-notification-adapters"],
+  "endpointIds": [
+    "booking.public.catalog.read",
+    "booking.public.availability.read",
+    "booking.public.waitlist.join",
+    "booking.public.hold.create",
+    "booking.public.checkout.start",
+    "booking.public.payment-return.read",
+    "booking.public.manage.read",
+    "booking.public.booking-cancel",
+    "booking.public.booking-reschedule"
+  ],
+  "canonicalRoutes": {
+    "booking.public.catalog.read": "GET /catalog.json",
+    "booking.public.availability.read": "GET /availability.json?serviceVariantId={serviceVariantId}&date={date}",
+    "booking.public.waitlist.join": "POST /waitlist.json",
+    "booking.public.hold.create": "POST /holds.json",
+    "booking.public.checkout.start": "POST /checkout.json",
+    "booking.public.payment-return.read": "GET /payment-return.json?token={token}",
+    "booking.public.manage.read": "GET /manage.json?token={token}",
+    "booking.public.booking-cancel": "POST /bookings/{id}/cancel.json",
+    "booking.public.booking-reschedule": "POST /bookings/{id}/reschedule.json"
+  },
+  "responsePolicy": {
+    "cacheControl": "no-store",
+    "robots": "noindex",
+    "paymentRedirectProof": false,
+    "mutationPolicy": "all-public-mutations-require-idempotency-key-and-replay-original-result",
+    "holdInputPolicy": ["valid-email", "booking-update-consent"],
+    "sensitiveFields": ["projectId", "customerId", "providerPaymentRef", "token", "secret", "rawPayload"]
+  },
+  "tokenPolicy": {
+    "paymentReturn": "short-lived",
+    "customerManage": "30-day-sealed",
+    "rawTokenStorage": false
+  }
+}

package/bundled-contracts/maggiedash/booking-email-templates-v1.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-email-templates-v1.json",
+  "title": "MaggieDash Booking email templates v1",
+  "schemaVersion": "maggiedash-booking-email-templates.v1",
+  "apiPrefix": "/api/maggie/booking/email-templates.json",
+  "auth": {
+    "managerSession": "host-session-cookie",
+    "emailPassword": true,
+    "passkeys": false
+  },
+  "roles": ["owner", "admin", "manager"],
+  "events": [
+    { "id": "booking.confirmed", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
+    { "id": "booking.rescheduled", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
+    { "id": "booking.cancelled", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "reason", "siteName"] },
+    { "id": "booking.reminder", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
+    { "id": "payment.action_required", "variables": ["customerName", "serviceName", "bookingId", "actionUrl", "siteName"] },
+    { "id": "payment.refunded", "variables": ["customerName", "serviceName", "bookingId", "siteName"] },
+    { "id": "booking.waitlist.available", "variables": ["customerName", "serviceName", "when", "locationName", "bookingUrl", "siteName"] }
+  ],
+  "endpointIds": ["booking.email-templates.read", "booking.email-templates.draft", "booking.email-templates.publish", "booking.email-templates.rollback"],
+  "canonicalRoutes": {
+    "booking.email-templates.read": "GET /email-templates.json",
+    "booking.email-templates.draft": "PATCH /email-templates.json?action=draft",
+    "booking.email-templates.publish": "PATCH /email-templates.json?action=publish",
+    "booking.email-templates.rollback": "PATCH /email-templates.json?action=rollback"
+  },
+  "policy": {
+    "tenantScoped": true,
+    "auditRequired": true,
+    "idempotencyRequiredForMutations": true,
+    "syntax": "{{variable}}",
+    "maxHtmlLength": 50000,
+    "providerCredentialsRemainServerOnly": true,
+    "recipientDataNeverReturned": true
+  }
+}

package/bundled-contracts/maggiedash/booking-host-adapter-v1.json

@@ -0,0 +1,78 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-host-adapter-v1.json",
+  "title": "MaggieDash Booking host adapter v1",
+  "schemaVersion": "maggiedash-booking-host-adapter.v1",
+  "apiPrefix": "/api/maggie/booking",
+  "auth": { "managerSession": "host-session-cookie", "emailPassword": true, "passkeys": false },
+  "requiredCapabilities": ["bookingOverview", "bookingCalendar", "bookingLifecycle", "customerLookup", "bookingWaitlist", "serviceCatalog", "locationSetup", "staffSetup", "resourceSetup", "paymentReconciliation", "bookingReports", "bookingSettings", "bookingAudit", "notificationOperations", "bookingAccess"],
+  "endpointIds": [
+    "booking.overview.read", "booking.reports.read", "booking.calendar.read", "booking.bookings.read", "booking.booking.read", "booking.booking.create", "booking.booking.transition", "booking.booking.reschedule", "booking.availability.read", "booking.holds.create", "booking.holds.release", "booking.customers.read", "booking.customer.read", "booking.waitlist.read", "booking.waitlist.update", "booking.catalog.read", "booking.catalog.write", "booking.locations.read", "booking.location.write", "booking.staff.read", "booking.staff.write", "booking.resources.read", "booking.resources.write", "booking.schedule.read", "booking.schedule.write", "booking.payments.read", "booking.payment.start", "booking.payment.reconcile", "booking.refund.start", "booking.notifications.read", "booking.notification.replay", "booking.health.read", "booking.payment-health.read", "booking.payment-health.verify", "booking.settings.read", "booking.settings.update", "booking.audit.read", "booking.events.read", "booking.runtime.read", "booking.provider.webhook"
+  ],
+  "canonicalRoutes": {
+    "booking.payment.start": "POST /payments/start.json",
+    "booking.refund.start": "POST /refunds.json",
+    "booking.notifications.read": "GET /notifications.json?status={status}",
+    "booking.notification.replay": "POST /notifications/{id}/replay.json",
+    "booking.payment-health.read": "GET /payment-health.json",
+    "booking.payment-health.verify": "POST /payment-health.json",
+    "booking.provider.webhook": "POST /webhooks/{provider}"
+  },
+  "serviceMethods": {
+    "booking.overview.read": "readOverview",
+    "booking.reports.read": "readReports",
+    "booking.calendar.read": "readCalendar",
+    "booking.bookings.read": "listBookings",
+    "booking.booking.read": "readBooking",
+    "booking.booking.create": "createBooking",
+    "booking.booking.transition": "transitionBooking",
+    "booking.booking.reschedule": "rescheduleBooking",
+    "booking.availability.read": "readAvailability",
+    "booking.holds.create": "createHold",
+    "booking.holds.release": "releaseHold",
+    "booking.customers.read": "listCustomers",
+    "booking.customer.read": "readCustomer",
+    "booking.waitlist.read": "listWaitlist",
+    "booking.waitlist.update": "updateWaitlist",
+    "booking.catalog.read": "readCatalog",
+    "booking.catalog.write": "updateCatalog",
+    "booking.locations.read": "listLocations",
+    "booking.location.write": "updateLocation",
+    "booking.staff.read": "listStaff",
+    "booking.staff.write": "updateStaff",
+    "booking.resources.read": "listResources",
+    "booking.resources.write": "updateResource",
+    "booking.schedule.read": "readSchedule",
+    "booking.schedule.write": "updateSchedule",
+    "booking.payments.read": "listPayments",
+    "booking.payment.start": "startPayment",
+    "booking.payment.reconcile": "reconcilePayment",
+    "booking.refund.start": "startRefund",
+    "booking.notifications.read": "listNotifications",
+    "booking.notification.replay": "replayNotification",
+    "booking.health.read": "readHealth",
+    "booking.payment-health.read": "readPaymentHealth",
+    "booking.payment-health.verify": "verifyPaymentConnection",
+    "booking.settings.read": "readSettings",
+    "booking.settings.update": "updateSettings",
+    "booking.audit.read": "listAudit",
+    "booking.events.read": "listEvents",
+    "booking.runtime.read": "readRuntime",
+    "booking.provider.webhook": "handleWebhook"
+  },
+  "customerServiceMethods": [
+    "readPublicCatalog",
+    "readPublicAvailability",
+    "createCustomerHold",
+    "startCustomerCheckout",
+    "readCustomerPaymentReturn",
+    "readCustomerManage",
+    "cancelCustomerBooking",
+    "rescheduleCustomerBooking",
+    "joinCustomerWaitlist"
+  ],
+  "runtimeEvidence": {
+    "requiredFields": ["id", "method", "route", "status", "requiredFieldsPresent"],
+    "auth": ["session", "provider-webhook"]
+  }
+}

package/bundled-contracts/maggiedash/booking-ops-evidence-v1.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "maggiedash-booking-ops-evidence.v1",
+  "requiredChecks": ["backup_restore", "alert_routing", "recovery_rehearsal"],
+  "requiredAlertCodes": [
+    "worker.lock_contention",
+    "worker.job_failed",
+    "worker.stale",
+    "availability.stale",
+    "payments.reconciliation_lag",
+    "notifications.retrying",
+    "notifications.dead_letter"
+  ],
+  "requiredCheckFields": {
+    "backup_restore": ["status", "backupVerifiedAt", "restoreVerifiedAt", "rowCountVerified"],
+    "alert_routing": ["status", "alertCodes", "criticalDeliveryVerified"],
+    "recovery_rehearsal": ["status", "rollbackWriteGuardVerified", "workerRestartVerified", "outboxReplayVerified"]
+  },
+  "safeFields": ["schemaVersion", "generatedAt", "environment", "tenant", "checks", "backup_restore", "alert_routing", "recovery_rehearsal", "status", "backupVerifiedAt", "restoreVerifiedAt", "rowCountVerified", "alertCodes", "criticalDeliveryVerified", "rollbackWriteGuardVerified", "workerRestartVerified", "outboxReplayVerified"]
+}