@topy-ai/maggie 0.7.37 → 0.7.38

package/README-zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.37 init --agent all
+npx @topy-ai/maggie@0.7.38 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,7 +25,7 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 release 是 `0.7.37`，加入可安裝的 `maggie-booking` workflow：MaggieDash Booking host bootstrap、傳統 email/password 團隊登入與 granular permissions、Stripe payment boundary、Resend outbox/template 管理、public customer booking flow、runtime/ops evidence checks，以及完整的 Booking 維護文件。Production activation 仍會 fail-closed，直到 host migration、owner、Stripe、scheduler 和 authenticated runtime evidence 都完成。上一版 `0.7.36` 完成下一批已驗證 feedback：修正 doctor placeholder scope、Tailwind renderable source scope、internal link/fragment audit、unstable baseline classification、site-wide baseline reason、base64url asset hash、installed-file hash update safety，並加入 provider-routed Gemini v2、venue timezone/DST booking parsing、social-card release path、notification lifecycle contract 和 mobile hero video playback contract。provider-bound video generation 與 transactional delivery 已記錄在 issue #39；前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 release 是 `0.7.38`，加入可安裝的 `maggie-booking` workflow：MaggieDash Booking host bootstrap、傳統 email/password 團隊登入與 granular permissions、Stripe payment boundary、Resend outbox/template 管理、public customer booking flow、runtime/ops evidence checks，以及完整的 Booking 維護文件。全新的 Astro host 會自動補上可攜的 Node SSR adapter；已有 Cloudflare、Vercel、Netlify 或 Deno adapter 的專案會保留原本的部署選擇。Production activation 仍會 fail-closed，直到 host migration、owner、Stripe、scheduler 和 authenticated runtime evidence 都完成。上一版 `0.7.36` 完成下一批已驗證 feedback：修正 doctor placeholder scope、Tailwind renderable source scope、internal link/fragment audit、unstable baseline classification、site-wide baseline reason、base64url asset hash、installed-file hash update safety，並加入 provider-routed Gemini v2、venue timezone/DST booking parsing、social-card release path、notification lifecycle contract 和 mobile hero video playback contract。provider-bound video generation 與 transactional delivery 已記錄在 issue #39；前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及
@@ -70,8 +70,11 @@ maggie booking install --project . --confirm --install-dependencies
 ```
 
 這個選項會依照專案現有的 npm/pnpm/yarn/bun lockfile，只安裝缺少的
-React、Phosphor、Tailwind、PostgreSQL 和 Stripe 套件，保留已存在的版本，
-並更新相對應的 lockfile；它不能和 `--dry-run` 或 `--diff` 一起使用。
+React、Phosphor、Tailwind、PostgreSQL、Stripe 和 SSR adapter 套件，保留已存在的
+版本，並更新相對應的 lockfile。空白 Astro 專案會補上可攜的
+`@astrojs/node` 與 `astro.config.mjs`；已有 `astro.config.*` 或
+Cloudflare/Vercel/Netlify/Deno adapter 的專案會保留原本的部署選擇。
+它不能和 `--dry-run` 或 `--diff` 一起使用。
 
 Booking 的 browser evidence gate 現在涵蓋全部 15 個 manager routes，在 mobile、
 tablet、desktop 三種 viewport 共需要 45 個 screens，包含 waitlist、locations、
@@ -100,6 +103,10 @@ Booking 內置七種 Resend 事件模板。Owner、administrator 和 Booking man
 舊版本。每個事件只接受核准的 placeholder，worker 發送前會 escape value；
 provider credentials 和 recipient address 只留在 server/worker，不會返回瀏覽器。
 
+Owner 設定 Stripe secrets 後，Booking Overview 會提供 server-side 的
+「Verify Stripe connection」操作：檢查帳號與 webhook 設定，只保存不含 secrets
+的 capability 狀態，並寫入 audited、可安全重試的結果；Stripe keys 不會進入瀏覽器。
+
 新版 release gates：
 
 ```bash

package/README.md

@@ -60,7 +60,9 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 19 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.37`. It adds the installable `maggie-booking`
+The current release is `0.7.38`. It adds adapter-aware fresh Astro Booking
+installation: blank hosts receive a portable Node SSR config while existing
+deployment adapters remain host-owned. It also adds the installable `maggie-booking`
 workflow for MaggieDash Booking: host bootstrap, traditional email/password
 team access with granular permissions, Stripe payment boundaries, Resend
 outbox and tenant email-template management, public customer booking flow,
@@ -525,8 +527,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.37 update --project . --force
-npx @topy-ai/maggie@0.7.37 cleanup --project .
+npx @topy-ai/maggie@0.7.38 update --project . --force
+npx @topy-ai/maggie@0.7.38 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -635,14 +637,18 @@ maggie booking install --project . --confirm
 
 For a fresh Astro host, let the explicit install also add only the missing
 Booking runtime packages through the host's existing npm/pnpm/yarn/bun
-package manager:
+package manager. This includes the server-rendering adapter when the project
+has no existing Astro deployment adapter:
 
 ```bash
 maggie booking install --project . --confirm --install-dependencies
 ```
 
-Existing dependency versions are preserved. This option updates the matching
-lockfile and is intentionally incompatible with `--dry-run` and `--diff`.
+Existing dependency versions are preserved. A blank Astro project receives a
+portable `@astrojs/node` adapter and `astro.config.mjs`; an existing
+`astro.config.*` and Cloudflare/Vercel/Netlify/Deno adapter remain untouched.
+This option updates the matching lockfile and is intentionally incompatible
+with `--dry-run` and `--diff`.
 
 For a reviewed new host, `--bootstrap` also applies the installed idempotent
 Booking schema using the host's existing `DATABASE_URL`:
@@ -698,6 +704,11 @@ reports required environment-key presence and the explicit schema,
 owner-registration, Stripe webhook, and Resend-worker steps without printing
 secret values or mutating the host.
 
+After the owner adds the Stripe secrets, the Booking Overview includes a
+server-side “Verify Stripe connection” action. It checks the account and
+webhook configuration, stores only non-secret capability status, and records
+an audited idempotent result; Stripe keys never enter the browser.
+
 Booking also includes a tenant-scoped Notifications screen for the Resend
 delivery outbox. It shows redacted delivery state and sanitized errors through
 `GET /api/maggie/booking/notifications.json`; an owner or manager can replay a

package/bundled-contracts/maggiedash/README.md

@@ -53,7 +53,7 @@ import.
   items with stable ordering, nesting, and safe destinations;
 - [`dashboard-runtime-v1.json`](dashboard-runtime-v1.json) defines evidence
   that an admin screen mounted, ran its checks, and completed its data calls.
-- MaggieDash 0.2.6 also ships a screen-level host adapter contract and
+- MaggieDash 0.2.7 also ships a screen-level host adapter contract and
   provider-neutral install starters in the first-party distribution. The
   `host-adapter-v2` contract lists endpoint methods, public routes, response
   content types, and required fields; `maggie dash conformance` validates

package/bundled-contracts/maggiedash/booking-host-adapter-v1.json

@@ -7,7 +7,7 @@
   "auth": { "managerSession": "host-session-cookie", "emailPassword": true, "passkeys": false },
   "requiredCapabilities": ["bookingOverview", "bookingCalendar", "bookingLifecycle", "customerLookup", "bookingWaitlist", "serviceCatalog", "locationSetup", "staffSetup", "resourceSetup", "paymentReconciliation", "bookingReports", "bookingSettings", "bookingAudit", "notificationOperations", "bookingAccess"],
   "endpointIds": [
-    "booking.overview.read", "booking.reports.read", "booking.calendar.read", "booking.bookings.read", "booking.booking.read", "booking.booking.create", "booking.booking.transition", "booking.booking.reschedule", "booking.availability.read", "booking.holds.create", "booking.holds.release", "booking.customers.read", "booking.customer.read", "booking.waitlist.read", "booking.waitlist.update", "booking.catalog.read", "booking.catalog.write", "booking.locations.read", "booking.location.write", "booking.staff.read", "booking.staff.write", "booking.resources.read", "booking.resources.write", "booking.schedule.read", "booking.schedule.write", "booking.payments.read", "booking.payment.start", "booking.payment.reconcile", "booking.refund.start", "booking.notifications.read", "booking.notification.replay", "booking.health.read", "booking.payment-health.read", "booking.settings.read", "booking.settings.update", "booking.audit.read", "booking.events.read", "booking.runtime.read", "booking.provider.webhook"
+    "booking.overview.read", "booking.reports.read", "booking.calendar.read", "booking.bookings.read", "booking.booking.read", "booking.booking.create", "booking.booking.transition", "booking.booking.reschedule", "booking.availability.read", "booking.holds.create", "booking.holds.release", "booking.customers.read", "booking.customer.read", "booking.waitlist.read", "booking.waitlist.update", "booking.catalog.read", "booking.catalog.write", "booking.locations.read", "booking.location.write", "booking.staff.read", "booking.staff.write", "booking.resources.read", "booking.resources.write", "booking.schedule.read", "booking.schedule.write", "booking.payments.read", "booking.payment.start", "booking.payment.reconcile", "booking.refund.start", "booking.notifications.read", "booking.notification.replay", "booking.health.read", "booking.payment-health.read", "booking.payment-health.verify", "booking.settings.read", "booking.settings.update", "booking.audit.read", "booking.events.read", "booking.runtime.read", "booking.provider.webhook"
   ],
   "canonicalRoutes": {
     "booking.payment.start": "POST /payments/start.json",
@@ -15,6 +15,7 @@
     "booking.notifications.read": "GET /notifications.json?status={status}",
     "booking.notification.replay": "POST /notifications/{id}/replay.json",
     "booking.payment-health.read": "GET /payment-health.json",
+    "booking.payment-health.verify": "POST /payment-health.json",
     "booking.provider.webhook": "POST /webhooks/{provider}"
   },
   "serviceMethods": {
@@ -51,6 +52,7 @@
     "booking.notification.replay": "replayNotification",
     "booking.health.read": "readHealth",
     "booking.payment-health.read": "readPaymentHealth",
+    "booking.payment-health.verify": "verifyPaymentConnection",
     "booking.settings.read": "readSettings",
     "booking.settings.update": "updateSettings",
     "booking.audit.read": "listAudit",

package/bundled-contracts/maggiedash/execution-board.json

@@ -79,7 +79,7 @@
       "status": "passed",
       "plan": ["Define request validation and safe error mapping", "Implement read DTO builders", "Implement mutation command dispatch with transaction hooks", "Keep host database/credentials injected"],
       "implementation": ["backend/booking/service.mjs", "backend/booking/dto.mjs", "backend/booking/request.mjs", "backend/booking/route-handler.mjs"],
-      "tests": ["reference host endpoint conformance", "booking service validator including canonical list-object responses", "booking route-handler validator across all 39 routes", "safe error and redaction tests", "project authorization fixtures"],
+      "tests": ["reference host endpoint conformance", "booking service validator including canonical list-object responses", "booking route-handler validator across all 40 routes", "safe error and redaction tests", "project authorization fixtures"],
       "docs": ["docs/maggiedash-booking/HOST-ADAPTER.md", "backend/README.md"],
       "acceptance": ["Host routes return canonical DTOs", "No SQL/provider/raw credentials cross the boundary", "All failures use the versioned safe error shape"]
     },
@@ -198,7 +198,7 @@
       "implementation": ["scripts/capture-booking-runtime-evidence.mjs", "scripts/validate-booking-runtime-plan.mjs", "scripts/validate-booking-runtime-evidence.mjs", "scripts/capture-booking-browser-evidence.mjs", "scripts/validate-booking-browser-evidence.mjs", ".github/workflows/booking-runtime-evidence.yml", ".github/workflows/booking-browser-evidence.yml"],
       "tests": ["maggie booking runtime-validate", "npm run booking:runtime:plan:test", "runtime evidence validator", "browser evidence validator including console/request/layoutErrors", "real host runtime plan run", "real host Playwright run"],
       "docs": ["docs/maggiedash-booking/QA-TEST-PLAN.md", "docs/maggiedash-booking/PROGRESS.md"],
-      "acceptance": ["All 39 manager endpoints have 2xx evidence", "All 15 manager screens pass at 3 viewports", "No console errors, failed requests, overflow, or login leakage"]
+      "acceptance": ["All 40 manager endpoints have 2xx evidence", "All 15 manager screens pass at 3 viewports", "No console errors, failed requests, overflow, or login leakage"]
     },
     {
       "id": "BK-032",
@@ -315,7 +315,7 @@
       "implementation": ["contracts/maggiedash/booking-host-adapter-v1.json", "tools/clis/maggie_booking.py", "tools/tests/test_maggie_booking.py", "docs/maggiedash-booking/SKILLS-AND-CLI.md"],
       "tests": ["python3 -m unittest tools.tests.test_maggie_booking -v", "maggie booking contract", "maggie booking tasks validate", "maggie booking inspect --project <installed-projection>", "python3 -m py_compile"],
       "docs": ["docs/maggiedash-booking/SKILLS-AND-CLI.md", "docs/maggiedash-booking/PROGRESS.md"],
-      "acceptance": ["The compact contract maps all 39 manager endpoints and nine customer methods", "Installed inspect fails when service types or validator are missing", "Release gate includes the service contract checks", "A regression test prevents service surface drift"]
+      "acceptance": ["The compact contract maps all 40 manager endpoints and nine customer methods", "Installed inspect fails when service types or validator are missing", "Release gate includes the service contract checks", "A regression test prevents service surface drift"]
     },
     {
       "id": "BK-041",
@@ -1218,7 +1218,7 @@
       "acceptance": [
         "A blank host can create its first location without a fixture ID",
         "Location writes validate timezone, scope, permission, uniqueness, and idempotent replay",
-        "The central and ORA location screen, 39-route contract, reference host, and configuration gates pass"
+        "The central and ORA location screen, 40-route contract, reference host, and configuration gates pass"
       ]
     },
     {
@@ -1230,7 +1230,7 @@
       "status": "passed",
       "plan": [
         "Add the location capability and two location endpoint IDs to the public installer contract",
-        "Align service-method mappings and the CLI detailed-contract count with MaggieDash's 39-route contract",
+        "Align service-method mappings and the CLI detailed-contract count with MaggieDash's 40-route contract",
         "Add regression coverage so future route additions cannot leave the installer contract stale"
       ],
       "implementation": [
@@ -1252,7 +1252,7 @@
         "docs/maggiedash-booking/README.md"
       ],
       "acceptance": [
-        "The ai-cmo-skills installer contract declares all 39 manager endpoints",
+        "The ai-cmo-skills installer contract declares all 40 manager endpoints",
         "The location capability and list/update service methods are present",
         "The public CLI and MaggieDash contract validators agree without host secrets or database access"
       ]
@@ -1263,7 +1263,7 @@
       "title": "Verify and release the public MaggieDash install source",
       "repository": "MaggieDash + release owner",
       "dependsOn": ["BK-077"],
-      "status": "needs-evidence",
+      "status": "passed",
       "plan": [
         "Commit and publish the local MaggieDash manifest hostBootstrap declaration and Booking source changes",
         "Run the default GitHub-source installer against a disposable Astro project",
@@ -1291,7 +1291,7 @@
       "acceptance": [
         "The default public source declares an Astro host bootstrap under hostBootstrap.astro",
         "A fresh Astro project can install Booking without a local MaggieDash checkout",
-        "The released source contains the same 39-route contract and worker/schema artifacts as the validated local source"
+        "The released source contains the same 40-route contract and worker/schema artifacts as the validated local source"
       ]
     },
     {
@@ -1326,7 +1326,7 @@
         "docs/maggiedash-booking/EXECUTION-BOARD.json"
       ],
       "acceptance": [
-        "The npm CLI validates the current 39-route Booking contract from bundled-contracts",
+        "The npm CLI validates the current 40-route Booking contract from bundled-contracts",
         "The npm CLI can validate Stripe and the packaged 69-task execution board",
         "Source-checkout and npm-package path layouts both remain supported"
       ]
@@ -1369,7 +1369,7 @@
         "Notification list results are tenant-scoped and omit raw recipient email/provider payloads",
         "Only an authorized owner/manager can replay a dead-letter notification",
         "Replay requires reason and idempotency, resets delivery state, and records event plus audit evidence",
-        "Central, installer contract, package bundle, ORA mirror, and build evidence agree on 39 manager routes"
+        "Central, installer contract, package bundle, ORA mirror, and build evidence agree on 40 manager routes"
       ]
     },
     {
@@ -1802,7 +1802,7 @@
       "status": "passed",
       "plan": [
         "Detect the host project's existing npm, pnpm, yarn, or bun lockfile",
-        "Add only missing React, Phosphor, Tailwind, PostgreSQL, and Stripe packages through the selected package manager",
+        "Add only missing React, Phosphor, Tailwind, PostgreSQL, Stripe, and SSR adapter packages through the selected package manager",
         "Keep dependency installation explicit and incompatible with read-only install modes",
         "Cover idempotency, package-manager selection, and failure-safe output in the CLI tests"
       ],
@@ -1829,6 +1829,7 @@
       ],
       "acceptance": [
         "A fresh Astro host can opt into one-command dependency completion without replacing existing versions",
+        "A blank Astro host receives a server-rendered Node adapter/config while an existing deployment adapter remains host-owned",
         "The selected package manager and missing package names are visible without printing secrets",
         "No package install occurs during --dry-run or --diff",
         "A project with all required packages is unchanged and no package-manager process runs"

package/bundled-skills/maggie-booking/SKILL.md

@@ -88,13 +88,15 @@ maggie booking install --project . --confirm --install-dependencies
 
 This is an explicit dependency mutation. It preserves existing package
 versions, updates the matching lockfile, and never installs a second copy of a
-package already present in `dependencies` or `devDependencies`.
-
-The default installer source is the public MaggieDash distribution. It must
-contain the released Astro `hostBootstrap` manifest and 39-route Booking
-source. While validating an unreleased local checkout, pass
-`--source /home/balalior/Dev/MaggieDash`; do not present a local-source result
-as proof that the public npm install path is released.
+package already present in `dependencies` or `devDependencies`. For a blank
+Astro host it also adds the compatible `@astrojs/node` SSR adapter and the
+portable server config; an existing `astro.config.*` and deployment adapter
+remain host-owned.
+
+The default installer source is the public MaggieDash `0.2.8` distribution. It
+contains the released Astro `hostBootstrap` manifest and 40-route Booking
+source. A fresh public-source install, `maggie booking inspect`, and
+`astro build` are the release evidence; a local-source result alone is not.
 
 For a new host with a reviewed `DATABASE_URL`, the explicit one-command
 bootstrap also applies the idempotent Booking schema:

package/bundled-tools/clis/maggie_booking.py

@@ -403,6 +403,14 @@ REQUIRED_HOST_DEPENDENCIES = (
     "tailwindcss",
 )
 
+ASTRO_ADAPTER_DEPENDENCIES = (
+    "@astrojs/node",
+    "@astrojs/cloudflare",
+    "@astrojs/netlify",
+    "@astrojs/vercel",
+    "@astrojs/deno",
+)
+
 # Keep the host install path reproducible without taking ownership of the
 # host's Astro version. Existing dependencies are left untouched; only
 # missing packages are added by `--install-dependencies`.
@@ -415,17 +423,74 @@ HOST_DEPENDENCY_RANGES = {
     "react-dom": "^19.0.0",
     "stripe": "^22.0.0",
     "tailwindcss": "^4.0.0",
+    "@astrojs/node": "^9.5.0",
+    "@astrojs/cloudflare": "^12.0.0",
+    "@astrojs/netlify": "^6.0.0",
+    "@astrojs/vercel": "^8.0.0",
+    "@astrojs/deno": "^6.0.0",
 }
 
 
+def astro_config_files(root: Path) -> list[Path]:
+    return sorted(root.glob("astro.config.*"))
+
+
+def astro_adapter_dependency(root: Path) -> str | None:
+    """Choose the existing Astro adapter, or the portable Node default.
+
+    A host-owned config takes precedence. A fresh Astro project gets the Node
+    adapter because Booking includes server routes; existing Cloudflare,
+    Netlify, Vercel, or Deno deployments are never replaced or supplemented.
+    """
+    try:
+        package = json.loads((root / "package.json").read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        package = {}
+    installed = set(package.get("dependencies") or {}) | set(package.get("devDependencies") or {})
+    configs = astro_config_files(root)
+    if "astro" not in installed and not configs and not any(root.glob("src/**/*.astro")):
+        return None
+    for name in ASTRO_ADAPTER_DEPENDENCIES:
+        if name in installed:
+            return name
+    config_text = "\n".join(path.read_text(encoding="utf-8", errors="ignore") for path in configs if path.is_file())
+    for name in ASTRO_ADAPTER_DEPENDENCIES:
+        if name in config_text:
+            return name
+    if not configs:
+        return "@astrojs/node"
+    # A project-specific adapter may be imported from a private package or
+    # local module. Do not guess or install Node over that host decision.
+    if "adapter" in config_text:
+        return None
+    return "@astrojs/node"
+
+
 def missing_host_dependencies(root: Path) -> list[str]:
     """Return only host packages absent from both dependency sections."""
     try:
         package = json.loads((root / "package.json").read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
-        return list(REQUIRED_HOST_DEPENDENCIES)
+        package = {}
     installed = set(package.get("dependencies") or {}) | set(package.get("devDependencies") or {})
-    return sorted(name for name in REQUIRED_HOST_DEPENDENCIES if name not in installed)
+    required = list(REQUIRED_HOST_DEPENDENCIES)
+    adapter = astro_adapter_dependency(root)
+    if adapter and adapter not in required:
+        required.append(adapter)
+    return sorted(name for name in required if name not in installed)
+
+
+def dependency_range(name: str, root: Path) -> str:
+    if name != "@astrojs/node":
+        return HOST_DEPENDENCY_RANGES[name]
+    try:
+        package = json.loads((root / "package.json").read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        package = {}
+    version = str((package.get("dependencies") or {}).get("astro") or (package.get("devDependencies") or {}).get("astro") or "")
+    match = re.search(r"(?:^|[^0-9])([0-9]+)(?:\.[0-9]+)?(?:\.[0-9]+)?", version)
+    major = int(match.group(1)) if match else 5
+    return "^9.5.0" if major <= 5 else "^10.0.0" if major == 6 else "^11.0.0"
 
 
 def host_package_manager(root: Path) -> tuple[str, list[str]]:
@@ -440,7 +505,7 @@ def host_package_manager(root: Path) -> tuple[str, list[str]]:
     manager = next((name for filename, name in lockfiles if (root / filename).is_file()), "npm")
     if shutil.which(manager) is None:
         raise RuntimeError(f"{manager} is required to install Booking host dependencies but is not available on PATH")
-    packages = [f"{name}@{HOST_DEPENDENCY_RANGES[name]}" for name in missing_host_dependencies(root)]
+    packages = [f"{name}@{dependency_range(name, root)}" for name in missing_host_dependencies(root)]
     if manager == "npm":
         return manager, ["npm", "install", "--save", "--no-audit", "--no-fund", *packages]
     if manager == "pnpm":
@@ -460,7 +525,7 @@ def install_host_dependencies(root: Path, runner=None) -> dict:
     completed = execute(command, cwd=root, check=False)
     if completed.returncode != 0:
         raise RuntimeError(f"{manager} failed while installing {len(missing)} missing Booking host dependencies")
-    return {"status": "installed", "missing": missing, "packageManager": manager, "command": [manager, "add" if manager != "npm" else "install", *[f"{name}@{HOST_DEPENDENCY_RANGES[name]}" for name in missing]]}
+    return {"status": "installed", "missing": missing, "packageManager": manager, "command": [manager, "add" if manager != "npm" else "install", *[f"{name}@{dependency_range(name, root)}" for name in missing]]}
 
 
 def _meaningful_env_value(value: str) -> bool:
@@ -545,7 +610,7 @@ def booking_setup_result(root: Path, environment: dict[str, str] | None = None)
     except (OSError, json.JSONDecodeError):
         package = {}
     installed_dependencies = set((package.get("dependencies") or {})) | set((package.get("devDependencies") or {}))
-    missing_dependencies = sorted(set(REQUIRED_HOST_DEPENDENCIES) - installed_dependencies)
+    missing_dependencies = missing_host_dependencies(root)
     has_sender = has("EMAIL_FROM") or has("RESEND_FROM_EMAIL")
     token_present = has("BOOKING_TOKEN_SECRET")
     token_valid = token_present and len(values.get("BOOKING_TOKEN_SECRET", "")) >= 32

package/bundled-tools/clis/maggie_dash.py

@@ -262,6 +262,12 @@ def manifest_host_file_pairs(source: Path, manifest: dict[str, object], root: Pa
     for path in sorted(source_item.rglob("*")):
         if path.is_file():
             child = path.relative_to(source_item)
+            # A deployment config is host-owned. The default Node config is
+            # useful for a blank Astro project, but adding a second config to
+            # a host that already has astro.config.ts/cloudflare/etc. can make
+            # Astro ambiguous or change its deployment target.
+            if framework == "astro" and child.name == "astro.config.mjs" and any(root.glob("astro.config.*")):
+                continue
             pairs.append((path, root / target_relative / child, source_relative / child))
     return pairs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.37",
+  "version": "0.7.38",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",