@topy-ai/maggie 0.7.38 → 0.7.40

package/bundled-skills/maggie-booking/SKILL.md

@@ -11,22 +11,30 @@ for importing a provider's service catalogue. The existing
 right choice for provider-backed services, prices, durations, booking links,
 and factual provider validation.
 
+## Project memory
+
+Before changing a host project, follow the shared
+[`memory-hook.md`](../../references/memory-hook.md) instructions for reading
+relevant project preferences and known pitfalls. After a verified fix or a
+durable host decision, record only the generalizable learning; never promote a
+temporary project detail, secret, or unverified guess into active memory.
+
 ## Contract and safety boundary
 
-Read [`../../docs/maggiedash-booking/README.md`](../../docs/maggiedash-booking/README.md),
-[`TASKS.md`](../../docs/maggiedash-booking/TASKS.md), and the task's linked
+Read [`../../bundled-references/maggiedash-booking/README.md`](../../bundled-references/maggiedash-booking/README.md),
+[`TASKS.md`](../../bundled-references/maggiedash-booking/TASKS.md), and the task's linked
 reference before changing code. MaggieDash owns the manager UI and versioned
 contracts. The host owns routes, traditional email/password sessions,
 PostgreSQL connection/transaction lifetime, tenant authorization, provider
 credentials, payment webhooks, notifications, and deployment. MaggieDash also
-ships a tenant-scoped PostgreSQL manager repository for catalogue, availability,
+ships a tenant-scoped PostgreSQL manager repository for catalogue, treatment packages, availability,
 booking, customer, configuration, schedule, health, audit, hold, and lifecycle
 persistence; it does not replace host connection ownership or payment/public-
 checkout adapters.
 
 For implementation work, use the leaf board and runbook:
-[`EXECUTION-BOARD.json`](../../docs/maggiedash-booking/EXECUTION-BOARD.json)
-and [`TASK-RUNBOOK.md`](../../docs/maggiedash-booking/TASK-RUNBOOK.md). Do not
+[`EXECUTION-BOARD.json`](../../bundled-references/maggiedash-booking/EXECUTION-BOARD.json)
+and [`TASK-RUNBOOK.md`](../../bundled-references/maggiedash-booking/TASK-RUNBOOK.md). Do not
 mark a task passed until its implementation gate, docs update, and evidence
 record are complete.
 
@@ -69,7 +77,7 @@ It applies the host-only evidence rule; fixture, test, and local environments
 cannot satisfy a required operational release artifact.
 
 For local CLI regression, the sanitized no-customer fixture is
-[`fixtures/maggiedash/booking-runtime.v1.json`](../../fixtures/maggiedash/booking-runtime.v1.json).
+[`fixtures/maggiedash/booking-runtime.v1.json`](../../bundled-contracts/maggiedash/booking-runtime.v1.json).
 
 Install the first-party workspace and the host integration through the stable
 Booking installer:
@@ -93,9 +101,23 @@ Astro host it also adds the compatible `@astrojs/node` SSR adapter and the
 portable server config; an existing `astro.config.*` and deployment adapter
 remain host-owned.
 
+For a new host with an approved database migration, `--ready` combines the two
+explicit setup mutations into one command:
+
+```bash
+maggie booking install --project . --confirm --ready
+```
+
+It installs only missing host packages, generates `BOOKING_TOKEN_SECRET` when
+needed, and applies the installed idempotent Booking schema. It still does not
+create the owner, configure Stripe, send email, enable a scheduler, or deploy.
+Use `--schedule systemd` or `--schedule cron` with `--ready` only to generate a
+reviewable scheduler artifact; enabling it remains an operator action after
+backup, migration, and release evidence checks.
+
 The default installer source is the public MaggieDash `0.2.8` distribution. It
-contains the released Astro `hostBootstrap` manifest and 40-route Booking
-source. A fresh public-source install, `maggie booking inspect`, and
+contains the released Astro `hostBootstrap` manifest and 47-route Booking
+source, including the tenant-scoped treatment package catalogue. A fresh public-source install, `maggie booking inspect`, and
 `astro build` are the release evidence; a local-source result alone is not.
 
 For a new host with a reviewed `DATABASE_URL`, the explicit one-command
@@ -114,6 +136,21 @@ characters fails closed. External secret stores must provision the same key
 separately. Bootstrap still does not create the owner, configure Stripe, send
 email, or deploy.
 
+Generate the reviewed worker scheduler artifact as part of the same install,
+or after an existing install:
+
+```bash
+maggie booking install --project . --confirm --bootstrap --schedule systemd
+# or, for a host without systemd:
+maggie booking worker-schedule --project . --scheduler cron --confirm
+```
+
+This writes `deploy/maggie-booking-worker.service` plus `.timer`, or a
+reviewable `deploy/maggie-booking-worker.cron`. It does not edit the crontab,
+enable systemd, start a process, or expose secrets. Review the generated
+artifact, set an unprivileged service user, then enable it only after the
+schema, backup/restore, and release evidence gates pass.
+
 Before changing host configuration, run the safe first-run checklist:
 
 ```bash
@@ -149,16 +186,19 @@ Validate the tenant-scoped Resend template boundary independently:
 maggie booking email-templates-contract
 ```
 
-This freezes the seven supported Booking events, approved `{{variable}}`
+This freezes the ten supported Booking events, approved `{{variable}}`
 placeholders, owner/admin/manager access, audit and idempotency requirements,
 and the server-only provider/recipient privacy boundary. It does not connect to
 Resend, send a message, or expose customer data.
 
 After the first owner signs in, the Booking Overview includes the same
 secret-safe readiness path: Stripe connection status, test/live mode, and a
-copyable `/api/maggie/booking/webhooks/stripe` URL. It gives the operator the
-next secret-store action without accepting or storing Stripe credentials in the
-browser or Booking database.
+copyable `/api/maggie/booking/webhooks/stripe` URL. The preferred path is still
+the deployment secret store. For a single-business host, an owner or manager
+may submit both Stripe values over HTTPS from this screen; the server verifies
+them first, stores only authenticated AES-256-GCM ciphertext derived from
+`BOOKING_TOKEN_SECRET`, and never returns the raw values. Deployment
+`STRIPE_SECRET_KEY` takes precedence over dashboard-managed credentials.
 
 For an Astro host, framework detection installs missing email/password login,
 first-owner registration, manager/public Booking routes, PostgreSQL/Stripe
@@ -171,9 +211,11 @@ the UI. Use `--host astro` to make detection explicit;
 use `--host none` when only the source distribution is wanted. The
 distribution keeps the content admin at `./_maggie/admin` and Booking source at
 `./_maggie/booking`. Existing files, including an existing `src/middleware.ts`,
-are preserved unless `--force` is explicitly supplied. A conventional Astro
-middleware receives the rewrite block automatically; unsupported middleware is
-preserved and reported by `maggie booking inspect` until integrated manually.
+are preserved unless `--force` is explicitly supplied. Conventional Astro
+middleware using either `defineMiddleware((context, next) => {})` or a
+destructured context such as `defineMiddleware(({ url, request }, next) => {})`
+receives the rewrite block automatically; unsupported middleware is preserved
+and reported by `maggie booking inspect` until integrated manually.
 Installation does not apply SQL, create an owner, or enable a payment provider.
 The standard Booking migration must create
 `maggiedash_booking_user_roles`; do not move that table into a project-only
@@ -233,18 +275,48 @@ allocation by the same time delta, checks each staff/resource interval, and
 preserves the original total duration. Single-treatment requests and legacy
 rows remain compatible. Public DTOs expose only safe segment fields.
 
+When a tenant has multiple online-bookable locations, the public catalogue must
+return a safe `locations` list and the customer page must let the customer pick
+one. Include the selected `locationId` in availability, waitlist, hold,
+checkout, and reschedule requests. Availability must validate that the
+location belongs to the tenant, is active and online-bookable, use its
+timezone, and filter conflicts by that location. Keep the legacy first
+`locationId` field during migration so older hosts remain compatible; never
+fall back to `location-1` or another fixture ID.
+
+After a confirmed package purchase, the public page may carry the opaque
+`packageEntitlementId` into the hold and checkout requests. The server resolves
+the customer from the submitted email, validates tenant ownership, active
+status, expiry, currency, and every selected treatment balance, then locks the
+entitlement and item rows while creating the booking and redemption ledger.
+Public package redemption is all-or-nothing for a multi-treatment selection;
+it confirms a fully covered booking at zero price and does not trust the
+browser to decide the balance.
+
 Every `staff` account must also be linked to a Booking staff profile. The host
 passes that `staff_id` into the server context, and the PostgreSQL repository
 filters bookings, calendar, availability, customer summaries, staff/resources,
 schedule, and lifecycle mutations by that assignment. An unlinked staff
 session fails closed. This is a data-security rule, not a UI convention.
+The administrator access registry must stay identical to the route-handler
+capabilities: calendar, bookings, customers, waitlist, catalogue, packages,
+staff, resources, schedule, locations, payments, refunds, notifications,
+settings, reports, and audit. If `permissions_json` is absent on a legacy role,
+apply the safe role defaults server-side; never treat a missing object as full
+read access. Explicitly granted staff capabilities must be honored by the
+route handler, while staff mutations remain limited to approved lifecycle
+transitions. Keep the access contract, Astro host, reference host, ORA mirror,
+and CLI validator synchronized whenever a route capability changes.
 The bootstrap now uses the host's server-side Resend configuration to send
 single-use invitation and password-reset links; raw tokens are never stored.
 The Resend worker separately delivers booking notifications. The default
 worker cycle includes `match-waitlist` and `enqueue-reminders`. The waitlist
 matcher orders eligible entries by priority/FIFO, requires explicit service and
 location scope, persists the offered slot, and queues one
-`booking.waitlist.available` notification. It never auto-creates or reserves a
+`booking.waitlist.available` notification. Package purchase fulfillment and
+provider-confirmed package refunds also queue the allowlisted
+`package.purchase.confirmed`/`package.purchase.refunded` Resend events linked to
+the package purchase, without appointment manage links. It never auto-creates or reserves a
 booking. The reminder job queues one `booking.reminder`
 email for each confirmed booking in the next 24 hours; the existing Resend
 dispatcher resolves the customer address at delivery time. Reminder queueing
@@ -280,7 +352,9 @@ installed host is:
 node scripts/maggie-booking-schema.mjs --dry-run
 node scripts/maggie-booking-schema.mjs --apply --confirm
 # open /_maggie/register and create the first owner
-# add Stripe and Resend secrets through the deployment secret store
+# preferred: add Stripe and Resend secrets through the deployment secret store
+# alternative: owner/manager can enter the Stripe key pair in Booking Overview;
+# the host verifies it and stores only encrypted ciphertext
 node scripts/maggie-booking-worker.mjs --write --confirm
 ```
 
@@ -379,7 +453,7 @@ Follow the task board rather than building a disconnected calendar first:
    signed duplicate/out-of-order webhooks before enabling capture.
 7. Run the UI source gate, contract gate, host runtime conformance, browser
    journeys, and release gate. Record each command in
-   [`PROGRESS.md`](../../docs/maggiedash-booking/PROGRESS.md).
+   [`PROGRESS.md`](../../bundled-references/maggiedash-booking/PROGRESS.md).
 
 8. Verify the scheduled worker queues and delivers a reminder once for a
    confirmed booking inside the 24-hour window. Check the notification
@@ -442,6 +516,11 @@ short-lived while customer-manage tokens are 30-day links. A redirect is never
 payment proof.
 Run `npm run booking:customer-flow:test` in MaggieDash before wiring the
 adapter, and retain real host/runtime/browser evidence as a separate gate.
+If the host already has a legacy `/book` request form, keep it as a fallback
+until the Booking schema is ready; expose the new customer route only after a
+schema-aware readiness check, and preserve any existing treatment hint when
+linking into the new flow. Do not replace a working host booking form with a
+route that can only show an unconfigured Booking error.
 The manager Booking UI also exposes the tenant-scoped waitlist queue. Managers
 can filter entries, notify/cancel/reprioritize them, or select a concrete slot
 and staff/resource allocation to create a real booking transaction linked by

package/bundled-skills/maggie-design/SKILL.md

@@ -182,6 +182,20 @@ unconfirmed writes. Generated copy and media must be marked authored rather
 than source-observed. Implementation must still capture responsive screenshots
 and run accessibility/build validation before publication.
 
+Author jobs are resumable design jobs even though their plan is stored beside
+the author brief at `.maggie/design/author-<id>.json`. Use the same progress
+commands as an in-place job; `status` and `step` resolve both supported job
+locations:
+
+```bash
+maggie design status author-<id> --project .
+maggie design step author-<id> --project . \
+  --step inspect-shell --evidence .maggie/evidence/inspect-shell.json
+```
+
+An author plan is not complete until every `requiredSteps` entry has matching
+evidence and the explicit approval step is recorded.
+
 ## Content UI initialization
 
 Use content UI initialization when `maggie-blog` or
@@ -496,3 +510,24 @@ Follow the shared [Maggie Decision Loop](../../references/decision-loop.md) for
 6. Require explicit final confirmation before any mutation or external write.
 
 If a decision is not relevant, record it as `skipped` with a reason. Do not silently assume a missing choice, and do not treat an existing output as permission to skip required work.
+
+## Contract checks for dashboards, samples, and progressive enhancement
+
+Run these stable evidence checks after implementation:
+
+```bash
+maggie design progressive-check --evidence .maggie/progressive.json
+maggie design css-check --html dist/index.html --css dist/assets/app.css
+maggie design css-cascade-check --evidence .maggie/css-cascade.json
+maggie design dash-init --project . --route /_maggie/admin --confirm
+maggie design dash-validate --plan .maggie/design/dashboard/*/plan.json --evidence .maggie/dashboard-evidence.json
+maggie design sample-init --project . --route /layout-sample --purpose "layout exploration" --confirm
+maggie design sample-validate --plan .maggie/design/sample/*/plan.json --evidence .maggie/sample-evidence.json
+```
+
+The checks cover smallest-region swaps, stable DOM identities, third-party
+requests, stale responsive Tailwind utilities, and unlayered CSS winning over
+utilities. Dashboard plans require operator journeys and desktop/tablet/mobile,
+collapsed-rail, mobile-drawer, and modal evidence. Sample plans require
+noindex, sitemap exclusion, a visible sample banner, placeholders, and a
+finish checklist.

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -381,3 +381,15 @@ backed by a content-change/source-revision event; operational sync, pull,
 deploy, or `updated_at` timestamps are rejected. The agent-file command emits
 locale-aware `llms.txt`, `sitemap.md`, and `insights.md` from the same route
 inventory; non-indexable routes are omitted.
+
+For every release, audit third-party privacy origins:
+
+```bash
+maggie seo privacy-check --evidence .maggie/privacy-origin-evidence.json
+```
+
+The site audit also records `primary_navigation_indexability` and flags a
+same-origin page linked from primary navigation when it is `noindex`,
+`nofollow`, or `none`. The privacy check fails in both directions: an embedded
+origin missing from the policy, or a policy origin never observed in rendered
+pages, requires review.

package/bundled-skills/maggie-service-booking/SKILL.md

@@ -502,3 +502,17 @@ later sync are marked `archived`, retained for reconciliation, and excluded
 from active category context and public fact gates. After every sync, run
 `fact-audit`, `category-context`, the category hash/render/audit sequence, and
 the aggregate `maggie_release.py` gate.
+
+### Treatment groups
+
+Keep one treatment catalogue entry and put length/price choices in its
+`variants` array. Imports emit `treatmentGroup` with variant count, duration
+range, and a from-price summary. Run the gate before rendering service cards:
+
+```bash
+maggie service treatment-group-audit --project .
+```
+
+This prevents a 30/60/90/120-minute treatment from becoming four unrelated
+products and gives catalogue, detail, booking, and pricing surfaces one stable
+identity.

package/bundled-tools/clis/maggie_booking.py

@@ -8,6 +8,7 @@ import json
 import os
 import re
 import secrets
+import shlex
 import shutil
 import subprocess
 import sys
@@ -200,7 +201,7 @@ def contract_checks(contract: dict) -> list[str]:
         if not isinstance(service_methods, dict) or set(service_methods) != set(endpoint_ids or []): errors.append("serviceMethods must map every endpoint exactly once")
         elif not all(isinstance(value, str) and value for value in service_methods.values()): errors.append("serviceMethods values must be non-empty strings")
         customer_methods = contract.get("customerServiceMethods")
-        if customer_methods != ["readPublicCatalog", "readPublicAvailability", "createCustomerHold", "startCustomerCheckout", "readCustomerPaymentReturn", "readCustomerManage", "cancelCustomerBooking", "rescheduleCustomerBooking", "joinCustomerWaitlist"]: errors.append("customerServiceMethods must declare the nine public customer methods")
+        if customer_methods != ["readPublicCatalog", "readPublicAvailability", "createCustomerHold", "startCustomerCheckout", "startCustomerPackageCheckout", "readCustomerPaymentReturn", "readCustomerPackagePaymentReturn", "readCustomerManage", "cancelCustomerBooking", "rescheduleCustomerBooking", "joinCustomerWaitlist"]: errors.append("customerServiceMethods must declare the eleven public customer methods")
     return errors
 
 
@@ -235,7 +236,17 @@ def access_contract_checks(contract: dict) -> list[str]:
     if auth.get("passkeys") is not False: errors.append("passkeys must be disabled")
     if auth.get("resendInvitation") is not True: errors.append("resendInvitation must be enabled")
     if roles != ["manager", "staff", "finance"]: errors.append("roles must be manager, staff, finance")
-    for permission in ("calendar.read", "bookings.manage", "payments.manage", "refunds.manage", "audit.read"):
+    expected_permissions = (
+        "calendar.read", "bookings.read", "bookings.manage", "customers.read",
+        "waitlist.read", "waitlist.manage", "catalog.read", "catalog.manage",
+        "packages.read", "packages.manage", "staff.read", "staff.manage",
+        "resources.read", "resources.manage", "schedule.read", "schedule.manage",
+        "locations.read", "locations.manage", "payments.read", "payments.manage",
+        "refunds.manage", "notifications.read", "notifications.manage",
+        "settings.read", "settings.manage", "reports.read", "audit.read",
+    )
+    if permissions != list(expected_permissions): errors.append("access permissions do not match the complete route capability registry")
+    for permission in expected_permissions:
         if permission not in permissions: errors.append(f"missing permission: {permission}")
     if endpoint_ids != ["booking.access.read", "booking.access.create", "booking.access.update", "booking.access.revoke"]: errors.append("access endpoint IDs are incomplete or out of order")
     expected = {"booking.access.read": "GET /access.json", "booking.access.create": "POST /access.json", "booking.access.update": "PATCH /access.json", "booking.access.revoke": "DELETE /access.json"}
@@ -273,12 +284,12 @@ def email_templates_contract_checks(contract: dict) -> list[str]:
     if auth.get("passkeys") is not False: errors.append("passkeys must be disabled")
     if roles != ["owner", "admin", "manager"]: errors.append("roles must be owner, admin, manager")
     events = contract.get("events")
-    if not isinstance(events, list) or len(events) != 7: errors.append("exactly seven Booking email events are required")
+    if not isinstance(events, list) or len(events) != 9: errors.append("exactly nine Booking email events are required")
     event_ids = [item.get("id") for item in events if isinstance(item, dict)] if isinstance(events, list) else []
-    expected_events = ["booking.confirmed", "booking.rescheduled", "booking.cancelled", "booking.reminder", "payment.action_required", "payment.refunded", "booking.waitlist.available"]
+    expected_events = ["booking.confirmed", "booking.rescheduled", "booking.cancelled", "booking.reminder", "payment.action_required", "payment.refunded", "package.purchase.confirmed", "package.purchase.refunded", "booking.waitlist.available"]
     if event_ids != expected_events: errors.append("email event IDs are incomplete or out of order")
     if len(event_ids) != len(set(event_ids)): errors.append("email event IDs must be unique")
-    allowed = {"customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "bookingUrl", "reason", "actionUrl", "siteName"}
+    allowed = {"customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "bookingUrl", "reason", "actionUrl", "packageName", "amount", "expiresAt", "siteName"}
     for event in events if isinstance(events, list) else []:
         variables = event.get("variables") if isinstance(event, dict) else None
         if not isinstance(variables, list) or not variables: errors.append(f"{event.get('id', 'unknown')}: variables must be a non-empty list")
@@ -331,7 +342,7 @@ def customer_contract_checks(contract: dict) -> list[str]:
     if noindex is not True: errors.append("customer surface must be noindex")
     if properties == {} and response_policy.get("mutationPolicy") != "all-public-mutations-require-idempotency-key-and-replay-original-result": errors.append("customer mutationPolicy must require idempotent replay")
     if properties == {} and set(response_policy.get("holdInputPolicy", [])) != {"valid-email", "booking-update-consent"}: errors.append("customer holdInputPolicy must require valid email and booking-update-consent")
-    if len(endpoints) != 9: errors.append("customer surface must declare nine endpoints")
+    if len(endpoints) != 11: errors.append("customer surface must declare eleven endpoints")
     if len(ids) != len(set(ids)): errors.append("customer endpoint IDs must be unique")
     if not all(str(item).startswith("booking.public.") for item in ids): errors.append("customer endpoint IDs must use the booking.public namespace")
     for endpoint in endpoints:
@@ -630,7 +641,7 @@ def booking_setup_result(root: Path, environment: dict[str, str] | None = None)
         setup_check("site", "Public site URL", ["PUBLIC_SITE_URL"], has("PUBLIC_SITE_URL"), detail="Used for login links, booking links, and email URLs."),
         setup_check("booking-token", "Public booking token secret", ["BOOKING_TOKEN_SECRET"], token_valid, detail="Must be at least 32 characters; used to sign public manage-booking links." if token_valid or not token_present else "The configured secret is too short; use at least 32 characters.", status_override="passed" if token_valid else "invalid" if token_present else None),
         setup_check("resend", "Resend email delivery", ["RESEND_API_KEY", "EMAIL_FROM|RESEND_FROM_EMAIL"], has("RESEND_API_KEY") and has_sender, detail="Required for password setup/reset, booking notifications, and reminders."),
-        setup_check("stripe", "Stripe online payments", ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"], stripe_complete, required=False, detail="Required only for deposit/full online payment flows; webhook URL is /api/maggie/booking/webhooks/stripe." if not stripe_partial else "Both Stripe secret and webhook secret are required for online payments.", status_override="passed" if stripe_complete else "degraded" if stripe_partial else "optional"),
+        setup_check("stripe", "Stripe online payments", ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"], stripe_complete, required=False, detail="Required only for deposit/full online payment flows; webhook URL is /api/maggie/booking/webhooks/stripe." if not stripe_partial and (stripe_secret or stripe_webhook) else "Both Stripe secret and webhook secret are required for online payments." if stripe_partial else "Optional at install: an owner or manager can connect Stripe from Booking Overview, or use the deployment secret store.", status_override="passed" if stripe_complete else "degraded" if stripe_partial else "optional"),
         {"id": "schema", "label": "Booking database schema", "status": "not-verified", "required": True, "detail": "The CLI does not connect to PostgreSQL. Apply the schema after backup, then verify with the host runtime checks."},
         {"id": "owner", "label": "First owner account", "status": "not-verified", "required": True, "detail": "Open /_maggie/register once the schema is applied. Registration closes after the first owner."},
         {"id": "worker", "label": "Resend worker schedule", "status": "not-verified", "required": True, "detail": "Run the installed worker from a single-flight scheduler; setup does not create a cron or systemd job."},
@@ -647,15 +658,19 @@ def booking_setup_result(root: Path, environment: dict[str, str] | None = None)
     if "stripe" in degraded_config:
         next_steps.append("Configure both STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET before accepting online payments.")
     if missing_dependencies:
-        next_steps.append("Install missing host packages with the project package manager: maggie booking install --project . --confirm --install-dependencies")
-    if any(item["id"] == "schema" and item["status"] == "not-verified" for item in checks):
+        next_steps.append("For a new host, install missing packages and apply the schema together: maggie booking install --project . --confirm --ready")
+    if not missing_dependencies and any(item["id"] == "schema" and item["status"] == "not-verified" for item in checks):
         next_steps.append("After backup, run: maggie booking install --project . --confirm --bootstrap")
     if any(item["id"] == "owner" and item["status"] == "not-verified" for item in checks):
         next_steps.append("Open /_maggie/register and create the first owner, then sign in at /_maggie/login")
     if any(item["id"] == "worker" and item["status"] == "not-verified" for item in checks):
         next_steps.append("Configure a single-flight scheduler for: node scripts/maggie-booking-worker.mjs --write --confirm")
-    if not has("STRIPE_SECRET_KEY") or not has("STRIPE_WEBHOOK_SECRET"):
-        next_steps.append("If taking online payments, configure Stripe test keys and POST /api/maggie/booking/webhooks/stripe before live mode.")
+    if stripe_partial:
+        next_steps.append("Complete both Stripe deployment keys before accepting online payments; then POST /api/maggie/booking/webhooks/stripe and verify the connection.")
+    elif not stripe_complete:
+        next_steps.append("After signing in, an owner or manager can connect Stripe from Booking Overview; alternatively add both deployment keys, configure the webhook URL, and verify the connection.")
+    else:
+        next_steps.append("After signing in, open Booking Overview and run Verify Stripe connection; env-key presence alone is not connected state.")
     status = "needs-configuration" if missing_required else "configured-pending-verification"
     return {
         "status": status,
@@ -663,7 +678,7 @@ def booking_setup_result(root: Path, environment: dict[str, str] | None = None)
         "checks": checks,
         "configuredKeys": sorted(key for key in sources if key in {"DATABASE_URL", "PUBLIC_SITE_URL", "BOOKING_TOKEN_SECRET", "RESEND_API_KEY", "EMAIL_FROM", "RESEND_FROM_EMAIL", "STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"}),
         "verificationPending": verification_pending,
-        "paymentConfiguration": "online-payments" if has("STRIPE_SECRET_KEY") and has("STRIPE_WEBHOOK_SECRET") else "no-payment-or-incomplete-stripe",
+        "paymentConfiguration": "online-payments-pending-verification" if stripe_complete else "incomplete-deployment-stripe" if stripe_partial else "dashboard-or-host-secret-pending",
         "next": next_steps,
         "note": "Read-only checklist. It does not print secrets, connect to PostgreSQL, apply migrations, create an owner, configure Stripe, send email, or deploy.",
     }
@@ -714,10 +729,101 @@ def ensure_bootstrap_token_secret(root: Path) -> bool:
     return True
 
 
+def write_worker_schedule(root: Path, scheduler: str, *, force: bool = False) -> dict:
+    """Generate a host-owned single-flight schedule for the installed worker.
+
+    The CLI writes deployment artifacts only. It never enables a systemd unit,
+    edits the host crontab, starts a process, or prints environment values.
+    The host operator remains responsible for reviewing the unit, selecting an
+    unprivileged service user, and enabling it after migration/evidence gates.
+    """
+    if scheduler not in {"systemd", "cron"}:
+        raise RuntimeError("worker scheduler must be systemd or cron")
+    script = root / "scripts" / "maggie-booking-worker.mjs"
+    if not script.is_file():
+        raise RuntimeError(f"installed Booking worker is missing: {script}")
+    output_dir = root / "deploy"
+    output_dir.mkdir(parents=True, exist_ok=True)
+    env_file = root / ".env"
+    worker_log = root / ".maggie" / "booking-worker.log"
+    worker_log.parent.mkdir(parents=True, exist_ok=True)
+    root_text = root.as_posix()
+    script_text = script.as_posix()
+    env_text = env_file.as_posix()
+    output: dict[str, str] = {}
+    if scheduler == "systemd":
+        service = output_dir / "maggie-booking-worker.service"
+        timer = output_dir / "maggie-booking-worker.timer"
+        service_text = f"""[Unit]
+Description=Maggie Booking worker and Resend outbox delivery
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+# Review and set an unprivileged deployment user before enabling this unit.
+WorkingDirectory={root_text}
+EnvironmentFile=-{env_text}
+ExecStart=/usr/bin/env node {script_text} --write --confirm
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths={root_text}/.maggie
+
+[Install]
+WantedBy=multi-user.target
+"""
+        timer_text = """[Unit]
+Description=Run Maggie Booking worker every minute
+
+[Timer]
+OnBootSec=1min
+OnUnitActiveSec=1min
+AccuracySec=10s
+Persistent=true
+Unit=maggie-booking-worker.service
+
+[Install]
+WantedBy=timers.target
+"""
+        for path, text in ((service, service_text), (timer, timer_text)):
+            if path.exists() and not force:
+                output[path.name] = "unchanged"
+                continue
+            path.write_text(text, encoding="utf-8")
+            output[path.name] = "written"
+    else:
+        cron = output_dir / "maggie-booking-worker.cron"
+        command = "cd {root} && {worker}".format(
+            root=shlex.quote(root_text),
+            worker=" ".join([
+                "/usr/bin/flock -n /tmp/maggie-booking-worker.lock",
+                "/usr/bin/env node",
+                shlex.quote(script_text),
+                "--write --confirm",
+            ]),
+        )
+        cron_text = f"""# Maggie Booking worker; install with the deploy user's crontab after review.
+# The worker performs its own PostgreSQL migration preflight and tenant lock.
+* * * * * {command} >> {shlex.quote(worker_log.as_posix())} 2>&1
+"""
+        if cron.exists() and not force:
+            output[cron.name] = "unchanged"
+        else:
+            cron.write_text(cron_text, encoding="utf-8")
+            output[cron.name] = "written"
+    return {"status": "generated", "scheduler": scheduler, "files": output, "note": "Review and enable the host scheduler after migration and release evidence; no service or crontab was changed."}
+
+
 def command_install(args: argparse.Namespace) -> int:
     """Install Booking, optionally adding missing host packages and schema."""
-    if (args.bootstrap or args.install_dependencies) and (args.dry_run or args.diff):
-        print("INSTALL_MUTATION_INCOMPATIBLE: --bootstrap and --install-dependencies cannot be combined with --dry-run or --diff.", file=sys.stderr)
+    schedule = getattr(args, "schedule", "none")
+    ready = bool(getattr(args, "ready", False))
+    install_dependencies = bool(getattr(args, "install_dependencies", False) or ready)
+    bootstrap = bool(getattr(args, "bootstrap", False) or ready)
+    if (bootstrap or install_dependencies or schedule != "none") and (args.dry_run or args.diff):
+        print("INSTALL_MUTATION_INCOMPATIBLE: --ready, --bootstrap, --install-dependencies, and --schedule cannot be combined with --dry-run or --diff.", file=sys.stderr)
         return 2
     if not args.dry_run and not args.diff and not args.confirm:
         print("CONFIRMATION_REQUIRED: add --confirm before installing Booking.", file=sys.stderr)
@@ -742,26 +848,47 @@ def command_install(args: argparse.Namespace) -> int:
     completed = subprocess.run(command, cwd=root, check=False)
     if completed.returncode != 0:
         return completed.returncode
-    if args.install_dependencies:
+    if install_dependencies:
         try:
             dependency_result = install_host_dependencies(root)
         except RuntimeError as error:
             print(f"DEPENDENCY_INSTALL_FAILED: {error}", file=sys.stderr)
             return 1
         print(json.dumps({"status": "host-dependencies", **dependency_result}, ensure_ascii=False))
-    if not args.bootstrap:
-        return 0
+    if bootstrap:
+        try:
+            ensure_bootstrap_token_secret(root)
+        except RuntimeError as error:
+            print(f"BOOTSTRAP_FAILED: {error}", file=sys.stderr)
+            return 1
+        schema_script = root / "scripts" / "maggie-booking-schema.mjs"
+        if not schema_script.is_file():
+            print(f"BOOTSTRAP_FAILED: installed host schema script is missing: {schema_script}", file=sys.stderr)
+            return 1
+        schema = subprocess.run(["node", str(schema_script), "--apply", "--confirm"], cwd=root, check=False)
+        if schema.returncode != 0:
+            return schema.returncode
+    if schedule != "none":
+        try:
+            print(json.dumps({"status": "worker-schedule", **write_worker_schedule(root, schedule, force=args.force)}, ensure_ascii=False))
+        except (OSError, RuntimeError) as error:
+            print(f"SCHEDULE_FAILED: {error}", file=sys.stderr)
+            return 1
+    return 0
+
+
+def command_worker_schedule(args: argparse.Namespace) -> int:
+    root = project_path(args)
+    if not args.confirm:
+        print("CONFIRMATION_REQUIRED: add --confirm before generating worker scheduler files.", file=sys.stderr)
+        return 2
     try:
-        ensure_bootstrap_token_secret(root)
-    except RuntimeError as error:
-        print(f"BOOTSTRAP_FAILED: {error}", file=sys.stderr)
-        return 1
-    schema_script = root / "scripts" / "maggie-booking-schema.mjs"
-    if not schema_script.is_file():
-        print(f"BOOTSTRAP_FAILED: installed host schema script is missing: {schema_script}", file=sys.stderr)
+        result = write_worker_schedule(root, args.scheduler, force=args.force)
+    except (OSError, RuntimeError) as error:
+        print(f"SCHEDULE_FAILED: {error}", file=sys.stderr)
         return 1
-    schema = subprocess.run(["node", str(schema_script), "--apply", "--confirm"], cwd=root, check=False)
-    return schema.returncode
+    print(json.dumps(result, ensure_ascii=False))
+    return 0
 
 
 def command_inspect(args: argparse.Namespace) -> int:
@@ -1073,8 +1200,16 @@ def parser() -> argparse.ArgumentParser:
     install.add_argument("--existing-dir")
     install.add_argument("--install-dependencies", action="store_true", help="add missing Astro Booking packages with the host package manager")
     install.add_argument("--bootstrap", action="store_true", help="apply the installed host Booking schema after installation")
+    install.add_argument("--ready", action="store_true", help="install missing host packages and apply the Booking schema after installation")
+    install.add_argument("--schedule", choices=["none", "systemd", "cron"], default="none", help="generate a reviewed worker scheduler artifact after installation")
     install.add_argument("--confirm", action="store_true")
     install.set_defaults(func=command_install)
+    worker_schedule = sub.add_parser("worker-schedule", help="generate a reviewed systemd or cron Booking worker schedule")
+    worker_schedule.add_argument("--project", default=".")
+    worker_schedule.add_argument("--scheduler", choices=["systemd", "cron"], required=True)
+    worker_schedule.add_argument("--force", action="store_true")
+    worker_schedule.add_argument("--confirm", action="store_true")
+    worker_schedule.set_defaults(func=command_worker_schedule)
     contract = sub.add_parser("contract", help="validate the provider-neutral Booking contract")
     contract.add_argument("--contract", default=str(DEFAULT_CONTRACT))
     contract.set_defaults(func=command_contract)