@topy-ai/maggie 0.7.38 → 0.7.41

package/README-zh-TW.md

@@ -2,14 +2,47 @@
 
 [English README](README.md) · [完整繁體中文 README](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/README.zh-TW.md)
 
-`@topy-ai/maggie` 提供 19 個可安裝的 AI website workflow skills，支援
+`@topy-ai/maggie` 提供 20 個可安裝的 AI website workflow skills，支援
 Codex、Claude Code 與相容的 coding agents。
 
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.38 init --agent all
-npx @topy-ai/maggie doctor --project .
+npx @topy-ai/maggie@0.7.41 init --agent all
+npx @topy-ai/maggie@0.7.41 doctor --project .
+```
+
+目前 release 是 `0.7.41`，完成 feedback batches 22、23：加入 declarative
+browser interaction evidence、design markup/style/content-key gate、compiler
+source anchoring、entity double-escape protection、`update --help` read-only，
+以及 noindex hypothetical indexability、可過期 baseline acknowledgement、
+DOM-only link extraction regression。MaggieDash 0.2.10 同步提供 content
+override、短期 browser session、CDN-safe public-session cache contracts；
+authentication 和 isolated dev server 仍由 host 負責。
+
+0.7.40 加入 feedback batch 21：progressive enhancement
+的區域/identity/request 驗證、Tailwind utility 與 CSS cascade evidence、
+dashboard/sample surface contract、primary navigation indexability、privacy
+origin parity、provider-neutral site structure、host capability manifest，
+以及包含 duration/price variants 的 Booking treatment group。MaggieDash
+同步更新至 0.2.9，ORA reference host 也提供相同的 capability/site-structure
+邊界。
+
+目前也加入 deferred workflow 的共用 contract gate：Gemini image/edit 使用
+Nano Banana 2，hero video 使用 Gemini Omni Flash，GSC 直接擴充 analytics
+release-gate，booking delivery 預設 Resend email + Twilio SMS；credentials、
+billing、storage 和 provider runtime 仍由 host 負責。
+
+```bash
+maggie media image-policy --policy contracts/maggie-media/image-generation-policy-v1.json
+maggie media video-policy --policy contracts/maggie-media/video-generation-policy-v1.json
+maggie analytics gsc-readiness --gsc-evidence .maggie/gsc-readiness.json
+maggie provenance --project . --source src/content/post.md
+maggie scaffold --project . --framework astro --language typescript --write --confirm
+maggie brand-kit --project . --design DESIGN.md --write --confirm
+maggie npm11 --project . --smoke --confirm
+maggie media video-playback --evidence .maggie/video-playback-evidence.json
+maggie booking-delivery --policy .maggie/booking-delivery-policy.json
 ```
 
 常用流程：
@@ -21,11 +54,26 @@ maggie memory context --project . --skill <skill-name>
 maggie doctor --project . --require-bootstrap --strict
 ```
 
+Feedback batch quality gates：
+
+```bash
+maggie design progressive-check --evidence .maggie/progressive.json
+maggie design dash-validate --plan .maggie/design/dashboard/PLAN.json --evidence .maggie/dashboard.json
+maggie seo privacy-check --evidence .maggie/privacy-origins.json
+maggie dash capabilities-validate --manifest .maggie/host-capabilities.json
+maggie dash structure-validate --model .maggie/site-structure.json --evidence .maggie/site-structure-rendered.json
+maggie service treatment-group-audit --project .
+```
+
+這些 gate 只接受經過清理的 build/browser evidence，會在第三方 request 重複、
+Tailwind/CSS cascade、dashboard unsupported surface、privacy origin、site
+structure drift 或重複 treatment product 時 fail closed。
+
 主要 skills 包括 clone、design、template、Blog、SEO/GEO、localization、
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 release 是 `0.7.38`，加入可安裝的 `maggie-booking` workflow：MaggieDash Booking host bootstrap、傳統 email/password 團隊登入與 granular permissions、Stripe payment boundary、Resend outbox/template 管理、public customer booking flow、runtime/ops evidence checks，以及完整的 Booking 維護文件。全新的 Astro host 會自動補上可攜的 Node SSR adapter；已有 Cloudflare、Vercel、Netlify 或 Deno adapter 的專案會保留原本的部署選擇。Production activation 仍會 fail-closed，直到 host migration、owner、Stripe、scheduler 和 authenticated runtime evidence 都完成。上一版 `0.7.36` 完成下一批已驗證 feedback：修正 doctor placeholder scope、Tailwind renderable source scope、internal link/fragment audit、unstable baseline classification、site-wide baseline reason、base64url asset hash、installed-file hash update safety，並加入 provider-routed Gemini v2、venue timezone/DST booking parsing、social-card release path、notification lifecycle contract 和 mobile hero video playback contract。provider-bound video generation 與 transactional delivery 已記錄在 issue #39；前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 source tree 的正式 release 是 `0.7.41`。本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及
@@ -63,10 +111,20 @@ delivery outbox：可查看去識別化的狀態與 sanitized error；owner/mana
 這是 Maggie 的 server-side delivery queue 與 audit 管理，不取代 Resend 自己的
 domain、audience、campaign 或 analytics console。
 
+Booking manager 也已提供 tenant-scoped 的 prepaid treatment package catalogue，
+以及客戶 package entitlement 的手動授予、餘額查詢和預約時的原子核銷：可設定
+包含的 treatment variant 數量、價格、幣別、有效期與啟用狀態。公開客戶流程
+也支援 package checkout、token-bound payment return；manager 可以查看購買紀錄
+並提出受 redemption 保護的 Stripe package refund。Stripe 確認購買或退款後，
+會透過共用 outbox/worker 發送去識別化且具 idempotency 的 Resend 通知。
+
 在全新的 Astro 專案中，可以讓安裝流程補上缺少的 Booking runtime 套件：
 
 ```bash
 maggie booking install --project . --confirm --install-dependencies
+
+# 已審核的新主機：安裝缺少的套件並套用 Booking schema
+maggie booking install --project . --confirm --ready
 ```
 
 這個選項會依照專案現有的 npm/pnpm/yarn/bun lockfile，只安裝缺少的
@@ -76,6 +134,19 @@ React、Phosphor、Tailwind、PostgreSQL、Stripe 和 SSR adapter 套件，保
 Cloudflare/Vercel/Netlify/Deno adapter 的專案會保留原本的部署選擇。
 它不能和 `--dry-run` 或 `--diff` 一起使用。
 
+如果 host 需要自動處理 Resend outbox、reminder 和 payment reconciliation，
+可以同時產生 scheduler artifact：
+
+```bash
+maggie booking install --project . --confirm --bootstrap --schedule systemd
+# 沒有 systemd 的 host：
+maggie booking worker-schedule --project . --scheduler cron --confirm
+```
+
+這只會在 `deploy/` 寫入可審查的 service/timer 或 cron 文件，不會修改
+crontab、啟用 systemd、啟動 worker，也不會輸出 secret。啟用前仍要由 host
+管理員審查 service user，並完成 migration、backup/restore 及 release evidence。
+
 Booking 的 browser evidence gate 現在涵蓋全部 15 個 manager routes，在 mobile、
 tablet、desktop 三種 viewport 共需要 45 個 screens，包含 waitlist、locations、
 notifications、reports 和 audit。Production release 仍需要 authenticated HTTPS
@@ -98,7 +169,12 @@ Booking Team access 支援透過 Resend 發送傳統 email/password 邀請、`ma
 maggie booking email-templates-contract
 ```
 
-Booking 內置七種 Resend 事件模板。Owner、administrator 和 Booking manager
+Booking 內置十種 Resend 事件模板，包含 package purchase confirmation/refund
+與成功 no-show fee charge 通知。No-show 狀態轉換不會自動扣款；只有在
+客戶同意、已有保存的 Stripe payment method、provider off-session capability
+已驗證，且 owner/manager/finance 明確確認後，才會建立 idempotent adjustment
+charge。
+Owner、administrator 和 Booking manager
 可以編輯 draft、用 sandbox sample data 預覽、發佈 audited version，或 rollback
 舊版本。每個事件只接受核准的 placeholder，worker 發送前會 escape value；
 provider credentials 和 recipient address 只留在 server/worker，不會返回瀏覽器。
@@ -149,6 +225,6 @@ maggie service retirement-audit --project . \
   --evidence .maggie/booking/retirement-evidence.json
 ```
 
-完整中文說明、19 個 skills 清單和 roadmap：
+完整中文說明、20 個 skills 清單和 roadmap：
 [繁體中文 README](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/README.zh-TW.md)
 · [Roadmap](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/ROADMAP.md)

package/README.md

@@ -58,17 +58,75 @@ Then invoke the installed skills from your coding agent, for example:
 
 Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
-package ships 19 installable skills and a local-first MaggieDash foundation.
+package ships 20 installable skills and a local-first MaggieDash foundation.
+
+The current release is `0.7.41`. It closes feedback batches 22 and 23 with
+declarative browser interaction evidence, stable design markup/style/content-key
+gates, compiler source anchoring, entity double-escape protection, and a
+read-only `update --help` path. It also adds hypothetical indexability
+diagnostics for `noindex` pages, expiring baseline acknowledgement evidence,
+DOM-only link extraction regression coverage, and provider-neutral MaggieDash
+contracts for content overrides, short-lived browser sessions, and CDN-safe
+public-session cache boundaries. Host-owned authentication and isolated
+dev-server choices remain explicit. MaggieDash 0.2.10 contains the matching
+host contracts.
+
+The source tree also includes the selected deferred-workflow contracts for
+Gemini media, clone interaction replay, GSC readiness, git content provenance,
+npm 11, empty-project scaffolding, brand kits, and booking delivery. The
+default provider policy is Gemini Nano Banana 2 for image/edit, Gemini Omni
+Flash for hero video, and Resend email plus Twilio SMS for booking delivery.
+Credentials, billing, storage, and live provider adapters remain host-owned.
 
-The current release is `0.7.38`. It adds adapter-aware fresh Astro Booking
+```bash
+maggie media image-policy --policy contracts/maggie-media/image-generation-policy-v1.json
+maggie media video-policy --policy contracts/maggie-media/video-generation-policy-v1.json
+maggie analytics gsc-readiness --gsc-evidence .maggie/gsc-readiness.json
+maggie provenance --project . --source src/content/post.md
+maggie scaffold --project . --framework astro --language typescript --write --confirm
+maggie brand-kit --project . --design DESIGN.md --write --confirm
+maggie npm11 --project . --smoke --confirm
+maggie media video-playback --evidence .maggie/video-playback-evidence.json
+maggie booking-delivery --policy .maggie/booking-delivery-policy.json
+```
+
+These are evidence gates, not implicit provider calls. See the maintainer
+[decision record](../../docs/github-issues/DECISIONS-2026-09-22.md) for the
+remaining host/provider release work.
+
+The 0.7.40 release adds feedback batch 21 contracts for
+progressive-enhancement identity/request safety, rendered Tailwind utility and
+CSS-cascade checks, dashboard/sample surface evidence, primary-navigation
+indexability, privacy-origin parity, provider-neutral site structure, host
+capability manifests, and Booking treatment groups with duration/price
+variants. It also includes MaggieDash 0.2.9 host-contract updates.
+
+The previous `0.7.39` release candidate added adapter-aware fresh Astro Booking
 installation: blank hosts receive a portable Node SSR config while existing
 deployment adapters remain host-owned. It also adds the installable `maggie-booking`
 workflow for MaggieDash Booking: host bootstrap, traditional email/password
 team access with granular permissions, Stripe payment boundaries, Resend
 outbox and tenant email-template management, public customer booking flow,
 runtime/ops evidence checks, and the maintained Booking implementation docs.
+The manager workspace also includes a tenant-scoped prepaid treatment package
+catalogue with included variant quantities, package pricing, optional expiry,
+and active/inactive state. Managers can also grant tenant-scoped customer
+entitlements, inspect remaining balances, and redeem matching visits
+transactionally when creating a manager booking. Public customers can also
+start package checkout, return through a token-bound payment page, and the
+manager can list and request guarded Stripe package refunds. Verified package
+success/refund transitions also enqueue idempotent Resend confirmation/refund
+emails through the shared delivery worker.
+The Booking flow also supports an explicit, consented Stripe off-session
+no-show fee action after a booking is marked `no_show`; it requires a saved
+payment method, verified provider capability, idempotent adjustment state, and
+queues the customer email through the Resend outbox only after a successful
+charge. A status transition never charges automatically.
 Production activation remains fail-closed until the host migration, owner,
-Stripe, scheduler, and authenticated runtime evidence are supplied.
+Stripe, scheduler, and authenticated runtime evidence are supplied. The
+release candidate also regenerates the published Booking contracts and adds
+an exact npm-tarball smoke test so the registry package cannot silently fall
+behind the source CLI.
 
 The previous `0.7.36` release closed the next validated feedback batch:
 production demo fixtures are development-only, Dash infers the persisted
@@ -527,8 +585,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.38 update --project . --force
-npx @topy-ai/maggie@0.7.38 cleanup --project .
+npx @topy-ai/maggie@0.7.39 update --project . --force
+npx @topy-ai/maggie@0.7.39 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -642,6 +700,9 @@ has no existing Astro deployment adapter:
 
 ```bash
 maggie booking install --project . --confirm --install-dependencies
+
+# Reviewed new host: install missing packages and apply the Booking schema
+maggie booking install --project . --confirm --ready
 ```
 
 Existing dependency versions are preserved. A blank Astro project receives a
@@ -663,6 +724,20 @@ one in the local `.env` without printing it. Existing secrets are preserved;
 short configured values fail closed. External secret stores must provision the
 key themselves.
 
+Generate the worker schedule artifact during install when the host is ready to
+review its Resend outbox, reminders, and payment reconciliation cadence:
+
+```bash
+maggie booking install --project . --confirm --bootstrap --schedule systemd
+# or:
+maggie booking worker-schedule --project . --scheduler cron --confirm
+```
+
+The command writes reviewable files under `deploy/` only. It does not edit a
+crontab, enable systemd, start a worker, or print secrets. Review the generated
+unit, set an unprivileged service user, and enable it only after the migration,
+backup/restore, and host evidence gates pass.
+
 Run the read-only onboarding checklist after installation:
 
 ```bash
@@ -689,7 +764,7 @@ Validate the tenant-scoped Booking email-template contract independently:
 maggie booking email-templates-contract
 ```
 
-The Booking workspace includes seven Resend event templates. Owner,
+The Booking workspace includes ten Resend event templates. Owner,
 administrator, and Booking managers can edit drafts, preview sandboxed sample
 data, publish audited versions, and roll back earlier versions. Event-specific
 placeholders are allowlisted and escaped before the host worker sends through
@@ -1007,7 +1082,7 @@ repairs with `maggie dash sections validate`, `fanout-validate`,
 `maggie dash inventory` to classify published pages once into disjoint kinds.
 See the [quality contract examples](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggiedash/quality-contracts.md).
 
-The package includes all 19 installable skills: `maggie-blog-bootstrap`,
+The package includes all 20 installable skills: `maggie-blog-bootstrap`,
 `maggie-dash`, `maggie-clone`, `maggie-clone-to-template`, `maggie-marketplace`,
 `maggie-template`, `maggie-design`, `maggie-ops`, `maggie-deployment`,
 `maggie-project-context`, `maggie-seo-geo`, `maggie-social-share`,
@@ -1065,6 +1140,23 @@ maggie list
 maggie --help
 ```
 
+Feedback batch quality gates:
+
+```bash
+maggie design progressive-check --evidence .maggie/progressive.json
+maggie design dash-validate --plan .maggie/design/dashboard/PLAN.json --evidence .maggie/dashboard.json
+maggie design sample-validate --plan .maggie/design/sample/PLAN.json --evidence .maggie/sample.json
+maggie seo privacy-check --evidence .maggie/privacy-origins.json
+maggie dash capabilities-validate --manifest .maggie/host-capabilities.json
+maggie dash structure-validate --model .maggie/site-structure.json --evidence .maggie/site-structure-rendered.json
+maggie service treatment-group-audit --project .
+```
+
+These checks consume sanitized build/browser evidence and fail closed on
+third-party request churn, stale utility CSS, unsupported dashboard panels,
+privacy-policy origin drift, site-structure drift, or duplicated treatment
+products.
+
 ## Safety model
 
 - Clone only sites the user owns or is authorized to reproduce.

package/bin/maggie.js

@@ -58,7 +58,7 @@ Usage:
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
-  maggie booking install|inspect|setup|contract|runtime-validate|ops-validate|release-gate|stripe-audit|tasks --project PATH [options]
+  maggie booking install|worker-schedule|inspect|setup|contract|runtime-validate|ops-validate|release-gate|stripe-audit|tasks --project PATH [options]
   maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|variant-copy-validate|media-validate|bindings-validate|idempotency-validate|reconcile> [options]
   maggie dash inventory --pages-file FILE [--require-page-kinds] [--require-source-coverage]
   maggie dash api-contract --spec FILE
@@ -68,6 +68,12 @@ Usage:
   maggie dash components-audit --bindings-file FILE --sections-file FILE --pages-file FILE
   maggie dash status --project PATH
   maggie dash migrate --project PATH --confirm
+  maggie dash capabilities-validate|session-check|content-overrides-check --manifest FILE
+  maggie dash cache-boundary-check --evidence FILE
+  maggie dash structure-validate --model FILE --evidence FILE
+  maggie design progressive-check|css-check|css-cascade-check|style-check --evidence FILE
+  maggie design dash-init|dash-validate|sample-init|sample-validate [options]
+  maggie seo privacy-check --evidence FILE
   maggie content FILE --source PROVIDER --project PATH --confirm
   maggie agent-content write --url URL --allowed-origin ORIGIN --token-env ENV --payload FILE
   maggie bootstrap phase <start|pass|fail|status> <phase> [project]
@@ -85,6 +91,7 @@ Usage:
   maggie clone-to-template validate <id>
   maggie clone run <homepage-url> --run-id <id>
   maggie clone status --run-id <id>
+  maggie clone interactions --run-id <id> --browse PATH --interactions FILE
   maggie design run <target-url> --clone-run <id>
   maggie design reference-ui --project PATH --reference PATH --surface blog,service --confirm
   maggie design init --project PATH --surface blog|service --reference-run PATH --confirm
@@ -94,6 +101,7 @@ Usage:
   maggie design icon-inventory --project PATH --source-dir src --runtime assets/icons.css --output docs/icon-inventory.json
   maggie design icon-release-gate --icon-report FILE --browser-report FILE --output FILE
   maggie design author --project PATH --route /about --purpose TEXT --audience TEXT --confirm
+  maggie design markup-check --html FILE [--require-content-keys]
   maggie design in-place --project PATH --route /pricing [--content-source PATH]
   maggie design section --project PATH --route /pricing --section-id ID
   maggie design section-validate --before FILE --after FILE --section-id ID
@@ -126,6 +134,13 @@ Usage:
   maggie migration identity --identity-file FILE [--expected-file FILE]
   maggie schedule PATH/.maggie/schedule.json --project PATH
   maggie analytics [traffic-audit|release-gate] --project PATH --environment staging
+  maggie analytics gsc-readiness --gsc-evidence FILE
+  maggie media [image-policy|video-policy|video-job|video-playback] [--policy/--job/--evidence FILE]
+  maggie provenance --project PATH [--source PATH] [--output FILE]
+  maggie scaffold --project PATH --framework astro|nextjs|sveltekit|nuxt|vite-react|vite-vue [--write --confirm]
+  maggie brand-kit --manifest FILE | --project PATH --design DESIGN.md [--write --confirm]
+  maggie npm11 --project PATH [--smoke --confirm]
+  maggie booking-delivery [--policy FILE]
   maggie release PATH --environment staging --target vps-with-cloudflare-dns
   maggie api lifecycle --project PATH [--execute --allow-quota]
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
@@ -136,7 +151,7 @@ Usage:
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]
-  maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR]
+  maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR] [--interactions FILE]
   maggie verification coverage --contract FILE --evidence FILE
   maggie ops audit|preflight|verify|lockfiles|seed-manifest|google-capabilities|favicon-check --project PATH
   maggie ops google-capabilities --project PATH --report FILE [--output FILE]
@@ -400,6 +415,10 @@ function install(args) {
 }
 
 function update(args) {
+  if (args.some((item) => ["--help", "-h"].includes(item))) {
+    usage();
+    return;
+  }
   const root = projectRoot(args);
   const skills = selectedSkills(args);
   const force = args.includes("--force");
@@ -469,7 +488,8 @@ function docs(args) {
 function seo(args) {
   const command = args[0];
   const scripts = { performance: "maggie_performance.py", images: "maggie_images.py", sitemap: "maggie_sitemap.py", indexnow: "maggie_indexnow.py", "social-cards": "maggie_social_cards.py", "head-tags": "maggie_head_tags.py" };
-  if (!scripts[command]) throw new Error("seo command must be performance, images, sitemap, indexnow, social-cards, or head-tags");
+  if (command === "privacy-check") return workflowCli("maggie_contracts.py", ["privacy-check", ...args.slice(1)]);
+  if (!scripts[command]) throw new Error("seo command must be performance, images, sitemap, indexnow, social-cards, head-tags, or privacy-check");
   workflowCli(scripts[command], args.slice(1));
 }
 
@@ -564,6 +584,8 @@ try {
   else if (command === "clone-to-template") workflowCli("maggie_clone_to_template.py", args);
   else if (command === "design" && args[0] === "icon-inventory") workflowCli("maggie_icon_inventory.py", args.slice(1));
   else if (command === "design" && args[0] === "icon-release-gate") workflowCli("maggie_icon_release_gate.py", args.slice(1));
+  else if (command === "design" && ["progressive-check", "css-check", "css-cascade-check", "style-check", "dash-init", "dash-validate", "sample-init", "sample-validate"].includes(args[0])) workflowCli("maggie_contracts.py", args);
+  else if (command === "design" && args[0] === "markup-check") workflowCli("maggie_design.py", args);
   else if (command === "design") workflowCli("maggie_design.py", args);
   else if (command === "auth") workflowCli("maggie_auth.py", args);
   else if (command === "blog") workflowCli("maggie_blog.py", args);
@@ -580,6 +602,10 @@ try {
   else if (command === "migration") workflowCli("maggie_migration.py", args);
   else if (command === "schedule") workflowCli("maggie_schedule.py", args);
   else if (command === "analytics") workflowCli("maggie_analytics.py", args);
+  else if (["media", "provenance", "scaffold", "brand-kit", "npm11", "booking-delivery"].includes(command)) {
+    const workflowArgs = command === "media" ? ["media", ...args] : command === "brand-kit" ? ["brand-kit", ...args] : command === "npm11" ? ["npm11", ...args] : command === "booking-delivery" ? ["booking-delivery", ...args] : [command, ...args];
+    workflowCli("maggie_workflows.py", workflowArgs);
+  }
   else if (command === "release") workflowCli("maggie_release.py", args);
   else if (command === "bootstrap") workflowCli("maggie.py", ["bootstrap", ...args]);
   else if (command === "api") workflowCli("maggie.py", ["api", ...args]);
@@ -590,6 +616,7 @@ try {
   else if (command === "site-audit") workflowCli("site_audit.py", args);
   else if (command === "browser-audit") workflowCli("maggie_browser_audit.py", args);
   else if (command === "verification") workflowCli("maggie_verification.py", args);
+  else if (command === "dash" && ["capabilities-validate", "structure-validate", "content-overrides-check", "session-check", "cache-boundary-check"].includes(args[0])) workflowCli("maggie_contracts.py", args);
   else if (command === "dash") workflowCli("maggie_dash.py", args);
   else if (command === "booking") workflowCli("maggie_booking.py", args);
   else if (command === "agent-content") workflowCli("maggie_agent_content.py", args);

package/bundled-contracts/maggie-clone/interaction-state-v1.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-clone/interaction-state-v1.schema.json",
+  "title": "Maggie clone interaction-state evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "sourceRunId", "interactionManifest", "viewports", "states"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-clone-interaction-state.v1"},
+    "sourceRunId": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
+    "interactionManifest": {"type": "string", "minLength": 1},
+    "viewports": {"type": "array", "items": {"enum": ["desktop", "tablet", "mobile"]}, "minItems": 3, "uniqueItems": true},
+    "states": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"type": "object", "required": ["viewport", "stepId", "status"], "properties": {
+        "viewport": {"enum": ["desktop", "tablet", "mobile"]},
+        "stepId": {"type": "string"},
+        "status": {"enum": ["passed", "failed"]},
+        "screenshot": {"type": ["string", "null"]},
+        "error": {"type": ["string", "null"]}
+      }, "additionalProperties": false}
+    },
+    "redacted": {"const": true}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-content/provenance-v1.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-content/provenance-v1.schema.json",
+  "title": "Maggie git-backed content provenance v1",
+  "type": "object",
+  "required": ["schemaVersion", "commit", "branch", "dirty", "sourceRevision", "authoringBoundary"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-content-provenance.v1"},
+    "commit": {"type": "string", "pattern": "^[0-9a-f]{7,64}$"},
+    "branch": {"type": "string", "minLength": 1},
+    "dirty": {"type": "boolean"},
+    "sourceRevision": {"type": "string", "pattern": "^[0-9a-f]{7,64}$"},
+    "sourcePath": {"type": "string", "minLength": 1},
+    "authoringBoundary": {"enum": ["git-source", "host-runtime", "generated-artifact"]},
+    "tracked": {"type": "boolean"},
+    "staleWritePolicy": {"const": "reject-unless-source-revision-matches"},
+    "capturedAt": {"type": "string", "format": "date-time"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-design/brand-kit-v1.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-design/brand-kit-v1.schema.json",
+  "title": "Maggie reusable brand kit v1",
+  "type": "object",
+  "required": ["schemaVersion", "designTokens", "logo", "typography", "icons", "assetManifest", "preview", "designBoundary"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-brand-kit.v1"},
+    "designTokens": {"type": "object", "minProperties": 1},
+    "logo": {"type": "object", "required": ["primary", "variants"], "properties": {"primary": {"type": "string"}, "variants": {"type": "array", "items": {"type": "string"}}}, "additionalProperties": false},
+    "typography": {"type": "object", "required": ["families", "weights"], "properties": {"families": {"type": "array", "minItems": 1}, "weights": {"type": "array", "minItems": 1}}, "additionalProperties": false},
+    "icons": {"type": "object", "required": ["library", "policy"], "properties": {"library": {"type": "string"}, "policy": {"enum": ["library-first", "host-defined"]}}, "additionalProperties": false},
+    "assetManifest": {"type": "string", "minLength": 1},
+    "preview": {"type": "string", "minLength": 1},
+    "designBoundary": {"const": "DESIGN.md-and-host-tokens-are-source-of-truth"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-design/browser-interactions-v1.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/browser-interactions-v1.schema.json",
+  "title": "Maggie browser interaction evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "steps"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-browser-interactions.v1"},
+    "steps": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["id", "action"],
+        "properties": {
+          "id": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
+          "action": {"enum": ["click", "fill", "type", "select", "press", "wait", "assert-visible", "assert-enabled", "assert-disabled", "assert-checked", "assert-editable", "assert-text", "assert-style", "assert-no-request"]},
+          "selector": {"type": "string"},
+          "property": {"type": "string"},
+          "origin": {"type": "string"}
+        },
+        "additionalProperties": true
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-design/css-utility-evidence-v1.schema.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Maggie rendered CSS utility evidence",
+  "type": "object",
+  "required": ["schemaVersion", "elements"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-css-utility-evidence.v1"},
+    "elements": {"type": "array"}
+  }
+}

package/bundled-contracts/maggie-design/dashboard-surface-v1.schema.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Maggie operator dashboard surface",
+  "type": "object",
+  "required": ["schemaVersion", "route", "requiredEvidence"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-dashboard-surface.v1"},
+    "route": {"type": "string"},
+    "requiredEvidence": {"type": "array", "minItems": 6}
+  }
+}

package/bundled-contracts/maggie-design/progressive-enhancement-v1.schema.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Maggie progressive enhancement evidence",
+  "type": "object",
+  "required": ["schemaVersion", "region", "initial", "states"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-progressive-enhancement.v1"},
+    "region": {"type": "object", "required": ["id", "selector", "swapScope"]},
+    "initial": {"type": "object", "required": ["thirdPartyRequests", "identities"]},
+    "states": {"type": "array", "minItems": 1}
+  }
+}

package/bundled-contracts/maggie-design/sample-surface-v1.schema.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Maggie layout sample surface",
+  "type": "object",
+  "required": ["schemaVersion", "route", "noindex", "sitemapIncluded", "finishChecklist"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-sample-surface.v1"},
+    "route": {"type": "string"},
+    "noindex": {"const": true},
+    "sitemapIncluded": {"const": false},
+    "finishChecklist": {"type": "array", "minItems": 1}
+  }
+}

package/bundled-contracts/maggie-design/style-editing-v1.schema.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/style-editing-v1.schema.json",
+  "title": "Maggie design style editing contract v1",
+  "type": "object",
+  "required": ["schemaVersion", "properties", "templates"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-style-editing.v1"},
+    "properties": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["name", "pattern"],
+        "properties": {
+          "name": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9-]*$"},
+          "pattern": {"type": "string", "minLength": 1},
+          "scale": {"type": "array", "items": {"type": "string"}}
+        },
+        "additionalProperties": false
+      }
+    },
+    "templates": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "styles"],
+        "properties": {"id": {"type": "string"}, "appliesTo": {"type": "string"}, "styles": {"type": "object"}},
+        "additionalProperties": false
+      }
+    },
+    "customValues": {"const": "allow only after property pattern validation"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-media/image-generation-policy-v1.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-media/image-generation-policy-v1.json",
+  "title": "Maggie Gemini image generation and editing policy v1",
+  "schemaVersion": "maggie-image-generation-policy.v1",
+  "provider": "google-gemini",
+  "model": "gemini-3.1-flash-image",
+  "fallbackModel": "gemini-3.1-flash-lite-image",
+  "endpointEnv": "GEMINI_API_ENDPOINT",
+  "apiKeyEnv": "GEMINI_API_KEY",
+  "billingMode": "host-managed-or-byok",
+  "rights": {
+    "inputRightsRequired": true,
+    "outputReviewRequired": true,
+    "syntheticWatermarkExpected": true
+  },
+  "moderation": {
+    "preflightRequired": true,
+    "postGenerationReviewRequired": true,
+    "blockedOutputPolicy": "discard-and-report"
+  },
+  "outputs": {
+    "allowedMimeTypes": ["image/png", "image/jpeg", "image/webp"],
+    "allowedSizes": ["1K", "2K", "4K"],
+    "maxReferenceImages": 14
+  },
+  "provenance": ["provider", "model", "promptHash", "inputAssetHashes", "sourceRevision", "createdAt"]
+}