@topy-ai/maggie 0.7.40 → 0.7.42

package/README-zh-TW.md

@@ -8,11 +8,22 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.38 init --agent all
-npx @topy-ai/maggie doctor --project .
+npx @topy-ai/maggie@0.7.42 init --agent all
+npx @topy-ai/maggie@0.7.42 doctor --project .
 ```
 
-目前 release 是 `0.7.40`，加入 feedback batch 21：progressive enhancement
+目前 release 是 `0.7.42`。新增 redacted Gemini video-provider evidence gate，
+驗證 provider acknowledgement、idempotency、moderation、object-storage
+readback、bounded retry 與 git provenance，並拒絕 raw provider payload 或
+input asset 欄位。0.7.41 完成 feedback batches 22、23：加入 declarative
+browser interaction evidence、design markup/style/content-key gate、compiler
+source anchoring、entity double-escape protection、`update --help` read-only，
+以及 noindex hypothetical indexability、可過期 baseline acknowledgement、
+DOM-only link extraction regression。MaggieDash 0.2.10 同步提供 content
+override、短期 browser session、CDN-safe public-session cache contracts；
+authentication 和 isolated dev server 仍由 host 負責。
+
+0.7.40 加入 feedback batch 21：progressive enhancement
 的區域/identity/request 驗證、Tailwind utility 與 CSS cascade evidence、
 dashboard/sample surface contract、primary navigation indexability、privacy
 origin parity、provider-neutral site structure、host capability manifest，
@@ -20,6 +31,25 @@ origin parity、provider-neutral site structure、host capability manifest，
 同步更新至 0.2.9，ORA reference host 也提供相同的 capability/site-structure
 邊界。
 
+目前也加入 deferred workflow 的共用 contract gate：Gemini image/edit 使用
+Nano Banana 2，hero video 使用 Gemini Omni Flash，GSC 直接擴充 analytics
+release-gate，booking delivery 預設 Resend email + Twilio SMS；credentials、
+billing、storage 和 provider runtime 仍由 host 負責。
+
+```bash
+maggie media image-policy --policy contracts/maggie-media/image-generation-policy-v1.json
+maggie media video-policy --policy contracts/maggie-media/video-generation-policy-v1.json
+maggie analytics gsc-readiness --gsc-evidence .maggie/gsc-readiness.json
+maggie provenance --project . --source src/content/post.md
+maggie scaffold --project . --framework astro --language typescript --write --confirm
+maggie brand-kit --project . --design DESIGN.md --write --confirm
+maggie npm11 --project . --smoke --confirm
+maggie media video-provider-evidence --evidence .maggie/video-provider-evidence.json \
+  --environment staging --model gemini-omni-1.1-flash --require-host
+maggie media video-playback --evidence .maggie/video-playback-evidence.json
+maggie booking-delivery --policy .maggie/booking-delivery-policy.json
+```
+
 常用流程：
 
 ```bash
@@ -48,7 +78,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 source tree 的 release candidate 是 `0.7.39`，npm registry 仍是 `0.7.38`；候選版本加入可安裝的 `maggie-booking` workflow：MaggieDash Booking host bootstrap、傳統 email/password 團隊登入與 granular permissions、Stripe payment boundary、Resend outbox/template 管理、public customer booking flow、runtime/ops evidence checks，以及完整的 Booking 維護文件。全新的 Astro host 會自動補上可攜的 Node SSR adapter；已有 Cloudflare、Vercel、Netlify 或 Deno adapter 的專案會保留原本的部署選擇。Production activation 仍會 fail-closed，直到 host migration、owner、Stripe、scheduler 和 authenticated runtime evidence 都完成。上一版 `0.7.36` 完成下一批已驗證 feedback：修正 doctor placeholder scope、Tailwind renderable source scope、internal link/fragment audit、unstable baseline classification、site-wide baseline reason、base64url asset hash、installed-file hash update safety，並加入 provider-routed Gemini v2、venue timezone/DST booking parsing、social-card release path、notification lifecycle contract 和 mobile hero video playback contract。provider-bound video generation 與 transactional delivery 已記錄在 issue #39；前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 source tree 的正式 release 是 `0.7.41`。本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -60,7 +60,47 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 20 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.40`. It adds feedback batch 21 contracts for
+The current release is `0.7.42`. It adds a redacted Gemini video-provider
+evidence gate for provider acknowledgement, idempotency, moderation,
+object-storage readback, bounded retry, and git provenance; unknown raw
+provider payload and input-asset fields fail validation. The 0.7.41 release
+closes feedback batches 22 and 23 with
+declarative browser interaction evidence, stable design markup/style/content-key
+gates, compiler source anchoring, entity double-escape protection, and a
+read-only `update --help` path. It also adds hypothetical indexability
+diagnostics for `noindex` pages, expiring baseline acknowledgement evidence,
+DOM-only link extraction regression coverage, and provider-neutral MaggieDash
+contracts for content overrides, short-lived browser sessions, and CDN-safe
+public-session cache boundaries. Host-owned authentication and isolated
+dev-server choices remain explicit. MaggieDash 0.2.10 contains the matching
+host contracts.
+
+The source tree also includes the selected deferred-workflow contracts for
+Gemini media, clone interaction replay, GSC readiness, git content provenance,
+npm 11, empty-project scaffolding, brand kits, and booking delivery. The
+default provider policy is Gemini Nano Banana 2 for image/edit, Gemini Omni
+Flash for hero video, and Resend email plus Twilio SMS for booking delivery.
+Credentials, billing, storage, and live provider adapters remain host-owned.
+
+```bash
+maggie media image-policy --policy contracts/maggie-media/image-generation-policy-v1.json
+maggie media video-policy --policy contracts/maggie-media/video-generation-policy-v1.json
+maggie analytics gsc-readiness --gsc-evidence .maggie/gsc-readiness.json
+maggie provenance --project . --source src/content/post.md
+maggie scaffold --project . --framework astro --language typescript --write --confirm
+maggie brand-kit --project . --design DESIGN.md --write --confirm
+maggie npm11 --project . --smoke --confirm
+maggie media video-provider-evidence --evidence .maggie/video-provider-evidence.json \
+  --environment staging --model gemini-omni-1.1-flash --require-host
+maggie media video-playback --evidence .maggie/video-playback-evidence.json
+maggie booking-delivery --policy .maggie/booking-delivery-policy.json
+```
+
+These are evidence gates, not implicit provider calls. See the maintainer
+[decision record](../../docs/github-issues/DECISIONS-2026-09-22.md) for the
+remaining host/provider release work.
+
+The 0.7.40 release adds feedback batch 21 contracts for
 progressive-enhancement identity/request safety, rendered Tailwind utility and
 CSS-cascade checks, dashboard/sample surface evidence, primary-navigation
 indexability, privacy-origin parity, provider-neutral site structure, host

package/bin/maggie.js

@@ -68,9 +68,10 @@ Usage:
   maggie dash components-audit --bindings-file FILE --sections-file FILE --pages-file FILE
   maggie dash status --project PATH
   maggie dash migrate --project PATH --confirm
-  maggie dash capabilities-validate --manifest FILE
+  maggie dash capabilities-validate|session-check|content-overrides-check --manifest FILE
+  maggie dash cache-boundary-check --evidence FILE
   maggie dash structure-validate --model FILE --evidence FILE
-  maggie design progressive-check|css-check|css-cascade-check --evidence FILE
+  maggie design progressive-check|css-check|css-cascade-check|style-check --evidence FILE
   maggie design dash-init|dash-validate|sample-init|sample-validate [options]
   maggie seo privacy-check --evidence FILE
   maggie content FILE --source PROVIDER --project PATH --confirm
@@ -90,6 +91,7 @@ Usage:
   maggie clone-to-template validate <id>
   maggie clone run <homepage-url> --run-id <id>
   maggie clone status --run-id <id>
+  maggie clone interactions --run-id <id> --browse PATH --interactions FILE
   maggie design run <target-url> --clone-run <id>
   maggie design reference-ui --project PATH --reference PATH --surface blog,service --confirm
   maggie design init --project PATH --surface blog|service --reference-run PATH --confirm
@@ -99,6 +101,7 @@ Usage:
   maggie design icon-inventory --project PATH --source-dir src --runtime assets/icons.css --output docs/icon-inventory.json
   maggie design icon-release-gate --icon-report FILE --browser-report FILE --output FILE
   maggie design author --project PATH --route /about --purpose TEXT --audience TEXT --confirm
+  maggie design markup-check --html FILE [--require-content-keys]
   maggie design in-place --project PATH --route /pricing [--content-source PATH]
   maggie design section --project PATH --route /pricing --section-id ID
   maggie design section-validate --before FILE --after FILE --section-id ID
@@ -131,6 +134,13 @@ Usage:
   maggie migration identity --identity-file FILE [--expected-file FILE]
   maggie schedule PATH/.maggie/schedule.json --project PATH
   maggie analytics [traffic-audit|release-gate] --project PATH --environment staging
+  maggie analytics gsc-readiness --gsc-evidence FILE
+  maggie media [image-policy|video-policy|video-job|video-provider-evidence|video-playback] [--policy/--job/--evidence FILE]
+  maggie provenance --project PATH [--source PATH] [--output FILE]
+  maggie scaffold --project PATH --framework astro|nextjs|sveltekit|nuxt|vite-react|vite-vue [--write --confirm]
+  maggie brand-kit --manifest FILE | --project PATH --design DESIGN.md [--write --confirm]
+  maggie npm11 --project PATH [--smoke --confirm]
+  maggie booking-delivery [--policy FILE]
   maggie release PATH --environment staging --target vps-with-cloudflare-dns
   maggie api lifecycle --project PATH [--execute --allow-quota]
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
@@ -141,7 +151,7 @@ Usage:
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]
-  maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR]
+  maggie browser-audit URL --browse PATH --output DIR --required SELECTOR [--sticky SELECTOR] [--interactions FILE]
   maggie verification coverage --contract FILE --evidence FILE
   maggie ops audit|preflight|verify|lockfiles|seed-manifest|google-capabilities|favicon-check --project PATH
   maggie ops google-capabilities --project PATH --report FILE [--output FILE]
@@ -405,6 +415,10 @@ function install(args) {
 }
 
 function update(args) {
+  if (args.some((item) => ["--help", "-h"].includes(item))) {
+    usage();
+    return;
+  }
   const root = projectRoot(args);
   const skills = selectedSkills(args);
   const force = args.includes("--force");
@@ -570,7 +584,8 @@ try {
   else if (command === "clone-to-template") workflowCli("maggie_clone_to_template.py", args);
   else if (command === "design" && args[0] === "icon-inventory") workflowCli("maggie_icon_inventory.py", args.slice(1));
   else if (command === "design" && args[0] === "icon-release-gate") workflowCli("maggie_icon_release_gate.py", args.slice(1));
-  else if (command === "design" && ["progressive-check", "css-check", "css-cascade-check", "dash-init", "dash-validate", "sample-init", "sample-validate"].includes(args[0])) workflowCli("maggie_contracts.py", args);
+  else if (command === "design" && ["progressive-check", "css-check", "css-cascade-check", "style-check", "dash-init", "dash-validate", "sample-init", "sample-validate"].includes(args[0])) workflowCli("maggie_contracts.py", args);
+  else if (command === "design" && args[0] === "markup-check") workflowCli("maggie_design.py", args);
   else if (command === "design") workflowCli("maggie_design.py", args);
   else if (command === "auth") workflowCli("maggie_auth.py", args);
   else if (command === "blog") workflowCli("maggie_blog.py", args);
@@ -587,6 +602,10 @@ try {
   else if (command === "migration") workflowCli("maggie_migration.py", args);
   else if (command === "schedule") workflowCli("maggie_schedule.py", args);
   else if (command === "analytics") workflowCli("maggie_analytics.py", args);
+  else if (["media", "provenance", "scaffold", "brand-kit", "npm11", "booking-delivery"].includes(command)) {
+    const workflowArgs = command === "media" ? ["media", ...args] : command === "brand-kit" ? ["brand-kit", ...args] : command === "npm11" ? ["npm11", ...args] : command === "booking-delivery" ? ["booking-delivery", ...args] : [command, ...args];
+    workflowCli("maggie_workflows.py", workflowArgs);
+  }
   else if (command === "release") workflowCli("maggie_release.py", args);
   else if (command === "bootstrap") workflowCli("maggie.py", ["bootstrap", ...args]);
   else if (command === "api") workflowCli("maggie.py", ["api", ...args]);
@@ -597,7 +616,7 @@ try {
   else if (command === "site-audit") workflowCli("site_audit.py", args);
   else if (command === "browser-audit") workflowCli("maggie_browser_audit.py", args);
   else if (command === "verification") workflowCli("maggie_verification.py", args);
-  else if (command === "dash" && ["capabilities-validate", "structure-validate"].includes(args[0])) workflowCli("maggie_contracts.py", args);
+  else if (command === "dash" && ["capabilities-validate", "structure-validate", "content-overrides-check", "session-check", "cache-boundary-check"].includes(args[0])) workflowCli("maggie_contracts.py", args);
   else if (command === "dash") workflowCli("maggie_dash.py", args);
   else if (command === "booking") workflowCli("maggie_booking.py", args);
   else if (command === "agent-content") workflowCli("maggie_agent_content.py", args);

package/bundled-contracts/maggie-clone/interaction-state-v1.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-clone/interaction-state-v1.schema.json",
+  "title": "Maggie clone interaction-state evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "sourceRunId", "interactionManifest", "viewports", "states"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-clone-interaction-state.v1"},
+    "sourceRunId": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
+    "interactionManifest": {"type": "string", "minLength": 1},
+    "viewports": {"type": "array", "items": {"enum": ["desktop", "tablet", "mobile"]}, "minItems": 3, "uniqueItems": true},
+    "states": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"type": "object", "required": ["viewport", "stepId", "status"], "properties": {
+        "viewport": {"enum": ["desktop", "tablet", "mobile"]},
+        "stepId": {"type": "string"},
+        "status": {"enum": ["passed", "failed"]},
+        "screenshot": {"type": ["string", "null"]},
+        "error": {"type": ["string", "null"]}
+      }, "additionalProperties": false}
+    },
+    "redacted": {"const": true}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-content/provenance-v1.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-content/provenance-v1.schema.json",
+  "title": "Maggie git-backed content provenance v1",
+  "type": "object",
+  "required": ["schemaVersion", "commit", "branch", "dirty", "sourceRevision", "authoringBoundary"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-content-provenance.v1"},
+    "commit": {"type": "string", "pattern": "^[0-9a-f]{7,64}$"},
+    "branch": {"type": "string", "minLength": 1},
+    "dirty": {"type": "boolean"},
+    "sourceRevision": {"type": "string", "pattern": "^[0-9a-f]{7,64}$"},
+    "sourcePath": {"type": "string", "minLength": 1},
+    "authoringBoundary": {"enum": ["git-source", "host-runtime", "generated-artifact"]},
+    "tracked": {"type": "boolean"},
+    "staleWritePolicy": {"const": "reject-unless-source-revision-matches"},
+    "capturedAt": {"type": "string", "format": "date-time"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-design/brand-kit-v1.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-design/brand-kit-v1.schema.json",
+  "title": "Maggie reusable brand kit v1",
+  "type": "object",
+  "required": ["schemaVersion", "designTokens", "logo", "typography", "icons", "assetManifest", "preview", "designBoundary"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-brand-kit.v1"},
+    "designTokens": {"type": "object", "minProperties": 1},
+    "logo": {"type": "object", "required": ["primary", "variants"], "properties": {"primary": {"type": "string"}, "variants": {"type": "array", "items": {"type": "string"}}}, "additionalProperties": false},
+    "typography": {"type": "object", "required": ["families", "weights"], "properties": {"families": {"type": "array", "minItems": 1}, "weights": {"type": "array", "minItems": 1}}, "additionalProperties": false},
+    "icons": {"type": "object", "required": ["library", "policy"], "properties": {"library": {"type": "string"}, "policy": {"enum": ["library-first", "host-defined"]}}, "additionalProperties": false},
+    "assetManifest": {"type": "string", "minLength": 1},
+    "preview": {"type": "string", "minLength": 1},
+    "designBoundary": {"const": "DESIGN.md-and-host-tokens-are-source-of-truth"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-design/browser-interactions-v1.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/browser-interactions-v1.schema.json",
+  "title": "Maggie browser interaction evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "steps"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-browser-interactions.v1"},
+    "steps": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["id", "action"],
+        "properties": {
+          "id": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
+          "action": {"enum": ["click", "fill", "type", "select", "press", "wait", "assert-visible", "assert-enabled", "assert-disabled", "assert-checked", "assert-editable", "assert-text", "assert-style", "assert-no-request"]},
+          "selector": {"type": "string"},
+          "property": {"type": "string"},
+          "origin": {"type": "string"}
+        },
+        "additionalProperties": true
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-design/style-editing-v1.schema.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/style-editing-v1.schema.json",
+  "title": "Maggie design style editing contract v1",
+  "type": "object",
+  "required": ["schemaVersion", "properties", "templates"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-style-editing.v1"},
+    "properties": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["name", "pattern"],
+        "properties": {
+          "name": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9-]*$"},
+          "pattern": {"type": "string", "minLength": 1},
+          "scale": {"type": "array", "items": {"type": "string"}}
+        },
+        "additionalProperties": false
+      }
+    },
+    "templates": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "styles"],
+        "properties": {"id": {"type": "string"}, "appliesTo": {"type": "string"}, "styles": {"type": "object"}},
+        "additionalProperties": false
+      }
+    },
+    "customValues": {"const": "allow only after property pattern validation"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-media/image-generation-policy-v1.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-media/image-generation-policy-v1.json",
+  "title": "Maggie Gemini image generation and editing policy v1",
+  "schemaVersion": "maggie-image-generation-policy.v1",
+  "provider": "google-gemini",
+  "model": "gemini-3.1-flash-image",
+  "fallbackModel": "gemini-3.1-flash-lite-image",
+  "endpointEnv": "GEMINI_API_ENDPOINT",
+  "apiKeyEnv": "GEMINI_API_KEY",
+  "billingMode": "host-managed-or-byok",
+  "rights": {
+    "inputRightsRequired": true,
+    "outputReviewRequired": true,
+    "syntheticWatermarkExpected": true
+  },
+  "moderation": {
+    "preflightRequired": true,
+    "postGenerationReviewRequired": true,
+    "blockedOutputPolicy": "discard-and-report"
+  },
+  "outputs": {
+    "allowedMimeTypes": ["image/png", "image/jpeg", "image/webp"],
+    "allowedSizes": ["1K", "2K", "4K"],
+    "maxReferenceImages": 14
+  },
+  "provenance": ["provider", "model", "promptHash", "inputAssetHashes", "sourceRevision", "createdAt"]
+}

package/bundled-contracts/maggie-media/video-generation-policy-v1.json

@@ -0,0 +1,40 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-media/video-generation-policy-v1.json",
+  "title": "Maggie Gemini hero video generation policy v1",
+  "schemaVersion": "maggie-video-generation-policy.v1",
+  "provider": "google-gemini",
+  "model": "gemini-omni-1.1-flash",
+  "fallbackModel": "veo-3.1-generate-preview",
+  "endpointEnv": "GEMINI_API_ENDPOINT",
+  "apiKeyEnv": "GEMINI_API_KEY",
+  "billingMode": "host-managed-or-byok",
+  "costPolicy": {
+    "budgetRequired": true,
+    "maxAttemptsPerJob": 3,
+    "duplicateChargeProtection": "idempotency-key"
+  },
+  "rights": {
+    "inputRightsRequired": true,
+    "outputReviewRequired": true,
+    "audioRightsRequired": true
+  },
+  "moderation": {
+    "preflightRequired": true,
+    "postGenerationReviewRequired": true,
+    "blockedOutputPolicy": "discard-and-report"
+  },
+  "storage": {
+    "adapter": "host-owned-object-storage",
+    "publicUrlPolicy": "signed-or-approved-public-url",
+    "retentionDaysRequired": true,
+    "sourceAssetAndJobMetadataRequired": true
+  },
+  "playback": {
+    "posterRequired": true,
+    "reducedMotionFallbackRequired": true,
+    "saveDataFallbackRequired": true,
+    "mobileSafe": true
+  },
+  "provenance": ["provider", "model", "promptHash", "inputAssetHashes", "sourceRevision", "createdAt"]
+}

package/bundled-contracts/maggie-media/video-job-v1.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-media/video-job-v1.schema.json",
+  "title": "Maggie video generation job v1",
+  "type": "object",
+  "required": ["schemaVersion", "jobId", "idempotencyKey", "state", "attempt", "sourceRevision", "provenance"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-video-job.v1"},
+    "jobId": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$"},
+    "idempotencyKey": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$"},
+    "state": {"enum": ["queued", "running", "retrying", "cancelled", "blocked", "completed", "failed", "dead-letter"]},
+    "attempt": {"type": "integer", "minimum": 0, "maximum": 3},
+    "sourceRevision": {"type": "object"},
+    "provenance": {"type": "object"},
+    "segments": {"type": "array", "items": {"type": "object"}},
+    "storage": {"type": "object"},
+    "errorClass": {"enum": ["provider-transient", "provider-permanent", "moderation", "rights", "validation", "cancelled", "cost-limit", "unknown"]}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-media/video-playback-evidence-v1.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-media/video-playback-evidence-v1.schema.json",
+  "title": "Maggie video playback evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "jobId", "sourceRevision", "viewports", "rawProviderPayloadIncluded"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-video-playback-evidence.v1"},
+    "jobId": {"type": "string"},
+    "sourceRevision": {"type": "object"},
+    "viewports": {"type": "array", "minItems": 3, "items": {"type": "object", "required": ["viewport", "status", "posterVisible", "reducedMotionFallback", "saveDataFallback"], "properties": {"viewport": {"enum": ["desktop", "tablet", "mobile"]}, "status": {"const": "passed"}, "posterVisible": {"const": true}, "reducedMotionFallback": {"const": true}, "saveDataFallback": {"const": true}}, "additionalProperties": false}},
+    "rawProviderPayloadIncluded": {"const": false}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-media/video-provider-evidence-v1.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-media/video-provider-evidence-v1.schema.json",
+  "title": "Maggie video provider canary evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "environment", "provider", "model", "status", "hostVerified", "acknowledgement", "idempotency", "moderation", "storage", "retry", "rawProviderPayloadIncluded", "inputAssetDataIncluded", "sourceRevision"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-video-provider-evidence.v1"},
+    "environment": {"enum": ["test", "staging", "production"]},
+    "provider": {"const": "google-gemini"},
+    "model": {"type": "string", "pattern": "^(gemini|veo)-"},
+    "status": {"const": "passed"},
+    "hostVerified": {"const": true},
+    "acknowledgement": {"type": "object", "required": ["accepted", "providerReferencePresent"], "properties": {"accepted": {"const": true}, "providerReferencePresent": {"const": true}}, "additionalProperties": false},
+    "idempotency": {"type": "object", "required": ["replayAccepted", "duplicateChargePrevented", "assetDeduplicated"], "properties": {"replayAccepted": {"const": true}, "duplicateChargePrevented": {"const": true}, "assetDeduplicated": {"const": true}}, "additionalProperties": false},
+    "moderation": {"type": "object", "required": ["preflightPassed", "postGenerationReviewPassed"], "properties": {"preflightPassed": {"const": true}, "postGenerationReviewPassed": {"const": true}}, "additionalProperties": false},
+    "storage": {"type": "object", "required": ["uploadAccepted", "metadataPersisted", "readbackPassed", "signedOrApprovedUrlPresent"], "properties": {"uploadAccepted": {"const": true}, "metadataPersisted": {"const": true}, "readbackPassed": {"const": true}, "signedOrApprovedUrlPresent": {"const": true}}, "additionalProperties": false},
+    "retry": {"type": "object", "required": ["transientFailureObserved", "bounded", "attempts"], "properties": {"transientFailureObserved": {"const": true}, "bounded": {"const": true}, "attempts": {"type": "integer", "minimum": 1, "maximum": 3}}, "additionalProperties": false},
+    "rawProviderPayloadIncluded": {"const": false},
+    "inputAssetDataIncluded": {"const": false},
+    "sourceRevision": {"type": "object", "required": ["commit", "branch", "dirty"], "properties": {"commit": {"type": "string"}, "branch": {"type": "string"}, "dirty": {"type": "boolean"}}, "additionalProperties": false},
+    "generatedAt": {"type": "string"}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-ops/npm11-preflight-v1.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-ops/npm11-preflight-v1.schema.json",
+  "title": "Maggie npm 11 install preflight v1",
+  "type": "object",
+  "required": ["schemaVersion", "supportMatrix", "node", "npm", "installScriptPolicy", "lockfilePolicy", "smoke"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-npm11-preflight.v1"},
+    "supportMatrix": {"type": "array", "minItems": 4, "items": {"type": "object", "required": ["packageManager", "supportedVersions", "installCommand", "lockfile", "lifecyclePolicy"], "properties": {"packageManager": {"enum": ["npm", "pnpm", "yarn", "bun"]}, "supportedVersions": {"type": "array", "minItems": 1}, "installCommand": {"type": "string"}, "lockfile": {"type": "string"}, "lifecyclePolicy": {"const": "ignore-scripts-smoke-first"}}, "additionalProperties": false}},
+    "node": {"type": "object", "required": ["supportedMajor", "observedMajor"]},
+    "npm": {"type": "object", "required": ["supportedMajor", "observedMajor"]},
+    "installScriptPolicy": {"enum": ["audit-before-run", "ignore-scripts-smoke-first"]},
+    "lockfilePolicy": {"enum": ["package-lock-v3", "host-package-manager"]},
+    "smoke": {"type": "object", "required": ["ignoreScripts", "passed"], "properties": {"ignoreScripts": {"type": "boolean"}, "passed": {"type": "boolean"}}, "additionalProperties": false}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-scaffold/host-scaffold-v1.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-scaffold/host-scaffold-v1.schema.json",
+  "title": "Maggie empty-project host scaffold v1",
+  "type": "object",
+  "required": ["schemaVersion", "framework", "language", "packageManager", "installPolicy", "hostHandoff"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-host-scaffold.v1"},
+    "framework": {"enum": ["astro", "nextjs", "sveltekit", "nuxt", "vite-react", "vite-vue"]},
+    "language": {"enum": ["typescript", "javascript"]},
+    "packageManager": {"enum": ["npm", "pnpm", "yarn", "bun"]},
+    "installPolicy": {"type": "object", "required": ["requiresConfirm", "secretsByDefault", "migrationsByDefault"], "properties": {
+      "requiresConfirm": {"const": true},
+      "secretsByDefault": {"const": "never"},
+      "migrationsByDefault": {"const": "never"},
+      "installDependencies": {"type": "boolean"}
+    }, "additionalProperties": false},
+    "hostHandoff": {"type": "object", "required": ["generatedFiles", "rollbackPlan", "nextCommands"], "properties": {
+      "generatedFiles": {"type": "array", "items": {"type": "string"}},
+      "rollbackPlan": {"type": "string", "minLength": 1},
+      "nextCommands": {"type": "array", "items": {"type": "string"}}
+    }, "additionalProperties": false}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-seo/gsc-readiness-v1.schema.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-seo/gsc-readiness-v1.schema.json",
+  "title": "Maggie Search Console readiness evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "property", "verification", "canonical", "robots", "sitemap", "authorization", "queryReadback", "productionSmoke"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-gsc-readiness.v1"},
+    "property": {"type": "object", "required": ["siteUrl", "type"], "properties": {"siteUrl": {"type": "string", "format": "uri"}, "type": {"enum": ["domain", "url-prefix"]}}, "additionalProperties": false},
+    "verification": {"type": "object", "required": ["passed"], "properties": {"passed": {"const": true}, "method": {"enum": ["dns", "html", "meta"]}}, "additionalProperties": false},
+    "canonical": {"type": "object", "required": ["passed", "origin"], "properties": {"passed": {"const": true}, "origin": {"type": "string"}}, "additionalProperties": false},
+    "robots": {"type": "object", "required": ["passed"], "properties": {"passed": {"const": true}}, "additionalProperties": false},
+    "sitemap": {"type": "object", "required": ["passed", "url"], "properties": {"passed": {"const": true}, "url": {"type": "string", "format": "uri"}}, "additionalProperties": false},
+    "authorization": {"type": "object", "required": ["readOnly", "authorized"], "properties": {"readOnly": {"const": true}, "authorized": {"const": true}}, "additionalProperties": false},
+    "queryReadback": {"type": "object", "required": ["passed"], "properties": {"passed": {"const": true}, "rows": {"type": "integer", "minimum": 0}}, "additionalProperties": false},
+    "productionSmoke": {"type": "object", "required": ["passed"], "properties": {"passed": {"const": true}}, "additionalProperties": false}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-service-booking/delivery-provider-default-v1.json

@@ -0,0 +1,8 @@
+{
+  "schemaVersion": "maggie-booking-delivery-provider.v1",
+  "email": {"provider": "resend", "channel": "email", "secretEnv": "RESEND_API_KEY"},
+  "sms": {"provider": "twilio", "channel": "sms", "secretEnv": "TWILIO_AUTH_TOKEN"},
+  "confirmationRule": "provider-acknowledged-only",
+  "retryPolicy": {"maxAttempts": 5, "backoff": "exponential-jitter", "idempotency": "booking-event-and-channel"},
+  "deadLetterPolicy": {"afterMaxAttempts": "dead-letter", "replayRequiresExplicitAction": true}
+}

package/bundled-contracts/maggie-service-booking/delivery-provider-v1.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-service-booking/delivery-provider-v1.schema.json",
+  "title": "Maggie booking notification delivery provider v1",
+  "type": "object",
+  "required": ["schemaVersion", "email", "sms", "confirmationRule", "retryPolicy", "deadLetterPolicy"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-booking-delivery-provider.v1"},
+    "email": {"type": "object", "required": ["provider", "channel", "secretEnv"], "properties": {"provider": {"enum": ["resend", "provider-neutral"]}, "channel": {"const": "email"}, "secretEnv": {"type": "string", "pattern": "^[A-Z][A-Z0-9_]+$"}}, "additionalProperties": false},
+    "sms": {"type": "object", "required": ["provider", "channel", "secretEnv"], "properties": {"provider": {"enum": ["twilio", "provider-neutral"]}, "channel": {"const": "sms"}, "secretEnv": {"type": "string", "pattern": "^[A-Z][A-Z0-9_]+$"}}, "additionalProperties": false},
+    "confirmationRule": {"const": "provider-acknowledged-only"},
+    "retryPolicy": {"type": "object", "required": ["maxAttempts", "backoff", "idempotency"], "properties": {"maxAttempts": {"type": "integer", "minimum": 1, "maximum": 10}, "backoff": {"enum": ["exponential-jitter", "fixed"]}, "idempotency": {"const": "booking-event-and-channel"}}, "additionalProperties": false},
+    "deadLetterPolicy": {"type": "object", "required": ["afterMaxAttempts", "replayRequiresExplicitAction"], "properties": {"afterMaxAttempts": {"const": "dead-letter"}, "replayRequiresExplicitAction": {"const": true}}, "additionalProperties": false}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/browser-session-v1.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/browser-session-v1.schema.json",
+  "title": "MaggieDash browser QA session contract v1",
+  "type": "object",
+  "required": ["schemaVersion", "mintingBoundary", "passwordHandling", "ttlMinutes", "mintRoute", "revokeRoute"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-browser-session.v1"},
+    "mintingBoundary": {"const": "host-adapter"},
+    "passwordHandling": {"const": "never-exposed"},
+    "ttlMinutes": {"type": "integer", "minimum": 1, "maximum": 240},
+    "mintRoute": {"type": "string", "pattern": "^/"},
+    "revokeRoute": {"type": "string", "pattern": "^/"},
+    "cookie": {"type": "object", "additionalProperties": true},
+    "roles": {"type": "array", "items": {"type": "string"}}
+  },
+  "additionalProperties": false
+}