@topy-ai/maggie 0.7.42 → 0.7.43

package/README-zh-TW.md

@@ -8,11 +8,13 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.42 init --agent all
-npx @topy-ai/maggie@0.7.42 doctor --project .
+npx @topy-ai/maggie@0.7.43 init --agent all
+npx @topy-ai/maggie@0.7.43 doctor --project .
 ```
 
-目前 release 是 `0.7.42`。新增 redacted Gemini video-provider evidence gate，
+目前 release 是 `0.7.43`。新增 secret-free Starter marketplace provisioning
+plan、versioned GitHub/Cloudflare/Starter contracts，以及 deterministic
+`maggie marketplace plan` dry-run CLI。0.7.42 新增 redacted Gemini video-provider evidence gate，
 驗證 provider acknowledgement、idempotency、moderation、object-storage
 readback、bounded retry 與 git provenance，並拒絕 raw provider payload 或
 input asset 欄位。0.7.41 完成 feedback batches 22、23：加入 declarative
@@ -78,7 +80,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 source tree 的正式 release 是 `0.7.41`。本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 source tree 的正式 release 是 `0.7.43`。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -60,7 +60,12 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 20 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.42`. It adds a redacted Gemini video-provider
+The current release is `0.7.43`. It adds a secret-free Starter marketplace
+provisioning plan and bundles versioned GitHub repository, Cloudflare Pages,
+Starter site, and Starter release contracts. `maggie marketplace plan` emits a
+deterministic dry-run plan for a public Cal.com URL, static Cloudflare Pages,
+no database, and ordered idempotent steps; it never stores credentials or
+mutates provider state. The 0.7.42 release adds a redacted Gemini video-provider
 evidence gate for provider acknowledgement, idempotency, moderation,
 object-storage readback, bounded retry, and git provenance; unknown raw
 provider payload and input-asset fields fail validation. The 0.7.41 release

package/bin/maggie.js

@@ -80,6 +80,7 @@ Usage:
   maggie remove [SKILL ...] [--project PATH] [--agent codex|claude|all]
   maggie cleanup --project PATH [--confirm]
   maggie marketplace add <template-url> clone <preview-url> --rename <id>
+  maggie marketplace plan --workspace-id ID --merchant-id ID --site-slug SLUG --cal-url URL [--output FILE]
   maggie marketplace list
   maggie marketplace suggest "premium London medical spa"
   maggie marketplace inspect <id>
@@ -124,6 +125,7 @@ Usage:
   maggie service convert-page <page-path> --project PATH
   maggie service match-pages --project PATH --pages-dir src/pages
   maggie deployment --project PATH --target vps-with-cloudflare-dns
+  maggie deployment worker-secrets --project PATH --environment staging --required RESEND_API_KEY
   maggie deployment readiness --project PATH
   maggie deployment parity --project PATH --evidence FILE --output FILE
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json

package/bundled-contracts/maggie-marketplace/cloudflare-pages-v1.schema.json

@@ -0,0 +1,90 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-marketplace/cloudflare-pages-v1.schema.json",
+  "title": "Maggie marketplace Cloudflare Pages adapter result v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "provider", "state", "sourceRevision", "retry", "privacy"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-marketplace-cloudflare-pages.v1"},
+    "provider": {"const": "cloudflare-pages"},
+    "state": {"enum": ["succeeded", "retryable", "dead-letter"]},
+    "projectOutcome": {"enum": ["created", "reused", "updated"]},
+    "domainOutcome": {"enum": ["created", "reused", "updated"]},
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["externalReference", "name", "productionBranch", "repositoryOwner", "repositoryName", "sourceType"],
+      "properties": {
+        "externalReference": {"type": "string", "minLength": 1, "maxLength": 200},
+        "name": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$"},
+        "productionBranch": {"type": "string", "pattern": "^[A-Za-z0-9._/-]+$"},
+        "repositoryOwner": {"type": "string", "minLength": 1, "maxLength": 100},
+        "repositoryName": {"type": "string", "minLength": 1, "maxLength": 100},
+        "sourceType": {"enum": ["github", "direct-upload"]},
+        "canonicalUrl": {"type": ["string", "null"], "format": "uri", "pattern": "^https://"}
+      }
+    },
+    "domain": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["externalReference", "name", "status", "validationStatus", "verificationStatus"],
+      "properties": {
+        "externalReference": {"type": "string", "minLength": 1, "maxLength": 255},
+        "name": {"type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.bea\\.gift$"},
+        "status": {"enum": ["initializing", "pending", "active", "deactivated", "blocked", "error", "unknown"]},
+        "validationStatus": {"type": "string", "minLength": 1, "maxLength": 80},
+        "verificationStatus": {"type": "string", "minLength": 1, "maxLength": 80}
+      }
+    },
+    "deployment": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["externalReference", "environment", "stageStatus", "skipped"],
+      "properties": {
+        "externalReference": {"type": "string", "minLength": 1, "maxLength": 200},
+        "environment": {"enum": ["production", "preview", "unknown"]},
+        "sourceRevision": {"type": ["string", "null"], "pattern": "^[A-Za-z0-9._:/-]{1,200}$"},
+        "branch": {"type": ["string", "null"], "pattern": "^[A-Za-z0-9._/-]+$"},
+        "stageStatus": {"enum": ["success", "idle", "active", "failure", "canceled", "unknown"]},
+        "url": {"type": ["string", "null"], "format": "uri", "pattern": "^https://"},
+        "skipped": {"type": "boolean"}
+      }
+    },
+    "publicReadback": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["url", "status", "https", "canonical"],
+      "properties": {
+        "url": {"type": "string", "format": "uri", "pattern": "^https://"},
+        "status": {"type": "integer", "minimum": 100, "maximum": 599},
+        "https": {"const": true},
+        "canonical": {"const": true},
+        "contentType": {"type": ["string", "null"], "maxLength": 160}
+      }
+    },
+    "sourceRevision": {"type": "string", "pattern": "^[A-Za-z0-9._:/-]{1,200}$"},
+    "errorCode": {"type": "string", "pattern": "^cloudflare_[a-z0-9_]{1,80}$"},
+    "retry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["allowed", "attempt", "maxAttempts"],
+      "properties": {
+        "allowed": {"type": "boolean"},
+        "attempt": {"type": "integer", "minimum": 1, "maximum": 3},
+        "maxAttempts": {"const": 3},
+        "afterSeconds": {"type": "integer", "minimum": 0, "maximum": 900}
+      }
+    },
+    "privacy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["tokenIncluded", "rawResponseIncluded", "secretFree"],
+      "properties": {
+        "tokenIncluded": {"const": false},
+        "rawResponseIncluded": {"const": false},
+        "secretFree": {"const": true}
+      }
+    }
+  }
+}

package/bundled-contracts/maggie-marketplace/enrichment-v1.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-marketplace/enrichment-v1.schema.json",
+  "title": "Maggie marketplace enrichment evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "candidateId", "status", "passed", "errors", "crawl", "audit", "snapshot", "seoBackfill", "retry", "privacy"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-marketplace-enrichment.v1"},
+    "candidateId": {"type": "string", "minLength": 1},
+    "status": {"enum": ["passed", "failed"]}, "passed": {"type": "boolean"},
+    "errors": {"type": "array", "items": {"type": "string"}},
+    "crawl": {"type": "object"}, "audit": {"type": "object"}, "snapshot": {"type": "object"}, "seoBackfill": {"type": "object"},
+    "retry": {"type": "object", "required": ["allowed"]},
+    "privacy": {"type": "object", "required": ["rawHtmlIncluded", "responseBodiesIncluded", "localPathsIncluded", "secretsRedacted"]}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggie-marketplace/github-repository-v1.schema.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-marketplace/github-repository-v1.schema.json",
+  "title": "Maggie marketplace GitHub repository adapter result v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "provider", "state", "sourceRevision", "retry", "privacy"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-marketplace-github-repository.v1"},
+    "provider": {"const": "github"},
+    "state": {"enum": ["succeeded", "retryable", "dead-letter"]},
+    "outcome": {"enum": ["created", "reused", "updated"]},
+    "repository": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["externalReference", "owner", "name", "private", "defaultBranch", "htmlUrl"],
+      "properties": {
+        "externalReference": {"type": "string", "pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$"},
+        "owner": {"type": "string", "pattern": "^[A-Za-z0-9-]{1,39}$"},
+        "name": {"type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,98}[A-Za-z0-9])?$"},
+        "private": {"type": "boolean"},
+        "defaultBranch": {"type": "string", "pattern": "^[A-Za-z0-9._/-]+$"},
+        "htmlUrl": {"type": "string", "format": "uri", "pattern": "^https://github\\.com/"}
+      }
+    },
+    "sourceRevision": {"type": "string", "pattern": "^[A-Za-z0-9._:/-]{1,200}$"},
+    "errorCode": {"type": "string", "pattern": "^github_[a-z0-9_]{1,80}$"},
+    "retry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["allowed", "attempt", "maxAttempts"],
+      "properties": {
+        "allowed": {"type": "boolean"},
+        "attempt": {"type": "integer", "minimum": 1, "maximum": 3},
+        "maxAttempts": {"const": 3},
+        "afterSeconds": {"type": "integer", "minimum": 0, "maximum": 900}
+      }
+    },
+    "privacy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["tokenIncluded", "rawResponseIncluded", "secretFree"],
+      "properties": {
+        "tokenIncluded": {"const": false},
+        "rawResponseIncluded": {"const": false},
+        "secretFree": {"const": true}
+      }
+    }
+  }
+}

package/bundled-contracts/maggie-marketplace/starter-provisioning-v1.schema.json

@@ -0,0 +1,72 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-marketplace/starter-provisioning-v1.schema.json",
+  "title": "Maggie marketplace Starter provisioning plan v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "plan", "mode", "workspace", "site", "booking", "steps", "security", "nextActions"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-marketplace-starter-provisioning.v1"},
+    "plan": {"const": "starter"},
+    "mode": {"const": "dry-run"},
+    "workspace": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["workspaceId", "merchantId"],
+      "properties": {
+        "workspaceId": {"type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$"},
+        "merchantId": {"type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$"}
+      }
+    },
+    "site": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["slug", "hostname", "repository", "branch", "runtime", "database"],
+      "properties": {
+        "slug": {"type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$"},
+        "hostname": {"type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.bea\\.gift$"},
+        "repository": {"type": "string", "pattern": "^bea-merchant-[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$"},
+        "templateId": {"type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$"},
+        "branch": {"type": "string", "pattern": "^[A-Za-z0-9._/-]+$"},
+        "runtime": {"const": "cloudflare-pages-static"},
+        "database": {"const": "none"}
+      }
+    },
+    "booking": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mode", "sourceOfTruth", "publicUrl", "embed"],
+      "properties": {
+        "mode": {"const": "cal-public"},
+        "sourceOfTruth": {"const": "cal.com"},
+        "publicUrl": {"type": "string", "format": "uri", "pattern": "^https://"},
+        "embed": {"enum": ["link", "iframe"]}
+      }
+    },
+    "steps": {
+      "type": "array",
+      "minItems": 6,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "status", "idempotencyKey"],
+        "properties": {
+          "id": {"enum": ["entitlement", "repository", "site-deploy", "hostname", "booking", "release-readback"]},
+          "status": {"const": "planned"},
+          "idempotencyKey": {"type": "string", "pattern": "^starter:[a-f0-9]{64}$"}
+        }
+      }
+    },
+    "security": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["secretsInArtifact", "calCredentialsStored", "databaseRequired"],
+      "properties": {
+        "secretsInArtifact": {"const": false},
+        "calCredentialsStored": {"const": false},
+        "databaseRequired": {"const": false}
+      }
+    },
+    "nextActions": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}
+  }
+}

package/bundled-contracts/maggie-marketplace/starter-release-v1.schema.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-marketplace/starter-release-v1.schema.json",
+  "title": "Maggie marketplace Starter release evidence v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "status", "checkedAt", "sourceRevision", "site", "booking", "artifact", "repository", "cloudflare", "errors", "security"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-marketplace-starter-release.v1"},
+    "status": {"enum": ["passed", "blocked"]},
+    "checkedAt": {"type": "string", "format": "date-time"},
+    "sourceRevision": {"type": "string", "pattern": "^[A-Za-z0-9._:/-]{1,200}$"},
+    "site": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["slug", "hostname", "templateId"],
+      "properties": {
+        "slug": {"type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$"},
+        "hostname": {"type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.bea\\.gift$"},
+        "templateId": {"type": "string", "minLength": 1, "maxLength": 120}
+      }
+    },
+    "booking": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mode", "publicUrl", "embed", "readback"],
+      "properties": {
+        "mode": {"const": "cal-public"},
+        "publicUrl": {"type": "string", "format": "uri", "pattern": "^https://"},
+        "embed": {"enum": ["link", "iframe"]},
+        "readback": {"enum": ["passed", "failed"]}
+      }
+    },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["readback", "fileCount"],
+      "properties": {"readback": {"enum": ["passed", "failed"]}, "fileCount": {"type": "integer", "minimum": 1}}
+    },
+    "repository": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["readback", "externalReference", "branch"],
+      "properties": {
+        "readback": {"enum": ["passed", "failed"]},
+        "externalReference": {"type": ["string", "null"], "maxLength": 200},
+        "branch": {"type": ["string", "null"], "pattern": "^[A-Za-z0-9._/-]+$"},
+        "commitSha": {"type": ["string", "null"], "pattern": "^[A-Fa-f0-9]{7,64}$"}
+      }
+    },
+    "cloudflare": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["readback", "projectReference", "deploymentReference", "hostnameReference", "publicUrl"],
+      "properties": {
+        "readback": {"enum": ["passed", "failed"]},
+        "projectReference": {"type": ["string", "null"], "maxLength": 200},
+        "deploymentReference": {"type": ["string", "null"], "maxLength": 200},
+        "hostnameReference": {"type": ["string", "null"], "maxLength": 255},
+        "publicUrl": {"type": ["string", "null"], "format": "uri", "pattern": "^https://"}
+      }
+    },
+    "errors": {"type": "array", "items": {"type": "string", "pattern": "^[a-z0-9_]{1,100}$"}},
+    "security": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["secretsInEvidence", "databaseRequired"],
+      "properties": {"secretsInEvidence": {"const": false}, "databaseRequired": {"const": false}}
+    }
+  }
+}

package/bundled-contracts/maggie-marketplace/starter-site-v1.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-marketplace/starter-site-v1.schema.json",
+  "title": "Maggie marketplace Starter site artifact v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "templateId", "sourceRevision", "site", "booking", "files", "security"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-marketplace-starter-site.v1"},
+    "templateId": {"type": "string", "minLength": 1, "maxLength": 120},
+    "sourceRevision": {"type": "string", "pattern": "^[A-Za-z0-9._:/-]{1,200}$"},
+    "site": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["slug", "hostname"],
+      "properties": {
+        "slug": {"type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$"},
+        "hostname": {"type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.bea\\.gift$"}
+      }
+    },
+    "booking": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mode", "publicUrl", "embed"],
+      "properties": {
+        "mode": {"const": "cal-public"},
+        "publicUrl": {"type": "string", "format": "uri", "pattern": "^https://"},
+        "embed": {"enum": ["link", "iframe"]}
+      }
+    },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "sha256", "bytes"],
+        "properties": {
+          "path": {"type": "string", "pattern": "^(?!/)(?!.*\\.\\.)[A-Za-z0-9_./-]+$"},
+          "sha256": {"type": "string", "pattern": "^[a-f0-9]{64}$"},
+          "bytes": {"type": "integer", "minimum": 0}
+        }
+      }
+    },
+    "security": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runtimeSecrets", "credentialsStored", "databaseRequired"],
+      "properties": {
+        "runtimeSecrets": {"const": false},
+        "credentialsStored": {"const": false},
+        "databaseRequired": {"const": false}
+      }
+    }
+  }
+}

package/bundled-skills/maggie-deployment/SKILL.md

@@ -145,6 +145,24 @@ This command never deploys. Production execution still requires the shared
 decision loop, explicit confirmation, migration/rollback details, and the
 provider-specific deploy command.
 
+For Cloudflare Workers, check the required secret *names* before a canary. The
+command never reads, prints, uploads, or changes secret values:
+
+```bash
+maggie deployment worker-secrets --project . \
+  --environment staging \
+  --required DATABASE_URL \
+  --required BOOKING_TOKEN_SECRET \
+  --required RESEND_API_KEY \
+  --required RESEND_FROM_EMAIL \
+  --output .maggie/deployment/worker-secrets.json
+```
+
+It calls `wrangler secret list --format json` and stores only configured and
+missing binding names. A missing required name fails closed. Use a redacted
+JSON name snapshot with `--snapshot` for CI or a host adapter that cannot
+expose Cloudflare credentials to Maggie; the snapshot must contain names only.
+
 For a VPS adapter, check the project `.env` by variable name before reporting
 credentials as unavailable:
 

package/bundled-tools/clis/maggie_deployment.py

@@ -77,6 +77,110 @@ def credential_preflight_main(argv: list[str]) -> int:
     return 0 if result["passed"] else 1
 
 
+def _secret_names(payload: object) -> list[str]:
+    """Extract only binding names from a Wrangler secret-list response."""
+    entries: object = payload
+    if isinstance(payload, dict):
+        entries = payload.get("secrets", payload.get("result", []))
+    if not isinstance(entries, list):
+        return []
+    names: set[str] = set()
+    for entry in entries:
+        if isinstance(entry, str):
+            name = entry
+        elif isinstance(entry, dict):
+            name = entry.get("name", entry.get("key", ""))
+        else:
+            continue
+        if isinstance(name, str) and re.fullmatch(r"[A-Z][A-Z0-9_]{1,127}", name):
+            names.add(name)
+    return sorted(names)
+
+
+def worker_secret_preflight(
+    project: Path,
+    environment: str,
+    required: list[str],
+    snapshot: Path | None = None,
+    worker_name: str | None = None,
+    wrangler_command: list[str] | None = None,
+) -> dict:
+    """Read Worker secret names without reading or mutating secret values."""
+    required_names = sorted({name.strip() for name in required if name.strip()})
+    errors: list[str] = []
+    if not required_names:
+        errors.append("at least one --required secret name is required")
+    if any(not re.fullmatch(r"[A-Z][A-Z0-9_]{1,127}", name) for name in required_names):
+        errors.append("required secret names must match [A-Z][A-Z0-9_]{1,127}")
+
+    source = "cloudflare-wrangler-secret-list"
+    configured: list[str] = []
+    if not errors and snapshot:
+        source = "redacted-secret-name-snapshot"
+        try:
+            configured = _secret_names(json.loads(snapshot.read_text(encoding="utf-8")))
+        except (OSError, json.JSONDecodeError) as error:
+            errors.append(f"secret-name snapshot is unreadable: {error}")
+    elif not errors:
+        command = list(wrangler_command or ["npx", "wrangler"])
+        command.extend(["secret", "list", "--env", environment, "--format", "json"])
+        if worker_name:
+            command.extend(["--name", worker_name])
+        try:
+            completed = subprocess.run(command, cwd=project, capture_output=True, text=True, check=False, timeout=30)
+        except (OSError, subprocess.SubprocessError):
+            completed = None
+        if completed is None or completed.returncode != 0:
+            errors.append("Wrangler secret-list command failed; inspect authentication and Worker target")
+        else:
+            try:
+                configured = _secret_names(json.loads(completed.stdout))
+            except json.JSONDecodeError:
+                errors.append("Wrangler secret-list response was not valid JSON")
+
+    missing = sorted(set(required_names) - set(configured))
+    errors.extend(f"required Worker secret is missing: {name}" for name in missing)
+    return {
+        "schemaVersion": "maggie-worker-secrets.v1",
+        "project": str(project),
+        "provider": "cloudflare-workers",
+        "environment": environment,
+        "worker": worker_name,
+        "required": required_names,
+        "configured": configured,
+        "missing": missing,
+        "source": source,
+        "valuesReturned": False,
+        "passed": not errors,
+        "errors": errors,
+        "mutation": "not executed",
+    }
+
+
+def worker_secret_preflight_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description="Check Cloudflare Worker secret names without reading or changing secret values.")
+    parser.add_argument("--project", default=".")
+    parser.add_argument("--environment", choices=("staging", "production"), default="staging")
+    parser.add_argument("--required", action="append", default=[], help="required secret name; repeat for each binding")
+    parser.add_argument("--worker-name")
+    parser.add_argument("--snapshot", help="offline JSON containing only secret names")
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    result = worker_secret_preflight(
+        Path(args.project).expanduser().resolve(),
+        args.environment,
+        args.required,
+        Path(args.snapshot).expanduser().resolve() if args.snapshot else None,
+        args.worker_name,
+    )
+    if args.output:
+        output = Path(args.output).resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 0 if result["passed"] else 1
+
+
 def preflight(project: Path, target: str, environment: str) -> dict:
     package_path = project / "package.json"
     package = json.loads(package_path.read_text(encoding="utf-8")) if package_path.exists() else {}
@@ -390,6 +494,8 @@ def write_release_runner(path: Path, plan: dict) -> None:
 def main() -> int:
     if sys.argv[1:2] == ["credential-preflight"]:
         return credential_preflight_main(sys.argv[2:])
+    if sys.argv[1:2] == ["worker-secrets"]:
+        return worker_secret_preflight_main(sys.argv[2:])
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("project", nargs="?", default=".")
     parser.add_argument("--target", choices=("detected", "cloudflare", "vps", "vps-with-cloudflare-dns", "gcp", "aws"), default="detected")

package/bundled-tools/clis/maggie_marketplace.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import re
 import shutil
@@ -10,6 +11,7 @@ import subprocess
 import sys
 import urllib.error
 import urllib.request
+from urllib.parse import urlparse
 from datetime import datetime, timezone
 from html.parser import HTMLParser
 from html import escape, unescape
@@ -57,6 +59,137 @@ def now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+STARTER_PLAN_SCHEMA_VERSION = "maggie-marketplace-starter-provisioning.v1"
+STARTER_STEP_IDS = (
+    "entitlement",
+    "repository",
+    "site-deploy",
+    "hostname",
+    "booking",
+    "release-readback",
+)
+
+
+def _starter_slug(value: str) -> str:
+    slug = str(value or "").strip().lower()
+    if not re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?", slug):
+        raise ValueError("Starter site slug must be 1-63 lowercase letters, numbers, or hyphens")
+    return slug
+
+
+def _starter_public_url(value: str) -> str:
+    url = str(value or "").strip()
+    parsed = urlparse(url)
+    if parsed.scheme != "https" or not parsed.netloc or parsed.username or parsed.password or parsed.fragment:
+        raise ValueError("Starter Cal public URL must be an https URL without credentials or a fragment")
+    return url
+
+
+def build_starter_plan(
+    workspace_id: str,
+    merchant_id: str,
+    slug: str,
+    cal_url: str,
+    embed: str = "link",
+    branch: str = "main",
+) -> dict:
+    workspace = str(workspace_id or "").strip()
+    merchant = str(merchant_id or "").strip()
+    if not re.fullmatch(r"[A-Za-z0-9_-]{1,128}", workspace) or not re.fullmatch(r"[A-Za-z0-9_-]{1,128}", merchant):
+        raise ValueError("workspace and merchant IDs must use letters, numbers, underscores, or hyphens")
+    site_slug = _starter_slug(slug)
+    public_url = _starter_public_url(cal_url)
+    if embed not in {"link", "iframe"}:
+        raise ValueError("Starter booking embed must be link or iframe")
+    if not re.fullmatch(r"[A-Za-z0-9._/-]+", branch or ""):
+        raise ValueError("Starter branch contains unsupported characters")
+    fingerprint = hashlib.sha256(
+        "|".join((workspace, merchant, site_slug, public_url, embed, branch)).encode("utf-8")
+    ).hexdigest()
+    return {
+        "schemaVersion": STARTER_PLAN_SCHEMA_VERSION,
+        "plan": "starter",
+        "mode": "dry-run",
+        "workspace": {"workspaceId": workspace, "merchantId": merchant},
+        "site": {
+            "slug": site_slug,
+            "hostname": f"{site_slug}.bea.gift",
+            "repository": f"bea-merchant-{site_slug}",
+            "branch": branch,
+            "runtime": "cloudflare-pages-static",
+            "database": "none",
+        },
+        "booking": {"mode": "cal-public", "sourceOfTruth": "cal.com", "publicUrl": public_url, "embed": embed},
+        "steps": [
+            {"id": step_id, "status": "planned", "idempotencyKey": f"starter:{fingerprint}"}
+            for step_id in STARTER_STEP_IDS
+        ],
+        "security": {
+            "secretsInArtifact": False,
+            "calCredentialsStored": False,
+            "databaseRequired": False,
+        },
+        "nextActions": [
+            "Confirm the merchant owns the supplied Cal public booking URL",
+            "Create or reconcile the GitHub repository and static site artifact",
+            "Deploy the generated site to Cloudflare Pages and read back the hostname",
+        ],
+    }
+
+
+def validate_starter_plan(plan: dict) -> list[str]:
+    errors = []
+    if not isinstance(plan, dict):
+        return ["plan must be an object"]
+    if plan.get("schemaVersion") != STARTER_PLAN_SCHEMA_VERSION:
+        errors.append("unsupported Starter plan schema")
+    if plan.get("plan") != "starter" or plan.get("mode") != "dry-run":
+        errors.append("Starter plan must be a dry-run")
+    site = plan.get("site") if isinstance(plan.get("site"), dict) else {}
+    if site.get("runtime") != "cloudflare-pages-static" or site.get("database") != "none":
+        errors.append("Starter site must be static Cloudflare Pages with no database")
+    booking = plan.get("booking") if isinstance(plan.get("booking"), dict) else {}
+    if booking.get("mode") != "cal-public" or booking.get("sourceOfTruth") != "cal.com":
+        errors.append("Starter booking must use a public Cal URL")
+    try:
+        _starter_public_url(booking.get("publicUrl", ""))
+    except ValueError as error:
+        errors.append(str(error))
+    security = plan.get("security") if isinstance(plan.get("security"), dict) else {}
+    for field in ("secretsInArtifact", "calCredentialsStored", "databaseRequired"):
+        if security.get(field) is not False:
+            errors.append(f"security.{field} must be false")
+    steps = plan.get("steps")
+    if not isinstance(steps, list) or [item.get("id") for item in steps if isinstance(item, dict)] != list(STARTER_STEP_IDS):
+        errors.append("Starter steps must be ordered and complete")
+    else:
+        for item in steps:
+            if item.get("status") != "planned" or not re.fullmatch(r"starter:[a-f0-9]{64}", str(item.get("idempotencyKey", ""))):
+                errors.append(f"invalid Starter step: {item.get('id')}")
+    return errors
+
+
+def starter_plan(args) -> int:
+    plan = build_starter_plan(
+        args.workspace_id,
+        args.merchant_id,
+        args.site_slug,
+        args.cal_url,
+        args.embed,
+        args.branch,
+    )
+    errors = validate_starter_plan(plan)
+    if errors:
+        raise ValueError("invalid generated Starter plan: " + "; ".join(errors))
+    rendered = json.dumps(plan, indent=2, ensure_ascii=False) + "\n"
+    if args.output:
+        output = args.output.resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(rendered, encoding="utf-8")
+    print(rendered, end="")
+    return 0
+
+
 def repo_root() -> Path:
     return Path(__file__).resolve().parents[2]
 
@@ -2140,6 +2273,16 @@ def main() -> int:
     add.add_argument("--sample", type=Path)
     add.add_argument("--force", action="store_true")
     add.set_defaults(func=lambda args: run_marketplace_job(argparse.Namespace(**{**vars(args), "template_url": args.template_url, "preview_url": args.preview_url})))
+    plan = sub.add_parser("plan", help="build a secret-free Starter provisioning plan")
+    plan.add_argument("--project", type=Path, default=Path.cwd(), help="host project path; planning is read-only")
+    plan.add_argument("--workspace-id", required=True)
+    plan.add_argument("--merchant-id", required=True)
+    plan.add_argument("--site-slug", required=True)
+    plan.add_argument("--cal-url", required=True)
+    plan.add_argument("--embed", choices=("link", "iframe"), default="link")
+    plan.add_argument("--branch", default="main")
+    plan.add_argument("--output", type=Path)
+    plan.set_defaults(func=starter_plan)
     val = sub.add_parser("validate")
     val.add_argument("template", type=Path)
     val.add_argument(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.42",
+  "version": "0.7.43",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",