@topy-ai/maggie 0.7.46 → 0.7.48

package/README-zh-TW.md

@@ -29,9 +29,17 @@ npx @topy-ai/maggie init --scope project --agent all
 npx @topy-ai/maggie doctor --scope project --project .
 ```
 
-目前 release 是 `0.7.46`。新增 browser adapter capability preflight、privacy-safe
-feedback evidence references/relationships、bounded batch-review evidence graph、
-remediation suggestions，以及 root-level unittest import 支援。`browser-audit
+目前 npm 版本為 `0.7.48`，處理 2026-10-10 的 27 條 hosted feedback（batch 26）：Social Share 新增 `adapters`（每個 provider 一組 canonical OAuth scope，LinkedIn 不同 scope 會撤銷舊 token；共用 OAuth client 警告）、`connections`（撤銷或無法解密的 token 標為 `needs_reconnect`，偵測會過期的簽名頭像 URL）、`queue`（slot-based 排程：not-before、最新優先、campaign 輪流與每日上限、DST-safe）與 `campaigns`（idea stage Start gate）；Deployment 新增 hash-only `secret-fingerprint`/`secret-parity`、`env-isolation`（本機 `.env` 指向 production database 時警告）、release retention 與 worker-before-enqueue 發布順序；QA 在未明確同意時阻擋對 production API 的寫入情境，並以 `maggie qa cors-preflight` 只用 OPTIONS 檢查每個 HTTP method；Design 新增 `pressable-check`、`layer-check`（Tailwind v4 unlayered CSS）、onboarding wizard/picker 模式與 `maggie-palette-roles-v1` palette generate/validate；Marketplace 加入 screenshot 完整性與像素預算、從 CSS 量測 palette、asset provenance、中性 `displayName`（全部模板已補齊）、template studio、`maggie-template-content-v1` 合約與圖片生成成本/無文字審查 gate；Booking 新增唯讀 Stripe live setup runbook 與 gift voucher lifecycle 合約（`maggie booking voucher-contract --ledger`）；Feedback 新增 `improvement` 類型與 `maggie feedback session-summary`。MaggieDash 0.2.11 會保留尚未部署 template 的 outbox email 而不是 dead-letter，並從 ORA host 上游通用修正。本版也包含 Booking 十個 email events 合約與 CLI validator 同步及安全輸出的 `arrivalNote`。前一版 `0.7.47` 處理 2026-09-26 五條新 feedback：project-scope
+`maggie init` 會建立本地 memory store；context 預設只讀取本 project scope；memory hook
+在 local Python adapter 不存在時 fallback 到已安裝 CLI；重複 init 保留既有檔案與時間戳；
+`maggie feedback list` 的 `--project` 可放在子命令前或後。Generated VPS runner 現在記錄
+Maggie 版本與 template fingerprint；preflight 會警示過期/無標記 runner，其他路徑可用
+`maggie deployment --check-runner PATH` 檢查。
+
+0.7.46 feedback batch 仍包含 release profile capability gate、deployment readiness bounded
+retry、Google account/property target verification、GA/GTM external-write idempotency/readback、
+browser adapter capability preflight、privacy-safe feedback evidence references/relationships，
+以及 root-level unittest import 支援。`browser-audit
 --check-browser` 會在導覽前拒絕 missing/incompatible adapter，包括解析成
 `xdg-open` 的系統 `browse`；feedback graph 不保存 raw payload、logs、credentials
 或本機路徑。另包含 0.7.45 的 Codex/Claude Code 一次性 user-scope 安裝、bundled
@@ -105,7 +113,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 source tree 的正式 release 是 `0.7.46`。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.48`，包含 batch 26 feedback 修正與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,10 +89,54 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 20 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.46`. It adds browser-adapter capability preflight,
-privacy-safe feedback evidence references/relationships, bounded batch-review
-evidence graphs, remediation suggestions, and root-level unittest import
-support. `browser-audit --check-browser` rejects missing or incompatible
+This package is `0.7.48`. It processes the 27 hosted feedback
+records of 2026-10-10 (batch 26) and includes the Booking email-template
+contract/CLI sync with escaped `arrivalNote` rendering:
+
+- Social Share: `adapters` enforces one canonical OAuth scope set per provider
+  (LinkedIn revokes earlier tokens on a different scope set) and warns about
+  shared OAuth clients; `connections` marks revoked/undecryptable tokens
+  `needs_reconnect` and flags expiring signed avatar URLs; `queue` is a
+  deterministic slot-based planner (not-before times, newest-first queue,
+  campaign round-robin with daily limits, DST-safe); `campaigns` gates the
+  idea stage before Start.
+- Deployment: hash-only `secret-fingerprint`/`secret-parity` across hosts,
+  `env-isolation` plus a preflight warning when local `.env` points at the
+  production database, documented release retention, and worker-before-enqueue
+  release ordering.
+- QA: mutating scenarios are blocked against a production API without
+  explicit consent, and `maggie qa cors-preflight` checks every HTTP method with
+  OPTIONS only.
+- Design: `pressable-check` (nested pressables on React Native Web),
+  `layer-check` (unlayered CSS overriding Tailwind v4 utilities), onboarding
+  wizard/picker patterns, and the `maggie-palette-roles-v1` contract with
+  `maggie design palette generate|validate`.
+- Marketplace/template: package audits for screenshot integrity and pixel
+  budget, palettes measured from template CSS, asset provenance, and neutral
+  `displayName`s (all catalogue templates backfilled); a template studio
+  (viewport × palette with overflow check); the `maggie-template-content-v1`
+  contract; and image-generation cost reports with a no-text review gate.
+- Booking: a read-only Stripe live-setup runbook and the provider-neutral gift
+  voucher lifecycle contract with `maggie booking voucher-contract --ledger`.
+- Feedback: an `improvement` type (hosted as `feature` + `subtype`) and
+  `maggie feedback session-summary`.
+- MaggieDash 0.2.11 holds outbox emails whose template is not yet deployed
+  instead of dead-lettering them, and upstreams generic fixes from the ORA host.
+
+The 0.7.47 release remains included: project
+initialization creates the repository's Maggie Memory store, memory context
+uses project-scope entries by default, the shared memory hook falls back to
+the installed CLI, repeated memory initialization preserves unchanged
+files, and `maggie feedback list` accepts `--project` before or after the
+subcommand. Generated VPS release runners also record their Maggie version and
+template fingerprint; deployment preflight warns about stale or unmarked
+runners, with `maggie deployment --check-runner PATH` for other locations.
+
+The 0.7.46 feedback batch remains included: capability-aware release profiles,
+bounded deployment-readiness retries, verified Google account/target evidence,
+idempotent external-write readback, browser-adapter capability preflight,
+privacy-safe feedback evidence and relationships, and root-level unittest
+import support. `browser-audit --check-browser` rejects missing or incompatible
 adapters before navigation, including a system `browse`/`xdg-open` opener.
 It also includes the 0.7.45 one-time user-scope installation for
 Codex and Claude Code, a bundled workflow runner, and scoped maintenance
@@ -657,8 +701,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.46 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.46 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.48 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.48 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -863,11 +907,11 @@ delivery outbox. It shows redacted delivery state and sanitized errors through
 manages Maggie's server-side transactional delivery queue and audit trail; it
 does not replace Resend's own domain, audience, campaign, or analytics console.
 
-The Booking browser-evidence gate covers all 15 manager routes at mobile,
-tablet, and desktop viewports (45 required screens), including waitlist,
-locations, notifications, reports, and audit. A production release still
-requires an authenticated HTTPS capture with zero console, request, and
-layout errors.
+The Booking browser-evidence gate covers all 17 manager routes at mobile,
+tablet, and desktop viewports (51 required screens), including waitlist,
+locations, notifications, email templates, reports, settings, and audit. A
+production release still requires an authenticated HTTPS capture with zero
+console, request, and layout errors.
 
 Compare an existing dashboard before replacing it:
 

package/bin/maggie.js

@@ -19,6 +19,23 @@ const TEMPLATES_ROOT = join(PACKAGE_ROOT, "bundled-templates");
 const STATE_DIR = ".maggie";
 const USER_SCOPE = "user";
 const PROJECT_SCOPE = "project";
+const PROJECT_MEMORY_FILES = {
+  preferences: "preferences.json",
+  conventions: "project-conventions.json",
+  lessons: "lessons.json",
+  errors: "error-patterns.json",
+};
+
+function initializeProjectMemory(root) {
+  const memoryRoot = join(root, STATE_DIR, "memory");
+  mkdirSync(memoryRoot, { recursive: true });
+  for (const [kind, filename] of Object.entries(PROJECT_MEMORY_FILES)) {
+    const path = join(memoryRoot, filename);
+    if (!existsSync(path)) {
+      writeFileSync(path, `${JSON.stringify({ schemaVersion: 1, kind, updatedAt: new Date().toISOString(), items: [] }, null, 2)}\n`, { flag: "wx" });
+    }
+  }
+}
 function loadSkillNames() {
   try {
     return JSON.parse(readFileSync(join(SKILLS_ROOT, "catalog.json"), "utf8")).skills.map((skill) => skill.name);
@@ -82,6 +99,8 @@ Usage:
   maggie dash structure-validate --model FILE --evidence FILE
   maggie design progressive-check|css-check|css-cascade-check|style-check --evidence FILE
   maggie design dash-init|dash-validate|sample-init|sample-validate [options]
+  maggie design pressable-check|layer-check --project PATH
+  maggie design palette generate --canvas HEX --text HEX --accent HEX | palette validate --palette FILE
   maggie seo privacy-check --evidence FILE
   maggie content FILE --source PROVIDER --project PATH --confirm
   maggie agent-content write --url URL --allowed-origin ORIGIN --token-env ENV --payload FILE
@@ -136,6 +155,8 @@ Usage:
   maggie service match-pages --project PATH --pages-dir src/pages
   maggie deployment --project PATH --target vps-with-cloudflare-dns
   maggie deployment worker-secrets --project PATH --environment staging --required RESEND_API_KEY
+  maggie deployment secret-parity --manifest api-1.json --manifest api-2.json --required KEY
+  maggie deployment env-isolation --project PATH --production-env .env.production
   maggie deployment readiness --project PATH
   maggie deployment parity --project PATH --evidence FILE --output FILE
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
@@ -158,8 +179,8 @@ Usage:
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
   maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
-  maggie feedback <collect|preview|batch|batch-review|submit|list> [options]
-  maggie qa <start|record|summary|export|assertion-audit> [options]
+  maggie feedback <collect|preview|batch|batch-review|session-summary|submit|list> [options]
+  maggie qa <start|record|summary|export|assertion-audit|cors-preflight> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]
@@ -488,6 +509,7 @@ function install(args) {
     if (existsSync(MARKETPLACE_ROOT)) copyIfMissing(MARKETPLACE_ROOT, join(root, "marketplace"));
     if (existsSync(CONTRACTS_ROOT)) copyIfMissing(CONTRACTS_ROOT, join(root, "contracts"));
     if (existsSync(join(TEMPLATES_ROOT, "maggiedash"))) copyIfMissing(join(TEMPLATES_ROOT, "maggiedash"), join(root, "templates", "maggiedash"));
+    initializeProjectMemory(root);
   }
   const manifestRoots = scope === USER_SCOPE ? allUserAgentRoots() : roots;
   const installedUserSkills = scope === USER_SCOPE ? mergedUserSkillNames(manifestRoots) : [];
@@ -496,7 +518,7 @@ function install(args) {
     : { scope, version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills: mergedSkillNames(root, skills), managedFiles: managedFileDigests(root, roots, skills), installed_at: new Date().toISOString() };
   writeInstallManifest(root, manifest, scope);
   console.log(scope === USER_SCOPE ? `Maggie installed for this user in ${userStateRoot()}` : `Maggie installed in ${root}`);
-  console.log(scope === USER_SCOPE ? "Project state remains local; run `maggie doctor --scope user` to verify the user install." : "Run `maggie doctor --project .` before using mutating workflows.");
+  console.log(scope === USER_SCOPE ? "Project state remains local; run `maggie doctor --scope user` to verify the user install." : "Project-scoped Maggie Memory is initialized locally; run `maggie doctor --project .` before using mutating workflows.");
 }
 
 function update(args) {
@@ -591,7 +613,7 @@ function workflowCli(name, args) {
   const root = projectRoot(args);
   const script = toolScript(name, root);
   if (!existsSync(script)) throw new Error(`${name} is missing: ${script}`);
-  const env = name === "maggie_feedback.py" ? { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } : process.env;
+  const env = { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION };
   const result = spawnSync("python3", [script, ...args], { stdio: "inherit", cwd: root, env });
   if (result.error) throw result.error;
   process.exitCode = result.status ?? 1;

package/bundled-contracts/maggie-design/palette-roles-v1.schema.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggie-design/palette-roles-v1.schema.json",
+  "title": "Maggie template palette role contract",
+  "description": "Semantic colour roles for one template: its signature palette plus derived, contrast-safe variants. Generated and validated by `maggie design palette`. Contrast rules (text, accentText and onAccent at 4.5:1) and the variant accent saturation cap are enforced by `maggie design palette validate`, not by this schema.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "template", "signature", "variants"],
+  "properties": {
+    "schemaVersion": { "const": "maggie-palette-roles-v1" },
+    "template": { "type": ["string", "null"] },
+    "signature": {
+      "allOf": [
+        { "$ref": "#/$defs/palette" },
+        { "properties": { "id": { "const": "signature" } } }
+      ]
+    },
+    "variants": { "type": "array", "items": { "$ref": "#/$defs/palette" } }
+  },
+  "$defs": {
+    "hex": { "type": "string", "pattern": "^#[0-9A-Fa-f]{6}$" },
+    "palette": {
+      "type": "object",
+      "required": ["id", "name", "roles"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "name": { "type": "string", "minLength": 1 },
+        "roles": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["canvas", "panel", "soft", "text", "accent", "accentText", "onAccent", "dark", "deep"],
+          "properties": {
+            "canvas": { "$ref": "#/$defs/hex", "description": "Page background." },
+            "panel": { "$ref": "#/$defs/hex", "description": "Cards and raised surfaces; body text must pass on it." },
+            "soft": { "$ref": "#/$defs/hex", "description": "Tinted band or chip background; not for long body copy." },
+            "text": { "$ref": "#/$defs/hex", "description": "Body text on canvas and panel." },
+            "accent": { "$ref": "#/$defs/hex", "description": "Buttons and highlights (fills)." },
+            "accentText": { "$ref": "#/$defs/hex", "description": "Accent-coloured text and links on canvas." },
+            "onAccent": { "$ref": "#/$defs/hex", "description": "Text placed on an accent fill." },
+            "dark": { "$ref": "#/$defs/hex", "description": "Dark band background." },
+            "deep": { "$ref": "#/$defs/hex", "description": "Deepest band, footer or overlay." }
+          }
+        }
+      }
+    }
+  }
+}

package/bundled-contracts/maggie-marketplace/template-content-v1.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggie-marketplace/template-content-v1.schema.json",
+  "title": "Maggie template content contract",
+  "description": "Neutral business content a marketplace template renders when exported as a data-driven component, so one design serves many businesses from their own data. Palette roles come from maggie-palette-roles-v1 and are emitted as --maggie-<role> CSS variables. Business rules (sample paths resolve, reviews carry a source or sample=true, hours are HH:MM) are enforced by `maggie_marketplace.py content-validate`.",
+  "type": "object",
+  "required": ["schemaVersion", "brand", "contact", "hero", "categories", "about", "gallery", "reviews", "hours", "faqs"],
+  "properties": {
+    "schemaVersion": { "const": "maggie-template-content-v1" },
+    "brand": {
+      "type": "object",
+      "required": ["name"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "tagline": { "type": ["string", "null"] },
+        "logo": { "$ref": "#/$defs/image" }
+      }
+    },
+    "contact": {
+      "type": "object",
+      "properties": {
+        "phone": { "type": ["string", "null"] },
+        "email": { "type": ["string", "null"] },
+        "address": { "type": ["string", "null"] },
+        "bookingUrl": { "type": ["string", "null"] }
+      }
+    },
+    "hero": {
+      "type": "object",
+      "required": ["headline"],
+      "properties": {
+        "headline": { "type": "string", "minLength": 1 },
+        "subheadline": { "type": ["string", "null"] },
+        "image": { "$ref": "#/$defs/image" },
+        "cta": { "type": "object", "properties": { "label": { "type": "string" }, "href": { "type": "string" } } }
+      }
+    },
+    "categories": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "services"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "description": { "type": ["string", "null"] },
+          "services": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["name"],
+              "properties": {
+                "name": { "type": "string", "minLength": 1 },
+                "description": { "type": ["string", "null"] },
+                "price": { "type": ["number", "null"], "minimum": 0 },
+                "currency": { "type": "string", "default": "GBP" },
+                "durationMinutes": { "type": ["integer", "null"], "minimum": 1 },
+                "bookingRef": { "type": ["string", "null"], "description": "Host booking/catalogue identifier, e.g. a MaggieDash Booking service id." }
+              }
+            }
+          }
+        }
+      }
+    },
+    "about": { "type": "object", "properties": { "heading": { "type": ["string", "null"] }, "body": { "type": ["string", "null"] }, "image": { "$ref": "#/$defs/image" } } },
+    "gallery": { "type": "array", "items": { "$ref": "#/$defs/image" } },
+    "reviews": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["quote"],
+        "properties": {
+          "quote": { "type": "string" },
+          "author": { "type": ["string", "null"] },
+          "rating": { "type": ["number", "null"], "minimum": 0, "maximum": 5 },
+          "source": { "type": ["string", "null"], "description": "Where the real review came from; required unless sample is true." },
+          "sample": { "type": "boolean" }
+        }
+      }
+    },
+    "hours": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["day"],
+        "properties": {
+          "day": { "enum": ["mon", "tue", "wed", "thu", "fri", "sat", "sun"] },
+          "opens": { "type": "string", "pattern": "^\\d{2}:\\d{2}$" },
+          "closes": { "type": "string", "pattern": "^\\d{2}:\\d{2}$" },
+          "closed": { "type": "boolean" }
+        }
+      }
+    },
+    "faqs": { "type": "array", "items": { "type": "object", "required": ["question", "answer"], "properties": { "question": { "type": "string" }, "answer": { "type": "string" } } } },
+    "samples": { "type": "array", "items": { "type": "string" }, "description": "Dotted content paths that still hold template sample copy the owner must replace (e.g. hero.headline, reviews.0)." },
+    "palette": { "type": "object", "description": "One maggie-palette-roles-v1 palette (id, name, roles)." }
+  },
+  "$defs": {
+    "image": {
+      "type": ["object", "null"],
+      "properties": { "src": { "type": "string" }, "alt": { "type": "string" } }
+    }
+  }
+}

package/bundled-contracts/maggiedash/booking-browser-evidence-v1.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-browser-evidence-v1.json",
+  "title": "MaggieDash Booking production browser evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "baseUrl", "generatedAt", "viewports", "screens", "consoleErrors", "failedRequests", "layoutErrors"],
+  "properties": {
+    "schemaVersion": { "const": "maggiedash-booking-browser-evidence.v1" },
+    "baseUrl": { "type": "string", "pattern": "^https://" },
+    "generatedAt": { "type": "string", "format": "date-time" },
+    "version": { "type": "string" },
+    "viewports": { "type": "array", "minItems": 3, "items": { "type": "object", "required": ["name", "width", "height"] } },
+    "screens": { "type": "array", "minItems": 51, "items": { "type": "object", "required": ["route", "viewport", "httpStatus", "screenshot", "ready"] } },
+    "consoleErrors": { "type": "array", "items": { "type": "string" } },
+    "failedRequests": { "type": "array", "items": { "type": "string" } },
+    "layoutErrors": { "type": "array", "items": { "type": "string" } },
+    "notes": { "type": "array", "items": { "type": "string" } }
+  },
+  "x-required-routes": ["/_maggie/booking/", "/_maggie/booking/calendar", "/_maggie/booking/bookings", "/_maggie/booking/customers", "/_maggie/booking/waitlist", "/_maggie/booking/locations", "/_maggie/booking/catalog", "/_maggie/booking/packages", "/_maggie/booking/staff", "/_maggie/booking/resources", "/_maggie/booking/schedule", "/_maggie/booking/payments", "/_maggie/booking/notifications", "/_maggie/booking/email-templates", "/_maggie/booking/reports", "/_maggie/booking/settings", "/_maggie/booking/audit"],
+  "x-required-viewports": [{"name":"mobile","width":390,"height":844},{"name":"tablet","width":768,"height":1024},{"name":"desktop","width":1440,"height":1000}]
+}

package/bundled-contracts/maggiedash/booking-browser-evidence-v2.json

@@ -0,0 +1,191 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-browser-evidence-v2.json",
+  "title": "MaggieDash Booking production browser evidence v2",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "baseUrl",
+    "generatedAt",
+    "viewports",
+    "screens",
+    "consoleErrors",
+    "failedRequests",
+    "layoutErrors"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "maggiedash-booking-browser-evidence.v2"
+    },
+    "baseUrl": {
+      "type": "string",
+      "pattern": "^https://"
+    },
+    "generatedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "version": {
+      "type": "string"
+    },
+    "viewports": {
+      "type": "array",
+      "minItems": 3,
+      "items": {
+        "type": "object",
+        "required": [
+          "name",
+          "width",
+          "height"
+        ]
+      }
+    },
+    "screens": {
+      "type": "array",
+      "minItems": 51,
+      "items": {
+        "type": "object",
+        "required": [
+          "route",
+          "viewport",
+          "httpStatus",
+          "finalPath",
+          "heading",
+          "screenshot",
+          "ready"
+        ],
+        "properties": {
+          "route": {
+            "type": "string",
+            "enum": [
+              "/_maggie/booking/",
+              "/_maggie/booking/calendar",
+              "/_maggie/booking/bookings",
+              "/_maggie/booking/customers",
+              "/_maggie/booking/waitlist",
+              "/_maggie/booking/locations",
+              "/_maggie/booking/catalog",
+              "/_maggie/booking/packages",
+              "/_maggie/booking/staff",
+              "/_maggie/booking/resources",
+              "/_maggie/booking/schedule",
+              "/_maggie/booking/payments",
+              "/_maggie/booking/notifications",
+              "/_maggie/booking/email-templates",
+              "/_maggie/booking/reports",
+              "/_maggie/booking/settings",
+              "/_maggie/booking/audit"
+            ]
+          },
+          "viewport": {
+            "type": "string",
+            "enum": [
+              "mobile",
+              "tablet",
+              "desktop"
+            ]
+          },
+          "httpStatus": {
+            "type": "integer",
+            "minimum": 200,
+            "maximum": 399
+          },
+          "finalPath": {
+            "type": "string",
+            "pattern": "^/_maggie/booking(?:/|$)"
+          },
+          "heading": {
+            "type": "string",
+            "minLength": 1
+          },
+          "screenshot": {
+            "type": "string",
+            "minLength": 1
+          },
+          "ready": {
+            "const": true
+          }
+        }
+      }
+    },
+    "consoleErrors": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "failedRequests": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "layoutErrors": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "notes": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "x-required-routes": [
+    "/_maggie/booking/",
+    "/_maggie/booking/calendar",
+    "/_maggie/booking/bookings",
+    "/_maggie/booking/customers",
+    "/_maggie/booking/waitlist",
+    "/_maggie/booking/locations",
+    "/_maggie/booking/catalog",
+    "/_maggie/booking/packages",
+    "/_maggie/booking/staff",
+    "/_maggie/booking/resources",
+    "/_maggie/booking/schedule",
+    "/_maggie/booking/payments",
+    "/_maggie/booking/notifications",
+    "/_maggie/booking/email-templates",
+    "/_maggie/booking/reports",
+    "/_maggie/booking/settings",
+    "/_maggie/booking/audit"
+  ],
+  "x-required-viewports": [
+    {
+      "name": "mobile",
+      "width": 390,
+      "height": 844
+    },
+    {
+      "name": "tablet",
+      "width": 768,
+      "height": 1024
+    },
+    {
+      "name": "desktop",
+      "width": 1440,
+      "height": 1000
+    }
+  ],
+  "x-required-headings": {
+    "/_maggie/booking/": "Overview",
+    "/_maggie/booking/calendar": "Calendar",
+    "/_maggie/booking/bookings": "Bookings",
+    "/_maggie/booking/customers": "Customers",
+    "/_maggie/booking/waitlist": "Waitlist",
+    "/_maggie/booking/locations": "Locations",
+    "/_maggie/booking/catalog": "Catalogue",
+    "/_maggie/booking/packages": "Packages",
+    "/_maggie/booking/staff": "Staff",
+    "/_maggie/booking/resources": "Resources",
+    "/_maggie/booking/schedule": "Schedule",
+    "/_maggie/booking/payments": "Payments",
+    "/_maggie/booking/notifications": "Notifications",
+    "/_maggie/booking/email-templates": "Email templates",
+    "/_maggie/booking/reports": "Reports",
+    "/_maggie/booking/settings": "Settings",
+    "/_maggie/booking/audit": "Audit"
+  }
+}

package/bundled-contracts/maggiedash/booking-email-templates-v1.json

@@ -11,16 +11,18 @@
   },
   "roles": ["owner", "admin", "manager"],
   "events": [
-    { "id": "booking.confirmed", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
+    { "id": "booking.confirmed", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName", "arrivalNote"] },
     { "id": "booking.rescheduled", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
     { "id": "booking.cancelled", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "reason", "siteName"] },
     { "id": "booking.reminder", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
     { "id": "payment.action_required", "variables": ["customerName", "serviceName", "bookingId", "actionUrl", "siteName"] },
     { "id": "payment.refunded", "variables": ["customerName", "serviceName", "bookingId", "siteName"] },
+    { "id": "payment.no_show_fee", "variables": ["customerName", "serviceName", "bookingId", "amount", "siteName"] },
     { "id": "package.purchase.confirmed", "variables": ["customerName", "packageName", "amount", "expiresAt", "siteName"] },
     { "id": "package.purchase.refunded", "variables": ["customerName", "packageName", "amount", "siteName"] },
     { "id": "booking.waitlist.available", "variables": ["customerName", "serviceName", "when", "locationName", "bookingUrl", "siteName"] }
   ],
+  "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "bookingUrl", "reason", "actionUrl", "packageName", "amount", "expiresAt", "siteName", "arrivalNote"],
   "endpointIds": ["booking.email-templates.read", "booking.email-templates.draft", "booking.email-templates.publish", "booking.email-templates.rollback"],
   "canonicalRoutes": {
     "booking.email-templates.read": "GET /email-templates.json",