@topy-ai/maggie 0.7.47 → 0.7.48

package/README-zh-TW.md

@@ -29,7 +29,7 @@ npx @topy-ai/maggie init --scope project --agent all
 npx @topy-ai/maggie doctor --scope project --project .
 ```
 
-目前 release 是 `0.7.47`。本版處理 2026-09-26 五條新 feedback：project-scope
+目前 npm 版本為 `0.7.48`，處理 2026-10-10 的 27 條 hosted feedback（batch 26）：Social Share 新增 `adapters`（每個 provider 一組 canonical OAuth scope，LinkedIn 不同 scope 會撤銷舊 token；共用 OAuth client 警告）、`connections`（撤銷或無法解密的 token 標為 `needs_reconnect`，偵測會過期的簽名頭像 URL）、`queue`（slot-based 排程：not-before、最新優先、campaign 輪流與每日上限、DST-safe）與 `campaigns`（idea stage Start gate）；Deployment 新增 hash-only `secret-fingerprint`/`secret-parity`、`env-isolation`（本機 `.env` 指向 production database 時警告）、release retention 與 worker-before-enqueue 發布順序；QA 在未明確同意時阻擋對 production API 的寫入情境，並以 `maggie qa cors-preflight` 只用 OPTIONS 檢查每個 HTTP method；Design 新增 `pressable-check`、`layer-check`（Tailwind v4 unlayered CSS）、onboarding wizard/picker 模式與 `maggie-palette-roles-v1` palette generate/validate；Marketplace 加入 screenshot 完整性與像素預算、從 CSS 量測 palette、asset provenance、中性 `displayName`（全部模板已補齊）、template studio、`maggie-template-content-v1` 合約與圖片生成成本/無文字審查 gate；Booking 新增唯讀 Stripe live setup runbook 與 gift voucher lifecycle 合約（`maggie booking voucher-contract --ledger`）；Feedback 新增 `improvement` 類型與 `maggie feedback session-summary`。MaggieDash 0.2.11 會保留尚未部署 template 的 outbox email 而不是 dead-letter，並從 ORA host 上游通用修正。本版也包含 Booking 十個 email events 合約與 CLI validator 同步及安全輸出的 `arrivalNote`。前一版 `0.7.47` 處理 2026-09-26 五條新 feedback：project-scope
 `maggie init` 會建立本地 memory store；context 預設只讀取本 project scope；memory hook
 在 local Python adapter 不存在時 fallback 到已安裝 CLI；重複 init 保留既有檔案與時間戳；
 `maggie feedback list` 的 `--project` 可放在子命令前或後。Generated VPS runner 現在記錄
@@ -113,7 +113,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 source tree 的正式 release 是 `0.7.47`。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.48`，包含 batch 26 feedback 修正與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,14 +89,48 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 20 installable skills and a local-first MaggieDash foundation.
 
-The current release is `0.7.47`. Project initialization creates a local Maggie
-Memory store, memory contexts default to project scope, and the shared hook
-falls back to the installed CLI if project Python tools are absent. Repeated
-memory initialization preserves existing files and timestamps. Feedback list
-accepts `--project` before or after its subcommand. Generated VPS runners record
-their Maggie version and template fingerprint; deployment preflight warns on
-stale or unmarked runners, with `maggie deployment --check-runner PATH` for
-other locations.
+This package is `0.7.48`. It processes the 27 hosted feedback
+records of 2026-10-10 (batch 26) and includes the Booking email-template
+contract/CLI sync with escaped `arrivalNote` rendering:
+
+- Social Share: `adapters` enforces one canonical OAuth scope set per provider
+  (LinkedIn revokes earlier tokens on a different scope set) and warns about
+  shared OAuth clients; `connections` marks revoked/undecryptable tokens
+  `needs_reconnect` and flags expiring signed avatar URLs; `queue` is a
+  deterministic slot-based planner (not-before times, newest-first queue,
+  campaign round-robin with daily limits, DST-safe); `campaigns` gates the
+  idea stage before Start.
+- Deployment: hash-only `secret-fingerprint`/`secret-parity` across hosts,
+  `env-isolation` plus a preflight warning when local `.env` points at the
+  production database, documented release retention, and worker-before-enqueue
+  release ordering.
+- QA: mutating scenarios are blocked against a production API without
+  explicit consent, and `maggie qa cors-preflight` checks every HTTP method with
+  OPTIONS only.
+- Design: `pressable-check` (nested pressables on React Native Web),
+  `layer-check` (unlayered CSS overriding Tailwind v4 utilities), onboarding
+  wizard/picker patterns, and the `maggie-palette-roles-v1` contract with
+  `maggie design palette generate|validate`.
+- Marketplace/template: package audits for screenshot integrity and pixel
+  budget, palettes measured from template CSS, asset provenance, and neutral
+  `displayName`s (all catalogue templates backfilled); a template studio
+  (viewport × palette with overflow check); the `maggie-template-content-v1`
+  contract; and image-generation cost reports with a no-text review gate.
+- Booking: a read-only Stripe live-setup runbook and the provider-neutral gift
+  voucher lifecycle contract with `maggie booking voucher-contract --ledger`.
+- Feedback: an `improvement` type (hosted as `feature` + `subtype`) and
+  `maggie feedback session-summary`.
+- MaggieDash 0.2.11 holds outbox emails whose template is not yet deployed
+  instead of dead-lettering them, and upstreams generic fixes from the ORA host.
+
+The 0.7.47 release remains included: project
+initialization creates the repository's Maggie Memory store, memory context
+uses project-scope entries by default, the shared memory hook falls back to
+the installed CLI, repeated memory initialization preserves unchanged
+files, and `maggie feedback list` accepts `--project` before or after the
+subcommand. Generated VPS release runners also record their Maggie version and
+template fingerprint; deployment preflight warns about stale or unmarked
+runners, with `maggie deployment --check-runner PATH` for other locations.
 
 The 0.7.46 feedback batch remains included: capability-aware release profiles,
 bounded deployment-readiness retries, verified Google account/target evidence,
@@ -667,8 +701,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.47 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.47 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.48 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.48 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -873,11 +907,11 @@ delivery outbox. It shows redacted delivery state and sanitized errors through
 manages Maggie's server-side transactional delivery queue and audit trail; it
 does not replace Resend's own domain, audience, campaign, or analytics console.
 
-The Booking browser-evidence gate covers all 15 manager routes at mobile,
-tablet, and desktop viewports (45 required screens), including waitlist,
-locations, notifications, reports, and audit. A production release still
-requires an authenticated HTTPS capture with zero console, request, and
-layout errors.
+The Booking browser-evidence gate covers all 17 manager routes at mobile,
+tablet, and desktop viewports (51 required screens), including waitlist,
+locations, notifications, email templates, reports, settings, and audit. A
+production release still requires an authenticated HTTPS capture with zero
+console, request, and layout errors.
 
 Compare an existing dashboard before replacing it:
 

package/bin/maggie.js

@@ -99,6 +99,8 @@ Usage:
   maggie dash structure-validate --model FILE --evidence FILE
   maggie design progressive-check|css-check|css-cascade-check|style-check --evidence FILE
   maggie design dash-init|dash-validate|sample-init|sample-validate [options]
+  maggie design pressable-check|layer-check --project PATH
+  maggie design palette generate --canvas HEX --text HEX --accent HEX | palette validate --palette FILE
   maggie seo privacy-check --evidence FILE
   maggie content FILE --source PROVIDER --project PATH --confirm
   maggie agent-content write --url URL --allowed-origin ORIGIN --token-env ENV --payload FILE
@@ -153,6 +155,8 @@ Usage:
   maggie service match-pages --project PATH --pages-dir src/pages
   maggie deployment --project PATH --target vps-with-cloudflare-dns
   maggie deployment worker-secrets --project PATH --environment staging --required RESEND_API_KEY
+  maggie deployment secret-parity --manifest api-1.json --manifest api-2.json --required KEY
+  maggie deployment env-isolation --project PATH --production-env .env.production
   maggie deployment readiness --project PATH
   maggie deployment parity --project PATH --evidence FILE --output FILE
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
@@ -175,8 +179,8 @@ Usage:
   maggie memory <init|list|search|context|add|record-error|transition|export> --project PATH
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
   maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
-  maggie feedback <collect|preview|batch|batch-review|submit|list> [options]
-  maggie qa <start|record|summary|export|assertion-audit> [options]
+  maggie feedback <collect|preview|batch|batch-review|session-summary|submit|list> [options]
+  maggie qa <start|record|summary|export|assertion-audit|cors-preflight> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]

package/bundled-contracts/maggie-design/palette-roles-v1.schema.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggie-design/palette-roles-v1.schema.json",
+  "title": "Maggie template palette role contract",
+  "description": "Semantic colour roles for one template: its signature palette plus derived, contrast-safe variants. Generated and validated by `maggie design palette`. Contrast rules (text, accentText and onAccent at 4.5:1) and the variant accent saturation cap are enforced by `maggie design palette validate`, not by this schema.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "template", "signature", "variants"],
+  "properties": {
+    "schemaVersion": { "const": "maggie-palette-roles-v1" },
+    "template": { "type": ["string", "null"] },
+    "signature": {
+      "allOf": [
+        { "$ref": "#/$defs/palette" },
+        { "properties": { "id": { "const": "signature" } } }
+      ]
+    },
+    "variants": { "type": "array", "items": { "$ref": "#/$defs/palette" } }
+  },
+  "$defs": {
+    "hex": { "type": "string", "pattern": "^#[0-9A-Fa-f]{6}$" },
+    "palette": {
+      "type": "object",
+      "required": ["id", "name", "roles"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "name": { "type": "string", "minLength": 1 },
+        "roles": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["canvas", "panel", "soft", "text", "accent", "accentText", "onAccent", "dark", "deep"],
+          "properties": {
+            "canvas": { "$ref": "#/$defs/hex", "description": "Page background." },
+            "panel": { "$ref": "#/$defs/hex", "description": "Cards and raised surfaces; body text must pass on it." },
+            "soft": { "$ref": "#/$defs/hex", "description": "Tinted band or chip background; not for long body copy." },
+            "text": { "$ref": "#/$defs/hex", "description": "Body text on canvas and panel." },
+            "accent": { "$ref": "#/$defs/hex", "description": "Buttons and highlights (fills)." },
+            "accentText": { "$ref": "#/$defs/hex", "description": "Accent-coloured text and links on canvas." },
+            "onAccent": { "$ref": "#/$defs/hex", "description": "Text placed on an accent fill." },
+            "dark": { "$ref": "#/$defs/hex", "description": "Dark band background." },
+            "deep": { "$ref": "#/$defs/hex", "description": "Deepest band, footer or overlay." }
+          }
+        }
+      }
+    }
+  }
+}

package/bundled-contracts/maggie-marketplace/template-content-v1.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggie-marketplace/template-content-v1.schema.json",
+  "title": "Maggie template content contract",
+  "description": "Neutral business content a marketplace template renders when exported as a data-driven component, so one design serves many businesses from their own data. Palette roles come from maggie-palette-roles-v1 and are emitted as --maggie-<role> CSS variables. Business rules (sample paths resolve, reviews carry a source or sample=true, hours are HH:MM) are enforced by `maggie_marketplace.py content-validate`.",
+  "type": "object",
+  "required": ["schemaVersion", "brand", "contact", "hero", "categories", "about", "gallery", "reviews", "hours", "faqs"],
+  "properties": {
+    "schemaVersion": { "const": "maggie-template-content-v1" },
+    "brand": {
+      "type": "object",
+      "required": ["name"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "tagline": { "type": ["string", "null"] },
+        "logo": { "$ref": "#/$defs/image" }
+      }
+    },
+    "contact": {
+      "type": "object",
+      "properties": {
+        "phone": { "type": ["string", "null"] },
+        "email": { "type": ["string", "null"] },
+        "address": { "type": ["string", "null"] },
+        "bookingUrl": { "type": ["string", "null"] }
+      }
+    },
+    "hero": {
+      "type": "object",
+      "required": ["headline"],
+      "properties": {
+        "headline": { "type": "string", "minLength": 1 },
+        "subheadline": { "type": ["string", "null"] },
+        "image": { "$ref": "#/$defs/image" },
+        "cta": { "type": "object", "properties": { "label": { "type": "string" }, "href": { "type": "string" } } }
+      }
+    },
+    "categories": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "services"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "description": { "type": ["string", "null"] },
+          "services": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["name"],
+              "properties": {
+                "name": { "type": "string", "minLength": 1 },
+                "description": { "type": ["string", "null"] },
+                "price": { "type": ["number", "null"], "minimum": 0 },
+                "currency": { "type": "string", "default": "GBP" },
+                "durationMinutes": { "type": ["integer", "null"], "minimum": 1 },
+                "bookingRef": { "type": ["string", "null"], "description": "Host booking/catalogue identifier, e.g. a MaggieDash Booking service id." }
+              }
+            }
+          }
+        }
+      }
+    },
+    "about": { "type": "object", "properties": { "heading": { "type": ["string", "null"] }, "body": { "type": ["string", "null"] }, "image": { "$ref": "#/$defs/image" } } },
+    "gallery": { "type": "array", "items": { "$ref": "#/$defs/image" } },
+    "reviews": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["quote"],
+        "properties": {
+          "quote": { "type": "string" },
+          "author": { "type": ["string", "null"] },
+          "rating": { "type": ["number", "null"], "minimum": 0, "maximum": 5 },
+          "source": { "type": ["string", "null"], "description": "Where the real review came from; required unless sample is true." },
+          "sample": { "type": "boolean" }
+        }
+      }
+    },
+    "hours": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["day"],
+        "properties": {
+          "day": { "enum": ["mon", "tue", "wed", "thu", "fri", "sat", "sun"] },
+          "opens": { "type": "string", "pattern": "^\\d{2}:\\d{2}$" },
+          "closes": { "type": "string", "pattern": "^\\d{2}:\\d{2}$" },
+          "closed": { "type": "boolean" }
+        }
+      }
+    },
+    "faqs": { "type": "array", "items": { "type": "object", "required": ["question", "answer"], "properties": { "question": { "type": "string" }, "answer": { "type": "string" } } } },
+    "samples": { "type": "array", "items": { "type": "string" }, "description": "Dotted content paths that still hold template sample copy the owner must replace (e.g. hero.headline, reviews.0)." },
+    "palette": { "type": "object", "description": "One maggie-palette-roles-v1 palette (id, name, roles)." }
+  },
+  "$defs": {
+    "image": {
+      "type": ["object", "null"],
+      "properties": { "src": { "type": "string" }, "alt": { "type": "string" } }
+    }
+  }
+}

package/bundled-contracts/maggiedash/booking-browser-evidence-v1.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-browser-evidence-v1.json",
+  "title": "MaggieDash Booking production browser evidence v1",
+  "type": "object",
+  "required": ["schemaVersion", "baseUrl", "generatedAt", "viewports", "screens", "consoleErrors", "failedRequests", "layoutErrors"],
+  "properties": {
+    "schemaVersion": { "const": "maggiedash-booking-browser-evidence.v1" },
+    "baseUrl": { "type": "string", "pattern": "^https://" },
+    "generatedAt": { "type": "string", "format": "date-time" },
+    "version": { "type": "string" },
+    "viewports": { "type": "array", "minItems": 3, "items": { "type": "object", "required": ["name", "width", "height"] } },
+    "screens": { "type": "array", "minItems": 51, "items": { "type": "object", "required": ["route", "viewport", "httpStatus", "screenshot", "ready"] } },
+    "consoleErrors": { "type": "array", "items": { "type": "string" } },
+    "failedRequests": { "type": "array", "items": { "type": "string" } },
+    "layoutErrors": { "type": "array", "items": { "type": "string" } },
+    "notes": { "type": "array", "items": { "type": "string" } }
+  },
+  "x-required-routes": ["/_maggie/booking/", "/_maggie/booking/calendar", "/_maggie/booking/bookings", "/_maggie/booking/customers", "/_maggie/booking/waitlist", "/_maggie/booking/locations", "/_maggie/booking/catalog", "/_maggie/booking/packages", "/_maggie/booking/staff", "/_maggie/booking/resources", "/_maggie/booking/schedule", "/_maggie/booking/payments", "/_maggie/booking/notifications", "/_maggie/booking/email-templates", "/_maggie/booking/reports", "/_maggie/booking/settings", "/_maggie/booking/audit"],
+  "x-required-viewports": [{"name":"mobile","width":390,"height":844},{"name":"tablet","width":768,"height":1024},{"name":"desktop","width":1440,"height":1000}]
+}

package/bundled-contracts/maggiedash/booking-browser-evidence-v2.json

@@ -0,0 +1,191 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-browser-evidence-v2.json",
+  "title": "MaggieDash Booking production browser evidence v2",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "baseUrl",
+    "generatedAt",
+    "viewports",
+    "screens",
+    "consoleErrors",
+    "failedRequests",
+    "layoutErrors"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "maggiedash-booking-browser-evidence.v2"
+    },
+    "baseUrl": {
+      "type": "string",
+      "pattern": "^https://"
+    },
+    "generatedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "version": {
+      "type": "string"
+    },
+    "viewports": {
+      "type": "array",
+      "minItems": 3,
+      "items": {
+        "type": "object",
+        "required": [
+          "name",
+          "width",
+          "height"
+        ]
+      }
+    },
+    "screens": {
+      "type": "array",
+      "minItems": 51,
+      "items": {
+        "type": "object",
+        "required": [
+          "route",
+          "viewport",
+          "httpStatus",
+          "finalPath",
+          "heading",
+          "screenshot",
+          "ready"
+        ],
+        "properties": {
+          "route": {
+            "type": "string",
+            "enum": [
+              "/_maggie/booking/",
+              "/_maggie/booking/calendar",
+              "/_maggie/booking/bookings",
+              "/_maggie/booking/customers",
+              "/_maggie/booking/waitlist",
+              "/_maggie/booking/locations",
+              "/_maggie/booking/catalog",
+              "/_maggie/booking/packages",
+              "/_maggie/booking/staff",
+              "/_maggie/booking/resources",
+              "/_maggie/booking/schedule",
+              "/_maggie/booking/payments",
+              "/_maggie/booking/notifications",
+              "/_maggie/booking/email-templates",
+              "/_maggie/booking/reports",
+              "/_maggie/booking/settings",
+              "/_maggie/booking/audit"
+            ]
+          },
+          "viewport": {
+            "type": "string",
+            "enum": [
+              "mobile",
+              "tablet",
+              "desktop"
+            ]
+          },
+          "httpStatus": {
+            "type": "integer",
+            "minimum": 200,
+            "maximum": 399
+          },
+          "finalPath": {
+            "type": "string",
+            "pattern": "^/_maggie/booking(?:/|$)"
+          },
+          "heading": {
+            "type": "string",
+            "minLength": 1
+          },
+          "screenshot": {
+            "type": "string",
+            "minLength": 1
+          },
+          "ready": {
+            "const": true
+          }
+        }
+      }
+    },
+    "consoleErrors": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "failedRequests": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "layoutErrors": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "notes": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "x-required-routes": [
+    "/_maggie/booking/",
+    "/_maggie/booking/calendar",
+    "/_maggie/booking/bookings",
+    "/_maggie/booking/customers",
+    "/_maggie/booking/waitlist",
+    "/_maggie/booking/locations",
+    "/_maggie/booking/catalog",
+    "/_maggie/booking/packages",
+    "/_maggie/booking/staff",
+    "/_maggie/booking/resources",
+    "/_maggie/booking/schedule",
+    "/_maggie/booking/payments",
+    "/_maggie/booking/notifications",
+    "/_maggie/booking/email-templates",
+    "/_maggie/booking/reports",
+    "/_maggie/booking/settings",
+    "/_maggie/booking/audit"
+  ],
+  "x-required-viewports": [
+    {
+      "name": "mobile",
+      "width": 390,
+      "height": 844
+    },
+    {
+      "name": "tablet",
+      "width": 768,
+      "height": 1024
+    },
+    {
+      "name": "desktop",
+      "width": 1440,
+      "height": 1000
+    }
+  ],
+  "x-required-headings": {
+    "/_maggie/booking/": "Overview",
+    "/_maggie/booking/calendar": "Calendar",
+    "/_maggie/booking/bookings": "Bookings",
+    "/_maggie/booking/customers": "Customers",
+    "/_maggie/booking/waitlist": "Waitlist",
+    "/_maggie/booking/locations": "Locations",
+    "/_maggie/booking/catalog": "Catalogue",
+    "/_maggie/booking/packages": "Packages",
+    "/_maggie/booking/staff": "Staff",
+    "/_maggie/booking/resources": "Resources",
+    "/_maggie/booking/schedule": "Schedule",
+    "/_maggie/booking/payments": "Payments",
+    "/_maggie/booking/notifications": "Notifications",
+    "/_maggie/booking/email-templates": "Email templates",
+    "/_maggie/booking/reports": "Reports",
+    "/_maggie/booking/settings": "Settings",
+    "/_maggie/booking/audit": "Audit"
+  }
+}

package/bundled-contracts/maggiedash/booking-email-templates-v1.json

@@ -11,16 +11,18 @@
   },
   "roles": ["owner", "admin", "manager"],
   "events": [
-    { "id": "booking.confirmed", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
+    { "id": "booking.confirmed", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName", "arrivalNote"] },
     { "id": "booking.rescheduled", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
     { "id": "booking.cancelled", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "reason", "siteName"] },
     { "id": "booking.reminder", "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "siteName"] },
     { "id": "payment.action_required", "variables": ["customerName", "serviceName", "bookingId", "actionUrl", "siteName"] },
     { "id": "payment.refunded", "variables": ["customerName", "serviceName", "bookingId", "siteName"] },
+    { "id": "payment.no_show_fee", "variables": ["customerName", "serviceName", "bookingId", "amount", "siteName"] },
     { "id": "package.purchase.confirmed", "variables": ["customerName", "packageName", "amount", "expiresAt", "siteName"] },
     { "id": "package.purchase.refunded", "variables": ["customerName", "packageName", "amount", "siteName"] },
     { "id": "booking.waitlist.available", "variables": ["customerName", "serviceName", "when", "locationName", "bookingUrl", "siteName"] }
   ],
+  "variables": ["customerName", "serviceName", "when", "locationName", "bookingId", "manageUrl", "bookingUrl", "reason", "actionUrl", "packageName", "amount", "expiresAt", "siteName", "arrivalNote"],
   "endpointIds": ["booking.email-templates.read", "booking.email-templates.draft", "booking.email-templates.publish", "booking.email-templates.rollback"],
   "canonicalRoutes": {
     "booking.email-templates.read": "GET /email-templates.json",

package/bundled-contracts/maggiedash/booking-voucher-lifecycle-v1.json

@@ -0,0 +1,85 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.topy.ai/contracts/booking-voucher-lifecycle-v1.json",
+  "title": "MaggieDash Booking gift voucher lifecycle v1",
+  "schemaVersion": "maggiedash-booking-voucher-lifecycle.v1",
+  "status": "contract",
+  "runtime": {
+    "owner": "host",
+    "maggieDashRuntime": false,
+    "note": "This contract fixes the provider-neutral voucher lifecycle. MaggieDash does not ship a voucher runtime in this release; a host implements it and proves it with a sanitized ledger fixture."
+  },
+  "apiPrefix": "/api/maggie/booking/vouchers.json",
+  "auth": { "managerSession": "host-session-cookie", "emailPassword": true, "passkeys": false },
+  "permissions": ["vouchers.read", "vouchers.sell", "vouchers.redeem", "vouchers.void", "vouchers.refund"],
+  "money": { "unit": "minor", "integerOnly": true, "singleCurrencyPerVoucher": true },
+  "channels": {
+    "online": {
+      "funding": "provider-payment",
+      "issueAfter": "verified payment success webhook",
+      "provider": "stripe",
+      "providerObjects": ["checkout_sessions", "payment_intents", "refunds"],
+      "nativeGiftCards": false
+    },
+    "till": {
+      "funding": "recorded-in-shop-payment",
+      "paymentMethods": ["cash", "card-terminal", "external"],
+      "requiredPermission": "vouchers.sell"
+    }
+  },
+  "codeFormat": {
+    "online": {
+      "pattern": "^[A-Z]{2,4}-[A-Z2-9]{4}-[A-Z2-9]{4}-[A-Z2-9]{4}$",
+      "alphabet": "ABCDEFGHJKLMNPQRSTUVWXYZ23456789",
+      "check": "hmac-sha256",
+      "checkSegment": "last segment is a truncated HMAC of the body under a server-only secret; verify in constant time before any database lookup"
+    },
+    "till": {
+      "pattern": "^[A-Z]{1,4}[0-9]{6,10}$",
+      "check": "luhn",
+      "checkSegment": "final digit is a Luhn check digit so mistyped printed codes fail before lookup"
+    },
+    "storage": "store only codeHash and codeLast4; never persist or return the full code after delivery"
+  },
+  "states": ["pending_payment", "active", "exhausted", "expired", "voided", "refunded"],
+  "ledger": {
+    "appendOnly": true,
+    "entryTypes": ["issue", "redeem", "undo_redeem", "void", "expire", "refund"],
+    "balanceRule": "balance = issue - redeem + undo_redeem - refund; it never becomes negative",
+    "fields": ["id", "voucherId", "type", "amount", "at", "actorId", "idempotencyKey", "reverses", "bookingId", "paymentRef", "refundMethod", "reason"]
+  },
+  "rules": {
+    "issue": "exactly one issue entry, first in the ledger, equal to faceValue; online vouchers stay pending_payment until the verified payment webhook",
+    "partialRedemption": "a redemption may be any positive amount up to the remaining balance; the remainder stays redeemable",
+    "undo": "undo_redeem reverses exactly one earlier redeem entry by id, for the same amount, at most once, and never after void",
+    "void": "void requires a reason and blocks every later redemption, undo, and refund; the remaining balance is reported but unusable",
+    "expiry": "no redemption at or after expiresAt; an expire entry records the unused balance without changing the ledger history",
+    "refund": "refund amount is capped by the remaining balance and by the funded amount minus earlier refunds; online refunds reference the original provider payment; till refunds record refundMethod",
+    "fullRefund": "a refund that brings the balance to zero before any redemption moves the voucher to refunded"
+  },
+  "notifications": [
+    { "id": "voucher.purchase.confirmed", "recipient": "buyer", "variables": ["customerName", "amount", "voucherLast4", "expiresAt", "siteName"] },
+    { "id": "voucher.delivered", "recipient": "recipient", "variables": ["recipientName", "senderName", "message", "amount", "voucherCode", "expiresAt", "redeemUrl", "siteName"] },
+    { "id": "voucher.redeemed", "recipient": "buyer-or-recipient", "variables": ["amount", "remainingBalance", "voucherLast4", "siteName"] },
+    { "id": "voucher.refunded", "recipient": "buyer", "variables": ["customerName", "amount", "voucherLast4", "siteName"] },
+    { "id": "voucher.expiry_reminder", "recipient": "recipient", "variables": ["recipientName", "remainingBalance", "expiresAt", "redeemUrl", "siteName"] }
+  ],
+  "endpointIds": ["booking.vouchers.read", "booking.vouchers.sell", "booking.vouchers.redeem", "booking.vouchers.undo", "booking.vouchers.void", "booking.vouchers.refund"],
+  "canonicalRoutes": {
+    "booking.vouchers.read": "GET /vouchers.json",
+    "booking.vouchers.sell": "POST /vouchers.json?action=sell",
+    "booking.vouchers.redeem": "POST /vouchers.json?action=redeem",
+    "booking.vouchers.undo": "POST /vouchers.json?action=undo",
+    "booking.vouchers.void": "POST /vouchers.json?action=void",
+    "booking.vouchers.refund": "POST /vouchers.json?action=refund"
+  },
+  "policy": {
+    "tenantScoped": true,
+    "auditRequired": true,
+    "idempotencyRequiredForMutations": true,
+    "fullCodeOnlyInDeliveryEmail": true,
+    "providerCredentialsRemainServerOnly": true,
+    "expiryPolicyDeclaredByHost": true
+  },
+  "ledgerFixtureSchemaVersion": "maggiedash-booking-voucher-ledger.v1"
+}