@topy-ai/maggie 0.7.52 → 0.7.53

package/README-zh-TW.md

@@ -29,7 +29,53 @@ npx @topy-ai/maggie init --scope project --agent all
 npx @topy-ai/maggie doctor --scope project --project .
 ```
 
-目前 npm 版本為 `0.7.52`：加入三項 mobile lane 後續修正——`maggie mobile preflight` 會在 non-interactive `eas update` script 缺少 `--environment` 時失敗，並在 build 後修改 `eas.json` 可能改變 fingerprint（OTA 更新會無聲地送不到該 build）時警告；`maggie mobile plan` 一律帶 `--environment`，每次 update 前先跑 `eas fingerprint:compare`；新增 `maggie design safe-area-check`，標出 iOS modal route 與 React Native `<Modal>` 內的 `<SafeAreaView>`（可能量到 0 的 top inset）。前一版 `0.7.51` 完成 batch 28：17 條 hosted feedback，來自一個跨平台產品開發 session（同一套 Expo 程式碼支援 web、iOS、Android，加上具備 MCP 與 ChatGPT/Claude app 的 AI 助理、產品自己的 CLI/MCP 套件、第三方 skills catalog 以及多租戶 assistant bridge host）。`maggie design app-validate` 改讀每個 viewport 的 evidence（scroll owner、固定 header/footer），只有 `app-init --pane list-detail:1024:2` 宣告的多欄版面才允許多個 scroll owner，並以 PNG 實際尺寸對照 plan viewport；`app-init --capabilities none|camera,…`（或 `--camera none`）讓非相機頁面不必填相機狀態，`--pattern` 加入新的 app UI patterns 驗收規則。新增 `maggie design app-collect`：在同一個瀏覽器分頁逐一以真實尺寸渲染已登入的 app 路由、略過 React Native Web 的包裝層計算 scroll owner、證明固定 shell，並寫出 `runtime-evidence.json` 與截圖（可 `--cdp-url` 接上已登入的 Chrome，或用專用 QA profile，`--read-only` 阻擋寫入）。新增 `maggie qa app-preflight`：偵測以 `CI=1` 或從錯誤資料夾啟動的 Metro/Expo dev server，並對會輪替的 refresh token 與連到 production API 的本機 server 發出警告。新增 `maggie-mobile-app` skill 與 `maggie mobile preflight|plan`（EAS build profile、TestFlight / Play 內部測試、EAS Update channel 與 fingerprint runtime policy、上架審核規則、建置前成本提示；`--auto-submit` 缺 `ascAppId` 或 `appVersion` policy 配上 remote build number 時在花費額度前就失敗）。新增 `maggie-assistant-tools` skill 與 `maggie assistant`（單一 tool registry、風險等級與 gate、與 model description 分開的使用者文案、由風險推導 MCP annotations、自動產生「助理能做與不能做」頁面、audit 檢查與簽章一次性 approval token 參考實作）。新增 `maggie product release-check|smoke|mcp-check|review-status`（產品 npm CLI/MCP 套件 metadata、`server.json`/`mcpName`、打包檔案機密掃描、安裝後 binary smoke、OAuth protected-resource metadata、ChatGPT/Claude/商店審核追蹤）、`maggie skills scaffold|validate|package|smoke`（第三方 skills catalog 打包成分類 plugin、all-in-one plugin 與 Claude Code `marketplace.json`）、`maggie deployment bridge-plan|bridge-collect-script|bridge-check`（多租戶 bridge host）；`maggie feedback session-summary` 支援多個 repo 與一般句子形式的 commit。MaggieDash 0.2.12 從 ORA host 上游通用修正。前一版 `0.7.50`：`maggie update` 改為 idempotent，內容已與套件相同的檔案不再改寫（保留時間戳），摘要分別列出 changed/unchanged/preserved 數量，只有真的保留了本機修改時才顯示 preserved 提示。前一版 `0.7.49` 完成 batch 27：33 條 2026-09-09 至 09-16 建立但從未提交的本機 feedback drafts，已逐條對照目前程式碼（其中兩條已被既有功能滿足）。新增離線 `maggie ops notifications`（通知 catalogue 合約、consent/retention/durable lead delivery 規則、provider template drift、只檢查變數名稱的 Resend preflight、queue health 門檻與 operator alerts、dry-run retention plan）；`maggie localization email-matrix` 與 `maggie localization lifecycle`（locale 優先順序、未翻譯/缺漏 locale、變數與 HTML/text 一致、market CTA route、consent-aware 行銷 email 預設不發送）；Deployment 的 `--keep-releases` 統一 retention policy、`auth-canary`、資料庫 owner 無法讀取 release 路徑時的 streamed migration、`collect` 單一 readiness report；Google failure remediation（`maggie ops google-diagnose`）與唯讀 `google-ads-preflight`/`google-ads-keyword-ideas`；Social Share `reconcile`（timeout 後不重複發文）、`maggie-marketing-run-v1` 合約、命名排程層與只管制對外發布的 regulated-content review；`maggie design icon-glyph-check`、`maggie design verify`、`maggie service import-stages-validate`/`import-readiness`/`fact-provenance`；以及 `--release-metadata` 版本一致性檢查、`maggie docs rollout-status` 與 stdin batch 輸入。前一版 `0.7.48` 處理 2026-10-10 的 27 條 hosted feedback（batch 26）：Social Share 新增 `adapters`（每個 provider 一組 canonical OAuth scope，LinkedIn 不同 scope 會撤銷舊 token；共用 OAuth client 警告）、`connections`（撤銷或無法解密的 token 標為 `needs_reconnect`，偵測會過期的簽名頭像 URL）、`queue`（slot-based 排程：not-before、最新優先、campaign 輪流與每日上限、DST-safe）與 `campaigns`（idea stage Start gate）；Deployment 新增 hash-only `secret-fingerprint`/`secret-parity`、`env-isolation`（本機 `.env` 指向 production database 時警告）、release retention 與 worker-before-enqueue 發布順序；QA 在未明確同意時阻擋對 production API 的寫入情境，並以 `maggie qa cors-preflight` 只用 OPTIONS 檢查每個 HTTP method；Design 新增 `pressable-check`、`layer-check`（Tailwind v4 unlayered CSS）、onboarding wizard/picker 模式與 `maggie-palette-roles-v1` palette generate/validate；Marketplace 加入 screenshot 完整性與像素預算、從 CSS 量測 palette、asset provenance、中性 `displayName`（全部模板已補齊）、template studio、`maggie-template-content-v1` 合約與圖片生成成本/無文字審查 gate；Booking 新增唯讀 Stripe live setup runbook 與 gift voucher lifecycle 合約（`maggie booking voucher-contract --ledger`）；Feedback 新增 `improvement` 類型與 `maggie feedback session-summary`。MaggieDash 0.2.11 會保留尚未部署 template 的 outbox email 而不是 dead-letter，並從 ORA host 上游通用修正。本版也包含 Booking 十個 email events 合約與 CLI validator 同步及安全輸出的 `arrivalNote`。前一版 `0.7.47` 處理 2026-09-26 五條新 feedback：project-scope
+目前 npm 版本為 `0.7.53`：完成 feedback batch 29，共 56 條 hosted feedback，來自一個多商家預約平台與一個社群／AI 助理產品，並同步發布 MaggieDash 0.2.13。
+
+- **預約規則與共用測試向量**：新增 `contracts/maggiedash/booking-rules-v1.json` 與 `docs/maggiedash-booking/RULES.md`，共 19 條規則、82 個測試向量，讓每個預約系統以相同方式實作：
+  - 客人的管理連結可以改哪些預約、預約保留時間過期後才付款的處理；
+  - 排班輸入一律以店家時區解讀、Postgres bigint 金額；
+  - 結帳金額計算（已含在項目價格內的加購不重複計價、服務費、禮券、套票、小費分配）；
+  - 未接上金流前不能設定訂金／全額付款，以及多階段提醒與「由誰取消」的通知；
+  - `.ics` 檔，以及可預約時段規則（分段營業時間、輪班、每位員工不同時長、空檔規則、團體預約、尖峰價、夏令時間）；
+  - 角色權限與 PIN 切換、客人安全、會員與點數、員工薪資，以及客人帳號。
+
+  `maggie booking rules-vectors` 可對參考實作執行，或用 `--host-command` 對你自己的引擎執行。
+- **預約平台**：託管多家商家的平台改用 Stripe Connect direct charges。`maggie booking connect-qa` 準備 Connect 測試模式的完整測試：拒絕 live key、找出測試用的 connected account、印出 `stripe listen` 指令並列出付款案例。另外提供隱藏的正式環境 smoke 商家做法。`maggie service migrate-check` 可先試跑（dry run）從 Fresha 或 CSV 搬移客人、未來預約與禮物卡。
+- **MaggieDash 0.2.13**：
+  - 管理連結只能更動已確認且尚未開始的預約；
+  - 晚到的付款在時段仍空著時恢復預約，否則請商家退款；
+  - 提醒分 24 小時與 2 小時各發一次；
+  - 客人取消或改期時會通知商家；
+  - 確認信附上 `.ics` 檔；
+  - 「只看自己的預約」依權限判斷，而不是角色名稱。
+- **部署**：
+  - `maggie deployment cloudflare-preflight` 阻止部署在缺少 token 時改用 wrangler 的 OAuth 登入、跑到另一個帳號；
+  - `vps-release` 把 SSR Node 發布變成一個可審閱的指令，並以部署使用者身分 build；
+  - `file-parity` 在局部複製檔案前檢查各主機，`warm-check` 只在暖機後才判斷延遲；
+  - `bridge-check` 檢查 proxy 的上傳大小與逾時上限；
+  - 文件補上 failover 不得重送寫入請求的規則。
+- **App 與 QA**：
+  - `maggie qa app-preflight --expect-symbol` 證明伺服器送出的 bundle 已包含剛改的程式，並指出是哪個程序佔用 port；
+  - `maggie mobile ota --build-ref` 以 build 當時的設定檔發布 OTA 更新；
+  - `maggie qa fit-check` 檢查儀表板（包含每個分頁與抽屜）是否都不用捲動整頁；
+  - `maggie design textinput-check` 與新的 app 介面模式涵蓋背景工作、單行輸入框、hash 分頁、右側抽屜與依螢幕大小分頁。
+- **AI 助理**：
+  - tool registry 支援結果卡片與存在伺服器的對話；
+  - 公開唯讀的探索型 MCP，已登入的 MCP 伺服器預設做 RFC 8707 audience 綁定；
+  - 面向訪客的預約接待助理，不會代為預約也不收卡號；
+  - 工作流程的常設核准（standing approval）；
+  - Codex app-server 圖片功能說明。
+- **社群與 SEO**：
+  - 貼文只能分享本工作區自己網域的文章，有圖片的貼文以圖片貼文發出；
+  - 規劃失敗時不留下空的 campaign；
+  - `schema-check` 找出對 Gemini 太複雜的結構化輸出 schema；
+  - `maggie seo origin-check` 與 `fragment-check` 涵蓋路由檢查與個人化片段的快取規則。
+- **其他**：
+  - `maggie feedback session-summary` 可指定要讀的 revision，把專案本身的 commit 與 skill 回饋分開，超過上限時依 scope 分組而不是默默截斷；
+  - Marketplace 目錄改用共用的城鎮解析與名稱搜尋模組；
+  - 移除空的 `maggie-emdash` 資料夾。
+
+前一版 `0.7.52` 加入 mobile 後續修正（`eas update --environment`、fingerprint 檢查、`maggie design safe-area-check`）。`0.7.51`（batch 28）新增 `maggie design app-collect`、`maggie qa app-preflight`、`maggie-mobile-app` 與 `maggie-assistant-tools` skills，以及 `maggie product`、`maggie skills`、`maggie deployment bridge-*`。前一版 `0.7.50`：`maggie update` 改為 idempotent，內容已與套件相同的檔案不再改寫（保留時間戳），摘要分別列出 changed/unchanged/preserved 數量，只有真的保留了本機修改時才顯示 preserved 提示。前一版 `0.7.49` 完成 batch 27：33 條 2026-09-09 至 09-16 建立但從未提交的本機 feedback drafts，已逐條對照目前程式碼（其中兩條已被既有功能滿足）。新增離線 `maggie ops notifications`（通知 catalogue 合約、consent/retention/durable lead delivery 規則、provider template drift、只檢查變數名稱的 Resend preflight、queue health 門檻與 operator alerts、dry-run retention plan）；`maggie localization email-matrix` 與 `maggie localization lifecycle`（locale 優先順序、未翻譯/缺漏 locale、變數與 HTML/text 一致、market CTA route、consent-aware 行銷 email 預設不發送）；Deployment 的 `--keep-releases` 統一 retention policy、`auth-canary`、資料庫 owner 無法讀取 release 路徑時的 streamed migration、`collect` 單一 readiness report；Google failure remediation（`maggie ops google-diagnose`）與唯讀 `google-ads-preflight`/`google-ads-keyword-ideas`；Social Share `reconcile`（timeout 後不重複發文）、`maggie-marketing-run-v1` 合約、命名排程層與只管制對外發布的 regulated-content review；`maggie design icon-glyph-check`、`maggie design verify`、`maggie service import-stages-validate`/`import-readiness`/`fact-provenance`；以及 `--release-metadata` 版本一致性檢查、`maggie docs rollout-status` 與 stdin batch 輸入。前一版 `0.7.48` 處理 2026-10-10 的 27 條 hosted feedback（batch 26）：Social Share 新增 `adapters`（每個 provider 一組 canonical OAuth scope，LinkedIn 不同 scope 會撤銷舊 token；共用 OAuth client 警告）、`connections`（撤銷或無法解密的 token 標為 `needs_reconnect`，偵測會過期的簽名頭像 URL）、`queue`（slot-based 排程：not-before、最新優先、campaign 輪流與每日上限、DST-safe）與 `campaigns`（idea stage Start gate）；Deployment 新增 hash-only `secret-fingerprint`/`secret-parity`、`env-isolation`（本機 `.env` 指向 production database 時警告）、release retention 與 worker-before-enqueue 發布順序；QA 在未明確同意時阻擋對 production API 的寫入情境，並以 `maggie qa cors-preflight` 只用 OPTIONS 檢查每個 HTTP method；Design 新增 `pressable-check`、`layer-check`（Tailwind v4 unlayered CSS）、onboarding wizard/picker 模式與 `maggie-palette-roles-v1` palette generate/validate；Marketplace 加入 screenshot 完整性與像素預算、從 CSS 量測 palette、asset provenance、中性 `displayName`（全部模板已補齊）、template studio、`maggie-template-content-v1` 合約與圖片生成成本/無文字審查 gate；Booking 新增唯讀 Stripe live setup runbook 與 gift voucher lifecycle 合約（`maggie booking voucher-contract --ledger`）；Feedback 新增 `improvement` 類型與 `maggie feedback session-summary`。MaggieDash 0.2.11 會保留尚未部署 template 的 outbox email 而不是 dead-letter，並從 ORA host 上游通用修正。本版也包含 Booking 十個 email events 合約與 CLI validator 同步及安全輸出的 `arrivalNote`。前一版 `0.7.47` 處理 2026-09-26 五條新 feedback：project-scope
 `maggie init` 會建立本地 memory store；context 預設只讀取本 project scope；memory hook
 在 local Python adapter 不存在時 fallback 到已安裝 CLI；重複 init 保留既有檔案與時間戳；
 `maggie feedback list` 的 `--project` 可放在子命令前或後。Generated VPS runner 現在記錄
@@ -113,7 +159,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 npm 版本為 `0.7.52`，包含 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.53`，包含 batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,58 +89,70 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 22 installable skills and a local-first MaggieDash foundation.
 
-This package is `0.7.52`. It adds three follow-ups to the mobile
-lane that arrived during the 0.7.51 release: `maggie mobile preflight` fails
-on non-interactive `eas update` scripts without `--environment` and warns
-when `eas.json` can change the fingerprint after a build (OTA updates would
-silently stop reaching it); `maggie mobile plan` always sets `--environment`
-and gates every update on `eas fingerprint:compare`; and the new
-`maggie design safe-area-check` flags `<SafeAreaView>` inside iOS modal routes
-and React Native `<Modal>`, where it can measure a 0 top inset.
-
-The 0.7.51 release closed batch 28: 17 hosted feedback
-records from a cross-platform product session (one Expo codebase for web,
-iOS and Android, an assistant with MCP and ChatGPT/Claude app surfaces,
-product CLI/MCP packages, a third-party skills catalog, and a multi-tenant
-assistant bridge host):
-
-- App surfaces: `maggie design app-validate` reads per-viewport evidence
-  (scroll owners, fixed shell), accepts extra scroll owners only where
-  `app-init --pane list-detail:1024:2` declares them, and checks each PNG's
-  real size against the plan viewport. `app-init --capabilities none|camera,…`
-  (or `--camera none`) drops irrelevant device states, and `--pattern` adds
-  acceptance rules from the new [app UI patterns](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-design/references/app-ui-patterns.md).
-- New `maggie design app-collect`: renders a signed-in app route one viewport
-  at a time in one browser tab at the real size, counts scroll owners while
-  skipping React Native Web wrappers, proves the fixed shell, and writes
-  `runtime-evidence.json` plus screenshots. It can attach to your signed-in
-  Chrome (`--cdp-url`) or use a QA profile, and can block writes (`--read-only`).
-- New `maggie qa app-preflight`: catches Metro/Expo dev servers started with
-  `CI=1` or from the wrong folder, and warns about rotating refresh tokens and
-  local servers that talk to production APIs.
-- New [`maggie-mobile-app`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-mobile-app/SKILL.md) skill and
-  `maggie mobile preflight|plan`: EAS build profiles, TestFlight / Play
-  internal testing, EAS Update channels and the fingerprint runtime policy,
-  store-review rules, and a cost notice. It fails before quota is spent when
-  `--auto-submit` lacks `ascAppId` or `appVersion` runtime policy is combined
-  with remote build numbers.
-- New [`maggie-assistant-tools`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-assistant-tools/SKILL.md)
-  skill and `maggie assistant`: one tool registry with risk levels, gates and
-  user-facing copy kept apart from model descriptions, MCP annotations derived
-  from risk, a generated "what the assistant can and can't do" page, audit
-  checks, and reference signed one-time approval tokens.
-- New `maggie product release-check|smoke|mcp-check|review-status` for a
-  product's own npm CLI and MCP packages (metadata, `server.json`/`mcpName`,
-  packed-file secret scan, installed-binary smoke, OAuth protected-resource
-  metadata, ChatGPT/Claude/store review tracking).
-- New `maggie skills scaffold|validate|package|smoke` for third-party skill
-  catalogs, packaging category plugins, an all-in-one plugin and a Claude Code
-  `marketplace.json` (checked with `claude plugin validate`).
-- New `maggie deployment bridge-plan|bridge-collect-script|bridge-check` for a
-  multi-tenant assistant bridge host on a VPS.
-- `maggie feedback session-summary` reads several repositories
-  (`--repo app=../app --since-date …`) and classifies plain commit subjects.
-- MaggieDash 0.2.12 upstreams generic fixes from the ORA host.
+This package is `0.7.53`. It closes feedback batch 29: 56 hosted
+records from a multi-business booking marketplace and a social/assistant
+product, plus MaggieDash 0.2.13.
+
+- **Booking rules with shared test vectors.** New
+  [`booking-rules-v1.json`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/contracts/maggiedash/booking-rules-v1.json) and
+  [RULES.md](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/docs/maggiedash-booking/RULES.md): 19 rules and 82 vectors that
+  every booking host implements the same way. They cover:
+  - which bookings a client's manage link may change, and payment that arrives after the hold expired;
+  - schedule inputs in the venue's time zone, and Postgres bigint money;
+  - till maths: add-ons not charged twice, service charge, vouchers, packages, split tips;
+  - deposit policies only when payments are connected, plus reminder stages and who-cancelled notices;
+  - `.ics` files, and availability (split hours, rotas, per-staff durations, gaps, groups, peak pricing, DST);
+  - roles with a PIN switch, client safety, loyalty and memberships, team pay, and customer accounts.
+
+  `maggie booking rules-vectors` runs the vectors against the reference
+  implementation, or against your own engine with `--host-command`.
+- **Booking platforms.** Stripe Connect direct charges for platforms that host
+  many businesses. `maggie booking connect-qa` prepares a test-mode Connect run:
+  it refuses live keys, finds a test connected account, prints the
+  `stripe listen` command and lists the payment cases. There is also a hidden
+  production smoke business pattern. `maggie service migrate-check` dry-runs
+  moving clients, future appointments and gift cards from Fresha or CSV.
+- **MaggieDash 0.2.13.**
+  - Manage links act only on confirmed bookings that have not started.
+  - A late payment reinstates the booking when the time is still free; otherwise the business is asked to refund it.
+  - Reminders go out at 24 h and 2 h, each once.
+  - The business is told when a client cancels or moves a booking.
+  - Confirmation emails attach an `.ics` file.
+  - "Own bookings only" follows permissions instead of the role name.
+- **Deployment.**
+  - `maggie deployment cloudflare-preflight` refuses a deploy that would fall back to wrangler's OAuth login on another account.
+  - `vps-release` runs an SSR Node release as one reviewed command and builds as the deploy user.
+  - `file-parity` checks hosts before a surgical copy, and `warm-check` judges latency only after warm-up.
+  - `bridge-check` checks the proxy's body-size and timeout limits.
+  - The docs now cover failover that must not replay writes.
+- **Apps and QA.**
+  - `maggie qa app-preflight --expect-symbol` proves the served bundle contains your edit and names who holds the port.
+  - `maggie mobile ota --build-ref` publishes OTA updates with the build's own config files.
+  - `maggie qa fit-check` checks that dashboards fit the screen, tabs and drawers included.
+  - `maggie design textinput-check` and new app patterns cover background jobs, a one-line composer, hash tabs, right drawers and screen-sized pagers.
+- **Assistants.**
+  - Result cards and server-stored threads in the tool registry.
+  - A public read-only discovery MCP, with RFC 8707 audience binding on signed-in servers.
+  - A visitor-facing booking receptionist that never books or takes cards.
+  - Standing approvals for workflows.
+  - Codex app-server image notes.
+- **Social and SEO.**
+  - Posts may only share articles from the workspace's own domain, and posts with an image go out as image posts.
+  - Failed plans leave no empty campaigns.
+  - `schema-check` catches structured-output schemas that are too complex for Gemini.
+  - `maggie seo origin-check` and `fragment-check` cover route checks and personalised fragments.
+- **Also:**
+  - `maggie feedback session-summary` reads a chosen revision, separates project commits from skill feedback, and groups by scope instead of silently capping.
+  - Marketplace directories get one shared town and name-search module.
+  - The empty `maggie-emdash` folder is gone.
+
+0.7.52 added mobile follow-ups: `eas update --environment`, a fingerprint gate,
+and `maggie design safe-area-check`. 0.7.51 (batch 28) added
+`maggie design app-collect`, `maggie qa app-preflight`, and the
+[`maggie-mobile-app`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-mobile-app/SKILL.md) and
+[`maggie-assistant-tools`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-assistant-tools/SKILL.md) skills.
+It also added `maggie product`, `maggie skills` and
+`maggie deployment bridge-*`.
 
 The 0.7.50 release made `maggie update` idempotent: files whose content already
 matches the package are left untouched (timestamps included) and counted as
@@ -787,8 +799,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.52 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.52 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.53 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.53 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never

package/bin/maggie.js

@@ -43,7 +43,7 @@ function loadSkillNames() {
     // Local regression tests may invoke the wrapper before package assembly.
     // Discover real frontmatter directories and never resurrect retired content.
     return readdirSync(SKILLS_ROOT, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory() && entry.name !== "maggie-emdash" && existsSync(join(SKILLS_ROOT, entry.name, "SKILL.md")))
+      .filter((entry) => entry.isDirectory() && existsSync(join(SKILLS_ROOT, entry.name, "SKILL.md")))
       .map((entry) => entry.name).sort();
   }
 }
@@ -85,6 +85,7 @@ Usage:
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
   maggie booking install|worker-schedule|inspect|setup|contract|runtime-validate|ops-validate|release-gate|stripe-audit|tasks --project PATH [options]
+  maggie booking rules-vectors [--rule ID] [--host-command CMD] | connect-qa [--detect]
   maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|variant-copy-validate|media-validate|bindings-validate|idempotency-validate|reconcile> [options]
   maggie dash inventory --pages-file FILE [--require-page-kinds] [--require-source-coverage]
   maggie dash api-contract --spec FILE
@@ -99,9 +100,11 @@ Usage:
   maggie dash structure-validate --model FILE --evidence FILE
   maggie design progressive-check|css-check|css-cascade-check|style-check --evidence FILE
   maggie design dash-init|dash-validate|sample-init|sample-validate [options]
-  maggie design pressable-check|layer-check|safe-area-check --project PATH
+  maggie design pressable-check|layer-check|safe-area-check|textinput-check --project PATH
   maggie design palette generate --canvas HEX --text HEX --accent HEX | palette validate --palette FILE
   maggie seo privacy-check --evidence FILE
+  maggie seo origin-check --base-url URL [--project PATH] [--expect-host HOST]
+  maggie seo fragment-check --url URL [--url URL2] [--cookie-env NAME]
   maggie content FILE --source PROVIDER --project PATH --confirm
   maggie agent-content write --url URL --allowed-origin ORIGIN --token-env ENV --payload FILE
   maggie bootstrap phase <start|pass|fail|status> <phase> [project]
@@ -153,6 +156,7 @@ Usage:
   maggie service validate --project PATH
   maggie service inspect --project PATH
   maggie service status --project PATH
+  maggie service migrate-check --timezone Europe/London [--clients F] [--appointments F] [--gift-cards F] [--service NAME] [--staff NAME]
   maggie service orchestration-validate --project PATH --manifest FILE
   maggie service import-stages-validate --project PATH --manifest FILE
   maggie service import-readiness --project PATH [--python-module M] [--browser] [--webdriver] [--env NAME] [--country LABEL]
@@ -164,7 +168,12 @@ Usage:
   maggie deployment secret-parity --manifest api-1.json --manifest api-2.json --required KEY
   maggie deployment bridge-plan|bridge-collect-script --plan bridge-host.json
   maggie deployment bridge-check --plan bridge-host.json --observed observed.json
-  maggie mobile preflight|plan --project PATH [--app-dir apps/app] [--profile production] [--platform ios|android|all] [--auto-submit]
+  maggie deployment cloudflare-preflight --project PATH [--env production] [--env-file .env] [--verify-zone]
+  maggie deployment file-parity --host H [--host H2] --root /srv/app/current --path dist/x.mjs [--ref DEPLOYED_COMMIT]
+  maggie deployment warm-check --url URL [--warm 3] [--samples 5] [--budget-ms 800]
+  maggie deployment vps-release --host deploy@HOST --release-root /srv/app --service app --env-file /etc/app.env [--health-url URL] [--confirm]
+  maggie mobile preflight|plan --project PATH [--app-dir apps/app] [--profile production] [--platform ios|android|all] [--auto-submit] [--build-ref REF]
+  maggie mobile ota --project PATH --build-ref REF --build-id ID --message TEXT [--confirm]
   maggie assistant registry-validate|annotations|capability-page|audit-check --registry FILE [--mcp-tools FILE] [--session FILE] [--output FILE]
   maggie assistant approval-selftest
   maggie product release-check --package DIR [--server-json FILE] [--changelog FILE] [--pack]
@@ -196,7 +205,7 @@ Usage:
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary|email-matrix|lifecycle> [options]
   maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
   maggie feedback <collect|preview|batch|batch-review|session-summary|submit|list> [options]
-  maggie qa <start|record|summary|export|assertion-audit|cors-preflight|app-preflight> [options]
+  maggie qa <start|record|summary|export|assertion-audit|cors-preflight|app-preflight|fit-check> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]
@@ -613,10 +622,10 @@ function marketplace(args) {
 function service(args) {
   const root = projectRoot(args);
   const importCommands = ["import-stages-validate", "import-readiness", "fact-provenance"];
-  const scriptName = args[0] === "orchestration-validate" ? "maggie_service_onboarding.py" : importCommands.includes(args[0]) ? "maggie_service_import.py" : "maggie_service_booking.py";
+  const scriptName = args[0] === "orchestration-validate" ? "maggie_service_onboarding.py" : args[0] === "migrate-check" ? "maggie_service_migration.py" : importCommands.includes(args[0]) ? "maggie_service_import.py" : "maggie_service_booking.py";
   const script = toolScript(scriptName, root);
   if (!existsSync(script)) throw new Error(`service booking CLI is missing: ${script}`);
-  const result = spawnSync("python3", [script, ...(scriptName === "maggie_service_onboarding.py" ? args.slice(1) : args)], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
+  const result = spawnSync("python3", [script, ...(["maggie_service_onboarding.py", "maggie_service_migration.py"].includes(scriptName) ? args.slice(1) : args)], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
   if (result.error) throw result.error;
   process.exitCode = result.status ?? 1;
 }
@@ -630,7 +639,8 @@ function seo(args) {
   const command = args[0];
   const scripts = { performance: "maggie_performance.py", images: "maggie_images.py", sitemap: "maggie_sitemap.py", indexnow: "maggie_indexnow.py", "social-cards": "maggie_social_cards.py", "head-tags": "maggie_head_tags.py" };
   if (command === "privacy-check") return workflowCli("maggie_contracts.py", ["privacy-check", ...args.slice(1)]);
-  if (!scripts[command]) throw new Error("seo command must be performance, images, sitemap, indexnow, social-cards, head-tags, or privacy-check");
+  if (command === "origin-check" || command === "fragment-check") return workflowCli("maggie_seo_routes.py", args);
+  if (!scripts[command]) throw new Error("seo command must be performance, images, sitemap, indexnow, social-cards, head-tags, privacy-check, origin-check, or fragment-check");
   workflowCli(scripts[command], args.slice(1));
 }
 
@@ -791,6 +801,7 @@ try {
   else if (command === "seo") seo(args);
   else if (command === "ops") workflowCli("maggie_ops.py", args);
   else if (command === "deployment" && ["bridge-plan", "bridge-collect-script", "bridge-check"].includes(args[0])) workflowCli("maggie_bridge_host.py", args);
+  else if (command === "deployment" && ["cloudflare-preflight", "file-parity", "warm-check", "vps-release"].includes(args[0])) workflowCli("maggie_deployment_ops.py", args);
   else if (command === "mobile") workflowCli("maggie_mobile.py", args);
   else if (command === "assistant") workflowCli("maggie_assistant_tools.py", args);
   else if (command === "product") workflowCli("maggie_product_release.py", args);

package/bundled-contracts/maggie-assistant-tools/booking-receptionist-example-v1.json

@@ -0,0 +1,161 @@
+{
+  "schemaVersion": "maggie-assistant-tool-registry.v1",
+  "description": "Booking receptionist and public discovery MCP for a multi-business booking marketplace. The receptionist answers visitors on one business's page from that business's facts only; it never books, cancels or takes card details \u2014 it opens the normal booking sheet at a real free time.",
+  "visitorPolicy": {
+    "enabledByDefault": false,
+    "dailyCaps": {
+      "perVisitor": 20,
+      "perBusiness": 300
+    },
+    "logAnswers": true,
+    "factsOnly": true,
+    "cardDetails": "never",
+    "handoff": "Show the business's phone and e-mail when the answer is not in its facts."
+  },
+  "mcpServers": [
+    {
+      "name": "discovery",
+      "auth": "none",
+      "rateLimit": {
+        "perIpPerMinute": 30,
+        "perIpPerDay": 2000
+      }
+    },
+    {
+      "name": "owner",
+      "auth": "oauth",
+      "resource": "https://example.com/mcp",
+      "audienceBinding": true
+    }
+  ],
+  "threads": {
+    "storage": "server",
+    "retentionDays": 90,
+    "supportAccess": "with-consent",
+    "deleteOnAccountDeletion": true
+  },
+  "tools": [
+    {
+      "name": "business_facts",
+      "description": "Return this business's treatments with prices and durations, opening hours, address, policies (cancellation, deposit, patch tests) and FAQs. Answer only from this data.",
+      "risk": "read",
+      "scope": "workspace",
+      "channels": [
+        "web-widget",
+        "in-app"
+      ],
+      "user": {
+        "label": "Answer from the business's details",
+        "detail": "Treatments, prices, opening hours and policies."
+      }
+    },
+    {
+      "name": "free_times_find",
+      "description": "Return up to 6 real free start times for a treatment (optionally a team member and a day) from the live availability engine.",
+      "risk": "read",
+      "scope": "workspace",
+      "channels": [
+        "web-widget",
+        "in-app",
+        "mcp"
+      ],
+      "mcpServers": [
+        "discovery",
+        "owner"
+      ],
+      "card": "slot-picker",
+      "user": {
+        "label": "Find free times",
+        "detail": "Real free times you can book."
+      }
+    },
+    {
+      "name": "booking_sheet_open",
+      "description": "Return a link that opens the business's normal booking sheet preselected at the chosen treatment and time. The visitor books and pays there; this tool never books.",
+      "risk": "read",
+      "scope": "workspace",
+      "channels": [
+        "web-widget",
+        "mcp"
+      ],
+      "mcpServers": [
+        "discovery"
+      ],
+      "user": {
+        "label": "Open the booking form",
+        "detail": "You finish the booking yourself."
+      }
+    },
+    {
+      "name": "business_search",
+      "description": "Search published businesses by treatment, town and name; returns names, towns, ratings and profile links.",
+      "risk": "read",
+      "scope": "workspace",
+      "channels": [
+        "mcp",
+        "chatgpt",
+        "claude"
+      ],
+      "mcpServers": [
+        "discovery"
+      ],
+      "card": "list",
+      "user": {
+        "label": "Search businesses",
+        "detail": "Published businesses only."
+      }
+    },
+    {
+      "name": "business_details",
+      "description": "Return one published business's profile: treatments and prices, hours, address, booking link.",
+      "risk": "read",
+      "scope": "workspace",
+      "channels": [
+        "mcp",
+        "chatgpt",
+        "claude"
+      ],
+      "mcpServers": [
+        "discovery"
+      ],
+      "card": "place",
+      "user": {
+        "label": "Show a business",
+        "detail": "Its treatments, prices and hours."
+      }
+    },
+    {
+      "name": "booking_reschedule",
+      "description": "Move one of the signed-in owner's bookings to a new free time after the owner approves the change preview.",
+      "risk": "write-reversible",
+      "scope": "workspace",
+      "channels": [
+        "in-app",
+        "mcp"
+      ],
+      "mcpServers": [
+        "owner"
+      ],
+      "card": "change-preview",
+      "user": {
+        "label": "Move a booking",
+        "detail": "Shows the old and new time first.",
+        "confirm": "Move this booking to the new time and tell the client?"
+      }
+    }
+  ],
+  "cantDo": [
+    {
+      "text": "Book, cancel or change an appointment for you in the chat.",
+      "instead": "Pick a time and finish in the booking form."
+    },
+    {
+      "text": "Take card details.",
+      "instead": "Pay securely in the booking form."
+    },
+    {
+      "text": "Give medical advice.",
+      "instead": "Ask the business, or your doctor."
+    }
+  ]
+}