@topy-ai/maggie 0.7.9 → 0.7.11

package/README.md

@@ -218,8 +218,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.9 update --project . --force
-npx @topy-ai/maggie@0.7.9 cleanup --project .
+npx @topy-ai/maggie@0.7.11 update --project . --force
+npx @topy-ai/maggie@0.7.11 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -229,8 +229,11 @@ as a command-line argument:
 node scripts/publish-npm.mjs --maggie-env-file ../.env
 ```
 
-The 0.7.9 workflow adds nested section-field contracts, renderer-backed
-examples, stable-ID preservation during migration, and disjoint page
+The 0.7.11 workflow adds served-content equivalence checks, query-route
+baseline exclusions, changed-surface render evidence gates, generated skill
+catalogs, component-binding audits, and icon-family noise filtering. It also
+includes the 0.7.9 nested section-field contracts, renderer-backed examples,
+stable-ID preservation during migration, and disjoint page
 inventory guidance. It retains the shared Google integrations runbook and
 fail-closed provider capability matrix, alongside the installable MaggieDash admin distribution and
 audited CMS operations (`cms revisions`,
@@ -248,6 +251,11 @@ observations; every route must include status, canonical, indexability, and
 required metadata checks. Agent content writes require an explicit approved
 origin, same-origin redirects, and recursive credential validation. Feedback
 submissions persist and print only an allowlisted acknowledgement. The release
+also adds image-aware content equivalence with explicit legacy-baseline
+limitations, locale checks for stored image alt text, a validated label/value
+`pairs` section, registry fan-out checks, idempotent reconciliation, per-step
+and section-scoped design evidence, catch-all source confidence, shell-safe VPS
+SSH guidance, and compatible feedback CLI examples. The release
 retains the existing service matching,
 localization, seed-manifest, lockfile/analytics, sitemap, deployment and
 rollback workflows.
@@ -470,7 +478,6 @@ python3 tools/clis/maggie_design.py rebrand \
 | `maggie-feedback` | Collect redacted feedback drafts and explicitly submit them to the NoBlox feedback endpoint |
 | `maggie-auth-reference` | Generate and validate traditional email/password auth with secure server-side sessions |
 | `maggie-blog` | Run a provider-neutral blog lifecycle with stable identity, topics, feeds, settings, and rollback |
-| `maggie-google-capabilities` | Validate redacted Google provider evidence and separate read/report/edit/publish capability states |
 
 `maggie-design` can initialize native blog and service UI plans from a local,
 read-only structural reference:
@@ -490,13 +497,32 @@ maggie design validate-ui --project . \
 This reuses the host project's homepage shell and `DESIGN.md`; it does not
 copy reference branding, source code, private data, or provider facts.
 
-The remaining installable skills are `maggie-blog-bootstrap`, `maggie-dash`,
-`maggie-clone`, `maggie-clone-to-template`, `maggie-marketplace`,
-`maggie-template`, `maggie-design`, `maggie-ops`, `maggie-deployment`,
-`maggie-project-context`, `maggie-social-share`, and `maggie-memory`.
+For existing routes, in-place design jobs are resumable and can be narrowed to
+one section. Catch-all routes remain `unproven` until their content source is
+declared, and each completed step records evidence:
+
+```bash
+maggie design in-place --project . --route /pricing \
+  --content-source src/lib/pages/db.ts
+maggie design step in-place-<id> --project . \
+  --step inspect-route --evidence .maggie/evidence/route.json
+maggie design section --project . --route /pricing --section-id hours
+maggie design section-validate --before before.json --after after.json \
+  --section-id hours
+```
+
+MaggieDash section contracts include a compact `pairs` band for factual
+label/value rows. Validate required values, registry fan-out, locale sidecars,
+and idempotent repairs with `maggie dash sections validate`,
+`fanout-validate`, `locale-validate`, and `reconcile`.
 
-The package also includes `maggie-auth-reference` and `maggie-blog`. Use the
-stable commands below after installation:
+The package includes all 18 installable skills: `maggie-blog-bootstrap`,
+`maggie-dash`, `maggie-clone`, `maggie-clone-to-template`, `maggie-marketplace`,
+`maggie-template`, `maggie-design`, `maggie-ops`, `maggie-deployment`,
+`maggie-project-context`, `maggie-seo-geo`, `maggie-social-share`,
+`maggie-service-booking`, `maggie-memory`, `maggie-content-localization`,
+`maggie-feedback`, `maggie-auth-reference`, and `maggie-blog`. Use the stable
+commands below after installation:
 
 ```bash
 maggie auth reference --project . --confirm

package/bin/maggie.js

@@ -17,26 +17,18 @@ const MARKETPLACE_ROOT = join(PACKAGE_ROOT, "bundled-marketplace");
 const CONTRACTS_ROOT = join(PACKAGE_ROOT, "bundled-contracts");
 const TEMPLATES_ROOT = join(PACKAGE_ROOT, "bundled-templates");
 const STATE_DIR = ".maggie";
-const SKILL_NAMES = [
-  "maggie-blog-bootstrap",
-  "maggie-dash",
-  "maggie-clone",
-  "maggie-clone-to-template",
-  "maggie-marketplace",
-  "maggie-template",
-  "maggie-design",
-  "maggie-ops",
-  "maggie-deployment",
-  "maggie-project-context",
-  "maggie-seo-geo",
-  "maggie-social-share",
-  "maggie-service-booking",
-  "maggie-memory",
-  "maggie-content-localization",
-  "maggie-feedback",
-  "maggie-auth-reference",
-  "maggie-blog",
-];
+function loadSkillNames() {
+  try {
+    return JSON.parse(readFileSync(join(SKILLS_ROOT, "catalog.json"), "utf8")).skills.map((skill) => skill.name);
+  } catch {
+    // Local regression tests may invoke the wrapper before package assembly.
+    // Discover real frontmatter directories and never resurrect retired content.
+    return readdirSync(SKILLS_ROOT, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && entry.name !== "maggie-emdash" && existsSync(join(SKILLS_ROOT, entry.name, "SKILL.md")))
+      .map((entry) => entry.name).sort();
+  }
+}
+const SKILL_NAMES = loadSkillNames();
 const RETIRED_PATHS = [
   ".agents/skills/maggie-emdash",
   ".claude/skills/maggie-emdash",
@@ -66,7 +58,8 @@ Usage:
   maggie doctor [--project PATH]
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
-  maggie dash sections <validate|prompt|keys> [options]
+  maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|reconcile> [options]
+  maggie dash components-audit --bindings-file FILE --sections-file FILE --pages-file FILE
   maggie dash status --project PATH
   maggie dash migrate --project PATH --confirm
   maggie content FILE --source PROVIDER --project PATH --confirm
@@ -92,6 +85,10 @@ Usage:
   maggie design validate-ui --project PATH --plan PATH --rendered-dir PATH --confirm
   maggie design icon-inventory --project PATH --source-dir src --runtime assets/icons.css --output docs/icon-inventory.json
   maggie design author --project PATH --route /about --purpose TEXT --audience TEXT --confirm
+  maggie design in-place --project PATH --route /pricing [--content-source PATH]
+  maggie design section --project PATH --route /pricing --section-id ID
+  maggie design section-validate --before FILE --after FILE --section-id ID
+  maggie design step <job-id> --step NAME --evidence FILE
   maggie auth reference --project PATH --confirm
   maggie auth check --project PATH [--production]
   maggie blog init|inspect|ingest|validate|publish|sitemap|settings|rollback|integration-state

package/bundled-skills/README.md

@@ -13,7 +13,6 @@ Skills are the agent-facing workflows. They compose with the tools in
 | `maggie-template` | Discover, recommend, inspect, and apply a selected Astro homepage template | marketplace catalog, bootstrap state, template `DESIGN.md` |
 | `maggie-design` | Fully clone authorized interior pages, then reconcile them to the homepage header/footer shell | browser MCP, clone planner CLI, completed Maggie homepage |
 | `maggie-ops` | Build, connect, operate, upgrade, and verify the private blog operations dashboard | Ops dashboard contract, authenticated API bridge, host tests |
-| `maggie-google-capabilities` | Validate a redacted Google provider capability matrix without inferring write access | Google integrations runbook, provider evidence |
 | `maggie-deployment` | Deploy and verify a dynamic Maggie blog, Cloudflare-first | Cloudflare Workers, D1, R2, KV, Wrangler |
 | `maggie-project-context` | Sync Project, voice, site and CTA context | project-context CLI/API |
 | `maggie-seo-geo` | Plan, audit, create/rewrite and measure SEO/GEO | visibility, SEO audit, GSC/GA4, content quality |

package/bundled-skills/catalog.json

@@ -0,0 +1,78 @@
+{
+  "schemaVersion": "maggie-skill-catalog.v1",
+  "generatedFrom": "skills/*/SKILL.md",
+  "skills": [
+    {
+      "name": "maggie-auth-reference",
+      "description": "Generate and validate a provider-neutral traditional email/password auth reference with secure server sessions and production security gates."
+    },
+    {
+      "name": "maggie-blog",
+      "description": "Create and operate a provider-neutral blog with stable post identity, topics, draft approval, archive/post routes, RSS, sitemap, settings, and idempotent local ingest."
+    },
+    {
+      "name": "maggie-blog-bootstrap",
+      "description": "Establish a MaggieDash-backed Astro blog or complete a small SEO/GEO-ready blog in an existing project."
+    },
+    {
+      "name": "maggie-clone",
+      "description": "Reverse-engineer an authorized website homepage and create the Maggie homepage foundation inside an existing blog project. Use with /maggie-clone plus a homepage URL when the user wants to replicate the homepage structure, header, footer, assets, responsive behavior, and interactions."
+    },
+    {
+      "name": "maggie-clone-to-template",
+      "description": "Turn an authorized website URL and a design or copy prompt into a validated marketplace template through clone, asset, screenshot, comparison, revision, and packaging gates."
+    },
+    {
+      "name": "maggie-content-localization",
+      "description": "Manage translation, polish, rewrite, market localization, review, stale detection, and publishing for pages, guides, posts, services, products, and categories."
+    },
+    {
+      "name": "maggie-dash",
+      "description": "Manage the MaggieDash project foundation, local content store, and approval lifecycle."
+    },
+    {
+      "name": "maggie-deployment",
+      "description": "Deploy and operate Maggie blog projects with Cloudflare Workers as the default target, while preserving an adapter boundary for VPS, GCP, and AWS."
+    },
+    {
+      "name": "maggie-design",
+      "description": "Design authorized interior pages, review rendered responsive layouts, or explicitly rebrand a packaged homepage/template. Use rebrand only with a named source brand and target brand."
+    },
+    {
+      "name": "maggie-feedback",
+      "description": "Collect, review, and explicitly submit privacy-safe feedback about a Maggie skill run, workflow result, bug, or feature request."
+    },
+    {
+      "name": "maggie-marketplace",
+      "description": "Build, rebrand, localise, validate, version, and apply reusable Astro marketplace templates from an authorised preview URL or local HTML export. Use when adding a design template, creating a neutral demo, or preparing a stable homepage starter for an Astro project."
+    },
+    {
+      "name": "maggie-memory",
+      "description": "Persist and retrieve confirmed user preferences, project conventions, lessons from repaired mistakes, and structured error history across Maggie skill runs."
+    },
+    {
+      "name": "maggie-ops",
+      "description": "Build, connect, operate, upgrade, and verify a private Maggie Ops dashboard for blog content, API Pull, sitemap matching, rewrite approvals, reports, and integrations. Use when the user asks for Ops/admin functionality or lifecycle operations rather than public blog pages."
+    },
+    {
+      "name": "maggie-project-context",
+      "description": "Sync a site's safe AI CMO Project, selected brand voice, site settings, and CTA context into a local generated context file. Use when connecting a vibe-coded blog or existing website to AI CMO, refreshing brand context, or diagnosing missing CTA/project data."
+    },
+    {
+      "name": "maggie-seo-geo",
+      "description": "Plan, audit, create, rewrite, and measure content for AI CMO's paid SEO and GEO workflow. Use for topic opportunities, AI visibility, technical SEO, extractable article structure, sitemap-based rewrites, GSC readback, or SEO/GEO client reports."
+    },
+    {
+      "name": "maggie-service-booking",
+      "description": "Import, synchronise, validate, and design SPA service pages from a booking provider such as Fresha. Use for service catalogues, treatment variants, prices, durations, booking links, payment links, and booking-aware page generation."
+    },
+    {
+      "name": "maggie-social-share",
+      "description": "Turn approved AI CMO articles and content assets into platform-native social drafts, scheduled posts, and measured distribution. Use for Social Share planning, LinkedIn/Facebook copy, CTA mapping, calendars, approvals, publish retries, or social performance readback."
+    },
+    {
+      "name": "maggie-template",
+      "description": "Discover, recommend, inspect, and apply verified Astro homepage templates from the Maggie marketplace. Use when a user wants to start a site from a selected template, compare available designs, or choose a visual direction before maggie-clone or maggie-design."
+    }
+  ]
+}

package/bundled-skills/maggie-dash/SKILL.md

@@ -177,6 +177,20 @@ maggie dash sections validate --registry templates/maggiedash/section-registry.j
 maggie dash sections prompt --registry templates/maggiedash/section-registry.json
 maggie dash sections keys --registry templates/maggiedash/section-registry.json \
   --page-id <page-id> --sections-file .maggie/sections.json
+maggie dash sections remap-translations \
+  --translations-file .maggie/translations-legacy.json \
+  --mapping-file .maggie/section-translation-map.json \
+  --output .maggie/translations-v2.json --confirm
+
+# Validate locale sidecars for stored image alt text before publishing:
+maggie dash sections locale-validate \
+  --page-id <page-id> --sections-file .maggie/sections.json \
+  --translations-file .maggie/translations-by-locale.json --locale zh-Hant
+
+# Check that a host wired every registry type through all implementation surfaces:
+maggie dash sections fanout-validate \
+  --registry templates/maggiedash/section-registry.json \
+  --fanout-file templates/maggiedash/section-fanout.json
 ```
 
 The catalogue declares purpose, usage, placement, repeatability and layout
@@ -184,10 +198,24 @@ limits, renderer-owned examples, and the shape of repeated entries. A repeat
 may contain an object (`title`, `body`, `href`, and so on), not just a count;
 the nested limits are displayed to the planner and checked by `sections
 validate`. Over-limit copy is an editor note; unknown types fail validation.
-The starter registry is provider-neutral and extensible: a host may add its
-own renderer-backed bands, but every added band must have a real-renderer
-preview or an explicitly labelled example fallback at the supported
-breakpoints. Do not describe the vocabulary as a fixed number of bands.
+The registry is intentionally marked `catalogStatus: starter`, not presented
+as a production-complete vocabulary. Hosts commonly add renderer-backed bands
+such as `form`, `map`, `steps`, `checklist`, `compare`, `quote`, `timeline`,
+`gallery`, `stats`, `split`, `glossary`, `credentials`, `team`, `before-after`,
+`statement`, `features`, `scope`, `animated`, `opening`, `breadcrumb`, and
+`bound-collection`; the machine-readable registry lists these examples. Every
+added band must have a real-renderer preview or an explicitly labelled example
+fallback at the supported breakpoints. Do not describe the starter vocabulary
+as a fixed number of bands.
+
+Required fields and repeated `pairs` values cannot be blank. The `pairs`
+starter band is intended for compact label/value facts such as opening hours;
+it is not a prose fallback. The registry fan-out manifest is a host integration
+contract: when a host adds a type, update its type union/schema, blank state,
+validation, readable-content extraction, renderer, and editor entry together,
+then run `fanout-validate`. `locale-validate` checks stored image-alt sidecars;
+the host adapter must write the section and all non-default locale rows in one
+transaction. The JSON report is evidence, not a database write.
 
 Translation keys use stable section IDs, with an array-index fallback only
 until the ordered migration is complete. Migration preserves unique IDs that
@@ -195,6 +223,13 @@ already belong to the source section list; it generates a new ID only for a
 missing, duplicate, or target-conflicting ID. Never rebuild IDs from array
 position or overwrite existing translation keys.
 
+When copy already lives under another keyspace, generate an explicit prefix
+mapping from the converter and run `remap-translations`. The helper applies
+longest prefixes first, preserves unmapped keys for review, and fails on
+conflicting destinations. For a database adapter, apply the section rows and
+translation remap in one transaction with the same migration ID; the JSON CLI
+is the reviewable output form, not a substitute for the adapter's transaction.
+
 Keep data-owned values out of page copy. For example, a pricing band should
 store a service identifier or slug and let the live service/booking adapter
 render current options and prices. Inventory reports must classify each

package/bundled-skills/maggie-deployment/SKILL.md

@@ -30,6 +30,12 @@ errors, missing assets, or visual placeholders. The result follows
 `maggie-deployment-canary.v1`; never include cookies, authorization headers, or
 response bodies in it.
 
+When a release changes a visitor-facing HTML, CSS, component, or asset surface,
+the release preflight automatically requires both a passing icon inventory and
+rendered canary evidence. The canary must include screenshots, zero console or
+network errors, and zero placeholder matches. Query-driven routes belong in
+behavior/API checks, not static byte baselines.
+
 ## Automatic memory hook
 
 Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and completion.

package/bundled-skills/maggie-deployment/references/vps.md

@@ -37,6 +37,39 @@ systemd service, environment file, Nginx/TLS configuration, release root,
 database/media migration and backup strategy, health checks, and rollback
 owner before any remote mutation.
 
+### SSH and secret-source contract
+
+Use these canonical project variables when a VPS adapter is configured:
+
+| Variable | Meaning | Precedence |
+| --- | --- | --- |
+| `NOBLOX_DEPLOY_HOST` | VPS hostname or IP | explicit CLI flag, then project `.env`, then provider secret manager |
+| `NOBLOX_DEPLOY_SSH_USER` | SSH login user | explicit CLI flag, then project `.env`, then provider secret manager |
+| `NOBLOX_DEPLOY_SSH_PORT` | SSH port | explicit CLI flag, then project `.env`, then provider secret manager |
+| `NOBLOX_DEPLOY_SSH_KEY` | path or secret reference for the private key | explicit CLI flag, then project `.env`, then provider secret manager |
+| `NOBLOX_DEPLOY_ENV_FILE` | remote runtime env-file reference | provider secret manager only for the secret values |
+
+Legacy provider-specific names may be supported by an adapter, but must be
+mapped to these names in the local plan. The SSH key is preferred. Do not put
+an SSH password in a plan or command line; if password authentication is
+unavoidable, resolve `NOBLOX_DEPLOY_SSH_PASSWORD` at execution time from the
+approved secret manager and never echo it. Explicit CLI values override `.env`;
+`.env` overrides the provider adapter's default names. Values are validated by
+name and presence only, never printed.
+
+When composing SSH options in Bash or zsh, use an array so whitespace is not
+reinterpreted as extra arguments:
+
+```zsh
+ssh_opts=(-o StrictHostKeyChecking=accept-new -o BatchMode=yes)
+ssh "${ssh_opts[@]}" -p "$NOBLOX_DEPLOY_SSH_PORT" \
+  "$NOBLOX_DEPLOY_SSH_USER@$NOBLOX_DEPLOY_HOST" "systemctl is-active example"
+```
+
+Do not use `ssh_opts='-o StrictHostKeyChecking=accept-new -o BatchMode=yes'`
+followed by `ssh $ssh_opts ...`; zsh does not perform the word splitting that
+this pattern assumes.
+
 Create a local, secret-free plan before remote execution:
 
 ```bash

package/bundled-skills/maggie-design/SKILL.md

@@ -10,13 +10,33 @@ metadata:
 ## In-place route evidence
 
 `maggie design in-place --project . --route /example` resolves local source
-files and falls back to a discovered `[...slug]`/`[[...slug]]` file. That
-fallback is currently a source candidate, not proof that the concrete URL is
-served. Verify the route's HTTP response, content identity and framework route
+files and falls back to a discovered `[...slug]`/`[[...slug]]` file. A catch-all
+is recorded as `resolution: unproven` unless `--content-source` names the
+actual DB/content resolver. A source candidate is not proof that the concrete
+URL is served: verify the HTTP response, content identity, and framework route
 mapping before editing a shared catch-all. Next app-router catch-alls whose
-file is named `page.tsx` are not covered by this filename fallback. Capture
-responsive and interaction evidence separately; a plan in phase `ready` is
-not a successful browser test.
+file is named `page.tsx` are not covered by this filename fallback.
+
+In-place work is resumable. Record each completed step and its evidence:
+
+```bash
+maggie design step in-place-<id> --project . \
+  --step inspect-route --evidence .maggie/evidence/route.json
+maggie design status in-place-<id> --project .
+```
+
+The job becomes `done` only after every required step has evidence; `ready`
+means the contract exists, not that browser QA passed. For a one-band change,
+use section-scoped mode and validate before/after evidence:
+
+```bash
+maggie design section --project . --route /pricing --section-id hours
+maggie design section-validate --before before.json --after after.json \
+  --section-id hours
+```
+
+The validator requires the target section to change and proves that every
+other section remains unchanged.
 
 ## Source-to-runtime icon inventory
 
@@ -34,8 +54,10 @@ Use `missing`, `unknown`, and `coverage` from the versioned
 `maggie-icon-inventory.v1` report as the release gate. A binary font without a
 name map is reported as evidence only; it must not be treated as proof that a
 glyph exists. Fix the source token or add the runtime definition before
-shipping. Do not paste private source, URLs with credentials, or user data
-into the report.
+shipping. The inventory compares a scoped runtime icon family (`ph-*`, `fa-*`,
+or `lucide-*`), normalizes family prefixes, and ignores inline SVG IDs and font
+filename noise. Do not paste private source, URLs with credentials, or user
+data into the report.
 
 ## Automatic memory hook
 

package/bundled-skills/maggie-feedback/SKILL.md

@@ -16,7 +16,7 @@ general lesson or regression test.
 ## Collect locally
 
 ```bash
-maggie feedback collect --project . \
+maggie feedback --project . collect \
   --skill maggie-clone-to-template --run-id clone-001 \
   --type bug --phase visual-qa \
   --summary "Mobile hero overflows the viewport" \
@@ -26,6 +26,7 @@ maggie feedback collect --project . \
   --reproduce "Run the clone workflow" \
   --reproduce "Open the mobile screenshot" \
   --screenshot ./screenshots/mobile.png
+# The equivalent `maggie feedback collect --project . ...` spelling is also supported.
 maggie feedback preview .maggie/feedback/<feedback-id>.json --format markdown
 ```
 

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -83,8 +83,13 @@ automatically replace the baseline following failure. Dynamic dates, class
 names and copy can produce legitimate differences requiring review.
 
 This covers server-rendered sitemap pages, not CSS rendering, JavaScript-only
-content, database translation keys or browser interactions. A source key change
-is detected here only when it changes served content. Baselines contain site
+content, database translation keys or browser interactions. Query-string URLs
+are recorded as excluded from byte baselines because they often represent
+search/filter state; use browser or API-specific tests for those states. The
+baseline now compares a served-content contract (headings, paragraphs and
+links) alongside metadata and structure, so a section migration cannot pass
+merely because the HTML byte shape stayed similar. A source key change is
+detected here only when it changes served content. Baselines contain site
 metadata; do not publish private project contracts without permission.
 
 ## Browser behavior evidence

package/bundled-templates/maggiedash/section-fanout.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": "maggiedash-section-fanout.v1",
+  "description": "Starter host contract: every registry type must be wired through each implementation surface. Hosts extending the registry must regenerate this file.",
+  "typeUnion": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
+  "sectionSchema": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
+  "blank": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
+  "validation": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
+  "textExtraction": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
+  "renderer": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"],
+  "editor": ["cards", "cta", "faq", "hero", "links", "pairs", "prose"]
+}

package/bundled-templates/maggiedash/section-registry.json

@@ -1,6 +1,8 @@
 {
   "schemaVersion": "maggiedash-section-registry.v1",
   "description": "The provider-neutral starter vocabulary used by page planners and editors. Hosts may extend it with renderer-backed section types.",
+  "catalogStatus": "starter",
+  "hostExtensionExamples": ["form", "map", "steps", "checklist", "compare", "quote", "timeline", "gallery", "stats", "split", "glossary", "credentials", "team", "before-after", "statement", "features", "scope", "animated", "opening", "breadcrumb", "bound-collection"],
   "sections": [
     {
       "type": "hero",
@@ -31,6 +33,19 @@
       ],
       "example": {"type": "prose", "heading": "Make the important part easier to understand", "paragraphs": ["Start with the decision your reader is trying to make.", "Then give them the context, evidence and next step in that order."]}
     },
+    {
+      "type": "pairs",
+      "purpose": "Shows named facts as a compact label-and-value band.",
+      "usage": "Use for opening hours, specifications, eligibility, or other factual pairs; never for long prose.",
+      "position": "body",
+      "repeatable": true,
+      "fields": [
+        {"name": "heading", "usage": "What the facts describe.", "limit": 90, "required": true},
+        {"name": "rows", "usage": "Non-empty factual label/value pairs.", "limit": 0, "repeats": {"min": 1, "max": 12, "of": [{"name": "label", "usage": "The fact name.", "limit": 70, "required": true}, {"name": "value", "usage": "The concise fact value; never blank.", "limit": 180, "required": true}]}},
+        {"name": "note", "usage": "Optional clarification below the facts.", "limit": 220}
+      ],
+      "example": {"type": "pairs", "heading": "At a glance", "rows": [{"label": "Typical response", "value": "Within one working day"}, {"label": "Available", "value": "Monday to Friday"}], "note": "Times may change on public holidays."}
+    },
     {
       "type": "cards",
       "purpose": "Presents parallel points side by side.",

package/bundled-tools/clis/maggie_dash.py

@@ -23,7 +23,8 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
 from maggie_dash_store import MaggieDashStore  # noqa: E402
 from service_variants import ServiceVariantStore  # noqa: E402
 from maggie_dash_ui import load_and_validate  # noqa: E402
-from maggie_sections import catalogue, section_id_migration, validate_registry, copy_notes  # noqa: E402
+from maggie_sections import catalogue, remap_translations, section_id_migration, validate_registry, copy_notes, validate_values, validate_fanout, reconcile_fields, validate_locale_coverage  # noqa: E402
+from route_imports import classify_bindings  # noqa: E402
 
 
 def project_root(args: argparse.Namespace) -> Path:
@@ -319,6 +320,47 @@ def command_ui(args: argparse.Namespace) -> int:
 
 
 def command_sections(args: argparse.Namespace) -> int:
+    if args.sections_command == "remap-translations":
+        require_confirm(args)
+        translations = json.loads(Path(args.translations_file).resolve().read_text(encoding="utf-8"))
+        mappings = json.loads(Path(args.mapping_file).resolve().read_text(encoding="utf-8"))
+        result = remap_translations(translations, mappings)
+        if result["passed"]:
+            output = Path(args.output).resolve()
+            if output.exists() and not args.force:
+                raise ValueError(f"output exists; use --force to replace: {output}")
+            output.parent.mkdir(parents=True, exist_ok=True)
+            output.write_text(json.dumps(result["translations"], indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+            result["output"] = str(output)
+        emit(result)
+        return 0 if result["passed"] else 1
+    if args.sections_command == "fanout-validate":
+        registry = json.loads(Path(args.registry).resolve().read_text(encoding="utf-8"))
+        fanout = json.loads(Path(args.fanout_file).resolve().read_text(encoding="utf-8"))
+        checked = validate_registry(registry)
+        result = {**validate_fanout(registry, fanout), "registry": checked}
+        emit(result)
+        return 0 if result["passed"] and checked["passed"] else 1
+    if args.sections_command == "reconcile":
+        current = json.loads(Path(args.current_file).resolve().read_text(encoding="utf-8"))
+        desired = json.loads(Path(args.desired_file).resolve().read_text(encoding="utf-8"))
+        result = reconcile_fields(current, desired)
+        if result["passed"]:
+            require_confirm(args)
+            output = Path(args.output).resolve()
+            if output.exists() and not args.force:
+                raise ValueError(f"output exists; use --force to replace: {output}")
+            output.parent.mkdir(parents=True, exist_ok=True)
+            output.write_text(json.dumps(result["result"], indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+            result["output"] = str(output)
+        emit(result)
+        return 0 if result["passed"] else 1
+    if args.sections_command == "locale-validate":
+        sections = json.loads(Path(args.sections_file).resolve().read_text(encoding="utf-8"))
+        translations = json.loads(Path(args.translations_file).resolve().read_text(encoding="utf-8"))
+        result = validate_locale_coverage(args.page_id, sections, translations, args.locale)
+        emit(result)
+        return 0 if result["passed"] else 1
     registry = json.loads(Path(args.registry).resolve().read_text(encoding="utf-8"))
     checked = validate_registry(registry)
     if not checked["passed"]:
@@ -329,14 +371,31 @@ def command_sections(args: argparse.Namespace) -> int:
         return 0
     if args.sections_command == "validate":
         sections = json.loads(Path(args.sections_file).resolve().read_text(encoding="utf-8"))
-        result = {**checked, "copy": copy_notes(registry, sections)}
+        result = {**checked, "copy": copy_notes(registry, sections), "values": validate_values(registry, sections)}
         emit(result)
-        return 0 if result["copy"]["passed"] else 1
+        return 0 if result["copy"]["passed"] and result["values"]["passed"] else 1
     sections = json.loads(Path(args.sections_file).resolve().read_text(encoding="utf-8"))
     emit(section_id_migration(args.page_id, sections))
     return 0
 
 
+def command_components_audit(args: argparse.Namespace) -> int:
+    bindings = json.loads(Path(args.bindings_file).resolve().read_text(encoding="utf-8"))
+    sections = json.loads(Path(args.sections_file).resolve().read_text(encoding="utf-8"))
+    pages = json.loads(Path(args.pages_file).resolve().read_text(encoding="utf-8"))
+    result = classify_bindings(
+        bindings if isinstance(bindings, list) else bindings.get("bindings", []),
+        set(sections if isinstance(sections, list) else sections.get("paths", [])),
+        set(pages if isinstance(pages, list) else pages.get("paths", [])),
+    )
+    if args.output:
+        output = Path(args.output).resolve(); output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+        result["output"] = str(output)
+    emit(result)
+    return 0 if result["passed"] else 1
+
+
 def variant_store(args: argparse.Namespace) -> ServiceVariantStore:
     return ServiceVariantStore(project_root(args) / ".maggie" / "service-variants.json")
 
@@ -449,7 +508,25 @@ def parser() -> argparse.ArgumentParser:
     sections_prompt.set_defaults(func=command_sections)
     sections_keys = sections_sub.add_parser("keys")
     sections_keys.add_argument("--registry", required=True); sections_keys.add_argument("--sections-file", required=True); sections_keys.add_argument("--page-id", required=True)
+    sections_remap = sections_sub.add_parser("remap-translations", help="move an existing translation keyspace into stable section keys")
+    sections_remap.add_argument("--translations-file", required=True); sections_remap.add_argument("--mapping-file", required=True); sections_remap.add_argument("--output", required=True); sections_remap.add_argument("--force", action="store_true"); sections_remap.add_argument("--confirm", action="store_true")
+    sections_remap.set_defaults(func=command_sections)
+    sections_fanout = sections_sub.add_parser("fanout-validate", help="check registry type fan-out across host implementation surfaces")
+    sections_fanout.add_argument("--registry", required=True); sections_fanout.add_argument("--fanout-file", required=True)
+    sections_fanout.set_defaults(func=command_sections)
+    sections_reconcile = sections_sub.add_parser("reconcile", help="apply an idempotent compare-and-set JSON repair")
+    sections_reconcile.add_argument("--current-file", required=True); sections_reconcile.add_argument("--desired-file", required=True); sections_reconcile.add_argument("--output", required=True); sections_reconcile.add_argument("--force", action="store_true"); sections_reconcile.add_argument("--confirm", action="store_true")
+    sections_reconcile.set_defaults(func=command_sections)
+    sections_locale = sections_sub.add_parser("locale-validate", help="check locale sidecar coverage for stored image alt fields")
+    sections_locale.add_argument("--page-id", required=True); sections_locale.add_argument("--sections-file", required=True); sections_locale.add_argument("--translations-file", required=True); sections_locale.add_argument("--locale", action="append", required=True)
+    sections_locale.set_defaults(func=command_sections)
     sections_keys.set_defaults(func=command_sections)
+    components = sub.add_parser("components-audit", help="classify route component bindings against live section/page inventories")
+    components.add_argument("--bindings-file", required=True)
+    components.add_argument("--sections-file", required=True, help="JSON array/object of section-managed paths")
+    components.add_argument("--pages-file", required=True, help="JSON array/object of live page paths")
+    components.add_argument("--output")
+    components.set_defaults(func=command_components_audit)
     variant = sub.add_parser("variant", help="manage service variant lifecycle")
     variant_sub = variant.add_subparsers(dest="variant_command", required=True)
     create = variant_sub.add_parser("create"); create.add_argument("--project", default="."); create.add_argument("--service-id", required=True); create.add_argument("--variant-id", required=True); create.add_argument("--variant-type", required=True); create.add_argument("--locale", required=True); create.add_argument("--market", required=True); create.add_argument("--slug", required=True); create.add_argument("--title", required=True); create.add_argument("--facts", required=True); create.add_argument("--source-revision", required=True); create.add_argument("--canonical-variant-id"); create.add_argument("--cluster-link", action="append", default=[]); create.add_argument("--layout-family", default="service-default"); create.add_argument("--confirm", action="store_true")