@topy-ai/maggie 0.7.47 → 0.7.48

package/bundled-tools/clis/maggie_booking_vouchers.py

@@ -0,0 +1,185 @@
+"""Validate the Booking gift voucher lifecycle contract and host ledger fixtures."""
+
+from __future__ import annotations
+
+from datetime import datetime
+
+
+CONTRACT_SCHEMA = "maggiedash-booking-voucher-lifecycle.v1"
+LEDGER_SCHEMA = "maggiedash-booking-voucher-ledger.v1"
+STATES = ["pending_payment", "active", "exhausted", "expired", "voided", "refunded"]
+ENTRY_TYPES = ["issue", "redeem", "undo_redeem", "void", "expire", "refund"]
+PERMISSIONS = ["vouchers.read", "vouchers.sell", "vouchers.redeem", "vouchers.void", "vouchers.refund"]
+NOTIFICATIONS = ["voucher.purchase.confirmed", "voucher.delivered", "voucher.redeemed", "voucher.refunded", "voucher.expiry_reminder"]
+ENDPOINTS = ["booking.vouchers.read", "booking.vouchers.sell", "booking.vouchers.redeem", "booking.vouchers.undo", "booking.vouchers.void", "booking.vouchers.refund"]
+# A ledger fixture is evidence, not a code store: the full code must never appear.
+FORBIDDEN_KEYS = {"code", "voucherCode", "rawCode", "secret", "hmacSecret"}
+
+
+def voucher_contract_checks(contract: dict) -> list[str]:
+    errors: list[str] = []
+    if contract.get("schemaVersion") != CONTRACT_SCHEMA: errors.append(f"schemaVersion must be {CONTRACT_SCHEMA}")
+    if contract.get("status") != "contract": errors.append("status must be contract")
+    runtime = contract.get("runtime") or {}
+    if runtime.get("owner") != "host" or runtime.get("maggieDashRuntime") is not False: errors.append("voucher runtime must be host-owned; MaggieDash ships no voucher runtime")
+    if contract.get("apiPrefix") != "/api/maggie/booking/vouchers.json": errors.append("apiPrefix must be /api/maggie/booking/vouchers.json")
+    auth = contract.get("auth") or {}
+    if auth.get("managerSession") != "host-session-cookie" or auth.get("emailPassword") is not True or auth.get("passkeys") is not False: errors.append("auth must use the host email/password session")
+    if contract.get("permissions") != PERMISSIONS: errors.append("voucher permissions are incomplete or out of order")
+    money = contract.get("money") or {}
+    if money.get("unit") != "minor" or money.get("integerOnly") is not True: errors.append("voucher money must be integer minor units")
+    channels = contract.get("channels") or {}
+    online, till = channels.get("online") or {}, channels.get("till") or {}
+    if online.get("provider") != "stripe" or online.get("nativeGiftCards") is not False: errors.append("online vouchers must be funded by Stripe payments with a local ledger, not a native gift card")
+    if not till.get("paymentMethods"): errors.append("till vouchers must declare recorded payment methods")
+    code_format = contract.get("codeFormat") or {}
+    if (code_format.get("online") or {}).get("check") != "hmac-sha256": errors.append("online codes must carry an HMAC check segment")
+    if not (code_format.get("till") or {}).get("check"): errors.append("till codes must carry a check digit")
+    if "codeHash" not in str(code_format.get("storage", "")): errors.append("code storage must keep only a hash and last four characters")
+    if contract.get("states") != STATES: errors.append("voucher states are incomplete or out of order")
+    ledger = contract.get("ledger") or {}
+    if ledger.get("appendOnly") is not True: errors.append("voucher ledger must be append-only")
+    if ledger.get("entryTypes") != ENTRY_TYPES: errors.append("voucher ledger entry types are incomplete or out of order")
+    rules = contract.get("rules") or {}
+    for rule in ("issue", "partialRedemption", "undo", "void", "expiry", "refund", "fullRefund"):
+        if not str(rules.get(rule, "")).strip(): errors.append(f"voucher rule is missing: {rule}")
+    notifications = [item.get("id") for item in contract.get("notifications", []) if isinstance(item, dict)]
+    if notifications != NOTIFICATIONS: errors.append("voucher notification events are incomplete or out of order")
+    if contract.get("endpointIds") != ENDPOINTS: errors.append("voucher endpoint IDs are incomplete or out of order")
+    routes = contract.get("canonicalRoutes") or {}
+    if set(routes) != set(ENDPOINTS): errors.append("voucher canonical routes are incomplete")
+    policy = contract.get("policy") or {}
+    for field in ("tenantScoped", "auditRequired", "idempotencyRequiredForMutations", "fullCodeOnlyInDeliveryEmail", "providerCredentialsRemainServerOnly"):
+        if policy.get(field) is not True: errors.append(f"voucher policy {field} must be true")
+    return errors
+
+
+def _time(value: object) -> datetime | None:
+    try:
+        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    return parsed if parsed.tzinfo else None
+
+
+def _forbidden_paths(value: object, path: str = "") -> list[str]:
+    found: list[str] = []
+    if isinstance(value, dict):
+        for key, item in value.items():
+            child = f"{path}.{key}" if path else key
+            if key in FORBIDDEN_KEYS: found.append(child)
+            found.extend(_forbidden_paths(item, child))
+    elif isinstance(value, list):
+        for index, item in enumerate(value):
+            found.extend(_forbidden_paths(item, f"{path}[{index}]"))
+    return found
+
+
+def replay_voucher(voucher: dict, now: datetime | None = None) -> tuple[dict, list[str]]:
+    """Replay one voucher ledger and return its derived state plus rule violations."""
+    vid = str(voucher.get("id") or "unknown")
+    errors: list[str] = []
+    face = voucher.get("faceValue")
+    channel = voucher.get("channel")
+    if channel not in ("online", "till"): errors.append(f"{vid}: channel must be online or till")
+    if not isinstance(face, int) or isinstance(face, bool) or face <= 0: errors.append(f"{vid}: faceValue must be a positive integer in minor units")
+    expires_at = _time(voucher.get("expiresAt")) if voucher.get("expiresAt") else None
+    if voucher.get("expiresAt") and expires_at is None: errors.append(f"{vid}: expiresAt must be an ISO timestamp with a timezone")
+    entries = voucher.get("entries")
+    if not isinstance(entries, list) or not entries:
+        return {"id": vid, "balance": 0, "status": None}, errors + [f"{vid}: ledger entries are required"]
+    balance = funded = refunded = 0
+    paid = channel == "till"
+    voided = expired = False
+    redeems: dict[str, int] = {}
+    undone: set[str] = set()
+    redeemed_any = False
+    previous: datetime | None = None
+    seen_ids: set[str] = set()
+    for index, entry in enumerate(entries):
+        label = f"{vid}: entry {entry.get('id') or index}"
+        kind, amount, at = entry.get("type"), entry.get("amount"), _time(entry.get("at"))
+        entry_id = str(entry.get("id") or "")
+        if not entry_id or entry_id in seen_ids: errors.append(f"{label}: entry id must be present and unique")
+        seen_ids.add(entry_id)
+        if kind not in ENTRY_TYPES: errors.append(f"{label}: unsupported entry type"); continue
+        if at is None: errors.append(f"{label}: at must be an ISO timestamp with a timezone"); continue
+        if previous and at < previous: errors.append(f"{label}: ledger entries must be in chronological order")
+        previous = at
+        if kind != "issue" and kind not in ("void", "expire") and (not isinstance(amount, int) or isinstance(amount, bool) or amount <= 0):
+            errors.append(f"{label}: amount must be a positive integer"); continue
+        if kind != "issue" and not str(entry.get("idempotencyKey", "")).strip(): errors.append(f"{label}: mutations require an idempotencyKey")
+        if index == 0 and kind != "issue": errors.append(f"{label}: the first entry must be issue"); continue
+        if kind == "issue":
+            if index != 0: errors.append(f"{label}: only one issue entry is allowed"); continue
+            if amount != face: errors.append(f"{label}: issue amount must equal faceValue")
+            balance = funded = face if isinstance(face, int) else 0
+            if channel == "online":
+                paid = bool(entry.get("paymentRef"))
+                if not paid: errors.append(f"{label}: online issue requires the verified provider paymentRef")
+            continue
+        if voided: errors.append(f"{label}: no {kind} is allowed after void"); continue
+        if kind == "void":
+            if not str(entry.get("reason", "")).strip(): errors.append(f"{label}: void requires a reason")
+            voided = True
+            continue
+        if kind == "expire":
+            if expires_at is None or at < expires_at: errors.append(f"{label}: expire before expiresAt")
+            expired = True
+            continue
+        if kind == "redeem":
+            if expires_at is not None and at >= expires_at: errors.append(f"{label}: redemption at or after expiry is blocked"); continue
+            if not paid: errors.append(f"{label}: redemption before payment is blocked"); continue
+            if amount > balance: errors.append(f"{label}: redemption exceeds the remaining balance"); continue
+            balance -= amount
+            redeems[entry_id] = amount
+            redeemed_any = True
+            continue
+        if kind == "undo_redeem":
+            target = str(entry.get("reverses") or "")
+            if target not in redeems: errors.append(f"{label}: undo must reverse an earlier redeem entry"); continue
+            if target in undone: errors.append(f"{label}: a redemption can be undone only once"); continue
+            if amount != redeems[target]: errors.append(f"{label}: undo amount must equal the reversed redemption"); continue
+            undone.add(target)
+            balance += amount
+            continue
+        if kind == "refund":
+            if amount > balance: errors.append(f"{label}: refund exceeds the remaining balance"); continue
+            if refunded + amount > funded: errors.append(f"{label}: refund exceeds the funded amount"); continue
+            if channel == "online" and not entry.get("paymentRef"): errors.append(f"{label}: online refunds must reference the original provider payment")
+            if channel == "till" and not entry.get("refundMethod"): errors.append(f"{label}: till refunds must record refundMethod")
+            balance -= amount
+            refunded += amount
+    if balance < 0: errors.append(f"{vid}: balance became negative")
+    # Status is evaluated at the later of the fixture clock and the ledger's own last entry.
+    now = now or datetime.now().astimezone()
+    if previous and previous > now: now = previous
+    if voided: status = "voided"
+    elif not paid: status = "pending_payment"
+    elif refunded and balance == 0 and not redeemed_any: status = "refunded"
+    elif balance == 0: status = "exhausted"
+    elif expired or (expires_at is not None and now >= expires_at): status = "expired"
+    else: status = "active"
+    declared = voucher.get("status")
+    if declared is not None and declared != status: errors.append(f"{vid}: declared status {declared} does not match the ledger ({status})")
+    declared_balance = voucher.get("balance")
+    if declared_balance is not None and declared_balance != balance: errors.append(f"{vid}: declared balance {declared_balance} does not match the ledger ({balance})")
+    return {"id": vid, "balance": balance, "status": status, "refunded": refunded}, errors
+
+
+def voucher_ledger_checks(fixture: dict) -> tuple[list[dict], list[str]]:
+    errors: list[str] = []
+    if fixture.get("schemaVersion") != LEDGER_SCHEMA: errors.append(f"ledger schemaVersion must be {LEDGER_SCHEMA}")
+    errors.extend(f"ledger must not contain full codes or secrets: {path}" for path in _forbidden_paths(fixture))
+    now = _time(fixture.get("now")) if fixture.get("now") else None
+    if fixture.get("now") and now is None: errors.append("ledger now must be an ISO timestamp with a timezone")
+    vouchers = fixture.get("vouchers")
+    if not isinstance(vouchers, list) or not vouchers:
+        return [], errors + ["ledger must contain at least one voucher"]
+    results = []
+    for voucher in vouchers:
+        if not isinstance(voucher, dict): errors.append("voucher entries must be objects"); continue
+        result, voucher_errors = replay_voucher(voucher, now)
+        results.append(result)
+        errors.extend(voucher_errors)
+    return results, errors

package/bundled-tools/clis/maggie_clone_to_template.py

@@ -58,6 +58,8 @@ def job_args(job: dict, marketplace: Path, template_id: str) -> argparse.Namespa
     values.setdefault("tag", [])
     values.setdefault("site_url", None)
     values.setdefault("sample", None)
+    values.setdefault("display_name", None)
+    values.setdefault("display_description", None)
     return argparse.Namespace(**values)
 
 
@@ -169,6 +171,7 @@ def plan_job(args: argparse.Namespace) -> int:
         "options": {
             "provider": args.provider, "brand": args.brand, "category": args.category,
             "tag": args.tag, "site_url": args.site_url, "sample": str(args.sample) if args.sample else None,
+            "display_name": getattr(args, "display_name", None), "display_description": getattr(args, "display_description", None),
         },
         "history": [{"phase": "STARTED", "at": now()}],
     }
@@ -222,6 +225,13 @@ def package_step(args: argparse.Namespace) -> int:
         command.extend(("--site-url", options.site_url))
     if options.sample:
         command.extend(("--sample", str(options.sample)))
+    # The customer-facing style name is neutral and separate from source
+    # evidence; without an explicit name the importer derives one from the
+    # measured design and checks it against the source brand and catalog.
+    if options.display_name:
+        command.extend(("--display-name", options.display_name))
+    if options.display_description:
+        command.extend(("--display-description", options.display_description))
     try:
         result = subprocess.run(command, cwd=marketplace.parent)
         template = marketplace / "templates" / template_id
@@ -363,6 +373,8 @@ def main() -> int:
     plan_parser.add_argument("--category", action="append", default=[])
     plan_parser.add_argument("--tag", action="append", default=[])
     plan_parser.add_argument("--sample", type=Path)
+    plan_parser.add_argument("--display-name", help="neutral customer-facing style name; never the source brand")
+    plan_parser.add_argument("--display-description")
     plan_parser.add_argument("--force", action="store_true")
     plan_parser.set_defaults(func=plan_job)
     for name, func, help_text in (
@@ -390,6 +402,8 @@ def main() -> int:
     run_parser.add_argument("--category", action="append", default=[])
     run_parser.add_argument("--tag", action="append", default=[])
     run_parser.add_argument("--sample", type=Path)
+    run_parser.add_argument("--display-name", help="neutral customer-facing style name; never the source brand")
+    run_parser.add_argument("--display-description")
     run_parser.add_argument("--force", action="store_true")
     run_parser.set_defaults(func=run)
     status_parser = sub.add_parser("status", help="inspect a URL-to-template job")

package/bundled-tools/clis/maggie_deployment.py

@@ -81,6 +81,238 @@ def credential_preflight_main(argv: list[str]) -> int:
     return 0 if result["passed"] else 1
 
 
+ENV_KEY_RE = re.compile(r"[A-Za-z_][A-Za-z0-9_]{0,127}")
+SHA256_RE = re.compile(r"[0-9a-f]{64}")
+DATABASE_URL_KEYS = ("DATABASE_URL", "POSTGRES_URL", "POSTGRES_PRISMA_URL", "PG_URL", "MYSQL_URL", "MONGODB_URI", "REDIS_URL")
+DATABASE_HOST_KEYS = ("DB_HOST", "PGHOST", "POSTGRES_HOST", "MYSQL_HOST", "DATABASE_HOST")
+LOCAL_DATABASE_HOSTS = {"localhost", "127.0.0.1", "::1", "0.0.0.0", "db", "postgres", "host.docker.internal"}
+
+
+def env_fingerprint(value: str) -> str:
+    return hashlib.sha256(value.encode("utf-8")).hexdigest()
+
+
+def fingerprint_manifest(env_file: Path, host: str, keys: list[str] | None = None) -> dict:
+    """Return key names and SHA-256 fingerprints only; values never leave this function."""
+    values = parse_env_file(env_file)
+    selected = sorted(set(keys)) if keys else sorted(values)
+    return {
+        "schemaVersion": "maggie-env-fingerprints.v1",
+        "host": host,
+        "keys": {key: env_fingerprint(values[key]) for key in selected if values.get(key, "").strip()},
+        "valuesReturned": False,
+    }
+
+
+def load_fingerprint_manifest(path: Path) -> dict:
+    """Read a JSON manifest or the `KEY <sha256>` lines emitted by the no-echo shell snippet."""
+    text = path.read_text(encoding="utf-8")
+    try:
+        value = json.loads(text)
+    except json.JSONDecodeError:
+        keys = {}
+        for line in text.splitlines():
+            parts = line.split()
+            if len(parts) == 2:
+                keys[parts[0]] = parts[1].lower()
+        value = {"schemaVersion": "maggie-env-fingerprints.v1", "host": path.stem, "keys": keys}
+    if not isinstance(value, dict) or not isinstance(value.get("keys"), dict):
+        raise ValueError(f"fingerprint manifest is invalid: {path.name}")
+    keys = {}
+    for key, digest in value["keys"].items():
+        if not ENV_KEY_RE.fullmatch(str(key)) or not SHA256_RE.fullmatch(str(digest)):
+            raise ValueError(f"fingerprint manifest {path.name} must contain only env names and SHA-256 hex digests")
+        keys[str(key)] = str(digest)
+    # The empty-string digest is what the snippet prints for an unset key.
+    empty = env_fingerprint("")
+    return {"host": str(value.get("host") or path.stem), "keys": {key: digest for key, digest in keys.items() if digest != empty}}
+
+
+def secret_parity(hosts: list[dict], required: list[str], strict: bool = False) -> dict:
+    """Compare env names and fingerprints across hosts; output carries short fingerprints only."""
+    errors: list[str] = []
+    warnings: list[str] = []
+    names = [host["host"] for host in hosts]
+    if len(hosts) < 2:
+        errors.append("at least two hosts are required for a parity check")
+    if len(set(names)) != len(names):
+        errors.append("host names must be unique")
+    required_names = sorted({name.strip() for name in required if name.strip()})
+    invalid = [name for name in required_names if not ENV_KEY_RE.fullmatch(name)]
+    if invalid:
+        errors.append("required names must be environment variable names")
+    union = sorted(set().union(*(host["keys"] for host in hosts)) | set(required_names)) if hosts else required_names
+    keys = []
+    for key in union:
+        present = {host["host"]: host["keys"][key] for host in hosts if key in host["keys"]}
+        missing = [name for name in names if name not in present]
+        distinct = sorted(set(present.values()))
+        status = "ok"
+        if missing:
+            status = "missing"
+        elif len(distinct) > 1:
+            status = "mismatch"
+        is_required = key in required_names
+        keys.append({
+            "key": key,
+            "required": is_required,
+            "status": status,
+            "missingOn": missing,
+            "fingerprints": {name: digest[:12] for name, digest in present.items()} if status == "mismatch" else {},
+        })
+        if status != "ok":
+            message = f"{key} is {status}" + (f" on {', '.join(missing)}" if missing else " across hosts")
+            (errors if is_required or strict else warnings).append(message)
+    return {
+        "schemaVersion": "maggie-secret-parity.v1",
+        "hosts": names,
+        "required": required_names,
+        "keys": keys,
+        "valuesReturned": False,
+        "passed": not errors,
+        "errors": errors,
+        "warnings": warnings,
+        "mutation": "not executed",
+    }
+
+
+def secret_parity_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="maggie deployment secret-parity",
+        description="Compare env key names and SHA-256 fingerprints across hosts without printing values.",
+    )
+    parser.add_argument("--host", action="append", default=[], metavar="NAME=ENV_FILE", help="local env file for one host; repeat")
+    parser.add_argument("--manifest", action="append", default=[], help="fingerprint manifest produced on a host; repeat")
+    parser.add_argument("--required", action="append", default=[], help="required key name; repeat")
+    parser.add_argument("--strict", action="store_true", help="fail on optional keys that differ, not only required keys")
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    hosts = []
+    for item in args.host:
+        name, separator, path = item.partition("=")
+        if not separator or not name or not path:
+            parser.error("--host must be NAME=ENV_FILE")
+        hosts.append({"host": name, "keys": fingerprint_manifest(Path(path).expanduser(), name)["keys"]})
+    for path in args.manifest:
+        hosts.append(load_fingerprint_manifest(Path(path).expanduser()))
+    result = secret_parity(hosts, args.required, args.strict)
+    if args.output:
+        output = Path(args.output).resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 0 if result["passed"] else 1
+
+
+def secret_fingerprint_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="maggie deployment secret-fingerprint",
+        description="Write a host's env key names and SHA-256 fingerprints (never values) for secret-parity.",
+    )
+    parser.add_argument("--env-file", required=True)
+    parser.add_argument("--host", required=True, help="stable host label, e.g. api-1")
+    parser.add_argument("--key", action="append", default=[], help="limit to these key names; repeat")
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    result = fingerprint_manifest(Path(args.env_file).expanduser(), args.host, args.key or None)
+    text = json.dumps(result, indent=2, ensure_ascii=False) + "\n"
+    if args.output:
+        output = Path(args.output).resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(text, encoding="utf-8")
+    print(text, end="")
+    return 0
+
+
+def database_targets(values: dict[str, str]) -> list[dict]:
+    """Extract database host/port/name per key; credentials are discarded."""
+    from urllib.parse import urlsplit
+
+    targets = []
+    for key, value in values.items():
+        if not value:
+            continue
+        if key in DATABASE_URL_KEYS or key.endswith("_DATABASE_URL") or key.endswith("_DB_URL"):
+            try:
+                parsed = urlsplit(value)
+                host = (parsed.hostname or "").lower()
+                port = parsed.port
+            except ValueError:
+                continue
+            if host:
+                targets.append({"key": key, "host": host, "port": port, "database": parsed.path.lstrip("/") or None})
+        elif key in DATABASE_HOST_KEYS:
+            targets.append({"key": key, "host": value.lower(), "port": None, "database": None})
+    return targets
+
+
+def environment_isolation(local_env: Path, production_env: Path | None = None, production_hosts: list[str] | None = None) -> dict:
+    """Fail when a local env file points at the production database."""
+    errors: list[str] = []
+    warnings: list[str] = []
+    local = database_targets(parse_env_file(local_env)) if local_env.is_file() else []
+    production = database_targets(parse_env_file(production_env)) if production_env and production_env.is_file() else []
+    production += [{"key": "--production-db-host", "host": host.lower(), "port": None, "database": None} for host in production_hosts or [] if host]
+    if not local:
+        warnings.append("no database connection setting found in the local env file")
+    if not production:
+        warnings.append("no production database host provided; pass --production-env or --production-db-host")
+    findings = []
+    for item in local:
+        if item["host"] in LOCAL_DATABASE_HOSTS:
+            continue
+        for prod in production:
+            if item["host"] != prod["host"]:
+                continue
+            same_port = item["port"] is None or prod["port"] is None or item["port"] == prod["port"]
+            same_database = item["database"] is None or prod["database"] is None or item["database"] == prod["database"]
+            shared = same_port and same_database
+            findings.append({"localKey": item["key"], "productionKey": prod["key"], "host": item["host"], "sameDatabase": shared})
+            if shared:
+                errors.append(f"{item['key']} points at the production database host {item['host']}; local test data will reach live pages and workers")
+            else:
+                warnings.append(f"{item['key']} uses the production database server {item['host']} with a different database or port")
+    return {
+        "schemaVersion": "maggie-environment-isolation.v1",
+        "localTargets": [{key: item[key] for key in ("key", "host", "port")} for item in local],
+        "productionHosts": sorted({item["host"] for item in production}),
+        "findings": findings,
+        "credentialsReturned": False,
+        "passed": not errors,
+        "errors": errors,
+        "warnings": warnings,
+        "mutation": "not executed",
+    }
+
+
+def environment_isolation_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="maggie deployment env-isolation",
+        description="Check that local development does not use the production database.",
+    )
+    parser.add_argument("--project", default=".")
+    parser.add_argument("--local-env", help="defaults to PROJECT/.env")
+    parser.add_argument("--production-env", help="production env file (read locally; values are not printed)")
+    parser.add_argument("--production-db-host", action="append", default=[], help="production database hostname; repeat")
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    project = Path(args.project).expanduser().resolve()
+    hosts = list(args.production_db_host)
+    if os.environ.get("MAGGIE_PRODUCTION_DB_HOST"):
+        hosts.append(os.environ["MAGGIE_PRODUCTION_DB_HOST"])
+    result = environment_isolation(
+        Path(args.local_env).expanduser().resolve() if args.local_env else project / ".env",
+        Path(args.production_env).expanduser().resolve() if args.production_env else None,
+        hosts,
+    )
+    if args.output:
+        output = Path(args.output).resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 0 if result["passed"] else 1
+
+
 def _secret_names(payload: object) -> list[str]:
     """Extract only binding names from a Wrangler secret-list response."""
     entries: object = payload
@@ -303,6 +535,14 @@ def preflight(
         "commands": {key: scripts[key] for key in ("build", "test", "lint", "typecheck", "deploy") if key in scripts},
         "next_action": "review target, environment, migrations, secrets, and rollback owner before execute",
     }
+    isolation_warnings: list[str] = []
+    production_env = next((path for path in (project / ".env.production", project / ".env.prod") if path.is_file()), None)
+    production_host = os.environ.get("MAGGIE_PRODUCTION_DB_HOST", "").strip()
+    if (project / ".env").is_file() and (production_env or production_host):
+        isolation = environment_isolation(project / ".env", production_env, [production_host] if production_host else [])
+        result["environment_isolation"] = {"passed": isolation["passed"], "productionHosts": isolation["productionHosts"], "errors": isolation["errors"]}
+        result["checks"]["local_database_isolated"] = isolation["passed"]
+        isolation_warnings = [f"environment isolation: {message}" for message in isolation["errors"]]
     if target in {"vps", "vps-with-cloudflare-dns"}:
         result["provider"] = "vps"
         result["architecture"] = "Astro Node standalone behind Nginx, managed by systemd, with release/current rollback layout"
@@ -357,12 +597,14 @@ def preflight(
         result["next_action"] = "review VPS host, SSH user, domain/DNS, systemd service, Nginx config, release path, migrations, and rollback owner before execute"
         runners = sorted(deployment_dir.rglob("release-runner.sh")) if deployment_dir.exists() else []
         result["release_runners"] = [release_runner_status(path) for path in runners[:25]]
-        result["warnings"] = [f"generated release runner is stale or unmarked: {item['path']}" for item in result["release_runners"] if item["status"] == "stale"]
+        result["warnings"] = isolation_warnings + [f"generated release runner is stale or unmarked: {item['path']}" for item in result["release_runners"] if item["status"] == "stale"]
         result["blocking_checks"] = ["package_manifest", "build_command", "env_example", "node_runtime_declared", "start_command_or_runtime", "stateless_or_migration_plan", "release_layout_declared", "rollback_command_declared", "release_retention_policy", "data_release_checkpoint", "release_plan_artifact", "systemd_artifact", "nginx_artifact", "deployment_artifacts_secret_free", "rollback_evidence"]
         if require_deployer:
             result["blocking_checks"].append("deployer_delegation")
     else:
         result["blocking_checks"] = ["package_manifest", "build_command", "env_example"]
+        if isolation_warnings:
+            result["warnings"] = isolation_warnings
     return result
 
 
@@ -678,6 +920,12 @@ def main() -> int:
         return credential_preflight_main(sys.argv[2:])
     if sys.argv[1:2] == ["worker-secrets"]:
         return worker_secret_preflight_main(sys.argv[2:])
+    if sys.argv[1:2] == ["secret-parity"]:
+        return secret_parity_main(sys.argv[2:])
+    if sys.argv[1:2] == ["secret-fingerprint"]:
+        return secret_fingerprint_main(sys.argv[2:])
+    if sys.argv[1:2] == ["env-isolation"]:
+        return environment_isolation_main(sys.argv[2:])
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("project", nargs="?", default=".")
     parser.add_argument("--target", choices=("detected", "cloudflare", "vps", "vps-with-cloudflare-dns", "gcp", "aws"), default="detected")

package/bundled-tools/clis/maggie_design.py

@@ -854,9 +854,18 @@ commands:
   resume       restart a failed design workflow
   author       plan an original first-party page
   markup-check validate optional style attributes, content keys, and entities
+  pressable-check flag pressables/buttons nested in another pressable (JSX/TSX)
+  layer-check  flag unlayered CSS that overrides Tailwind v4 utilities
+  palette      generate or validate a semantic palette role contract
   reference-ui, init, validate-ui, app-init, app-validate, rebrand, review
 """)
         return 0
+    if len(sys.argv) > 1 and sys.argv[1] in {"pressable-check", "layer-check"}:
+        from maggie_design_lint import main as lint_main
+        return lint_main(sys.argv[1:])
+    if len(sys.argv) > 1 and sys.argv[1] == "palette":
+        from maggie_palette import main as palette_main
+        return palette_main(sys.argv[2:])
     if len(sys.argv) > 1 and sys.argv[1] == "reference-ui":
         command = argparse.ArgumentParser(description="Record sanitized blog/service UI evidence from a read-only reference project.")
         command.add_argument("--project", type=Path, default=Path.cwd())