@orchid-labs/pluxx 0.1.21 → 0.1.22

package/dist/index.js

@@ -7841,6 +7841,20 @@ function definePlugin(config) {
   return PluginConfigSchema.parse(config);
 }
 
+// src/hook-events.ts
+var CODEX_SUPPORTED_HOOK_EVENTS = [
+  "SessionStart",
+  "SubagentStart",
+  "PreToolUse",
+  "PermissionRequest",
+  "PostToolUse",
+  "PreCompact",
+  "PostCompact",
+  "UserPromptSubmit",
+  "SubagentStop",
+  "Stop"
+];
+
 // src/runtime-readiness-registry.ts
 function getEnabledRuntimeReadinessBindings(capability, plan) {
   return capability.bindings.filter((binding) => {
@@ -7855,7 +7869,7 @@ function getEnabledRuntimeReadinessBindings(capability, plan) {
   });
 }
 var NAMED_PROMPT_TARGET_NOTE = "Named `skills` / `commands` readiness targets currently translate through prompt-entry gating with best-effort matching because the core four do not share one exact per-skill or per-command runtime interception surface.";
-var CODEX_EXTERNAL_NOTE = "Codex readiness now bundles translated hooks in the plugin, and Pluxx still emits `.codex/readiness.generated.json` plus `.codex/hooks.generated.json` as debugging companions because plugin-bundled hook activation still depends on `[features].plugin_hooks = true`. The general `hooks = true` flag covers non-plugin hook config and defaults on, while `codex_hooks` is deprecated and should not be treated as a plugin-bundled hook fallback.";
+var CODEX_EXTERNAL_NOTE = "Codex readiness now bundles translated hooks in the plugin, and Pluxx still emits `.codex/readiness.generated.json` plus `.codex/hooks.generated.json` as debugging companions because hook activation still depends on `[features].hooks = true`, enabled plugin state, review, trust, and runtime support. `codex_hooks` is deprecated and should not be treated as the current hook feature key.";
 function getRuntimeReadinessNamedPromptTargetNote() {
   return NAMED_PROMPT_TARGET_NOTE;
 }
@@ -8103,7 +8117,7 @@ var PLATFORM_LIMIT_POLICIES = {
     },
     hooksFeatureFlag: {
       kind: "hard",
-      notes: "Hook support depends on the Codex hooks feature flag/runtime support."
+      notes: "Codex hook support depends on the canonical hooks feature flag plus enabled-plugin, trust/review, and runtime support."
     }
   },
   "cursor": {
@@ -8303,8 +8317,8 @@ var PLATFORM_VALIDATION_RULES = {
     hooks: {
       supported: true,
       files: ["hooks/hooks.json", ".codex/hooks.json", "~/.codex/hooks.json"],
-      eventNames: ["SessionStart", "PreToolUse", "PermissionRequest", "PostToolUse", "UserPromptSubmit", "Stop"],
-      notes: "Codex documents both project or user hook config and plugin-bundled hooks. Plugin-bundled hooks live at `hooks/hooks.json` in the plugin and require `[features].plugin_hooks = true`; the general `[features].hooks = true` flag covers non-plugin hook config and defaults on. `codex_hooks` is deprecated and should not be treated as a plugin-bundled hook fallback."
+      eventNames: [...CODEX_SUPPORTED_HOOK_EVENTS],
+      notes: "Codex documents both project/user hook config and plugin-bundled hooks. Plugin-bundled hooks live at `hooks/hooks.json` in the plugin and require the canonical `[features].hooks = true` flag, enabled plugin state, user review, trust, and runtime support. `codex_hooks` is deprecated and should not be treated as the current hook feature key."
     },
     instructions: {
       files: ["AGENTS.md", "AGENTS.override.md"],
@@ -8743,7 +8757,7 @@ var CORE_FOUR_PRIMITIVE_CAPABILITIES = {
       hooks: {
         mode: "translate",
         nativeSurfaces: ["hooks/hooks.json", ".codex/hooks.json", "~/.codex/hooks.json"],
-        notes: "Hooks are native. Pluxx bundles translated Codex hooks in the plugin with the documented `[features].plugin_hooks = true` plugin gate, and still tracks the broader project/user hook config paths where `[features].hooks` is the general flag and `codex_hooks` is deprecated."
+        notes: "Hooks are native. Pluxx bundles translated Codex hooks in the plugin with the documented `[features].hooks = true` feature key, and still tracks broader project/user hook config paths where `codex_hooks` is deprecated. Plugin-bundled execution still also depends on enabled plugin state, review, trust, and runtime support."
       },
       permissions: {
         mode: "translate",
@@ -9139,6 +9153,78 @@ function getPublishReloadInstruction(target) {
   return PUBLISH_RELOAD_INSTRUCTIONS[target];
 }
 
+// src/mcp-native-overrides.ts
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  return value;
+}
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return void 0;
+}
+function readStringRecord(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  const stringRecord = Object.fromEntries(
+    Object.entries(record).filter(([, entryValue]) => typeof entryValue === "string")
+  );
+  return Object.keys(stringRecord).length > 0 ? stringRecord : void 0;
+}
+function extractEnvVar(value) {
+  const match = value.match(/\$\{(?:env:)?([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/);
+  return match?.[1] ?? match?.[2];
+}
+function envVarToKey(envVar) {
+  return envVar.toLowerCase().replace(/_/g, "-");
+}
+function collectNativeMcpAuthUserConfigEntries(config, platforms, existingFields) {
+  const next = [];
+  const seenKeys = new Set(existingFields.map((field) => field.key));
+  const seenEnvVars = new Set(
+    existingFields.map((field) => field.envVar ?? defaultUserConfigEnvVar(field.key))
+  );
+  const pushDerived = (envVar, platform, serverName) => {
+    if (!envVar || seenEnvVars.has(envVar)) return;
+    const key = envVarToKey(envVar);
+    if (seenKeys.has(key)) return;
+    seenEnvVars.add(envVar);
+    seenKeys.add(key);
+    next.push({
+      key,
+      title: envVar,
+      description: `Derived from native ${platform} MCP auth for ${serverName}.`,
+      type: "secret",
+      required: true,
+      envVar,
+      targets: [platform]
+    });
+  };
+  for (const platform of platforms) {
+    const platformConfig = asRecord(config.platforms?.[platform]);
+    const mcpServers = asRecord(platformConfig?.mcpServers);
+    if (!mcpServers) continue;
+    for (const [serverName, rawOverride] of Object.entries(mcpServers)) {
+      const override = asRecord(rawOverride);
+      if (!override) continue;
+      const bearerTokenEnv = firstString(override.bearer_token_env_var, override.bearerTokenEnvVar);
+      if (bearerTokenEnv) pushDerived(bearerTokenEnv, platform, serverName);
+      for (const record of [
+        readStringRecord(override.env_http_headers ?? override.envHttpHeaders),
+        readStringRecord(override.headers),
+        readStringRecord(override.http_headers ?? override.httpHeaders)
+      ]) {
+        for (const value of Object.values(record ?? {})) {
+          const envVar = extractEnvVar(value) ?? value;
+          pushDerived(envVar, platform, serverName);
+        }
+      }
+    }
+  }
+  return next;
+}
+
 // src/cli/publish.ts
 var INSTALLER_TARGETS = ["claude-code", "cursor", "codex", "opencode"];
 function runCommandDefault(command, args, options) {
@@ -9438,8 +9524,15 @@ echo
 echo "Installed __DISPLAY_NAME__ across ${installerTargets.join(", ")}."
 `.replaceAll("__REPO__", "REPO_PLACEHOLDER").replaceAll("__DISPLAY_NAME__", "DISPLAY_PLACEHOLDER");
 }
+function collectInstallerUserConfigEntries(config, platforms) {
+  const baseEntries = collectUserConfigEntries(config, platforms);
+  return [
+    ...baseEntries,
+    ...collectNativeMcpAuthUserConfigEntries(config, platforms, baseEntries)
+  ];
+}
 function renderInstallerUserConfigSnippet(config, platform, installDirVariable) {
-  const entries = collectUserConfigEntries(config, [platform]).map((entry) => ({
+  const entries = collectInstallerUserConfigEntries(config, [platform]).map((entry) => ({
     key: entry.key,
     title: entry.title,
     type: entry.type ?? "string",
@@ -9447,6 +9540,7 @@ function renderInstallerUserConfigSnippet(config, platform, installDirVariable)
     envVar: entry.envVar ?? defaultUserConfigEnvVar(entry.key)
   }));
   if (entries.length === 0) return "";
+  const preserveSecretReferences = platform === "codex";
   const promptLines = entries.map((entry) => {
     const functionName = entry.type === "secret" ? "pluxx_prompt_secret_config" : "pluxx_prompt_text_config";
     return `${functionName} ${JSON.stringify(entry.key)} ${JSON.stringify(entry.envVar)} ${JSON.stringify(entry.title)} ${entry.required ? "1" : "0"}`;
@@ -9457,6 +9551,8 @@ ${JSON.stringify(entries)}
 PLUXX_USER_CONFIG_JSON
 )"
 PLUXX_REUSED_USER_CONFIG=0
+PLUXX_PRESERVE_SECRET_REFS="${preserveSecretReferences ? "1" : "0"}"
+export PLUXX_PRESERVE_SECRET_REFS
 
 pluxx_is_placeholder_secret() {
   case "$1" in
@@ -9483,12 +9579,14 @@ const fs = require('fs')
 const filepath = process.env.PLUXX_SAVED_USER_CONFIG_PATH
 const key = process.env.PLUXX_SAVED_CONFIG_KEY
 const envVar = process.env.PLUXX_SAVED_CONFIG_ENV_VAR
+const preserveSecretRefs = process.env.PLUXX_PRESERVE_SECRET_REFS === '1'
 
 try {
   const payload = JSON.parse(fs.readFileSync(filepath, 'utf8'))
   const candidates = [
     payload && payload.env && envVar ? payload.env[envVar] : undefined,
     payload && payload.values && key ? payload.values[key] : undefined,
+    preserveSecretRefs && payload && payload.envRefs && envVar && payload.envRefs[envVar] === envVar ? envVar : undefined,
   ]
 
   for (const candidate of candidates) {
@@ -9584,21 +9682,53 @@ const path = require('path')
 
 const installDir = process.env.PLUXX_INSTALL_DIR
 const spec = JSON.parse(process.env.PLUXX_USER_CONFIG_SPEC || '[]')
+const preserveSecretReferences = ${preserveSecretReferences ? "true" : "false"}
 
 if (installDir && spec.length > 0) {
   const env = {}
   const values = {}
+  const envRefs = {}
+  const secretKeys = []
+  const secretEnv = []
+  let hasSecret = false
+  const secretEnvVars = new Set(
+    spec
+      .filter((entry) => entry && entry.type === 'secret' && typeof entry.envVar === 'string' && entry.envVar !== '')
+      .map((entry) => entry.envVar),
+  )
 
   for (const entry of spec) {
+    if (entry.type === 'secret') {
+      hasSecret = true
+      if (preserveSecretReferences) {
+        if (entry.key) secretKeys.push(entry.key)
+        if (entry.envVar) secretEnv.push(entry.envVar)
+      }
+    }
     const value = process.env[entry.envVar]
     if (value === undefined || value === '') continue
+    if (preserveSecretReferences && entry.type === 'secret') {
+      envRefs[entry.envVar] = entry.envVar
+      continue
+    }
     values[entry.key] = value
     env[entry.envVar] = value
   }
 
   fs.writeFileSync(
     path.join(installDir, '.pluxx-user.json'),
-    JSON.stringify({ values, env }, null, 2) + '\\n',
+    JSON.stringify(
+      {
+        ...(Object.keys(values).length > 0 ? { values } : {}),
+        ...(Object.keys(env).length > 0 ? { env } : {}),
+        ...(Object.keys(envRefs).length > 0 ? { envRefs } : {}),
+        ...(hasSecret ? { secretStorage: preserveSecretReferences ? 'env-ref' : 'materialized' } : {}),
+        ...(preserveSecretReferences && secretKeys.length > 0 ? { secretKeys: [...new Set(secretKeys)].sort() } : {}),
+        ...(preserveSecretReferences && secretEnv.length > 0 ? { secretEnv: [...new Set(secretEnv)].sort() } : {}),
+      },
+      null,
+      2,
+    ) + '\\n',
   )
 
   const envScriptPath = path.join(installDir, 'scripts/check-env.sh')
@@ -9611,7 +9741,10 @@ if (installDir && spec.length > 0) {
 
   const materialize = (value) =>
     typeof value === 'string'
-      ? value.replace(/\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g, (_match, name) => env[name] || '${" + name + "}')
+      ? value.replace(
+        /\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g,
+        (_match, name) => (preserveSecretReferences && secretEnvVars.has(name) ? '${" + name + "}' : (env[name] || '${" + name + "}')),
+      )
       : value
 
   const materializeRecord = (record) => {
@@ -9635,7 +9768,7 @@ if (installDir && spec.length > 0) {
         server.env = materializeRecord(server.env)
       }
 
-      if (server.bearer_token_env_var && env[server.bearer_token_env_var]) {
+      if (!preserveSecretReferences && server.bearer_token_env_var && env[server.bearer_token_env_var]) {
         server.http_headers = {
           ...(server.http_headers || {}),
           Authorization: 'Bearer ' + env[server.bearer_token_env_var],
@@ -9643,7 +9776,7 @@ if (installDir && spec.length > 0) {
         delete server.bearer_token_env_var
       }
 
-      if (server.env_http_headers && typeof server.env_http_headers === 'object') {
+      if (!preserveSecretReferences && server.env_http_headers && typeof server.env_http_headers === 'object') {
         server.http_headers = {
           ...(server.http_headers || {}),
         }
@@ -9668,7 +9801,7 @@ NODE
 `;
 }
 function hasInstallerUserConfig(config, platform) {
-  return collectUserConfigEntries(config, [platform]).length > 0;
+  return collectInstallerUserConfigEntries(config, [platform]).length > 0;
 }
 function renderInstallerSavedUserConfigCaptureSnippet(config, platform, installDirVariable) {
   if (!hasInstallerUserConfig(config, platform)) return "";
@@ -9834,13 +9967,13 @@ for (const line of lines) {
     continue
   }
   if (tableName === '') {
-    const dottedMatch = trimmed.match(/^features\\.plugin_hooks\\s*=\\s*(.+)$/)
+    const dottedMatch = trimmed.match(/^features\\.hooks\\s*=\\s*(.+)$/)
     if (dottedMatch && isTomlTrue(dottedMatch[1])) process.exit(0)
     const inlineMatch = trimmed.match(/^features\\s*=\\s*(.+)$/)
-    if (inlineMatch && /\\bplugin_hooks\\s*=\\s*true\\b/i.test(inlineMatch[1])) process.exit(0)
+    if (inlineMatch && /\\bhooks\\s*=\\s*true\\b/i.test(inlineMatch[1])) process.exit(0)
   }
   if (tableName !== 'features') continue
-  const match = trimmed.match(/^plugin_hooks\\s*=\\s*(.+)$/)
+  const match = trimmed.match(/^hooks\\s*=\\s*(.+)$/)
   if (match && isTomlTrue(match[1])) process.exit(0)
 }
 process.exit(1)
@@ -9859,7 +9992,7 @@ NODE
       *)
         if [[ -r /dev/tty ]]; then
           echo "This Codex plugin bundle includes startup hooks." >/dev/tty
-          echo "Codex requires [features].plugin_hooks = true before plugin-bundled hooks can run." >/dev/tty
+          echo "Codex requires [features].hooks = true before plugin-bundled hooks can run." >/dev/tty
           read -r -p "Enable Codex plugin-bundled hooks in $CODEX_CONFIG_PATH now? [Y/n] " PLUXX_CODEX_HOOKS_REPLY </dev/tty
           case "$PLUXX_CODEX_HOOKS_REPLY" in
             n|N|no|NO)
@@ -9931,7 +10064,7 @@ for (let index = 0; index < lines.length; index += 1) {
     if (/^features\\.[A-Za-z0-9_-]+\\s*=/.test(trimmed) && firstTopLevelFeaturesDotted < 0) {
       firstTopLevelFeaturesDotted = index
     }
-    if (/^features\\.plugin_hooks\\s*=/.test(trimmed)) {
+    if (/^features\\.hooks\\s*=/.test(trimmed)) {
       topLevelPluginHooksDotted = index
     }
     if (/^features\\s*=\\s*\\{/.test(trimmed)) {
@@ -9950,28 +10083,28 @@ if (start >= 0) {
 
   let updated = false
   for (let index = start + 1; index < end; index += 1) {
-    if (/^plugin_hooks\\s*=/.test(stripTomlComment(lines[index]).trim())) {
-      lines[index] = 'plugin_hooks = true'
+    if (/^hooks\\s*=/.test(stripTomlComment(lines[index]).trim())) {
+      lines[index] = 'hooks = true'
       updated = true
     }
   }
-  if (!updated) lines.splice(start + 1, 0, 'plugin_hooks = true')
+  if (!updated) lines.splice(start + 1, 0, 'hooks = true')
 } else if (topLevelPluginHooksDotted >= 0) {
-  lines[topLevelPluginHooksDotted] = 'features.plugin_hooks = true'
+  lines[topLevelPluginHooksDotted] = 'features.hooks = true'
 } else if (firstTopLevelFeaturesDotted >= 0) {
-  lines.splice(firstTopLevelFeaturesDotted + 1, 0, 'features.plugin_hooks = true')
+  lines.splice(firstTopLevelFeaturesDotted + 1, 0, 'features.hooks = true')
 } else if (topLevelInlineFeatures >= 0 && lines[topLevelInlineFeatures].includes('}')) {
-  if (/\\bplugin_hooks\\s*=/.test(lines[topLevelInlineFeatures])) {
+  if (/\\bhooks\\s*=/.test(lines[topLevelInlineFeatures])) {
     lines[topLevelInlineFeatures] = lines[topLevelInlineFeatures].replace(
-      /\\bplugin_hooks\\s*=\\s*(true|false)\\b/i,
-      'plugin_hooks = true',
+      /\\bhooks\\s*=\\s*(true|false)\\b/i,
+      'hooks = true',
     )
   } else {
-    lines[topLevelInlineFeatures] = lines[topLevelInlineFeatures].replace(/}/, ', plugin_hooks = true }')
+    lines[topLevelInlineFeatures] = lines[topLevelInlineFeatures].replace(/}/, ', hooks = true }')
   }
 } else {
   if (lines.length > 0 && lines[lines.length - 1] !== '') lines.push('')
-  lines.push('[features]', 'plugin_hooks = true')
+  lines.push('[features]', 'hooks = true')
 }
 
 fs.mkdirSync(path.dirname(filepath), { recursive: true })
@@ -9982,7 +10115,7 @@ NODE
     else
       echo "Codex plugin-bundled hooks are not enabled. Startup hooks from this plugin will not run until you add this to $CODEX_CONFIG_PATH:" >&2
       echo "[features]" >&2
-      echo "plugin_hooks = true" >&2
+      echo "hooks = true" >&2
       echo "Then restart or refresh Codex before relying on plugin startup hooks." >&2
       echo "Set PLUXX_CODEX_ENABLE_PLUGIN_HOOKS=1 before running this installer to enable it noninteractively." >&2
     fi
@@ -10621,7 +10754,7 @@ import { resolve as resolve5 } from "path";
 import { spawn, spawnSync as spawnSync2 } from "child_process";
 import { accessSync, constants, existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, readdirSync as readdirSync2, realpathSync } from "fs";
 import { homedir } from "os";
-import { basename as basename2, dirname as dirname2, resolve as resolve4 } from "path";
+import { basename as basename2, dirname as dirname2, relative as relative2, resolve as resolve4 } from "path";
 
 // node_modules/jiti/lib/jiti.mjs
 var import_jiti = __toESM(require_jiti(), 1);
@@ -11156,7 +11289,7 @@ var MUTATING_PREFIX_PATTERN = new RegExp(`^(${MUTATING_PREFIXES.join("|")})\\b`,
 // src/codex-hooks-feature.ts
 var RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG = "hooks";
 var ALTERNATE_CODEX_HOOKS_FEATURE_FLAG = "codex_hooks";
-var PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG = "plugin_hooks";
+var PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG = "hooks";
 function getCodexHooksFeatureState(features) {
   if (!features) {
     return {
@@ -11334,12 +11467,119 @@ function splitTomlDottedPath(value) {
 var MATERIALIZED_ENV_MARKER = "materialized required config";
 var MIN_NODE_MAJOR = 18;
 var STDIO_LAUNCH_SMOKE_TIMEOUT_MS = 1200;
+var MAX_SECRET_SCAN_FILE_BYTES = 512 * 1024;
+var LEGACY_SECRET_IDENTIFIER_PATTERN = /(^|[-_])(api[-_]?key|secret|token|password|credential)([-_]|$)/i;
+var TEST_SECRET_SENTINELS = [
+  { pattern: /\bshh-secret\b/i, label: "test secret sentinel" },
+  { pattern: /\bsecret-key\b/i, label: "test secret sentinel" },
+  { pattern: /\bliteral-secret-value-that-should-not-copy\b/i, label: "test secret sentinel" }
+];
 function renderInstalledPluginRoot(value, rootDir) {
   return value.replaceAll("${PLUGIN_ROOT}", rootDir).replaceAll("${CLAUDE_PLUGIN_ROOT}", rootDir).replaceAll("${CURSOR_PLUGIN_ROOT}", rootDir).replaceAll("${CODEX_PLUGIN_ROOT}", rootDir).replaceAll("${OPENCODE_PLUGIN_ROOT}", rootDir);
 }
 function addCheck(checks, check) {
   checks.push(check);
 }
+function looksLegacySecretIdentifier(value) {
+  return LEGACY_SECRET_IDENTIFIER_PATTERN.test(
+    value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[._/\s]+/g, "-")
+  );
+}
+function walkInstalledBundleFiles(rootDir, currentDir = rootDir) {
+  const files = [];
+  for (const entry of readdirSync2(currentDir, { withFileTypes: true })) {
+    const absolutePath = resolve4(currentDir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...walkInstalledBundleFiles(rootDir, absolutePath));
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    files.push(relative2(rootDir, absolutePath).replace(/\\/g, "/"));
+  }
+  return files.sort();
+}
+function readInstalledTextFile(rootDir, relativePath) {
+  const absolutePath = resolve4(rootDir, relativePath);
+  const content = readFileSync4(absolutePath);
+  if (content.length > MAX_SECRET_SCAN_FILE_BYTES) return null;
+  if (content.includes(0)) return null;
+  return content.toString("utf-8");
+}
+function collectInstalledPlaintextSecretCandidates(rootDir) {
+  const userConfigPath = resolve4(rootDir, ".pluxx-user.json");
+  if (!existsSync4(userConfigPath)) return [];
+  try {
+    const payload = JSON.parse(readFileSync4(userConfigPath, "utf-8"));
+    if (payload.secretStorage === "materialized") return [];
+    const secretKeys = new Set(Array.isArray(payload.secretKeys) ? payload.secretKeys.filter((value) => typeof value === "string") : []);
+    const secretEnv = new Set(Array.isArray(payload.secretEnv) ? payload.secretEnv.filter((value) => typeof value === "string") : []);
+    const hasSecretMetadata = secretKeys.size > 0 || secretEnv.size > 0;
+    const candidateLabels = /* @__PURE__ */ new Map();
+    const recordCandidate = (rawValue, label) => {
+      if (typeof rawValue !== "string") return;
+      const value = rawValue.trim();
+      if (!value) return;
+      if (extractEnvReference(value)) return;
+      if (isPlaceholderSecretValue(value)) return;
+      const labels = candidateLabels.get(value) ?? /* @__PURE__ */ new Set();
+      labels.add(label);
+      candidateLabels.set(value, labels);
+    };
+    for (const [key, value] of Object.entries(payload.values ?? {})) {
+      if (hasSecretMetadata ? !secretKeys.has(key) : !looksLegacySecretIdentifier(key)) continue;
+      recordCandidate(value, `userConfig "${key}"`);
+    }
+    for (const [key, value] of Object.entries(payload.env ?? {})) {
+      if (hasSecretMetadata ? !secretEnv.has(key) : !looksLegacySecretIdentifier(key)) continue;
+      recordCandidate(value, `env "${key}"`);
+    }
+    return [...candidateLabels.entries()].map(([value, labels]) => ({
+      value,
+      labels: [...labels].sort()
+    }));
+  } catch {
+    return [];
+  }
+}
+function checkInstalledPlaintextSecrets(checks, rootDir) {
+  const literalCandidates = collectInstalledPlaintextSecretCandidates(rootDir);
+  const findings = /* @__PURE__ */ new Map();
+  for (const relativePath of walkInstalledBundleFiles(rootDir)) {
+    const content = readInstalledTextFile(rootDir, relativePath);
+    if (!content) continue;
+    const labels = /* @__PURE__ */ new Set();
+    for (const candidate of literalCandidates) {
+      if (!content.includes(candidate.value)) continue;
+      for (const label of candidate.labels) labels.add(label);
+    }
+    for (const sentinel of TEST_SECRET_SENTINELS) {
+      if (sentinel.pattern.test(content)) {
+        labels.add(sentinel.label);
+      }
+    }
+    if (labels.size > 0) {
+      findings.set(relativePath, labels);
+    }
+  }
+  if (findings.size === 0) {
+    addCheck(checks, {
+      level: "success",
+      code: "consumer-plaintext-secret-absent",
+      title: "Installed bundle does not expose known plaintext secret material",
+      detail: "No known prompted secret values or maintained test-secret sentinels were detected in scanned installed text files.",
+      fix: "No action needed."
+    });
+    return;
+  }
+  const detail = [...findings.entries()].map(([path, labels]) => `${path} (${[...labels].sort().join(", ")})`).join("; ");
+  addCheck(checks, {
+    level: "error",
+    code: "consumer-plaintext-secret-leak",
+    title: "Installed bundle contains plaintext secret material",
+    detail: `Detected plaintext secret material in installed files: ${detail}.`,
+    fix: "Rotate the affected credential, remove the leaking install, reinstall after the Pluxx secret-reference fix, and rerun pluxx doctor --consumer."
+  });
+}
 function summarizeChecks(checks) {
   const visibleChecks = checks.filter((check) => !check.code.startsWith("primitive-"));
   const errors = visibleChecks.filter((check) => check.level === "error").length;
@@ -11474,7 +11714,7 @@ function readCodexHooksFeatureFlag(filePath) {
       inFeaturesTable = sectionMatch[1].trim() === "features";
       continue;
     }
-    const dottedFeatureMatch = line.match(/^features\.(plugin_hooks|hooks|codex_hooks)\s*=\s*(.+)$/);
+    const dottedFeatureMatch = line.match(/^features\.(hooks|codex_hooks)\s*=\s*(.+)$/);
     if (dottedFeatureMatch) {
       assignFeatureFlag(dottedFeatureMatch[1], dottedFeatureMatch[2]);
       continue;
@@ -11491,7 +11731,7 @@ function readCodexHooksFeatureFlag(filePath) {
       continue;
     }
     if (!inFeaturesTable) continue;
-    const featureMatch = line.match(/^(plugin_hooks|hooks|codex_hooks)\s*=\s*(.+)$/);
+    const featureMatch = line.match(/^(hooks|codex_hooks)\s*=\s*(.+)$/);
     if (!featureMatch) continue;
     assignFeatureFlag(featureMatch[1], featureMatch[2]);
   }
@@ -12110,20 +12350,20 @@ function checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options) {
   const enabledProbes = probes.filter((probe) => probe.enabled);
   const checkedPaths = probes.map((probe) => `${probe.scope} ${probe.exists ? "config" : "path"}: ${probe.path}${probe.exists ? "" : " (missing)"}`).join("; ");
   const describeEnabledFlags = (probe) => {
-    const enabledFlags = [];
-    if (probe.pluginBundledEnabled) enabledFlags.push(PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG);
-    if (probe.recommendedEnabled) enabledFlags.push(RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG);
-    if (probe.alternateEnabled) enabledFlags.push(ALTERNATE_CODEX_HOOKS_FEATURE_FLAG);
-    return enabledFlags.join(" + ");
+    const enabledFlags = /* @__PURE__ */ new Set();
+    if (probe.pluginBundledEnabled) enabledFlags.add(PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG);
+    if (probe.recommendedEnabled) enabledFlags.add(RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG);
+    if (probe.alternateEnabled) enabledFlags.add(ALTERNATE_CODEX_HOOKS_FEATURE_FLAG);
+    return [...enabledFlags].join(" + ");
   };
   const generalOnlyProbes = probes.filter((probe) => !probe.pluginBundledEnabled && (probe.recommendedEnabled || probe.alternateEnabled));
   if (generalOnlyProbes.length > 0) {
     addCheck(checks, {
       level: "warning",
       code: "consumer-codex-plugin-hooks-feature-flag-general-only",
-      title: "Codex config enables only general hook flags, not the plugin-bundled hook gate",
-      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, but ${generalOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")} enables only general hook flags (${generalOnlyProbes.map((probe) => describeEnabledFlags(probe)).join(" and ")}). Those general flags do not activate plugin-bundled hooks by themselves.`,
-      fix: `Enable \`${PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the active Codex config, reload Codex, and rerun pluxx verify-install.`,
+      title: "Codex config enables only deprecated hook flags",
+      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, but ${generalOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")} enables only deprecated hook flags (${generalOnlyProbes.map((probe) => describeEnabledFlags(probe)).join(" and ")}). Current Codex docs use \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG}\` as the canonical feature key.`,
+      fix: `Enable \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the active Codex config, reload Codex, and rerun pluxx verify-install.`,
       path: generalOnlyProbes[0].path
     });
   }
@@ -12133,8 +12373,8 @@ function checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options) {
       level: "warning",
       code: "consumer-codex-hooks-feature-flag-legacy-only",
       title: "Codex config still uses the deprecated general hook compatibility flag",
-      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, and the checked Codex config enables only the deprecated general hook flag \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG} = true\` in ${legacyOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")}. That flag is not the plugin-bundled hook gate.`,
-      fix: `Prefer \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` only for non-plugin hook config if needed, and use \`${PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` for plugin-bundled hooks. Reload Codex and rerun pluxx verify-install after updating the active config.`,
+      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, and the checked Codex config enables only the deprecated hook flag \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG} = true\` in ${legacyOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")}. Current Codex docs use \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG}\` as the canonical feature key.`,
+      fix: `Use \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\`, reload Codex, and rerun pluxx verify-install after updating the active config.`,
       path: legacyOnlyProbes[0].path
     });
   }
@@ -12142,8 +12382,8 @@ function checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options) {
     addCheck(checks, {
       level: "success",
       code: "consumer-codex-hooks-feature-flag-enabled",
-      title: "Codex plugin-bundled hook feature flag found for this install",
-      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, and the plugin hook gate was found in ${enabledProbes.map((probe) => `${probe.scope} config ${probe.path} (${describeEnabledFlags(probe)})`).join(" and ")}. Treat that as a prerequisite, not proof of live hook execution.`,
+      title: "Codex hook feature flag found for this install",
+      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, and the canonical hook feature key was found in ${enabledProbes.map((probe) => `${probe.scope} config ${probe.path} (${describeEnabledFlags(probe)})`).join(" and ")}. Treat that as a prerequisite, not proof of live hook execution.`,
       fix: "No action needed.",
       path: enabledProbes[0].path
     });
@@ -12154,8 +12394,8 @@ function checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options) {
     level: "warning",
     code: "consumer-codex-hooks-feature-flag-missing",
     title: "Codex plugin-bundled hook activation is missing its known feature-gate prerequisite",
-    detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, but \`${PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG} = true\` was not found in the checked Codex config layers. The general \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG}\` flag covers non-plugin hook config and defaults on, while \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG}\` is deprecated and should not be treated as a plugin-bundled hook fallback. Checked ${checkedPaths}.${parseErrors.length > 0 ? ` Unparseable config: ${parseErrors.join("; ")}.` : ""}`,
-    fix: `Enable \`${PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the relevant project or user Codex config, reload Codex, and rerun pluxx verify-install.`,
+    detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, but \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` was not found in the checked Codex config layers. \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG}\` is deprecated and should not be treated as the current hook feature key. Checked ${checkedPaths}.${parseErrors.length > 0 ? ` Unparseable config: ${parseErrors.join("; ")}.` : ""}`,
+    fix: `Enable \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the relevant project or user Codex config, reload Codex, and rerun pluxx verify-install.`,
     path: probes.find((probe) => probe.exists)?.path ?? hooksReference
   });
 }
@@ -12689,6 +12929,7 @@ async function doctorConsumer(rootDir = process.cwd(), options = {}) {
   checkInstalledCodexPermissionCompanion(checks, rootDir, layout, options);
   checkInstalledPermissionHook(checks, rootDir, layout);
   checkInstalledUserConfig(checks, rootDir);
+  checkInstalledPlaintextSecrets(checks, rootDir);
   checkInstalledEnvValidation(checks, rootDir);
   checkInstalledRuntimeScriptRoles(checks, rootDir);
   await checkInstalledMcpConfig(checks, rootDir, layout);

package/dist/readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../src/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,OAAO,CAAA;IACrB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,YAAY,EAAE,OAAO,CAAA;IACrB,eAAe,EAAE,OAAO,CAAA;IACxB,gBAAgB,EAAE,OAAO,CAAA;IACzB,qBAAqB,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,GAAG,oBAAoB,CAsBrG;AAED,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,CAyRjF"}
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../src/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,OAAO,CAAA;IACrB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,YAAY,EAAE,OAAO,CAAA;IACrB,eAAe,EAAE,OAAO,CAAA;IACxB,gBAAgB,EAAE,OAAO,CAAA;IACzB,qBAAqB,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,GAAG,oBAAoB,CAsBrG;AAED,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,CAiSjF"}

package/dist/user-config.d.ts

@@ -4,6 +4,14 @@ export interface ResolvedUserConfigEntry {
     value: string | number | boolean;
     envVar?: string;
 }
+export interface InstalledUserConfigPayload {
+    values?: Record<string, string | number | boolean>;
+    env?: Record<string, string>;
+    envRefs?: Record<string, string>;
+    secretStorage?: 'env-ref' | 'materialized';
+    secretKeys?: string[];
+    secretEnv?: string[];
+}
 interface DerivedUserConfigEntry extends UserConfigEntry {
     source: 'explicit' | 'mcp-auth' | 'mcp-env';
 }
@@ -16,5 +24,8 @@ export declare function collectUserConfigEntries(config: PluginConfig, platforms
 export declare function resolveUserConfigEntriesForTarget(entries: ResolvedUserConfigEntry[], target: TargetPlatform): ResolvedUserConfigEntry[];
 export declare function buildUserConfigEnvMap(entries: ResolvedUserConfigEntry[]): Record<string, string>;
 export declare function buildUserConfigValueMap(entries: ResolvedUserConfigEntry[]): Record<string, string | number | boolean>;
+export declare function buildInstalledUserConfigPayload(entries: ResolvedUserConfigEntry[], options?: {
+    preserveSecretReferences?: boolean;
+}): InstalledUserConfigPayload;
 export {};
 //# sourceMappingURL=user-config.d.ts.map

package/dist/user-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-config.d.ts","sourceRoot":"","sources":["../src/user-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAa,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAExF,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,eAAe,CAAA;IACtB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,sBAAuB,SAAQ,eAAe;IACtD,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAA;CAC5C;AAcD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS5D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU7D;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKhE;AA2CD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,SAAS,GAAE,cAAc,EAAmB,GAC3C,sBAAsB,EAAE,CAyD1B;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,uBAAuB,EAAE,EAClC,MAAM,EAAE,cAAc,GACrB,uBAAuB,EAAE,CAE3B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOhG;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAMrH"}
+{"version":3,"file":"user-config.d.ts","sourceRoot":"","sources":["../src/user-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAa,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAExF,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,eAAe,CAAA;IACtB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,aAAa,CAAC,EAAE,SAAS,GAAG,cAAc,CAAA;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,UAAU,sBAAuB,SAAQ,eAAe;IACtD,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAA;CAC5C;AAcD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS5D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU7D;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKhE;AA2CD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,SAAS,GAAE,cAAc,EAAmB,GAC3C,sBAAsB,EAAE,CAyD1B;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,uBAAuB,EAAE,EAClC,MAAM,EAAE,cAAc,GACrB,uBAAuB,EAAE,CAE3B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOhG;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAMrH;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,uBAAuB,EAAE,EAClC,OAAO,GAAE;IAAE,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAAO,GACnD,0BAA0B,CAqC5B"}

package/dist/validation/platform-rules.d.ts

@@ -77,6 +77,7 @@ export interface PlatformRules {
 }
 export type PrimitiveTranslationMode = 'preserve' | 'translate' | 'degrade' | 'drop';
 export type CoreFourPlatform = Extract<TargetPlatform, 'claude-code' | 'cursor' | 'codex' | 'opencode'>;
+export declare const CORE_FOUR_PLATFORMS: readonly ["claude-code", "cursor", "codex", "opencode"];
 export interface PlatformPrimitiveCapability {
     mode: PrimitiveTranslationMode;
     nativeSurfaces: string[];

package/dist/validation/platform-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-rules.d.ts","sourceRoot":"","sources":["../../src/validation/platform-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAGpE,KAAK,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAA;AAE/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;AAE/D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,iBAAiB,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC/C,0BAA0B,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACtD,qBAAqB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACjD,YAAY,EAAE,mBAAmB,CAAA;IACjC,qBAAqB,EAAE,mBAAmB,CAAA;IAC1C,iBAAiB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC7C,sBAAsB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAClD,kBAAkB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC9C,oBAAoB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAChD,gBAAgB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC5C,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,cAAc,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,cAAc,CAAA;IACtB,aAAa,EAAE,qBAAqB,CAAA;IACpC,kBAAkB,EAAE;QAClB,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,SAAS,CAAA;QAChB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,EAAE,CAAA;IACH,WAAW,EAAE;QACX,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,QAAQ,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,GAAG,EAAE;QACH,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,IAAI,EAAE,MAAM,EAAE,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO,CAAA;QAClB,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,YAAY,EAAE;QACZ,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAC9B;AAED,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAA;AAEpF,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC,CAAA;AAEvG,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,wBAAwB,CAAA;IAC9B,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAA;IACjE,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAC9B;AAuCD,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,cAAc,CAoDlE,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,cAAc,EAAE,qBAAqB,CAkFjF,CAAA;AAED,KAAK,cAAc,GAAG,OAAO,CAC3B,cAAc,EACZ,aAAa,GACb,QAAQ,GACR,OAAO,GACP,UAAU,GACV,WAAW,GACX,MAAM,GACN,YAAY,GACZ,UAAU,GACV,OAAO,GACP,KAAK,CACR,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,cAAc,EAAE,aAAa,CAwe3E,CAAA;AAED,eAAO,MAAM,gCAAgC,EAAE,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,CA2KpG,CAAA;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,aAAa,CAExE;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,6BAA6B,CAE1G"}
+{"version":3,"file":"platform-rules.d.ts","sourceRoot":"","sources":["../../src/validation/platform-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAIpE,KAAK,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAA;AAE/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;AAE/D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,iBAAiB,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC/C,0BAA0B,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACtD,qBAAqB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACjD,YAAY,EAAE,mBAAmB,CAAA;IACjC,qBAAqB,EAAE,mBAAmB,CAAA;IAC1C,iBAAiB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC7C,sBAAsB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAClD,kBAAkB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC9C,oBAAoB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAChD,gBAAgB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC5C,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,cAAc,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,cAAc,CAAA;IACtB,aAAa,EAAE,qBAAqB,CAAA;IACpC,kBAAkB,EAAE;QAClB,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,SAAS,CAAA;QAChB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,EAAE,CAAA;IACH,WAAW,EAAE;QACX,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,QAAQ,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,GAAG,EAAE;QACH,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,IAAI,EAAE,MAAM,EAAE,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO,CAAA;QAClB,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,YAAY,EAAE;QACZ,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAC9B;AAED,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAA;AAEpF,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC,CAAA;AACvG,eAAO,MAAM,mBAAmB,yDAAgG,CAAA;AAEhI,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,wBAAwB,CAAA;IAC9B,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAA;IACjE,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAC9B;AAuCD,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,cAAc,CAoDlE,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,cAAc,EAAE,qBAAqB,CAkFjF,CAAA;AAED,KAAK,cAAc,GAAG,OAAO,CAC3B,cAAc,EACZ,aAAa,GACb,QAAQ,GACR,OAAO,GACP,UAAU,GACV,WAAW,GACX,MAAM,GACN,YAAY,GACZ,UAAU,GACV,OAAO,GACP,KAAK,CACR,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,cAAc,EAAE,aAAa,CAwe3E,CAAA;AAED,eAAO,MAAM,gCAAgC,EAAE,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,CA2KpG,CAAA;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,aAAa,CAExE;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,6BAA6B,CAE1G"}