@paperclipai/server 2026.824.0 → 2026.825.0-beta.1

package/dist/services/scripts/codex-auth-read.cjs

@@ -0,0 +1,93 @@
+// The descriptor-bound credential read helper. The server runs it in the sandbox
+// as `node -e <this file> <sessionHome> <maxBytes> [<expectedUid>]`. The sandbox
+// already runs node for the Paperclip bridge, so the helper needs no extra
+// runtime.
+//
+// The helper closes the time-of-check-to-time-of-use (TOCTOU) window. It opens
+// the filesystem root, then opens each session-home path component in turn with a
+// no-follow, directory-only open, relative to the previous directory descriptor. A
+// symlink at any component fails the walk. Node has no `openat`, so the helper
+// opens each next component through `/proc/self/fd/<dfd>/<component>`: the kernel
+// resolves the magic descriptor link, then applies `O_NOFOLLOW` to the final
+// component. This binds each open to the descriptor inode, not to a re-resolved
+// pathname, so it matches an `openat` walk.
+//
+// The helper opens `auth.json` relative to the final directory descriptor with
+// `O_NOFOLLOW`, runs `fstat` on that one descriptor, and reads only from it. The
+// `fstat` check requires a regular file, the expected owner, exact mode `0600`,
+// and a size at or below the bound. The helper never re-opens the pathname after
+// the check.
+//
+// Security: the helper prints only the base64 of the credential bytes on the
+// fully validated success path. It prints one fixed error token on stderr on every
+// failed path. It never prints the pathname, the raw bytes, or any other detail.
+
+"use strict";
+
+const fs = require("node:fs");
+
+const NAME = "auth.json";
+const home = process.argv[1];
+const max = Number.parseInt(process.argv[2], 10);
+const expectedUid =
+  process.argv[3] !== undefined ? Number.parseInt(process.argv[3], 10) : process.getuid();
+
+function fail() {
+  process.stderr.write("AUTH_READ_FAILED\n");
+  process.exit(1);
+}
+
+if (!Number.isInteger(max) || max <= 0) fail();
+if (typeof home !== "string" || !home.startsWith("/")) fail();
+const parts = home.split("/").filter((component) => component.length > 0);
+if (parts.length === 0) fail();
+
+// Open each component with a no-follow, directory-only open relative to the
+// previous descriptor. A symlink or a non-directory at any component throws, so
+// the read fails closed and never leaves the trusted tree.
+let dfd;
+try {
+  dfd = fs.openSync("/", fs.constants.O_RDONLY | fs.constants.O_DIRECTORY);
+} catch {
+  fail();
+}
+for (const part of parts) {
+  try {
+    dfd = fs.openSync(
+      `/proc/self/fd/${dfd}/${part}`,
+      fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW,
+    );
+  } catch {
+    fail();
+  }
+}
+
+// Open the credential relative to the final directory descriptor with a no-follow
+// open, so a symlink credential fails and a missing credential fails.
+let ffd;
+try {
+  ffd = fs.openSync(`/proc/self/fd/${dfd}/${NAME}`, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+} catch {
+  fail();
+}
+
+// Validate the opened descriptor, then read only from it.
+const st = fs.fstatSync(ffd);
+if (!st.isFile()) fail();
+if (st.uid !== expectedUid) fail();
+if ((st.mode & 0o7777) !== 0o600) fail();
+if (st.size > max) fail();
+
+const buffer = Buffer.allocUnsafe(65536);
+const chunks = [];
+let total = 0;
+for (;;) {
+  const read = fs.readSync(ffd, buffer, 0, buffer.length, null);
+  if (read === 0) break;
+  chunks.push(Buffer.from(buffer.subarray(0, read)));
+  total += read;
+  if (total > max) fail();
+}
+
+process.stdout.write(Buffer.concat(chunks).toString("base64"));
+process.exit(0);

package/dist/services/secret-proposal-authorization.d.ts

@@ -0,0 +1,15 @@
+import type { Db } from "@paperclipai/db";
+import { type AuthorizationActor } from "./authorization.js";
+type ResolvableSecretProposal = {
+    kind: string;
+    targetId: string | null;
+};
+export declare function assertCanResolveProposal(input: {
+    db: Db;
+    actor: AuthorizationActor;
+    companyId: string;
+    proposal: ResolvableSecretProposal;
+    assertSecretDefinitionAdmin?: () => void;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=secret-proposal-authorization.d.ts.map

package/dist/services/secret-proposal-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-proposal-authorization.d.ts","sourceRoot":"","sources":["../../src/services/secret-proposal-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAG1C,OAAO,EAA8B,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,EAAE,EAAE,EAAE,CAAC;IACP,KAAK,EAAE,kBAAkB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,wBAAwB,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1C,iBAwBA"}

package/dist/services/secret-proposal-authorization.js

@@ -0,0 +1,29 @@
+import { forbidden, unprocessable } from "../errors.js";
+import { accessService } from "./access.js";
+import { authorizationDeniedDetails } from "./authorization.js";
+export async function assertCanResolveProposal(input) {
+    if (input.proposal.kind === "secret") {
+        if (!input.assertSecretDefinitionAdmin) {
+            throw forbidden("Company admin access required");
+        }
+        input.assertSecretDefinitionAdmin();
+        return;
+    }
+    if (input.proposal.kind !== "binding" || !input.proposal.targetId) {
+        throw unprocessable("Binding proposal target is missing");
+    }
+    const decision = await accessService(input.db).decide({
+        actor: input.actor,
+        action: "agent_config:update",
+        resource: {
+            type: "agent",
+            companyId: input.companyId,
+            agentId: input.proposal.targetId,
+        },
+        scope: { requiresChangeGrant: true },
+    });
+    if (!decision.allowed) {
+        throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
+    }
+}
+//# sourceMappingURL=secret-proposal-authorization.js.map

package/dist/services/secret-proposal-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-proposal-authorization.js","sourceRoot":"","sources":["../../src/services/secret-proposal-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAA2B,MAAM,oBAAoB,CAAC;AAOzF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAM9C;IACC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;YACvC,MAAM,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,aAAa,CAAC,oCAAoC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;SACjC;QACD,KAAK,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/services/secret-proposal-notifications.d.ts

@@ -0,0 +1,18 @@
+import type { issueService } from "./issues.js";
+import { type IssueAssignmentWakeupDeps } from "./issue-assignment-wakeup.js";
+type ProposalResolutionNotification = {
+    originIssueId: string | null;
+    kind: string;
+    proposedName: string | null;
+    configPath: string | null;
+};
+export declare function notifySecretProposalResolution(input: {
+    proposal: ProposalResolutionNotification;
+    status: "approved" | "rejected";
+    userId: string;
+    reason?: string | null;
+    issues: Pick<ReturnType<typeof issueService>, "getById" | "addComment">;
+    heartbeat: IssueAssignmentWakeupDeps;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=secret-proposal-notifications.d.ts.map

package/dist/services/secret-proposal-notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-proposal-notifications.d.ts","sourceRoot":"","sources":["../../src/services/secret-proposal-notifications.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAC;AAEtC,KAAK,8BAA8B,GAAG;IACpC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,QAAQ,EAAE,8BAA8B,CAAC;IACzC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC,CAAC;IACxE,SAAS,EAAE,yBAAyB,CAAC;CACtC,iBAuCA"}

package/dist/services/secret-proposal-notifications.js

@@ -0,0 +1,37 @@
+import { logger } from "../middleware/logger.js";
+import { queueIssueAssignmentWakeup, } from "./issue-assignment-wakeup.js";
+export async function notifySecretProposalResolution(input) {
+    if (!input.proposal.originIssueId)
+        return;
+    try {
+        const issue = await input.issues.getById(input.proposal.originIssueId);
+        if (!issue)
+            return;
+        const subject = input.proposal.kind === "secret"
+            ? `secret proposal \`${input.proposal.proposedName ?? "unnamed"}\``
+            : `binding proposal \`${input.proposal.configPath ?? "unknown"}\``;
+        const configPath = input.proposal.kind === "binding"
+            ? `\n- New config path: \`${input.proposal.configPath ?? "unknown"}\`\n- Verify: \`GET /api/agents/me/secrets\``
+            : "";
+        const reason = input.reason ? `\n\nReason: ${input.reason}` : "";
+        try {
+            await input.issues.addComment(issue.id, `Secret proposal resolution\n\n- Proposal: ${subject}\n- Status: **${input.status}**${configPath}${reason}`, { userId: input.userId });
+        }
+        catch (err) {
+            logger.warn({ err, issueId: issue.id, proposalStatus: input.status }, "failed to post secret proposal resolution comment");
+        }
+        await queueIssueAssignmentWakeup({
+            heartbeat: input.heartbeat,
+            issue,
+            reason: "secret_proposal_resolved",
+            mutation: `secret_proposal_${input.status}`,
+            contextSource: "secret.proposal.resolution",
+            requestedByActorType: "user",
+            requestedByActorId: input.userId,
+        });
+    }
+    catch (err) {
+        logger.warn({ err, issueId: input.proposal.originIssueId, proposalStatus: input.status }, "failed to notify origin issue about secret proposal resolution");
+    }
+}
+//# sourceMappingURL=secret-proposal-notifications.js.map

package/dist/services/secret-proposal-notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-proposal-notifications.js","sourceRoot":"","sources":["../../src/services/secret-proposal-notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EACL,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AAStC,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAOpD;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa;QAAE,OAAO;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAC9C,CAAC,CAAC,qBAAqB,KAAK,CAAC,QAAQ,CAAC,YAAY,IAAI,SAAS,IAAI;YACnE,CAAC,CAAC,sBAAsB,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS,IAAI,CAAC;QACrE,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;YAClD,CAAC,CAAC,0BAA0B,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS,8CAA8C;YAChH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAC3B,KAAK,CAAC,EAAE,EACR,6CAA6C,OAAO,iBAAiB,KAAK,CAAC,MAAM,KAAK,UAAU,GAAG,MAAM,EAAE,EAC3G,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,EACxD,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,0BAA0B,CAAC;YAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;YACL,MAAM,EAAE,0BAA0B;YAClC,QAAQ,EAAE,mBAAmB,KAAK,CAAC,MAAM,EAAE;YAC3C,aAAa,EAAE,4BAA4B;YAC3C,oBAAoB,EAAE,MAAM;YAC5B,kBAAkB,EAAE,KAAK,CAAC,MAAM;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,EAC5E,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/services/secret-proposals.d.ts

@@ -32,6 +32,7 @@ export declare function createSecretProposalsService(db: Db): {
         proposedByAgentId: string;
         originIssueId: string | null;
         originRunId: string;
+        interactionId: string | null;
         resolvedByUserId: string | null;
         resolvedAt: Date | null;
         resolutionReason: string | null;
@@ -69,17 +70,18 @@ export declare function createSecretProposalsService(db: Db): {
         updatedAt: Date;
         resolvedAt: Date | null;
         secretId: string | null;
+        interactionId: string | null;
         expiresAt: Date;
+        configPath: string | null;
+        justification: string;
         resolvedByUserId: string | null;
         projectionClass: string;
         targetType: string | null;
         targetId: string | null;
-        configPath: string | null;
         originIssueId: string | null;
         proposedName: string | null;
         proposedKey: string | null;
         proposedDescription: string | null;
-        justification: string;
         valueFingerprintSha256: string | null;
         valueLength: number | null;
         secretProposalId: string | null;
@@ -105,17 +107,18 @@ export declare function createSecretProposalsService(db: Db): {
         updatedAt: Date;
         resolvedAt: Date | null;
         secretId: string | null;
+        interactionId: string | null;
         expiresAt: Date;
+        configPath: string | null;
+        justification: string;
         resolvedByUserId: string | null;
         projectionClass: string;
         targetType: string | null;
         targetId: string | null;
-        configPath: string | null;
         originIssueId: string | null;
         proposedName: string | null;
         proposedKey: string | null;
         proposedDescription: string | null;
-        justification: string;
         valueCiphertext: Record<string, unknown> | null;
         valueFingerprintSha256: string | null;
         valueLength: number | null;
@@ -131,6 +134,7 @@ export declare function createSecretProposalsService(db: Db): {
     }>;
     createBinding: (context: Pick<ProposalRunContext, "companyId" | "heartbeatRunId">, input: {
         secretId?: string | null;
+        sourceConfigPath?: string | null;
         secretProposalId?: string | null;
         targetAgentId?: string | null;
         configPath: string;
@@ -146,17 +150,18 @@ export declare function createSecretProposalsService(db: Db): {
         updatedAt: Date;
         resolvedAt: Date | null;
         secretId: string | null;
+        interactionId: string | null;
         expiresAt: Date;
+        configPath: string | null;
+        justification: string;
         resolvedByUserId: string | null;
         projectionClass: string;
         targetType: string | null;
         targetId: string | null;
-        configPath: string | null;
         originIssueId: string | null;
         proposedName: string | null;
         proposedKey: string | null;
         proposedDescription: string | null;
-        justification: string;
         valueCiphertext: Record<string, unknown> | null;
         valueFingerprintSha256: string | null;
         valueLength: number | null;
@@ -200,17 +205,18 @@ export declare function createSecretProposalsService(db: Db): {
         updatedAt: Date;
         resolvedAt: Date | null;
         secretId: string | null;
+        interactionId: string | null;
         expiresAt: Date;
+        configPath: string | null;
+        justification: string;
         resolvedByUserId: string | null;
         projectionClass: string;
         targetType: string | null;
         targetId: string | null;
-        configPath: string | null;
         originIssueId: string | null;
         proposedName: string | null;
         proposedKey: string | null;
         proposedDescription: string | null;
-        justification: string;
         valueFingerprintSha256: string | null;
         valueLength: number | null;
         secretProposalId: string | null;
@@ -250,17 +256,18 @@ export declare function createSecretProposalsService(db: Db): {
         updatedAt: Date;
         resolvedAt: Date | null;
         secretId: string | null;
+        interactionId: string | null;
         expiresAt: Date;
+        configPath: string | null;
+        justification: string;
         resolvedByUserId: string | null;
         projectionClass: string;
         targetType: string | null;
         targetId: string | null;
-        configPath: string | null;
         originIssueId: string | null;
         proposedName: string | null;
         proposedKey: string | null;
         proposedDescription: string | null;
-        justification: string;
         valueFingerprintSha256: string | null;
         valueLength: number | null;
         secretProposalId: string | null;
@@ -279,6 +286,7 @@ export declare function createSecretProposalsService(db: Db): {
             description?: string | null;
             providerConfigId?: string | null;
         };
+        assertCanResolve?: (proposal: Proposal, txDb: Db) => Promise<void>;
     }) => Promise<{
         id: string;
         companyId: string;
@@ -303,6 +311,7 @@ export declare function createSecretProposalsService(db: Db): {
         proposedByAgentId: string;
         originIssueId: string | null;
         originRunId: string;
+        interactionId: string | null;
         resolvedByUserId: string | null;
         resolvedAt: Date | null;
         resolutionReason: string | null;
@@ -341,6 +350,7 @@ export declare function createSecretProposalsService(db: Db): {
         proposedByAgentId: string;
         originIssueId: string | null;
         originRunId: string;
+        interactionId: string | null;
         resolvedByUserId: string | null;
         resolvedAt: Date | null;
         resolutionReason: string | null;

package/dist/services/secret-proposals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-proposals.d.ts","sourceRoot":"","sources":["../../src/services/secret-proposals.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAU,sBAAsB,EAAyC,MAAM,iBAAiB,CAAC;AAiBxG,MAAM,MAAM,4BAA4B,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAC;AAEF,KAAK,QAAQ,GAAG,OAAO,sBAAsB,CAAC,YAAY,CAAC;AA0C3D,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,EAAE;yBACf,MAAM,cAAc,MAAM,aAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAyM1C,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA/GH,kBAAkB,SAAS;QAC9D,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;KACvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAsCqC,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,gBAAgB,CAAC,SAAS;QACrG,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,kBAAkB,CAAC;KACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAoGY,MAAM,WACR,MAAM,YACN;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAejC,MAAM,WACR,MAAM,GAAG,IAAI,YACb;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAWQ,QAAQ,aAAY,EAAE;yBA4I1C,MAAM,cAAc,MAAM,SAAS;QACnE,gBAAgB,EAAE,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,SAAS,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAiDoC,MAAM,cAAc,MAAM,UAAU,OAAO,CAAC,4BAA4B,EAAE,UAAU,CAAC,UAAS;QACjI,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gEAwEiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;EAsB9E"}
+{"version":3,"file":"secret-proposals.d.ts","sourceRoot":"","sources":["../../src/services/secret-proposals.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAGL,sBAAsB,EAOvB,MAAM,iBAAiB,CAAC;AAiBzB,MAAM,MAAM,4BAA4B,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAC;AAEF,KAAK,QAAQ,GAAG,OAAO,sBAAsB,CAAC,YAAY,CAAC;AA0C3D,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,EAAE;yBACf,MAAM,cAAc,MAAM,aAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA+Y1C,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAtKH,kBAAkB,SAAS;QAC9D,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;KACvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAsCqC,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,gBAAgB,CAAC,SAAS;QACrG,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,kBAAkB,CAAC;KACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA0JY,MAAM,WACR,MAAM,YACN;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAejC,MAAM,WACR,MAAM,GAAG,IAAI,YACb;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAWQ,QAAQ,aAAY,EAAE;yBAsK1C,MAAM,cAAc,MAAM,SAAS;QACnE,gBAAgB,EAAE,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,SAAS,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QAC7F,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAkDoC,MAAM,cAAc,MAAM,UAAU,OAAO,CAAC,4BAA4B,EAAE,UAAU,CAAC,UAAS;QACjI,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gEAgFiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;EAsB9E"}