aimeat 2.7.0 → 3.0.0

package/dist/src/routes/sharing-groups.js

@@ -10,21 +10,31 @@
  *   - POST   /v1/groups/:id/members  -- Add member
  *   - PATCH  /v1/groups/:id/members/:identifier -- Update member permissions
  *   - DELETE /v1/groups/:id/members/:identifier -- Remove member
+ *   - POST   /v1/groups/:id/shares   -- Share a key space with this group
+ *   - GET    /v1/groups/:id/shares   -- What this group can reach
+ *   - GET    /v1/shares              -- What I have shared, and to whom
+ *   - GET    /v1/shares/incoming     -- What has been shared WITH me
+ *   - DELETE /v1/shares/:shareId     -- Stop sharing
  * @version-history
+ *   v1.2.0 -- 2026-08-11 -- Key-space shares. A group could only ever be pointed at one record at a
+ *     time (`visibility:'group'` + one `groupId` on the record), which meant a subscription had to
+ *     re-share every new key and could not hand anyone a space that does not exist yet. A share is
+ *     now (owner, group, key pattern), the record stays private, and both list directions exist —
+ *     including the reader's, whose absence is why nobody could find what they had been given.
+ *   v1.1.0 -- 2026-08-11 -- Create, add-member and remove-member call
+ *     services/sharing-group-members.ts, which aimeat_group_create and friends now call too. This
+ *     router keeps the envelope and the status codes and nothing else of those three.
  *   v1.0.0 -- 2026-05-21 -- Initial creation for Agent Dashboard Phase 1
  */
 import { Router } from 'express';
-import { v4 as uuidv4 } from 'uuid';
+import { randomUUID } from 'node:crypto';
+import { createSharingGroup, addSharingGroupMember, removeSharingGroupMember, } from '../services/sharing-group-members.js';
+import { createShare, revokeShare, listOutgoingShares, listIncomingShares, } from '../services/group-shares.js';
 import { success, error } from '../middleware/envelope.js';
-import { requireAuth, requireRole } from '../auth/middleware.js';
+import { requireAuth, requireRole, requireScope } from '../auth/middleware.js';
 import { resolveIdentity } from '../utils/gaii.js';
 import { emitChange } from '../services/event-bus.js';
-import { SharingGroupCreateSchema, SharingGroupUpdateSchema, SharingGroupAddMemberSchema, SharingGroupUpdateMemberSchema, } from '../models/sharing-group-schemas.js';
-function resolveMemberIdentifier(identifier, nodeId) {
-    if (identifier.includes('@') || identifier.includes('#'))
-        return identifier;
-    return `${identifier}@${nodeId}`;
-}
+import { SharingGroupUpdateSchema, SharingGroupUpdateMemberSchema, } from '../models/sharing-group-schemas.js';
 export function sharingGroupsRouter(config, storage) {
     const router = Router();
     /** Resolve effective identity -- owner sessions use GHII, agents use GAII */
@@ -32,43 +42,18 @@ export function sharingGroupsRouter(config, storage) {
     /* ── POST /v1/groups -- Create a sharing group ── */
     router.post('/v1/groups', requireAuth(), requireRole('owner'), async (req, res) => {
         const ownerGaii = resolve(req);
-        const parsed = SharingGroupCreateSchema.safeParse(req.body);
-        if (!parsed.success) {
-            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', parsed.error.issues.map(i => i.message).join(', ')));
-            return;
-        }
-        const { name, description, members, default_permissions } = parsed.data;
-        // Max 50 groups per owner
-        const existing = await storage.listSharingGroups(ownerGaii);
-        if (existing.length >= 50) {
-            res.status(409).json(error(config.nodeId, 'LIMIT_REACHED', 'Maximum 50 sharing groups per owner'));
+        // Validation, the 50-group ceiling, the member's stored address, the record and the change
+        // event are services/sharing-group-members.ts, because aimeat_group_create decides them too.
+        const created = await createSharingGroup({ storage, config }, ownerGaii, req.body);
+        if (!created.ok) {
+            res.status(created.status).json(error(config.nodeId, created.code, created.message));
             return;
         }
-        const now = new Date().toISOString();
-        const id = uuidv4();
-        // Convert members from request format (identifier_type) to storage format (identifierType)
-        const storageMbers = members.map(m => ({
-            identifier: resolveMemberIdentifier(m.identifier, config.nodeId),
-            identifierType: m.identifier_type,
-            permissions: m.permissions ?? default_permissions,
-            addedAt: now,
-            addedBy: ownerGaii,
-        }));
-        const record = await storage.createSharingGroup({
-            id,
-            name: name.trim(),
-            description: description?.trim(),
-            ownerGaii,
-            members: storageMbers,
-            defaultPermissions: default_permissions,
-            createdAt: now,
-            updatedAt: now,
-        });
+        const record = created.group;
         res.status(201).json(success(config.nodeId, { group: record }, [
-            { description: 'View group', method: 'GET', url: `/v1/groups/${id}` },
-            { description: 'Add member', method: 'POST', url: `/v1/groups/${id}/members` },
+            { description: 'View group', method: 'GET', url: `/v1/groups/${record.id}` },
+            { description: 'Add member', method: 'POST', url: `/v1/groups/${record.id}/members` },
         ]));
-        emitChange('groups');
     });
     /* ── GET /v1/groups -- List own + member-of groups ── */
     router.get('/v1/groups', requireAuth(), async (req, res) => {
@@ -167,9 +152,13 @@ export function sharingGroupsRouter(config, storage) {
         }
         // Check if any memory entries reference this group
         const refCount = await storage.countEntriesReferencingGroup(id);
+        // The group's shares go with it. A share whose audience no longer exists grants nothing anyway,
+        // and leaving the rows behind would make "what have I shared" list access that nobody holds.
+        const droppedShares = await storage.deleteGroupSharesByGroup(id);
         await storage.deleteSharingGroup(id);
         res.json(success(config.nodeId, {
             deleted: true,
+            shares_revoked: droppedShares,
             warning: refCount > 0
                 ? `${refCount} memory entries referenced this group and will fall back to private visibility`
                 : undefined,
@@ -180,50 +169,14 @@ export function sharingGroupsRouter(config, storage) {
     router.post('/v1/groups/:id/members', requireAuth(), requireRole('owner'), async (req, res) => {
         const id = req.params.id;
         const ownerGaii = resolve(req);
-        const group = await storage.getSharingGroup(id);
-        if (!group) {
-            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Sharing group not found'));
-            return;
-        }
-        if (group.ownerGaii !== ownerGaii) {
-            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the group owner can add members'));
+        // Ownership, the ceiling, the duplicate test, the member's stored address and the write are
+        // services/sharing-group-members.ts, because aimeat_group_add_member decides them too.
+        const added = await addSharingGroupMember({ storage, config }, ownerGaii, id, req.body);
+        if (!added.ok) {
+            res.status(added.status).json(error(config.nodeId, added.code, added.message));
             return;
         }
-        if (group.members.length >= 100) {
-            res.status(409).json(error(config.nodeId, 'LIMIT_REACHED', 'Maximum 100 members per group'));
-            return;
-        }
-        const parsed = SharingGroupAddMemberSchema.safeParse(req.body);
-        if (!parsed.success) {
-            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', parsed.error.issues.map(i => i.message).join(', ')));
-            return;
-        }
-        const { identifier: rawIdentifier, identifier_type, permissions } = parsed.data;
-        const identifier = resolveMemberIdentifier(rawIdentifier, config.nodeId);
-        // Check for duplicate
-        if (group.members.some(m => m.identifier === identifier)) {
-            res.status(409).json(error(config.nodeId, 'DUPLICATE', 'Member already exists in this group'));
-            return;
-        }
-        const now = new Date().toISOString();
-        const newMember = {
-            identifier,
-            identifierType: identifier_type,
-            permissions: permissions ?? group.defaultPermissions,
-            addedAt: now,
-            addedBy: ownerGaii,
-        };
-        const updatedMembers = [...group.members, newMember];
-        const updated = await storage.updateSharingGroup(id, {
-            members: updatedMembers,
-            updatedAt: now,
-        });
-        if (!updated) {
-            res.status(500).json(error(config.nodeId, 'INTERNAL', 'Failed to add member'));
-            return;
-        }
-        res.status(201).json(success(config.nodeId, { group: updated, added: newMember }));
-        emitChange('groups');
+        res.status(201).json(success(config.nodeId, { group: added.group, added: added.member }));
     });
     /* ── PATCH /v1/groups/:id/members/:identifier -- Update member permissions ── */
     router.patch('/v1/groups/:id/members/:identifier', requireAuth(), requireRole('owner'), async (req, res) => {
@@ -271,31 +224,98 @@ export function sharingGroupsRouter(config, storage) {
         const id = req.params.id;
         const identifier = req.params.identifier;
         const ownerGaii = resolve(req);
+        const removed = await removeSharingGroupMember({ storage, config }, ownerGaii, id, identifier);
+        if (!removed.ok) {
+            res.status(removed.status).json(error(config.nodeId, removed.code, removed.message));
+            return;
+        }
+        res.json(success(config.nodeId, { group: removed.group, removed: removed.identifier }));
+    });
+    // ── Key-space shares ────────────────────────────────────────────────────────
+    // A share is (owner, group, key pattern). It is what actually grants a cross-owner read; the
+    // group is only the audience. Both list directions are here because the table answers two
+    // different people's questions, and the reader's half is the one whose absence made groups
+    // unusable: without it you have to be handed the owner identity and the exact key out of band.
+    const shareApi = (share) => ({
+        id: share.id,
+        group_id: share.groupId,
+        owner_gaii: share.ownerGaii,
+        key_pattern: share.keyPattern,
+        note: share.note ?? null,
+        expires_at: share.expiresAt ?? null,
+        created_at: share.createdAt,
+        created_by: share.createdBy,
+    });
+    /** The caller as the share layer sees them: which owner it lands under, and who is acting. */
+    const shareCaller = (req) => ({
+        ownerGaii: `${req.auth.owner}@${config.nodeId}`,
+        principal: resolve(req),
+        scopes: req.auth.scopes ?? [],
+        roles: req.auth.roles,
+    });
+    // The write gate for shares lives in services/group-shares.ts and nowhere else, so this door and
+    // the MCP one refuse for the same reason. It cannot be a `requireRole('owner')` here: an agent's
+    // token carries its owner's `owner` role (routes/auth.ts), so a role check would pass every agent
+    // and `share:manage` would be decoration. The service distinguishes the human from the agent.
+    /* ── POST /v1/groups/:id/shares -- share a key space with this group ── */
+    router.post('/v1/groups/:id/shares', requireAuth(), requireScope('share:manage'), async (req, res) => {
+        const { key_pattern, note, expires_at } = req.body ?? {};
+        const created = await createShare({ storage, newId: () => randomUUID(), now: () => new Date().toISOString() }, shareCaller(req), { groupId: req.params.id, keyPattern: key_pattern, note, expiresAt: expires_at ?? null });
+        if (!created.ok) {
+            res.status(created.status).json(error(config.nodeId, created.code, created.message));
+            return;
+        }
+        res.status(201).json(success(config.nodeId, { share: shareApi(created.value) }, [
+            { description: 'What you have shared', method: 'GET', url: '/v1/shares' },
+            { description: 'Stop sharing this', method: 'DELETE', url: `/v1/shares/${created.value.id}` },
+        ]));
+        emitChange('groups');
+    });
+    /* ── GET /v1/groups/:id/shares -- what this group can reach ── */
+    router.get('/v1/groups/:id/shares', requireAuth(), requireScope('memory:read'), async (req, res) => {
+        const id = req.params.id;
         const group = await storage.getSharingGroup(id);
         if (!group) {
             res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Sharing group not found'));
             return;
         }
-        if (group.ownerGaii !== ownerGaii) {
-            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the group owner can remove members'));
-            return;
-        }
-        const memberIdx = group.members.findIndex(m => m.identifier === identifier);
-        if (memberIdx === -1) {
-            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Member not found in this group'));
+        // Owner or member. A member seeing which key spaces they were given is the point; anyone else
+        // learns nothing, not even that the group exists.
+        const identity = resolve(req);
+        const ownerGhii = `${req.auth.owner}@${config.nodeId}`;
+        const isOwner = group.ownerGaii === identity || group.ownerGaii === ownerGhii;
+        const isMember = group.members.some(m => m.identifier === identity || m.identifier === ownerGhii);
+        if (!isOwner && !isMember) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Sharing group not found'));
             return;
         }
-        const updatedMembers = group.members.filter(m => m.identifier !== identifier);
-        const now = new Date().toISOString();
-        const updated = await storage.updateSharingGroup(id, {
-            members: updatedMembers,
-            updatedAt: now,
-        });
-        if (!updated) {
-            res.status(500).json(error(config.nodeId, 'INTERNAL', 'Failed to remove member'));
+        const all = await storage.listGroupSharesByGroups([id]);
+        res.json(success(config.nodeId, { shares: all.map(shareApi), total: all.length }));
+    });
+    /* ── GET /v1/shares -- what I have shared, and to whom ── */
+    router.get('/v1/shares', requireAuth(), requireScope('memory:read'), async (req, res) => {
+        const shares = await listOutgoingShares(storage, `${req.auth.owner}@${config.nodeId}`);
+        res.json(success(config.nodeId, { shares: shares.map(shareApi), total: shares.length }));
+    });
+    /* ── GET /v1/shares/incoming -- what has been shared WITH me ── */
+    // MUST stay above any /v1/shares/:param route (Express matches top-to-bottom).
+    router.get('/v1/shares/incoming', requireAuth(), requireScope('memory:read'), async (req, res) => {
+        // Resolved identity, not the raw sub: an owner session carries a bare account name, and every
+        // membership is keyed under the GHII. This is the same trap that made group reads fail for
+        // humans while working for their agents.
+        const shares = await listIncomingShares(storage, resolve(req));
+        res.json(success(config.nodeId, { shares: shares.map(shareApi), total: shares.length }, [
+            { description: 'Read a shared key', method: 'GET', url: '/v1/memory/{owner_gaii}/{key}' },
+        ]));
+    });
+    /* ── DELETE /v1/shares/:shareId -- stop sharing ── */
+    router.delete('/v1/shares/:shareId', requireAuth(), requireScope('share:manage'), async (req, res) => {
+        const revoked = await revokeShare({ storage }, shareCaller(req), req.params.shareId);
+        if (!revoked.ok) {
+            res.status(revoked.status).json(error(config.nodeId, revoked.code, revoked.message));
             return;
         }
-        res.json(success(config.nodeId, { group: updated, removed: identifier }));
+        res.json(success(config.nodeId, { revoked: true, share: shareApi(revoked.value) }));
         emitChange('groups');
     });
     return router;

package/dist/src/routes/sharing-groups.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharing-groups.js","sourceRoot":"","sources":["../../../src/routes/sharing-groups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,oCAAoC,CAAC;AAE5C,SAAS,uBAAuB,CAAC,UAAkB,EAAE,MAAc;IACjE,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5E,OAAO,GAAG,UAAU,IAAI,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,OAAgB;IACxE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEpF,qDAAqD;IACrD,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAExE,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QAEpB,2FAA2F;QAC3F,MAAM,YAAY,GAAyB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3D,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YAChE,cAAc,EAAE,CAAC,CAAC,eAAe;YACjC,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,mBAAmB;YACjD,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC;YAC9C,EAAE;YACF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE;YAChC,SAAS;YACT,OAAO,EAAE,YAAY;YACrB,kBAAkB,EAAE,mBAAmB;YACvC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7D,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE;YACrE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE;SAC/E,CAAC,CAAC,CAAC;QACJ,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,MAAM,cAAc,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,MAAM,CAAC;QACX,IAAI,cAAc,EAAE,CAAC;YACnB,iEAAiE;YACjE,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;YAEpE,8BAA8B;YAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC7D,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC;QAEpE,2DAA2D;QAC3D,MAAM,cAAc,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAE/F,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,oCAAoC,CAAC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,iCAAiC,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAA4B,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACjF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAChG,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS;YAAE,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;QAEhH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACrD,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,iCAAiC,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,mDAAmD;QACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;QAEhE,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAErC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;YAC9B,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,QAAQ,GAAG,CAAC;gBACnB,CAAC,CAAC,GAAG,QAAQ,gFAAgF;gBAC7F,CAAC,CAAC,SAAS;SACd,CAAC,CAAC,CAAC;QACJ,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5F,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,sCAAsC,CAAC,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,+BAA+B,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAChF,MAAM,UAAU,GAAG,uBAAuB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAEzE,sBAAsB;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,qCAAqC,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAuB;YACpC,UAAU;YACV,cAAc,EAAE,eAAe;YAC/B,WAAW,EAAE,WAAW,IAAI,KAAK,CAAC,kBAAkB;YACpD,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,SAAS;SACnB,CAAC;QAEF,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,EAAE;YACnD,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACnF,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzG,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,UAAoB,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QAC5E,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,gCAAgC,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,cAAc,CAAC,SAAS,CAAC,GAAG;YAC1B,GAAG,cAAc,CAAC,SAAS,CAAC;YAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;SACrC,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,EAAE;YACnD,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACrD,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,CAAC,MAAM,CAAC,oCAAoC,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1G,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,UAAoB,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QAC5E,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,gCAAgC,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,EAAE;YACnD,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAC1E,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"sharing-groups.js","sourceRoot":"","sources":["../../../src/routes/sharing-groups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,OAAgB;IACxE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEpF,qDAAqD;IACrD,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,2FAA2F;QAC3F,6FAA6F;QAC7F,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7D,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,MAAM,CAAC,EAAE,EAAE,EAAE;YAC5E,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,MAAM,CAAC,EAAE,UAAU,EAAE;SACtF,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,MAAM,cAAc,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,MAAM,CAAC;QACX,IAAI,cAAc,EAAE,CAAC;YACnB,iEAAiE;YACjE,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;YAEpE,8BAA8B;YAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC7D,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC;QAEpE,2DAA2D;QAC3D,MAAM,cAAc,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAE/F,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,oCAAoC,CAAC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,iCAAiC,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAA4B,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACjF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAChG,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS;YAAE,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;QAEhH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACrD,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,iCAAiC,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,mDAAmD;QACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;QAEhE,gGAAgG;QAChG,6FAA6F;QAC7F,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAErC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;YAC9B,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,aAAa;YAC7B,OAAO,EAAE,QAAQ,GAAG,CAAC;gBACnB,CAAC,CAAC,GAAG,QAAQ,gFAAgF;gBAC7F,CAAC,CAAC,SAAS;SACd,CAAC,CAAC,CAAC;QACJ,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5F,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,4FAA4F;QAC5F,uFAAuF;QACvF,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzG,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,UAAoB,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QAC5E,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,gCAAgC,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,cAAc,CAAC,SAAS,CAAC,GAAG;YAC1B,GAAG,cAAc,CAAC,SAAS,CAAC;YAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;SACrC,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,EAAE;YACnD,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACrD,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,CAAC,MAAM,CAAC,oCAAoC,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1G,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,UAAoB,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,6FAA6F;IAC7F,0FAA0F;IAC1F,2FAA2F;IAC3F,+FAA+F;IAE/F,MAAM,QAAQ,GAAG,CAAC,KAAyD,EAAE,EAAE,CAAC,CAAC;QAC/E,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QACnC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC,CAAC;IAEH,8FAA8F;IAC9F,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,CAAC;QAC7C,SAAS,EAAE,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;QAChD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM,IAAI,EAAE;QAC9B,KAAK,EAAE,GAAG,CAAC,IAAK,CAAC,KAAK;KACvB,CAAC,CAAC;IAEH,iGAAiG;IACjG,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAE9F,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnG,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAC3E,WAAW,CAAC,GAAG,CAAC,EAChB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAY,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,IAAI,IAAI,EAAE,CACnG,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;YAC9E,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE;YACzE,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE;SAC9F,CAAC,CAAC,CAAC;QACJ,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,WAAW,EAAE,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjG,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,8FAA8F;QAC9F,kDAAkD;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;QAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,+EAA+E;IAC/E,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,WAAW,EAAE,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/F,8FAA8F;QAC9F,2FAA2F;QAC3F,yCAAyC;QACzC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE;YACtF,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,+BAA+B,EAAE;SAC1F,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,WAAW,EAAE,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnG,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/routes/storage-files.d.ts

@@ -40,6 +40,19 @@
  *     `text/*` makes a browser fall back to the locale default and render UTF-8 as mojibake; these
  *     are UPLOADED bytes though, so a genuinely cp1252 .txt/.csv keeps the type it has today rather
  *     than being retyped into something its owner cannot read.
+ *   v1.10.0 -- 2026-08-11 -- POST /v1/storage stores through services/storage-file-write.ts, which
+ *     aimeat_storage_upload now calls too. The tool copy of this write had never run the account-wide
+ *     storage quota, never charged the overage that follows it, and had no anonymous key fence, so the
+ *     same upload was gated and billed through this door and neither through the tool. The presigned
+ *     branch also stops hand-writing the token meta: it dropped `group_id` and `workspace_refs`, so a
+ *     presigned upload asking for visibility 'group' landed bound to no group and was readable by
+ *     nobody. Chunked complete still writes its own copy; it has no tool twin.
+ *   v1.11.0 -- 2026-08-11 -- August 2026 audit H-26: every response that carries file bytes goes
+ *     through setStoredFileHeaders() (utils/file-download-headers.ts), which adds nosniff, a
+ *     Content-Disposition and a file-only CSP to the content type it already set. A file's type
+ *     comes from whoever uploaded it, and GET /v1/pub serves a public file to anyone from the apex
+ *     origin, so uploaded text/html or image/svg+xml was a page running next to the portal's
+ *     session. Images, media, PDFs and plain text still render inline; everything else downloads.
  */
 import { Router } from 'express';
 import type { AimeatConfig } from '../config.js';

package/dist/src/routes/storage-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-files.d.ts","sourceRoot":"","sources":["../../../src/routes/storage-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAuCvD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAqrBjF"}
+{"version":3,"file":"storage-files.d.ts","sourceRoot":"","sources":["../../../src/routes/storage-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,yBAAyB,CAAC;AAuC1E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CA6pBjF"}

package/dist/src/routes/storage-files.js

@@ -40,9 +40,22 @@
  *     `text/*` makes a browser fall back to the locale default and render UTF-8 as mojibake; these
  *     are UPLOADED bytes though, so a genuinely cp1252 .txt/.csv keeps the type it has today rather
  *     than being retyped into something its owner cannot read.
+ *   v1.10.0 -- 2026-08-11 -- POST /v1/storage stores through services/storage-file-write.ts, which
+ *     aimeat_storage_upload now calls too. The tool copy of this write had never run the account-wide
+ *     storage quota, never charged the overage that follows it, and had no anonymous key fence, so the
+ *     same upload was gated and billed through this door and neither through the tool. The presigned
+ *     branch also stops hand-writing the token meta: it dropped `group_id` and `workspace_refs`, so a
+ *     presigned upload asking for visibility 'group' landed bound to no group and was readable by
+ *     nobody. Chunked complete still writes its own copy; it has no tool twin.
+ *   v1.11.0 -- 2026-08-11 -- August 2026 audit H-26: every response that carries file bytes goes
+ *     through setStoredFileHeaders() (utils/file-download-headers.ts), which adds nosniff, a
+ *     Content-Disposition and a file-only CSP to the content type it already set. A file's type
+ *     comes from whoever uploaded it, and GET /v1/pub serves a public file to anyone from the apex
+ *     origin, so uploaded text/html or image/svg+xml was a page running next to the portal's
+ *     session. Images, media, PDFs and plain text still render inline; everything else downloads.
  */
 import { Router } from 'express';
-import { sniffedContentType } from '../utils/app-content-type.js';
+import { setStoredFileHeaders } from '../utils/file-download-headers.js';
 import { requireAuth, requireRole, requireExternalPrincipal, requireScope, optionalAuth } from '../auth/middleware.js';
 import { success, error } from '../middleware/envelope.js';
 import { emitChange } from '../services/event-bus.js';
@@ -54,7 +67,7 @@ import { checkStorageQuota, chargeOverage } from '../services/quota.js';
 import { emitResourceUpdated, emitResourceListChanged } from '../mcp/index.js';
 import { resolveIdentity } from '../utils/gaii.js';
 import { normalizeWorkspaceRefs } from '../utils/workspace-ref.js';
-import { generateUploadToken } from '../services/upload-token.js';
+import { writeStorageFile, mintStorageUploadUrl } from '../services/storage-file-write.js';
 import { generateDownloadToken, verifyDownloadToken, DownloadTokenError } from '../services/download-token.js';
 import { pubEmbedUrl, pubEmbedMarkdown } from '../services/doc-images.js';
 import { FOREIGN_HANDLE_TTL_SECONDS, OWN_HANDLE_TTL_SECONDS } from '../services/file-refs.js';
@@ -114,14 +127,14 @@ export function storageFilesRouter(config, storage) {
                 const end = match[2] ? parseInt(match[2], 10) : file.size - 1;
                 const chunk = file.data.subarray(start, end + 1);
                 res.status(206);
+                setStoredFileHeaders(res, file);
                 res.setHeader('Content-Range', `bytes ${start}-${end}/${file.size}`);
                 res.setHeader('Content-Length', chunk.length);
-                res.setHeader('Content-Type', sniffedContentType(file.mimeType, file.data));
                 res.end(chunk);
                 return;
             }
         }
-        res.setHeader('Content-Type', sniffedContentType(file.mimeType, file.data));
+        setStoredFileHeaders(res, file);
         res.setHeader('Content-Length', file.size);
         res.setHeader('Cache-Control', 'private, max-age=300');
         res.end(file.data);
@@ -142,33 +155,28 @@ export function storageFilesRouter(config, storage) {
             const { key: k, visibility: v, data, mime_type, mode, federate: reqFederate, group_id: reqGroupId, workspace_ref: reqWorkspaceRef, workspace_refs: reqWorkspaceRefs } = req.body ?? {};
             federateFlag = reqFederate === true;
             // --- PRESIGNED MODE: return upload URL ---
+            // The key fence and the token meta are the shared ones (services/storage-file-write.ts).
+            // Hand-writing the meta here is how `group_id` and `workspace_refs` used to be dropped at
+            // mint: a presigned upload asking for visibility 'group' landed bound to no group and was
+            // then readable by nobody.
             if (mode === 'presigned') {
-                if (!k) {
-                    res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'key is required'));
-                    return;
-                }
-                // Same namespace fence as the inline path below. It used to sit AFTER this early
-                // return, so minting a presigned URL was a way for an anonymous agent to write
-                // outside anonymous/* — the gate is on the representation, not on the write.
-                if (isAnonymousGaii(gaii) && !String(k).startsWith('anonymous/')) {
-                    res.status(403).json(error(config.nodeId, 'FORBIDDEN', 'Anonymous agents can only upload to keys prefixed with "anonymous/"'));
+                const minted = await mintStorageUploadUrl({ storage, config }, gaii, {
+                    key: k ? String(k) : '',
+                    mimeType: mime_type,
+                    visibility: v,
+                    groupId: reqGroupId,
+                    workspaceRef: normalizeWorkspaceRefs(reqWorkspaceRefs, reqWorkspaceRef) || undefined,
+                });
+                if (!minted.ok) {
+                    res.status(minted.status).json(error(config.nodeId, minted.code, minted.message));
                     return;
                 }
-                const maxBytes = config.storageMaxFileSizeMb * 1024 * 1024;
-                const ct = mime_type ?? 'application/octet-stream';
-                const token = await generateUploadToken({
-                    sub: gaii,
-                    utype: 'storage',
-                    meta: { key: k, mime_type: ct, visibility: v ?? 'private' },
-                    maxBytes,
-                    contentType: ct,
-                });
                 res.json(success(config.nodeId, {
-                    upload_url: `${config.baseUrl}/v1/upload/${token}`,
+                    upload_url: minted.uploadUrl,
                     upload_method: 'PUT',
-                    content_type: ct,
-                    max_size_bytes: maxBytes,
-                    expires_in_seconds: 3600,
+                    content_type: minted.contentType,
+                    max_size_bytes: minted.maxBytes,
+                    expires_in_seconds: minted.expiresInSeconds,
                 }));
                 return;
             }
@@ -184,11 +192,9 @@ export function storageFilesRouter(config, storage) {
             key = k;
             visibility = v ?? 'private';
             groupId = visibility === 'group' ? reqGroupId : undefined;
+            // A 'workspace' file that names no workspace is refused by the shared write below, which
+            // is also where the raw-body branch meets the same rule.
             workspaceRef = visibility === 'workspace' ? normalizeWorkspaceRefs(reqWorkspaceRefs, reqWorkspaceRef) : undefined;
-            if (visibility === 'workspace' && !workspaceRef) {
-                res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'visibility "workspace" requires workspace_refs (or workspace_ref) as one or more "<organismId>/<workspaceId>"'));
-                return;
-            }
             fileData = decoded;
             mimeType = mime_type ?? 'application/octet-stream';
         }
@@ -203,40 +209,23 @@ export function storageFilesRouter(config, storage) {
             fileData = Buffer.concat(chunks);
             mimeType = contentType || 'application/octet-stream';
         }
-        // Anonymous namespace enforcement: anonymous agents can only upload to anonymous/* keys
-        if (isAnonymousGaii(gaii) && !key.startsWith('anonymous/')) {
-            res.status(403).json(error(config.nodeId, 'FORBIDDEN', 'Anonymous agents can only upload to keys prefixed with "anonymous/"'));
-            return;
-        }
-        // Per-file size limit (configurable)
-        if (fileData.length > config.storageMaxFileSizeMb * 1024 * 1024) {
-            res.status(413).json(error(config.nodeId, 'QUOTA_EXCEEDED', `File size exceeds ${config.storageMaxFileSizeMb}MB limit`));
-            return;
-        }
-        // M-2: Total storage quota enforcement (§8.4, default 100MB per agent)
-        const storageQuota = await checkStorageQuota(config, storage, gaii, fileData.length);
-        if (!storageQuota.allowed) {
-            res.status(413).json(error(config.nodeId, 'QUOTA_EXCEEDED', storageQuota.reason));
-            return;
-        }
-        const file = await storage.createStorageFile({
+        // The key fence, the two size ceilings, the record shape, the overage charge and the change
+        // events are the shared write (services/storage-file-write.ts). This handler parses the
+        // request and renders the answer; the decisions belong to every door that stores a file.
+        const written = await writeStorageFile({ storage, config, emitResourceUpdated, emitResourceListChanged }, gaii, {
             key,
-            ownerGaii: gaii,
+            data: fileData,
+            mimeType,
             visibility: visibility,
             groupId,
             workspaceRef,
-            mimeType,
-            size: fileData.length,
-            data: fileData,
             federate: federateFlag === true,
-            createdAt: new Date().toISOString(),
         });
-        // M-3: Charge overage morsels if over quota (§15)
-        if (storageQuota.overageMorsels > 0) {
-            await chargeOverage(storage, gaii, storageQuota.overageMorsels, 'storage_overage');
+        if (!written.ok) {
+            res.status(written.status).json(error(config.nodeId, written.code, written.message));
+            return;
         }
-        emitResourceUpdated(gaii, `aimeat://storage/${encodeURIComponent(key)}`);
-        emitResourceListChanged(gaii);
+        const { file, overageMorsels } = written;
         res.status(201).json(success(config.nodeId, {
             key: file.key,
             owner_gaii: file.ownerGaii,
@@ -245,7 +234,7 @@ export function storageFilesRouter(config, storage) {
             visibility: file.visibility,
             federate: file.federate ?? false,
             created_at: file.createdAt,
-            overage_charged: storageQuota.overageMorsels > 0 ? storageQuota.overageMorsels : undefined,
+            overage_charged: overageMorsels > 0 ? overageMorsels : undefined,
             // Ready-to-embed, owner-addressed URL. Embedding this in a workspace document scopes the file
             // to that workspace's members on save (never the public internet) — use it, not /v1/storage/<key>.
             embed_url: pubEmbedUrl(file.ownerGaii, file.key),
@@ -254,7 +243,6 @@ export function storageFilesRouter(config, storage) {
             { description: 'Download this file', method: 'GET', url: `/v1/storage/${encodeURIComponent(key)}` },
             { description: 'List all files', method: 'GET', url: '/v1/storage' },
         ]));
-        emitChange('files');
     });
     // GET /v1/storage — list storage items (agent auth)
     router.get('/v1/storage', requireAuth(), requireExternalPrincipal(), requireScope('storage:read'), async (req, res) => {
@@ -529,7 +517,11 @@ export function storageFilesRouter(config, storage) {
             // Lets the bytes be drawn into a canvas and read back, which is what any app doing
             // something WITH a public image (resize, re-encode, hand to a tool) has to do.
             res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
-            res.setHeader('Content-Type', sniffedContentType(file.mimeType, file.data));
+            // The door this hardening exists for. Anyone on the internet reaches this branch, the
+            // bytes come back from the apex origin, and their type is whatever the uploader said it
+            // was, so an uploaded page would run as the portal. Images, media, PDFs and plain text
+            // still render; everything else is saved rather than shown.
+            setStoredFileHeaders(res, file);
             res.setHeader('Content-Length', file.size);
             res.end(file.data);
             return;
@@ -580,7 +572,7 @@ export function storageFilesRouter(config, storage) {
             await sendHandle(accessorGaii);
             return;
         }
-        res.setHeader('Content-Type', sniffedContentType(file.mimeType, file.data));
+        setStoredFileHeaders(res, file);
         res.setHeader('Content-Length', file.size);
         res.end(file.data);
     });
@@ -607,7 +599,9 @@ export function storageFilesRouter(config, storage) {
             res.status(404).end();
             return;
         }
-        res.setHeader('Content-Type', sniffedContentType(file.mimeType, file.data));
+        // Same headers as the GET below, so a client cannot learn one answer from HEAD and meet a
+        // different one when it fetches the bytes.
+        setStoredFileHeaders(res, file);
         res.setHeader('Content-Length', file.size);
         res.setHeader('X-AIMEAT-Visibility', file.visibility);
         res.setHeader('X-AIMEAT-Created', file.createdAt);
@@ -659,14 +653,14 @@ export function storageFilesRouter(config, storage) {
                 const end = match[2] ? parseInt(match[2], 10) : file.size - 1;
                 const chunk = file.data.subarray(start, end + 1);
                 res.status(206);
+                setStoredFileHeaders(res, file);
                 res.setHeader('Content-Range', `bytes ${start}-${end}/${file.size}`);
                 res.setHeader('Content-Length', chunk.length);
-                res.setHeader('Content-Type', sniffedContentType(file.mimeType, file.data));
                 res.end(chunk);
                 return;
             }
         }
-        res.setHeader('Content-Type', sniffedContentType(file.mimeType, file.data));
+        setStoredFileHeaders(res, file);
         res.setHeader('Content-Length', file.size);
         res.end(file.data);
     });