@dsh-enhanced/lark-channel 0.1.47 → 0.1.49

package/lib/setup-business.js

@@ -0,0 +1,335 @@
+import { spawn } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, lstat, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { isAbsolute, join } from 'node:path';
+import { installLarkBusinessSkill, reconcileLarkBusinessSkill } from './business-skill.js';
+import { LARK_BUSINESS_CLEARED_ENV } from './business-environment.js';
+const keyPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const revisionPattern = /^[a-f0-9-]{36}$/u;
+const cliProfile = 'dsh-owner';
+const bindingSizeLimit = 256 * 1024;
+/** Each process uses the same private config and Linux credential directories. */
+export function larkBusinessEnvironment(configDir, dataDir) {
+    const env = { ...process.env };
+    for (const key of LARK_BUSINESS_CLEARED_ENV)
+        delete env[key];
+    env.LARKSUITE_CLI_CONFIG_DIR = configDir;
+    env.LARKSUITE_CLI_DATA_DIR = dataDir;
+    env.LARKSUITE_CLI_NO_UPDATE_NOTIFIER = '1';
+    env.LARKSUITE_CLI_NO_SKILLS_NOTIFIER = '1';
+    return env;
+}
+/** Never echo CLI output from a credential-bearing command into an error. */
+export async function runBusinessCli(request) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(request.command, request.args, {
+            env: request.env, shell: false, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true,
+        });
+        const chunks = [];
+        const errors = [];
+        let bytes = 0;
+        let failed = false;
+        const stop = () => {
+            failed = true;
+            child.kill('SIGKILL');
+        };
+        const timer = setTimeout(stop, request.timeoutMs);
+        child.stdout.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > 1024 * 1024)
+                stop();
+            else
+                chunks.push(chunk);
+        });
+        child.stderr.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > 1024 * 1024)
+                stop();
+            else
+                errors.push(chunk);
+        });
+        child.stdin.on('error', () => { });
+        child.once('error', () => {
+            clearTimeout(timer);
+            reject(new Error('lark business setup: CLI could not start'));
+        });
+        child.once('close', (code, signal) => {
+            clearTimeout(timer);
+            if (failed || signal !== null)
+                reject(new Error('lark business setup: CLI timed out or exceeded its output limit'));
+            else
+                resolve({ code, stdout: Buffer.concat(chunks).toString('utf8'), stderr: Buffer.concat(errors).toString('utf8') });
+        });
+        child.stdin.end(request.input);
+    });
+}
+function object(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value : undefined;
+}
+export function isVerifiedLarkBusinessOwner(value, appId, ownerUserId) {
+    const status = object(value);
+    const user = object(object(status?.identities)?.user);
+    return status?.appId === appId && status.identity === 'user' && status.verified === true
+        && user?.openId === ownerUserId && user.available === true && user.verified === true
+        && (user.status === 'ready' || user.status === 'needs_refresh');
+}
+async function privateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        throw new Error('lark business setup: managed directory is not a real directory');
+    await chmod(path, 0o700);
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error('lark business setup: CLI returned invalid JSON');
+    }
+}
+function scopeList(value) {
+    if (!Array.isArray(value) || value.length > 4096
+        || value.some(scope => typeof scope !== 'string' || !/^[A-Za-z0-9_.:-]{1,256}$/u.test(scope))
+        || new Set(value).size !== value.length)
+        return undefined;
+    return value;
+}
+function scopeString(value) {
+    return typeof value === 'string' ? scopeList(value.trim().split(/\s+/u).filter(Boolean)) : undefined;
+}
+function authorizationEvidence(value) {
+    const evidence = object(value);
+    const requestedScopes = scopeList(evidence?.requestedScopes);
+    const grantedScopes = scopeList(evidence?.grantedScopes);
+    const missingScopes = scopeList(evidence?.missingScopes);
+    if (!requestedScopes?.length || !grantedScopes || !missingScopes)
+        return undefined;
+    const granted = new Set(grantedScopes);
+    const expectedMissing = requestedScopes.filter(scope => !granted.has(scope));
+    if (expectedMissing.length !== missingScopes.length
+        || expectedMissing.some(scope => !missingScopes.includes(scope)))
+        return undefined;
+    const permissionCompletion = missingScopes.length ? 'partial' : 'complete';
+    if (evidence?.permissionCompletion !== permissionCompletion)
+        return undefined;
+    return { permissionCompletion, requestedScopes, grantedScopes, missingScopes };
+}
+/** v1.0.85's ExitAuth (3) also reports a saved login with missing scopes. */
+function completedAuthorization(result, ownerUserId) {
+    const payload = object(parseJson(result.stdout));
+    const evidence = authorizationEvidence({ permissionCompletion: Array.isArray(payload?.missing) && payload.missing.length ? 'partial' : 'complete',
+        requestedScopes: payload?.requested, grantedScopes: payload?.granted, missingScopes: payload?.missing });
+    const warning = object(payload?.warning);
+    const newly = scopeList(payload?.newly_granted);
+    const already = scopeList(payload?.already_granted);
+    const classified = newly && already ? [...newly, ...already] : undefined;
+    const requestedGranted = evidence?.requestedScopes.filter(scope => evidence.grantedScopes.includes(scope));
+    const scope = scopeString(payload?.scope);
+    if (payload?.event !== 'authorization_complete' || payload.user_open_id !== ownerUserId || !evidence
+        || !classified || new Set(classified).size !== classified.length
+        || classified.length !== requestedGranted?.length || classified.some(scope => !requestedGranted.includes(scope))
+        || !scope || scope.length !== evidence.grantedScopes.length || scope.some(item => !evidence.grantedScopes.includes(item))
+        || (evidence.permissionCompletion === 'partial'
+            ? result.code !== 3 || warning?.type !== 'missing_scope'
+            : result.code !== 0 || payload.warning !== undefined)) {
+        throw new Error('lark business setup: user authorization is incomplete; business skill was not activated');
+    }
+    return evidence;
+}
+/** Completes user authorization after channel owner binding; publishes a skill only after readback. */
+export async function setupLarkBusinessTools(input, runtime = {}) {
+    if (!isAbsolute(input.dshHome) || !isAbsolute(input.cli.command)
+        || !keyPattern.test(input.profile) || !keyPattern.test(input.account)
+        || !/^cli_[0-9a-f]{16}$/iu.test(input.appId) || !/^ou_[A-Za-z0-9_-]+$/u.test(input.ownerUserId)
+        || !['feishu', 'lark'].includes(input.domain)
+        || !input.appSecret || ['\r', '\n', '\0'].some(character => input.appSecret.includes(character))
+        || !Number.isSafeInteger(input.timeoutMs) || input.timeoutMs < 30_000 || input.timeoutMs > 900_000) {
+        throw new Error('lark business setup: invalid binding inputs');
+    }
+    await reconcileLarkBusinessSkill({ ...input, enabled: true });
+    const root = join(input.dshHome, 'lark-business');
+    await privateDirectory(root);
+    const id = createHash('sha256').update(JSON.stringify([input.profile, input.account])).digest('hex').slice(0, 24);
+    const directory = join(root, id);
+    await privateDirectory(directory);
+    const activePath = join(directory, 'active.json');
+    const pendingPath = join(directory, 'pending.json');
+    const run = runtime.run ?? runBusinessCli;
+    const publishSkill = runtime.installSkill ?? installLarkBusinessSkill;
+    const paths = (revision) => ({ configDir: join(directory, revision, 'config'), dataDir: join(directory, revision, 'data') });
+    const invoke = async (revision, args, secret, timeoutMs = 30_000) => {
+        const { configDir, dataDir } = paths(revision);
+        return run({ command: input.cli.command, args: ['--profile', cliProfile, ...args],
+            env: larkBusinessEnvironment(configDir, dataDir), timeoutMs,
+            ...(secret === undefined ? {} : { input: secret }) });
+    };
+    const verified = async (revision) => {
+        const result = await invoke(revision, ['auth', 'status', '--json', '--verify']);
+        if (result.code !== 0)
+            return false;
+        let status = parseJson(result.stdout);
+        if (!isVerifiedLarkBusinessOwner(status, input.appId, input.ownerUserId))
+            return false;
+        // `auth status` labels the user with the local profile openId. Independently
+        // compare the server's current user_info response with the paired owner.
+        const readback = await invoke(revision, ['api', 'GET', '/open-apis/authen/v1/user_info', '--as', 'user']);
+        if (readback.code !== 0)
+            return false;
+        const identity = object(parseJson(readback.stdout));
+        if (identity?.ok !== true || identity.identity !== 'user' || object(identity.data)?.open_id !== input.ownerUserId)
+            return false;
+        // The first status can report scope fields collected before token refresh.
+        // Read the current token scope list after verified user_info has used it.
+        const refreshed = await invoke(revision, ['auth', 'status', '--json', '--verify']);
+        if (refreshed.code !== 0)
+            return false;
+        status = parseJson(refreshed.stdout);
+        if (!isVerifiedLarkBusinessOwner(status, input.appId, input.ownerUserId))
+            return false;
+        return { scopes: scopeString(object(object(object(status)?.identities)?.user)?.scope) };
+    };
+    const configure = async (revision) => {
+        const result = await invoke(revision, ['config', 'init', '--name', cliProfile, '--app-id', input.appId,
+            '--app-secret-stdin', '--brand', input.domain], `${input.appSecret}\n`);
+        if (result.code !== 0)
+            throw new Error('lark business setup: CLI app configuration failed; channel binding is retained');
+    };
+    const skill = async (revision) => {
+        const { configDir, dataDir } = paths(revision);
+        return (await publishSkill({ dshHome: input.dshHome, profile: input.profile, account: input.account,
+            appId: input.appId, ownerUserId: input.ownerUserId, cliCommand: input.cli.command,
+            cliConfigDir: configDir, cliDataDir: dataDir, cliProfile })).path;
+    };
+    const readBinding = async (path) => {
+        try {
+            const info = await lstat(path);
+            if (!info.isFile() || info.isSymbolicLink() || info.size > bindingSizeLimit)
+                throw new Error('lark business setup: invalid binding file');
+            return object(parseJson(await readFile(path, 'utf8')));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            return undefined;
+        }
+    };
+    const matches = (binding) => binding?.schema === 1 && typeof binding.revision === 'string' && revisionPattern.test(binding.revision)
+        && binding.appId === input.appId && binding.ownerUserId === input.ownerUserId
+        && binding.domain === input.domain && binding.cliVersion === input.cli.version && binding.requestedDomains === 'all';
+    const validatePaths = async (revision) => {
+        const current = paths(revision);
+        for (const path of [join(directory, revision), current.configDir, current.dataDir]) {
+            const info = await lstat(path);
+            if (!info.isDirectory() || info.isSymbolicLink())
+                throw new Error('lark business setup: active CLI directory changed');
+        }
+    };
+    const writeBinding = async (path, binding) => {
+        const temporary = join(directory, `binding.${randomUUID()}.tmp`);
+        const content = `${JSON.stringify(binding)}\n`;
+        if (Buffer.byteLength(content) > bindingSizeLimit)
+            throw new Error('lark business setup: authorization evidence exceeded its limit');
+        await writeFile(temporary, content, { mode: 0o600, flag: 'wx' });
+        await rename(temporary, path);
+    };
+    const result = (skillPath, reusedAuthorization, evidence) => ({
+        skillPath, reusedAuthorization, permissionCompletion: evidence?.permissionCompletion ?? 'unknown',
+        requestedScopes: evidence?.requestedScopes ?? [], grantedScopes: evidence?.grantedScopes ?? [], missingScopes: evidence?.missingScopes ?? [],
+    });
+    const currentEvidence = (evidence, scopes) => {
+        // The receipt records a login snapshot. Subsequent tokens can lose scopes;
+        // current result claims use the verified CLI identity's token scope list.
+        if (!evidence || !scopes)
+            return undefined;
+        const missingScopes = evidence.requestedScopes.filter(scope => !scopes.includes(scope));
+        return { permissionCompletion: missingScopes.length ? 'partial' : 'complete', requestedScopes: evidence.requestedScopes,
+            grantedScopes: scopes, missingScopes };
+    };
+    const existing = await readBinding(activePath);
+    if (matches(existing)) {
+        await validatePaths(existing.revision);
+        const evidence = authorizationEvidence(existing.authorization);
+        if (existing.authorization !== undefined && !evidence)
+            throw new Error('lark business setup: invalid authorization evidence');
+        // Application secrets may have rotated since the previous setup. Updating
+        // this same named profile retains its user session without another login.
+        await configure(existing.revision);
+        const identity = await verified(existing.revision);
+        if (identity) {
+            return result(await skill(existing.revision), true, currentEvidence(evidence, identity.scopes));
+        }
+    }
+    // Only a captured completion can recover publication after interrupted owner
+    // readback/skill installation. Tokens or an all-domain request alone do not
+    // prove which scopes were granted, including for older orphan revisions.
+    const pending = await readBinding(pendingPath);
+    if (matches(pending)) {
+        const evidence = authorizationEvidence(pending.authorization);
+        if (pending.authorization !== undefined && !evidence)
+            throw new Error('lark business setup: invalid pending authorization evidence');
+        if (evidence) {
+            await validatePaths(pending.revision);
+            await configure(pending.revision);
+            const identity = await verified(pending.revision);
+            if (!identity)
+                throw new Error('lark business setup: authorized user does not match the bound owner; business skill was not activated');
+            const skillPath = await skill(pending.revision);
+            await writeBinding(activePath, { schema: 1, revision: pending.revision, appId: input.appId, ownerUserId: input.ownerUserId,
+                domain: input.domain, cliVersion: input.cli.version, requestedDomains: 'all', authorization: evidence });
+            await unlink(pendingPath);
+            return result(skillPath, true, currentEvidence(evidence, identity.scopes));
+        }
+    }
+    const revision = randomUUID();
+    const { configDir, dataDir } = paths(revision);
+    await privateDirectory(join(directory, revision));
+    await privateDirectory(configDir);
+    await privateDirectory(dataDir);
+    await configure(revision);
+    const binding = { schema: 1, revision, appId: input.appId, ownerUserId: input.ownerUserId,
+        domain: input.domain, cliVersion: input.cli.version, requestedDomains: 'all' };
+    await writeBinding(pendingPath, binding);
+    const started = await invoke(revision, ['auth', 'login', '--domain', 'all', '--no-wait', '--json']);
+    if (started.code !== 0)
+        throw new Error('lark business setup: user authorization could not start; check application permissions');
+    if (/failed to (?:cache requested|load cached requested) scopes/iu.test(started.stderr ?? '')) {
+        throw new Error('lark business setup: requested scope evidence could not be saved');
+    }
+    const authorization = object(parseJson(started.stdout));
+    if (typeof authorization?.verification_url !== 'string' || typeof authorization.device_code !== 'string'
+        || !authorization.device_code || authorization.device_code.length > 4096) {
+        throw new Error('lark business setup: invalid device authorization response');
+    }
+    let url;
+    try {
+        url = new URL(authorization.verification_url);
+    }
+    catch {
+        throw new Error('lark business setup: invalid authorization URL');
+    }
+    const verificationUrl = authorization.verification_url;
+    if (url.protocol !== 'https:' || url.username || url.password || ['\r', '\n', '\0'].some(character => verificationUrl.includes(character))) {
+        throw new Error('lark business setup: invalid authorization URL');
+    }
+    await input.onAuthorization(authorization.verification_url);
+    const authorized = await invoke(revision, ['auth', 'login', '--device-code', authorization.device_code, '--json'], undefined, input.timeoutMs);
+    if (/failed to (?:cache requested|load cached requested) scopes/iu.test(authorized.stderr ?? '')) {
+        throw new Error('lark business setup: requested scope evidence could not be read; business skill was not activated');
+    }
+    const evidence = completedAuthorization(authorized, input.ownerUserId);
+    binding.authorization = evidence;
+    await writeBinding(pendingPath, binding);
+    const identity = await verified(revision);
+    if (!identity)
+        throw new Error('lark business setup: authorized user does not match the bound owner; business skill was not activated');
+    // Retain old configuration files while publishing. macOS/Windows native
+    // keychains can share app/user entries; only Linux data paths are isolated.
+    // Setup sends no business writes, only authentication and identity readback.
+    const skillPath = await skill(revision);
+    await writeBinding(activePath, binding);
+    await unlink(pendingPath);
+    return result(skillPath, false, currentEvidence(evidence, identity.scopes));
+}
+//# sourceMappingURL=setup-business.js.map

package/lib/setup-business.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-business.js","sourceRoot":"","sources":["../src/setup-business.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC3F,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AA6BrE,MAAM,UAAU,GAAG,oCAAoC,CAAA;AACvD,MAAM,eAAe,GAAG,kBAAkB,CAAA;AAC1C,MAAM,UAAU,GAAG,WAAW,CAAA;AAC9B,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAA;AAEnC,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,OAAe;IACxE,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IAC9B,KAAK,MAAM,GAAG,IAAI,yBAAyB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5D,GAAG,CAAC,wBAAwB,GAAG,SAAS,CAAA;IACxC,GAAG,CAAC,sBAAsB,GAAG,OAAO,CAAA;IACpC,GAAG,CAAC,gCAAgC,GAAG,GAAG,CAAA;IAC1C,GAAG,CAAC,gCAAgC,GAAG,GAAG,CAAA;IAC1C,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA2B;IAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;YACjD,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI;SACnF,CAAC,CAAA;QACF,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,MAAM,GAAG,IAAI,CAAA;YACb,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvB,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACjD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAA;YACrB,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;gBAAE,IAAI,EAAE,CAAA;;gBAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAA;YACrB,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;gBAAE,IAAI,EAAE,CAAA;;gBAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAA4C,CAAC,CAAC,CAAA;QAC3E,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC,CAAA;;gBAC9G,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACxH,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc,EAAE,KAAa,EAAE,WAAmB;IAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAA;IACrD,OAAO,MAAM,EAAE,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;WACnF,IAAI,EAAE,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;WACjF,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe,CAAC,CAAA;AACnE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnI,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IAAC,CAAC;AACxH,CAAC;AA8BD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;WAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WAC1F,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC3D,OAAO,KAAiB,CAAA;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACtG,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IACxD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IACxD,IAAI,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAA;IACtC,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5E,IAAI,eAAe,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;WAC9C,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACpF,MAAM,oBAAoB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;IAC1E,IAAI,QAAQ,EAAE,oBAAoB,KAAK,oBAAoB;QAAE,OAAO,SAAS,CAAA;IAC7E,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,CAAA;AAChF,CAAC;AAED,6EAA6E;AAC7E,SAAS,sBAAsB,CAAC,MAAyB,EAAE,WAAmB;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAC/I,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxE,MAAM,gBAAgB,GAAG,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1G,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACzC,IAAI,OAAO,EAAE,KAAK,KAAK,wBAAwB,IAAI,OAAO,CAAC,YAAY,KAAK,WAAW,IAAI,CAAC,QAAQ;WAC/F,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM;WAC7D,UAAU,CAAC,MAAM,KAAK,gBAAgB,EAAE,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;WAC7G,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WACtH,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS;YAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,EAAE,IAAI,KAAK,eAAe;YACxD,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAA;IAC5G,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA6B,EAAE,UAAoC,EAAE;IAChH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;WAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WAClE,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;WAC5F,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;WAC1C,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;WAC7F,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,OAAO,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,0BAA0B,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IACjD,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,CAAA;IAChH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAChC,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,CAAA;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,wBAAwB,CAAA;IACrE,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IACpI,MAAM,MAAM,GAAG,KAAK,EAAE,QAAgB,EAAE,IAAc,EAAE,MAAe,EAAE,SAAS,GAAG,MAAM,EAA8B,EAAE;QACzH,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;YAC/E,GAAG,EAAE,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS;YAC3D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACzD,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAgB,EAAqD,EAAE;QAC7F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAA;QAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACnC,IAAI,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAA;QACtF,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QACzG,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACnD,IAAI,QAAQ,EAAE,EAAE,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC,WAAW;YAAE,OAAO,KAAK,CAAA;QAC/H,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAA;QAClF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACtC,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAA;QACtF,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAA;IACzF,CAAC,CAAA;IACD,MAAM,SAAS,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK;YACpG,oBAAoB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,CAAA;QACzE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IAC1H,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,EAAE,QAAgB,EAAmB,EAAE;QACxD,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC9C,OAAO,CAAC,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YACjG,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO;YACjF,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,CAAC,CAAA;IACD,MAAM,WAAW,GAAG,KAAK,EAAE,IAAY,EAAgD,EAAE;QACvF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YACzI,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;YACnE,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,OAA4C,EAA6D,EAAE,CAC1H,OAAO,EAAE,MAAM,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;WACpG,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;WAC1E,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAA;IACtH,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;QAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACxH,CAAC;IACH,CAAC,CAAA;IACD,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAE,OAAsB,EAAiB,EAAE;QACjF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,UAAU,EAAE,MAAM,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAA;QAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACpI,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAChE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC/B,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,mBAA4B,EAAE,QAAgC,EAA2B,EAAE,CAAC,CAAC;QAC9H,SAAS,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,QAAQ,EAAE,oBAAoB,IAAI,SAAS;QACjG,eAAe,EAAE,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,IAAI,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,IAAI,EAAE;KAC7I,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,CAAC,QAA2C,EAAE,MAA4B,EAAqC,EAAE;QACvI,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACvF,OAAO,EAAE,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe;YACrH,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAC1C,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAA;IAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;QAC9D,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QAC7H,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACjG,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAA;IAC9C,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAC7D,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;QACpI,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACrC,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACjD,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAA;YACvI,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC/C,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;gBACxH,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC1G,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;YACzB,OAAO,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAA;IAC7B,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;IACjD,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACjC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC/B,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;IACzB,MAAM,OAAO,GAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QACtG,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAA;IAChF,MAAM,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;IACnG,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;IACjI,IAAI,8DAA8D,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACvD,IAAI,OAAO,aAAa,EAAE,gBAAgB,KAAK,QAAQ,IAAI,OAAO,aAAa,CAAC,WAAW,KAAK,QAAQ;WACnG,CAAC,aAAa,CAAC,WAAW,IAAI,aAAa,CAAC,WAAW,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IAAC,CAAC;IACjI,MAAM,eAAe,GAAG,aAAa,CAAC,gBAAgB,CAAA;IACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3I,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;IAC9I,IAAI,8DAA8D,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAA;IACtH,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IACtE,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAA;IAChC,MAAM,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACzC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAA;IACvI,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;IACvC,MAAM,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACvC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;IACzB,OAAO,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7E,CAAC"}

package/lib/setup-profile.d.ts

@@ -10,7 +10,7 @@ export interface LarkProfileSetupInput {
     keychainAccount: string;
     credentialProvider?: 'linux-protected-file' | 'linux-secret-service' | 'macos-keychain' | 'windows-dpapi';
     credentialPath?: string;
-    agentTools?: 'disable' | 'enable' | 'preserve';
+    agentTools?: 'disable' | 'enable' | 'preserve' | 'auto';
 }
 export interface LarkAgentPolicyRefreshInput {
     profilePatch: string;

package/lib/setup-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-profile.d.ts","sourceRoot":"","sources":["../src/setup-profile.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,eAAe,CAAA;IACzG,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAA;CAC/C;AAED,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAA;CACjC;AAi9BD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,MAAM,CA+GtF;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CA+N9E"}
+{"version":3,"file":"setup-profile.d.ts","sourceRoot":"","sources":["../src/setup-profile.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,eAAe,CAAA;IACzG,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAA;CACxD;AAED,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAA;CACjC;AAi9BD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,MAAM,CA+GtF;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAoP9E"}

package/lib/setup-profile.js

@@ -1017,8 +1017,8 @@ export function configureLarkProfilePatch(input) {
         .includes(credentialProvider)) {
         throw new Error('lark-channel setup: invalid credentialProvider');
     }
-    const agentToolsMode = input.agentTools ?? 'preserve';
-    if (!['disable', 'enable', 'preserve'].includes(agentToolsMode)) {
+    let agentToolsMode = input.agentTools ?? 'auto';
+    if (!['disable', 'enable', 'preserve', 'auto'].includes(agentToolsMode)) {
         throw new Error('lark-channel setup: invalid agentTools mode');
     }
     const credentialHandle = `lark-app-secret-${account}`;
@@ -1030,8 +1030,11 @@ export function configureLarkProfilePatch(input) {
     assertManagedProfileRowIntegrity(rows);
     const existingLarkRow = findRow(rows, 'dsh-enhanced-lark-channel');
     let previousAccount;
+    let existingAppConfigured = false;
     if (existingLarkRow !== undefined) {
         const existingChannel = asMap(existingLarkRow.get('config', true), 'lark-channel config');
+        const existingAppId = existingChannel.get('appId');
+        existingAppConfigured = existingAppId !== undefined && existingAppId !== '';
         const existingAccount = existingChannel.get('account');
         if (existingAccount !== undefined) {
             if (typeof existingAccount !== 'string') {
@@ -1053,6 +1056,26 @@ export function configureLarkProfilePatch(input) {
     assertManagedForegroundRuleIntegrity(rules);
     assertManagedFixedRuleIntegrity(rules, account);
     const sourceOwnerPrincipal = configuredOwnerPrincipal(rules, grantSourceAccount);
+    if (agentToolsMode === 'auto') {
+        // A new owner gets the install-time capability default. Existing bindings,
+        // explicit restrictions and remnants of retired bindings retain the old
+        // preserve path; re-running onboarding must not re-enable revoked tools.
+        const hasOwnerHistory = rules.items.some(item => {
+            if (!isMap(item))
+                return false;
+            const id = item.get('id');
+            return typeof id === 'string' && id.startsWith('lark-owner-');
+        });
+        const hasForegroundRestriction = rules.items.some(item => {
+            if (!isMap(item))
+                return false;
+            const id = item.get('id');
+            return typeof id === 'string' && isManagedForegroundRuleId(id)
+                && !isUnrestrictedForegroundAllow(item);
+        });
+        agentToolsMode = existingAppConfigured || hasOwnerHistory || hasForegroundRestriction
+            ? 'preserve' : 'enable';
+    }
     const preserveOwnerPrincipal = sourceOwnerPrincipal
         ?? (previousAccount === undefined ? principalId : undefined);
     if (agentToolsMode === 'preserve'