@larksuite/openclaw-lark 2026.3.9

package/src/core/app-scope-checker.js

@@ -0,0 +1,191 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * App Scope Checker — 查询应用已开通的 scope 列表。
+ *
+ * 通过 `GET /open-apis/application/v6/applications/:app_id` (TAT) 获取
+ * 应用信息，从 `app.scopes` 中提取已开通的 scope 字符串列表。
+ *
+ * 结果带 30 秒内存缓存，避免每次 invoke() 都调远程 API。
+ * scope 检查失败后可调 {@link invalidateAppScopeCache} 清缓存重查。
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { larkLogger } from './lark-logger';
+const log = larkLogger('core/app-scope-checker');
+import { AppScopeCheckFailedError } from './auth-errors';
+// ---------------------------------------------------------------------------
+// Cache
+// ---------------------------------------------------------------------------
+const cache = new Map();
+const CACHE_TTL_MS = 30 * 1000; // 30 秒
+/** 清除指定 appId 的缓存。 */
+export function invalidateAppScopeCache(appId) {
+    cache.delete(appId);
+}
+// ---------------------------------------------------------------------------
+// Fetch
+// ---------------------------------------------------------------------------
+/**
+ * 获取应用已开通的 scope 列表。
+ *
+ * 需要应用自身有 `application:application:self_manage` 权限。
+ * `appId` 可传 `"me"` 查自己。
+ *
+ * @param sdk - Lark SDK 实例
+ * @param appId - 应用 ID
+ * @param tokenType - token 类型，用于过滤只支持特定 token 类型的 scope
+ * @returns scope 字符串数组，如 `["calendar:calendar", "task:task:write"]`
+ */
+export async function getAppGrantedScopes(sdk, appId, tokenType) {
+    // 1. 检查缓存
+    const cached = cache.get(appId);
+    if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
+        // 从缓存中过滤出支持当前 token 类型的 scope
+        return cached.rawScopes
+            .filter((s) => {
+            if (tokenType && s.token_types && Array.isArray(s.token_types)) {
+                return s.token_types.includes(tokenType);
+            }
+            return true;
+        })
+            .map((s) => s.scope);
+    }
+    // 2. 调用 API
+    try {
+        const res = await sdk.request({
+            method: 'GET',
+            url: `/open-apis/application/v6/applications/${appId}`,
+            params: { lang: 'zh_cn' },
+        });
+        if (res.code !== 0) {
+            // 任何 API 错误都认为是应用缺少 application:application:self_manage 权限
+            throw new AppScopeCheckFailedError(appId);
+        }
+        // 响应结构: res.data.app.scopes → [{ scope: "xxx", description, level, token_types?: string[] }]
+        // 或者从 app_version 中获取 scopes
+        const app = res.data?.app ?? res.app ?? res.data;
+        const rawScopes = app?.scopes ?? app?.online_version?.scopes ?? [];
+        // 提取并验证 scope 字符串
+        const validScopes = rawScopes
+            .filter((s) => typeof s.scope === 'string' && s.scope.length > 0)
+            .map((s) => ({ scope: s.scope, token_types: s.token_types }));
+        // 3. 写缓存（缓存完整数据，包含 token_types 和原始 app 对象）
+        cache.set(appId, { rawScopes: validScopes, rawApp: app, fetchedAt: Date.now() });
+        log.info(`fetched ${validScopes.length} scopes for app ${appId}`);
+        // 4. 根据 tokenType 过滤
+        const scopes = validScopes
+            .filter((s) => {
+            if (tokenType && s.token_types && Array.isArray(s.token_types)) {
+                return s.token_types.includes(tokenType);
+            }
+            return true;
+        })
+            .map((s) => s.scope);
+        log.info(`returning ${scopes.length} scopes${tokenType ? ` for ${tokenType} token` : ''}`);
+        return scopes;
+    }
+    catch (err) {
+        // 如果是 AppScopeCheckFailedError，重新抛出（不吞掉）
+        if (err instanceof AppScopeCheckFailedError) {
+            throw err;
+        }
+        // 检查是否是权限相关的 HTTP 错误（400/403）
+        // axios/SDK 异常对象通常包含 response.status 或 status 字段
+        const statusCode = err?.response?.status || err?.status || err?.statusCode;
+        const isPermissionError = statusCode === 400 ||
+            statusCode === 403 ||
+            (err instanceof Error && (err.message.includes('status code 400') || err.message.includes('status code 403')));
+        if (isPermissionError) {
+            throw new AppScopeCheckFailedError(appId);
+        }
+        log.warn(`failed to fetch scopes for ${appId}: ${err instanceof Error ? err.message : err}`);
+        // 其他查询失败不阻塞调用，返回空数组（后续 API 调用如果缺 scope 会被服务端拒绝）
+        return [];
+    }
+}
+// ---------------------------------------------------------------------------
+// App info
+// ---------------------------------------------------------------------------
+/**
+ * 获取应用信息，包括 owner 信息。
+ *
+ * 复用 getAppGrantedScopes 的 API 调用和缓存。
+ * 如果缓存中已有数据且未过期，直接从缓存提取。
+ *
+ * @param sdk - Lark SDK 实例
+ * @param appId - 应用 ID（可传 "me"）
+ */
+export async function getAppInfo(sdk, appId) {
+    // 先确保缓存已填充（调一次 getAppGrantedScopes 来触发 API + 缓存）
+    await getAppGrantedScopes(sdk, appId);
+    const cached = cache.get(appId);
+    const rawApp = cached?.rawApp;
+    // 提取 owner 信息
+    const owner = rawApp?.owner;
+    const creatorId = rawApp?.creator_id;
+    // 统一 owner 定义：type=2（企业内成员）用 owner_id，否则回退 creator_id
+    // 兼容两种字段名（owner_type 和 type）
+    const ownerTypeValue = owner?.owner_type ?? owner?.type;
+    const effectiveOwnerOpenId = ownerTypeValue === 2 && owner?.owner_id ? owner.owner_id : (creatorId ?? owner?.owner_id);
+    return {
+        appId,
+        creatorId,
+        ownerOpenId: owner?.owner_id,
+        ownerType: owner?.owner_type,
+        effectiveOwnerOpenId,
+        scopes: cached?.rawScopes ?? [],
+    };
+}
+// ---------------------------------------------------------------------------
+// Scope intersection
+// ---------------------------------------------------------------------------
+/**
+ * 计算 APP 已有 ∩ OAPI 需要 的交集。
+ *
+ * 用于传给 OAuth 的 scope 参数 — 只请求 APP 已开通且 API 需要的 scope。
+ *
+ * @param appGranted - 应用已开通的 scope 列表
+ * @param apiRequired - OAPI 要求的 scope 列表
+ * @returns 交集 scope 列表
+ */
+export function intersectScopes(appGranted, apiRequired) {
+    const grantedSet = new Set(appGranted);
+    return apiRequired.filter((s) => grantedSet.has(s));
+}
+/**
+ * 计算 OAPI 需要但 APP 未开通的 scope（差集）。
+ *
+ * 用于 AppScopeMissingError 的 missingScopes。
+ *
+ * @param appGranted - 应用已开通的 scope 列表
+ * @param apiRequired - OAPI 要求的 scope 列表
+ * @returns 缺失的 scope 列表
+ */
+export function missingScopes(appGranted, apiRequired) {
+    const grantedSet = new Set(appGranted);
+    return apiRequired.filter((s) => !grantedSet.has(s));
+}
+/**
+ * 校验应用已开通的 scope 是否满足要求。
+ *
+ * 与 tool-client.ts invoke() 的 scope 校验逻辑完全一致，作为唯一真值来源：
+ *   - `scopeNeedType === "all"`: appScopes 必须包含 requiredScopes 的全部项
+ *   - 其他（默认 "one"）:        appScopes 与 requiredScopes 的交集非空即可
+ *   - appScopes 为空:            视为满足（API 查询失败，退回服务端判断）
+ *
+ * @param appScopes      - 应用已开通的 scope 列表（由 getAppGrantedScopes 返回）
+ * @param requiredScopes - 需要的 scope 列表
+ * @param scopeNeedType  - "all" 表示全部必须，undefined/"one" 表示任一即可
+ */
+export function isAppScopeSatisfied(appScopes, requiredScopes, scopeNeedType) {
+    if (appScopes.length === 0)
+        return true; // API 查询失败 → 退回服务端判断
+    if (requiredScopes.length === 0)
+        return true;
+    if (scopeNeedType === 'all') {
+        return missingScopes(appScopes, requiredScopes).length === 0;
+    }
+    return intersectScopes(appScopes, requiredScopes).length > 0;
+}
+//# sourceMappingURL=app-scope-checker.js.map

package/src/core/app-scope-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-scope-checker.js","sourceRoot":"","sources":["../../../src/core/app-scope-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,uDAAuD;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,GAAG,GAAG,UAAU,CAAC,wBAAwB,CAAC,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AA2BzD,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,MAAM,YAAY,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO;AAEvC,sBAAsB;AACtB,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAgB,EAChB,KAAa,EACb,SAA6B;IAE7B,UAAU;IACV,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QAC3D,8BAA8B;QAC9B,OAAO,MAAM,CAAC,SAAS;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,IAAI,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,YAAY;IACZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAO,GAAW,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,0CAA0C,KAAK,EAAE;YACtD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,2DAA2D;YAC3D,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,6FAA6F;QAC7F,6BAA6B;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;QACjD,MAAM,SAAS,GACb,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,MAAM,IAAI,EAAE,CAAC;QAEnD,kBAAkB;QAClB,MAAM,WAAW,GAAG,SAAS;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAEjE,2CAA2C;QAC3C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjF,GAAG,CAAC,IAAI,CAAC,WAAW,WAAW,CAAC,MAAM,mBAAmB,KAAK,EAAE,CAAC,CAAC;QAElE,qBAAqB;QACrB,MAAM,MAAM,GAAG,WAAW;aACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,IAAI,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvB,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,UAAU,SAAS,CAAC,CAAC,CAAC,QAAQ,SAAS,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAE3F,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yCAAyC;QACzC,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,8BAA8B;QAC9B,iDAAiD;QACjD,MAAM,UAAU,GAAI,GAAW,EAAE,QAAQ,EAAE,MAAM,IAAK,GAAW,EAAE,MAAM,IAAK,GAAW,EAAE,UAAU,CAAC;QAEtG,MAAM,iBAAiB,GACrB,UAAU,KAAK,GAAG;YAClB,UAAU,KAAK,GAAG;YAClB,CAAC,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAEjH,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,8BAA8B,KAAK,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7F,gDAAgD;QAChD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAgB,EAAE,KAAa;IAC9D,iDAAiD;IACjD,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,EAAE,MAA6C,CAAC;IAErE,cAAc;IACd,MAAM,KAAK,GAAG,MAAM,EAAE,KAET,CAAC;IACd,MAAM,SAAS,GAAG,MAAM,EAAE,UAAgC,CAAC;IAE3D,sDAAsD;IACtD,6BAA6B;IAC7B,MAAM,cAAc,GAAG,KAAK,EAAE,UAAU,IAAK,KAAa,EAAE,IAAI,CAAC;IACjE,MAAM,oBAAoB,GACxB,cAAc,KAAK,CAAC,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC;IAE5F,OAAO;QACL,KAAK;QACL,SAAS;QACT,WAAW,EAAE,KAAK,EAAE,QAAQ;QAC5B,SAAS,EAAE,KAAK,EAAE,UAAU;QAC5B,oBAAoB;QACpB,MAAM,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,UAAoB,EAAE,WAAqB;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,UAAoB,EAAE,WAAqB;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAmB,EACnB,cAAwB,EACxB,aAA6B;IAE7B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC9D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/D,CAAC"}

package/src/core/auth-errors.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * auth-errors.ts — 统一错误类型定义。
+ *
+ * 所有与认证/授权/scope 相关的错误类型集中在此文件，
+ * 解除 tool-client ↔ app-scope-checker 循环依赖。
+ *
+ * 其他模块应直接 import 此文件，或通过 tool-client / uat-client 的 re-export 使用。
+ */
+/** 飞书 OAPI 错误码常量，替代各处硬编码的 magic number。 */
+export declare const LARK_ERROR: {
+    /** 应用 scope 不足（租户维度） */
+    readonly APP_SCOPE_MISSING: 99991672;
+    /** 用户 token scope 不足 */
+    readonly USER_SCOPE_INSUFFICIENT: 99991679;
+    /** access_token 无效 */
+    readonly TOKEN_INVALID: 99991668;
+    /** access_token 已过期 */
+    readonly TOKEN_EXPIRED: 99991669;
+    /** refresh_token 无效 */
+    readonly REFRESH_TOKEN_INVALID: 20003;
+    /** refresh_token 已过期 */
+    readonly REFRESH_TOKEN_EXPIRED: 20004;
+    /** refresh_token 缺失 */
+    readonly REFRESH_TOKEN_MISSING: 20024;
+    /** refresh_token 已被吊销 */
+    readonly REFRESH_TOKEN_REVOKED: 20063;
+    /** 消息已被撤回 */
+    readonly MESSAGE_RECALLED: 230011;
+    /** 消息已被删除 */
+    readonly MESSAGE_DELETED: 231003;
+};
+/** 不可恢复的 refresh_token 错误码集合，遇到后需要重新授权。 */
+export declare const REFRESH_TOKEN_IRRECOVERABLE: ReadonlySet<number>;
+/** 消息终止错误码集合（撤回/删除），遇到后应停止对该消息的后续操作。 */
+export declare const MESSAGE_TERMINAL_CODES: ReadonlySet<number>;
+/** access_token 失效相关的错误码集合，遇到后可尝试刷新重试。 */
+export declare const TOKEN_RETRY_CODES: ReadonlySet<number>;
+/** invoke() 错误共享的 scope 信息。 */
+export interface ScopeErrorInfo {
+    apiName: string;
+    scopes: string[];
+    /** 应用 scope 是否已验证通过。false 表示 app scope 检查失败，scope 信息可能不准确。 */
+    appScopeVerified?: boolean;
+    /** 应用 ID，用于生成开放平台权限管理链接。 */
+    appId?: string;
+}
+/** OAuth 授权提示信息，与 handleInvokeError 返回的结构一致。 */
+export interface AuthHint {
+    error: string;
+    api: string;
+    required_scope: string;
+    user_open_id: string;
+    message: string;
+    next_tool_call: {
+        tool: 'feishu_oauth';
+        params: {
+            action: 'authorize';
+            scope: string;
+        };
+    };
+}
+/** tryInvoke 返回值的判别联合体。 */
+export type TryInvokeResult<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: string;
+    authHint: AuthHint;
+} | {
+    ok: false;
+    error: string;
+    authHint?: undefined;
+};
+/**
+ * Thrown when no valid UAT exists and the user needs to (re-)authorise.
+ * Callers should catch this and trigger the OAuth flow.
+ */
+export declare class NeedAuthorizationError extends Error {
+    readonly userOpenId: string;
+    constructor(userOpenId: string);
+}
+/**
+ * 应用缺少 application:application:self_manage 权限，无法查询应用权限配置。
+ *
+ * 需要管理员在飞书开放平台开通 application:application:self_manage 权限。
+ */
+export declare class AppScopeCheckFailedError extends Error {
+    /** 应用 ID，用于生成开放平台权限管理链接。 */
+    readonly appId?: string;
+    constructor(appId?: string);
+}
+/**
+ * 应用未开通 OAPI 所需 scope。
+ *
+ * 需要管理员在飞书开放平台开通权限。
+ */
+export declare class AppScopeMissingError extends Error {
+    readonly apiName: string;
+    /** OAPI 需要但 APP 未开通的 scope 列表。 */
+    readonly missingScopes: string[];
+    /** 工具的全部所需 scope（含已开通的），用于应用权限完成后一次性发起用户授权。 */
+    readonly allRequiredScopes?: string[];
+    /** 应用 ID，用于生成开放平台权限管理链接。 */
+    readonly appId?: string;
+    readonly scopeNeedType?: 'one' | 'all';
+    /** 触发此错误时使用的 token 类型，用于保持 card action 二次校验一致。 */
+    readonly tokenType?: 'user' | 'tenant';
+    constructor(info: ScopeErrorInfo, scopeNeedType?: 'one' | 'all', tokenType?: 'user' | 'tenant', allRequiredScopes?: string[]);
+}
+/**
+ * 用户未授权或 scope 不足，需要发起 OAuth 授权。
+ *
+ * `requiredScopes` 为 APP∩OAPI 的有效 scope，可直接传给
+ * `feishu_oauth authorize --scope`。
+ */
+export declare class UserAuthRequiredError extends Error {
+    readonly userOpenId: string;
+    readonly apiName: string;
+    /** APP∩OAPI 交集 scope，传给 OAuth authorize。 */
+    readonly requiredScopes: string[];
+    /** 应用 scope 是否已验证通过。false 时 requiredScopes 可能不准确。 */
+    readonly appScopeVerified: boolean;
+    /** 应用 ID，用于生成开放平台权限管理链接。 */
+    readonly appId?: string;
+    constructor(userOpenId: string, info: ScopeErrorInfo);
+}
+/**
+ * 服务端报 99991679 — 用户 token 的 scope 不足。
+ *
+ * 需要增量授权：用缺失的 scope 发起新 Device Flow。
+ */
+export declare class UserScopeInsufficientError extends Error {
+    readonly userOpenId: string;
+    readonly apiName: string;
+    /** 缺失的 scope 列表。 */
+    readonly missingScopes: string[];
+    constructor(userOpenId: string, info: ScopeErrorInfo);
+}
+//# sourceMappingURL=auth-errors.d.ts.map

package/src/core/auth-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors.d.ts","sourceRoot":"","sources":["../../../src/core/auth-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,2CAA2C;AAC3C,eAAO,MAAM,UAAU;IACrB,wBAAwB;;IAExB,wBAAwB;;IAExB,sBAAsB;;IAEtB,uBAAuB;;IAEvB,uBAAuB;;IAEvB,wBAAwB;;IAExB,uBAAuB;;IAEvB,yBAAyB;;IAEzB,aAAa;;IAEb,aAAa;;CAEL,CAAC;AAEX,2CAA2C;AAC3C,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAK1D,CAAC;AAEH,wCAAwC;AACxC,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAGrD,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAiE,CAAC;AAMpH,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE;QACd,IAAI,EAAE,cAAc,CAAC;QACrB,MAAM,EAAE;YAAE,MAAM,EAAE,WAAW,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;KAChD,CAAC;CACH;AAED,2BAA2B;AAC3B,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GACrB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAMvD;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAChB,UAAU,EAAE,MAAM;CAK/B;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEZ,KAAK,CAAC,EAAE,MAAM;CAK3B;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;IACjC,+CAA+C;IAC/C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;gBAGrC,IAAI,EAAE,cAAc,EACpB,aAAa,CAAC,EAAE,KAAK,GAAG,KAAK,EAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE;CAe/B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEZ,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc;CASrD;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oBAAoB;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;gBAErB,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc;CAOrD"}

package/src/core/auth-errors.js

@@ -0,0 +1,156 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * auth-errors.ts — 统一错误类型定义。
+ *
+ * 所有与认证/授权/scope 相关的错误类型集中在此文件，
+ * 解除 tool-client ↔ app-scope-checker 循环依赖。
+ *
+ * 其他模块应直接 import 此文件，或通过 tool-client / uat-client 的 re-export 使用。
+ */
+// ---------------------------------------------------------------------------
+// Feishu error code constants
+// ---------------------------------------------------------------------------
+/** 飞书 OAPI 错误码常量，替代各处硬编码的 magic number。 */
+export const LARK_ERROR = {
+    /** 应用 scope 不足（租户维度） */
+    APP_SCOPE_MISSING: 99991672,
+    /** 用户 token scope 不足 */
+    USER_SCOPE_INSUFFICIENT: 99991679,
+    /** access_token 无效 */
+    TOKEN_INVALID: 99991668,
+    /** access_token 已过期 */
+    TOKEN_EXPIRED: 99991669,
+    /** refresh_token 无效 */
+    REFRESH_TOKEN_INVALID: 20003,
+    /** refresh_token 已过期 */
+    REFRESH_TOKEN_EXPIRED: 20004,
+    /** refresh_token 缺失 */
+    REFRESH_TOKEN_MISSING: 20024,
+    /** refresh_token 已被吊销 */
+    REFRESH_TOKEN_REVOKED: 20063,
+    /** 消息已被撤回 */
+    MESSAGE_RECALLED: 230011,
+    /** 消息已被删除 */
+    MESSAGE_DELETED: 231003,
+};
+/** 不可恢复的 refresh_token 错误码集合，遇到后需要重新授权。 */
+export const REFRESH_TOKEN_IRRECOVERABLE = new Set([
+    LARK_ERROR.REFRESH_TOKEN_INVALID,
+    LARK_ERROR.REFRESH_TOKEN_EXPIRED,
+    LARK_ERROR.REFRESH_TOKEN_MISSING,
+    LARK_ERROR.REFRESH_TOKEN_REVOKED,
+]);
+/** 消息终止错误码集合（撤回/删除），遇到后应停止对该消息的后续操作。 */
+export const MESSAGE_TERMINAL_CODES = new Set([
+    LARK_ERROR.MESSAGE_RECALLED,
+    LARK_ERROR.MESSAGE_DELETED,
+]);
+/** access_token 失效相关的错误码集合，遇到后可尝试刷新重试。 */
+export const TOKEN_RETRY_CODES = new Set([LARK_ERROR.TOKEN_INVALID, LARK_ERROR.TOKEN_EXPIRED]);
+// ---------------------------------------------------------------------------
+// Error classes
+// ---------------------------------------------------------------------------
+/**
+ * Thrown when no valid UAT exists and the user needs to (re-)authorise.
+ * Callers should catch this and trigger the OAuth flow.
+ */
+export class NeedAuthorizationError extends Error {
+    userOpenId;
+    constructor(userOpenId) {
+        super('need_user_authorization');
+        this.name = 'NeedAuthorizationError';
+        this.userOpenId = userOpenId;
+    }
+}
+/**
+ * 应用缺少 application:application:self_manage 权限，无法查询应用权限配置。
+ *
+ * 需要管理员在飞书开放平台开通 application:application:self_manage 权限。
+ */
+export class AppScopeCheckFailedError extends Error {
+    /** 应用 ID，用于生成开放平台权限管理链接。 */
+    appId;
+    constructor(appId) {
+        super('应用缺少 application:application:self_manage 权限，无法查询应用权限配置。请管理员在开放平台开通该权限。');
+        this.name = 'AppScopeCheckFailedError';
+        this.appId = appId;
+    }
+}
+/**
+ * 应用未开通 OAPI 所需 scope。
+ *
+ * 需要管理员在飞书开放平台开通权限。
+ */
+export class AppScopeMissingError extends Error {
+    apiName;
+    /** OAPI 需要但 APP 未开通的 scope 列表。 */
+    missingScopes;
+    /** 工具的全部所需 scope（含已开通的），用于应用权限完成后一次性发起用户授权。 */
+    allRequiredScopes;
+    /** 应用 ID，用于生成开放平台权限管理链接。 */
+    appId;
+    scopeNeedType;
+    /** 触发此错误时使用的 token 类型，用于保持 card action 二次校验一致。 */
+    tokenType;
+    constructor(info, scopeNeedType, tokenType, allRequiredScopes) {
+        if (scopeNeedType === 'one') {
+            super(`应用缺少权限 [${info.scopes.join(', ')}](开启任一权限即可)，请管理员在开放平台开通。`);
+        }
+        else {
+            super(`应用缺少权限 [${info.scopes.join(', ')}]，请管理员在开放平台开通。`);
+        }
+        this.name = 'AppScopeMissingError';
+        this.apiName = info.apiName;
+        this.missingScopes = info.scopes;
+        this.allRequiredScopes = allRequiredScopes;
+        this.appId = info.appId;
+        this.scopeNeedType = scopeNeedType;
+        this.tokenType = tokenType;
+    }
+}
+/**
+ * 用户未授权或 scope 不足，需要发起 OAuth 授权。
+ *
+ * `requiredScopes` 为 APP∩OAPI 的有效 scope，可直接传给
+ * `feishu_oauth authorize --scope`。
+ */
+export class UserAuthRequiredError extends Error {
+    userOpenId;
+    apiName;
+    /** APP∩OAPI 交集 scope，传给 OAuth authorize。 */
+    requiredScopes;
+    /** 应用 scope 是否已验证通过。false 时 requiredScopes 可能不准确。 */
+    appScopeVerified;
+    /** 应用 ID，用于生成开放平台权限管理链接。 */
+    appId;
+    constructor(userOpenId, info) {
+        super('need_user_authorization');
+        this.name = 'UserAuthRequiredError';
+        this.userOpenId = userOpenId;
+        this.apiName = info.apiName;
+        this.requiredScopes = info.scopes;
+        this.appId = info.appId;
+        this.appScopeVerified = info.appScopeVerified ?? true;
+    }
+}
+/**
+ * 服务端报 99991679 — 用户 token 的 scope 不足。
+ *
+ * 需要增量授权：用缺失的 scope 发起新 Device Flow。
+ */
+export class UserScopeInsufficientError extends Error {
+    userOpenId;
+    apiName;
+    /** 缺失的 scope 列表。 */
+    missingScopes;
+    constructor(userOpenId, info) {
+        super('user_scope_insufficient');
+        this.name = 'UserScopeInsufficientError';
+        this.userOpenId = userOpenId;
+        this.apiName = info.apiName;
+        this.missingScopes = info.scopes;
+    }
+}
+//# sourceMappingURL=auth-errors.js.map

package/src/core/auth-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors.js","sourceRoot":"","sources":["../../../src/core/auth-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,wBAAwB;IACxB,iBAAiB,EAAE,QAAQ;IAC3B,wBAAwB;IACxB,uBAAuB,EAAE,QAAQ;IACjC,sBAAsB;IACtB,aAAa,EAAE,QAAQ;IACvB,uBAAuB;IACvB,aAAa,EAAE,QAAQ;IACvB,uBAAuB;IACvB,qBAAqB,EAAE,KAAK;IAC5B,wBAAwB;IACxB,qBAAqB,EAAE,KAAK;IAC5B,uBAAuB;IACvB,qBAAqB,EAAE,KAAK;IAC5B,yBAAyB;IACzB,qBAAqB,EAAE,KAAK;IAC5B,aAAa;IACb,gBAAgB,EAAE,MAAM;IACxB,aAAa;IACb,eAAe,EAAE,MAAM;CACf,CAAC;AAEX,2CAA2C;AAC3C,MAAM,CAAC,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IACtE,UAAU,CAAC,qBAAqB;IAChC,UAAU,CAAC,qBAAqB;IAChC,UAAU,CAAC,qBAAqB;IAChC,UAAU,CAAC,qBAAqB;CACjC,CAAC,CAAC;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,UAAU,CAAC,gBAAgB;IAC3B,UAAU,CAAC,eAAe;CAC3B,CAAC,CAAC;AAEH,0CAA0C;AAC1C,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;AAmCpH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,UAAU,CAAS;IAC5B,YAAY,UAAkB;QAC5B,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,4BAA4B;IACnB,KAAK,CAAU;IAExB,YAAY,KAAc;QACxB,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAS;IACzB,kCAAkC;IACzB,aAAa,CAAW;IACjC,+CAA+C;IACtC,iBAAiB,CAAY;IACtC,4BAA4B;IACnB,KAAK,CAAU;IACf,aAAa,CAAiB;IACvC,kDAAkD;IACzC,SAAS,CAAqB;IAEvC,YACE,IAAoB,EACpB,aAA6B,EAC7B,SAA6B,EAC7B,iBAA4B;QAE5B,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;YAC5B,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,UAAU,CAAS;IACnB,OAAO,CAAS;IACzB,4CAA4C;IACnC,cAAc,CAAW;IAClC,qDAAqD;IAC5C,gBAAgB,CAAU;IAEnC,4BAA4B;IACnB,KAAK,CAAU;IAExB,YAAY,UAAkB,EAAE,IAAoB;QAClD,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACxD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,UAAU,CAAS;IACnB,OAAO,CAAS;IACzB,oBAAoB;IACX,aAAa,CAAW;IAEjC,YAAY,UAAkB,EAAE,IAAoB;QAClD,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,CAAC;CACF"}

package/src/core/chat-info-cache.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Account-scoped LRU cache for Feishu group/chat metadata.
+ *
+ * Caches the result of `im.chat.get` (chat_mode, group_message_type, etc.)
+ * to avoid repeated OAPI calls for every inbound message.
+ *
+ * Key fields cached:
+ * - `chat_mode`: "group" | "topic" | "p2p"
+ * - `group_message_type`: "chat" | "thread" (only for chat_mode=group)
+ */
+import type { ClawdbotConfig } from 'openclaw/plugin-sdk';
+export interface ChatInfo {
+    chatMode: 'group' | 'topic' | 'p2p';
+    groupMessageType?: 'chat' | 'thread';
+}
+/** Clear chat-info caches (called from LarkClient.clearCache). */
+export declare function clearChatInfoCache(accountId?: string): void;
+/**
+ * Determine whether a group supports thread sessions.
+ *
+ * Returns `true` when the group is a topic group (`chat_mode=topic`) or
+ * a normal group with thread message mode (`group_message_type=thread`).
+ *
+ * Results are cached per-account with a 1-hour TTL to minimise OAPI calls.
+ */
+export declare function isThreadCapableGroup(params: {
+    cfg: ClawdbotConfig;
+    chatId: string;
+    accountId?: string;
+}): Promise<boolean>;
+/**
+ * Fetch (or read from cache) the chat metadata for a given chat ID.
+ *
+ * Returns `undefined` when the API call fails (best-effort).
+ */
+export declare function getChatInfo(params: {
+    cfg: ClawdbotConfig;
+    chatId: string;
+    accountId?: string;
+}): Promise<ChatInfo | undefined>;
+/**
+ * Determine the chat type (p2p or group) for a given chat ID.
+ *
+ * Delegates to the shared {@link getChatInfo} cache (account-scoped LRU with
+ * 1-hour TTL) so that chat metadata is fetched at most once across all
+ * call-sites (dispatch, reaction handler, etc.).
+ *
+ * Falls back to "p2p" if the API call fails.
+ */
+export declare function getChatTypeFeishu(params: {
+    cfg: ClawdbotConfig;
+    chatId: string;
+    accountId?: string;
+}): Promise<'p2p' | 'group'>;
+//# sourceMappingURL=chat-info-cache.d.ts.map

package/src/core/chat-info-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-info-cache.d.ts","sourceRoot":"","sources":["../../../src/core/chat-info-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAU1D,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACtC;AAsED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ3D;AAMD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,GAAG,EAAE,cAAc,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CAKnB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE;IACxC,GAAG,EAAE,cAAc,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA8BhC;AAMD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,GAAG,EAAE,cAAc,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,CAK3B"}