@larksuite/openclaw-lark 2026.3.9

package/src/core/scope-manager.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Scope 管理模块
+ *
+ * 为所有工具动作提供类型安全的 scope 查询和检查功能。
+ *
+ * ## 三个核心概念
+ *
+ * ### 1. Required Scopes（API 需要的权限）
+ * - 定义：每个 API 调用所需的飞书权限列表
+ * - 来源：tool-scopes.ts（手动维护的类型化配置）
+ * - 示例：`["calendar:calendar.event:create", "calendar:calendar.event:update"]`
+ * - 用途：判断应用和用户是否需要申请/授权权限
+ *
+ * ### 2. App Granted Scopes（应用已开通的权限）
+ * - 定义：应用在飞书开放平台配置并获得管理员批准的权限
+ * - 来源：通过 API 查询 `/open-apis/application/v6/applications`
+ * - 作用：应用级权限前置检查，避免无效的用户授权请求
+ * - 检查时机：在请求用户授权前
+ *
+ * ### 3. User Granted Scopes（用户授权的权限）
+ * - 定义：用户通过 OAuth 流程明确授权给应用的权限
+ * - 来源：OAuth token 中的 scope 字段
+ * - 作用：用户级权限检查，确保用户已授权所需权限
+ * - 检查时机：每次 API 调用前
+ *
+ * ## 权限检查流程
+ *
+ * ```
+ * 1. 获取 Required Scopes (API 需要什么权限？)
+ *    ↓
+ * 2. 检查 App Granted Scopes (应用开通了吗？)
+ *    ↓ 是
+ * 3. 检查 User Granted Scopes (用户授权了吗？)
+ *    ↓ 是
+ * 4. 调用 API
+ * ```
+ */
+import { type ToolActionKey, type ToolScopeMapping, TOOL_SCOPES } from './tool-scopes';
+export type { ToolActionKey, ToolScopeMapping };
+export { TOOL_SCOPES };
+/**
+ * 获取单个工具动作所需的 scopes（Required Scopes）
+ *
+ * @param toolAction - 工具动作键（例如 "feishu_calendar_event.create"）
+ * @returns API 需要的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const requiredScopes = getRequiredScopes("feishu_calendar_event.create");
+ * // 返回: ["calendar:calendar.event:create", "calendar:calendar.event:update"]
+ * ```
+ */
+export declare function getRequiredScopes(toolAction: ToolActionKey): string[];
+/**
+ * 获取多个工具动作的合并 Required Scopes（去重）
+ *
+ * @param toolActions - 工具动作键数组
+ * @returns 去重并排序后的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const requiredScopes = getRequiredScopesForActions([
+ *   "feishu_calendar_event.create",
+ *   "feishu_calendar_event.list"
+ * ]);
+ * // 返回两个动作的所有唯一 scopes
+ * ```
+ */
+export declare function getRequiredScopesForActions(toolActions: ToolActionKey[]): string[];
+/**
+ * 检查工具动作是否需要任何 scope
+ *
+ * @param toolAction - 工具动作键
+ * @returns 如果动作需要至少一个 scope 则返回 true
+ *
+ * @example
+ * ```ts
+ * hasRequiredScopes("feishu_calendar_event.create"); // true
+ * hasRequiredScopes("feishu_sheets_spreadsheet.create"); // false (空数组)
+ * ```
+ */
+export declare function hasRequiredScopes(toolAction: ToolActionKey): boolean;
+/**
+ * 获取需要特定 scope 的所有工具动作
+ *
+ * @param scope - Scope 字符串（例如 "calendar:calendar.event:create"）
+ * @returns 需要此 scope 的工具动作键数组
+ *
+ * @example
+ * ```ts
+ * const actions = getActionsForScope("calendar:calendar.event:create");
+ * // 返回: ["feishu_calendar_event.create"]
+ * ```
+ */
+export declare function getActionsForScope(scope: string): ToolActionKey[];
+/**
+ * 检查应用是否开通了工具动作所需的所有权限（App Granted Scopes）
+ *
+ * @param toolAction - 工具动作键
+ * @param appGrantedScopes - 应用已开通的 scope 集合（来自开放平台）
+ * @returns 如果应用已开通所有必需的 scopes 则返回 true
+ *
+ * @example
+ * ```ts
+ * const appScopes = new Set([
+ *   "calendar:calendar.event:create",
+ *   "calendar:calendar.event:update"
+ * ]);
+ * checkAppScopes("feishu_calendar_event.create", appScopes); // true
+ *
+ * const partialAppScopes = new Set(["calendar:calendar.event:create"]);
+ * checkAppScopes("feishu_calendar_event.create", partialAppScopes); // false
+ * ```
+ */
+export declare function checkAppScopes(toolAction: ToolActionKey, appGrantedScopes: Set<string> | string[]): boolean;
+/**
+ * 获取应用未开通的 scopes
+ *
+ * @param toolAction - 工具动作键
+ * @param appGrantedScopes - 应用已开通的 scope 集合
+ * @returns 应用未开通的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const appScopes = new Set(["calendar:calendar.event:create"]);
+ * const missing = getMissingAppScopes("feishu_calendar_event.create", appScopes);
+ * // 返回: ["calendar:calendar.event:update"]
+ * ```
+ */
+export declare function getMissingAppScopes(toolAction: ToolActionKey, appGrantedScopes: Set<string> | string[]): string[];
+/**
+ * 检查用户是否授权了工具动作所需的所有权限（User Granted Scopes）
+ *
+ * @param toolAction - 工具动作键
+ * @param userGrantedScopes - 用户已授权的 scope 集合（来自 OAuth token）
+ * @returns 如果用户已授权所有必需的 scopes 则返回 true
+ *
+ * @example
+ * ```ts
+ * const userScopes = new Set([
+ *   "calendar:calendar.event:create",
+ *   "calendar:calendar.event:update"
+ * ]);
+ * checkUserScopes("feishu_calendar_event.create", userScopes); // true
+ *
+ * const partialUserScopes = new Set(["calendar:calendar.event:create"]);
+ * checkUserScopes("feishu_calendar_event.create", partialUserScopes); // false
+ * ```
+ */
+export declare function checkUserScopes(toolAction: ToolActionKey, userGrantedScopes: Set<string> | string[]): boolean;
+/**
+ * 获取用户未授权的 scopes
+ *
+ * @param toolAction - 工具动作键
+ * @param userGrantedScopes - 用户已授权的 scope 集合
+ * @returns 用户未授权的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const userScopes = new Set(["calendar:calendar.event:create"]);
+ * const missing = getMissingUserScopes("feishu_calendar_event.create", userScopes);
+ * // 返回: ["calendar:calendar.event:update"]
+ * ```
+ */
+export declare function getMissingUserScopes(toolAction: ToolActionKey, userGrantedScopes: Set<string> | string[]): string[];
+//# sourceMappingURL=scope-manager.d.ts.map

package/src/core/scope-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-manager.d.ts","sourceRoot":"","sources":["../../../src/core/scope-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAIvF,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,CAAC;AAIvB;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,aAAa,GAAG,MAAM,EAAE,CAErE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CASlF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAEpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,EAAE,CAUjE;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,CAW3G;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAKjH;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,CAW7G;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAKnH"}

package/src/core/scope-manager.js

@@ -0,0 +1,214 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Scope 管理模块
+ *
+ * 为所有工具动作提供类型安全的 scope 查询和检查功能。
+ *
+ * ## 三个核心概念
+ *
+ * ### 1. Required Scopes（API 需要的权限）
+ * - 定义：每个 API 调用所需的飞书权限列表
+ * - 来源：tool-scopes.ts（手动维护的类型化配置）
+ * - 示例：`["calendar:calendar.event:create", "calendar:calendar.event:update"]`
+ * - 用途：判断应用和用户是否需要申请/授权权限
+ *
+ * ### 2. App Granted Scopes（应用已开通的权限）
+ * - 定义：应用在飞书开放平台配置并获得管理员批准的权限
+ * - 来源：通过 API 查询 `/open-apis/application/v6/applications`
+ * - 作用：应用级权限前置检查，避免无效的用户授权请求
+ * - 检查时机：在请求用户授权前
+ *
+ * ### 3. User Granted Scopes（用户授权的权限）
+ * - 定义：用户通过 OAuth 流程明确授权给应用的权限
+ * - 来源：OAuth token 中的 scope 字段
+ * - 作用：用户级权限检查，确保用户已授权所需权限
+ * - 检查时机：每次 API 调用前
+ *
+ * ## 权限检查流程
+ *
+ * ```
+ * 1. 获取 Required Scopes (API 需要什么权限？)
+ *    ↓
+ * 2. 检查 App Granted Scopes (应用开通了吗？)
+ *    ↓ 是
+ * 3. 检查 User Granted Scopes (用户授权了吗？)
+ *    ↓ 是
+ * 4. 调用 API
+ * ```
+ */
+import { TOOL_SCOPES } from './tool-scopes';
+export { TOOL_SCOPES };
+// ===== 函数：Required Scopes（API 需要的权限）=====
+/**
+ * 获取单个工具动作所需的 scopes（Required Scopes）
+ *
+ * @param toolAction - 工具动作键（例如 "feishu_calendar_event.create"）
+ * @returns API 需要的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const requiredScopes = getRequiredScopes("feishu_calendar_event.create");
+ * // 返回: ["calendar:calendar.event:create", "calendar:calendar.event:update"]
+ * ```
+ */
+export function getRequiredScopes(toolAction) {
+    return TOOL_SCOPES[toolAction] ?? [];
+}
+/**
+ * 获取多个工具动作的合并 Required Scopes（去重）
+ *
+ * @param toolActions - 工具动作键数组
+ * @returns 去重并排序后的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const requiredScopes = getRequiredScopesForActions([
+ *   "feishu_calendar_event.create",
+ *   "feishu_calendar_event.list"
+ * ]);
+ * // 返回两个动作的所有唯一 scopes
+ * ```
+ */
+export function getRequiredScopesForActions(toolActions) {
+    const scopesSet = new Set();
+    for (const action of toolActions) {
+        const scopes = getRequiredScopes(action);
+        scopes.forEach((scope) => scopesSet.add(scope));
+    }
+    return Array.from(scopesSet).sort();
+}
+/**
+ * 检查工具动作是否需要任何 scope
+ *
+ * @param toolAction - 工具动作键
+ * @returns 如果动作需要至少一个 scope 则返回 true
+ *
+ * @example
+ * ```ts
+ * hasRequiredScopes("feishu_calendar_event.create"); // true
+ * hasRequiredScopes("feishu_sheets_spreadsheet.create"); // false (空数组)
+ * ```
+ */
+export function hasRequiredScopes(toolAction) {
+    return getRequiredScopes(toolAction).length > 0;
+}
+/**
+ * 获取需要特定 scope 的所有工具动作
+ *
+ * @param scope - Scope 字符串（例如 "calendar:calendar.event:create"）
+ * @returns 需要此 scope 的工具动作键数组
+ *
+ * @example
+ * ```ts
+ * const actions = getActionsForScope("calendar:calendar.event:create");
+ * // 返回: ["feishu_calendar_event.create"]
+ * ```
+ */
+export function getActionsForScope(scope) {
+    const actions = [];
+    for (const [action, scopes] of Object.entries(TOOL_SCOPES)) {
+        if (scopes.includes(scope)) {
+            actions.push(action);
+        }
+    }
+    return actions;
+}
+// ===== 函数：App Scope 检查 =====
+/**
+ * 检查应用是否开通了工具动作所需的所有权限（App Granted Scopes）
+ *
+ * @param toolAction - 工具动作键
+ * @param appGrantedScopes - 应用已开通的 scope 集合（来自开放平台）
+ * @returns 如果应用已开通所有必需的 scopes 则返回 true
+ *
+ * @example
+ * ```ts
+ * const appScopes = new Set([
+ *   "calendar:calendar.event:create",
+ *   "calendar:calendar.event:update"
+ * ]);
+ * checkAppScopes("feishu_calendar_event.create", appScopes); // true
+ *
+ * const partialAppScopes = new Set(["calendar:calendar.event:create"]);
+ * checkAppScopes("feishu_calendar_event.create", partialAppScopes); // false
+ * ```
+ */
+export function checkAppScopes(toolAction, appGrantedScopes) {
+    const requiredScopes = getRequiredScopes(toolAction);
+    // 如果不需要任何 scope，则总是满足要求
+    if (requiredScopes.length === 0) {
+        return true;
+    }
+    const grantedSet = Array.isArray(appGrantedScopes) ? new Set(appGrantedScopes) : appGrantedScopes;
+    return requiredScopes.every((scope) => grantedSet.has(scope));
+}
+/**
+ * 获取应用未开通的 scopes
+ *
+ * @param toolAction - 工具动作键
+ * @param appGrantedScopes - 应用已开通的 scope 集合
+ * @returns 应用未开通的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const appScopes = new Set(["calendar:calendar.event:create"]);
+ * const missing = getMissingAppScopes("feishu_calendar_event.create", appScopes);
+ * // 返回: ["calendar:calendar.event:update"]
+ * ```
+ */
+export function getMissingAppScopes(toolAction, appGrantedScopes) {
+    const requiredScopes = getRequiredScopes(toolAction);
+    const grantedSet = Array.isArray(appGrantedScopes) ? new Set(appGrantedScopes) : appGrantedScopes;
+    return requiredScopes.filter((scope) => !grantedSet.has(scope));
+}
+// ===== 函数：User Scope 检查 =====
+/**
+ * 检查用户是否授权了工具动作所需的所有权限（User Granted Scopes）
+ *
+ * @param toolAction - 工具动作键
+ * @param userGrantedScopes - 用户已授权的 scope 集合（来自 OAuth token）
+ * @returns 如果用户已授权所有必需的 scopes 则返回 true
+ *
+ * @example
+ * ```ts
+ * const userScopes = new Set([
+ *   "calendar:calendar.event:create",
+ *   "calendar:calendar.event:update"
+ * ]);
+ * checkUserScopes("feishu_calendar_event.create", userScopes); // true
+ *
+ * const partialUserScopes = new Set(["calendar:calendar.event:create"]);
+ * checkUserScopes("feishu_calendar_event.create", partialUserScopes); // false
+ * ```
+ */
+export function checkUserScopes(toolAction, userGrantedScopes) {
+    const requiredScopes = getRequiredScopes(toolAction);
+    // 如果不需要任何 scope，则总是满足要求
+    if (requiredScopes.length === 0) {
+        return true;
+    }
+    const grantedSet = Array.isArray(userGrantedScopes) ? new Set(userGrantedScopes) : userGrantedScopes;
+    return requiredScopes.every((scope) => grantedSet.has(scope));
+}
+/**
+ * 获取用户未授权的 scopes
+ *
+ * @param toolAction - 工具动作键
+ * @param userGrantedScopes - 用户已授权的 scope 集合
+ * @returns 用户未授权的 scope 字符串数组
+ *
+ * @example
+ * ```ts
+ * const userScopes = new Set(["calendar:calendar.event:create"]);
+ * const missing = getMissingUserScopes("feishu_calendar_event.create", userScopes);
+ * // 返回: ["calendar:calendar.event:update"]
+ * ```
+ */
+export function getMissingUserScopes(toolAction, userGrantedScopes) {
+    const requiredScopes = getRequiredScopes(toolAction);
+    const grantedSet = Array.isArray(userGrantedScopes) ? new Set(userGrantedScopes) : userGrantedScopes;
+    return requiredScopes.filter((scope) => !grantedSet.has(scope));
+}
+//# sourceMappingURL=scope-manager.js.map

package/src/core/scope-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-manager.js","sourceRoot":"","sources":["../../../src/core/scope-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAA6C,WAAW,EAAE,MAAM,eAAe,CAAC;AAKvF,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,2CAA2C;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAyB;IACzD,OAAO,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAA4B;IACtE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAyB;IACzD,OAAO,iBAAiB,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAuB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8BAA8B;AAE9B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,UAAyB,EAAE,gBAAwC;IAChG,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAErD,wBAAwB;IACxB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAElG,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAyB,EAAE,gBAAwC;IACrG,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAElG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,+BAA+B;AAE/B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,UAAyB,EAAE,iBAAyC;IAClG,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAErD,wBAAwB;IACxB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAErG,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAyB,EAAE,iBAAyC;IACvG,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAErG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/src/core/security-check.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Multi-account isolation checks.
+ *
+ * Detects potentially unsafe configurations where multiple Feishu accounts
+ * belonging to different tenants (different appId) share the default agent
+ * without proper isolation via agents + bindings.
+ */
+import type { ClawdbotConfig } from 'openclaw/plugin-sdk';
+import type { LarkAccount } from './types';
+export type IsolationStatus = 
+/** Single account / same appId / no multi-tenant concern */
+{
+    mode: 'not-applicable';
+}
+/** All accounts have bindings pointing to different agents */
+ | {
+    mode: 'isolated';
+    accounts: LarkAccount[];
+}
+/** All accounts have bindings but share the same agent (explicit choice) */
+ | {
+    mode: 'shared-explicit';
+    accounts: LarkAccount[];
+    sharedAgentId: string;
+}
+/** Some or all accounts have no bindings — implicit sharing, risky */
+ | {
+    mode: 'shared-implicit';
+    accounts: LarkAccount[];
+    unboundAccounts: LarkAccount[];
+};
+/**
+ * Diagnose whether multiple enabled accounts from different tenants
+ * are properly isolated via agent bindings.
+ */
+export declare function checkMultiAccountIsolation(cfg: ClawdbotConfig): IsolationStatus;
+/**
+ * Check whether `session.dmScope` is set to per-account isolation.
+ *
+ * Without this setting, different bots talking to the same user share
+ * the same session — even if agent bindings are configured.
+ */
+export declare function needsDmScopeFix(cfg: ClawdbotConfig): boolean;
+/** Return the fix command string, or null if not needed. */
+export declare function getDmScopeFixCommand(cfg: ClawdbotConfig): string | null;
+/**
+ * Generate a combined warning block for doctor / start.
+ * Returns null when everything is fine.
+ */
+export declare function formatIsolationWarning(status: IsolationStatus, cfg?: ClawdbotConfig): string | null;
+/**
+ * Generate `openclaw config set` commands for per-account isolation.
+ */
+export declare function generateIsolationFixCommands(cfg: ClawdbotConfig): {
+    commands: string[];
+    preview: string;
+} | null;
+/**
+ * Generate commands for explicitly sharing the same agent across accounts.
+ */
+export declare function generateSharedAgentCommands(cfg: ClawdbotConfig): {
+    commands: string[];
+    preview: string;
+} | null;
+export declare function collectIsolationWarnings(_cfg: ClawdbotConfig): string[];
+export declare function emitSecurityWarnings(_cfg: ClawdbotConfig, _logger: {
+    warn?: (msg: string) => void;
+    info?: (msg: string) => void;
+}): void;
+//# sourceMappingURL=security-check.d.ts.map

package/src/core/security-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-check.d.ts","sourceRoot":"","sources":["../../../src/core/security-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAM3C,MAAM,MAAM,eAAe;AACzB,4DAA4D;AAC1D;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE;AAC5B,8DAA8D;GAC5D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAA;CAAE;AAC/C,4EAA4E;GAC1E;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAC7E,sEAAsE;GACpE;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,eAAe,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAMzF;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,cAAc,GAAG,eAAe,CA8B/E;AAuBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAI5D;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAGvE;AAeD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAsBnG;AAMD;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA2BhH;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAqB/G;AAMD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAGvE;AAMD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACtE,IAAI,CAEN"}

package/src/core/security-check.js

@@ -0,0 +1,175 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Multi-account isolation checks.
+ *
+ * Detects potentially unsafe configurations where multiple Feishu accounts
+ * belonging to different tenants (different appId) share the default agent
+ * without proper isolation via agents + bindings.
+ */
+import { getEnabledLarkAccounts } from './accounts';
+// ---------------------------------------------------------------------------
+// Check logic
+// ---------------------------------------------------------------------------
+/**
+ * Diagnose whether multiple enabled accounts from different tenants
+ * are properly isolated via agent bindings.
+ */
+export function checkMultiAccountIsolation(cfg) {
+    const accounts = getEnabledLarkAccounts(cfg);
+    if (accounts.length <= 1)
+        return { mode: 'not-applicable' };
+    const appIds = new Set(accounts.map((a) => (a.configured ? a.appId : undefined)).filter((id) => !!id));
+    if (appIds.size <= 1)
+        return { mode: 'not-applicable' };
+    const feishuBindings = cfg.bindings?.filter((b) => b.match?.channel === 'feishu' && b.match?.accountId);
+    if (!feishuBindings || feishuBindings.length === 0) {
+        return { mode: 'shared-implicit', accounts, unboundAccounts: accounts };
+    }
+    const boundAccountIds = new Set(feishuBindings.map((b) => b.match.accountId));
+    const unboundAccounts = accounts.filter((a) => !boundAccountIds.has(a.accountId));
+    if (unboundAccounts.length > 0) {
+        return { mode: 'shared-implicit', accounts, unboundAccounts };
+    }
+    const agentIds = new Set(feishuBindings.map((b) => b.agentId));
+    if (agentIds.size === 1) {
+        return {
+            mode: 'shared-explicit',
+            accounts,
+            sharedAgentId: agentIds.values().next().value,
+        };
+    }
+    return { mode: 'isolated', accounts };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function accountNames(accounts) {
+    return accounts.map((a) => a.name ?? a.accountId).join('、');
+}
+function isMultiTenant(cfg) {
+    const accounts = getEnabledLarkAccounts(cfg);
+    if (accounts.length <= 1)
+        return false;
+    const appIds = new Set(accounts.map((a) => (a.configured ? a.appId : undefined)).filter((id) => !!id));
+    return appIds.size > 1;
+}
+// ---------------------------------------------------------------------------
+// Session dmScope
+// ---------------------------------------------------------------------------
+const RECOMMENDED_DM_SCOPE = 'per-account-channel-peer';
+/**
+ * Check whether `session.dmScope` is set to per-account isolation.
+ *
+ * Without this setting, different bots talking to the same user share
+ * the same session — even if agent bindings are configured.
+ */
+export function needsDmScopeFix(cfg) {
+    if (!isMultiTenant(cfg))
+        return false;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return cfg.session?.dmScope !== RECOMMENDED_DM_SCOPE;
+}
+/** Return the fix command string, or null if not needed. */
+export function getDmScopeFixCommand(cfg) {
+    if (!needsDmScopeFix(cfg))
+        return null;
+    return `openclaw config set session.dmScope "${RECOMMENDED_DM_SCOPE}"`;
+}
+/** User-facing dmScope warning block (markdown). */
+function formatDmScopeWarning() {
+    return ('⚠️ **私聊消息串混**\n\n' +
+        '当同一个用户同时使用多个机器人时，不同机器人的私聊消息会混在同一段对话里，' +
+        '导致 AI 无法区分用户在跟哪个机器人说话。');
+}
+// ---------------------------------------------------------------------------
+// Warning text for /feishu doctor & /feishu start
+// ---------------------------------------------------------------------------
+/**
+ * Generate a combined warning block for doctor / start.
+ * Returns null when everything is fine.
+ */
+export function formatIsolationWarning(status, cfg) {
+    const sections = [];
+    // Agent sharing warning
+    if (status.mode === 'shared-implicit') {
+        const names = accountNames(status.accounts);
+        sections.push(`⚠️ **多个机器人共用记忆，对话内容可能互相可见**\n\n` +
+            `当前 ${status.accounts.length} 个飞书机器人（${names}）共用同一个 AI 记忆。\n` +
+            `用户 A 跟机器人「${status.accounts[0].name ?? status.accounts[0].accountId}」说的话，` +
+            `可能出现在机器人「${status.accounts[1]?.name ?? status.accounts[1]?.accountId ?? '...'}」的回复中。\n\n` +
+            `👉 发送 **/feishu isolate** 一键查看修复方案`);
+    }
+    // dmScope warning
+    if (cfg && needsDmScopeFix(cfg)) {
+        sections.push(formatDmScopeWarning() + '\n\n' + '👉 发送 **/feishu isolate** 一键查看修复方案');
+    }
+    if (sections.length === 0)
+        return null;
+    return sections.join('\n\n---\n\n');
+}
+// ---------------------------------------------------------------------------
+// Fix command generation
+// ---------------------------------------------------------------------------
+/**
+ * Generate `openclaw config set` commands for per-account isolation.
+ */
+export function generateIsolationFixCommands(cfg) {
+    const status = checkMultiAccountIsolation(cfg);
+    if (status.mode !== 'shared-implicit')
+        return null;
+    const accounts = status.accounts;
+    const commands = [];
+    const agentsList = accounts.map((a) => ({
+        id: `feishu-${a.accountId}`,
+        name: `飞书 ${a.name ?? a.accountId}`,
+    }));
+    commands.push(`openclaw config set agents.list '${JSON.stringify(agentsList)}' --json`);
+    const bindings = accounts.map((a) => ({
+        match: { channel: 'feishu', accountId: a.accountId },
+        agentId: `feishu-${a.accountId}`,
+    }));
+    commands.push(`openclaw config set bindings '${JSON.stringify(bindings)}' --json`);
+    const dmScopeCmd = getDmScopeFixCommand(cfg);
+    if (dmScopeCmd)
+        commands.push(dmScopeCmd);
+    commands.push('openclaw gateway restart');
+    const previewLines = accounts.map((a) => `  ${a.name ?? a.accountId}  →  独立记忆（feishu-${a.accountId}）`);
+    return { commands, preview: previewLines.join('\n') };
+}
+/**
+ * Generate commands for explicitly sharing the same agent across accounts.
+ */
+export function generateSharedAgentCommands(cfg) {
+    const status = checkMultiAccountIsolation(cfg);
+    if (status.mode !== 'shared-implicit')
+        return null;
+    const accounts = status.accounts;
+    const commands = [];
+    const bindings = accounts.map((a) => ({
+        match: { channel: 'feishu', accountId: a.accountId },
+        agentId: 'default',
+    }));
+    commands.push(`openclaw config set bindings '${JSON.stringify(bindings)}' --json`);
+    const dmScopeCmd = getDmScopeFixCommand(cfg);
+    if (dmScopeCmd)
+        commands.push(dmScopeCmd);
+    commands.push('openclaw gateway restart');
+    const previewLines = accounts.map((a) => `  ${a.name ?? a.accountId}  →  共用记忆（default）`);
+    return { commands, preview: previewLines.join('\n') };
+}
+// ---------------------------------------------------------------------------
+// collectWarnings adapter (for SDK security.collectWarnings)
+// ---------------------------------------------------------------------------
+export function collectIsolationWarnings(_cfg) {
+    // TODO: 产品明确多账号隔离方案后再透出告警
+    return [];
+}
+// ---------------------------------------------------------------------------
+// Startup log
+// ---------------------------------------------------------------------------
+export function emitSecurityWarnings(_cfg, _logger) {
+    // TODO: 产品明确多账号隔离方案后再透出告警
+}
+//# sourceMappingURL=security-check.js.map

package/src/core/security-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-check.js","sourceRoot":"","sources":["../../../src/core/security-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAiBpD,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAmB;IAC5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAE5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAExD,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAExG,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAM,CAAC,SAAU,CAAC,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAElF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,QAAQ;YACR,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,YAAY,CAAC,QAAuB;IAC3C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB;IACxC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,8DAA8D;IAC9D,OAAQ,GAAW,CAAC,OAAO,EAAE,OAAO,KAAK,oBAAoB,CAAC;AAChE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,wCAAwC,oBAAoB,GAAG,CAAC;AACzE,CAAC;AAED,oDAAoD;AACpD,SAAS,oBAAoB;IAC3B,OAAO,CACL,mBAAmB;QACnB,uCAAuC;QACvC,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAuB,EAAE,GAAoB;IAClF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,wBAAwB;IACxB,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,QAAQ,CAAC,IAAI,CACX,iCAAiC;YAC/B,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,WAAW,KAAK,iBAAiB;YAC7D,aAAa,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,OAAO;YAC3E,YAAY,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,KAAK,YAAY;YAC1F,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,MAAM,GAAG,oCAAoC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAmB;IAC9D,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,CAAC,SAAS,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE;KACpC,CAAC,CAAC,CAAC;IACJ,QAAQ,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAExF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE;QACpD,OAAO,EAAE,UAAU,CAAC,CAAC,SAAS,EAAE;KACjC,CAAC,CAAC,CAAC;IACJ,QAAQ,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE1C,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAE1C,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,oBAAoB,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;IAEvG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAmB;IAC7D,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE;QACpD,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC,CAAC;IACJ,QAAQ,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE1C,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAE1C,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,oBAAoB,CAAC,CAAC;IAEzF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,MAAM,UAAU,wBAAwB,CAAC,IAAoB;IAC3D,0BAA0B;IAC1B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,OAAuE;IAEvE,0BAA0B;AAC5B,CAAC"}