@ssobig/writer-cli 0.2.0

package/tools/writer-cli/src/auth.cjs

@@ -0,0 +1,655 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const http = require("node:http");
+const os = require("node:os");
+const path = require("node:path");
+const { spawn } = require("node:child_process");
+const { cliError } = require("./errors.cjs");
+
+const KEYCHAIN_SERVICE = "com.ssobig.writer-cli.auth";
+const AUTH_STORAGE_KEY = "ssobig-writer-cli-auth-v1";
+const KEYCHAIN_CHUNK_VERSION = "v2";
+const KEYCHAIN_SECRET_LIMIT = 120;
+const KEYCHAIN_CHUNK_SIZE = 96;
+const KEYCHAIN_MANIFEST_PATTERN = /^v2\|([a-f0-9]{32})\|([1-9][0-9]{0,3})\|([a-f0-9]{64})$/;
+const DPAPI_STORAGE_VERSION = "ssobig-writer-dpapi-v1";
+const DPAPI_MAX_SECRET_BYTES = 4 * 1024 * 1024;
+const DPAPI_SCRIPT = String.raw`$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Security
+$request = [Console]::In.ReadToEnd() | ConvertFrom-Json
+$data = [Convert]::FromBase64String([string]$request.data)
+$entropy = [Text.Encoding]::UTF8.GetBytes([string]$request.entropy)
+$scope = [Security.Cryptography.DataProtectionScope]::CurrentUser
+if ([string]$request.operation -eq 'protect') {
+  $result = [Security.Cryptography.ProtectedData]::Protect($data, $entropy, $scope)
+} elseif ([string]$request.operation -eq 'unprotect') {
+  $result = [Security.Cryptography.ProtectedData]::Unprotect($data, $entropy, $scope)
+} else {
+  throw 'Unsupported DPAPI operation.'
+}
+[Console]::Out.Write([Convert]::ToBase64String($result))`;
+
+function delay(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+function createFileLock(options = {}) {
+  const fsApi = options.fs || fs;
+  const platform = String(options.platform || process.platform);
+  const environment = options.environment || process.env;
+  const homeDirectory = options.homeDirectory || os.homedir();
+  const windowsRoot = environment.LOCALAPPDATA || path.join(homeDirectory, "AppData", "Local");
+  const baseDirectory = options.baseDirectory || (platform === "win32"
+    ? path.join(windowsRoot, "SSOBIG", "WriterCLI", "locks")
+    : path.join(homeDirectory, "Library", "Caches", "ssobig-writer-cli", "locks"));
+  const staleMs = Number(options.staleMs || 600_000);
+  const recoveryStaleMs = Number(options.recoveryStaleMs || 10_000);
+  const randomUUID = options.randomUUID || crypto.randomUUID;
+  const processAlive = options.processAlive || (pid => {
+    if (!Number.isSafeInteger(pid) || pid < 1) return false;
+    try { process.kill(pid, 0); return true; }
+    catch (error) { return error.code === "EPERM"; }
+  });
+
+  function readOwner(lockPath) {
+    try { return JSON.parse(fsApi.readFileSync(lockPath, "utf8")); }
+    catch (error) { if (error.code === "ENOENT") return null; return null; }
+  }
+
+  function ownedBy(lockPath, token) {
+    return readOwner(lockPath)?.token === token;
+  }
+
+  function releaseOwned(lockPath, token, handle = null) {
+    if (handle !== null) {
+      try { fsApi.closeSync(handle); } catch (error) { void error; }
+    }
+    if (!ownedBy(lockPath, token)) return;
+    try { fsApi.unlinkSync(lockPath); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  }
+
+  async function lock(name, acquireTimeout, callback) {
+    fsApi.mkdirSync(baseDirectory, { recursive: true, mode: 0o700 });
+    const fileName = `${crypto.createHash("sha256").update(String(name)).digest("hex")}.lock`;
+    const lockPath = path.join(baseDirectory, fileName);
+    const recoveryPath = `${lockPath}.recovery`;
+    const startedAt = Date.now();
+    const timeoutMs = Number(acquireTimeout) < 0 ? 10_000 : Math.min(Math.max(Number(acquireTimeout || 10_000), 250), 10_000);
+    let handle = null;
+    const token = randomUUID();
+    while (!handle) {
+      if (fsApi.existsSync(recoveryPath)) {
+        try {
+          const recoveryStat = fsApi.statSync(recoveryPath);
+          const recoveryOwner = readOwner(recoveryPath);
+          if (Date.now() - recoveryStat.mtimeMs > recoveryStaleMs && !processAlive(Number(recoveryOwner?.pid))) {
+            releaseOwned(recoveryPath, recoveryOwner?.token);
+            continue;
+          }
+        } catch (error) {
+          if (error.code === "ENOENT") continue;
+          throw cliError("E_AUTH_LOCK", "인증 recovery lock 상태를 확인할 수 없습니다.", null, error);
+        }
+        if (Date.now() - startedAt >= timeoutMs) throw cliError("E_AUTH_BUSY", "다른 Writer CLI 인증 작업이 진행 중입니다. 잠시 후 다시 시도해 주세요.");
+        await delay(100);
+        continue;
+      }
+      try {
+        handle = fsApi.openSync(lockPath, "wx", 0o600);
+        try { fsApi.writeFileSync(handle, JSON.stringify({ pid: process.pid, token, createdAt: Date.now() })); }
+        catch (writeError) {
+          try { fsApi.closeSync(handle); } catch (closeError) { void closeError; }
+          handle = null;
+          try { fsApi.unlinkSync(lockPath); } catch (unlinkError) { void unlinkError; }
+          throw writeError;
+        }
+      } catch (error) {
+        if (error.code !== "EEXIST") throw cliError("E_AUTH_LOCK", "인증 lock을 만들 수 없습니다.", null, error);
+        try {
+          const stat = fsApi.statSync(lockPath);
+          const owner = readOwner(lockPath);
+          if (Date.now() - stat.mtimeMs > staleMs && !processAlive(Number(owner?.pid))) {
+            let recoveryHandle = null;
+            const recoveryToken = randomUUID();
+            try {
+              recoveryHandle = fsApi.openSync(recoveryPath, "wx", 0o600);
+              try { fsApi.writeFileSync(recoveryHandle, JSON.stringify({ pid: process.pid, token: recoveryToken, createdAt: Date.now() })); }
+              catch (writeError) {
+                try { fsApi.closeSync(recoveryHandle); } catch (closeError) { void closeError; }
+                recoveryHandle = null;
+                try { fsApi.unlinkSync(recoveryPath); } catch (unlinkError) { void unlinkError; }
+                throw writeError;
+              }
+              const latestStat = fsApi.statSync(lockPath);
+              const latestOwner = readOwner(lockPath);
+              if (latestOwner?.token === owner?.token
+                && Date.now() - latestStat.mtimeMs > staleMs
+                && !processAlive(Number(latestOwner?.pid))) {
+                fsApi.unlinkSync(lockPath);
+              }
+            } catch (recoveryError) {
+              if (!["EEXIST", "ENOENT"].includes(recoveryError.code)) throw recoveryError;
+            } finally {
+              if (recoveryHandle !== null) releaseOwned(recoveryPath, recoveryToken, recoveryHandle);
+            }
+            continue;
+          }
+        } catch (statError) {
+          if (statError.code === "ENOENT") continue;
+          throw cliError("E_AUTH_LOCK", "인증 lock 상태를 확인할 수 없습니다.", null, statError);
+        }
+        if (Date.now() - startedAt >= timeoutMs) throw cliError("E_AUTH_BUSY", "다른 Writer CLI 인증 작업이 진행 중입니다. 잠시 후 다시 시도해 주세요.");
+        await delay(100);
+      }
+    }
+    const heartbeatMs = Math.max(100, Math.min(Math.floor(staleMs / 3), 30_000));
+    const heartbeat = setInterval(() => {
+      if (!ownedBy(lockPath, token)) return;
+      try { fsApi.utimesSync(lockPath, new Date(), new Date()); } catch (error) { void error; }
+    }, heartbeatMs);
+    heartbeat.unref?.();
+    try { return await callback(); }
+    finally {
+      clearInterval(heartbeat);
+      releaseOwned(lockPath, token, handle);
+    }
+  }
+
+  return Object.freeze({ lock });
+}
+
+function defaultCommandRunner(command, args, input = "") {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { shell: false, stdio: ["pipe", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", chunk => stdout.push(chunk));
+    child.stderr.on("data", chunk => stderr.push(chunk));
+    child.on("error", reject);
+    child.stdin.on("error", reject);
+    child.on("close", (code, signal) => resolve({ code, signal, stdout: Buffer.concat(stdout).toString("utf8"), stderr: Buffer.concat(stderr).toString("utf8") }));
+    child.stdin.end(input);
+  });
+}
+
+function commandSucceeded(result) {
+  return result?.code === 0 && !result?.signal;
+}
+
+function createKeychainStorage(options = {}) {
+  if ((options.platform || process.platform) !== "darwin") throw cliError("E_KEYCHAIN_UNAVAILABLE", "Writer CLI 인증은 현재 macOS Keychain에서만 지원합니다.");
+  const run = options.run || defaultCommandRunner;
+  const service = String(options.service || KEYCHAIN_SERVICE);
+
+  async function readSecret(account) {
+    const result = await run("/usr/bin/security", ["find-generic-password", "-a", String(account), "-s", service, "-w"]);
+    if (result.code === 44 && !result.signal) return null;
+    if (!commandSucceeded(result)) throw cliError("E_KEYCHAIN_UNAVAILABLE", "macOS Keychain에서 Writer CLI 세션을 읽을 수 없습니다.");
+    return result.stdout.replace(/\r?\n$/, "");
+  }
+
+  async function writeSecret(account, value) {
+    const secret = String(value);
+    if (secret.length > KEYCHAIN_SECRET_LIMIT) throw cliError("E_KEYCHAIN_UNAVAILABLE", "macOS Keychain chunk 크기 제한을 초과했습니다.");
+    const result = await run("/usr/bin/security", ["add-generic-password", "-a", String(account), "-s", service, "-U", "-w"], `${secret}\n${secret}\n`);
+    if (!commandSucceeded(result)) throw cliError("E_KEYCHAIN_UNAVAILABLE", "macOS Keychain에 Writer CLI 세션을 저장할 수 없습니다.");
+  }
+
+  async function deleteSecret(account) {
+    const result = await run("/usr/bin/security", ["delete-generic-password", "-a", String(account), "-s", service]);
+    if (result.signal || ![0, 44].includes(result.code)) throw cliError("E_KEYCHAIN_UNAVAILABLE", "macOS Keychain에서 Writer CLI 세션을 삭제할 수 없습니다.");
+  }
+
+  function parseManifest(value) {
+    const match = KEYCHAIN_MANIFEST_PATTERN.exec(String(value || ""));
+    if (!match) return null;
+    return Object.freeze({ generation: match[1], count: Number(match[2]), hash: match[3] });
+  }
+
+  function chunkAccount(key, generation, index) {
+    return `${String(key)}::${KEYCHAIN_CHUNK_VERSION}::${generation}::${index}`;
+  }
+
+  async function deleteGeneration(key, manifest) {
+    if (!manifest) return;
+    for (let index = 0; index < manifest.count; index += 1) {
+      await deleteSecret(chunkAccount(key, manifest.generation, index));
+    }
+  }
+
+  async function getItem(key) {
+    const stored = await readSecret(key);
+    if (stored === null) return null;
+    const manifest = parseManifest(stored);
+    if (!manifest) return stored;
+    const chunks = [];
+    for (let index = 0; index < manifest.count; index += 1) {
+      const chunk = await readSecret(chunkAccount(key, manifest.generation, index));
+      if (chunk === null) throw cliError("E_KEYCHAIN_UNAVAILABLE", "macOS Keychain의 Writer CLI 세션 chunk가 누락되었습니다.");
+      chunks.push(chunk);
+    }
+    const encoded = chunks.join("");
+    const bytes = Buffer.from(encoded, "base64");
+    if (bytes.toString("base64") !== encoded || crypto.createHash("sha256").update(bytes).digest("hex") !== manifest.hash) {
+      throw cliError("E_KEYCHAIN_UNAVAILABLE", "macOS Keychain의 Writer CLI 세션 무결성을 확인할 수 없습니다.");
+    }
+    return bytes.toString("utf8");
+  }
+
+  async function setItem(key, value) {
+    const previous = parseManifest(await readSecret(key));
+    const bytes = Buffer.from(String(value), "utf8");
+    const encoded = bytes.toString("base64");
+    const chunks = encoded.match(new RegExp(`.{1,${KEYCHAIN_CHUNK_SIZE}}`, "g")) || [""];
+    const generation = crypto.randomBytes(16).toString("hex");
+    const manifest = `${KEYCHAIN_CHUNK_VERSION}|${generation}|${chunks.length}|${crypto.createHash("sha256").update(bytes).digest("hex")}`;
+    const writtenAccounts = [];
+    try {
+      for (let index = 0; index < chunks.length; index += 1) {
+        const account = chunkAccount(key, generation, index);
+        await writeSecret(account, chunks[index]);
+        writtenAccounts.push(account);
+      }
+      await writeSecret(key, manifest);
+    } catch (error) {
+      for (const account of writtenAccounts) {
+        try { await deleteSecret(account); } catch (cleanupError) { void cleanupError; }
+      }
+      throw error;
+    }
+    try { await deleteGeneration(key, previous); } catch (cleanupError) { void cleanupError; }
+  }
+
+  async function removeItem(key) {
+    const stored = await readSecret(key);
+    const manifest = parseManifest(stored);
+    try { await deleteGeneration(key, manifest); }
+    finally { await deleteSecret(key); }
+  }
+
+  return Object.freeze({ isServer: true, getItem, setItem, removeItem });
+}
+
+function canonicalBase64(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(normalized)) {
+    throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", `${label} 응답 형식이 올바르지 않습니다.`);
+  }
+  const bytes = Buffer.from(normalized, "base64");
+  if (bytes.toString("base64") !== normalized) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", `${label} 응답 무결성을 확인할 수 없습니다.`);
+  return bytes;
+}
+
+function createWindowsDpapiStorage(options = {}) {
+  if ((options.platform || process.platform) !== "win32") {
+    throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows DPAPI credential store는 Windows에서만 사용할 수 있습니다.");
+  }
+  const fsApi = options.fs || fs;
+  const run = options.run || defaultCommandRunner;
+  const environment = options.environment || process.env;
+  const homeDirectory = options.homeDirectory || os.homedir();
+  const localAppData = options.localAppData || environment.LOCALAPPDATA || path.join(homeDirectory, "AppData", "Local");
+  const directory = path.resolve(String(options.directory || path.join(localAppData, "SSOBIG", "WriterCLI", "credentials")));
+  const entropy = String(options.entropy || KEYCHAIN_SERVICE);
+  const powershell = String(options.powershell || "powershell.exe");
+  const encodedScript = Buffer.from(DPAPI_SCRIPT, "utf16le").toString("base64");
+
+  function ensureDirectory() {
+    try {
+      const existing = fsApi.lstatSync(directory);
+      if (existing.isSymbolicLink() || !existing.isDirectory()) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows credential store 경로가 안전한 directory가 아닙니다.");
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+      fsApi.mkdirSync(directory, { recursive: true });
+    }
+    const verified = fsApi.lstatSync(directory);
+    if (verified.isSymbolicLink() || !verified.isDirectory()) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows credential store 경로가 안전한 directory가 아닙니다.");
+    return directory;
+  }
+
+  function itemPath(key) {
+    return path.join(directory, `${crypto.createHash("sha256").update(String(key)).digest("hex")}.dpapi`);
+  }
+
+  async function transform(operation, bytes, context = "probe") {
+    const input = Buffer.from(bytes);
+    if (input.length > DPAPI_MAX_SECRET_BYTES) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows credential store 값이 허용 크기를 초과했습니다.");
+    let result;
+    try {
+      result = await run(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encodedScript], JSON.stringify({
+        operation,
+        data: input.toString("base64"),
+        entropy: `${entropy}:${String(context)}`
+      }));
+    } catch (error) {
+      throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows DPAPI를 실행할 수 없습니다.", null, error);
+    }
+    if (!commandSucceeded(result)) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows DPAPI가 credential 값을 처리하지 못했습니다.");
+    return canonicalBase64(result.stdout, "Windows DPAPI");
+  }
+
+  async function getItem(key) {
+    const target = itemPath(key);
+    let envelope;
+    try {
+      const stat = fsApi.lstatSync(target);
+      if (stat.isSymbolicLink() || !stat.isFile()) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows credential 파일이 안전한 일반 파일이 아닙니다.");
+      envelope = String(fsApi.readFileSync(target, "utf8"));
+    } catch (error) {
+      if (error?.code === "ENOENT") return null;
+      throw error;
+    }
+    const prefix = `${DPAPI_STORAGE_VERSION}:`;
+    if (!envelope.startsWith(prefix)) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows credential 파일 형식이 올바르지 않습니다.");
+    const encrypted = canonicalBase64(envelope.slice(prefix.length), "Windows credential");
+    const clear = await transform("unprotect", encrypted, key);
+    return clear.toString("utf8");
+  }
+
+  async function setItem(key, value) {
+    ensureDirectory();
+    const target = itemPath(key);
+    try {
+      if (fsApi.lstatSync(target).isSymbolicLink()) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows credential 파일은 symbolic link일 수 없습니다.");
+    } catch (error) { if (error?.code !== "ENOENT") throw error; }
+    const encrypted = await transform("protect", Buffer.from(String(value), "utf8"), key);
+    const temporary = path.join(directory, `.${path.basename(target)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+    let descriptor = null;
+    try {
+      descriptor = fsApi.openSync(temporary, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
+      fsApi.writeFileSync(descriptor, `${DPAPI_STORAGE_VERSION}:${encrypted.toString("base64")}`);
+      fsApi.fsyncSync(descriptor);
+      fsApi.closeSync(descriptor);
+      descriptor = null;
+      fsApi.renameSync(temporary, target);
+    } finally {
+      if (descriptor !== null) try { fsApi.closeSync(descriptor); } catch (error) { void error; }
+      try { fsApi.unlinkSync(temporary); } catch (error) { if (error?.code !== "ENOENT") throw error; }
+    }
+  }
+
+  async function removeItem(key) {
+    const target = itemPath(key);
+    try {
+      const stat = fsApi.lstatSync(target);
+      if (stat.isSymbolicLink() || !stat.isFile()) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows credential 파일이 안전한 일반 파일이 아닙니다.");
+      fsApi.unlinkSync(target);
+    } catch (error) { if (error?.code !== "ENOENT") throw error; }
+  }
+
+  async function probe() {
+    const clear = Buffer.from("ssobig-writer-dpapi-probe", "utf8");
+    const encrypted = await transform("protect", clear, "probe");
+    const decrypted = await transform("unprotect", encrypted, "probe");
+    if (!decrypted.equals(clear)) throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", "Windows DPAPI round-trip 검증에 실패했습니다.");
+    return true;
+  }
+
+  return Object.freeze({ isServer: true, kind: "windows-dpapi", directory, getItem, setItem, removeItem, probe });
+}
+
+function createCredentialStorage(options = {}) {
+  const platform = String(options.platform || process.platform);
+  if (platform === "darwin") return createKeychainStorage(options);
+  if (platform === "win32") return createWindowsDpapiStorage(options);
+  throw cliError("E_CREDENTIAL_STORE_UNAVAILABLE", `현재 플랫폼 ${platform}에는 지원되는 Writer CLI credential store가 없습니다.`);
+}
+
+function defaultCreateClient(url, key, options) {
+  let createClient;
+  try { ({ createClient } = require("@supabase/supabase-js")); }
+  catch (error) {
+    throw cliError("E_DEPENDENCY_MISSING", "먼저 tools/writer-cli에서 npm ci --ignore-scripts를 실행해 주세요.", null, error);
+  }
+  return createClient(url, key, options);
+}
+
+function defaultOpenBrowser(url, options = {}) {
+  const platform = String(options.platform || process.platform);
+  const spawnProcess = options.spawn || spawn;
+  const invocation = platform === "darwin" ? ["/usr/bin/open", [url]]
+    : platform === "win32" ? ["explorer.exe", [url]]
+      : platform === "linux" ? ["xdg-open", [url]] : null;
+  if (!invocation) return Promise.reject(cliError("E_BROWSER_OPEN", `현재 플랫폼 ${platform}에서 브라우저를 자동으로 열 수 없습니다.`));
+  return new Promise((resolve, reject) => {
+    const child = spawnProcess(invocation[0], invocation[1], { shell: false, detached: true, stdio: "ignore" });
+    child.on("error", reject);
+    child.on("spawn", () => { child.unref(); resolve(); });
+  });
+}
+
+function createAuthManager(config, options = {}) {
+  const storage = options.storage || createCredentialStorage({ ...(options.credential || options.keychain || {}), platform: options.platform });
+  const authLock = options.authLock || createFileLock({ ...(options.lock || {}), platform: options.platform });
+  const createClient = options.createClient || defaultCreateClient;
+  const openBrowser = options.openBrowser || (url => defaultOpenBrowser(url, { platform: options.platform }));
+  const httpApi = options.http || http;
+  const loginTimeoutMs = Number(options.loginTimeoutMs || 180_000);
+  const persistent = options.persistent === true;
+  const staffVerificationMs = Math.max(0, Number(options.staffVerificationMs ?? 300_000));
+  const now = options.now || Date.now;
+  let persistentClient = null;
+  let verifiedUser = null;
+  let verifiedAt = 0;
+  let verificationPromise = null;
+
+  function client() {
+    if (persistent && persistentClient) return persistentClient;
+    const created = createClient(config.supabaseUrl, config.supabaseKey, {
+      auth: {
+        flowType: "pkce",
+        persistSession: true,
+        storageKey: AUTH_STORAGE_KEY,
+        storage,
+        autoRefreshToken: persistent,
+        detectSessionInUrl: false,
+        debug: false,
+        lock: authLock.lock
+      }
+    });
+    if (persistent) {
+      persistentClient = created;
+    }
+    return created;
+  }
+
+  async function assertWriterAccount(authClient) {
+    const { data: userData, error: userError } = await authClient.auth.getUser();
+    if (userError || !userData?.user) throw cliError("E_AUTH_REQUIRED", "Google 계정으로 Writer CLI에 로그인해 주세요.", null, userError);
+    const email = String(userData.user.email || "").trim().toLowerCase();
+    if (!email) throw cliError("E_AUTHORIZATION", "이메일이 확인된 Google 계정이 필요합니다.");
+    const { data, error } = await authClient.rpc("ensure_somi_writer_account");
+    const account = Array.isArray(data) ? data[0] : data;
+    if (error || !account?.user_id) throw cliError("E_AUTHORIZATION", "Writer 회원정보와 접근권한을 확인할 수 없습니다.", null, error);
+    if (String(account.user_id) !== String(userData.user.id || "")
+      || String(account.email || "").trim().toLowerCase() !== email) {
+      throw cliError("E_AUTHORIZATION", "Writer 회원정보가 현재 Google 로그인과 일치하지 않습니다.");
+    }
+    return Object.freeze({
+      id: String(account.user_id),
+      email: String(account.email || email),
+      displayName: String(account.display_name || email.split("@")[0]),
+      isAdmin: account.is_admin === true,
+      activeOwnedCount: Number(account.active_owned_count || 0),
+      activeOwnedLimit: account.active_owned_limit === null ? null : Number(account.active_owned_limit)
+    });
+  }
+
+  async function withSession(callback) {
+    const authClient = client();
+    const currentTime = Number(now());
+    if (!verifiedUser || currentTime - verifiedAt >= staffVerificationMs) {
+      verificationPromise ||= assertWriterAccount(authClient).then(user => {
+        verifiedUser = user;
+        verifiedAt = Number(now());
+        return user;
+      }).finally(() => { verificationPromise = null; });
+      await verificationPromise;
+    }
+    const user = verifiedUser;
+    try { return await callback({ client: authClient, user }); }
+    catch (error) {
+      if (["E_AUTH_REQUIRED", "E_AUTHORIZATION", "42501"].includes(String(error?.code || "")) || [401, 403].includes(Number(error?.status))) {
+        verifiedUser = null;
+        verifiedAt = 0;
+      }
+      throw error;
+    }
+  }
+
+  async function login(loginOptions = {}) {
+    return authLock.lock("ssobig-writer-cli-login", 10_000, async () => {
+      const authClient = client();
+      let handled = false;
+      let completed = false;
+      let arrivalTimeout = null;
+      let callbackResolve;
+      let callbackReject;
+      let expectedHost = "";
+      const callback = new Promise((resolve, reject) => { callbackResolve = resolve; callbackReject = reject; });
+      callback.catch(() => {});
+      function closeCallbackServer({ force = false } = {}) {
+        server.close();
+        if (force) server.closeAllConnections?.();
+      }
+      const server = httpApi.createServer(async (request, response) => {
+        let requestUrl;
+        try { requestUrl = new URL(request.url, `http://${expectedHost}`); }
+        catch (error) { response.writeHead(400).end("Invalid callback"); return; }
+        if (completed || !expectedHost || request.headers.host !== expectedHost || requestUrl.pathname !== "/auth/callback" || handled) {
+          response.writeHead(404, { "Cache-Control": "no-store" }).end("Not found");
+          return;
+        }
+        handled = true;
+        if (arrivalTimeout) clearTimeout(arrivalTimeout);
+        let exchangeSucceeded = false;
+        try {
+          const oauthError = requestUrl.searchParams.get("error_description") || requestUrl.searchParams.get("error");
+          if (oauthError) throw cliError("E_AUTH_REQUIRED", `Google 로그인에 실패했습니다: ${oauthError}`);
+          const code = requestUrl.searchParams.get("code");
+          if (!code) throw cliError("E_AUTH_REQUIRED", "OAuth callback에 인증 code가 없습니다.");
+          const { error } = await authClient.auth.exchangeCodeForSession(code);
+          if (error) throw error;
+          exchangeSucceeded = true;
+          const user = await assertWriterAccount(authClient);
+          response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+          response.end("<!doctype html><meta charset=\"utf-8\"><title>SSOBIG WRITER CLI</title><p>로그인이 완료되었습니다. 이 창을 닫아도 됩니다.</p>");
+          completed = true;
+          callbackResolve(user);
+        } catch (error) {
+          try {
+            if (exchangeSucceeded) await authClient.auth.signOut({ scope: "local" });
+            else await storage.removeItem(`${AUTH_STORAGE_KEY}-code-verifier`);
+          } catch (cleanupError) { void cleanupError; }
+          response.writeHead(400, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+          response.end("Writer CLI 로그인을 완료하지 못했습니다. 터미널의 오류를 확인해 주세요.");
+          completed = true;
+          callbackReject(error);
+        } finally {
+          closeCallbackServer();
+        }
+      });
+
+      await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+          expectedHost = `127.0.0.1:${server.address().port}`;
+          resolve();
+        });
+      });
+      arrivalTimeout = setTimeout(() => {
+        if (completed) return;
+        completed = true;
+        closeCallbackServer({ force: true });
+        callbackReject(cliError("E_AUTH_TIMEOUT", "Writer CLI 로그인이 시간 안에 완료되지 않았습니다."));
+      }, loginTimeoutMs);
+      try {
+        const port = server.address().port;
+        const redirectTo = `http://127.0.0.1:${port}/auth/callback`;
+        const { data, error } = await authClient.auth.signInWithOAuth({
+          provider: "google",
+          options: {
+            redirectTo,
+            skipBrowserRedirect: true,
+            queryParams: { prompt: "select_account" }
+          }
+        });
+        if (error || !data?.url) throw cliError("E_AUTH_REQUIRED", "Google 로그인 URL을 만들 수 없습니다.", null, error);
+        if (typeof loginOptions.onUrl === "function") loginOptions.onUrl(data.url);
+        if (loginOptions.openBrowser !== false) await openBrowser(data.url);
+        return await callback;
+      } catch (error) {
+        closeCallbackServer({ force: !completed });
+        try { await storage.removeItem(`${AUTH_STORAGE_KEY}-code-verifier`); } catch (cleanupError) { void cleanupError; }
+        throw error;
+      } finally {
+        if (arrivalTimeout) clearTimeout(arrivalTimeout);
+      }
+    });
+  }
+
+  async function whoami() {
+    return withSession(async ({ user }) => user);
+  }
+
+  async function logout() {
+    const authClient = client();
+    let signOutError = null;
+    try {
+      const result = await authClient.auth.signOut({ scope: "local" });
+      signOutError = result.error || null;
+    } catch (error) {
+      signOutError = error;
+    }
+    await storage.removeItem(AUTH_STORAGE_KEY);
+    await storage.removeItem(`${AUTH_STORAGE_KEY}-code-verifier`);
+    if (persistentClient?.auth?.stopAutoRefresh) persistentClient.auth.stopAutoRefresh();
+    persistentClient = null;
+    verifiedUser = null;
+    verifiedAt = 0;
+    return { loggedOut: true, remoteSignOutWarning: Boolean(signOutError) };
+  }
+
+  async function dispose() {
+    const authClient = persistentClient;
+    persistentClient = null;
+    verifiedUser = null;
+    verifiedAt = 0;
+    verificationPromise = null;
+    if (authClient?.auth?.stopAutoRefresh) authClient.auth.stopAutoRefresh();
+  }
+
+  return Object.freeze({ login, logout, whoami, withSession, dispose, storage });
+}
+
+async function inspectStoredSession(storage, options = {}) {
+  const stored = await storage.getItem(AUTH_STORAGE_KEY);
+  if (stored === null || stored === undefined || stored === "") return Object.freeze({ status: "missing" });
+  let session;
+  try { session = JSON.parse(String(stored)); }
+  catch (error) { return Object.freeze({ status: "malformed" }); }
+  if (!session || typeof session !== "object" || typeof session.access_token !== "string" || !session.access_token) {
+    return Object.freeze({ status: "malformed" });
+  }
+  const expiresAt = Number(session.expires_at || 0);
+  const nowSeconds = Math.floor(Number(typeof options.now === "function" ? options.now() : Date.now()) / 1000);
+  if (Number.isFinite(expiresAt) && expiresAt > 0 && expiresAt <= nowSeconds) return Object.freeze({ status: "expired" });
+  return Object.freeze({ status: "active" });
+}
+
+module.exports = Object.freeze({
+  KEYCHAIN_SERVICE,
+  AUTH_STORAGE_KEY,
+  DPAPI_STORAGE_VERSION,
+  createFileLock,
+  createKeychainStorage,
+  createWindowsDpapiStorage,
+  createCredentialStorage,
+  createAuthManager,
+  inspectStoredSession,
+  defaultCommandRunner,
+  commandSucceeded,
+  defaultOpenBrowser
+});