democut 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 InfoGrab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,169 @@
+# democut
+
+DemoCut(democut) 에이전트 인증 CLI — OAuth2 **Device Flow**(RFC 8628). Higgsfield 의
+`auth login` 과 같은 방식으로, 에이전트가 한 번 로그인하면 워크스페이스 스코프 토큰을 받아
+이후 호출에 Bearer 가 자동으로 붙는다.
+
+## 설치
+
+```bash
+npm install -g democut      # 또는: npx democut auth login
+```
+
+## 사용
+
+```bash
+democut auth login      # device flow 로 로그인 → 토큰 저장
+democut auth status     # 현재 정체/워크스페이스/티어
+democut auth logout
+
+# 헤드리스(서버/CI/에이전트): 브라우저 안 열고 코드+URL 만 출력
+democut auth login --no-browser
+# 기계 판독(래퍼가 코드를 Slack 등에 게시):
+democut auth login --json
+```
+
+`--base-url <url>` 또는 `DEMOCUT_BASE_URL` 로 서버를 지정한다(기본: prod).
+
+## 동작
+
+1. `auth login` 이 서버에 device authorization 요청 → `user_code` + 승인 URL 수신.
+2. 데스크톱이면 브라우저 자동 오픈, 헤드리스면 코드+URL 출력 → **사람이 브라우저에서
+   로그인하고 워크스페이스(조직)를 선택해 승인**.
+3. CLI 가 토큰 엔드포인트를 폴링 → 승인되면 `access`/`refresh` 토큰을 `~/.democut/credentials.json`
+   (권한 600)에 저장.
+4. 이후 `access`(1h)는 만료 시 `refresh`(장수명)로 자동 갱신.
+
+토큰은 **승인한 사람의 워크스페이스와 플랜(tier/role)** 으로 스코프된다 — 워크스페이스마다
+각자의 에이전트를 붙일 수 있는 멀티테넌트 구조.
+
+## 영상 생성
+
+```bash
+democut video estimate [--duration <초>] [--resolution <해상도>]
+democut video generate "<프롬프트>" [--yes] [--wait] [--output <경로>]
+democut video status <job_id> [--wait] [--output <경로>]
+```
+
+### 사용 흐름
+
+1. **비용 확인**: `democut video estimate` 로 제출 없이 예상 비용만 본다.
+   ```bash
+   democut video estimate --duration 10 --resolution 1080p
+   # 출력: 예상 비용: $2.21  (514,080 tokens · dreamina-seedance-2-0-260128)
+   ```
+
+2. **영상 생성**: `democut video generate` 로 제출. **비용 승인이 필요하다.**
+   - **대화형 환경** (데스크톱·터미널): 확인 프롬프트가 뜬다.
+   - **비대화형** (서버·CI·에이전트): `--yes` 플래그가 필수 — 없으면 거부.
+   ```bash
+   # 대화형 (확인 프롬프트 있음)
+   democut video generate "고양이가 춤춘다"
+   # 예상 비용: $0.49  (113,400 tokens · dreamina-seedance-2-0-260128)
+   # $0.49 가 청구됩니다. 생성할까요? [y/N]
+
+   # 비대화형 (MCP/에이전트)
+   democut video generate "고양이가 춤춘다" --yes
+   ```
+
+3. **완료 대기 & 다운로드**:
+   ```bash
+   # 상태 조회만
+   democut video status <job_id>
+
+   # 완료까지 기다리고 저장 (24시간 만료 URL)
+   democut video status <job_id> --wait --output video.mp4
+   ```
+
+### 주의사항
+
+- **생성이 성공하면 과금된다** — 서버는 성공을 처음 관측한 시점에 원장에 기록한다(폴링을 반복해도 한 번).
+  실패한 생성은 원장에 남지 않지만, 제출이 업스트림에 접수된 뒤의 재시도는 별개 생성이라 다시 과금된다.
+- **산출물 URL 은 24시간 후 만료된다** — `--output` 으로 즉시 받아두지 않으면 재생성해야 한다(재과금).
+- **CLI 는 제출을 자동 재시도하지 않는다** — BytePlus 가 멱등키(Idempotency-Key)를 지원하지 않아 재시도가 곧 재과금이다.
+  실패해 보여도 먼저 `democut video status <job_id>` 로 확인할 것.
+- **`--wait` 시한 초과는 실패가 아니다** — 작업은 서버에서 계속 진행된다(종료 코드 5). 새로 제출하지 말고 `status` 로 확인한다.
+
+### 종료 코드
+
+| 코드 | 뜻 | 대응 |
+|---|---|---|
+| 0 | 성공 | — |
+| 1 | 일반 오류 | 미로그인·사용자 취소·생성 실패·알 수 없음 |
+| 2 | 파라미터 오류 (재시도 가능) | 해상도/길이 잘못 됨·예산 초과·`--yes` 누락. **과금 없음.** |
+| 3 | 일시적 업스트림 오류 | **그대로 재시도해도 안전하다.** |
+| 4 | 업스트림 거부 (결정적) | **재시도하면 재과금될 수 있다 — 이 코드가 뜨면 상태 조회 후 사람에게 문의.** |
+| 5 | `--wait` 시한 초과 | **실패가 아니다.** 작업은 계속 진행 중 — `status <job_id>` 로 확인. 재제출 금지. |
+
+### 옵션
+
+| 옵션 | 설명 |
+|---|---|
+| `--duration <초>` | 모델별 허용 범위(2.0 계열 4~15, 2.5 계열 4~30). 기본 5초 |
+| `--resolution <r>` | 480p / 720p(기본) / 1080p / 4k |
+| `--ratio <비율>` | 16:9(기본) / 9:16 / 1:1 / 4:3 / 21:9 / adaptive |
+| `--yes` / `-y` | 비대화형에서 필수. 비용 확인 프롬프트 스킵 |
+| `--wait` | 완료까지 대기. `--timeout <초>` 로 조정 (기본 900초 = 15분) |
+| `-o`, `--output <경로>` | 생성된 mp4 저장. 서명 URL 이 24시간 후 만료되므로 사실상 필수 |
+| `--json` | 기계 판독용 JSON 한 줄 |
+| `--base-url <url>` | 서버 지정 (기본: prod) |
+
+## 개발
+
+```bash
+npm install
+npm run typecheck
+npm test
+npm run build      # dist/cli.js (bin: democut) 번들
+```
+
+## 게시 (npm publish)
+
+**아직 게시되지 않았다** — `npm install -g democut` 은 현재 404 다.
+게시는 사람이 한다(에이전트 범위 밖).
+
+> ⚠️ **게시가 문서 승격보다 먼저다.** `democut` 은 **무스코프**라 우리가 게시하기 전까지
+> **누구나 그 이름으로 올릴 수 있다**(스코프 패키지와 달리 네임스페이스 보호가 없다).
+> `/docs/agents` 의 복사 버튼과 `/updates` 공지가 먼저 나가면, 그 사이 제3자가 악성
+> `democut` 을 선점해 사용자가 그것을 설치하는 창이 열린다 —
+> `democut auth login` 이 워크스페이스 토큰을 다루므로 토큰 탈취로 이어질 수 있다
+> (CWE-829, faceta 리뷰 2026-08-21).
+>
+> 따라서 **머지 → npm publish → 승격(promote)** 순서를 지킨다. 승격 전에 확인:
+> ```bash
+> curl -s -o /dev/null -w '%{http_code}\n' https://registry.npmjs.org/democut   # 200 이어야 한다
+> ```
+
+순서:
+
+1. **서버 라우터가 프로덕션에 있어야 한다.** `democut video` 는 `/api/videogen` 을 호출하고
+   기본 base URL 이 프로덕션(`https://democut.ai`)이다. 그 라우터가 없으면 게시해도 모든
+   video 커맨드가 404 다. 확인:
+   ```bash
+   curl -s -o /dev/null -w '%{http_code}\n' -X POST https://democut.ai/api/videogen/estimate
+   # 401 이면 배포됨(인증 필요) · 404 면 미승격
+   ```
+2. **org 는 필요 없다.** 이 패키지는 **무스코프**(`democut`)라 개인 계정으로 바로 게시되고,
+   무스코프는 기본이 public 이라 `--access public` 도 필요 없다.
+
+   > `@democut` **스코프**는 쓸 수 없다 — 그 이름은 이미 npm 계정 하나가 점유하고 있고
+   > (username 과 org 는 같은 네임스페이스다) 그래서 `democut` org 를 만들 수 없다.
+   > **패키지 이름은 그와 별개 네임스페이스**라 무스코프 `democut` 은 그대로 쓸 수 있다.
+   > 향후 `@democut/mcp` 같은 스코프 패키지가 필요해지면 그 계정을 되찾아야 한다
+   > (이메일을 못 받는 미인증 계정이면 로그인 후 계정 설정에서 이메일을 교체하거나,
+   > 비밀번호를 모르면 npm Support 로 문의).
+
+3. `npm login` 후:
+   ```bash
+   cd cli
+   npm run build          # prepublishOnly 가 자동으로도 돌지만 먼저 확인
+   npm publish            # 무스코프는 기본 public — --access 불필요
+   ```
+
+> **토큰을 코드나 대화에 넣지 않는다.** `npm login` 은 브라우저 인증이고 토큰은 `~/.npmrc`
+> 에만 남는다. CI 에서 자동 게시가 필요해지면 npm **Automation token**(publish 전용,
+> 이 패키지로 스코프 제한)을 발급해 **GitLab CI/CD 변수**(masked + protected)에 두고
+> `NODE_AUTH_TOKEN` 으로 주입한다 — 이 레포가 배포 시크릿에 쓰는 방식과 같다.
+
+게시되는 것은 `files` 에 적힌 **`dist/` 뿐**이다(소스·테스트는 포함되지 않는다).
+`npm pack --dry-run` 으로 목록을 먼저 확인할 수 있다.

package/dist/cli.js

@@ -0,0 +1,916 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { realpathSync } from "fs";
+import { fileURLToPath } from "url";
+
+// src/device-flow.ts
+var DeviceFlowError = class extends Error {
+  constructor(code, message) {
+    super(message ?? code);
+    this.code = code;
+    this.name = "DeviceFlowError";
+  }
+  code;
+};
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var SLOW_DOWN_INCREMENT_MS = 5e3;
+async function postJson(url, body, fetchImpl) {
+  const res = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const text = await res.text();
+  let json = {};
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+      json = {};
+    }
+  }
+  return { ok: res.ok, status: res.status, json };
+}
+function oauthError(json) {
+  const detail = json?.detail;
+  if (detail && typeof detail === "object" && typeof detail.error === "string") {
+    return detail.error;
+  }
+  return "invalid_grant";
+}
+async function requestDeviceAuthorization(baseUrl, fetchImpl = fetch) {
+  const { ok, status: status2, json } = await postJson(
+    `${baseUrl}/api/oauth/device/authorize`,
+    {},
+    fetchImpl
+  );
+  if (!ok) {
+    if (status2 === 503) {
+      throw new DeviceFlowError(
+        "disabled",
+        "\uC11C\uBC84\uC5D0\uC11C device flow \uAC00 \uBE44\uD65C\uC131\uD654\uB418\uC5B4 \uC788\uC2B5\uB2C8\uB2E4 (DEMOCUT_DEVICE_TOKEN_SECRET \uBBF8\uC124\uC815)."
+      );
+    }
+    throw new DeviceFlowError("authorize_failed", `device authorize \uC2E4\uD328 (HTTP ${status2}).`);
+  }
+  return json;
+}
+async function pollTokenOnce(baseUrl, deviceCode, fetchImpl = fetch) {
+  const { ok, json } = await postJson(
+    `${baseUrl}/api/oauth/token`,
+    { grant_type: DEVICE_GRANT, device_code: deviceCode },
+    fetchImpl
+  );
+  if (ok) return { status: "approved", tokens: json };
+  const err3 = oauthError(json);
+  if (err3 === "authorization_pending") return { status: "pending" };
+  if (err3 === "slow_down") return { status: "slow_down" };
+  throw new DeviceFlowError(err3, describeError(err3));
+}
+async function refreshToken(baseUrl, refresh, fetchImpl = fetch) {
+  const { ok, json } = await postJson(
+    `${baseUrl}/api/oauth/token`,
+    { grant_type: "refresh_token", refresh_token: refresh },
+    fetchImpl
+  );
+  if (!ok) throw new DeviceFlowError(oauthError(json), "\uD1A0\uD070 \uAC31\uC2E0\uC5D0 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4(\uC7AC\uB85C\uADF8\uC778 \uD544\uC694).");
+  return json;
+}
+async function pollUntilApproved(baseUrl, auth, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Math.floor(Date.now() / 1e3));
+  let intervalMs = Math.max(1, auth.interval) * 1e3;
+  const deadline = now() + auth.expires_in;
+  while (now() < deadline) {
+    await sleep(intervalMs);
+    const out3 = await pollTokenOnce(baseUrl, auth.device_code, fetchImpl);
+    if (out3.status === "approved") return out3.tokens;
+    if (out3.status === "slow_down") intervalMs += SLOW_DOWN_INCREMENT_MS;
+    deps.onPending?.();
+  }
+  throw new DeviceFlowError("expired_token", describeError("expired_token"));
+}
+function describeError(code) {
+  switch (code) {
+    case "expired_token":
+      return "\uAE30\uAE30 \uCF54\uB4DC\uAC00 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4. democut auth login \uC744 \uB2E4\uC2DC \uC2E4\uD589\uD558\uC138\uC694.";
+    case "access_denied":
+      return "\uC2B9\uC778\uC774 \uAC70\uBD80\uB418\uC5C8\uC2B5\uB2C8\uB2E4.";
+    case "invalid_grant":
+      return "\uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 \uCF54\uB4DC\uC785\uB2C8\uB2E4.";
+    default:
+      return code;
+  }
+}
+
+// src/token-store.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { randomBytes } from "crypto";
+
+// src/config.ts
+import { homedir } from "os";
+import { join } from "path";
+var DEFAULT_BASE_URL = "https://democut.ai";
+function resolveBaseUrl(override) {
+  const raw = (override || process.env.DEMOCUT_BASE_URL || DEFAULT_BASE_URL).trim();
+  return raw.replace(/\/+$/, "");
+}
+function configDir() {
+  const xdg = process.env.XDG_CONFIG_HOME?.trim();
+  return xdg ? join(xdg, "democut") : join(homedir(), ".democut");
+}
+function credentialsPath() {
+  return join(configDir(), "credentials.json");
+}
+
+// src/token-store.ts
+function paths(p) {
+  return { dir: p?.dir ?? configDir(), path: p?.path ?? credentialsPath() };
+}
+function readStore(path) {
+  if (!existsSync(path)) return {};
+  try {
+    const data = JSON.parse(readFileSync(path, "utf8"));
+    return data && typeof data === "object" ? data : {};
+  } catch {
+    return {};
+  }
+}
+function writeStore(store, dir, path) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmp = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(store, null, 2)}
+`, { flag: "wx", mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync(tmp, path);
+}
+function loadCredentials(baseUrl, p) {
+  return readStore(paths(p).path)[baseUrl] ?? null;
+}
+function saveCredentials(creds, p) {
+  const { dir, path } = paths(p);
+  const store = readStore(path);
+  store[creds.base_url] = creds;
+  writeStore(store, dir, path);
+}
+function clearCredentials(baseUrl, p) {
+  const { dir, path } = paths(p);
+  const store = readStore(path);
+  if (!(baseUrl in store)) return;
+  delete store[baseUrl];
+  if (Object.keys(store).length === 0) {
+    if (existsSync(path)) rmSync(path);
+  } else {
+    writeStore(store, dir, path);
+  }
+}
+
+// src/auth.ts
+var EXPIRY_SKEW_S = 60;
+var NotLoggedInError = class extends Error {
+};
+async function getValidAccessToken(baseUrl, deps = {}) {
+  const now = deps.now ?? (() => Math.floor(Date.now() / 1e3));
+  const creds = loadCredentials(baseUrl, deps.paths);
+  if (!creds) {
+    throw new NotLoggedInError(
+      `\uB85C\uADF8\uC778\uC774 \uD544\uC694\uD569\uB2C8\uB2E4 (${baseUrl}). 'democut auth login' \uC744 \uC2E4\uD589\uD558\uC138\uC694.`
+    );
+  }
+  if (creds.expires_at - EXPIRY_SKEW_S > now()) {
+    return creds.access_token;
+  }
+  const t = await refreshToken(baseUrl, creds.refresh_token, deps.fetchImpl);
+  const updated = {
+    base_url: baseUrl,
+    access_token: t.access_token,
+    refresh_token: t.refresh_token || creds.refresh_token,
+    workspace_id: creds.workspace_id,
+    expires_at: now() + t.expires_in
+  };
+  saveCredentials(updated, deps.paths);
+  return updated.access_token;
+}
+async function whoami(baseUrl, accessToken, fetchImpl = fetch) {
+  const res = await fetchImpl(`${baseUrl}/api/auth/whoami`, {
+    headers: { Authorization: `Bearer ${accessToken}` }
+  });
+  if (!res.ok) throw new Error(`whoami \uC2E4\uD328 (HTTP ${res.status}).`);
+  return await res.json();
+}
+
+// src/open-browser.ts
+import { spawn } from "child_process";
+function isHeadless() {
+  if (!process.stdout.isTTY) return true;
+  if (process.platform === "linux" && !process.env.DISPLAY) return true;
+  return false;
+}
+function openBrowser(url) {
+  try {
+    if (process.platform === "darwin") {
+      spawn("open", [url], { stdio: "ignore", detached: true }).unref();
+    } else if (process.platform === "win32") {
+      spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
+    } else {
+      spawn("xdg-open", [url], { stdio: "ignore", detached: true }).unref();
+    }
+  } catch {
+  }
+}
+
+// src/commands/auth.ts
+var out = (s) => process.stdout.write(`${s}
+`);
+var err = (s) => process.stderr.write(`${s}
+`);
+async function loginCommand(opts) {
+  const base = resolveBaseUrl(opts.baseUrl);
+  const auth = await requestDeviceAuthorization(base);
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        user_code: auth.user_code,
+        verification_uri: auth.verification_uri,
+        verification_uri_complete: auth.verification_uri_complete,
+        expires_in: auth.expires_in
+      })
+    );
+  } else {
+    out("");
+    out("  \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC544\uB798 \uC8FC\uC18C\uB97C \uC5F4\uACE0 \uCF54\uB4DC\uB97C \uC785\uB825\uD574 \uC2B9\uC778\uD558\uC138\uC694:");
+    out("");
+    out(`    URL : ${auth.verification_uri}`);
+    out(`    \uCF54\uB4DC: ${auth.user_code}`);
+    out("");
+    if (!opts.noBrowser && !isHeadless()) {
+      out("  (\uBE0C\uB77C\uC6B0\uC800\uB97C \uC790\uB3D9\uC73C\uB85C \uC5FD\uB2C8\uB2E4\u2026)");
+      openBrowser(auth.verification_uri_complete);
+    }
+    process.stderr.write("  \uC2B9\uC778 \uB300\uAE30 \uC911");
+  }
+  const tokens = await pollUntilApproved(base, auth, {
+    onPending: () => {
+      if (!opts.json) process.stderr.write(".");
+    }
+  });
+  const expiresAt = Math.floor(Date.now() / 1e3) + tokens.expires_in;
+  let workspaceId = null;
+  try {
+    workspaceId = (await whoami(base, tokens.access_token)).workspace_id;
+  } catch {
+  }
+  saveCredentials({
+    base_url: base,
+    access_token: tokens.access_token,
+    refresh_token: tokens.refresh_token,
+    workspace_id: workspaceId,
+    expires_at: expiresAt
+  });
+  if (opts.json) {
+    out(JSON.stringify({ status: "approved", workspace_id: workspaceId }));
+  } else {
+    err("");
+    out("");
+    out(`\u2713 \uB85C\uADF8\uC778\uB428${workspaceId ? ` (\uC6CC\uD06C\uC2A4\uD398\uC774\uC2A4: ${workspaceId})` : ""}. \uC790\uACA9\uC99D\uBA85\uC744 \uC800\uC7A5\uD588\uC2B5\uB2C8\uB2E4.`);
+  }
+  return 0;
+}
+async function statusCommand(opts) {
+  const base = resolveBaseUrl(opts.baseUrl);
+  if (!loadCredentials(base)) {
+    out(`\uB85C\uADF8\uC544\uC6C3 \uC0C1\uD0DC\uC785\uB2C8\uB2E4 (${base}). 'democut auth login' \uC73C\uB85C \uB85C\uADF8\uC778\uD558\uC138\uC694.`);
+    return 1;
+  }
+  try {
+    const token = await getValidAccessToken(base);
+    const me = await whoami(base, token);
+    if (opts.json) {
+      out(JSON.stringify({ logged_in: true, base_url: base, ...me }));
+    } else {
+      out(`\uB85C\uADF8\uC778\uB428 (${base})`);
+      out(`  \uC6CC\uD06C\uC2A4\uD398\uC774\uC2A4: ${me.workspace_id ?? "-"}`);
+      out(`  \uC815\uCCB4: ${me.kind}   \uC5ED\uD560: ${me.role ?? "-"}   \uD2F0\uC5B4: ${me.tier ?? "-"}`);
+    }
+    return 0;
+  } catch (e) {
+    const msg = e instanceof NotLoggedInError ? e.message : `\uC790\uACA9\uC99D\uBA85 \uB9CC\uB8CC/\uBB34\uD6A8: ${e.message}`;
+    out(`${msg}
+\uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694: 'democut auth login'`);
+    return 1;
+  }
+}
+function logoutCommand(opts) {
+  const base = resolveBaseUrl(opts.baseUrl);
+  clearCredentials(base);
+  out(`\uB85C\uADF8\uC544\uC6C3\uB428 (${base}).`);
+  return 0;
+}
+
+// src/api-client.ts
+var ApiError = class extends Error {
+  constructor(status2, code, message, retriable, extra = {}) {
+    super(message);
+    this.status = status2;
+    this.code = code;
+    this.retriable = retriable;
+    this.extra = extra;
+    this.name = "ApiError";
+  }
+  status;
+  code;
+  retriable;
+  extra;
+};
+function parseDetail(status2, body) {
+  const detail = body?.detail;
+  if (detail && typeof detail === "object" && !Array.isArray(detail)) {
+    const d = detail;
+    if (typeof d.code === "string" || typeof d.message === "string") {
+      const { code, message, retriable, ...extra } = d;
+      return new ApiError(
+        status2,
+        typeof code === "string" ? code : `HTTP_${status2}`,
+        typeof message === "string" ? message : `HTTP ${status2}`,
+        typeof retriable === "boolean" ? retriable : null,
+        extra
+      );
+    }
+  }
+  if (typeof detail === "string") {
+    return new ApiError(status2, `HTTP_${status2}`, detail, null);
+  }
+  if (Array.isArray(detail)) {
+    const lines = detail.map((e) => {
+      const item = e;
+      const where = Array.isArray(item.loc) ? item.loc.filter((p) => p !== "body").join(".") : "";
+      const msg = typeof item.msg === "string" ? item.msg : JSON.stringify(e);
+      return where ? `${where}: ${msg}` : msg;
+    });
+    return new ApiError(status2, "VALIDATION_ERROR", lines.join("\n"), true);
+  }
+  return new ApiError(status2, `HTTP_${status2}`, `\uC694\uCCAD\uC774 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4 (HTTP ${status2}).`, null);
+}
+async function apiRequest(baseUrl, path, init = {}, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const token = await getValidAccessToken(baseUrl, deps);
+  const headers = { Authorization: `Bearer ${token}` };
+  if (init.body !== void 0) headers["Content-Type"] = "application/json";
+  const res = await fetchImpl(`${baseUrl}${path}`, {
+    method: init.method ?? "GET",
+    headers,
+    ...init.body === void 0 ? {} : { body: JSON.stringify(init.body) }
+  });
+  const text = await res.text();
+  let json = null;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+      json = null;
+    }
+  }
+  if (!res.ok) {
+    if (res.status === 401) {
+      throw new ApiError(
+        401,
+        "UNAUTHENTICATED",
+        "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB418\uC5C8\uAC70\uB098 \uC720\uD6A8\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4. 'democut auth login' \uC73C\uB85C \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694.",
+        false
+      );
+    }
+    throw parseDetail(res.status, json);
+  }
+  return json;
+}
+
+// src/confirm.ts
+import { createInterface } from "readline/promises";
+function isInteractive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function confirm(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question(`${question} [y/N] `);
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
+// src/videogen.ts
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["succeeded", "failed", "cancelled"]);
+function isTerminal(status2) {
+  return TERMINAL_STATUSES.has(status2);
+}
+function estimate(baseUrl, body, deps = {}) {
+  return apiRequest(baseUrl, "/api/videogen/estimate", { method: "POST", body }, deps);
+}
+function submit(baseUrl, body, deps = {}) {
+  return apiRequest(baseUrl, "/api/videogen", { method: "POST", body }, deps);
+}
+function status(baseUrl, jobId, projectSlug, deps = {}) {
+  const q = projectSlug ? `?project_slug=${encodeURIComponent(projectSlug)}` : "";
+  return apiRequest(
+    baseUrl,
+    `/api/videogen/${encodeURIComponent(jobId)}${q}`,
+    {},
+    deps
+  );
+}
+var WaitTimeout = class extends Error {
+  constructor(jobId, waitedS) {
+    super(
+      `${waitedS}\uCD08 \uC548\uC5D0 \uC644\uB8CC\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. \uC791\uC5C5\uC740 \uC11C\uBC84\uC5D0\uC11C \uACC4\uC18D \uC9C4\uD589\uB429\uB2C8\uB2E4 \u2014 'democut video status ${jobId}' \uB85C \uB2E4\uC2DC \uD655\uC778\uD558\uC138\uC694 (\uC0C8\uB85C \uC81C\uCD9C\uD558\uBA74 \uB2E4\uC2DC \uACFC\uAE08\uB429\uB2C8\uB2E4).`
+    );
+    this.jobId = jobId;
+    this.waitedS = waitedS;
+    this.name = "WaitTimeout";
+  }
+  jobId;
+  waitedS;
+};
+var POLL_INTERVAL_S = 5;
+async function waitForCompletion(baseUrl, jobId, projectSlug, timeoutS, deps = {}) {
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Math.floor(Date.now() / 1e3));
+  const deadline = now() + timeoutS;
+  for (; ; ) {
+    const job = await status(baseUrl, jobId, projectSlug, deps);
+    if (isTerminal(job.status)) return job;
+    deps.onTick?.(job);
+    if (now() >= deadline) throw new WaitTimeout(jobId, timeoutS);
+    await sleep(POLL_INTERVAL_S * 1e3);
+  }
+}
+async function download(videoUrl, outPath, fetchImpl = fetch) {
+  const { writeFile } = await import("fs/promises");
+  const res = await fetchImpl(videoUrl);
+  if (!res.ok) {
+    throw new Error(
+      `\uC0B0\uCD9C\uBB3C \uB0B4\uB824\uBC1B\uAE30 \uC2E4\uD328 (HTTP ${res.status}). \uC11C\uBA85 URL \uC740 24\uC2DC\uAC04 \uD6C4 \uB9CC\uB8CC\uB429\uB2C8\uB2E4.`
+    );
+  }
+  await writeFile(outPath, Buffer.from(await res.arrayBuffer()));
+}
+
+// src/commands/video.ts
+var EXIT = {
+  OK: 0,
+  /** 일반 오류 — 미로그인·사용자 취소·생성 실패·알 수 없음. */
+  GENERAL: 1,
+  /** 요청을 고쳐서 다시 보내면 된다 — 파라미터 오류·예산 초과·승인 누락. 과금 없음. */
+  FIXABLE: 2,
+  /** 일시적 업스트림 오류. **그대로 재시도해도 안전하다.** */
+  TRANSIENT: 3,
+  /** 업스트림이 거부. **재시도하면 재과금될 수 있다 — 자동 재시도 금지.** */
+  UPSTREAM_REJECTED: 4,
+  /**
+   * `--wait` 시한 초과. **실패가 아니다** — 작업은 서버에서 계속 돌고 있다.
+   *
+   * 일반 오류(1)와 같은 코드를 쓰면 에이전트가 "실패했으니 다시" 로 읽고 재제출해
+   * 두 번 과금된다. 그래서 별도 코드로 뗀다: 할 일은 재제출이 아니라 status 재조회다.
+   */
+  WAIT_TIMEOUT: 5
+};
+var out2 = (s) => process.stdout.write(`${s}
+`);
+var err2 = (s) => process.stderr.write(`${s}
+`);
+function emit(opts, ok, payload) {
+  if (opts.json) out2(JSON.stringify({ ok, ...payload }));
+}
+function usd(v) {
+  return v < 0.01 ? `$${v.toFixed(4)}` : `$${v.toFixed(2)}`;
+}
+function parseIntOpt(raw, name) {
+  if (raw === void 0) return void 0;
+  const n = Number(raw);
+  if (!Number.isInteger(n)) throw new UsageError(`--${name} \uC740 \uC815\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4: ${raw}`);
+  return n;
+}
+var UsageError = class extends Error {
+};
+function renderApiError(e, opts) {
+  const code = e.status === 402 || e.status === 422 ? EXIT.FIXABLE : e.status === 503 ? EXIT.TRANSIENT : e.status === 502 ? EXIT.UPSTREAM_REJECTED : EXIT.GENERAL;
+  if (opts.json) {
+    emit(opts, false, {
+      error: { status: e.status, code: e.code, message: e.message, retriable: e.retriable, ...e.extra },
+      exit_code: code
+    });
+    return code;
+  }
+  err2(`\uC624\uB958 [${e.code}] ${e.message}`);
+  if (e.status === 402) {
+    const limit = e.extra.limit_usd;
+    const would = e.extra.would_cost_usd;
+    if (typeof limit === "number" && typeof would === "number") {
+      err2(`  \uC0C1\uD55C ${usd(limit)} \xB7 \uC774 \uC694\uCCAD ${usd(would)}`);
+    }
+    err2("  \uD574\uC0C1\uB3C4\uB098 \uAE38\uC774\uB97C \uB0AE\uCDB0 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694. \uC544\uC9C1 \uACFC\uAE08\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.");
+  } else if (e.status === 422) {
+    err2("  \uD30C\uB77C\uBBF8\uD130\uB97C \uACE0\uCCD0 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694. \uC544\uC9C1 \uACFC\uAE08\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.");
+  } else if (e.status === 503) {
+    err2("  \uC77C\uC2DC\uC801\uC778 \uC624\uB958\uC785\uB2C8\uB2E4. \uC7A0\uC2DC \uD6C4 \uADF8\uB300\uB85C \uB2E4\uC2DC \uC2DC\uB3C4\uD574\uB3C4 \uC548\uC804\uD569\uB2C8\uB2E4.");
+  } else if (e.status === 502) {
+    err2("  \u26A0\uFE0F \uC81C\uCD9C\uC774 \uC774\uBBF8 \uC811\uC218\uB410\uC744 \uC218 \uC788\uC2B5\uB2C8\uB2E4. \uADF8\uB300\uB85C \uB2E4\uC2DC \uC81C\uCD9C\uD558\uBA74 \uB450 \uBC88 \uACFC\uAE08\uB420 \uC218 \uC788\uC73C\uB2C8,");
+    err2("     \uBA3C\uC800 'democut video status <job_id>' \uB85C \uD655\uC778\uD558\uAC70\uB098 \uC0AC\uB78C\uC5D0\uAC8C \uBB38\uC758\uD558\uC138\uC694.");
+  } else if (e.status === 403) {
+    err2("  \uC774 \uC6CC\uD06C\uC2A4\uD398\uC774\uC2A4\uC5D0\uC11C \uC601\uC0C1\uC744 \uC0DD\uC131\uD560 \uAD8C\uD55C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4(\uBA64\uBC84 \uC774\uC0C1 \uD544\uC694).");
+  }
+  return code;
+}
+async function guarded(opts, fn) {
+  try {
+    return await fn();
+  } catch (e) {
+    if (e instanceof NotLoggedInError) {
+      if (opts.json) emit(opts, false, { error: { code: "NOT_LOGGED_IN", message: e.message } });
+      else err2(e.message);
+      return EXIT.GENERAL;
+    }
+    if (e instanceof ApiError) return renderApiError(e, opts);
+    if (e instanceof UsageError) {
+      if (opts.json) emit(opts, false, { error: { code: "USAGE", message: e.message } });
+      else err2(`\uC0AC\uC6A9\uBC95 \uC624\uB958: ${e.message}`);
+      return EXIT.FIXABLE;
+    }
+    if (e instanceof WaitTimeout) {
+      if (opts.json) {
+        emit(opts, false, {
+          error: { code: "WAIT_TIMEOUT", message: e.message, retriable: false },
+          job_id: e.jobId,
+          still_running: true
+        });
+      } else {
+        err2(e.message);
+      }
+      return EXIT.WAIT_TIMEOUT;
+    }
+    const msg = e?.message ?? String(e);
+    if (opts.json) emit(opts, false, { error: { code: "UNKNOWN", message: msg } });
+    else err2(`\uC624\uB958: ${msg}`);
+    return EXIT.GENERAL;
+  }
+}
+function buildEstimateIn(opts) {
+  return {
+    duration_s: parseIntOpt(opts.duration, "duration") ?? 5,
+    resolution: opts.resolution ?? "720p",
+    ratio: opts.ratio ?? "16:9",
+    ...opts.model ? { model: opts.model } : {}
+  };
+}
+function estimateCommand(opts, deps = {}) {
+  return guarded(opts, async () => {
+    const base = resolveBaseUrl(opts.baseUrl);
+    const r = await estimate(base, buildEstimateIn(opts), deps);
+    if (opts.json) {
+      emit(opts, true, { tokens: r.tokens, cost_usd: r.cost_usd, model: r.model });
+    } else {
+      out2(`\uC608\uC0C1 \uBE44\uC6A9: ${usd(r.cost_usd)}  (${r.tokens.toLocaleString()} tokens \xB7 ${r.model})`);
+    }
+    return EXIT.OK;
+  });
+}
+function generateCommand(prompt, opts, deps = {}) {
+  return guarded(opts, async () => {
+    if (!prompt || !prompt.trim()) {
+      throw new UsageError('\uD504\uB86C\uD504\uD2B8\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \uC608: democut video generate "\uACE0\uC591\uC774\uAC00 \uCDA4\uCD98\uB2E4"');
+    }
+    const base = resolveBaseUrl(opts.baseUrl);
+    const est = buildEstimateIn(opts);
+    const quote = await estimate(base, est, deps);
+    if (!opts.json) {
+      out2(`\uC608\uC0C1 \uBE44\uC6A9: ${usd(quote.cost_usd)}  (${quote.tokens.toLocaleString()} tokens \xB7 ${quote.model})`);
+      out2(`  ${est.duration_s}\uCD08 \xB7 ${est.resolution} \xB7 ${est.ratio}`);
+    }
+    if (!opts.yes) {
+      if (!(deps.isInteractiveImpl ?? isInteractive)()) {
+        const message = `\uBE44\uB300\uD654\uD615 \uD658\uACBD\uC774\uB77C \uBE44\uC6A9 \uC2B9\uC778\uC744 \uBC1B\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4 (\uC608\uC0C1 ${usd(quote.cost_usd)}). \uD655\uC778\uD588\uB2E4\uBA74 --yes \uB97C \uBD99\uC5EC \uB2E4\uC2DC \uC2E4\uD589\uD558\uC138\uC694.`;
+        if (opts.json) {
+          emit(opts, false, {
+            error: { code: "CONFIRMATION_REQUIRED", message },
+            estimated_cost_usd: quote.cost_usd
+          });
+        } else {
+          err2(message);
+        }
+        return EXIT.FIXABLE;
+      }
+      if (opts.json) {
+        const message = `--json \uBAA8\uB4DC\uC5D0\uC11C\uB294 --yes \uAC00 \uD544\uC694\uD569\uB2C8\uB2E4 (\uC608\uC0C1 ${usd(quote.cost_usd)}).`;
+        emit(opts, false, {
+          error: { code: "CONFIRMATION_REQUIRED", message },
+          estimated_cost_usd: quote.cost_usd
+        });
+        return EXIT.FIXABLE;
+      }
+      const ask = deps.confirmImpl ?? confirm;
+      if (!await ask(`${usd(quote.cost_usd)} \uAC00 \uCCAD\uAD6C\uB429\uB2C8\uB2E4. \uC0DD\uC131\uD560\uAE4C\uC694?`)) {
+        out2("\uCDE8\uC18C\uD588\uC2B5\uB2C8\uB2E4. \uACFC\uAE08\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.");
+        return EXIT.GENERAL;
+      }
+    }
+    const body = {
+      prompt,
+      duration_s: est.duration_s,
+      resolution: est.resolution,
+      ratio: est.ratio,
+      generate_audio: Boolean(opts.audio),
+      watermark: Boolean(opts.watermark),
+      ...opts.model ? { model: opts.model } : {},
+      ...opts.seed !== void 0 ? { seed: parseIntOpt(opts.seed, "seed") } : {},
+      ...opts.imageUrls?.length ? { image_urls: opts.imageUrls } : {},
+      ...opts.project ? { project_slug: opts.project } : {}
+    };
+    const job = await submit(base, body, deps);
+    if (job.duplicate) {
+      if (job.pending) {
+        const message = "\uAC19\uC740 \uC694\uCCAD\uC774 \uBC29\uAE08 \uC81C\uCD9C\uB418\uC5B4 \uC9C4\uD589 \uC911\uC785\uB2C8\uB2E4. \uC7A0\uC2DC \uD6C4 'democut video status <job_id>' \uB85C \uD655\uC778\uD558\uC138\uC694.";
+        if (opts.json) emit(opts, true, { duplicate: true, pending: true, job_id: null, message });
+        else out2(message);
+        return EXIT.OK;
+      }
+      if (!opts.json) out2(`\uAC19\uC740 \uC694\uCCAD\uC774 \uC774\uBBF8 \uC9C4\uD589 \uC911\uC785\uB2C8\uB2E4 (job ${job.job_id}). \uC0C8\uB85C \uACFC\uAE08\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.`);
+    } else if (!opts.json) {
+      out2(`\uC81C\uCD9C\uB428: job ${job.job_id}  (\uC608\uC0C1 ${usd(job.estimated_cost_usd)})`);
+    }
+    if (!opts.wait) {
+      if (opts.json) {
+        emit(opts, true, {
+          job_id: job.job_id,
+          status: job.status,
+          model: job.model,
+          estimated_cost_usd: job.estimated_cost_usd,
+          duplicate: job.duplicate,
+          pending: job.pending
+        });
+      } else {
+        const projectFlag = opts.project ? ` --project ${opts.project}` : "";
+        out2(`\uC644\uB8CC \uD655\uC778: democut video status ${job.job_id}${projectFlag}`);
+      }
+      return EXIT.OK;
+    }
+    return finishWithWait(base, job.job_id, opts, deps);
+  });
+}
+function statusCommand2(jobId, opts, deps = {}) {
+  return guarded(opts, async () => {
+    if (!jobId) throw new UsageError("job_id \uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \uC608: democut video status <job_id>");
+    const base = resolveBaseUrl(opts.baseUrl);
+    if (opts.wait) return finishWithWait(base, jobId, opts, deps);
+    const job = await status(base, jobId, opts.project, deps);
+    return report(job, opts, deps);
+  });
+}
+async function finishWithWait(base, jobId, opts, deps) {
+  const timeoutS = parseIntOpt(opts.timeout, "timeout") ?? 900;
+  if (!opts.json) process.stderr.write("  \uC0DD\uC131 \uB300\uAE30 \uC911");
+  const job = await waitForCompletion(base, jobId, opts.project, timeoutS, {
+    ...deps,
+    onTick: () => {
+      if (!opts.json) process.stderr.write(".");
+    }
+  });
+  if (!opts.json) err2("");
+  return report(job, opts, deps);
+}
+async function report(job, opts, deps = {}) {
+  if (job.status === "failed" || job.status === "cancelled") {
+    if (opts.json) {
+      emit(opts, false, { job_id: job.job_id, status: job.status, error: job.error });
+    } else {
+      err2(`\uC0DD\uC131 \uC2E4\uD328 (${job.status}): ${job.error ?? "\uC0AC\uC720 \uBBF8\uC0C1"}`);
+    }
+    return EXIT.GENERAL;
+  }
+  let saved = null;
+  let downloadError = null;
+  if (job.video_url && opts.output) {
+    try {
+      await (deps.downloadImpl ?? download)(job.video_url, opts.output);
+      saved = opts.output;
+    } catch (e) {
+      downloadError = e?.message ?? String(e);
+    }
+  }
+  if (opts.json) {
+    emit(opts, downloadError === null, {
+      job_id: job.job_id,
+      status: job.status,
+      model: job.model,
+      video_url: job.video_url ?? null,
+      tokens: job.tokens ?? null,
+      cost_usd: job.cost_usd ?? null,
+      seed: job.seed ?? null,
+      saved_to: saved,
+      ...downloadError ? { download_error: downloadError } : {}
+    });
+  } else {
+    out2(`\uC0C1\uD0DC: ${job.status}`);
+    if (job.cost_usd != null) out2(`  \uBE44\uC6A9: ${usd(job.cost_usd)}${job.tokens != null ? ` (${job.tokens.toLocaleString()} tokens)` : ""}`);
+    if (saved) out2(`  \uC800\uC7A5\uB428: ${saved}`);
+    else if (job.video_url) {
+      out2(`  URL : ${job.video_url}`);
+      if (downloadError) {
+        err2(`  \uB0B4\uB824\uBC1B\uAE30 \uC2E4\uD328: ${downloadError}`);
+        err2("  \u26A0\uFE0F \uC704 URL \uB85C \uC9C1\uC811 \uBC1B\uC73C\uC138\uC694 \u2014 24\uC2DC\uAC04 \uD6C4 \uB9CC\uB8CC\uB418\uBA70, \uB2E4\uC2DC \uB9CC\uB4E4\uBA74 \uB610 \uACFC\uAE08\uB429\uB2C8\uB2E4.");
+      } else {
+        out2("  \u26A0\uFE0F \uC774 URL \uC740 24\uC2DC\uAC04 \uD6C4 \uB9CC\uB8CC\uB429\uB2C8\uB2E4 \u2014 \uC9C0\uAE08 \uB0B4\uB824\uBC1B\uC73C\uC138\uC694 (--output <\uACBD\uB85C>).");
+      }
+    }
+  }
+  return downloadError === null ? EXIT.OK : EXIT.GENERAL;
+}
+
+// src/cli.ts
+var VERSION = "0.2.0";
+var HELP = `democut \u2014 DemoCut \uC5D0\uC774\uC804\uD2B8 CLI (OAuth2 device flow + \uC601\uC0C1 \uC0DD\uC131)
+
+\uC0AC\uC6A9\uBC95:
+  democut auth login [--no-browser] [--json] [--base-url <url>]
+  democut auth status [--json] [--base-url <url>]
+  democut auth logout [--base-url <url>]
+
+  democut video estimate [--duration <\uCD08>] [--resolution <\uD574\uC0C1\uB3C4>] [--ratio <\uBE44\uC728>] [--model <id>]
+  democut video generate "<\uD504\uB86C\uD504\uD2B8>" [--yes] [--wait] [--output <\uACBD\uB85C>] [\uC0DD\uC131 \uC635\uC158\u2026]
+  democut video status <job_id> [--wait] [--output <\uACBD\uB85C>] [--project <slug>]
+
+\uC0DD\uC131 \uC635\uC158:
+  --duration <\uCD08>     \uAE30\uBCF8 5 (\uBAA8\uB378\uBCC4 \uD5C8\uC6A9 \uBC94\uC704 \uB2E4\uB984: 2.0=4~15, 2.5=4~30)
+  --resolution <r>    480p | 720p(\uAE30\uBCF8) | 1080p | 4k
+  --ratio <a>         16:9(\uAE30\uBCF8) | 9:16 | 1:1 | 4:3 | 21:9 | adaptive
+  --model <id>        \uAE30\uBCF8 \uC11C\uBC84 \uC124\uC815\uAC12
+  --seed <n>          \uACB0\uC815\uB860\uC801 \uC0DD\uC131\uC6A9 seed
+  --image-url <url>   image\u2192video \uCC38\uC870 (\uACF5\uAC1C HTTPS URL, \uCD5C\uB300 4\uD68C \uBC18\uBCF5)
+  --audio             \uC624\uB514\uC624 \uD568\uAED8 \uC0DD\uC131
+  --watermark         \uC6CC\uD130\uB9C8\uD06C \uB123\uAE30
+  --project <slug>    \uBE44\uC6A9\uC744 \uC774 \uD504\uB85C\uC81D\uD2B8\uB85C \uADC0\uC18D
+
+\uACF5\uD1B5 \uC635\uC158:
+  -y, --yes           \uBE44\uC6A9 \uD655\uC778 \uC5C6\uC774 \uC9C4\uD589 (\uBE44\uB300\uD654\uD615\uC5D0\uC11C\uB294 \uD544\uC218)
+      --wait          \uC644\uB8CC\uAE4C\uC9C0 \uAE30\uB2E4\uB9BC
+      --timeout <\uCD08>  --wait \uC2DC\uD55C (\uAE30\uBCF8 900)
+  -o, --output <\uACBD\uB85C> \uC0B0\uCD9C\uBB3C \uC800\uC7A5 (\uC11C\uBA85 URL \uC740 24\uC2DC\uAC04 \uD6C4 \uB9CC\uB8CC \u2014 \uBC1B\uC544 \uB450\uC138\uC694)
+      --json          \uAE30\uACC4 \uD310\uB3C5\uC6A9 JSON \uD55C \uC904
+      --base-url <u>  DemoCut \uC11C\uBC84 URL (\uAE30\uBCF8: $DEMOCUT_BASE_URL \uB610\uB294 prod)
+  -h, --help          \uB3C4\uC6C0\uB9D0
+  -v, --version       \uBC84\uC804
+
+\uC885\uB8CC \uCF54\uB4DC:
+  0 \uC131\uACF5   1 \uC77C\uBC18 \uC624\uB958(\uBBF8\uB85C\uADF8\uC778\xB7\uCDE8\uC18C\xB7\uC0DD\uC131 \uC2E4\uD328)   2 \uACE0\uCCD0\uC11C \uC7AC\uC2DC\uB3C4 \uAC00\uB2A5(\uACFC\uAE08 \uC5C6\uC74C)
+  3 \uC77C\uC2DC \uC624\uB958(\uADF8\uB300\uB85C \uC7AC\uC2DC\uB3C4 \uC548\uC804)                  4 \uC5C5\uC2A4\uD2B8\uB9BC \uAC70\uBD80(\uC7AC\uC2DC\uB3C4 \uC2DC \uC7AC\uACFC\uAE08 \uC704\uD5D8)
+  5 --wait \uC2DC\uD55C \uCD08\uACFC \u2014 \uC2E4\uD328 \uC544\uB2D8. \uC791\uC5C5\uC740 \uACC4\uC18D \uC9C4\uD589 \uC911\uC774\uB2C8 status \uB85C \uD655\uC778(\uC7AC\uC81C\uCD9C \uAE08\uC9C0)`;
+var VALUE_FLAGS = {
+  "--base-url": "baseUrl",
+  "--duration": "duration",
+  "--resolution": "resolution",
+  "--ratio": "ratio",
+  "--model": "model",
+  "--seed": "seed",
+  "--project": "project",
+  "--output": "output",
+  "-o": "output",
+  "--timeout": "timeout"
+};
+var BOOL_FLAGS = {
+  "--no-browser": "noBrowser",
+  "--device": "noBrowser",
+  "--json": "json",
+  "--yes": "yes",
+  "-y": "yes",
+  "--wait": "wait",
+  "--audio": "audio",
+  "--watermark": "watermark"
+};
+var HELP_FLAGS = /* @__PURE__ */ new Set(["-h", "--help", "-v", "--version"]);
+function isKnownFlag(token) {
+  return token in VALUE_FLAGS || token in BOOL_FLAGS || HELP_FLAGS.has(token) || token === "--image-url" || token.startsWith("--image-url=");
+}
+function parseArgs(argv) {
+  const positional = [];
+  const options = {};
+  let help = false;
+  let version = false;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a) continue;
+    if (a === "-h" || a === "--help") {
+      help = true;
+      continue;
+    }
+    if (a === "-v" || a === "--version") {
+      version = true;
+      continue;
+    }
+    if (a === "--image-url" || a.startsWith("--image-url=")) {
+      const v = a.startsWith("--image-url=") ? a.slice("--image-url=".length) : argv[++i];
+      if (v) (options.imageUrls ??= []).push(v);
+      continue;
+    }
+    const boolKey = BOOL_FLAGS[a];
+    if (boolKey) {
+      options[boolKey] = true;
+      continue;
+    }
+    const valueKey = VALUE_FLAGS[a];
+    if (valueKey) {
+      const v = argv[++i];
+      if (v === void 0 || isKnownFlag(v)) {
+        throw new UsageError(`${a} \uC5D0 \uAC12\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.`);
+      }
+      options[valueKey] = v;
+      continue;
+    }
+    const eq = a.indexOf("=");
+    if (eq > 0) {
+      const key = VALUE_FLAGS[a.slice(0, eq)];
+      if (key) {
+        options[key] = a.slice(eq + 1);
+        continue;
+      }
+    }
+    positional.push(a);
+  }
+  return { positional, options, help, version };
+}
+async function run(argv, deps = {}) {
+  let parsed;
+  try {
+    parsed = parseArgs(argv);
+  } catch (e) {
+    if (e instanceof UsageError) {
+      process.stderr.write(`\uC0AC\uC6A9\uBC95 \uC624\uB958: ${e.message}
+`);
+      return EXIT.FIXABLE;
+    }
+    throw e;
+  }
+  const { positional, options, help, version } = parsed;
+  if (version) {
+    process.stdout.write(`${VERSION}
+`);
+    return 0;
+  }
+  const [group, sub, arg] = positional;
+  if (help || !group) {
+    process.stdout.write(`${HELP}
+`);
+    return help ? EXIT.OK : EXIT.FIXABLE;
+  }
+  if (group === "auth") {
+    if (sub === "login") return loginCommand(options);
+    if (sub === "status") return statusCommand(options);
+    if (sub === "logout") return Promise.resolve(logoutCommand(options));
+    process.stderr.write(`\uC54C \uC218 \uC5C6\uB294 auth \uBA85\uB839: ${sub ?? "(\uC5C6\uC74C)"}
+${HELP}
+`);
+    return EXIT.FIXABLE;
+  }
+  if (group === "video") {
+    if (sub === "estimate") return estimateCommand(options, deps);
+    if (sub === "generate") return generateCommand(arg, options, deps);
+    if (sub === "status") return statusCommand2(arg, options, deps);
+    process.stderr.write(`\uC54C \uC218 \uC5C6\uB294 video \uBA85\uB839: ${sub ?? "(\uC5C6\uC74C)"}
+${HELP}
+`);
+    return EXIT.FIXABLE;
+  }
+  process.stderr.write(`\uC54C \uC218 \uC5C6\uB294 \uBA85\uB839: ${group}
+${HELP}
+`);
+  return EXIT.FIXABLE;
+}
+var invokedDirectly = (() => {
+  const arg = process.argv[1];
+  if (arg === void 0) return false;
+  try {
+    return realpathSync(arg) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+})();
+if (invokedDirectly || process.env.DEMOCUT_CLI_RUN === "1") {
+  run(process.argv.slice(2)).then((code) => process.exit(code)).catch((e) => {
+    process.stderr.write(`\uC624\uB958: ${e?.message ?? String(e)}
+`);
+    process.exit(1);
+  });
+}
+export {
+  VERSION,
+  parseArgs,
+  run
+};

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "democut",
+  "version": "0.2.0",
+  "description": "DemoCut 에이전트 CLI — device flow 로그인(RFC 8628) + 영상 생성",
+  "license": "MIT",
+  "author": "InfoGrab",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/infograb/ai/democut/democut-app.git",
+    "directory": "cli"
+  },
+  "bugs": {
+    "url": "https://gitlab.com/infograb/ai/democut/democut-app/-/issues"
+  },
+  "homepage": "https://democut.ai",
+  "keywords": [
+    "video-generation",
+    "ai-video",
+    "cli",
+    "auth",
+    "oauth2",
+    "agent"
+  ],
+  "type": "module",
+  "bin": {
+    "democut": "dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build",
+    "generate:types": "openapi-typescript http://localhost:8000/api/_spec/openapi.json -o src/api.types.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "openapi-typescript": "^7.13.0",
+    "tsup": "^8.3.5",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.8"
+  }
+}