nworks-plus 1.3.0

package/dist/mcp.js

@@ -0,0 +1,2895 @@
+// src/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/mcp/tools.ts
+import { z } from "zod";
+
+// src/utils/error.ts
+var AuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthError";
+  }
+};
+var ApiError = class extends Error {
+  code;
+  statusCode;
+  constructor(code, description, statusCode) {
+    super(description);
+    this.name = "ApiError";
+    this.code = code;
+    this.statusCode = statusCode;
+  }
+};
+
+// src/auth/config.ts
+import { readFile, writeFile, mkdir } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function hasServiceAccountCreds(creds) {
+  return !!(creds.serviceAccount && creds.privateKeyPath && creds.botId);
+}
+var IS_UNIX = process.platform !== "win32";
+var CONFIG_DIR = join(homedir(), ".config", "nworks");
+var CREDENTIALS_PATH = join(CONFIG_DIR, "credentials.json");
+var TOKEN_PATH = join(CONFIG_DIR, "token.json");
+var USER_TOKEN_PATH = join(CONFIG_DIR, "user-token.json");
+async function ensureConfigDir() {
+  if (!existsSync(CONFIG_DIR)) {
+    await mkdir(CONFIG_DIR, { recursive: true, ...IS_UNIX && { mode: 448 } });
+  }
+}
+function getCredentialsFromEnv() {
+  const clientId = process.env["NWORKS_CLIENT_ID"];
+  const clientSecret = process.env["NWORKS_CLIENT_SECRET"];
+  if (!clientId || !clientSecret) return null;
+  return {
+    clientId,
+    clientSecret,
+    serviceAccount: process.env["NWORKS_SERVICE_ACCOUNT"],
+    privateKeyPath: process.env["NWORKS_PRIVATE_KEY_PATH"],
+    botId: process.env["NWORKS_BOT_ID"],
+    domainId: process.env["NWORKS_DOMAIN_ID"]
+  };
+}
+async function loadCredentials(profile = "default") {
+  const envCreds = getCredentialsFromEnv();
+  if (envCreds) return envCreds;
+  if (!existsSync(CREDENTIALS_PATH)) {
+    throw new AuthError(
+      "Not logged in. Run `nworks login` or set environment variables."
+    );
+  }
+  const raw = await readFile(CREDENTIALS_PATH, "utf-8");
+  const profiles = JSON.parse(raw);
+  const creds = profiles[profile];
+  if (!creds) {
+    throw new AuthError(`Profile "${profile}" not found in credentials.`);
+  }
+  return creds;
+}
+async function saveCredentials(creds, profile = "default") {
+  await ensureConfigDir();
+  let profiles = {};
+  if (existsSync(CREDENTIALS_PATH)) {
+    const raw = await readFile(CREDENTIALS_PATH, "utf-8");
+    profiles = JSON.parse(raw);
+  }
+  profiles[profile] = creds;
+  await writeFile(
+    CREDENTIALS_PATH,
+    JSON.stringify(profiles, null, 2),
+    { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
+  );
+}
+async function loadToken(profile = "default") {
+  if (!existsSync(TOKEN_PATH)) return null;
+  const raw = await readFile(TOKEN_PATH, "utf-8");
+  const tokens = JSON.parse(raw);
+  const entry = tokens[profile];
+  if (!entry) return null;
+  return {
+    accessToken: String(entry["accessToken"]),
+    expiresAt: Number(entry["expiresAt"])
+  };
+}
+async function saveToken(token, profile = "default") {
+  await ensureConfigDir();
+  let tokens = {};
+  if (existsSync(TOKEN_PATH)) {
+    const raw = await readFile(TOKEN_PATH, "utf-8");
+    tokens = JSON.parse(raw);
+  }
+  tokens[profile] = token;
+  await writeFile(
+    TOKEN_PATH,
+    JSON.stringify(tokens, null, 2),
+    { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
+  );
+}
+async function loadUserToken(profile = "default") {
+  if (!existsSync(USER_TOKEN_PATH)) return null;
+  const raw = await readFile(USER_TOKEN_PATH, "utf-8");
+  const tokens = JSON.parse(raw);
+  const entry = tokens[profile];
+  if (!entry) return null;
+  return {
+    accessToken: String(entry["accessToken"]),
+    refreshToken: String(entry["refreshToken"]),
+    expiresAt: Number(entry["expiresAt"]),
+    scope: String(entry["scope"] ?? "")
+  };
+}
+async function saveUserToken(token, profile = "default") {
+  await ensureConfigDir();
+  let tokens = {};
+  if (existsSync(USER_TOKEN_PATH)) {
+    const raw = await readFile(USER_TOKEN_PATH, "utf-8");
+    tokens = JSON.parse(raw);
+  }
+  tokens[profile] = token;
+  await writeFile(
+    USER_TOKEN_PATH,
+    JSON.stringify(tokens, null, 2),
+    { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
+  );
+}
+async function clearCredentials(profile = "default") {
+  if (existsSync(CREDENTIALS_PATH)) {
+    const raw = await readFile(CREDENTIALS_PATH, "utf-8");
+    const profiles = JSON.parse(raw);
+    delete profiles[profile];
+    await writeFile(
+      CREDENTIALS_PATH,
+      JSON.stringify(profiles, null, 2),
+      { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
+    );
+  }
+  if (existsSync(TOKEN_PATH)) {
+    const raw = await readFile(TOKEN_PATH, "utf-8");
+    const tokens = JSON.parse(raw);
+    delete tokens[profile];
+    await writeFile(
+      TOKEN_PATH,
+      JSON.stringify(tokens, null, 2),
+      { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
+    );
+  }
+  if (existsSync(USER_TOKEN_PATH)) {
+    const raw = await readFile(USER_TOKEN_PATH, "utf-8");
+    const tokens = JSON.parse(raw);
+    delete tokens[profile];
+    await writeFile(
+      USER_TOKEN_PATH,
+      JSON.stringify(tokens, null, 2),
+      { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
+    );
+  }
+}
+
+// src/auth/jwt.ts
+import { readFile as readFile2, stat } from "fs/promises";
+import jwt from "jsonwebtoken";
+async function createJWT(creds) {
+  if (!creds.serviceAccount || !creds.privateKeyPath) {
+    throw new AuthError(
+      "Service Account credentials required for bot authentication.\nRun `nworks login` with --service-account and --private-key flags."
+    );
+  }
+  const privateKey = await readFile2(creds.privateKeyPath, "utf-8");
+  if (process.platform !== "win32") {
+    const fileStat = await stat(creds.privateKeyPath);
+    const mode = fileStat.mode & 511;
+    if (mode & 63) {
+      console.error(
+        `[nworks] Warning: Private key file has permissions ${mode.toString(8)}. Recommended: 600`
+      );
+    }
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  const payload = {
+    iss: creds.clientId,
+    sub: creds.serviceAccount,
+    iat: now,
+    exp: now + 3600
+  };
+  return jwt.sign(payload, privateKey, { algorithm: "RS256" });
+}
+
+// src/auth/token.ts
+var AUTH_URL = "https://auth.worksmobile.com/oauth2/v2.0/token";
+async function getValidToken(profile = "default") {
+  const cached = await loadToken(profile);
+  if (cached && cached.expiresAt > Date.now() / 1e3 + 300) {
+    return cached.accessToken;
+  }
+  return refreshToken(profile);
+}
+async function refreshToken(profile = "default") {
+  const creds = await loadCredentials(profile);
+  const assertion = await createJWT(creds);
+  const body = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    assertion,
+    client_id: creds.clientId,
+    client_secret: creds.clientSecret,
+    scope: process.env["NWORKS_SCOPE"] ?? "bot bot.read user.read"
+  });
+  const res = await fetch(AUTH_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    const truncated = text.length > 200 ? text.substring(0, 200) + "..." : text;
+    throw new AuthError(`Token exchange failed (${res.status}): ${truncated}`);
+  }
+  const data = await res.json();
+  const expiresIn = Number(data.expires_in);
+  const tokenData = {
+    accessToken: data.access_token,
+    expiresAt: Math.floor(Date.now() / 1e3) + expiresIn
+  };
+  await saveToken(tokenData, profile);
+  return tokenData.accessToken;
+}
+
+// src/api/client.ts
+var BASE_URL = "https://www.worksapis.com/v1.0";
+var MAX_RETRIES = 3;
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function request(opts, _retryCount = 0) {
+  const { method, path, body, profile = "default" } = opts;
+  const token = await getValidToken(profile);
+  const url = `${BASE_URL}${path}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] ${method} ${url}`);
+  }
+  const res = await fetch(url, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    body: body ? JSON.stringify(body) : void 0
+  });
+  if (res.status === 401 && _retryCount === 0) {
+    await refreshToken(profile);
+    return request(opts, _retryCount + 1);
+  }
+  if (res.status === 429 && _retryCount < MAX_RETRIES) {
+    const MAX_RETRY_AFTER = 60;
+    const rawRetry = parseInt(res.headers.get("Retry-After") ?? "5", 10);
+    const retryAfter = Math.min(Number.isNaN(rawRetry) ? 5 : rawRetry, MAX_RETRY_AFTER);
+    await sleep(retryAfter * 1e3);
+    return request(opts, _retryCount + 1);
+  }
+  if (!res.ok) {
+    let code = "UNKNOWN";
+    let description = `HTTP ${res.status}`;
+    try {
+      const errorBody = await res.json();
+      code = errorBody.code ?? code;
+      description = errorBody.description ?? description;
+    } catch {
+    }
+    if (res.status === 401) {
+      throw new AuthError(description);
+    }
+    throw new ApiError(code, description, res.status);
+  }
+  const text = await res.text();
+  if (!text) {
+    return void 0;
+  }
+  return JSON.parse(text);
+}
+
+// src/utils/sanitize.ts
+import { basename, resolve, sep } from "path";
+import { randomBytes } from "crypto";
+function sanitizePathSegment(value) {
+  if (!value || typeof value !== "string") {
+    throw new Error("Path segment must be a non-empty string");
+  }
+  if (value === "me") return value;
+  if (/[/\\]/.test(value) || value.includes("..")) {
+    throw new Error(`Invalid path segment: "${value}"`);
+  }
+  return encodeURIComponent(value);
+}
+function sanitizeFileName(name) {
+  if (!name || typeof name !== "string") {
+    throw new Error("File name must be a non-empty string");
+  }
+  const base = basename(name);
+  return base.replace(/[\r\n"\\]/g, "_");
+}
+function validateLocalPath(filePath, allowedBase) {
+  const resolved = resolve(filePath);
+  if (allowedBase) {
+    const resolvedBase = resolve(allowedBase);
+    if (resolved !== resolvedBase && !resolved.startsWith(resolvedBase + sep)) {
+      throw new Error(`Path "${filePath}" escapes the allowed directory "${allowedBase}"`);
+    }
+  }
+  return resolved;
+}
+function validateRedirectUrl(location, allowedHosts) {
+  let parsed;
+  try {
+    parsed = new URL(location);
+  } catch {
+    throw new Error(`Invalid redirect URL: "${location}"`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Redirect URL must use HTTPS: "${location}"`);
+  }
+  const isAllowed = allowedHosts.some(
+    (host) => parsed.hostname === host || parsed.hostname.endsWith("." + host)
+  );
+  if (!isAllowed) {
+    throw new Error(`Redirect to untrusted host: "${parsed.hostname}"`);
+  }
+  return location;
+}
+function generateSecureState() {
+  return randomBytes(32).toString("hex");
+}
+
+// src/api/message.ts
+function buildContent(opts) {
+  const type = opts.type ?? "text";
+  if (type === "text") {
+    return { type: "text", text: opts.text };
+  }
+  if (type === "button") {
+    const actions = opts.actions ? (() => {
+      const parsed = JSON.parse(opts.actions);
+      if (!Array.isArray(parsed)) throw new Error("actions must be a JSON array");
+      return parsed;
+    })() : [];
+    return {
+      type: "button_template",
+      contentText: opts.text,
+      actions
+    };
+  }
+  if (type === "list") {
+    const elements = opts.elements ? (() => {
+      const parsed = JSON.parse(opts.elements);
+      if (!Array.isArray(parsed)) throw new Error("elements must be a JSON array");
+      return parsed;
+    })() : [];
+    return {
+      type: "list_template",
+      coverData: { text: opts.text },
+      elements
+    };
+  }
+  return { type: "text", text: opts.text };
+}
+async function send(opts) {
+  const profile = opts.profile ?? "default";
+  const creds = await loadCredentials(profile);
+  if (!creds.botId) {
+    throw new Error(
+      "Bot ID is required for sending messages.\nRun `nworks login` with --bot-id flag to set up bot credentials."
+    );
+  }
+  const content = buildContent(opts);
+  const body = { content };
+  if (opts.to) {
+    const result = await request({
+      method: "POST",
+      path: `/bots/${sanitizePathSegment(creds.botId)}/users/${sanitizePathSegment(opts.to)}/messages`,
+      body,
+      profile
+    });
+    return { success: true, messageId: result?.messageId };
+  }
+  if (opts.channel) {
+    const result = await request({
+      method: "POST",
+      path: `/bots/${sanitizePathSegment(creds.botId)}/channels/${sanitizePathSegment(opts.channel)}/messages`,
+      body,
+      profile
+    });
+    return { success: true, messageId: result?.messageId };
+  }
+  throw new Error("Either --to (userId) or --channel (channelId) is required.");
+}
+async function listMembers(channelId, profile = "default") {
+  const creds = await loadCredentials(profile);
+  if (!creds.botId) {
+    throw new Error(
+      "Bot ID is required for listing channel members.\nRun `nworks login` with --bot-id flag to set up bot credentials."
+    );
+  }
+  const result = await request({
+    method: "GET",
+    path: `/bots/${sanitizePathSegment(creds.botId)}/channels/${sanitizePathSegment(channelId)}/members`,
+    profile
+  });
+  return { members: result.members ?? [], responseMetaData: result.responseMetaData };
+}
+
+// src/api/directory.ts
+async function listUsers(profile = "default") {
+  const result = await request({
+    method: "GET",
+    path: "/users",
+    profile
+  });
+  return { users: result.users ?? [], responseMetaData: result.responseMetaData };
+}
+
+// src/api/calendar.ts
+import { randomUUID } from "crypto";
+
+// src/auth/oauth-user.ts
+import { createServer } from "http";
+import { randomBytes as randomBytes2 } from "crypto";
+import { URL as URL2 } from "url";
+var AUTH_URL2 = "https://auth.worksmobile.com/oauth2/v2.0/authorize";
+var TOKEN_URL = "https://auth.worksmobile.com/oauth2/v2.0/token";
+var REDIRECT_PORT = 9876;
+var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
+function buildAuthorizeUrl(clientId, scope, state) {
+  const params = new URLSearchParams({
+    client_id: clientId,
+    redirect_uri: REDIRECT_URI,
+    scope,
+    response_type: "code",
+    state
+  });
+  return `${AUTH_URL2}?${params.toString()}`;
+}
+function waitForAuthCode(expectedState) {
+  return new Promise((resolve2, reject) => {
+    const timeout = setTimeout(() => {
+      server.close();
+      reject(new AuthError("OAuth login timed out (120s). Try again."));
+    }, 12e4);
+    const server = createServer((req, res) => {
+      const url = new URL2(req.url ?? "/", `http://localhost:${REDIRECT_PORT}`);
+      if (url.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end("Not found");
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const error = url.searchParams.get("error");
+      const state = url.searchParams.get("state");
+      if (state !== expectedState) {
+        res.writeHead(403, { "Content-Type": "text/html; charset=utf-8" });
+        res.end("<h2>\uBCF4\uC548 \uC624\uB958</h2><p>state \uBD88\uC77C\uCE58. \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694.</p>");
+        clearTimeout(timeout);
+        server.close();
+        reject(new AuthError("OAuth state mismatch \u2014 possible CSRF attack."));
+        return;
+      }
+      if (error) {
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end("<h2>\uB85C\uADF8\uC778 \uC2E4\uD328</h2><p>\uC774 \uCC3D\uC744 \uB2EB\uC544\uB3C4 \uB429\uB2C8\uB2E4.</p>");
+        clearTimeout(timeout);
+        server.close();
+        reject(new AuthError(`OAuth error: ${error}`));
+        return;
+      }
+      if (!code) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end("<h2>\uC798\uBABB\uB41C \uC694\uCCAD</h2><p>Authorization code\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.</p>");
+        clearTimeout(timeout);
+        server.close();
+        reject(new AuthError("Missing authorization code in callback."));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end("<h2>\uB85C\uADF8\uC778 \uC131\uACF5!</h2><p>\uC774 \uCC3D\uC744 \uB2EB\uACE0 \uD130\uBBF8\uB110\uB85C \uB3CC\uC544\uAC00\uC138\uC694.</p>");
+      clearTimeout(timeout);
+      server.close();
+      resolve2(code);
+    });
+    server.listen(REDIRECT_PORT, "127.0.0.1", () => {
+    });
+    server.on("error", (err) => {
+      clearTimeout(timeout);
+      reject(new AuthError(`Failed to start callback server on port ${REDIRECT_PORT}: ${err.message}`));
+    });
+  });
+}
+async function exchangeCodeForToken(code, clientId, clientSecret) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    client_id: clientId,
+    client_secret: clientSecret,
+    redirect_uri: REDIRECT_URI
+  });
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    const truncated = text.length > 200 ? text.substring(0, 200) + "..." : text;
+    throw new AuthError(`Token exchange failed (${res.status}): ${truncated}`);
+  }
+  const data = await res.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Math.floor(Date.now() / 1e3) + Number(data.expires_in),
+    scope: data.scope
+  };
+}
+async function refreshUserToken(refreshToken2, profile = "default") {
+  const creds = await loadCredentials(profile);
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken2,
+    client_id: creds.clientId,
+    client_secret: creds.clientSecret
+  });
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    const truncated = text.length > 200 ? text.substring(0, 200) + "..." : text;
+    throw new AuthError(`Token refresh failed (${res.status}): ${truncated}`);
+  }
+  const data = await res.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token ?? refreshToken2,
+    expiresAt: Math.floor(Date.now() / 1e3) + Number(data.expires_in),
+    scope: data.scope
+  };
+}
+function startOAuthCallbackServer(clientId, clientSecret, expectedState) {
+  return waitForAuthCode(expectedState).then(
+    (code) => exchangeCodeForToken(code, clientId, clientSecret)
+  );
+}
+async function revokeToken(token, clientId, clientSecret) {
+  try {
+    const res = await fetch("https://auth.worksmobile.com/oauth2/v2.0/revoke", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        token,
+        client_id: clientId,
+        client_secret: clientSecret
+      }).toString()
+    });
+    if (!res.ok && process.env["NWORKS_VERBOSE"] === "1") {
+      console.error(`[nworks] Token revoke returned ${res.status}`);
+    }
+  } catch {
+  }
+}
+
+// src/auth/token-user.ts
+async function getValidUserToken(profile = "default") {
+  const cached = await loadUserToken(profile);
+  if (!cached) {
+    throw new AuthError(
+      "User OAuth token not found. Run `nworks login --user` first."
+    );
+  }
+  if (cached.expiresAt > Date.now() / 1e3 + 300) {
+    return cached.accessToken;
+  }
+  const refreshed = await refreshUserToken(cached.refreshToken, profile);
+  await saveUserToken(refreshed, profile);
+  return refreshed.accessToken;
+}
+
+// src/api/calendar.ts
+var BASE_URL2 = "https://www.worksapis.com/v1.0";
+async function authedFetch(url, init, profile) {
+  const token = await getValidUserToken(profile);
+  const headers = new Headers(init.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  return fetch(url, { ...init, headers });
+}
+async function handleError(res) {
+  if (res.status === 401) {
+    throw new AuthError("User token expired. Run `nworks login --user --scope calendar` again.");
+  }
+  let code = "UNKNOWN";
+  let description = `HTTP ${res.status}`;
+  try {
+    const body = await res.json();
+    code = body.code ?? code;
+    description = body.description ?? description;
+  } catch {
+  }
+  throw new ApiError(code, description, res.status);
+}
+function generateEventId() {
+  return `event-${randomUUID()}`;
+}
+function normalizeDateTime(dt) {
+  const match = dt.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2})([+-]\d{2}:\d{2}|Z)?$/);
+  if (match) {
+    return `${match[1]}:00${match[2] ?? ""}`;
+  }
+  return dt;
+}
+async function listEvents(fromDateTime, untilDateTime, userId = "me", profile = "default") {
+  const from = encodeURIComponent(fromDateTime);
+  const until = encodeURIComponent(untilDateTime);
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events?fromDateTime=${from}&untilDateTime=${until}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError(res);
+  const data = await res.json();
+  return { events: data.events ?? [] };
+}
+async function listCalendars(userId = "me", profile = "default") {
+  const calendars = [];
+  let cursor;
+  do {
+    const params = new URLSearchParams();
+    params.set("count", "50");
+    if (cursor) params.set("cursor", cursor);
+    const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar-personals?${params.toString()}`;
+    if (process.env["NWORKS_VERBOSE"] === "1") {
+      console.error(`[nworks] GET ${url}`);
+    }
+    const res = await authedFetch(url, { method: "GET" }, profile);
+    if (!res.ok) return handleError(res);
+    const data = await res.json();
+    calendars.push(...data.calendarPersonals ?? []);
+    cursor = data.responseMetaData?.nextCursor || void 0;
+  } while (cursor);
+  return calendars;
+}
+async function listEventsInCalendar(calendarId, fromDateTime, untilDateTime, userId = "me", profile = "default") {
+  const from = encodeURIComponent(fromDateTime);
+  const until = encodeURIComponent(untilDateTime);
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendars/${sanitizePathSegment(calendarId)}/events?fromDateTime=${from}&untilDateTime=${until}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError(res);
+  const data = await res.json();
+  return { events: data.events ?? [] };
+}
+async function listAllEvents(fromDateTime, untilDateTime, userId = "me", profile = "default") {
+  let calendars;
+  try {
+    calendars = await listCalendars(userId, profile);
+  } catch (err) {
+    if (process.env["NWORKS_VERBOSE"] === "1") {
+      console.error(`[nworks] listCalendars failed, falling back to default calendar: ${String(err)}`);
+    }
+    calendars = [];
+  }
+  if (calendars.length === 0) {
+    const result = await listEvents(fromDateTime, untilDateTime, userId, profile);
+    const events = result.events.flatMap(
+      (e) => e.eventComponents.map((c) => ({ ...c, calendarId: "", calendarName: "" }))
+    );
+    return { events, calendarCount: 0, skippedCalendars: [] };
+  }
+  const skippedCalendars = [];
+  const perCalendar = await Promise.all(
+    calendars.map(async (cal) => {
+      try {
+        const result = await listEventsInCalendar(
+          cal.calendarId,
+          fromDateTime,
+          untilDateTime,
+          userId,
+          profile
+        );
+        return result.events.flatMap(
+          (e) => e.eventComponents.map((c) => ({
+            ...c,
+            calendarId: cal.calendarId,
+            calendarName: cal.calendarName
+          }))
+        );
+      } catch (err) {
+        skippedCalendars.push(cal.calendarName || cal.calendarId);
+        if (process.env["NWORKS_VERBOSE"] === "1") {
+          console.error(`[nworks] calendar ${cal.calendarId} events failed: ${String(err)}`);
+        }
+        return [];
+      }
+    })
+  );
+  return { events: perCalendar.flat(), calendarCount: calendars.length, skippedCalendars };
+}
+async function createEvent(opts) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const timeZone = opts.timeZone ?? "Asia/Seoul";
+  const eventId = generateEventId();
+  const eventComponent = {
+    eventId,
+    summary: opts.summary,
+    start: { dateTime: normalizeDateTime(opts.start), timeZone },
+    end: { dateTime: normalizeDateTime(opts.end), timeZone }
+  };
+  if (opts.description) eventComponent.description = opts.description;
+  if (opts.location) eventComponent.location = opts.location;
+  if (opts.transparency) eventComponent.transparency = opts.transparency;
+  if (opts.visibility) eventComponent.visibility = opts.visibility;
+  if (opts.attendees) {
+    eventComponent.attendees = opts.attendees.map((a) => ({
+      email: a.email,
+      displayName: a.displayName ?? "",
+      partstat: "NEEDS-ACTION",
+      isOptional: false,
+      isResource: false
+    }));
+  }
+  const body = {
+    eventComponents: [eventComponent],
+    sendNotification: opts.sendNotification ?? false
+  };
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
+  }
+  const res = await authedFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (res.status === 201) {
+    return await res.json();
+  }
+  if (!res.ok) return handleError(res);
+  return await res.json();
+}
+async function getEvent(eventId, userId = "me", profile = "default") {
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(eventId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError(res);
+  const data = await res.json();
+  const event = data.eventComponents[0];
+  if (!event) throw new ApiError("NOT_FOUND", "Event not found", 404);
+  return event;
+}
+async function updateEvent(opts) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const timeZone = opts.timeZone ?? "Asia/Seoul";
+  const existing = await getEvent(opts.eventId, userId, profile);
+  const eventComponent = {
+    eventId: opts.eventId,
+    summary: opts.summary ?? existing.summary,
+    start: opts.start ? { dateTime: normalizeDateTime(opts.start), timeZone } : existing.start,
+    end: opts.end ? { dateTime: normalizeDateTime(opts.end), timeZone } : existing.end
+  };
+  if (opts.description !== void 0) eventComponent.description = opts.description;
+  else if (existing.description) eventComponent.description = existing.description;
+  if (opts.location !== void 0) eventComponent.location = opts.location;
+  else if (existing.location) eventComponent.location = existing.location;
+  if (opts.transparency !== void 0) eventComponent.transparency = opts.transparency;
+  if (opts.visibility !== void 0) eventComponent.visibility = opts.visibility;
+  if (opts.attendees !== void 0) {
+    eventComponent.attendees = opts.attendees.map((a) => ({
+      email: a.email,
+      displayName: a.displayName ?? "",
+      partstat: "NEEDS-ACTION",
+      isOptional: false,
+      isResource: false
+    }));
+  } else if (existing.attendees) {
+    eventComponent.attendees = existing.attendees;
+  }
+  const body = {
+    eventComponents: [eventComponent],
+    sendNotification: opts.sendNotification ?? false
+  };
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(opts.eventId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] PUT ${url}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
+  }
+  const res = await authedFetch(
+    url,
+    {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (!res.ok) return handleError(res);
+}
+async function deleteEvent(eventId, userId = "me", sendNotification = false, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("sendNotification", String(sendNotification));
+  const url = `${BASE_URL2}/users/${sanitizePathSegment(userId)}/calendar/events/${sanitizePathSegment(eventId)}?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] DELETE ${url}`);
+  }
+  const res = await authedFetch(url, { method: "DELETE" }, profile);
+  if (res.status === 204) return;
+  if (!res.ok) return handleError(res);
+}
+
+// src/api/drive.ts
+import { readFile as readFile3, stat as stat2 } from "fs/promises";
+import { basename as basename2 } from "path";
+var BASE_URL3 = "https://www.worksapis.com/v1.0";
+var MAX_UPLOAD_SIZE = 100 * 1024 * 1024;
+var ALLOWED_HOSTS = [
+  "storage.worksmobile.com",
+  "www.worksapis.com",
+  "worksapis.com"
+];
+async function authedFetch2(url, init, profile) {
+  const token = await getValidUserToken(profile);
+  const headers = new Headers(init.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  return fetch(url, { ...init, headers });
+}
+async function handleError2(res) {
+  if (res.status === 401) {
+    throw new AuthError("User token expired. Run `nworks login --user --scope file` again.");
+  }
+  let code = "UNKNOWN";
+  let description = `HTTP ${res.status}`;
+  try {
+    const body = await res.json();
+    code = body.code ?? code;
+    description = body.description ?? description;
+  } catch {
+  }
+  throw new ApiError(code, description, res.status);
+}
+async function listFiles(userId = "me", folderId, count = 20, cursor, profile = "default") {
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const path = folderId ? `${base}/${sanitizePathSegment(folderId)}/children` : base;
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${path}?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch2(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError2(res);
+  const data = await res.json();
+  return { files: data.files ?? [], responseMetaData: data.responseMetaData };
+}
+async function uploadFile(localPath, userId = "me", folderId, overwrite = false, profile = "default") {
+  const fileName = basename2(localPath);
+  const safeName = sanitizeFileName(fileName);
+  const fileStat = await stat2(localPath);
+  const fileSize = fileStat.size;
+  if (fileSize > MAX_UPLOAD_SIZE) {
+    throw new ApiError("FILE_TOO_LARGE", `File size (${fileSize} bytes) exceeds maximum allowed (${MAX_UPLOAD_SIZE} bytes)`, 413);
+  }
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const createUrl = folderId ? `${base}/${sanitizePathSegment(folderId)}` : base;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${createUrl} (create upload URL)`);
+  }
+  const createRes = await authedFetch2(
+    createUrl,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ fileName, fileSize, overwrite })
+    },
+    profile
+  );
+  if (!createRes.ok) return handleError2(createRes);
+  const { uploadUrl } = await createRes.json();
+  validateRedirectUrl(uploadUrl, ALLOWED_HOSTS);
+  const fileBuffer = await readFile3(localPath);
+  const boundary = `----nworks${Date.now()}`;
+  const header = Buffer.from(
+    `--${boundary}\r
+Content-Disposition: form-data; name="Filedata"; filename="${safeName}"\r
+Content-Type: application/octet-stream\r
+\r
+`
+  );
+  const footer = Buffer.from(`\r
+--${boundary}--\r
+`);
+  const body = Buffer.concat([header, fileBuffer, footer]);
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${uploadUrl} (upload content, ${fileSize} bytes)`);
+  }
+  const uploadRes = await authedFetch2(
+    uploadUrl,
+    {
+      method: "POST",
+      headers: { "Content-Type": `multipart/form-data; boundary=${boundary}` },
+      body
+    },
+    profile
+  );
+  if (!uploadRes.ok) return handleError2(uploadRes);
+  return await uploadRes.json();
+}
+async function uploadBuffer(fileBuffer, fileName, userId = "me", folderId, overwrite = false, profile = "default") {
+  const fileSize = fileBuffer.length;
+  if (fileSize > MAX_UPLOAD_SIZE) {
+    throw new ApiError("FILE_TOO_LARGE", `File size (${fileSize} bytes) exceeds maximum allowed (${MAX_UPLOAD_SIZE} bytes)`, 413);
+  }
+  const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
+  const createUrl = folderId ? `${base}/${sanitizePathSegment(folderId)}` : base;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${createUrl} (create upload URL for buffer)`);
+  }
+  const createRes = await authedFetch2(
+    createUrl,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ fileName, fileSize, overwrite })
+    },
+    profile
+  );
+  if (!createRes.ok) return handleError2(createRes);
+  const { uploadUrl } = await createRes.json();
+  validateRedirectUrl(uploadUrl, ALLOWED_HOSTS);
+  const boundary = `----nworks${Date.now()}`;
+  const header = Buffer.from(
+    `--${boundary}\r
+Content-Disposition: form-data; name="Filedata"; filename="${sanitizeFileName(fileName)}"\r
+Content-Type: application/octet-stream\r
+\r
+`
+  );
+  const footer = Buffer.from(`\r
+--${boundary}--\r
+`);
+  const body = Buffer.concat([header, fileBuffer, footer]);
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${uploadUrl} (upload buffer, ${fileSize} bytes)`);
+  }
+  const uploadRes = await authedFetch2(
+    uploadUrl,
+    {
+      method: "POST",
+      headers: { "Content-Type": `multipart/form-data; boundary=${boundary}` },
+      body
+    },
+    profile
+  );
+  if (!uploadRes.ok) return handleError2(uploadRes);
+  return await uploadRes.json();
+}
+async function downloadFile(fileId, userId = "me", profile = "default") {
+  const url = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files/${sanitizePathSegment(fileId)}/download`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url} (get download URL)`);
+  }
+  const redirectRes = await authedFetch2(
+    url,
+    { method: "GET", redirect: "manual" },
+    profile
+  );
+  if (redirectRes.status === 401) {
+    throw new AuthError("User token expired. Run `nworks login --user --scope file` again.");
+  }
+  const location = redirectRes.headers.get("location");
+  if (!location) {
+    if (!redirectRes.ok) return handleError2(redirectRes);
+    throw new ApiError("NO_REDIRECT", "No download URL returned", redirectRes.status);
+  }
+  const safeLocation = validateRedirectUrl(location, ALLOWED_HOSTS);
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${safeLocation} (download content)`);
+  }
+  const downloadRes = await fetch(safeLocation, { method: "GET" });
+  if (!downloadRes.ok) return handleError2(downloadRes);
+  const arrayBuffer = await downloadRes.arrayBuffer();
+  const buffer = Buffer.from(arrayBuffer);
+  const disposition = downloadRes.headers.get("content-disposition");
+  let fileName;
+  if (disposition) {
+    const match = disposition.match(/filename\*?=(?:UTF-8''|"?)([^";]+)/i);
+    if (match?.[1]) {
+      fileName = decodeURIComponent(match[1].replace(/"/g, ""));
+    }
+  }
+  return { buffer, fileName };
+}
+
+// src/api/mail.ts
+var BASE_URL4 = "https://www.worksapis.com/v1.0";
+async function authedFetch3(url, init, profile) {
+  const token = await getValidUserToken(profile);
+  const headers = new Headers(init.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  return fetch(url, { ...init, headers });
+}
+async function handleError3(res) {
+  if (res.status === 401) {
+    throw new AuthError("User token expired. Run `nworks login --user --scope mail` again.");
+  }
+  let code = "UNKNOWN";
+  let description = `HTTP ${res.status}`;
+  try {
+    const body = await res.json();
+    code = body.code ?? code;
+    description = body.description ?? description;
+  } catch {
+  }
+  throw new ApiError(code, description, res.status);
+}
+async function sendMail(opts) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+  }
+  const body = {
+    to: opts.to,
+    subject: opts.subject
+  };
+  if (opts.body !== void 0) body.body = opts.body;
+  if (opts.cc) body.cc = opts.cc;
+  if (opts.bcc) body.bcc = opts.bcc;
+  if (opts.contentType) body.contentType = opts.contentType;
+  const res = await authedFetch3(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (res.status === 202) return;
+  if (!res.ok) return handleError3(res);
+}
+async function listMails(folderId = 0, userId = "me", count = 30, cursor, isUnread, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  if (isUnread) params.set("isUnread", "true");
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/mailfolders/${sanitizePathSegment(String(folderId))}/children?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch3(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError3(res);
+  const data = await res.json();
+  return {
+    mails: data.mails ?? [],
+    unreadCount: data.unreadCount,
+    folderName: data.folderName,
+    totalCount: data.totalCount,
+    responseMetaData: data.responseMetaData
+  };
+}
+async function readMail(mailId, userId = "me", profile = "default") {
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/${sanitizePathSegment(String(mailId))}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch3(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError3(res);
+  return await res.json();
+}
+async function downloadAttachment(mailId, attachmentId, userId = "me", profile = "default") {
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/${sanitizePathSegment(String(mailId))}/attachments/${sanitizePathSegment(String(attachmentId))}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch3(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError3(res);
+  const data = await res.json();
+  if (!data.data) {
+    throw new ApiError("NO_ATTACHMENT_DATA", "Attachment response had no data", res.status);
+  }
+  return {
+    filename: data.filename ?? `attachment-${attachmentId}`,
+    buffer: Buffer.from(data.data, "base64")
+  };
+}
+
+// src/api/task.ts
+var BASE_URL5 = "https://www.worksapis.com/v1.0";
+async function authedFetch4(url, init, profile) {
+  const token = await getValidUserToken(profile);
+  const headers = new Headers(init.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  return fetch(url, { ...init, headers });
+}
+async function handleError4(res) {
+  if (res.status === 401) {
+    throw new AuthError("User token expired. Run `nworks login --user --scope task` again.");
+  }
+  let code = "UNKNOWN";
+  let description = `HTTP ${res.status}`;
+  try {
+    const body = await res.json();
+    code = body.code ?? code;
+    description = body.description ?? description;
+  } catch {
+  }
+  throw new ApiError(code, description, res.status);
+}
+async function resolveUserId(userId, profile) {
+  if (userId !== "me") return userId;
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}`;
+  const res = await authedFetch4(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError4(res);
+  const data = await res.json();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Resolved "me" \u2192 ${data.userId}`);
+  }
+  return data.userId;
+}
+async function listTasks(categoryId = "default", userId = "me", count = 50, cursor, status = "ALL", profile = "default") {
+  const params = new URLSearchParams();
+  params.set("categoryId", categoryId);
+  params.set("count", String(count));
+  params.set("status", status);
+  if (cursor) params.set("cursor", cursor);
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}/tasks?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch4(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError4(res);
+  const data = await res.json();
+  return { tasks: data.tasks ?? [], responseMetaData: data.responseMetaData };
+}
+async function createTask(opts) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const resolvedUserId = await resolveUserId(userId, profile);
+  const assignorId = opts.assignorId ?? resolvedUserId;
+  const assigneeIds = opts.assigneeIds ?? [resolvedUserId];
+  const body = {
+    assignorId,
+    assignees: assigneeIds.map((id) => ({ assigneeId: id, status: "TODO" })),
+    title: opts.title,
+    content: opts.content ?? "",
+    completionCondition: "ANY_ONE"
+  };
+  if (opts.dueDate) body.dueDate = opts.dueDate;
+  if (opts.categoryId) body.categoryId = opts.categoryId;
+  const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}/tasks`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
+  }
+  const res = await authedFetch4(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (res.status === 201) {
+    return await res.json();
+  }
+  if (!res.ok) return handleError4(res);
+  return await res.json();
+}
+async function updateTask(opts) {
+  const profile = opts.profile ?? "default";
+  const body = {};
+  if (opts.title !== void 0) body.title = opts.title;
+  if (opts.content !== void 0) body.content = opts.content;
+  if (opts.dueDate !== void 0) body.dueDate = opts.dueDate;
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(opts.taskId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] PATCH ${url}`);
+  }
+  const res = await authedFetch4(
+    url,
+    {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (!res.ok) return handleError4(res);
+  return await res.json();
+}
+async function completeTask(taskId, profile = "default") {
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}/complete`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+  }
+  const res = await authedFetch4(
+    url,
+    { method: "POST" },
+    profile
+  );
+  if (res.status === 204) return;
+  if (!res.ok) return handleError4(res);
+}
+async function incompleteTask(taskId, profile = "default") {
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}/incomplete`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+  }
+  const res = await authedFetch4(
+    url,
+    { method: "POST" },
+    profile
+  );
+  if (res.status === 204) return;
+  if (!res.ok) return handleError4(res);
+}
+async function deleteTask(taskId, profile = "default") {
+  const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] DELETE ${url}`);
+  }
+  const res = await authedFetch4(
+    url,
+    { method: "DELETE" },
+    profile
+  );
+  if (res.status === 204) return;
+  if (!res.ok) return handleError4(res);
+}
+
+// src/api/board.ts
+var BASE_URL6 = "https://www.worksapis.com/v1.0";
+async function authedFetch5(url, init, profile) {
+  const token = await getValidUserToken(profile);
+  const headers = new Headers(init.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  return fetch(url, { ...init, headers });
+}
+async function handleError5(res) {
+  if (res.status === 401) {
+    throw new AuthError("User token expired. Run `nworks login --user --scope board` again.");
+  }
+  let code = "UNKNOWN";
+  let description = `HTTP ${res.status}`;
+  try {
+    const body = await res.json();
+    code = body.code ?? code;
+    description = body.description ?? description;
+  } catch {
+  }
+  throw new ApiError(code, description, res.status);
+}
+function safeParseJson(text) {
+  const safe = text.replace(
+    /"((?:board|post|domain|user)Id)"\s*:\s*(\d{16,})/g,
+    '"$1":"$2"'
+  );
+  return JSON.parse(safe);
+}
+async function listBoards(count = 20, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${BASE_URL6}/boards?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch5(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError5(res);
+  const text = await res.text();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
+  }
+  const data = safeParseJson(text);
+  return { boards: data.boards ?? [], responseMetaData: data.responseMetaData };
+}
+async function listPosts(boardId, count = 20, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(boardId)}/posts?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch5(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError5(res);
+  const text = await res.text();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
+  }
+  const data = safeParseJson(text);
+  return { posts: data.posts ?? [], responseMetaData: data.responseMetaData };
+}
+async function readPost(boardId, postId, profile = "default") {
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(boardId)}/posts/${sanitizePathSegment(postId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await authedFetch5(url, { method: "GET" }, profile);
+  if (!res.ok) return handleError5(res);
+  const text = await res.text();
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
+  }
+  return safeParseJson(text);
+}
+async function createPost(opts) {
+  const profile = opts.profile ?? "default";
+  const body = {
+    title: opts.title,
+    body: opts.body ?? ""
+  };
+  if (opts.enableComment !== void 0) body.enableComment = opts.enableComment;
+  if (opts.sendNotifications !== void 0) body.sendNotifications = opts.sendNotifications;
+  const url = `${BASE_URL6}/boards/${sanitizePathSegment(opts.boardId)}/posts`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
+    console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
+  }
+  const res = await authedFetch5(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    profile
+  );
+  if (res.status === 201 || res.ok) {
+    const text = await res.text();
+    if (process.env["NWORKS_VERBOSE"] === "1") {
+      console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
+    }
+    return safeParseJson(text);
+  }
+  return handleError5(res);
+}
+
+// src/commands/doctor.ts
+import { Command } from "commander";
+import { existsSync as existsSync2 } from "fs";
+import { readFile as readFile4 } from "fs/promises";
+
+// src/output/format.ts
+function output(data, opts = {}) {
+  const useJson = opts.json || !process.stdout.isTTY;
+  if (useJson) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (Array.isArray(data)) {
+    printTable(data);
+  } else if (typeof data === "object" && data !== null) {
+    const record = data;
+    for (const value of Object.values(record)) {
+      if (Array.isArray(value) && value.length > 0) {
+        printTable(value);
+        return;
+      }
+    }
+    for (const [key, value] of Object.entries(record)) {
+      console.log(`  ${key}: ${String(value)}`);
+    }
+  } else {
+    console.log(String(data));
+  }
+}
+function printTable(rows) {
+  if (rows.length === 0) {
+    console.log("  (no data)");
+    return;
+  }
+  const first = rows[0];
+  const keys = Object.keys(first);
+  const widths = {};
+  for (const key of keys) {
+    widths[key] = key.length;
+  }
+  for (const row of rows) {
+    const record = row;
+    for (const key of keys) {
+      const len = String(record[key] ?? "").length;
+      if (len > (widths[key] ?? 0)) {
+        widths[key] = len;
+      }
+    }
+  }
+  const header = keys.map((k) => k.padEnd(widths[k] ?? 0)).join("  ");
+  const separator = keys.map((k) => "\u2500".repeat(widths[k] ?? 0)).join("\u2500\u2500");
+  console.log(`  ${header}`);
+  console.log(`  ${separator}`);
+  for (const row of rows) {
+    const record = row;
+    const line = keys.map((k) => String(record[k] ?? "").padEnd(widths[k] ?? 0)).join("  ");
+    console.log(`  ${line}`);
+  }
+}
+function errorOutput(error, opts = {}) {
+  const payload = {
+    success: false,
+    error: { code: error.code ?? "ERROR", message: error.message, hint: error.hint }
+  };
+  if (opts.json || !process.stderr.isTTY) {
+    console.error(JSON.stringify(payload, null, 2));
+  } else {
+    console.error(`  Error: ${error.message}`);
+    if (error.code) {
+      console.error(`  Code: ${error.code}`);
+    }
+    if (error.hint) {
+      console.error(`  \u2192 ${error.hint}`);
+    }
+  }
+}
+
+// src/utils/error-hints.ts
+var REQUIRED_SCOPES = {
+  calendar: "calendar",
+  "calendar.list": "calendar.read",
+  "calendar.create": "calendar calendar.read",
+  "calendar.update": "calendar calendar.read",
+  "calendar.delete": "calendar calendar.read",
+  mail: "mail",
+  "mail.send": "mail",
+  "mail.list": "mail.read",
+  "mail.read": "mail.read",
+  task: "task",
+  "task.list": "task.read",
+  "task.create": "task user.read",
+  "task.update": "task user.read",
+  "task.delete": "task user.read",
+  drive: "file",
+  "drive.list": "file.read",
+  "drive.upload": "file",
+  "drive.download": "file.read",
+  board: "board",
+  "board.list": "board.read",
+  "board.posts": "board.read",
+  "board.read": "board.read",
+  "board.create": "board"
+};
+var ERROR_HINTS_CLI = {
+  FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
+  ACCESS_DENIED: "\uC811\uADFC\uC774 \uAC70\uBD80\uB410\uC2B5\uB2C8\uB2E4. Admin\uC5D0\uC11C Bot\uC744 \uCD94\uAC00\uD588\uB294\uC9C0 \uD655\uC778\uD558\uC138\uC694.",
+  SERVICE_ACCOUNT_NOT_ALLOWED: "\uC11C\uBE44\uC2A4 \uACC4\uC815\uC73C\uB85C\uB294 \uC774 API\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. `nworks login --user`\uB85C User OAuth \uB85C\uADF8\uC778\uD558\uC138\uC694.",
+  UNAUTHORIZED: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. `nworks login`\uC73C\uB85C \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694."
+};
+var ERROR_HINTS_MCP = {
+  FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
+  ACCESS_DENIED: "\uC811\uADFC\uC774 \uAC70\uBD80\uB410\uC2B5\uB2C8\uB2E4. Admin\uC5D0\uC11C Bot\uC744 \uCD94\uAC00\uD588\uB294\uC9C0 \uD655\uC778\uD558\uC138\uC694.",
+  SERVICE_ACCOUNT_NOT_ALLOWED: "\uC11C\uBE44\uC2A4 \uACC4\uC815\uC73C\uB85C\uB294 \uC774 API\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. nworks_login_user tool\uB85C User OAuth \uB85C\uADF8\uC778\uC744 \uBA3C\uC800 \uD574\uC8FC\uC138\uC694.",
+  UNAUTHORIZED: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. nworks_login_user tool\uB85C \uB2E4\uC2DC \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uADF8\uB798\uB3C4 \uC548 \uB418\uBA74 nworks_setup tool\uB85C \uC7AC\uC124\uC815 \uD6C4 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694."
+};
+function cliErrorHint(err, area) {
+  if (err instanceof ApiError) {
+    const hint = ERROR_HINTS_CLI[err.code];
+    const scopeHint = area ? buildScopeHint(area, "cli") : "";
+    if (hint) {
+      return `[${err.code}] ${err.message}
+  \u2192 ${hint}${scopeHint}`;
+    }
+    return `[${err.code}] ${err.message}${scopeHint}`;
+  }
+  if (err instanceof AuthError) {
+    return `${err.message}
+  \u2192 ${ERROR_HINTS_CLI["UNAUTHORIZED"]}`;
+  }
+  return err.message;
+}
+function mcpErrorHint(err, area) {
+  if (err instanceof ApiError) {
+    const hint = ERROR_HINTS_MCP[err.code];
+    const scopeHint = area ? buildScopeHint(area, "mcp") : "";
+    if (hint) {
+      return `Error: [${err.code}] ${err.message}
+
+[\uC548\uB0B4] ${hint}${scopeHint}`;
+    }
+    return `Error: [${err.code}] ${err.message}${scopeHint}`;
+  }
+  if (err instanceof AuthError) {
+    return `Error: ${err.message}
+
+[\uC548\uB0B4] \uC778\uC99D \uC815\uBCF4\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4. nworks_setup tool\uC744 \uBA3C\uC800 \uD638\uCD9C\uD558\uC138\uC694 (Client ID \uD544\uC694, Client Secret\uC740 \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC5D0\uC11C \uC77D\uC74C). \uD658\uACBD\uBCC0\uC218\uAC00 \uC5C6\uC73C\uBA74 \uC0AC\uC6A9\uC790\uC5D0\uAC8C MCP \uC124\uC815 \uD30C\uC77C\uC758 env \uD544\uB4DC\uC5D0 NWORKS_CLIENT_SECRET \uCD94\uAC00\uB97C \uC548\uB0B4\uD558\uC138\uC694.`;
+  }
+  return `Error: ${err.message}`;
+}
+function buildScopeHint(area, mode) {
+  const scope = REQUIRED_SCOPES[area];
+  if (!scope) return "";
+  const scopes = scope.split(" ").join(", ");
+  if (mode === "cli") {
+    return `
+  \u2192 \uC774 \uBA85\uB839\uC5B4\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \`nworks login --user --scope "${scope}"\`\uB97C \uC2E4\uD589\uD558\uC138\uC694.`;
+  }
+  return `
+  \u2192 \uC774 API\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. nworks_login_user tool\uB85C \uB85C\uADF8\uC778\uD558\uC138\uC694 (scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uC54A\uC73C\uBA74 \uC804\uCCB4 \uAD8C\uD55C\uC774 \uC790\uB3D9 \uD3EC\uD568\uB429\uB2C8\uB2E4).`;
+}
+
+// src/output/cli-error.ts
+function cliError(err, opts = {}, area) {
+  const error = err;
+  if (error instanceof ApiError) {
+    errorOutput(
+      {
+        code: error.code,
+        message: error.message,
+        hint: cliErrorHint(err, area).split("\n").slice(1).map((l) => l.replace(/^\s+→\s*/, "")).join(" ")
+      },
+      opts
+    );
+  } else if (error instanceof AuthError) {
+    errorOutput(
+      {
+        code: "AUTH_ERROR",
+        message: error.message,
+        hint: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. `nworks login`\uC73C\uB85C \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694."
+      },
+      opts
+    );
+  } else {
+    errorOutput({ message: error.message }, opts);
+  }
+  process.exitCode = 1;
+}
+
+// src/commands/doctor.ts
+async function runChecks(profile) {
+  const results = [];
+  let creds;
+  try {
+    creds = await loadCredentials(profile);
+    results.push({ check: "credentials", status: "OK", detail: `clientId: ${creds.clientId}` });
+  } catch {
+    results.push({ check: "credentials", status: "FAIL", detail: "\uC778\uC99D \uC815\uBCF4 \uC5C6\uC74C. CLI: `nworks login --user` / MCP: nworks_setup tool \uC0AC\uC6A9 (\uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET \uD544\uC694)" });
+    return results;
+  }
+  if (hasServiceAccountCreds(creds)) {
+    results.push({ check: "serviceAccount", status: "OK", detail: creds.serviceAccount });
+  } else {
+    results.push({ check: "serviceAccount", status: "SKIP", detail: "\uBBF8\uC124\uC815 (\uBD07 \uBA54\uC2DC\uC9C0 \uC0AC\uC6A9 \uC2DC \uD544\uC694)" });
+  }
+  if (creds.privateKeyPath) {
+    if (existsSync2(creds.privateKeyPath)) {
+      try {
+        await readFile4(creds.privateKeyPath, "utf-8");
+        results.push({ check: "privateKey", status: "OK", detail: creds.privateKeyPath });
+      } catch {
+        results.push({ check: "privateKey", status: "FAIL", detail: `\uC77D\uAE30 \uBD88\uAC00: ${creds.privateKeyPath}` });
+      }
+    } else {
+      results.push({ check: "privateKey", status: "FAIL", detail: `\uD30C\uC77C \uC5C6\uC74C: ${creds.privateKeyPath}` });
+    }
+  } else {
+    results.push({ check: "privateKey", status: "SKIP", detail: "\uBBF8\uC124\uC815" });
+  }
+  if (creds.botId) {
+    results.push({ check: "botId", status: "OK", detail: creds.botId });
+  } else {
+    results.push({ check: "botId", status: "SKIP", detail: "\uBBF8\uC124\uC815 (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)" });
+  }
+  const token = await loadToken(profile);
+  if (token) {
+    const valid = token.expiresAt > Date.now() / 1e3;
+    results.push({
+      check: "serviceToken",
+      status: valid ? "OK" : "EXPIRED",
+      detail: valid ? `\uB9CC\uB8CC: ${new Date(token.expiresAt * 1e3).toISOString()}` : `\uB9CC\uB8CC\uB428: ${new Date(token.expiresAt * 1e3).toISOString()}`
+    });
+  } else {
+    results.push({ check: "serviceToken", status: "SKIP", detail: "\uD1A0\uD070 \uC5C6\uC74C" });
+  }
+  const userToken = await loadUserToken(profile);
+  if (userToken) {
+    const valid = userToken.expiresAt > Date.now() / 1e3;
+    results.push({
+      check: "userOAuth",
+      status: valid ? "OK" : "EXPIRED",
+      detail: valid ? `scope: ${userToken.scope} | \uB9CC\uB8CC: ${new Date(userToken.expiresAt * 1e3).toISOString()}` : `\uB9CC\uB8CC\uB428 | scope: ${userToken.scope}`
+    });
+  } else {
+    results.push({ check: "userOAuth", status: "SKIP", detail: "\uD1A0\uD070 \uC5C6\uC74C. `nworks login --user` \uD544\uC694" });
+  }
+  if (hasServiceAccountCreds(creds) && token && token.expiresAt > Date.now() / 1e3) {
+    try {
+      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
+        headers: { Authorization: `Bearer ${token.accessToken}` }
+      });
+      if (res.ok) {
+        results.push({ check: "apiConnection", status: "OK", detail: "NAVER WORKS API \uC5F0\uACB0 \uC131\uACF5" });
+      } else {
+        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
+      }
+    } catch (e) {
+      results.push({ check: "apiConnection", status: "FAIL", detail: `\uC5F0\uACB0 \uC2E4\uD328: ${e.message}` });
+    }
+  } else if (userToken && userToken.expiresAt > Date.now() / 1e3) {
+    try {
+      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
+        headers: { Authorization: `Bearer ${userToken.accessToken}` }
+      });
+      if (res.ok) {
+        results.push({ check: "apiConnection", status: "OK", detail: "NAVER WORKS API \uC5F0\uACB0 \uC131\uACF5" });
+      } else {
+        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
+      }
+    } catch (e) {
+      results.push({ check: "apiConnection", status: "FAIL", detail: `\uC5F0\uACB0 \uC2E4\uD328: ${e.message}` });
+    }
+  } else {
+    results.push({ check: "apiConnection", status: "SKIP", detail: "\uC720\uD6A8\uD55C \uD1A0\uD070 \uC5C6\uC74C \u2014 API \uD14C\uC2A4\uD2B8 \uAC74\uB108\uB700" });
+  }
+  return results;
+}
+var doctorCommand = new Command("doctor").description("Check nworks configuration and connectivity").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const results = await runChecks(opts.profile);
+    if (opts.json || !process.stdout.isTTY) {
+      output(results, opts);
+    } else {
+      console.log("\n  nworks doctor\n");
+      for (const r of results) {
+        const icon = r.status === "OK" ? "\u2705" : r.status === "SKIP" ? "\u2796" : "\u274C";
+        console.log(`  ${icon} ${r.check.padEnd(16)} ${r.detail}`);
+      }
+      console.log();
+    }
+  } catch (err) {
+    cliError(err, opts);
+  }
+});
+
+// src/utils/datetime.ts
+function todaySeoulRange() {
+  const ymd = new Intl.DateTimeFormat("en-CA", {
+    timeZone: "Asia/Seoul",
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  }).format(/* @__PURE__ */ new Date());
+  return {
+    from: `${ymd}T00:00:00+09:00`,
+    until: `${ymd}T23:59:59+09:00`
+  };
+}
+
+// src/utils/html-to-text.ts
+var HTML_TAG = /<\/?(?:html|body|head|div|p|br|span|table|tr|td|th|thead|tbody|tfoot|a|img|ul|ol|li|h[1-6]|b|i|u|strong|em|blockquote|font|style|script|noscript|title|meta|center|hr|pre|section|article|nav|header|footer|main|figure|figcaption|small|sub|sup|mark|code)\b/i;
+var NAMED_ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: " ",
+  copy: "\xA9",
+  reg: "\xAE",
+  trade: "\u2122",
+  hellip: "\u2026",
+  mdash: "\u2014",
+  ndash: "\u2013",
+  lsquo: "\u2018",
+  rsquo: "\u2019",
+  ldquo: "\u201C",
+  rdquo: "\u201D",
+  bull: "\u2022",
+  middot: "\xB7",
+  euro: "\u20AC",
+  pound: "\xA3",
+  cent: "\xA2"
+};
+function decodeEntities(s) {
+  return s.replace(/&(#x?[0-9a-f]+|[a-z][a-z0-9]*);/gi, (m, ent) => {
+    if (ent[0] === "#") {
+      const isHex = ent[1] === "x" || ent[1] === "X";
+      const code = isHex ? parseInt(ent.slice(2), 16) : parseInt(ent.slice(1), 10);
+      if (Number.isNaN(code)) return m;
+      try {
+        return String.fromCodePoint(code);
+      } catch {
+        return m;
+      }
+    }
+    const named = NAMED_ENTITIES[ent.toLowerCase()];
+    return named ?? m;
+  });
+}
+function htmlToText(input) {
+  if (!input) return "";
+  if (!HTML_TAG.test(input)) return input.trim();
+  let s = input;
+  s = s.replace(/<!--[\s\S]*?-->/g, "");
+  s = s.replace(/<(script|style|head|noscript|title)\b[^>]*>[\s\S]*?<\/\1>/gi, "");
+  s = s.replace(/<br\s*\/?>/gi, "\n");
+  s = s.replace(/<li\b[^>]*>/gi, "\n\u2022 ");
+  s = s.replace(/<\/(td|th)>/gi, " ");
+  s = s.replace(
+    /<\/(p|div|tr|h[1-6]|table|ul|ol|blockquote|section|article|header|footer|pre)>/gi,
+    "\n"
+  );
+  s = s.replace(/<[^>]+>/g, "");
+  s = decodeEntities(s);
+  s = s.replace(/\r\n?/g, "\n").replace(/[^\S\n]+/g, " ").replace(/ *\n */g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+  return s;
+}
+
+// src/utils/attachment-text.ts
+var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
+  "txt",
+  "text",
+  "csv",
+  "tsv",
+  "log",
+  "md",
+  "markdown",
+  "json",
+  "xml",
+  "yaml",
+  "yml",
+  "ics",
+  "vcs",
+  "vcf",
+  "srt",
+  "vtt",
+  "ini",
+  "conf",
+  "cfg",
+  "properties",
+  "env"
+]);
+var HTML_EXTENSIONS = /* @__PURE__ */ new Set(["html", "htm", "xhtml"]);
+function extensionOf(filename) {
+  const dot = filename.lastIndexOf(".");
+  return dot >= 0 ? filename.slice(dot + 1).toLowerCase() : "";
+}
+function attachmentTextOrNull(filename, buffer) {
+  const ext = extensionOf(filename);
+  if (HTML_EXTENSIONS.has(ext)) {
+    return htmlToText(buffer.toString("utf8"));
+  }
+  if (TEXT_EXTENSIONS.has(ext)) {
+    return buffer.toString("utf8");
+  }
+  return null;
+}
+
+// src/mcp/tools.ts
+function registerTools(server) {
+  server.tool(
+    "nworks_setup",
+    `NAVER WORKS API \uC778\uC99D \uC815\uBCF4\uB97C \uC124\uC815\uD569\uB2C8\uB2E4.
+
+\u25A0 \uC0AC\uC804 \uC900\uBE44 (\uC0AC\uC6A9\uC790\uAC00 \uC9C1\uC811 \uD574\uC57C \uD568):
+  1. https://dev.worksmobile.com \uC5D0\uC11C \uC571 \uC0DD\uC131 \uD6C4 Client ID\uC640 Client Secret\uC744 \uBC1C\uAE09\uBC1B\uC2B5\uB2C8\uB2E4.
+  2. MCP \uC124\uC815 \uD30C\uC77C(\uC608: claude_desktop_config.json)\uC758 nworks \uC11C\uBC84\uC5D0 env \uD544\uB4DC\uB97C \uCD94\uAC00\uD569\uB2C8\uB2E4:
+     { "env": { "NWORKS_CLIENT_SECRET": "<\uBC1C\uAE09\uBC1B\uC740 Client Secret>" } }
+  3. MCP \uD074\uB77C\uC774\uC5B8\uD2B8(\uC608: Claude Desktop)\uB97C \uC7AC\uC2DC\uC791\uD569\uB2C8\uB2E4.
+
+\u25A0 \uC774 tool\uC758 \uC5ED\uD560:
+  - clientId(\uD544\uC218)\uC640 serviceAccount, botId, domainId(\uC120\uD0DD)\uB97C \uD30C\uB77C\uBBF8\uD130\uB85C \uBC1B\uC544 \uC800\uC7A5\uD569\uB2C8\uB2E4.
+  - Client Secret\uC740 \uBCF4\uC548\uC744 \uC704\uD574 \uD30C\uB77C\uBBF8\uD130\uB85C \uBC1B\uC9C0 \uC54A\uC73C\uBA70, \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC5D0\uC11C \uC790\uB3D9\uC73C\uB85C \uC77D\uC2B5\uB2C8\uB2E4.
+  - Service Account \uC0AC\uC6A9 \uC2DC \uD658\uACBD\uBCC0\uC218 NWORKS_PRIVATE_KEY_PATH\uB3C4 \uD544\uC694\uD569\uB2C8\uB2E4.
+
+\u25A0 \uC124\uC815 \uD6C4 \uB2E4\uC74C \uB2E8\uACC4:
+  - \uCE98\uB9B0\uB354/\uBA54\uC77C/\uB4DC\uB77C\uC774\uBE0C/\uD560\uC77C/\uAC8C\uC2DC\uD310 \u2192 nworks_login_user tool\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778 \uD544\uC694
+  - \uBA54\uC2DC\uC9C0/\uAD6C\uC131\uC6D0\uC870\uD68C \u2192 Service Account \uC778\uC99D (serviceAccount + botId + NWORKS_PRIVATE_KEY_PATH)
+
+\u25A0 \uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC774 \uC5C6\uC73C\uBA74 \uC774 tool\uC740 \uC2E4\uD328\uD569\uB2C8\uB2E4. \uC2E4\uD328 \uC2DC \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC704 \uC0AC\uC804 \uC900\uBE44 \uB2E8\uACC4\uB97C \uC548\uB0B4\uD558\uC138\uC694.
+
+OAuth Redirect URI: http://localhost:9876/callback`,
+    {
+      clientId: z.string().describe("Client ID (Developer Console\uC5D0\uC11C \uBC1C\uAE09)"),
+      serviceAccount: z.string().optional().describe("Service Account ID (\uC608: xxxxx.serviceaccount@domain)"),
+      botId: z.string().optional().describe("Bot ID (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)"),
+      domainId: z.string().optional().describe("Domain ID")
+    },
+    async ({ clientId, serviceAccount, botId, domainId }) => {
+      try {
+        const resolvedSecret = process.env["NWORKS_CLIENT_SECRET"];
+        if (!resolvedSecret) {
+          return {
+            content: [{ type: "text", text: JSON.stringify({
+              error: true,
+              message: "\uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET\uC774 \uC124\uC815\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.",
+              userAction: [
+                "1. https://dev.worksmobile.com \uC5D0\uC11C \uC571\uC758 Client Secret\uC744 \uD655\uC778\uD569\uB2C8\uB2E4.",
+                "2. MCP \uC124\uC815 \uD30C\uC77C(\uC608: claude_desktop_config.json)\uC744 \uC5F4\uACE0, nworks \uC11C\uBC84 \uC124\uC815\uC5D0 \uB2E4\uC74C\uC744 \uCD94\uAC00\uD569\uB2C8\uB2E4:",
+                '   "env": { "NWORKS_CLIENT_SECRET": "<Client Secret>" }',
+                "3. MCP \uD074\uB77C\uC774\uC5B8\uD2B8(\uC608: Claude Desktop)\uB97C \uC7AC\uC2DC\uC791\uD569\uB2C8\uB2E4.",
+                "4. \uC7AC\uC2DC\uC791 \uD6C4 \uB2E4\uC2DC \uC2DC\uB3C4\uD574\uC8FC\uC138\uC694."
+              ],
+              configExample: '{ "mcpServers": { "nworks": { "command": "npx", "args": ["-y", "nworks", "mcp"], "env": { "NWORKS_CLIENT_SECRET": "<Client Secret>" } } } }'
+            }) }],
+            isError: true
+          };
+        }
+        const resolvedPrivateKeyPath = process.env["NWORKS_PRIVATE_KEY_PATH"];
+        await saveCredentials({
+          clientId,
+          clientSecret: resolvedSecret,
+          serviceAccount,
+          privateKeyPath: resolvedPrivateKeyPath,
+          botId,
+          domainId
+        });
+        const nextSteps = [];
+        if (serviceAccount && resolvedPrivateKeyPath && botId) {
+          nextSteps.push("Service Account \uC778\uC99D \uC900\uBE44 \uC644\uB8CC \u2014 \uBD07 \uBA54\uC2DC\uC9C0 \uB4F1 \uBC14\uB85C \uC0AC\uC6A9 \uAC00\uB2A5");
+        } else if (serviceAccount && botId && !resolvedPrivateKeyPath) {
+          nextSteps.push('NWORKS_PRIVATE_KEY_PATH \uD658\uACBD\uBCC0\uC218\uAC00 \uC124\uC815\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. Service Account \uC778\uC99D\uC5D0\uB294 Private Key \uD30C\uC77C \uACBD\uB85C\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC548\uB0B4\uD558\uC138\uC694: (1) Developer Console(https://dev.worksmobile.com)\uC5D0\uC11C Private Key\uB97C \uB2E4\uC6B4\uB85C\uB4DC (2) MCP \uC124\uC815 \uD30C\uC77C\uC758 env\uC5D0 NWORKS_PRIVATE_KEY_PATH\uB97C \uCD94\uAC00 (\uC608: "NWORKS_PRIVATE_KEY_PATH": "C:/keys/private.key") (3) MCP \uD074\uB77C\uC774\uC5B8\uD2B8 \uC7AC\uC2DC\uC791');
+        }
+        nextSteps.push("User OAuth\uAC00 \uD544\uC694\uD55C API\uB294 nworks_login_user tool\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uC744 \uC9C4\uD589\uD558\uC138\uC694");
+        const mask = (s) => s.length <= 4 ? "****" : `****${s.slice(-Math.min(4, Math.floor(s.length / 3)))}`;
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                success: true,
+                message: "\uC778\uC99D \uC815\uBCF4\uAC00 \uC800\uC7A5\uB418\uC5C8\uC2B5\uB2C8\uB2E4.",
+                nextSteps,
+                clientId: mask(clientId),
+                clientSecret: `${mask(resolvedSecret)} (\uD658\uACBD\uBCC0\uC218)`,
+                serviceAccount: serviceAccount ?? null,
+                privateKeyPath: resolvedPrivateKeyPath ? `${mask(resolvedPrivateKeyPath)} (\uD658\uACBD\uBCC0\uC218)` : null,
+                botId: botId ?? null
+              })
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_message_send",
+    "NAVER WORKS \uBA54\uC2DC\uC9C0\uB97C \uC804\uC1A1\uD569\uB2C8\uB2E4 (\uBD07\uC774 \uC0AC\uC6A9\uC790 \uB610\uB294 \uCC44\uB110\uC5D0 \uBC1C\uC1A1). Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup\uC5D0\uC11C serviceAccount, botId \uC124\uC815 + \uD658\uACBD\uBCC0\uC218 NWORKS_PRIVATE_KEY_PATH \uD544\uC694. User OAuth \uBD88\uD544\uC694)",
+    {
+      to: z.string().optional().describe("\uC218\uC2E0\uC790 userId (channel\uACFC \uD0DD 1). nworks_directory_members\uB85C userId \uC870\uD68C \uAC00\uB2A5"),
+      channel: z.string().optional().describe("\uCC44\uB110 channelId (to\uC640 \uD0DD 1). nworks_message_members\uB85C \uCC44\uB110 \uAD6C\uC131\uC6D0 \uD655\uC778 \uAC00\uB2A5"),
+      text: z.string().describe("\uBA54\uC2DC\uC9C0 \uBCF8\uBB38"),
+      type: z.enum(["text", "button", "list"]).optional().describe("\uBA54\uC2DC\uC9C0 \uD0C0\uC785 (\uAE30\uBCF8: text)"),
+      actions: z.string().optional().describe("\uBC84\uD2BC \uC561\uC158 JSON (type=button\uC77C \uB54C)"),
+      elements: z.string().optional().describe("\uB9AC\uC2A4\uD2B8 \uD56D\uBAA9 JSON (type=list\uC77C \uB54C)")
+    },
+    async ({ to, channel, text, type, actions, elements }) => {
+      try {
+        const result = await send({
+          to,
+          channel,
+          text,
+          type,
+          actions,
+          elements
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_message_members",
+    "\uD2B9\uC815 \uCC44\uB110\uC758 \uAD6C\uC131\uC6D0 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uCC44\uB110\uC5D0 \uB204\uAC00 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694)",
+    {
+      channel: z.string().describe("\uCC44\uB110 channelId")
+    },
+    async ({ channel }) => {
+      try {
+        const result = await listMembers(channel);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_directory_members",
+    "NAVER WORKS \uC870\uC9C1 \uAD6C\uC131\uC6D0(\uC9C1\uC6D0) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAD6C\uC131\uC6D0 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uD300\uC6D0 \uCC3E\uC544\uC918', '\uB204\uAD6C\uD55C\uD14C \uBA54\uC2DC\uC9C0 \uBCF4\uB0BC\uC9C0 userId \uCC3E\uAE30' \uB4F1\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694). \uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uC218\uC2E0\uC790 userId\uB97C \uC5EC\uAE30\uC11C \uC870\uD68C \uAC00\uB2A5",
+    {},
+    async () => {
+      try {
+        const result = await listUsers();
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_calendar_list",
+    "\uC0AC\uC6A9\uC790\uC758 \uBAA8\uB4E0 \uCE98\uB9B0\uB354\uC5D0\uC11C \uC77C\uC815/\uC2A4\uCF00\uC904\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4 (\uAC1C\uC778\xB7\uD1A1\uBC29 \uCE98\uB9B0\uB354 \uC804\uCCB4 \uC9D1\uACC4). '\uC624\uB298 \uC77C\uC815 \uC54C\uB824\uC918', '\uC774\uBC88 \uC8FC \uC2A4\uCF00\uC904 \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uAC01 \uC77C\uC815\uC5D0 \uC18C\uC18D \uCE98\uB9B0\uB354 \uC774\uB984\uC774 \uBD99\uC2B5\uB2C8\uB2E4. fromDateTime/untilDateTime\uC744 \uBAA8\uB450 \uC0DD\uB7B5\uD558\uBA74 \uC790\uB3D9\uC73C\uB85C '\uC624\uB298'(Asia/Seoul)\uB85C \uC870\uD68C\uD558\uBBC0\uB85C, \uD604\uC7AC \uB0A0\uC9DC\uB97C \uBAB0\uB77C\uB3C4 \uC548\uC804\uD569\uB2C8\uB2E4. \uD2B9\uC815 \uCE98\uB9B0\uB354\uB9CC \uBCF4\uB824\uBA74 calendarId \uC9C0\uC815. \uC751\uB2F5\uC758 skippedCalendars\uB294 \uAD8C\uD55C \uB4F1\uC73C\uB85C \uC870\uD68C \uC2E4\uD328\uD574 \uACB0\uACFC\uC5D0\uC11C \uBE60\uC9C4 \uCE98\uB9B0\uB354 \uBAA9\uB85D\uC785\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (calendar.read scope). \uBBF8\uB85C\uADF8\uC778 \uC2DC nworks_login_user\uB85C \uB85C\uADF8\uC778 \uD544\uC694",
+    {
+      fromDateTime: z.string().optional().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00). \uC0DD\uB7B5 \uC2DC \uC624\uB298 00:00 (Asia/Seoul)"),
+      untilDateTime: z.string().optional().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00). \uC0DD\uB7B5 \uC2DC \uC624\uB298 23:59 (Asia/Seoul)"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      calendarId: z.string().optional().describe("\uD2B9\uC815 \uCE98\uB9B0\uB354\uB9CC \uC870\uD68C (\uBBF8\uC9C0\uC815 \uC2DC \uBAA8\uB4E0 \uCE98\uB9B0\uB354 \uC9D1\uACC4). nworks_calendar_calendars\uB85C ID \uC870\uD68C \uAC00\uB2A5")
+    },
+    async ({ fromDateTime, untilDateTime, userId, calendarId }) => {
+      try {
+        const today = todaySeoulRange();
+        const from = fromDateTime ?? today.from;
+        const until = untilDateTime ?? today.until;
+        if (calendarId) {
+          const result = await listEventsInCalendar(
+            calendarId,
+            from,
+            until,
+            userId ?? "me"
+          );
+          const events2 = result.events.flatMap(
+            (e) => e.eventComponents.map((c) => ({
+              eventId: c.eventId,
+              summary: c.summary,
+              start: c.start.dateTime ?? c.start.date ?? "",
+              end: c.end.dateTime ?? c.end.date ?? "",
+              location: c.location ?? "",
+              calendar: calendarId
+            }))
+          );
+          return {
+            content: [{ type: "text", text: JSON.stringify({ events: events2, count: events2.length, range: { from, until } }) }]
+          };
+        }
+        const { events: raw, calendarCount, skippedCalendars } = await listAllEvents(from, until, userId ?? "me");
+        const events = raw.map((c) => ({
+          eventId: c.eventId,
+          summary: c.summary,
+          start: c.start.dateTime ?? c.start.date ?? "",
+          end: c.end.dateTime ?? c.end.date ?? "",
+          location: c.location ?? "",
+          calendar: c.calendarName
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ events, count: events.length, calendarCount, skippedCalendars, range: { from, until } }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_calendar_calendars",
+    "\uC0AC\uC6A9\uC790\uAC00 \uC811\uADFC \uAC00\uB2A5\uD55C \uCE98\uB9B0\uB354 \uBAA9\uB85D\uACFC \uAC01 \uCE98\uB9B0\uB354 ID\uB97C \uC870\uD68C\uD569\uB2C8\uB2E4 (\uAC1C\uC778\xB7\uD1A1\uBC29 \uCE98\uB9B0\uB354). '\uB0B4 \uCE98\uB9B0\uB354 \uBAA9\uB85D \uBCF4\uC5EC\uC918', \uD2B9\uC815 \uCE98\uB9B0\uB354\uC758 \uC77C\uC815\uB9CC \uC870\uD68C\uD558\uAE30 \uC804\uC5D0 ID\uB97C \uCC3E\uC744 \uB54C \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar.read scope)",
+    {
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ userId }) => {
+      try {
+        const calendars = await listCalendars(userId ?? "me");
+        const list = calendars.map((c) => ({
+          calendarId: c.calendarId,
+          name: c.calendarName
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ calendars: list, count: list.length }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_calendar_create",
+    "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD68C\uC758 \uC7A1\uC544\uC918', '\uC77C\uC815 \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope)",
+    {
+      summary: z.string().describe("\uC77C\uC815 \uC81C\uBAA9"),
+      start: z.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      end: z.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      timeZone: z.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
+      description: z.string().optional().describe("\uC77C\uC815 \uC124\uBA85"),
+      location: z.string().optional().describe("\uC7A5\uC18C"),
+      attendees: z.array(z.object({ email: z.string(), displayName: z.string().optional() })).optional().describe("\uCC38\uC11D\uC790 \uBAA9\uB85D"),
+      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({
+      summary,
+      start,
+      end,
+      timeZone,
+      description,
+      location,
+      attendees,
+      sendNotification,
+      userId
+    }) => {
+      try {
+        const result = await createEvent({
+          summary,
+          start,
+          end,
+          timeZone,
+          description,
+          location,
+          attendees,
+          sendNotification,
+          userId: userId ?? "me"
+        });
+        const event = result.eventComponents?.[0];
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, eventId: event?.eventId, summary: event?.summary, start: event?.start, end: event?.end }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.create") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_calendar_update",
+    "\uAE30\uC874 \uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC218\uC815\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uC2DC\uAC04 \uBCC0\uACBD\uD574\uC918', '\uD68C\uC758 \uC81C\uBAA9 \uBC14\uAFD4\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
+    {
+      eventId: z.string().describe("\uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      summary: z.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
+      start: z.string().optional().describe("\uC0C8 \uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      end: z.string().optional().describe("\uC0C8 \uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      timeZone: z.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
+      description: z.string().optional().describe("\uC0C8 \uC124\uBA85"),
+      location: z.string().optional().describe("\uC0C8 \uC7A5\uC18C"),
+      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({
+      eventId,
+      summary,
+      start,
+      end,
+      timeZone,
+      description,
+      location,
+      sendNotification,
+      userId
+    }) => {
+      try {
+        await updateEvent({
+          eventId,
+          summary,
+          start,
+          end,
+          timeZone,
+          description,
+          location,
+          sendNotification,
+          userId: userId ?? "me"
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, eventId, message: "\uC77C\uC815\uC774 \uC218\uC815\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.update") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_calendar_delete",
+    "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uCDE8\uC18C\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
+    {
+      eventId: z.string().describe("\uC0AD\uC81C\uD560 \uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ eventId, sendNotification, userId }) => {
+      try {
+        await deleteEvent(
+          eventId,
+          userId ?? "me",
+          sendNotification ?? false
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, eventId, message: "\uC77C\uC815\uC774 \uC0AD\uC81C\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "calendar.delete") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_drive_list",
+    "NAVER WORKS \uB4DC\uB77C\uC774\uBE0C\uC758 \uD30C\uC77C/\uD3F4\uB354 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C \uBCF4\uC5EC\uC918', '\uB0B4 \uD30C\uC77C \uBAA9\uB85D' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
+    {
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      folderId: z.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+    },
+    async ({ userId, folderId, count, cursor }) => {
+      try {
+        const result = await listFiles(
+          userId ?? "me",
+          folderId,
+          count ?? 20,
+          cursor
+        );
+        const files = result.files.map((f) => ({
+          fileId: f.fileId,
+          name: f.fileName,
+          type: f.fileType,
+          size: f.fileSize,
+          modified: f.modifiedTime,
+          path: f.filePath
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ files, count: files.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_drive_upload",
+    "\uD30C\uC77C\uC744 \uB4DC\uB77C\uC774\uBE0C\uC5D0 \uC5C5\uB85C\uB4DC\uD569\uB2C8\uB2E4 (User OAuth file scope \uD544\uC694). content(base64)\uC640 fileName\uC73C\uB85C \uC804\uB2EC\uD558\uAC70\uB098, filePath\uB85C \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C\uB97C \uC9C0\uC815\uD569\uB2C8\uB2E4. MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC5D0\uC11C\uB294 content+fileName \uBC29\uC2DD\uC744 \uAD8C\uC7A5\uD569\uB2C8\uB2E4.",
+    {
+      content: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD30C\uC77C \uB0B4\uC6A9 (base64 \uC778\uCF54\uB529). filePath \uB300\uC2E0 \uC0AC\uC6A9"),
+      fileName: z.string().optional().describe("\uD30C\uC77C\uBA85 (content \uC0AC\uC6A9 \uC2DC \uD544\uC218)"),
+      filePath: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C (content \uB300\uC2E0 \uC0AC\uC6A9, \uB85C\uCEEC \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791)"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      folderId: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      overwrite: z.boolean().optional().describe("\uB3D9\uC77C \uD30C\uC77C\uBA85 \uB36E\uC5B4\uC4F0\uAE30 (\uAE30\uBCF8: false)")
+    },
+    async ({ content, fileName, filePath, userId, folderId, overwrite }) => {
+      try {
+        let result;
+        if (content && fileName) {
+          const buffer = Buffer.from(content, "base64");
+          if (process.env["NWORKS_VERBOSE"] === "1") {
+            console.error(`[nworks] MCP upload: fileName=${fileName}, bufferSize=${buffer.length}`);
+          }
+          result = await uploadBuffer(
+            buffer,
+            fileName,
+            userId ?? "me",
+            folderId,
+            overwrite ?? false
+          );
+        } else if (filePath) {
+          const safePath = validateLocalPath(filePath);
+          if (process.env["NWORKS_VERBOSE"] === "1") {
+            console.error(`[nworks] MCP upload: filePath=${safePath}`);
+          }
+          result = await uploadFile(
+            safePath,
+            userId ?? "me",
+            folderId,
+            overwrite ?? false
+          );
+        } else {
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: "content+fileName \uB610\uB294 filePath \uC911 \uD558\uB098\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4. MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC5D0\uC11C\uB294 \uD30C\uC77C \uB0B4\uC6A9\uC744 base64\uB85C \uC778\uCF54\uB529\uD558\uC5EC content \uD30C\uB77C\uBBF8\uD130\uC5D0 \uC804\uB2EC\uD558\uACE0, fileName\uC5D0 \uD30C\uC77C\uBA85\uC744 \uC9C0\uC815\uD558\uC138\uC694." }) }],
+            isError: true
+          };
+        }
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
+        };
+      } catch (err) {
+        if (process.env["NWORKS_VERBOSE"] === "1") {
+          console.error(`[nworks] drive upload error: ${err.stack}`);
+        }
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.upload") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_drive_download",
+    "\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
+    {
+      fileId: z.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_drive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ fileId, outputDir, outputName, userId }) => {
+      try {
+        const result = await downloadFile(
+          fileId,
+          userId ?? "me"
+        );
+        const fileName = outputName ?? result.fileName ?? fileId;
+        if (outputDir) {
+          const { writeFile: writeFile2 } = await import("fs/promises");
+          const { join: join2 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join2(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
+          await writeFile2(outPath, result.buffer);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
+          };
+        }
+        const MAX_INLINE_SIZE = 5 * 1024 * 1024;
+        if (result.buffer.length > MAX_INLINE_SIZE) {
+          const sizeMB = (result.buffer.length / (1024 * 1024)).toFixed(1);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: `\uD30C\uC77C\uC774 \uB108\uBB34 \uD07D\uB2C8\uB2E4 (${sizeMB}MB). outputDir\uB97C \uC9C0\uC815\uD574\uC11C \uB85C\uCEEC\uC5D0 \uC800\uC7A5\uD558\uC138\uC694.`, fileName, size: result.buffer.length }) }],
+            isError: true
+          };
+        }
+        const textExtensions = /\.(txt|md|csv|json|xml|html|htm|css|js|ts|jsx|tsx|yaml|yml|toml|ini|cfg|conf|log|sh|bash|zsh|py|rb|java|go|rs|c|cpp|h|hpp|sql|graphql|env|gitignore|dockerignore|editorconfig)$/i;
+        const isText = textExtensions.test(fileName);
+        if (isText) {
+          const text = result.buffer.toString("utf-8");
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "text", content: text }) }]
+          };
+        }
+        const base64 = result.buffer.toString("base64");
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "base64", content: base64 }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.download") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_mail_send",
+    "NAVER WORKS \uBA54\uC77C\uC744 \uC804\uC1A1\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uBCF4\uB0B4\uC918', '\uC774\uBA54\uC77C \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uBE44\uB3D9\uAE30 \uC804\uC1A1(\uC131\uACF5 \uC2DC 202). User OAuth \uC778\uC99D \uD544\uC694 (mail scope)",
+    {
+      to: z.string().describe("\uC218\uC2E0\uC790 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      subject: z.string().describe("\uBA54\uC77C \uC81C\uBAA9"),
+      body: z.string().optional().describe("\uBA54\uC77C \uBCF8\uBB38"),
+      cc: z.string().optional().describe("\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      bcc: z.string().optional().describe("\uC228\uC740\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      contentType: z.enum(["html", "text"]).optional().describe("\uBCF8\uBB38 \uD615\uC2DD (\uAE30\uBCF8: html)"),
+      userId: z.string().optional().describe("\uBC1C\uC2E0\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ to, subject, body, cc, bcc, contentType, userId }) => {
+      try {
+        await sendMail({
+          to,
+          subject,
+          body,
+          cc,
+          bcc,
+          contentType,
+          userId: userId ?? "me"
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, message: "\uBA54\uC77C\uC774 \uC804\uC1A1\uB418\uC5C8\uC2B5\uB2C8\uB2E4 (\uBE44\uB3D9\uAE30 \uCC98\uB9AC)" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "mail.send") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_mail_list",
+    "\uBC1B\uC740 \uBA54\uC77C \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uD655\uC778\uD574\uC918', '\uBC1B\uC740\uD3B8\uC9C0\uD568 \uBCF4\uC5EC\uC918', '\uC548 \uC77D\uC740 \uBA54\uC77C \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
+    {
+      folderId: z.number().optional().describe("\uBA54\uC77C \uD3F4\uB354 ID (\uAE30\uBCF8: 0 = \uBC1B\uC740\uD3B8\uC9C0\uD568)"),
+      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 30, \uCD5C\uB300: 200)"),
+      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      isUnread: z.boolean().optional().describe("\uC77D\uC9C0 \uC54A\uC740 \uBA54\uC77C\uB9CC \uC870\uD68C"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ folderId, count, cursor, isUnread, userId }) => {
+      try {
+        const result = await listMails(
+          folderId ?? 0,
+          userId ?? "me",
+          count ?? 30,
+          cursor,
+          isUnread
+        );
+        const mails = result.mails.map((m) => ({
+          mailId: m.mailId,
+          from: m.from.email,
+          subject: m.subject,
+          date: m.receivedTime,
+          status: m.status,
+          attachments: m.attachCount ?? 0
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ mails, count: mails.length, totalCount: result.totalCount, unreadCount: result.unreadCount, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "mail.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_mail_read",
+    "\uD2B9\uC815 \uBA54\uC77C\uC758 \uC0C1\uC138 \uB0B4\uC6A9(\uBCF8\uBB38, \uCCA8\uBD80\uD30C\uC77C \uB4F1)\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uBA54\uC77C \uB0B4\uC6A9 \uBCF4\uC5EC\uC918', '\uC694\uC57D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uBCF8\uBB38(body)\uC740 \uAE30\uBCF8\uC801\uC73C\uB85C HTML \uD0DC\uADF8\uB97C \uAC77\uC5B4\uB0B8 \uC815\uC81C \uD14D\uC2A4\uD2B8\uB85C \uBC18\uD658\uD558\uBBC0\uB85C \uADF8\uB300\uB85C \uC77D\uACE0 \uC694\uC57D\uD558\uAE30 \uC88B\uC2B5\uB2C8\uB2E4. \uC6D0\uBCF8 HTML\uC774 \uD544\uC694\uD558\uBA74 format\uC744 'html' \uB610\uB294 'both'\uB85C \uC9C0\uC815\uD558\uC138\uC694. mailId\uB294 nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
+    {
+      mailId: z.number().describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      format: z.enum(["text", "html", "both"]).optional().describe("\uBCF8\uBB38 \uD615\uC2DD (\uAE30\uBCF8 text=\uC815\uC81C \uD14D\uC2A4\uD2B8, html=\uC6D0\uBCF8 HTML, both=\uC815\uC81C+\uC6D0\uBCF8). \uB300\uBD80\uBD84 text\uB85C \uCDA9\uBD84")
+    },
+    async ({ mailId, userId, format }) => {
+      try {
+        const result = await readMail(
+          mailId,
+          userId ?? "me"
+        );
+        const mail = result.mail;
+        const fmt = format ?? "text";
+        const payload = {
+          mailId: mail.mailId,
+          from: mail.from,
+          to: mail.to,
+          cc: mail.cc ?? [],
+          subject: mail.subject,
+          date: mail.receivedTime,
+          attachments: result.attachments?.map((a) => ({
+            id: a.attachmentId,
+            filename: a.filename,
+            contentType: a.contentType,
+            size: a.size
+          })) ?? []
+        };
+        if (fmt === "html") {
+          payload.body = mail.body;
+          payload.bodyFormat = "html";
+        } else {
+          payload.body = htmlToText(mail.body);
+          payload.bodyFormat = "text";
+          if (fmt === "both") payload.bodyHtml = mail.body;
+        }
+        return {
+          content: [{ type: "text", text: JSON.stringify(payload) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "mail.read") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_mail_attachment",
+    "\uBA54\uC77C \uCCA8\uBD80\uD30C\uC77C\uC758 \uD14D\uC2A4\uD2B8 \uB0B4\uC6A9\uC744 \uC77D\uC2B5\uB2C8\uB2E4. '\uCCA8\uBD80\uD30C\uC77C \uB0B4\uC6A9 \uD655\uC778\uD574\uC918', 'CSV \uCCA8\uBD80 \uC694\uC57D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uD14D\uC2A4\uD2B8\uB958(txt\xB7csv\xB7json\xB7xml\xB7html\xB7ics \uB4F1)\uB294 \uB0B4\uC6A9\uC744 \uADF8\uB300\uB85C \uBC18\uD658\uD558\uBA70, HTML\uC740 \uC815\uC81C \uD14D\uC2A4\uD2B8\uB85C \uBC18\uD658\uD569\uB2C8\uB2E4. PDF\xB7\uC624\uD53C\uC2A4 \uBB38\uC11C\xB7\uC774\uBBF8\uC9C0 \uAC19\uC740 \uBC14\uC774\uB108\uB9AC\uB294 \uD14D\uC2A4\uD2B8 \uCD94\uCD9C\uC774 \uBD88\uAC00\uD558\uBA70(\uBCC4\uB3C4 \uD30C\uC11C \uD544\uC694), \uC774 \uACBD\uC6B0 CLI `nworks mail attachment --out`\uC73C\uB85C \uC800\uC7A5\uD558\uB3C4\uB85D \uC548\uB0B4\uD569\uB2C8\uB2E4. mailId\xB7attachmentId\uB294 nworks_mail_read\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
+    {
+      mailId: z.number().describe("\uBA54\uC77C ID (nworks_mail_read\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      attachmentId: z.number().describe("\uCCA8\uBD80\uD30C\uC77C ID (nworks_mail_read\uC758 attachments[].id)"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ mailId, attachmentId, userId }) => {
+      try {
+        const { filename, buffer } = await downloadAttachment(
+          mailId,
+          attachmentId,
+          userId ?? "me"
+        );
+        const text = attachmentTextOrNull(filename, buffer);
+        if (text !== null) {
+          return {
+            content: [{ type: "text", text: JSON.stringify({ filename, size: buffer.length, text }) }]
+          };
+        }
+        return {
+          content: [{ type: "text", text: JSON.stringify({
+            filename,
+            size: buffer.length,
+            binary: true,
+            message: "\uBC14\uC774\uB108\uB9AC \uCCA8\uBD80\uD30C\uC77C\uC774\uB77C \uD14D\uC2A4\uD2B8 \uCD94\uCD9C\uC774 \uBD88\uAC00\uD569\uB2C8\uB2E4. CLI `nworks mail attachment --id <mailId> --attachment <attachmentId> --out <\uACBD\uB85C>`\uB85C \uC800\uC7A5\uD558\uC138\uC694."
+          }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "mail.read") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_task_list",
+    "\uD560 \uC77C(TODO) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uD560 \uC77C \uD655\uC778\uD574\uC918', 'TODO \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uB0A8\uC740 \uC5C5\uBB34 \uBB50 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (task.read scope)",
+    {
+      categoryId: z.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID (\uAE30\uBCF8: default)"),
+      status: z.enum(["TODO", "ALL"]).optional().describe("\uD544\uD130: TODO \uB610\uB294 ALL (\uAE30\uBCF8: ALL)"),
+      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 50, \uCD5C\uB300: 100)"),
+      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ categoryId, status, count, cursor, userId }) => {
+      try {
+        const result = await listTasks(
+          categoryId ?? "default",
+          userId ?? "me",
+          count ?? 50,
+          cursor,
+          status ?? "ALL"
+        );
+        const tasks = result.tasks.map((t) => ({
+          taskId: t.taskId,
+          title: t.title,
+          status: t.status,
+          dueDate: t.dueDate,
+          assignor: t.assignorName ?? t.assignorId,
+          created: t.createdTime
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ tasks, count: tasks.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "task.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_task_create",
+    "\uD560 \uC77C(TODO)\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD560 \uC77C \uCD94\uAC00\uD574\uC918', 'TODO \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uAE30\uBCF8\uC801\uC73C\uB85C \uC790\uAE30 \uC790\uC2E0\uC5D0\uAC8C \uD560\uB2F9. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
+    {
+      title: z.string().describe("\uD560 \uC77C \uC81C\uBAA9"),
+      content: z.string().optional().describe("\uD560 \uC77C \uB0B4\uC6A9"),
+      dueDate: z.string().optional().describe("\uB9C8\uAC10\uC77C (YYYY-MM-DD)"),
+      categoryId: z.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID"),
+      assigneeIds: z.array(z.string()).optional().describe("\uB2F4\uB2F9\uC790 user ID \uBAA9\uB85D (\uBBF8\uC9C0\uC815 \uC2DC \uC790\uAE30 \uC790\uC2E0)"),
+      userId: z.string().optional().describe("\uC0DD\uC131\uC790 user ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ title, content, dueDate, categoryId, assigneeIds, userId }) => {
+      try {
+        const result = await createTask({
+          title,
+          content,
+          dueDate,
+          categoryId,
+          assigneeIds,
+          userId: userId ?? "me"
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, taskId: result.taskId, title: result.title, status: result.status, dueDate: result.dueDate }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "task.create") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_task_update",
+    "\uD560 \uC77C\uC744 \uC218\uC815\uD558\uAC70\uB098 \uC644\uB8CC \uCC98\uB9AC\uD569\uB2C8\uB2E4. '\uD560 \uC77C \uC644\uB8CC \uCC98\uB9AC\uD574\uC918', '\uB9C8\uAC10\uC77C \uBCC0\uACBD\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. taskId\uB294 nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
+    {
+      taskId: z.string().describe("\uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      status: z.enum(["done", "todo"]).optional().describe("\uC0C1\uD0DC \uBCC0\uACBD: done(\uC644\uB8CC) \uB610\uB294 todo(\uBBF8\uC644\uB8CC)"),
+      title: z.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
+      content: z.string().optional().describe("\uC0C8 \uB0B4\uC6A9"),
+      dueDate: z.string().optional().describe("\uC0C8 \uB9C8\uAC10\uC77C (YYYY-MM-DD)")
+    },
+    async ({ taskId, status, title, content, dueDate }) => {
+      try {
+        if (status) {
+          if (status === "done") {
+            await completeTask(taskId);
+          } else {
+            await incompleteTask(taskId);
+          }
+        }
+        if (title !== void 0 || content !== void 0 || dueDate !== void 0) {
+          const result = await updateTask({ taskId, title, content, dueDate });
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, taskId: result.taskId, title: result.title, status: result.status, dueDate: result.dueDate }) }]
+          };
+        }
+        if (status) {
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, taskId, status: status === "done" ? "DONE" : "TODO" }) }]
+          };
+        }
+        return {
+          content: [{ type: "text", text: JSON.stringify({ error: true, message: "status, title, content, dueDate \uC911 \uD558\uB098 \uC774\uC0C1\uC744 \uC9C0\uC815\uD558\uC138\uC694." }) }],
+          isError: true
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "task.update") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_task_delete",
+    "\uD560 \uC77C\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. taskId\uB294 nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
+    {
+      taskId: z.string().describe("\uC0AD\uC81C\uD560 \uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+    },
+    async ({ taskId }) => {
+      try {
+        await deleteTask(taskId);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, taskId, message: "\uD560 \uC77C\uC774 \uC0AD\uC81C\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "task.delete") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_board_list",
+    "NAVER WORKS \uAC8C\uC2DC\uD310 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310 \uBB50 \uC788\uC5B4?', '\uACF5\uC9C0\uC0AC\uD56D \uAC8C\uC2DC\uD310 \uCC3E\uC544\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
+    {
+      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20)"),
+      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+    },
+    async ({ count, cursor }) => {
+      try {
+        const result = await listBoards(count ?? 20, cursor);
+        const boards = result.boards.map((b) => ({
+          boardId: b.boardId,
+          boardName: b.boardName,
+          description: b.description ?? ""
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ boards, count: boards.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "board.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_board_posts",
+    "\uAC8C\uC2DC\uD310\uC758 \uAE00 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310 \uAE00 \uBCF4\uC5EC\uC918', '\uACF5\uC9C0\uC0AC\uD56D \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
+    {
+      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 40)"),
+      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+    },
+    async ({ boardId, count, cursor }) => {
+      try {
+        const result = await listPosts(boardId, count ?? 20, cursor);
+        const posts = result.posts.map((p) => ({
+          postId: p.postId,
+          title: p.title,
+          userName: p.userName ?? "",
+          readCount: p.readCount ?? 0,
+          commentCount: p.commentCount ?? 0,
+          createdTime: p.createdTime ?? ""
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ posts, count: posts.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "board.posts") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_board_read",
+    "\uAC8C\uC2DC\uD310 \uAE00\uC758 \uC0C1\uC138 \uB0B4\uC6A9\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. postId\uB294 nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
+    {
+      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      postId: z.string().describe("\uAE00 ID (nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5)")
+    },
+    async ({ boardId, postId }) => {
+      try {
+        const post = await readPost(boardId, postId);
+        return {
+          content: [{ type: "text", text: JSON.stringify({
+            postId: post.postId,
+            boardId: post.boardId,
+            title: post.title,
+            body: post.body ?? "",
+            userName: post.userName ?? "",
+            readCount: post.readCount ?? 0,
+            commentCount: post.commentCount ?? 0,
+            createdTime: post.createdTime ?? "",
+            updatedTime: post.updatedTime ?? ""
+          }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "board.read") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_board_create",
+    "\uAC8C\uC2DC\uD310\uC5D0 \uAE00\uC744 \uC791\uC131\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310\uC5D0 \uAE00 \uC62C\uB824\uC918', '\uACF5\uC9C0 \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board scope)",
+    {
+      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      title: z.string().describe("\uAE00 \uC81C\uBAA9"),
+      body: z.string().optional().describe("\uAE00 \uBCF8\uBB38"),
+      enableComment: z.boolean().optional().describe("\uB313\uAE00 \uD5C8\uC6A9 (\uAE30\uBCF8: true)"),
+      sendNotifications: z.boolean().optional().describe("\uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)")
+    },
+    async ({ boardId, title, body, enableComment, sendNotifications }) => {
+      try {
+        const post = await createPost({
+          boardId,
+          title,
+          body,
+          enableComment,
+          sendNotifications
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, postId: post.postId, boardId: post.boardId, title: post.title }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "board.create") }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_login_user",
+    "User OAuth \uB85C\uADF8\uC778\uC744 \uC2DC\uC791\uD569\uB2C8\uB2E4. \uBC18\uD658\uB41C URL\uC744 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5B4 NAVER WORKS\uC5D0 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uB85C\uADF8\uC778 \uC644\uB8CC \uD6C4 \uC790\uB3D9\uC73C\uB85C \uD1A0\uD070\uC774 \uC800\uC7A5\uB429\uB2C8\uB2E4. \uC911\uC694: scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694. \uAE30\uBCF8\uAC12\uC774 \uBAA8\uB4E0 API(\uCE98\uB9B0\uB354, \uBA54\uC77C, \uD560\uC77C, \uB4DC\uB77C\uC774\uBE0C, \uAC8C\uC2DC\uD310)\uB97C \uD3EC\uD568\uD558\uBBC0\uB85C \uD55C \uBC88 \uB85C\uADF8\uC778\uC73C\uB85C \uC804\uCCB4 \uAE30\uB2A5\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4. scope\uB97C \uC881\uAC8C \uC9C0\uC815\uD558\uBA74 \uB2E4\uB978 \uAE30\uB2A5 \uC0AC\uC6A9 \uC2DC \uC7AC\uB85C\uADF8\uC778\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.",
+    {
+      scope: z.string().optional().describe("\uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694 (\uAE30\uBCF8\uAC12\uC774 \uC804\uCCB4 scope \uD3EC\uD568). \uD2B9\uC218\uD55C \uACBD\uC6B0\uC5D0\uB9CC \uC0AC\uC6A9")
+    },
+    async ({ scope }) => {
+      const DEFAULT_SCOPE = "calendar calendar.read file file.read mail mail.read task task.read user.read board board.read";
+      try {
+        const creds = await loadCredentials();
+        const SCOPE_DEPS = {
+          calendar: ["calendar.read"],
+          task: ["user.read"],
+          "task.read": ["user.read"]
+        };
+        const expandScopes = (scopes) => {
+          const expanded = new Set(scopes);
+          for (const s of scopes) {
+            const deps = SCOPE_DEPS[s];
+            if (deps) deps.forEach((d) => expanded.add(d));
+          }
+          return [...expanded];
+        };
+        const existingToken = await loadUserToken();
+        const existingScopes = existingToken?.scope?.split(" ").filter(Boolean) ?? [];
+        const requestedScopes = expandScopes((scope ?? DEFAULT_SCOPE).split(" ").filter(Boolean));
+        const mergedScopes = [.../* @__PURE__ */ new Set([...existingScopes, ...requestedScopes])].join(" ");
+        const state = generateSecureState();
+        const authorizeUrl = buildAuthorizeUrl(creds.clientId, mergedScopes, state);
+        startOAuthCallbackServer(creds.clientId, creds.clientSecret, state).then(
+          (token) => saveUserToken({
+            accessToken: token.accessToken,
+            refreshToken: token.refreshToken,
+            expiresAt: token.expiresAt,
+            scope: token.scope
+          })
+        ).then(() => {
+          console.error("[nworks] User OAuth login successful. Token saved.");
+        }).catch((err) => {
+          console.error(`[nworks] User OAuth login failed: ${err.message}`);
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                message: "\uC544\uB798 URL\uC744 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5B4 NAVER WORKS\uC5D0 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uB85C\uADF8\uC778 \uC644\uB8CC \uD6C4 \uC790\uB3D9\uC73C\uB85C \uD1A0\uD070\uC774 \uC800\uC7A5\uB429\uB2C8\uB2E4. (\uC81C\uD55C\uC2DC\uAC04: 120\uCD08)",
+                loginUrl: authorizeUrl,
+                scope: mergedScopes,
+                callbackPort: 9876,
+                timeout: "120\uCD08"
+              })
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_whoami",
+    "\uD604\uC7AC \uC778\uC99D\uB41C NAVER WORKS \uACC4\uC815 \uC815\uBCF4\uC640 \uD1A0\uD070 \uC720\uD6A8 \uC0C1\uD0DC\uB97C \uD655\uC778\uD569\uB2C8\uB2E4. \uC778\uC99D \uBB38\uC81C \uC9C4\uB2E8 \uC2DC \uBA3C\uC800 \uD638\uCD9C",
+    {},
+    async () => {
+      try {
+        const creds = await loadCredentials();
+        const token = await loadToken();
+        const userToken = await loadUserToken();
+        const isValid = token ? token.expiresAt > Date.now() / 1e3 : false;
+        const userTokenValid = userToken ? userToken.expiresAt > Date.now() / 1e3 : false;
+        const mask = (s) => s.length <= 4 ? "****" : `****${s.slice(-4)}`;
+        const info = {
+          serviceAccount: creds.serviceAccount ?? null,
+          clientId: mask(creds.clientId),
+          botId: creds.botId ?? null,
+          tokenValid: isValid,
+          userOAuth: userToken ? { valid: userTokenValid, scope: userToken.scope } : null
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(info) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_logout",
+    "\uC800\uC7A5\uB41C NAVER WORKS \uC778\uC99D \uC815\uBCF4\uC640 \uD1A0\uD070\uC744 \uBAA8\uB450 \uC0AD\uC81C\uD569\uB2C8\uB2E4",
+    {},
+    async () => {
+      try {
+        try {
+          const creds = await loadCredentials();
+          const token = await loadToken();
+          const userToken = await loadUserToken();
+          if (token?.accessToken) {
+            await revokeToken(token.accessToken, creds.clientId, creds.clientSecret);
+          }
+          if (userToken?.refreshToken) {
+            await revokeToken(userToken.refreshToken, creds.clientId, creds.clientSecret);
+          }
+        } catch {
+        }
+        await clearCredentials();
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                success: true,
+                message: "\uC778\uC99D \uC815\uBCF4\uC640 \uD1A0\uD070\uC774 \uBAA8\uB450 \uC0AD\uC81C\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uB2E4\uC2DC \uC0AC\uC6A9\uD558\uB824\uBA74 nworks_setup tool\uB85C \uC7AC\uC124\uC815 \uD6C4 nworks_login_user\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uD558\uC138\uC694."
+              })
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "nworks_doctor",
+    "NAVER WORKS \uC5F0\uACB0 \uC0C1\uD0DC\uB97C \uC9C4\uB2E8\uD569\uB2C8\uB2E4. \uC778\uC99D \uC815\uBCF4, \uD1A0\uD070, Private Key, API \uC5F0\uACB0\uC744 \uC810\uAC80\uD569\uB2C8\uB2E4.",
+    {},
+    async () => {
+      try {
+        const results = await runChecks("default");
+        const maskedResults = results.map((r) => {
+          if (r.check === "credentials" && r.status === "OK") {
+            return { ...r, detail: r.detail.replace(/clientId: .+/, "clientId: ****") };
+          }
+          if (r.check === "privateKey" && r.status === "OK") {
+            return { ...r, detail: "OK (path hidden)" };
+          }
+          if (r.check === "serviceAccount" && r.status === "OK") {
+            const masked = r.detail.length <= 4 ? "****" : `****${r.detail.slice(-4)}`;
+            return { ...r, detail: masked };
+          }
+          return r;
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(maskedResults) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err) }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/server.ts
+async function startMcpServer() {
+  try {
+    await loadCredentials();
+  } catch {
+    console.error(
+      "[nworks] Authentication required. Run: nworks login"
+    );
+  }
+  try {
+    const userToken = await loadUserToken();
+    if (!userToken) {
+      console.error(
+        "[nworks] User OAuth not configured. Run: nworks login --user"
+      );
+    }
+  } catch {
+  }
+  const server = new McpServer({
+    name: "nworks",
+    version: "1.0.0"
+  });
+  registerTools(server);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+// src/mcp.ts
+startMcpServer().catch((err) => {
+  console.error("MCP server failed:", err);
+  process.exit(1);
+});
+//# sourceMappingURL=mcp.js.map