nworks 1.2.2 → 1.3.0

package/dist/index.js

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { Command as Command14 } from "commander";
+
+// src/version.ts
 import { createRequire } from "module";
-import { Command as Command13 } from "commander";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var VERSION = pkg.version;
 
 // src/commands/login.ts
 import { Command } from "commander";
@@ -11,10 +16,11 @@ import { existsSync as existsSync2 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/auth/config.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
+import { readFile, writeFile, mkdir, chmod, rename } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+import { z } from "zod";
 
 // src/utils/error.ts
 var AuthError = class extends Error {
@@ -43,11 +49,40 @@ var CONFIG_DIR = join(homedir(), ".config", "nworks");
 var CREDENTIALS_PATH = join(CONFIG_DIR, "credentials.json");
 var TOKEN_PATH = join(CONFIG_DIR, "token.json");
 var USER_TOKEN_PATH = join(CONFIG_DIR, "user-token.json");
+var PROFILE_NAME_PATTERN = /^[\w.-]+$/;
+var FORBIDDEN_PROFILE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var DOTS_ONLY = /^\.+$/;
+function validateProfileName(profile) {
+  if (!PROFILE_NAME_PATTERN.test(profile) || FORBIDDEN_PROFILE_KEYS.has(profile) || DOTS_ONLY.test(profile)) {
+    throw new AuthError(
+      `Invalid profile name "${profile}". Use only letters, digits, ".", "_", or "-" (and not "." / ".." alone).`
+    );
+  }
+}
+var credentialsSchema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  serviceAccount: z.string().optional(),
+  privateKeyPath: z.string().optional(),
+  botId: z.string().optional(),
+  domainId: z.string().optional()
+}).passthrough();
 async function ensureConfigDir() {
   if (!existsSync(CONFIG_DIR)) {
     await mkdir(CONFIG_DIR, { recursive: true, ...IS_UNIX && { mode: 448 } });
+  } else if (IS_UNIX) {
+    await chmod(CONFIG_DIR, 448);
   }
 }
+var tempFileCounter = 0;
+async function writeSecureFile(path, data) {
+  const tempPath = `${path}.${process.pid}.${tempFileCounter++}.tmp`;
+  await writeFile(tempPath, data, { encoding: "utf-8", ...IS_UNIX && { mode: 384 } });
+  if (IS_UNIX) {
+    await chmod(tempPath, 384);
+  }
+  await rename(tempPath, path);
+}
 function getCredentialsFromEnv() {
   const clientId = process.env["NWORKS_CLIENT_ID"];
   const clientSecret = process.env["NWORKS_CLIENT_SECRET"];
@@ -64,6 +99,7 @@ function getCredentialsFromEnv() {
 async function loadCredentials(profile = "default") {
   const envCreds = getCredentialsFromEnv();
   if (envCreds) return envCreds;
+  validateProfileName(profile);
   if (!existsSync(CREDENTIALS_PATH)) {
     throw new AuthError(
       "Not logged in. Run `nworks login` or set environment variables."
@@ -75,9 +111,16 @@ async function loadCredentials(profile = "default") {
   if (!creds) {
     throw new AuthError(`Profile "${profile}" not found in credentials.`);
   }
-  return creds;
+  const parsed = credentialsSchema.safeParse(creds);
+  if (!parsed.success) {
+    throw new AuthError(
+      `Credentials for profile "${profile}" are malformed. Run \`nworks login\` to reconfigure.`
+    );
+  }
+  return parsed.data;
 }
 async function saveCredentials(creds, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let profiles = {};
   if (existsSync(CREDENTIALS_PATH)) {
@@ -85,13 +128,10 @@ async function saveCredentials(creds, profile = "default") {
     profiles = JSON.parse(raw);
   }
   profiles[profile] = creds;
-  await writeFile(
-    CREDENTIALS_PATH,
-    JSON.stringify(profiles, null, 2),
-    { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
-  );
+  await writeSecureFile(CREDENTIALS_PATH, JSON.stringify(profiles, null, 2));
 }
 async function loadToken(profile = "default") {
+  validateProfileName(profile);
   if (!existsSync(TOKEN_PATH)) return null;
   const raw = await readFile(TOKEN_PATH, "utf-8");
   const tokens = JSON.parse(raw);
@@ -103,6 +143,7 @@ async function loadToken(profile = "default") {
   };
 }
 async function saveToken(token, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let tokens = {};
   if (existsSync(TOKEN_PATH)) {
@@ -110,13 +151,10 @@ async function saveToken(token, profile = "default") {
     tokens = JSON.parse(raw);
   }
   tokens[profile] = token;
-  await writeFile(
-    TOKEN_PATH,
-    JSON.stringify(tokens, null, 2),
-    { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
-  );
+  await writeSecureFile(TOKEN_PATH, JSON.stringify(tokens, null, 2));
 }
 async function loadUserToken(profile = "default") {
+  validateProfileName(profile);
   if (!existsSync(USER_TOKEN_PATH)) return null;
   const raw = await readFile(USER_TOKEN_PATH, "utf-8");
   const tokens = JSON.parse(raw);
@@ -130,6 +168,7 @@ async function loadUserToken(profile = "default") {
   };
 }
 async function saveUserToken(token, profile = "default") {
+  validateProfileName(profile);
   await ensureConfigDir();
   let tokens = {};
   if (existsSync(USER_TOKEN_PATH)) {
@@ -137,42 +176,27 @@ async function saveUserToken(token, profile = "default") {
     tokens = JSON.parse(raw);
   }
   tokens[profile] = token;
-  await writeFile(
-    USER_TOKEN_PATH,
-    JSON.stringify(tokens, null, 2),
-    { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
-  );
+  await writeSecureFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2));
 }
 async function clearCredentials(profile = "default") {
+  validateProfileName(profile);
   if (existsSync(CREDENTIALS_PATH)) {
     const raw = await readFile(CREDENTIALS_PATH, "utf-8");
     const profiles = JSON.parse(raw);
     delete profiles[profile];
-    await writeFile(
-      CREDENTIALS_PATH,
-      JSON.stringify(profiles, null, 2),
-      { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
-    );
+    await writeSecureFile(CREDENTIALS_PATH, JSON.stringify(profiles, null, 2));
   }
   if (existsSync(TOKEN_PATH)) {
     const raw = await readFile(TOKEN_PATH, "utf-8");
     const tokens = JSON.parse(raw);
     delete tokens[profile];
-    await writeFile(
-      TOKEN_PATH,
-      JSON.stringify(tokens, null, 2),
-      { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
-    );
+    await writeSecureFile(TOKEN_PATH, JSON.stringify(tokens, null, 2));
   }
   if (existsSync(USER_TOKEN_PATH)) {
     const raw = await readFile(USER_TOKEN_PATH, "utf-8");
     const tokens = JSON.parse(raw);
     delete tokens[profile];
-    await writeFile(
-      USER_TOKEN_PATH,
-      JSON.stringify(tokens, null, 2),
-      { encoding: "utf-8", ...IS_UNIX && { mode: 384 } }
-    );
+    await writeSecureFile(USER_TOKEN_PATH, JSON.stringify(tokens, null, 2));
   }
 }
 
@@ -246,7 +270,6 @@ async function refreshToken(profile = "default") {
 
 // src/auth/oauth-user.ts
 import { createServer } from "http";
-import { randomBytes } from "crypto";
 import { URL as URL2 } from "url";
 var AUTH_URL2 = "https://auth.worksmobile.com/oauth2/v2.0/authorize";
 var TOKEN_URL = "https://auth.worksmobile.com/oauth2/v2.0/token";
@@ -262,13 +285,13 @@ function buildAuthorizeUrl(clientId, scope, state) {
   });
   return `${AUTH_URL2}?${params.toString()}`;
 }
-async function startUserOAuthFlow(_scope, profile = "default", expectedState) {
+async function startUserOAuthFlow(_scope, profile, expectedState) {
   const creds = await loadCredentials(profile);
-  const code = await waitForAuthCode(expectedState ?? randomBytes(16).toString("hex"));
+  const code = await waitForAuthCode(expectedState);
   return exchangeCodeForToken(code, creds.clientId, creds.clientSecret);
 }
 function waitForAuthCode(expectedState) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const timeout = setTimeout(() => {
       server.close();
       reject(new AuthError("OAuth login timed out (120s). Try again."));
@@ -285,10 +308,7 @@ function waitForAuthCode(expectedState) {
       const state = url.searchParams.get("state");
       if (state !== expectedState) {
         res.writeHead(403, { "Content-Type": "text/html; charset=utf-8" });
-        res.end("<h2>\uBCF4\uC548 \uC624\uB958</h2><p>state \uBD88\uC77C\uCE58. \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694.</p>");
-        clearTimeout(timeout);
-        server.close();
-        reject(new AuthError("OAuth state mismatch \u2014 possible CSRF attack."));
+        res.end("<h2>\uBCF4\uC548 \uC624\uB958</h2><p>state \uBD88\uC77C\uCE58. \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uB85C\uADF8\uC778\uC744 \uB2E4\uC2DC \uC9C4\uD589\uD558\uC138\uC694.</p>");
         return;
       }
       if (error) {
@@ -311,7 +331,7 @@ function waitForAuthCode(expectedState) {
       res.end("<h2>\uB85C\uADF8\uC778 \uC131\uACF5!</h2><p>\uC774 \uCC3D\uC744 \uB2EB\uACE0 \uD130\uBBF8\uB110\uB85C \uB3CC\uC544\uAC00\uC138\uC694.</p>");
       clearTimeout(timeout);
       server.close();
-      resolve2(code);
+      resolve3(code);
     });
     server.listen(REDIRECT_PORT, "127.0.0.1", () => {
     });
@@ -321,6 +341,17 @@ function waitForAuthCode(expectedState) {
     });
   });
 }
+async function safeErrorSummary(res) {
+  const text = await res.text();
+  try {
+    const body = JSON.parse(text);
+    if (body.error || body.error_description) {
+      return [body.error, body.error_description].filter(Boolean).join(": ");
+    }
+  } catch {
+  }
+  return text.length > 200 ? text.slice(0, 200) + "..." : text;
+}
 async function exchangeCodeForToken(code, clientId, clientSecret) {
   const body = new URLSearchParams({
     grant_type: "authorization_code",
@@ -335,9 +366,7 @@ async function exchangeCodeForToken(code, clientId, clientSecret) {
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text();
-    const truncated = text.length > 200 ? text.substring(0, 200) + "..." : text;
-    throw new AuthError(`Token exchange failed (${res.status}): ${truncated}`);
+    throw new AuthError(`Token exchange failed (${res.status}): ${await safeErrorSummary(res)}`);
   }
   const data = await res.json();
   return {
@@ -361,9 +390,7 @@ async function refreshUserToken(refreshToken2, profile = "default") {
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text();
-    const truncated = text.length > 200 ? text.substring(0, 200) + "..." : text;
-    throw new AuthError(`Token refresh failed (${res.status}): ${truncated}`);
+    throw new AuthError(`Token refresh failed (${res.status}): ${await safeErrorSummary(res)}`);
   }
   const data = await res.json();
   return {
@@ -396,6 +423,69 @@ async function revokeToken(token, clientId, clientSecret) {
   }
 }
 
+// src/auth/scopes.ts
+var READ_SCOPES = [
+  "calendar.read",
+  "file.read",
+  "mail.read",
+  "task.read",
+  "user.read",
+  "board.read",
+  "contact.read"
+];
+var ALL_SCOPES = [
+  "calendar",
+  "calendar.read",
+  "file",
+  "file.read",
+  "mail",
+  "mail.read",
+  "task",
+  "task.read",
+  "user.read",
+  "board",
+  "board.read",
+  "contact",
+  "contact.read"
+];
+var SCOPE_DEPENDENCIES = {
+  calendar: ["calendar.read"],
+  file: ["file.read"],
+  mail: ["mail.read"],
+  task: ["task.read", "user.read"],
+  "task.read": ["user.read"],
+  board: ["board.read"],
+  contact: ["contact.read"]
+};
+var SCOPE_PRESETS = {
+  readonly: READ_SCOPES,
+  // default를 all로 두는 이유: 현재 제품의 "한 번 로그인으로 전체 기능" 약속을 보존한다.
+  // 읽기 전용을 기본값으로 하면 신규 사용자가 쓰기 기능(일정 생성 등)을 쓸 때 재로그인해야 한다.
+  // 안전을 최우선하려면 readonly로 바꾸면 되지만, 삭제류 도구는 이미 destructiveHint
+  // annotation으로 클라이언트 승인 게이트가 걸린다.
+  default: ALL_SCOPES,
+  all: ALL_SCOPES
+};
+function isPreset(value) {
+  return value === "readonly" || value === "default" || value === "all";
+}
+function expandScopeDependencies(scopes) {
+  const expanded = new Set(scopes);
+  for (const scope of scopes) {
+    const deps = SCOPE_DEPENDENCIES[scope];
+    if (deps) deps.forEach((d) => expanded.add(d));
+  }
+  return [...expanded];
+}
+function resolveScopes(input) {
+  if (!input) return SCOPE_PRESETS.default;
+  if (isPreset(input)) return SCOPE_PRESETS[input];
+  return expandScopeDependencies(input.split(" ").filter(Boolean));
+}
+function mergeScopes(existing, requested) {
+  return [.../* @__PURE__ */ new Set([...existing, ...requested])].join(" ");
+}
+
 // src/output/format.ts
 function output(data, opts = {}) {
   const useJson = opts.json || !process.stdout.isTTY;
@@ -469,7 +559,7 @@ function errorOutput(error, opts = {}) {
 }
 
 // src/commands/login.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes } from "crypto";
 async function prompt(question) {
   const rl = createInterface({
     input: process.stdin,
@@ -482,11 +572,24 @@ async function prompt(question) {
     rl.close();
   }
 }
-var loginCommand = new Command("login").description("Authenticate with NAVER WORKS").option("--user", "User OAuth login (opens browser)").option("--scope <scope>", "OAuth scope for user login", "calendar.read").option("--client-id <id>", "Client ID").option("--client-secret <secret>", "Client Secret").option("--service-account <account>", "Service Account ID").option("--private-key <path>", "Path to private key file (.key)").option("--bot-id <id>", "Bot ID").option("--domain-id <id>", "Domain ID (optional)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+async function promptSecret(question) {
+  process.stdout.write(question);
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  rl._writeToOutput = () => {
+  };
+  try {
+    const answer = await rl.question("");
+    process.stdout.write("\n");
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+var loginCommand = new Command("login").description("Authenticate with NAVER WORKS").option("--user", "User OAuth login (opens browser)").option("--preset <preset>", "Scope preset: readonly | default | all (default: all)").option("--scope <scope>", "Advanced: raw space-separated scopes (overrides --preset)").option("--client-id <id>", "Client ID").option("--client-secret <secret>", "Client Secret").option("--service-account <account>", "Service Account ID").option("--private-key <path>", "Path to private key file (.key)").option("--bot-id <id>", "Bot ID").option("--domain-id <id>", "Domain ID (optional)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
   try {
     const profile = opts.profile;
     if (opts.user) {
-      await handleUserLogin(opts.scope, profile, opts);
+      await handleUserLogin(profile, opts);
     } else {
       await handleServiceAccountLogin(opts);
     }
@@ -496,7 +599,7 @@ var loginCommand = new Command("login").description("Authenticate with NAVER WOR
     process.exitCode = 1;
   }
 });
-async function handleUserLogin(scope, profile, opts) {
+async function handleUserLogin(profile, opts) {
   let clientId = opts.clientId;
   let clientSecret = opts.clientSecret;
   try {
@@ -507,7 +610,7 @@ async function handleUserLogin(scope, profile, opts) {
   }
   if (process.stdin.isTTY) {
     if (!clientId) clientId = await prompt("Client ID: ");
-    if (!clientSecret) clientSecret = await prompt("Client Secret: ");
+    if (!clientSecret) clientSecret = await promptSecret("Client Secret: ");
   }
   if (!clientId || !clientSecret) {
     throw new Error(
@@ -520,22 +623,31 @@ async function handleUserLogin(scope, profile, opts) {
   } catch {
     await saveCredentials({ clientId, clientSecret }, profile);
   }
-  const state = randomBytes2(16).toString("hex");
-  const authorizeUrl = buildAuthorizeUrl(clientId, scope, state);
+  const requestedScopes = resolveScopes(opts.preset ?? opts.scope);
+  let existingScopes = [];
+  try {
+    const existingToken = await loadUserToken(profile);
+    existingScopes = existingToken?.scope?.split(" ").filter(Boolean) ?? [];
+  } catch {
+  }
+  const mergedScope = mergeScopes(existingScopes, requestedScopes);
+  const state = randomBytes(16).toString("hex");
+  const authorizeUrl = buildAuthorizeUrl(clientId, mergedScope, state);
   console.error(`
 Opening browser for NAVER WORKS login...`);
   console.error(`If the browser does not open, visit this URL:
 `);
   console.error(`  ${authorizeUrl}
 `);
-  const { exec } = await import("child_process");
-  const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  if (process.platform === "win32") {
-    exec(`start "" "${authorizeUrl}"`);
+  const { execFile } = await import("child_process");
+  if (process.platform === "darwin") {
+    execFile("open", [authorizeUrl]);
+  } else if (process.platform === "win32") {
+    execFile("cmd", ["/c", "start", "", authorizeUrl]);
   } else {
-    exec(`${openCmd} "${authorizeUrl}"`);
+    execFile("xdg-open", [authorizeUrl]);
   }
-  const tokenData = await startUserOAuthFlow(scope, profile, state);
+  const tokenData = await startUserOAuthFlow(mergedScope, profile, state);
   await saveUserToken(tokenData, profile);
   output(
     {
@@ -562,7 +674,7 @@ async function handleServiceAccountLogin(opts) {
   if (!botId) botId = process.env["NWORKS_BOT_ID"];
   if (process.stdin.isTTY) {
     if (!clientId) clientId = await prompt("Client ID: ");
-    if (!clientSecret) clientSecret = await prompt("Client Secret: ");
+    if (!clientSecret) clientSecret = await promptSecret("Client Secret: ");
     if (!serviceAccount)
       serviceAccount = await prompt("Service Account: ");
     if (!privateKeyPath)
@@ -624,10 +736,10 @@ var REQUIRED_SCOPES = {
   "board.create": "board"
 };
 var ERROR_HINTS_CLI = {
-  FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
-  ACCESS_DENIED: "\uC811\uADFC\uC774 \uAC70\uBD80\uB410\uC2B5\uB2C8\uB2E4. Admin\uC5D0\uC11C Bot\uC744 \uCD94\uAC00\uD588\uB294\uC9C0 \uD655\uC778\uD558\uC138\uC694.",
-  SERVICE_ACCOUNT_NOT_ALLOWED: "\uC11C\uBE44\uC2A4 \uACC4\uC815\uC73C\uB85C\uB294 \uC774 API\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. `nworks login --user`\uB85C User OAuth \uB85C\uADF8\uC778\uD558\uC138\uC694.",
-  UNAUTHORIZED: "\uC778\uC99D\uC774 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4. `nworks login`\uC73C\uB85C \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694."
+  FORBIDDEN: "Insufficient permission. Check the OAuth scopes in the Developer Console.",
+  ACCESS_DENIED: "Access denied. Make sure the Bot is added in the Admin console.",
+  SERVICE_ACCOUNT_NOT_ALLOWED: "This API is not available with a Service Account. Log in with User OAuth via `nworks login --user`.",
+  UNAUTHORIZED: "Authentication expired. Log in again with `nworks login`."
 };
 var ERROR_HINTS_MCP = {
   FORBIDDEN: "\uAD8C\uD55C\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4. Developer Console\uC5D0\uC11C OAuth Scope\uB97C \uD655\uC778\uD558\uC138\uC694.",
@@ -675,7 +787,7 @@ function buildScopeHint(area, mode) {
   const scopes = scope.split(" ").join(", ");
   if (mode === "cli") {
     return `
-  \u2192 \uC774 \uBA85\uB839\uC5B4\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \`nworks login --user --scope "${scope}"\`\uB97C \uC2E4\uD589\uD558\uC138\uC694.`;
+  \u2192 This command requires the ${scopes} scope(s). Run \`nworks login --user --scope "${scope}"\`.`;
   }
   return `
   \u2192 \uC774 API\uB294 ${scopes} scope\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. nworks_login_user tool\uB85C \uB85C\uADF8\uC778\uD558\uC138\uC694 (scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uC54A\uC73C\uBA74 \uC804\uCCB4 \uAD8C\uD55C\uC774 \uC790\uB3D9 \uD3EC\uD568\uB429\uB2C8\uB2E4).`;
@@ -768,7 +880,7 @@ import { Command as Command4 } from "commander";
 var BASE_URL = "https://www.worksapis.com/v1.0";
 var MAX_RETRIES = 3;
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function request(opts, _retryCount = 0) {
   const { method, path, body, profile = "default" } = opts;
@@ -818,8 +930,8 @@ async function request(opts, _retryCount = 0) {
 }
 
 // src/utils/sanitize.ts
-import { basename, resolve, sep } from "path";
-import { randomBytes as randomBytes3 } from "crypto";
+import { resolve, sep } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
 function sanitizePathSegment(value) {
   if (!value || typeof value !== "string") {
     throw new Error("Path segment must be a non-empty string");
@@ -834,8 +946,9 @@ function sanitizeFileName(name) {
   if (!name || typeof name !== "string") {
     throw new Error("File name must be a non-empty string");
   }
-  const base = basename(name);
-  return base.replace(/[\r\n"\\]/g, "_");
+  const segments = name.split(/[/\\]/).filter((s) => s.length > 0);
+  const base = segments[segments.length - 1] ?? "";
+  return base.replace(/[\r\n"]/g, "_");
 }
 function validateLocalPath(filePath, allowedBase) {
   const resolved = resolve(filePath);
@@ -866,7 +979,7 @@ function validateRedirectUrl(location, allowedHosts) {
   return location;
 }
 function generateSecureState() {
-  return randomBytes3(32).toString("hex");
+  return randomBytes2(32).toString("hex");
 }
 
 // src/api/message.ts
@@ -988,20 +1101,25 @@ var messageCommand = new Command4("message").description("Bot message operations
 import { Command as Command5 } from "commander";
 
 // src/api/directory.ts
-async function listUsers(profile = "default") {
+async function listUsers(count = 100, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
   const result = await request({
     method: "GET",
-    path: "/users",
+    path: `/users?${params.toString()}`,
     profile
   });
   return { users: result.users ?? [], responseMetaData: result.responseMetaData };
 }
 
 // src/commands/directory.ts
-var membersCommand2 = new Command5("members").description("List organization members (requires directory.read scope)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+var membersCommand2 = new Command5("members").description("List organization members (requires directory.read scope)").option("--count <n>", "Items per page (default: 100)").option("--cursor <cursor>", "Pagination cursor from a previous response").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
   try {
-    const result = await listUsers(opts.profile);
+    const count = opts.count ? Number(opts.count) : 100;
+    const result = await listUsers(count, opts.cursor, opts.profile);
     const formatted = {
+      nextCursor: result.responseMetaData?.nextCursor ?? null,
       users: result.users.map((u) => ({
         userId: u.userId,
         userName: [u.userName?.lastName, u.userName?.firstName].filter(Boolean).join(" ") || "",
@@ -1024,6 +1142,7 @@ import { Command as Command6 } from "commander";
 import { randomUUID } from "crypto";
 
 // src/auth/token-user.ts
+var inFlightRefresh = /* @__PURE__ */ new Map();
 async function getValidUserToken(profile = "default") {
   const cached = await loadUserToken(profile);
   if (!cached) {
@@ -1034,22 +1153,106 @@ async function getValidUserToken(profile = "default") {
   if (cached.expiresAt > Date.now() / 1e3 + 300) {
     return cached.accessToken;
   }
+  return refreshValidUserToken(profile);
+}
+function refreshValidUserToken(profile = "default") {
+  const existing = inFlightRefresh.get(profile);
+  if (existing) return existing;
+  const run = doRefresh(profile);
+  inFlightRefresh.set(profile, run);
+  void run.finally(() => inFlightRefresh.delete(profile)).catch(() => {
+  });
+  return run;
+}
+async function doRefresh(profile) {
+  const cached = await loadUserToken(profile);
+  if (!cached) {
+    throw new AuthError(
+      "User OAuth token not found. Run `nworks login --user` first."
+    );
+  }
   const refreshed = await refreshUserToken(cached.refreshToken, profile);
   await saveUserToken(refreshed, profile);
   return refreshed.accessToken;
 }
 
-// src/api/calendar.ts
-var BASE_URL2 = "https://www.worksapis.com/v1.0";
-async function authedFetch(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
+// src/api/user-client.ts
+var MAX_RETRIES2 = 3;
+var MAX_RETRY_AFTER_SECONDS = 60;
+var MAX_CONCURRENT_PER_HOST = 5;
+function sleep2(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+var HostSemaphore = class {
+  constructor(max) {
+    this.max = max;
+  }
+  active = 0;
+  waiters = [];
+  async acquire() {
+    if (this.active < this.max) {
+      this.active++;
+      return;
+    }
+    await new Promise((resolve3) => this.waiters.push(resolve3));
+  }
+  release() {
+    const next = this.waiters.shift();
+    if (next) {
+      next();
+    } else {
+      this.active--;
+    }
+  }
+};
+var semaphores = /* @__PURE__ */ new Map();
+function semaphoreFor(host) {
+  let semaphore = semaphores.get(host);
+  if (!semaphore) {
+    semaphore = new HostSemaphore(MAX_CONCURRENT_PER_HOST);
+    semaphores.set(host, semaphore);
+  }
+  return semaphore;
+}
+async function userFetch(url, init, profile) {
+  let refreshedOn401 = false;
+  for (let attempt = 0; ; attempt++) {
+    const res = await fetchOnce(url, init, profile);
+    if (res.status === 401 && !refreshedOn401) {
+      refreshedOn401 = true;
+      await refreshValidUserToken(profile);
+      continue;
+    }
+    if (res.status === 429 && attempt < MAX_RETRIES2) {
+      await sleep2(retryAfterMs(res));
+      continue;
+    }
+    return res;
+  }
+}
+async function fetchOnce(url, init, profile) {
+  const host = new URL(url).host;
+  const semaphore = semaphoreFor(host);
+  await semaphore.acquire();
+  try {
+    const token = await getValidUserToken(profile);
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return await fetch(url, { ...init, headers });
+  } finally {
+    semaphore.release();
+  }
+}
+function retryAfterMs(res) {
+  const raw = parseInt(res.headers.get("Retry-After") ?? "5", 10);
+  const seconds = Math.min(Number.isNaN(raw) ? 5 : raw, MAX_RETRY_AFTER_SECONDS);
+  return seconds * 1e3;
 }
-async function handleError(res) {
+async function handleUserApiError(res) {
   if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope calendar` again.");
+    throw new AuthError(
+      "User token expired or revoked. Run `nworks login --user` again."
+    );
   }
   let code = "UNKNOWN";
   let description = `HTTP ${res.status}`;
@@ -1061,6 +1264,9 @@ async function handleError(res) {
   }
   throw new ApiError(code, description, res.status);
 }
+
+// src/api/calendar.ts
+var BASE_URL2 = "https://www.worksapis.com/v1.0";
 function generateEventId() {
   return `event-${randomUUID()}`;
 }
@@ -1078,8 +1284,8 @@ async function listEvents(fromDateTime, untilDateTime, userId = "me", profile =
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return { events: data.events ?? [] };
 }
@@ -1116,7 +1322,7 @@ async function createEvent(opts) {
     console.error(`[nworks] POST ${url}`);
     console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -1128,7 +1334,7 @@ async function createEvent(opts) {
   if (res.status === 201) {
     return await res.json();
   }
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
 async function getEvent(eventId, userId = "me", profile = "default") {
@@ -1136,8 +1342,8 @@ async function getEvent(eventId, userId = "me", profile = "default") {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   const event = data.eventComponents[0];
   if (!event) throw new ApiError("NOT_FOUND", "Event not found", 404);
@@ -1180,7 +1386,7 @@ async function updateEvent(opts) {
     console.error(`[nworks] PUT ${url}`);
     console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch(
+  const res = await userFetch(
     url,
     {
       method: "PUT",
@@ -1189,7 +1395,7 @@ async function updateEvent(opts) {
     },
     profile
   );
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function deleteEvent(eventId, userId = "me", sendNotification = false, profile = "default") {
   const params = new URLSearchParams();
@@ -1198,9 +1404,9 @@ async function deleteEvent(eventId, userId = "me", sendNotification = false, pro
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] DELETE ${url}`);
   }
-  const res = await authedFetch(url, { method: "DELETE" }, profile);
+  const res = await userFetch(url, { method: "DELETE" }, profile);
   if (res.status === 204) return;
-  if (!res.ok) return handleError(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 
 // src/commands/calendar.ts
@@ -1321,34 +1527,15 @@ import { Command as Command7 } from "commander";
 
 // src/api/drive.ts
 import { readFile as readFile4, stat as stat2 } from "fs/promises";
-import { basename as basename2 } from "path";
+import { basename } from "path";
 var BASE_URL3 = "https://www.worksapis.com/v1.0";
 var MAX_UPLOAD_SIZE = 100 * 1024 * 1024;
 var ALLOWED_HOSTS = [
   "storage.worksmobile.com",
+  "apis-storage.worksmobile.com",
   "www.worksapis.com",
   "worksapis.com"
 ];
-async function authedFetch2(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError2(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope file` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
 async function listFiles(userId = "me", folderId, count = 20, cursor, profile = "default") {
   const base = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files`;
   const path = folderId ? `${base}/${sanitizePathSegment(folderId)}/children` : base;
@@ -1359,13 +1546,13 @@ async function listFiles(userId = "me", folderId, count = 20, cursor, profile =
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch2(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError2(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return { files: data.files ?? [], responseMetaData: data.responseMetaData };
 }
 async function uploadFile(localPath, userId = "me", folderId, overwrite = false, profile = "default") {
-  const fileName = basename2(localPath);
+  const fileName = basename(localPath);
   const safeName = sanitizeFileName(fileName);
   const fileStat = await stat2(localPath);
   const fileSize = fileStat.size;
@@ -1377,7 +1564,7 @@ async function uploadFile(localPath, userId = "me", folderId, overwrite = false,
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${createUrl} (create upload URL)`);
   }
-  const createRes = await authedFetch2(
+  const createRes = await userFetch(
     createUrl,
     {
       method: "POST",
@@ -1386,7 +1573,7 @@ async function uploadFile(localPath, userId = "me", folderId, overwrite = false,
     },
     profile
   );
-  if (!createRes.ok) return handleError2(createRes);
+  if (!createRes.ok) return handleUserApiError(createRes);
   const { uploadUrl } = await createRes.json();
   validateRedirectUrl(uploadUrl, ALLOWED_HOSTS);
   const fileBuffer = await readFile4(localPath);
@@ -1405,7 +1592,7 @@ Content-Type: application/octet-stream\r
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${uploadUrl} (upload content, ${fileSize} bytes)`);
   }
-  const uploadRes = await authedFetch2(
+  const uploadRes = await userFetch(
     uploadUrl,
     {
       method: "POST",
@@ -1414,7 +1601,7 @@ Content-Type: application/octet-stream\r
     },
     profile
   );
-  if (!uploadRes.ok) return handleError2(uploadRes);
+  if (!uploadRes.ok) return handleUserApiError(uploadRes);
   return await uploadRes.json();
 }
 async function uploadBuffer(fileBuffer, fileName, userId = "me", folderId, overwrite = false, profile = "default") {
@@ -1427,7 +1614,7 @@ async function uploadBuffer(fileBuffer, fileName, userId = "me", folderId, overw
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${createUrl} (create upload URL for buffer)`);
   }
-  const createRes = await authedFetch2(
+  const createRes = await userFetch(
     createUrl,
     {
       method: "POST",
@@ -1436,7 +1623,7 @@ async function uploadBuffer(fileBuffer, fileName, userId = "me", folderId, overw
     },
     profile
   );
-  if (!createRes.ok) return handleError2(createRes);
+  if (!createRes.ok) return handleUserApiError(createRes);
   const { uploadUrl } = await createRes.json();
   validateRedirectUrl(uploadUrl, ALLOWED_HOSTS);
   const boundary = `----nworks${Date.now()}`;
@@ -1454,7 +1641,7 @@ Content-Type: application/octet-stream\r
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${uploadUrl} (upload buffer, ${fileSize} bytes)`);
   }
-  const uploadRes = await authedFetch2(
+  const uploadRes = await userFetch(
     uploadUrl,
     {
       method: "POST",
@@ -1463,33 +1650,29 @@ Content-Type: application/octet-stream\r
     },
     profile
   );
-  if (!uploadRes.ok) return handleError2(uploadRes);
+  if (!uploadRes.ok) return handleUserApiError(uploadRes);
   return await uploadRes.json();
 }
-async function downloadFile(fileId, userId = "me", profile = "default") {
-  const url = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files/${sanitizePathSegment(fileId)}/download`;
+async function downloadViaRedirect(url, profile) {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url} (get download URL)`);
   }
-  const redirectRes = await authedFetch2(
+  const redirectRes = await userFetch(
     url,
     { method: "GET", redirect: "manual" },
     profile
   );
-  if (redirectRes.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope file` again.");
-  }
   const location = redirectRes.headers.get("location");
   if (!location) {
-    if (!redirectRes.ok) return handleError2(redirectRes);
+    if (!redirectRes.ok) return handleUserApiError(redirectRes);
     throw new ApiError("NO_REDIRECT", "No download URL returned", redirectRes.status);
   }
   const safeLocation = validateRedirectUrl(location, ALLOWED_HOSTS);
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${safeLocation} (download content)`);
   }
-  const downloadRes = await fetch(safeLocation, { method: "GET" });
-  if (!downloadRes.ok) return handleError2(downloadRes);
+  const downloadRes = await userFetch(safeLocation, { method: "GET" }, profile);
+  if (!downloadRes.ok) return handleUserApiError(downloadRes);
   const arrayBuffer = await downloadRes.arrayBuffer();
   const buffer = Buffer.from(arrayBuffer);
   const disposition = downloadRes.headers.get("content-disposition");
@@ -1502,6 +1685,42 @@ async function downloadFile(fileId, userId = "me", profile = "default") {
   }
   return { buffer, fileName };
 }
+async function downloadFile(fileId, userId = "me", profile = "default") {
+  const url = `${BASE_URL3}/users/${sanitizePathSegment(userId)}/drive/files/${sanitizePathSegment(fileId)}/download`;
+  return downloadViaRedirect(url, profile);
+}
+async function listSharedDrives(count = 20, cursor, profile = "default") {
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${BASE_URL3}/sharedrives?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { sharedDrives: data.sharedrives ?? [], responseMetaData: data.responseMetaData };
+}
+async function listSharedDriveFiles(sharedriveId, folderId, count = 20, cursor, profile = "default") {
+  const base = `${BASE_URL3}/sharedrives/${sanitizePathSegment(sharedriveId)}/files`;
+  const path = folderId ? `${base}/${sanitizePathSegment(folderId)}/children` : base;
+  const params = new URLSearchParams();
+  params.set("count", String(count));
+  if (cursor) params.set("cursor", cursor);
+  const url = `${path}?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { files: data.files ?? [], responseMetaData: data.responseMetaData };
+}
+async function downloadSharedDriveFile(sharedriveId, fileId, profile = "default") {
+  const url = `${BASE_URL3}/sharedrives/${sanitizePathSegment(sharedriveId)}/files/${sanitizePathSegment(fileId)}/download`;
+  return downloadViaRedirect(url, profile);
+}
 
 // src/commands/drive.ts
 var listCommand2 = new Command7("list").description("List files in Drive (requires User OAuth with file or file.read scope)").option("--user <userId>", "Target user ID (default: me)").option("--folder <folderId>", "Folder ID to list (default: root)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
@@ -1595,33 +1814,86 @@ var downloadCommand = new Command7("download").description("Download a file from
     cliError(err, opts, "drive");
   }
 });
-var driveCommand = new Command7("drive").description("Drive operations (requires User OAuth with file scope)").addCommand(listCommand2).addCommand(uploadCommand).addCommand(downloadCommand);
+var sharedriveListCommand = new Command7("sharedrive-list").description("List shared drives (requires User OAuth with file or file.read scope)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await listSharedDrives(
+      parseInt(opts.count, 10),
+      opts.cursor,
+      opts.profile
+    );
+    output(
+      {
+        sharedDrives: result.sharedDrives,
+        count: result.sharedDrives.length,
+        nextCursor: result.responseMetaData?.nextCursor ?? null
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "drive");
+  }
+});
+var sharedriveFilesCommand = new Command7("sharedrive-files").description("List files in a shared drive (requires User OAuth with file or file.read scope)").requiredOption("--sharedrive <sharedriveId>", "Shared drive ID (from sharedrive-list)").option("--folder <fileId>", "Folder ID to list (default: root)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await listSharedDriveFiles(
+      opts.sharedrive,
+      opts.folder,
+      parseInt(opts.count, 10),
+      opts.cursor,
+      opts.profile
+    );
+    const files = result.files.map((f) => ({
+      name: f.fileName,
+      type: f.fileType,
+      size: f.fileSize,
+      modified: f.modifiedTime,
+      fileId: f.fileId
+    }));
+    output(
+      {
+        files,
+        count: files.length,
+        nextCursor: result.responseMetaData?.nextCursor ?? null
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "drive");
+  }
+});
+var sharedriveDownloadCommand = new Command7("sharedrive-download").description("Download a file from a shared drive (requires User OAuth with file or file.read scope)").requiredOption("--sharedrive <sharedriveId>", "Shared drive ID (from sharedrive-list)").requiredOption("--file-id <fileId>", "File ID to download").option("--out <path>", "Output directory (default: current directory)").option("--name <filename>", "Output filename (default: original name)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await downloadSharedDriveFile(
+      opts.sharedrive,
+      opts.fileId,
+      opts.profile
+    );
+    const fileName = opts.name ?? result.fileName ?? opts.fileId;
+    const outDir = opts.out ?? process.cwd();
+    const outPath = join2(outDir, fileName);
+    await writeFile2(outPath, result.buffer);
+    output(
+      {
+        success: true,
+        fileName,
+        path: outPath,
+        size: result.buffer.length
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "drive");
+  }
+});
+var driveCommand = new Command7("drive").description("Drive operations (requires User OAuth with file scope)").addCommand(listCommand2).addCommand(uploadCommand).addCommand(downloadCommand).addCommand(sharedriveListCommand).addCommand(sharedriveFilesCommand).addCommand(sharedriveDownloadCommand);
 
 // src/commands/mail.ts
+import { writeFile as writeFile3 } from "fs/promises";
+import { join as join3 } from "path";
 import { Command as Command8 } from "commander";
 
 // src/api/mail.ts
 var BASE_URL4 = "https://www.worksapis.com/v1.0";
-async function authedFetch3(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError3(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope mail` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
 async function sendMail(opts) {
   const userId = opts.userId ?? "me";
   const profile = opts.profile ?? "default";
@@ -1637,7 +1909,7 @@ async function sendMail(opts) {
   if (opts.cc) body.cc = opts.cc;
   if (opts.bcc) body.bcc = opts.bcc;
   if (opts.contentType) body.contentType = opts.contentType;
-  const res = await authedFetch3(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -1647,7 +1919,7 @@ async function sendMail(opts) {
     profile
   );
   if (res.status === 202) return;
-  if (!res.ok) return handleError3(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function listMails(folderId = 0, userId = "me", count = 30, cursor, isUnread, profile = "default") {
   const params = new URLSearchParams();
@@ -1658,8 +1930,8 @@ async function listMails(folderId = 0, userId = "me", count = 30, cursor, isUnre
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch3(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError3(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return {
     mails: data.mails ?? [],
@@ -1674,10 +1946,22 @@ async function readMail(mailId, userId = "me", profile = "default") {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch3(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError3(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
+async function downloadAttachment(mailId, attachmentId, userId = "me", profile = "default") {
+  const url = `${BASE_URL4}/users/${sanitizePathSegment(userId)}/mail/${sanitizePathSegment(
+    String(mailId)
+  )}/attachments/${sanitizePathSegment(String(attachmentId))}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { buffer: Buffer.from(data.data, "base64"), filename: data.filename };
+}
 
 // src/commands/mail.ts
 var sendCommand2 = new Command8("send").description("Send a mail (requires User OAuth with mail scope)").requiredOption("--to <emails>", "Recipient email addresses (separate with ;)").requiredOption("--subject <subject>", "Mail subject").option("--body <body>", "Mail body content").option("--cc <emails>", "CC email addresses (separate with ;)").option("--bcc <emails>", "BCC email addresses (separate with ;)").option("--content-type <type>", "Body format: html or text", "html").option("--user <userId>", "Sender user ID (default: me)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").option("--dry-run", "Print request without sending").action(async (opts) => {
@@ -1765,38 +2049,43 @@ var readCommand = new Command8("read").description("Read a specific mail (requir
     cliError(err, opts, "mail");
   }
 });
-var mailCommand = new Command8("mail").description("Mail operations (requires User OAuth with mail scope)").addCommand(sendCommand2).addCommand(listCommand3).addCommand(readCommand);
+var downloadAttachmentCommand = new Command8("download-attachment").description("Download a mail attachment (requires User OAuth with mail or mail.read scope)").requiredOption("--id <mailId>", "Mail ID (from mail list)").requiredOption("--attachment-id <attachmentId>", "Attachment ID (from mail read)").option("--out <path>", "Output directory (default: current directory)").option("--name <filename>", "Output filename (default: original name)").option("--user <userId>", "Target user ID (default: me)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await downloadAttachment(
+      parseInt(opts.id, 10),
+      parseInt(opts.attachmentId, 10),
+      opts.user ?? "me",
+      opts.profile
+    );
+    const fileName = opts.name ?? result.filename;
+    const outDir = opts.out ?? process.cwd();
+    const outPath = join3(outDir, fileName);
+    await writeFile3(outPath, result.buffer);
+    output(
+      {
+        success: true,
+        fileName,
+        path: outPath,
+        size: result.buffer.length
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "mail");
+  }
+});
+var mailCommand = new Command8("mail").description("Mail operations (requires User OAuth with mail scope)").addCommand(sendCommand2).addCommand(listCommand3).addCommand(readCommand).addCommand(downloadAttachmentCommand);
 
 // src/commands/task.ts
 import { Command as Command9 } from "commander";
 
 // src/api/task.ts
 var BASE_URL5 = "https://www.worksapis.com/v1.0";
-async function authedFetch4(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError4(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope task` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
 async function resolveUserId(userId, profile) {
   if (userId !== "me") return userId;
   const url = `${BASE_URL5}/users/${sanitizePathSegment(userId)}`;
-  const res = await authedFetch4(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError4(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] Resolved "me" \u2192 ${data.userId}`);
@@ -1813,8 +2102,8 @@ async function listTasks(categoryId = "default", userId = "me", count = 50, curs
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch4(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError4(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const data = await res.json();
   return { tasks: data.tasks ?? [], responseMetaData: data.responseMetaData };
 }
@@ -1838,7 +2127,7 @@ async function createTask(opts) {
     console.error(`[nworks] POST ${url}`);
     console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -1850,7 +2139,7 @@ async function createTask(opts) {
   if (res.status === 201) {
     return await res.json();
   }
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
 async function updateTask(opts) {
@@ -1863,7 +2152,7 @@ async function updateTask(opts) {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] PATCH ${url}`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     {
       method: "PATCH",
@@ -1872,7 +2161,7 @@ async function updateTask(opts) {
     },
     profile
   );
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
   return await res.json();
 }
 async function completeTask(taskId, profile = "default") {
@@ -1880,39 +2169,39 @@ async function completeTask(taskId, profile = "default") {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     { method: "POST" },
     profile
   );
   if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function incompleteTask(taskId, profile = "default") {
   const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}/incomplete`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] POST ${url}`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     { method: "POST" },
     profile
   );
   if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 async function deleteTask(taskId, profile = "default") {
   const url = `${BASE_URL5}/tasks/${sanitizePathSegment(taskId)}`;
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] DELETE ${url}`);
   }
-  const res = await authedFetch4(
+  const res = await userFetch(
     url,
     { method: "DELETE" },
     profile
   );
   if (res.status === 204) return;
-  if (!res.ok) return handleError4(res);
+  if (!res.ok) return handleUserApiError(res);
 }
 
 // src/commands/task.ts
@@ -2035,26 +2324,6 @@ import { Command as Command10 } from "commander";
 
 // src/api/board.ts
 var BASE_URL6 = "https://www.worksapis.com/v1.0";
-async function authedFetch5(url, init, profile) {
-  const token = await getValidUserToken(profile);
-  const headers = new Headers(init.headers);
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(url, { ...init, headers });
-}
-async function handleError5(res) {
-  if (res.status === 401) {
-    throw new AuthError("User token expired. Run `nworks login --user --scope board` again.");
-  }
-  let code = "UNKNOWN";
-  let description = `HTTP ${res.status}`;
-  try {
-    const body = await res.json();
-    code = body.code ?? code;
-    description = body.description ?? description;
-  } catch {
-  }
-  throw new ApiError(code, description, res.status);
-}
 function safeParseJson(text) {
   const safe = text.replace(
     /"((?:board|post|domain|user)Id)"\s*:\s*(\d{16,})/g,
@@ -2070,8 +2339,8 @@ async function listBoards(count = 20, cursor, profile = "default") {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const text = await res.text();
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
@@ -2087,8 +2356,8 @@ async function listPosts(boardId, count = 20, cursor, profile = "default") {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const text = await res.text();
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
@@ -2101,8 +2370,8 @@ async function readPost(boardId, postId, profile = "default") {
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] GET ${url}`);
   }
-  const res = await authedFetch5(url, { method: "GET" }, profile);
-  if (!res.ok) return handleError5(res);
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
   const text = await res.text();
   if (process.env["NWORKS_VERBOSE"] === "1") {
     console.error(`[nworks] Response: ${res.status} (${text.length} bytes)`);
@@ -2122,7 +2391,7 @@ async function createPost(opts) {
     console.error(`[nworks] POST ${url}`);
     console.error(`[nworks] Body: ${JSON.stringify(body).length} bytes`);
   }
-  const res = await authedFetch5(
+  const res = await userFetch(
     url,
     {
       method: "POST",
@@ -2138,7 +2407,7 @@ async function createPost(opts) {
     }
     return safeParseJson(text);
   }
-  return handleError5(res);
+  return handleUserApiError(res);
 }
 
 // src/commands/board.ts
@@ -2236,128 +2505,256 @@ var createCommand3 = new Command10("create").description("Create a post in a boa
 });
 var boardCommand = new Command10("board").description("Board operations (requires User OAuth)").addCommand(listCommand5).addCommand(postsCommand).addCommand(readCommand2).addCommand(createCommand3);
 
-// src/commands/mcp-cmd.ts
-import { Command as Command12 } from "commander";
-
-// src/mcp/server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-
-// src/mcp/tools.ts
-import { z } from "zod";
-
-// src/commands/doctor.ts
+// src/commands/contact.ts
 import { Command as Command11 } from "commander";
-import { existsSync as existsSync3 } from "fs";
-import { readFile as readFile5 } from "fs/promises";
-async function runChecks(profile) {
-  const results = [];
-  let creds;
-  try {
-    creds = await loadCredentials(profile);
-    results.push({ check: "credentials", status: "OK", detail: `clientId: ${creds.clientId}` });
-  } catch {
-    results.push({ check: "credentials", status: "FAIL", detail: "\uC778\uC99D \uC815\uBCF4 \uC5C6\uC74C. CLI: `nworks login --user` / MCP: nworks_setup tool \uC0AC\uC6A9 (\uD658\uACBD\uBCC0\uC218 NWORKS_CLIENT_SECRET \uD544\uC694)" });
-    return results;
+
+// src/api/contact.ts
+var BASE_URL7 = "https://www.worksapis.com/v1.0";
+async function listContacts(opts = {}) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const params = new URLSearchParams();
+  params.set("count", String(opts.count ?? 20));
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  if (opts.accessibleRange) params.set("accessibleRange", opts.accessibleRange);
+  if (opts.contactTagId) params.set("contactTagId", opts.contactTagId);
+  if (opts.email) params.set("email", opts.email);
+  if (opts.telephone) params.set("telephone", opts.telephone);
+  if (opts.orderBy) params.set("orderBy", opts.orderBy);
+  if (opts.searchDateType) params.set("searchDateType", opts.searchDateType);
+  if (opts.startDateTime) params.set("startDateTime", opts.startDateTime);
+  if (opts.endDateTime) params.set("endDateTime", opts.endDateTime);
+  const url = `${BASE_URL7}/users/${sanitizePathSegment(userId)}/contacts?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
   }
-  if (hasServiceAccountCreds(creds)) {
-    results.push({ check: "serviceAccount", status: "OK", detail: creds.serviceAccount });
-  } else {
-    results.push({ check: "serviceAccount", status: "SKIP", detail: "\uBBF8\uC124\uC815 (\uBD07 \uBA54\uC2DC\uC9C0 \uC0AC\uC6A9 \uC2DC \uD544\uC694)" });
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { contacts: data.contacts ?? [], responseMetaData: data.responseMetaData };
+}
+async function getContact(contactId, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
   }
-  if (creds.privateKeyPath) {
-    if (existsSync3(creds.privateKeyPath)) {
-      try {
-        await readFile5(creds.privateKeyPath, "utf-8");
-        results.push({ check: "privateKey", status: "OK", detail: creds.privateKeyPath });
-      } catch {
-        results.push({ check: "privateKey", status: "FAIL", detail: `\uC77D\uAE30 \uBD88\uAC00: ${creds.privateKeyPath}` });
-      }
-    } else {
-      results.push({ check: "privateKey", status: "FAIL", detail: `\uD30C\uC77C \uC5C6\uC74C: ${creds.privateKeyPath}` });
-    }
-  } else {
-    results.push({ check: "privateKey", status: "SKIP", detail: "\uBBF8\uC124\uC815" });
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function createContact(payload, profile = "default") {
+  const url = `${BASE_URL7}/contacts`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] POST ${url}`);
   }
-  if (creds.botId) {
-    results.push({ check: "botId", status: "OK", detail: creds.botId });
-  } else {
-    results.push({ check: "botId", status: "SKIP", detail: "\uBBF8\uC124\uC815 (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)" });
+  const res = await userFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    },
+    profile
+  );
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function updateContact(contactId, payload, partial = true, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] ${partial ? "PATCH" : "PUT"} ${url}`);
   }
-  const token = await loadToken(profile);
-  if (token) {
-    const valid = token.expiresAt > Date.now() / 1e3;
-    results.push({
-      check: "serviceToken",
-      status: valid ? "OK" : "EXPIRED",
-      detail: valid ? `\uB9CC\uB8CC: ${new Date(token.expiresAt * 1e3).toISOString()}` : `\uB9CC\uB8CC\uB428: ${new Date(token.expiresAt * 1e3).toISOString()}`
-    });
-  } else {
-    results.push({ check: "serviceToken", status: "SKIP", detail: "\uD1A0\uD070 \uC5C6\uC74C" });
+  const res = await userFetch(
+    url,
+    {
+      method: partial ? "PATCH" : "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    },
+    profile
+  );
+  if (!res.ok) return handleUserApiError(res);
+  return await res.json();
+}
+async function deleteContact(contactId, profile = "default") {
+  const url = `${BASE_URL7}/contacts/${sanitizePathSegment(contactId)}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] DELETE ${url}`);
   }
-  const userToken = await loadUserToken(profile);
-  if (userToken) {
-    const valid = userToken.expiresAt > Date.now() / 1e3;
-    results.push({
-      check: "userOAuth",
-      status: valid ? "OK" : "EXPIRED",
-      detail: valid ? `scope: ${userToken.scope} | \uB9CC\uB8CC: ${new Date(userToken.expiresAt * 1e3).toISOString()}` : `\uB9CC\uB8CC\uB428 | scope: ${userToken.scope}`
+  const res = await userFetch(url, { method: "DELETE" }, profile);
+  if (res.status === 204) return;
+  if (!res.ok) return handleUserApiError(res);
+}
+async function listContactTags(opts = {}) {
+  const userId = opts.userId ?? "me";
+  const profile = opts.profile ?? "default";
+  const params = new URLSearchParams();
+  params.set("count", String(opts.count ?? 20));
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  const url = `${BASE_URL7}/users/${sanitizePathSegment(userId)}/contact-tags?${params.toString()}`;
+  if (process.env["NWORKS_VERBOSE"] === "1") {
+    console.error(`[nworks] GET ${url}`);
+  }
+  const res = await userFetch(url, { method: "GET" }, profile);
+  if (!res.ok) return handleUserApiError(res);
+  const data = await res.json();
+  return { contactTags: data.contactTags ?? [], responseMetaData: data.responseMetaData };
+}
+
+// src/commands/contact.ts
+var listCommand6 = new Command11("list").description("List contacts (requires User OAuth with contact or contact.read scope)").option("--user <userId>", "Target user ID (default: me)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--tag <contactTagId>", "Filter by contact tag ID").option("--email <email>", "Filter by email").option("--tel <telephone>", "Filter by phone number").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await listContacts({
+      userId: opts.user ?? "me",
+      count: parseInt(opts.count, 10),
+      cursor: opts.cursor,
+      contactTagId: opts.tag,
+      email: opts.email,
+      telephone: opts.tel,
+      profile: opts.profile
     });
-  } else {
-    results.push({ check: "userOAuth", status: "SKIP", detail: "\uD1A0\uD070 \uC5C6\uC74C. `nworks login --user` \uD544\uC694" });
+    output(
+      {
+        contacts: result.contacts,
+        count: result.contacts.length,
+        nextCursor: result.responseMetaData?.nextCursor ?? null
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "contact");
   }
-  if (hasServiceAccountCreds(creds) && token && token.expiresAt > Date.now() / 1e3) {
-    try {
-      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
-        headers: { Authorization: `Bearer ${token.accessToken}` }
-      });
-      if (res.ok) {
-        results.push({ check: "apiConnection", status: "OK", detail: "NAVER WORKS API \uC5F0\uACB0 \uC131\uACF5" });
-      } else {
-        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
-      }
-    } catch (e) {
-      results.push({ check: "apiConnection", status: "FAIL", detail: `\uC5F0\uACB0 \uC2E4\uD328: ${e.message}` });
-    }
-  } else if (userToken && userToken.expiresAt > Date.now() / 1e3) {
-    try {
-      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
-        headers: { Authorization: `Bearer ${userToken.accessToken}` }
-      });
-      if (res.ok) {
-        results.push({ check: "apiConnection", status: "OK", detail: "NAVER WORKS API \uC5F0\uACB0 \uC131\uACF5" });
-      } else {
-        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
-      }
-    } catch (e) {
-      results.push({ check: "apiConnection", status: "FAIL", detail: `\uC5F0\uACB0 \uC2E4\uD328: ${e.message}` });
-    }
-  } else {
-    results.push({ check: "apiConnection", status: "SKIP", detail: "\uC720\uD6A8\uD55C \uD1A0\uD070 \uC5C6\uC74C \u2014 API \uD14C\uC2A4\uD2B8 \uAC74\uB108\uB700" });
+});
+var getCommand = new Command11("get").description("Get a contact by ID (requires User OAuth with contact or contact.read scope)").requiredOption("--id <contactId>", "Contact ID (from contact list)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await getContact(opts.id, opts.profile);
+    output(result, opts);
+  } catch (err) {
+    cliError(err, opts, "contact");
   }
-  return results;
-}
-var doctorCommand = new Command11("doctor").description("Check nworks configuration and connectivity").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+});
+var createCommand4 = new Command11("create").description("Create a contact (requires User OAuth with contact scope)").requiredOption("--payload <json>", "Contact fields as JSON (passed through to the NAVER WORKS API)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").option("--dry-run", "Print request without creating").action(async (opts) => {
   try {
-    const results = await runChecks(opts.profile);
-    if (opts.json || !process.stdout.isTTY) {
-      output(results, opts);
-    } else {
-      console.log("\n  nworks doctor\n");
-      for (const r of results) {
-        const icon = r.status === "OK" ? "\u2705" : r.status === "SKIP" ? "\u2796" : "\u274C";
-        console.log(`  ${icon} ${r.check.padEnd(16)} ${r.detail}`);
-      }
-      console.log();
+    const payload = JSON.parse(opts.payload);
+    if (opts.dryRun) {
+      output({ dryRun: true, request: payload }, opts);
+      return;
     }
+    const result = await createContact(payload, opts.profile);
+    output({ success: true, ...result }, opts);
   } catch (err) {
-    cliError(err, opts);
+    cliError(err, opts, "contact");
+  }
+});
+var updateCommand3 = new Command11("update").description("Update a contact (requires User OAuth with contact scope)").requiredOption("--id <contactId>", "Contact ID (from contact list)").requiredOption("--payload <json>", "Fields to update as JSON (passed through to the NAVER WORKS API)").option("--replace", "Use PUT instead of PATCH (replace entire contact)", false).option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const payload = JSON.parse(opts.payload);
+    const result = await updateContact(
+      opts.id,
+      payload,
+      !opts.replace,
+      opts.profile
+    );
+    output({ success: true, ...result }, opts);
+  } catch (err) {
+    cliError(err, opts, "contact");
+  }
+});
+var deleteCommand3 = new Command11("delete").description("Delete a contact (requires User OAuth with contact scope)").requiredOption("--id <contactId>", "Contact ID (from contact list)").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    await deleteContact(opts.id, opts.profile);
+    output({ success: true, contactId: opts.id, message: "Contact deleted" }, opts);
+  } catch (err) {
+    cliError(err, opts, "contact");
+  }
+});
+var listTagsCommand = new Command11("list-tags").description("List contact tags (requires User OAuth with contact or contact.read scope)").option("--user <userId>", "Target user ID (default: me)").option("--count <n>", "Items per page (default: 20)", "20").option("--cursor <cursor>", "Pagination cursor").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const result = await listContactTags({
+      userId: opts.user ?? "me",
+      count: parseInt(opts.count, 10),
+      cursor: opts.cursor,
+      profile: opts.profile
+    });
+    output(
+      {
+        contactTags: result.contactTags,
+        count: result.contactTags.length,
+        nextCursor: result.responseMetaData?.nextCursor ?? null
+      },
+      opts
+    );
+  } catch (err) {
+    cliError(err, opts, "contact");
   }
 });
+var contactCommand = new Command11("contact").description("Contact operations (requires User OAuth with contact scope)").addCommand(listCommand6).addCommand(getCommand).addCommand(createCommand4).addCommand(updateCommand3).addCommand(deleteCommand3).addCommand(listTagsCommand);
 
-// src/mcp/tools.ts
-function registerTools(server) {
-  server.tool(
+// src/commands/mcp-cmd.ts
+import { Command as Command13 } from "commander";
+import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/mcp/tools/setup.ts
+import { z as z2 } from "zod";
+
+// src/mcp/tool-registry.ts
+var TOOL_ANNOTATIONS = {
+  nworks_setup: { title: "Save credentials", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  nworks_message_send: { title: "Send message", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_message_members: { title: "List channel members", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_directory_members: { title: "List organization members", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_list: { title: "List calendar events", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_create: { title: "Create calendar event", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_calendar_update: { title: "Update calendar event", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_calendar_delete: { title: "Delete calendar event", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_drive_list: { title: "List drive files", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_drive_upload: { title: "Upload file to drive", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  // download는 outputDir 지정 시 로컬 파일을 쓰므로 순수 읽기가 아니다(readOnlyHint=false).
+  nworks_drive_download: { title: "Download drive file", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_list: { title: "List shared drives", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_files: { title: "List shared drive files", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_sharedrive_download: { title: "Download shared drive file", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_mail_send: { title: "Send mail", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_mail_list: { title: "List mail", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_mail_read: { title: "Read mail", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  // drive_download와 같은 이유로 outputDir 지정 시 로컬 파일을 쓴다(readOnlyHint=false).
+  nworks_mail_download_attachment: { title: "Download mail attachment", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  nworks_task_list: { title: "List tasks", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_task_create: { title: "Create task", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_task_update: { title: "Update task", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_task_delete: { title: "Delete task", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_list: { title: "List boards", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_posts: { title: "List board posts", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_read: { title: "Read board post", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_board_create: { title: "Create board post", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_contact_list: { title: "List contacts", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_get: { title: "Get contact", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_create: { title: "Create contact", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_contact_update: { title: "Update contact", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_delete: { title: "Delete contact", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_contact_list_tags: { title: "List contact tags", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_login_user: { title: "Log in with User OAuth", readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  nworks_whoami: { title: "Show auth status", readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_logout: { title: "Log out", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  nworks_doctor: { title: "Diagnose connection", readOnlyHint: true, idempotentHint: true, openWorldHint: true }
+};
+function defineTool(server, name, description, inputSchema, handler) {
+  const annotations = TOOL_ANNOTATIONS[name];
+  server.registerTool(
+    name,
+    { description, inputSchema, ...annotations ? { annotations } : {} },
+    handler
+  );
+}
+
+// src/mcp/tools/setup.ts
+function registerSetupTools(server) {
+  defineTool(
+    server,
     "nworks_setup",
     `NAVER WORKS API \uC778\uC99D \uC815\uBCF4\uB97C \uC124\uC815\uD569\uB2C8\uB2E4.
 
@@ -2380,10 +2777,10 @@ function registerTools(server) {
 
 OAuth Redirect URI: http://localhost:9876/callback`,
     {
-      clientId: z.string().describe("Client ID (Developer Console\uC5D0\uC11C \uBC1C\uAE09)"),
-      serviceAccount: z.string().optional().describe("Service Account ID (\uC608: xxxxx.serviceaccount@domain)"),
-      botId: z.string().optional().describe("Bot ID (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)"),
-      domainId: z.string().optional().describe("Domain ID")
+      clientId: z2.string().describe("Client ID (Developer Console\uC5D0\uC11C \uBC1C\uAE09)"),
+      serviceAccount: z2.string().optional().describe("Service Account ID (\uC608: xxxxx.serviceaccount@domain)"),
+      botId: z2.string().optional().describe("Bot ID (\uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uD544\uC694)"),
+      domainId: z2.string().optional().describe("Domain ID")
     },
     async ({ clientId, serviceAccount, botId, domainId }) => {
       try {
@@ -2421,7 +2818,7 @@ OAuth Redirect URI: http://localhost:9876/callback`,
           nextSteps.push('NWORKS_PRIVATE_KEY_PATH \uD658\uACBD\uBCC0\uC218\uAC00 \uC124\uC815\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. Service Account \uC778\uC99D\uC5D0\uB294 Private Key \uD30C\uC77C \uACBD\uB85C\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4. \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC548\uB0B4\uD558\uC138\uC694: (1) Developer Console(https://dev.worksmobile.com)\uC5D0\uC11C Private Key\uB97C \uB2E4\uC6B4\uB85C\uB4DC (2) MCP \uC124\uC815 \uD30C\uC77C\uC758 env\uC5D0 NWORKS_PRIVATE_KEY_PATH\uB97C \uCD94\uAC00 (\uC608: "NWORKS_PRIVATE_KEY_PATH": "C:/keys/private.key") (3) MCP \uD074\uB77C\uC774\uC5B8\uD2B8 \uC7AC\uC2DC\uC791');
         }
         nextSteps.push("User OAuth\uAC00 \uD544\uC694\uD55C API\uB294 nworks_login_user tool\uB85C \uBE0C\uB77C\uC6B0\uC800 \uB85C\uADF8\uC778\uC744 \uC9C4\uD589\uD558\uC138\uC694");
-        const mask = (s) => s.length <= 4 ? "****" : `****${s.slice(-Math.min(4, Math.floor(s.length / 3)))}`;
+        const mask2 = (s) => s.length <= 4 ? "****" : `****${s.slice(-Math.min(4, Math.floor(s.length / 3)))}`;
         return {
           content: [
             {
@@ -2430,10 +2827,10 @@ OAuth Redirect URI: http://localhost:9876/callback`,
                 success: true,
                 message: "\uC778\uC99D \uC815\uBCF4\uAC00 \uC800\uC7A5\uB418\uC5C8\uC2B5\uB2C8\uB2E4.",
                 nextSteps,
-                clientId: mask(clientId),
-                clientSecret: `${mask(resolvedSecret)} (\uD658\uACBD\uBCC0\uC218)`,
+                clientId: mask2(clientId),
+                clientSecret: `${mask2(resolvedSecret)} (\uD658\uACBD\uBCC0\uC218)`,
                 serviceAccount: serviceAccount ?? null,
-                privateKeyPath: resolvedPrivateKeyPath ? `${mask(resolvedPrivateKeyPath)} (\uD658\uACBD\uBCC0\uC218)` : null,
+                privateKeyPath: resolvedPrivateKeyPath ? `${mask2(resolvedPrivateKeyPath)} (\uD658\uACBD\uBCC0\uC218)` : null,
                 botId: botId ?? null
               })
             }
@@ -2447,16 +2844,22 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/message.ts
+import { z as z3 } from "zod";
+function registerMessageTools(server) {
+  defineTool(
+    server,
     "nworks_message_send",
     "NAVER WORKS \uBA54\uC2DC\uC9C0\uB97C \uC804\uC1A1\uD569\uB2C8\uB2E4 (\uBD07\uC774 \uC0AC\uC6A9\uC790 \uB610\uB294 \uCC44\uB110\uC5D0 \uBC1C\uC1A1). Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup\uC5D0\uC11C serviceAccount, botId \uC124\uC815 + \uD658\uACBD\uBCC0\uC218 NWORKS_PRIVATE_KEY_PATH \uD544\uC694. User OAuth \uBD88\uD544\uC694)",
     {
-      to: z.string().optional().describe("\uC218\uC2E0\uC790 userId (channel\uACFC \uD0DD 1). nworks_directory_members\uB85C userId \uC870\uD68C \uAC00\uB2A5"),
-      channel: z.string().optional().describe("\uCC44\uB110 channelId (to\uC640 \uD0DD 1). nworks_message_members\uB85C \uCC44\uB110 \uAD6C\uC131\uC6D0 \uD655\uC778 \uAC00\uB2A5"),
-      text: z.string().describe("\uBA54\uC2DC\uC9C0 \uBCF8\uBB38"),
-      type: z.enum(["text", "button", "list"]).optional().describe("\uBA54\uC2DC\uC9C0 \uD0C0\uC785 (\uAE30\uBCF8: text)"),
-      actions: z.string().optional().describe("\uBC84\uD2BC \uC561\uC158 JSON (type=button\uC77C \uB54C)"),
-      elements: z.string().optional().describe("\uB9AC\uC2A4\uD2B8 \uD56D\uBAA9 JSON (type=list\uC77C \uB54C)")
+      to: z3.string().optional().describe("\uC218\uC2E0\uC790 userId (channel\uACFC \uD0DD 1). nworks_directory_members\uB85C userId \uC870\uD68C \uAC00\uB2A5"),
+      channel: z3.string().optional().describe("\uCC44\uB110 channelId (to\uC640 \uD0DD 1). nworks_message_members\uB85C \uCC44\uB110 \uAD6C\uC131\uC6D0 \uD655\uC778 \uAC00\uB2A5"),
+      text: z3.string().describe("\uBA54\uC2DC\uC9C0 \uBCF8\uBB38"),
+      type: z3.enum(["text", "button", "list"]).optional().describe("\uBA54\uC2DC\uC9C0 \uD0C0\uC785 (\uAE30\uBCF8: text)"),
+      actions: z3.string().optional().describe("\uBC84\uD2BC \uC561\uC158 JSON (type=button\uC77C \uB54C)"),
+      elements: z3.string().optional().describe("\uB9AC\uC2A4\uD2B8 \uD56D\uBAA9 JSON (type=list\uC77C \uB54C)")
     },
     async ({ to, channel, text, type, actions, elements }) => {
       try {
@@ -2479,11 +2882,12 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_message_members",
     "\uD2B9\uC815 \uCC44\uB110\uC758 \uAD6C\uC131\uC6D0 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uCC44\uB110\uC5D0 \uB204\uAC00 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694)",
     {
-      channel: z.string().describe("\uCC44\uB110 channelId")
+      channel: z3.string().describe("\uCC44\uB110 channelId")
     },
     async ({ channel }) => {
       try {
@@ -2499,15 +2903,29 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/directory.ts
+import { z as z4 } from "zod";
+function registerDirectoryTools(server) {
+  defineTool(
+    server,
     "nworks_directory_members",
-    "NAVER WORKS \uC870\uC9C1 \uAD6C\uC131\uC6D0(\uC9C1\uC6D0) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAD6C\uC131\uC6D0 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uD300\uC6D0 \uCC3E\uC544\uC918', '\uB204\uAD6C\uD55C\uD14C \uBA54\uC2DC\uC9C0 \uBCF4\uB0BC\uC9C0 userId \uCC3E\uAE30' \uB4F1\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694). \uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uC218\uC2E0\uC790 userId\uB97C \uC5EC\uAE30\uC11C \uC870\uD68C \uAC00\uB2A5",
-    {},
-    async () => {
+    "NAVER WORKS \uC870\uC9C1 \uAD6C\uC131\uC6D0(\uC9C1\uC6D0) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAD6C\uC131\uC6D0 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uD300\uC6D0 \uCC3E\uC544\uC918', '\uB204\uAD6C\uD55C\uD14C \uBA54\uC2DC\uC9C0 \uBCF4\uB0BC\uC9C0 userId \uCC3E\uAE30' \uB4F1\uC5D0 \uC0AC\uC6A9. Service Account \uC778\uC99D \uC0AC\uC6A9 (nworks_setup \uD544\uC694). \uBA54\uC2DC\uC9C0 \uC804\uC1A1 \uC2DC \uC218\uC2E0\uC790 userId\uB97C \uC5EC\uAE30\uC11C \uC870\uD68C \uAC00\uB2A5. \uAD6C\uC131\uC6D0\uC774 \uB9CE\uC73C\uBA74 nextCursor\uB85C \uB2E4\uC74C \uD398\uC774\uC9C0\uB97C \uC774\uC5B4\uC11C \uC870\uD68C",
+    {
+      count: z4.number().int().min(1).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 100)"),
+      cursor: z4.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C (\uC774\uC804 \uC751\uB2F5\uC758 nextCursor \uAC12)")
+    },
+    async ({ count, cursor }) => {
       try {
-        const result = await listUsers();
+        const result = await listUsers(count ?? 100, cursor);
         return {
-          content: [{ type: "text", text: JSON.stringify(result) }]
+          content: [{ type: "text", text: JSON.stringify({
+            users: result.users,
+            count: result.users.length,
+            hasMore: !!result.responseMetaData?.nextCursor,
+            nextCursor: result.responseMetaData?.nextCursor ?? null
+          }) }]
         };
       } catch (err) {
         return {
@@ -2517,13 +2935,19 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/calendar.ts
+import { z as z5 } from "zod";
+function registerCalendarTools(server) {
+  defineTool(
+    server,
     "nworks_calendar_list",
     "\uC0AC\uC6A9\uC790\uC758 \uCE98\uB9B0\uB354 \uC77C\uC815/\uC2A4\uCF00\uC904\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC624\uB298 \uC77C\uC815 \uC54C\uB824\uC918', '\uC774\uBC88 \uC8FC \uC2A4\uCF00\uC904 \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar.read scope). \uBBF8\uB85C\uADF8\uC778 \uC2DC nworks_login_user\uB85C \uB85C\uADF8\uC778 \uD544\uC694",
     {
-      fromDateTime: z.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
-      untilDateTime: z.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      fromDateTime: z5.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
+      untilDateTime: z5.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss+09:00)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ fromDateTime, untilDateTime, userId }) => {
       try {
@@ -2552,19 +2976,20 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_calendar_create",
     "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD68C\uC758 \uC7A1\uC544\uC918', '\uC77C\uC815 \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope)",
     {
-      summary: z.string().describe("\uC77C\uC815 \uC81C\uBAA9"),
-      start: z.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      end: z.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      timeZone: z.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
-      description: z.string().optional().describe("\uC77C\uC815 \uC124\uBA85"),
-      location: z.string().optional().describe("\uC7A5\uC18C"),
-      attendees: z.array(z.object({ email: z.string(), displayName: z.string().optional() })).optional().describe("\uCC38\uC11D\uC790 \uBAA9\uB85D"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      summary: z5.string().describe("\uC77C\uC815 \uC81C\uBAA9"),
+      start: z5.string().describe("\uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      end: z5.string().describe("\uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      timeZone: z5.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
+      description: z5.string().optional().describe("\uC77C\uC815 \uC124\uBA85"),
+      location: z5.string().optional().describe("\uC7A5\uC18C"),
+      attendees: z5.array(z5.object({ email: z5.string(), displayName: z5.string().optional() })).optional().describe("\uCC38\uC11D\uC790 \uBAA9\uB85D"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({
       summary,
@@ -2601,19 +3026,20 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_calendar_update",
     "\uAE30\uC874 \uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC218\uC815\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uC2DC\uAC04 \uBCC0\uACBD\uD574\uC918', '\uD68C\uC758 \uC81C\uBAA9 \uBC14\uAFD4\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
     {
-      eventId: z.string().describe("\uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      summary: z.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
-      start: z.string().optional().describe("\uC0C8 \uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      end: z.string().optional().describe("\uC0C8 \uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
-      timeZone: z.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
-      description: z.string().optional().describe("\uC0C8 \uC124\uBA85"),
-      location: z.string().optional().describe("\uC0C8 \uC7A5\uC18C"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      eventId: z5.string().describe("\uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      summary: z5.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
+      start: z5.string().optional().describe("\uC0C8 \uC2DC\uC791 \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      end: z5.string().optional().describe("\uC0C8 \uC885\uB8CC \uC77C\uC2DC (YYYY-MM-DDThh:mm:ss)"),
+      timeZone: z5.string().optional().describe("\uD0C0\uC784\uC874 (\uAE30\uBCF8: Asia/Seoul)"),
+      description: z5.string().optional().describe("\uC0C8 \uC124\uBA85"),
+      location: z5.string().optional().describe("\uC0C8 \uC7A5\uC18C"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({
       eventId,
@@ -2649,13 +3075,14 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_calendar_delete",
     "\uCE98\uB9B0\uB354 \uC77C\uC815\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. '\uC77C\uC815 \uCDE8\uC18C\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (calendar + calendar.read scope). eventId\uB294 nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5",
     {
-      eventId: z.string().describe("\uC0AD\uC81C\uD560 \uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      sendNotification: z.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      eventId: z5.string().describe("\uC0AD\uC81C\uD560 \uC77C\uC815 ID (nworks_calendar_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      sendNotification: z5.boolean().optional().describe("\uCC38\uC11D\uC790\uC5D0\uAC8C \uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)"),
+      userId: z5.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ eventId, sendNotification, userId }) => {
       try {
@@ -2675,14 +3102,20 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/drive.ts
+import { z as z6 } from "zod";
+function registerDriveTools(server) {
+  defineTool(
+    server,
     "nworks_drive_list",
     "NAVER WORKS \uB4DC\uB77C\uC774\uBE0C\uC758 \uD30C\uC77C/\uD3F4\uB354 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C \uBCF4\uC5EC\uC918', '\uB0B4 \uD30C\uC77C \uBAA9\uB85D' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
     {
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
-      folderId: z.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      folderId: z6.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
     async ({ userId, folderId, count, cursor }) => {
       try {
@@ -2711,16 +3144,17 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_drive_upload",
     "\uD30C\uC77C\uC744 \uB4DC\uB77C\uC774\uBE0C\uC5D0 \uC5C5\uB85C\uB4DC\uD569\uB2C8\uB2E4 (User OAuth file scope \uD544\uC694). content(base64)\uC640 fileName\uC73C\uB85C \uC804\uB2EC\uD558\uAC70\uB098, filePath\uB85C \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C\uB97C \uC9C0\uC815\uD569\uB2C8\uB2E4. MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC5D0\uC11C\uB294 content+fileName \uBC29\uC2DD\uC744 \uAD8C\uC7A5\uD569\uB2C8\uB2E4.",
     {
-      content: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD30C\uC77C \uB0B4\uC6A9 (base64 \uC778\uCF54\uB529). filePath \uB300\uC2E0 \uC0AC\uC6A9"),
-      fileName: z.string().optional().describe("\uD30C\uC77C\uBA85 (content \uC0AC\uC6A9 \uC2DC \uD544\uC218)"),
-      filePath: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C (content \uB300\uC2E0 \uC0AC\uC6A9, \uB85C\uCEEC \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
-      folderId: z.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
-      overwrite: z.boolean().optional().describe("\uB3D9\uC77C \uD30C\uC77C\uBA85 \uB36E\uC5B4\uC4F0\uAE30 (\uAE30\uBCF8: false)")
+      content: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD30C\uC77C \uB0B4\uC6A9 (base64 \uC778\uCF54\uB529). filePath \uB300\uC2E0 \uC0AC\uC6A9"),
+      fileName: z6.string().optional().describe("\uD30C\uC77C\uBA85 (content \uC0AC\uC6A9 \uC2DC \uD544\uC218)"),
+      filePath: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uB85C\uCEEC \uD30C\uC77C \uACBD\uB85C (content \uB300\uC2E0 \uC0AC\uC6A9, \uB85C\uCEEC \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791)"),
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      folderId: z6.string().optional().describe("\uC5C5\uB85C\uB4DC\uD560 \uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      overwrite: z6.boolean().optional().describe("\uB3D9\uC77C \uD30C\uC77C\uBA85 \uB36E\uC5B4\uC4F0\uAE30 (\uAE30\uBCF8: false)")
     },
     async ({ content, fileName, filePath, userId, folderId, overwrite }) => {
       try {
@@ -2755,43 +3189,157 @@ OAuth Redirect URI: http://localhost:9876/callback`,
           };
         }
         return {
-          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
+        };
+      } catch (err) {
+        if (process.env["NWORKS_VERBOSE"] === "1") {
+          console.error(`[nworks] drive upload error: ${err.stack}`);
+        }
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.upload") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_drive_download",
+    "\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
+    {
+      fileId: z6.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_drive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z6.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z6.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
+      userId: z6.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ fileId, outputDir, outputName, userId }) => {
+      try {
+        const result = await downloadFile(
+          fileId,
+          userId ?? "me"
+        );
+        const fileName = outputName ?? result.fileName ?? fileId;
+        if (outputDir) {
+          const { writeFile: writeFile4 } = await import("fs/promises");
+          const { join: join5 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join5(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
+          await writeFile4(outPath, result.buffer);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
+          };
+        }
+        const MAX_INLINE_SIZE = 5 * 1024 * 1024;
+        if (result.buffer.length > MAX_INLINE_SIZE) {
+          const sizeMB = (result.buffer.length / (1024 * 1024)).toFixed(1);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: `\uD30C\uC77C\uC774 \uB108\uBB34 \uD07D\uB2C8\uB2E4 (${sizeMB}MB). outputDir\uB97C \uC9C0\uC815\uD574\uC11C \uB85C\uCEEC\uC5D0 \uC800\uC7A5\uD558\uC138\uC694.`, fileName, size: result.buffer.length }) }],
+            isError: true
+          };
+        }
+        const textExtensions = /\.(txt|md|csv|json|xml|html|htm|css|js|ts|jsx|tsx|yaml|yml|toml|ini|cfg|conf|log|sh|bash|zsh|py|rb|java|go|rs|c|cpp|h|hpp|sql|graphql|env|gitignore|dockerignore|editorconfig)$/i;
+        const isText = textExtensions.test(fileName);
+        if (isText) {
+          const text = result.buffer.toString("utf-8");
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "text", content: text }) }]
+          };
+        }
+        const base64 = result.buffer.toString("base64");
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "base64", content: base64 }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.download") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_sharedrive_list",
+    "NAVER WORKS \uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uBB50 \uC788\uC5B4?', '\uD300 \uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uCC3E\uC544\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
+    {
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+    },
+    async ({ count, cursor }) => {
+      try {
+        const result = await listSharedDrives(count ?? 20, cursor);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ sharedDrives: result.sharedDrives, count: result.sharedDrives.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_sharedrive_files",
+    "\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C\uC758 \uD30C\uC77C/\uD3F4\uB354 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. sharedriveId\uB294 nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope)",
+    {
+      sharedriveId: z6.string().describe("\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C ID (nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      folderId: z6.string().optional().describe("\uD3F4\uB354 ID (\uBBF8\uC9C0\uC815 \uC2DC \uB8E8\uD2B8)"),
+      count: z6.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 200)"),
+      cursor: z6.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+    },
+    async ({ sharedriveId, folderId, count, cursor }) => {
+      try {
+        const result = await listSharedDriveFiles(
+          sharedriveId,
+          folderId,
+          count ?? 20,
+          cursor
+        );
+        const files = result.files.map((f) => ({
+          fileId: f.fileId,
+          name: f.fileName,
+          type: f.fileType,
+          size: f.fileSize,
+          modified: f.modifiedTime,
+          path: f.filePath
+        }));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ files, count: files.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
         };
       } catch (err) {
-        if (process.env["NWORKS_VERBOSE"] === "1") {
-          console.error(`[nworks] drive upload error: ${err.stack}`);
-        }
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "drive.upload") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_files") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
-    "nworks_drive_download",
-    "\uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
+  defineTool(
+    server,
+    "nworks_sharedrive_download",
+    "\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C \uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (file.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
     {
-      fileId: z.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_drive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      outputDir: z.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
-      outputName: z.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      sharedriveId: z6.string().describe("\uACF5\uC720 \uB4DC\uB77C\uC774\uBE0C ID (nworks_sharedrive_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      fileId: z6.string().describe("\uB2E4\uC6B4\uB85C\uB4DC\uD560 \uD30C\uC77C ID (nworks_sharedrive_files\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z6.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z6.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)")
     },
-    async ({ fileId, outputDir, outputName, userId }) => {
+    async ({ sharedriveId, fileId, outputDir, outputName }) => {
       try {
-        const result = await downloadFile(
-          fileId,
-          userId ?? "me"
-        );
+        const result = await downloadSharedDriveFile(sharedriveId, fileId);
         const fileName = outputName ?? result.fileName ?? fileId;
         if (outputDir) {
-          const { writeFile: writeFile3 } = await import("fs/promises");
-          const { join: join3 } = await import("path");
+          const { writeFile: writeFile4 } = await import("fs/promises");
+          const { join: join5 } = await import("path");
           const safeDir = validateLocalPath(outputDir);
           const safeName = sanitizeFileName(fileName);
-          const outPath = join3(safeDir, safeName);
+          const outPath = join5(safeDir, safeName);
           validateLocalPath(outPath, safeDir);
-          await writeFile3(outPath, result.buffer);
+          await writeFile4(outPath, result.buffer);
           return {
             content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
           };
@@ -2818,23 +3366,29 @@ OAuth Redirect URI: http://localhost:9876/callback`,
         };
       } catch (err) {
         return {
-          content: [{ type: "text", text: mcpErrorHint(err, "drive.download") }],
+          content: [{ type: "text", text: mcpErrorHint(err, "drive.sharedrive_download") }],
           isError: true
         };
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/mail.ts
+import { z as z7 } from "zod";
+function registerMailTools(server) {
+  defineTool(
+    server,
     "nworks_mail_send",
     "NAVER WORKS \uBA54\uC77C\uC744 \uC804\uC1A1\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uBCF4\uB0B4\uC918', '\uC774\uBA54\uC77C \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uBE44\uB3D9\uAE30 \uC804\uC1A1(\uC131\uACF5 \uC2DC 202). User OAuth \uC778\uC99D \uD544\uC694 (mail scope)",
     {
-      to: z.string().describe("\uC218\uC2E0\uC790 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      subject: z.string().describe("\uBA54\uC77C \uC81C\uBAA9"),
-      body: z.string().optional().describe("\uBA54\uC77C \uBCF8\uBB38"),
-      cc: z.string().optional().describe("\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      bcc: z.string().optional().describe("\uC228\uC740\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
-      contentType: z.enum(["html", "text"]).optional().describe("\uBCF8\uBB38 \uD615\uC2DD (\uAE30\uBCF8: html)"),
-      userId: z.string().optional().describe("\uBC1C\uC2E0\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      to: z7.string().describe("\uC218\uC2E0\uC790 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      subject: z7.string().describe("\uBA54\uC77C \uC81C\uBAA9"),
+      body: z7.string().optional().describe("\uBA54\uC77C \uBCF8\uBB38"),
+      cc: z7.string().optional().describe("\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      bcc: z7.string().optional().describe("\uC228\uC740\uCC38\uC870 \uC774\uBA54\uC77C (\uC5EC\uB7EC \uBA85\uC740 ; \uB85C \uAD6C\uBD84)"),
+      contentType: z7.enum(["html", "text"]).optional().describe("\uBCF8\uBB38 \uD615\uC2DD (\uAE30\uBCF8: html)"),
+      userId: z7.string().optional().describe("\uBC1C\uC2E0\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ to, subject, body, cc, bcc, contentType, userId }) => {
       try {
@@ -2858,15 +3412,16 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_mail_list",
     "\uBC1B\uC740 \uBA54\uC77C \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uBA54\uC77C \uD655\uC778\uD574\uC918', '\uBC1B\uC740\uD3B8\uC9C0\uD568 \uBCF4\uC5EC\uC918', '\uC548 \uC77D\uC740 \uBA54\uC77C \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
     {
-      folderId: z.number().optional().describe("\uBA54\uC77C \uD3F4\uB354 ID (\uAE30\uBCF8: 0 = \uBC1B\uC740\uD3B8\uC9C0\uD568)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 30, \uCD5C\uB300: 200)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
-      isUnread: z.boolean().optional().describe("\uC77D\uC9C0 \uC54A\uC740 \uBA54\uC77C\uB9CC \uC870\uD68C"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      folderId: z7.number().int().min(0).optional().describe("\uBA54\uC77C \uD3F4\uB354 ID (\uAE30\uBCF8: 0 = \uBC1B\uC740\uD3B8\uC9C0\uD568)"),
+      count: z7.number().int().min(1).max(200).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 30, \uCD5C\uB300: 200)"),
+      cursor: z7.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      isUnread: z7.boolean().optional().describe("\uC77D\uC9C0 \uC54A\uC740 \uBA54\uC77C\uB9CC \uC870\uD68C"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ folderId, count, cursor, isUnread, userId }) => {
       try {
@@ -2896,12 +3451,13 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_mail_read",
     "\uD2B9\uC815 \uBA54\uC77C\uC758 \uC0C1\uC138 \uB0B4\uC6A9(\uBCF8\uBB38, \uCCA8\uBD80\uD30C\uC77C \uB4F1)\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC774 \uBA54\uC77C \uB0B4\uC6A9 \uBCF4\uC5EC\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. mailId\uB294 nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope)",
     {
-      mailId: z.number().describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      mailId: z7.number().int().min(0).describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ mailId, userId }) => {
       try {
@@ -2935,15 +3491,80 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
+    "nworks_mail_download_attachment",
+    "\uBA54\uC77C \uCCA8\uBD80\uD30C\uC77C\uC744 \uB2E4\uC6B4\uB85C\uB4DC\uD569\uB2C8\uB2E4. mailId\uC640 attachmentId\uB294 nworks_mail_read\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (mail.read scope). outputDir\uC744 \uC9C0\uC815\uD558\uBA74 \uB85C\uCEEC\uC5D0 \uD30C\uC77C\uB85C \uC800\uC7A5\uD558\uACE0, \uBBF8\uC9C0\uC815 \uC2DC \uD30C\uC77C \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658\uD569\uB2C8\uB2E4 (\uD14D\uC2A4\uD2B8\uB294 text, \uBC14\uC774\uB108\uB9AC\uB294 base64). 5MB \uCD08\uACFC \uD30C\uC77C\uC740 \uBC18\uB4DC\uC2DC outputDir\uB97C \uC9C0\uC815\uD574\uC57C \uD569\uB2C8\uB2E4.",
+    {
+      mailId: z7.number().int().min(0).describe("\uBA54\uC77C ID (nworks_mail_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      attachmentId: z7.number().int().min(0).describe("\uCCA8\uBD80\uD30C\uC77C ID (nworks_mail_read\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      outputDir: z7.string().optional().describe("\uC800\uC7A5 \uB514\uB809\uD1A0\uB9AC (\uC9C0\uC815 \uC2DC \uD30C\uC77C\uB85C \uC800\uC7A5, \uBBF8\uC9C0\uC815 \uC2DC \uB0B4\uC6A9\uC744 \uC9C1\uC811 \uBC18\uD658)"),
+      outputName: z7.string().optional().describe("\uC800\uC7A5 \uD30C\uC77C\uBA85 (\uBBF8\uC9C0\uC815 \uC2DC \uC6D0\uBCF8 \uD30C\uC77C\uBA85)"),
+      userId: z7.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+    },
+    async ({ mailId, attachmentId, outputDir, outputName, userId }) => {
+      try {
+        const result = await downloadAttachment(
+          mailId,
+          attachmentId,
+          userId ?? "me"
+        );
+        const fileName = outputName ?? result.filename;
+        if (outputDir) {
+          const { writeFile: writeFile4 } = await import("fs/promises");
+          const { join: join5 } = await import("path");
+          const safeDir = validateLocalPath(outputDir);
+          const safeName = sanitizeFileName(fileName);
+          const outPath = join5(safeDir, safeName);
+          validateLocalPath(outPath, safeDir);
+          await writeFile4(outPath, result.buffer);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, path: outPath, size: result.buffer.length }) }]
+          };
+        }
+        const MAX_INLINE_SIZE = 5 * 1024 * 1024;
+        if (result.buffer.length > MAX_INLINE_SIZE) {
+          const sizeMB = (result.buffer.length / (1024 * 1024)).toFixed(1);
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: true, message: `\uD30C\uC77C\uC774 \uB108\uBB34 \uD07D\uB2C8\uB2E4 (${sizeMB}MB). outputDir\uB97C \uC9C0\uC815\uD574\uC11C \uB85C\uCEEC\uC5D0 \uC800\uC7A5\uD558\uC138\uC694.`, fileName, size: result.buffer.length }) }],
+            isError: true
+          };
+        }
+        const textExtensions = /\.(txt|md|csv|json|xml|html|htm|css|js|ts|jsx|tsx|yaml|yml|toml|ini|cfg|conf|log|sh|bash|zsh|py|rb|java|go|rs|c|cpp|h|hpp|sql|graphql|env|gitignore|dockerignore|editorconfig)$/i;
+        const isText = textExtensions.test(fileName);
+        if (isText) {
+          const text = result.buffer.toString("utf-8");
+          return {
+            content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "text", content: text }) }]
+          };
+        }
+        const base64 = result.buffer.toString("base64");
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, fileName, size: result.buffer.length, encoding: "base64", content: base64 }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "mail.download_attachment") }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/task.ts
+import { z as z8 } from "zod";
+function registerTaskTools(server) {
+  defineTool(
+    server,
     "nworks_task_list",
     "\uD560 \uC77C(TODO) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uD560 \uC77C \uD655\uC778\uD574\uC918', 'TODO \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uB0A8\uC740 \uC5C5\uBB34 \uBB50 \uC788\uC5B4?' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (task.read scope)",
     {
-      categoryId: z.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID (\uAE30\uBCF8: default)"),
-      status: z.enum(["TODO", "ALL"]).optional().describe("\uD544\uD130: TODO \uB610\uB294 ALL (\uAE30\uBCF8: ALL)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 50, \uCD5C\uB300: 100)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
-      userId: z.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      categoryId: z8.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID (\uAE30\uBCF8: default)"),
+      status: z8.enum(["TODO", "ALL"]).optional().describe("\uD544\uD130: TODO \uB610\uB294 ALL (\uAE30\uBCF8: ALL)"),
+      count: z8.number().int().min(1).max(100).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 50, \uCD5C\uB300: 100)"),
+      cursor: z8.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      userId: z8.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ categoryId, status, count, cursor, userId }) => {
       try {
@@ -2973,16 +3594,17 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_create",
     "\uD560 \uC77C(TODO)\uC744 \uC0C8\uB85C \uB9CC\uB4ED\uB2C8\uB2E4. '\uD560 \uC77C \uCD94\uAC00\uD574\uC918', 'TODO \uB4F1\uB85D\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. \uAE30\uBCF8\uC801\uC73C\uB85C \uC790\uAE30 \uC790\uC2E0\uC5D0\uAC8C \uD560\uB2F9. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      title: z.string().describe("\uD560 \uC77C \uC81C\uBAA9"),
-      content: z.string().optional().describe("\uD560 \uC77C \uB0B4\uC6A9"),
-      dueDate: z.string().optional().describe("\uB9C8\uAC10\uC77C (YYYY-MM-DD)"),
-      categoryId: z.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID"),
-      assigneeIds: z.array(z.string()).optional().describe("\uB2F4\uB2F9\uC790 user ID \uBAA9\uB85D (\uBBF8\uC9C0\uC815 \uC2DC \uC790\uAE30 \uC790\uC2E0)"),
-      userId: z.string().optional().describe("\uC0DD\uC131\uC790 user ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
+      title: z8.string().describe("\uD560 \uC77C \uC81C\uBAA9"),
+      content: z8.string().optional().describe("\uD560 \uC77C \uB0B4\uC6A9"),
+      dueDate: z8.string().optional().describe("\uB9C8\uAC10\uC77C (YYYY-MM-DD)"),
+      categoryId: z8.string().optional().describe("\uCE74\uD14C\uACE0\uB9AC ID"),
+      assigneeIds: z8.array(z8.string()).optional().describe("\uB2F4\uB2F9\uC790 user ID \uBAA9\uB85D (\uBBF8\uC9C0\uC815 \uC2DC \uC790\uAE30 \uC790\uC2E0)"),
+      userId: z8.string().optional().describe("\uC0DD\uC131\uC790 user ID (\uBBF8\uC9C0\uC815 \uC2DC me)")
     },
     async ({ title, content, dueDate, categoryId, assigneeIds, userId }) => {
       try {
@@ -3005,15 +3627,16 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_update",
     "\uD560 \uC77C\uC744 \uC218\uC815\uD558\uAC70\uB098 \uC644\uB8CC \uCC98\uB9AC\uD569\uB2C8\uB2E4. '\uD560 \uC77C \uC644\uB8CC \uCC98\uB9AC\uD574\uC918', '\uB9C8\uAC10\uC77C \uBCC0\uACBD\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. taskId\uB294 nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      taskId: z.string().describe("\uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      status: z.enum(["done", "todo"]).optional().describe("\uC0C1\uD0DC \uBCC0\uACBD: done(\uC644\uB8CC) \uB610\uB294 todo(\uBBF8\uC644\uB8CC)"),
-      title: z.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
-      content: z.string().optional().describe("\uC0C8 \uB0B4\uC6A9"),
-      dueDate: z.string().optional().describe("\uC0C8 \uB9C8\uAC10\uC77C (YYYY-MM-DD)")
+      taskId: z8.string().describe("\uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      status: z8.enum(["done", "todo"]).optional().describe("\uC0C1\uD0DC \uBCC0\uACBD: done(\uC644\uB8CC) \uB610\uB294 todo(\uBBF8\uC644\uB8CC)"),
+      title: z8.string().optional().describe("\uC0C8 \uC81C\uBAA9"),
+      content: z8.string().optional().describe("\uC0C8 \uB0B4\uC6A9"),
+      dueDate: z8.string().optional().describe("\uC0C8 \uB9C8\uAC10\uC77C (YYYY-MM-DD)")
     },
     async ({ taskId, status, title, content, dueDate }) => {
       try {
@@ -3047,11 +3670,12 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_task_delete",
     "\uD560 \uC77C\uC744 \uC0AD\uC81C\uD569\uB2C8\uB2E4. taskId\uB294 nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (task + user.read scope)",
     {
-      taskId: z.string().describe("\uC0AD\uC81C\uD560 \uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+      taskId: z8.string().describe("\uC0AD\uC81C\uD560 \uD560 \uC77C ID (nworks_task_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
     },
     async ({ taskId }) => {
       try {
@@ -3067,12 +3691,18 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/board.ts
+import { z as z9 } from "zod";
+function registerBoardTools(server) {
+  defineTool(
+    server,
     "nworks_board_list",
     "NAVER WORKS \uAC8C\uC2DC\uD310 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310 \uBB50 \uC788\uC5B4?', '\uACF5\uC9C0\uC0AC\uD56D \uAC8C\uC2DC\uD310 \uCC3E\uC544\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
     {
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      count: z9.number().int().min(1).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20)"),
+      cursor: z9.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
     async ({ count, cursor }) => {
       try {
@@ -3093,13 +3723,14 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_board_posts",
     "\uAC8C\uC2DC\uD310\uC758 \uAE00 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310 \uAE00 \uBCF4\uC5EC\uC918', '\uACF5\uC9C0\uC0AC\uD56D \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      count: z.number().optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 40)"),
-      cursor: z.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      count: z9.number().int().min(1).max(40).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 40)"),
+      cursor: z9.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
     },
     async ({ boardId, count, cursor }) => {
       try {
@@ -3123,12 +3754,13 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_board_read",
     "\uAC8C\uC2DC\uD310 \uAE00\uC758 \uC0C1\uC138 \uB0B4\uC6A9\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. postId\uB294 nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board.read scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      postId: z.string().describe("\uAE00 ID (nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5)")
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      postId: z9.string().describe("\uAE00 ID (nworks_board_posts\uB85C \uC870\uD68C \uAC00\uB2A5)")
     },
     async ({ boardId, postId }) => {
       try {
@@ -3154,15 +3786,16 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_board_create",
     "\uAC8C\uC2DC\uD310\uC5D0 \uAE00\uC744 \uC791\uC131\uD569\uB2C8\uB2E4. '\uAC8C\uC2DC\uD310\uC5D0 \uAE00 \uC62C\uB824\uC918', '\uACF5\uC9C0 \uC791\uC131\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. boardId\uB294 nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (board scope)",
     {
-      boardId: z.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
-      title: z.string().describe("\uAE00 \uC81C\uBAA9"),
-      body: z.string().optional().describe("\uAE00 \uBCF8\uBB38"),
-      enableComment: z.boolean().optional().describe("\uB313\uAE00 \uD5C8\uC6A9 (\uAE30\uBCF8: true)"),
-      sendNotifications: z.boolean().optional().describe("\uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)")
+      boardId: z9.string().describe("\uAC8C\uC2DC\uD310 ID (nworks_board_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      title: z9.string().describe("\uAE00 \uC81C\uBAA9"),
+      body: z9.string().optional().describe("\uAE00 \uBCF8\uBB38"),
+      enableComment: z9.boolean().optional().describe("\uB313\uAE00 \uD5C8\uC6A9 (\uAE30\uBCF8: true)"),
+      sendNotifications: z9.boolean().optional().describe("\uC54C\uB9BC \uBC1C\uC1A1 (\uAE30\uBCF8: false)")
     },
     async ({ boardId, title, body, enableComment, sendNotifications }) => {
       try {
@@ -3184,33 +3817,173 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/mcp/tools/contact.ts
+import { z as z10 } from "zod";
+function registerContactTools(server) {
+  defineTool(
+    server,
+    "nworks_contact_list",
+    "NAVER WORKS \uAC1C\uC778 \uC5F0\uB77D\uCC98 \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uBAA9\uB85D \uBCF4\uC5EC\uC918', '\uB0B4 \uBA85\uD568\uCCA9 \uD655\uC778' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
+    {
+      userId: z10.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      count: z10.number().int().min(1).max(500).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 500)"),
+      cursor: z10.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C"),
+      contactTagId: z10.string().optional().describe("\uC5F0\uB77D\uCC98 \uD0DC\uADF8 ID\uB85C \uD544\uD130\uB9C1 (nworks_contact_list_tags\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      email: z10.string().optional().describe("\uC774\uBA54\uC77C\uB85C \uD544\uD130\uB9C1"),
+      telephone: z10.string().optional().describe("\uC804\uD654\uBC88\uD638\uB85C \uD544\uD130\uB9C1")
+    },
+    async ({ userId, count, cursor, contactTagId, email, telephone }) => {
+      try {
+        const result = await listContacts({
+          userId: userId ?? "me",
+          count: count ?? 20,
+          cursor,
+          contactTagId,
+          email,
+          telephone
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ contacts: result.contacts, count: result.contacts.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.list") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_get",
+    "\uD2B9\uC815 \uC5F0\uB77D\uCC98\uC758 \uC0C1\uC138 \uC815\uBCF4\uB97C \uC870\uD68C\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
+    {
+      contactId: z10.string().describe("\uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+    },
+    async ({ contactId }) => {
+      try {
+        const result = await getContact(contactId);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.get") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_create",
+    `\uC0C8 \uC5F0\uB77D\uCC98\uB97C \uB9CC\uB4ED\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uCD94\uAC00\uD574\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. payload\uB294 NAVER WORKS \uC5F0\uB77D\uCC98 API \uC2A4\uD399\uC5D0 \uB9DE\uB294 JSON \uAC1D\uCCB4\uB97C \uADF8\uB300\uB85C \uC804\uB2EC\uD569\uB2C8\uB2E4. contactName\uACFC permission\uC740 \uD544\uC218\uC774\uBA70, permission.accessibleMembers\uC5D0\uB294 \uCD5C\uC18C 1\uBA85\uC774 \uC788\uC5B4\uC57C \uD569\uB2C8\uB2E4(\uBCF4\uD1B5 \uBCF8\uC778). \uC608: {"contactName":{"lastName":"\uAE40","firstName":"\uCCA0\uC218"},"emails":[{"email":"a@b.com","primary":true}],"permission":{"accessibleRange":"MEMBER","isCoEditing":false,"accessibleMembers":[{"id":"<userId>","type":"USER"}]}}. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)`,
+    {
+      payload: z10.record(z10.string(), z10.unknown()).describe("\uC5F0\uB77D\uCC98 \uD544\uB4DC. \uD544\uC218: contactName, permission(accessibleRange\xB7isCoEditing\xB7accessibleMembers \uCD5C\uC18C 1\uBA85). \uC120\uD0DD: emails[], telephones[], organizations[], memo")
+    },
+    async ({ payload }) => {
+      try {
+        const result = await createContact(payload);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.create") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_update",
+    "\uAE30\uC874 \uC5F0\uB77D\uCC98\uB97C \uC218\uC815\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. payload\uB294 \uC218\uC815\uD560 \uD544\uB4DC\uB9CC \uB2F4\uC740 JSON \uAC1D\uCCB4\uC785\uB2C8\uB2E4. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)",
+    {
+      contactId: z10.string().describe("\uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)"),
+      payload: z10.record(z10.string(), z10.unknown()).describe("\uC218\uC815\uD560 \uD544\uB4DC (name, email, tel, company \uB4F1)"),
+      replace: z10.boolean().optional().describe("\uC804\uCCB4 \uAD50\uCCB4(PUT) \uC5EC\uBD80 (\uAE30\uBCF8: false, \uBD80\uBD84 \uC218\uC815 PATCH)")
+    },
+    async ({ contactId, payload, replace }) => {
+      try {
+        const result = await updateContact(contactId, payload, !(replace ?? false));
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, ...result }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.update") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_delete",
+    "\uC5F0\uB77D\uCC98\uB97C \uC0AD\uC81C\uD569\uB2C8\uB2E4. contactId\uB294 nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5. User OAuth \uC778\uC99D \uD544\uC694 (contact scope)",
+    {
+      contactId: z10.string().describe("\uC0AD\uC81C\uD560 \uC5F0\uB77D\uCC98 ID (nworks_contact_list\uB85C \uC870\uD68C \uAC00\uB2A5)")
+    },
+    async ({ contactId }) => {
+      try {
+        await deleteContact(contactId);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, contactId, message: "\uC5F0\uB77D\uCC98\uAC00 \uC0AD\uC81C\uB418\uC5C8\uC2B5\uB2C8\uB2E4" }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.delete") }],
+          isError: true
+        };
+      }
+    }
+  );
+  defineTool(
+    server,
+    "nworks_contact_list_tags",
+    "\uC5F0\uB77D\uCC98 \uD0DC\uADF8(\uADF8\uB8F9) \uBAA9\uB85D\uC744 \uC870\uD68C\uD569\uB2C8\uB2E4. '\uC5F0\uB77D\uCC98 \uD0DC\uADF8 \uBAA9\uB85D \uBCF4\uC5EC\uC918' \uB4F1\uC758 \uC694\uCCAD\uC5D0 \uC0AC\uC6A9. User OAuth \uC778\uC99D \uD544\uC694 (contact.read scope)",
+    {
+      userId: z10.string().optional().describe("\uB300\uC0C1 \uC0AC\uC6A9\uC790 ID (\uBBF8\uC9C0\uC815 \uC2DC me)"),
+      count: z10.number().int().min(1).max(500).optional().describe("\uD398\uC774\uC9C0\uB2F9 \uD56D\uBAA9 \uC218 (\uAE30\uBCF8: 20, \uCD5C\uB300: 500)"),
+      cursor: z10.string().optional().describe("\uD398\uC774\uC9C0\uB124\uC774\uC158 \uCEE4\uC11C")
+    },
+    async ({ userId, count, cursor }) => {
+      try {
+        const result = await listContactTags({ userId: userId ?? "me", count: count ?? 20, cursor });
+        return {
+          content: [{ type: "text", text: JSON.stringify({ contactTags: result.contactTags, count: result.contactTags.length, hasMore: !!result.responseMetaData?.nextCursor, nextCursor: result.responseMetaData?.nextCursor ?? null }) }]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: mcpErrorHint(err, "contact.list_tags") }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/mcp/tools/auth.ts
+import { z as z11 } from "zod";
+function registerAuthTools(server) {
+  defineTool(
+    server,
     "nworks_login_user",
-    "User OAuth \uB85C\uADF8\uC778\uC744 \uC2DC\uC791\uD569\uB2C8\uB2E4. \uBC18\uD658\uB41C URL\uC744 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5B4 NAVER WORKS\uC5D0 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uB85C\uADF8\uC778 \uC644\uB8CC \uD6C4 \uC790\uB3D9\uC73C\uB85C \uD1A0\uD070\uC774 \uC800\uC7A5\uB429\uB2C8\uB2E4. \uC911\uC694: scope\uB97C \uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694. \uAE30\uBCF8\uAC12\uC774 \uBAA8\uB4E0 API(\uCE98\uB9B0\uB354, \uBA54\uC77C, \uD560\uC77C, \uB4DC\uB77C\uC774\uBE0C, \uAC8C\uC2DC\uD310)\uB97C \uD3EC\uD568\uD558\uBBC0\uB85C \uD55C \uBC88 \uB85C\uADF8\uC778\uC73C\uB85C \uC804\uCCB4 \uAE30\uB2A5\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4. scope\uB97C \uC881\uAC8C \uC9C0\uC815\uD558\uBA74 \uB2E4\uB978 \uAE30\uB2A5 \uC0AC\uC6A9 \uC2DC \uC7AC\uB85C\uADF8\uC778\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.",
+    "User OAuth \uB85C\uADF8\uC778\uC744 \uC2DC\uC791\uD569\uB2C8\uB2E4. \uBC18\uD658\uB41C URL\uC744 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5B4 NAVER WORKS\uC5D0 \uB85C\uADF8\uC778\uD558\uC138\uC694. \uB85C\uADF8\uC778 \uC644\uB8CC \uD6C4 \uC790\uB3D9\uC73C\uB85C \uD1A0\uD070\uC774 \uC800\uC7A5\uB429\uB2C8\uB2E4. \uC911\uC694: preset\uC744 \uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694. \uAE30\uBCF8\uAC12(default=all)\uC774 \uBAA8\uB4E0 API(\uCE98\uB9B0\uB354, \uBA54\uC77C, \uD560\uC77C, \uB4DC\uB77C\uC774\uBE0C, \uAC8C\uC2DC\uD310)\uB97C \uD3EC\uD568\uD558\uBBC0\uB85C \uD55C \uBC88 \uB85C\uADF8\uC778\uC73C\uB85C \uC804\uCCB4 \uAE30\uB2A5\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4. \uC77D\uAE30 \uC804\uC6A9\uC73C\uB85C \uC81C\uD55C\uD558\uB824\uBA74 preset='readonly'\uB97C \uC9C0\uC815\uD558\uC138\uC694(\uC774 \uACBD\uC6B0 \uC0DD\uC131/\uC218\uC815/\uC0AD\uC81C \uB3C4\uAD6C\uB294 \uC7AC\uB85C\uADF8\uC778 \uD544\uC694).",
     {
-      scope: z.string().optional().describe("\uC9C0\uC815\uD558\uC9C0 \uB9C8\uC138\uC694 (\uAE30\uBCF8\uAC12\uC774 \uC804\uCCB4 scope \uD3EC\uD568). \uD2B9\uC218\uD55C \uACBD\uC6B0\uC5D0\uB9CC \uC0AC\uC6A9")
+      preset: z11.enum(["readonly", "default", "all"]).optional().describe("scope \uD504\uB9AC\uC14B. \uAE30\uBCF8 default(=all, \uC804\uCCB4 \uAE30\uB2A5). readonly\uB294 \uC77D\uAE30 \uC804\uC6A9."),
+      scope: z11.string().optional().describe("\uACE0\uAE09: \uACF5\uBC31 \uAD6C\uBD84 raw scope \uC9C1\uC811 \uC9C0\uC815(preset \uB300\uC2E0). \uD2B9\uC218\uD55C \uACBD\uC6B0\uC5D0\uB9CC \uC0AC\uC6A9")
     },
-    async ({ scope }) => {
-      const DEFAULT_SCOPE = "calendar calendar.read file file.read mail mail.read task task.read user.read board board.read";
+    async ({ preset, scope }) => {
       try {
         const creds = await loadCredentials();
-        const SCOPE_DEPS = {
-          calendar: ["calendar.read"],
-          task: ["user.read"],
-          "task.read": ["user.read"]
-        };
-        const expandScopes = (scopes) => {
-          const expanded = new Set(scopes);
-          for (const s of scopes) {
-            const deps = SCOPE_DEPS[s];
-            if (deps) deps.forEach((d) => expanded.add(d));
-          }
-          return [...expanded];
-        };
         const existingToken = await loadUserToken();
         const existingScopes = existingToken?.scope?.split(" ").filter(Boolean) ?? [];
-        const requestedScopes = expandScopes((scope ?? DEFAULT_SCOPE).split(" ").filter(Boolean));
-        const mergedScopes = [.../* @__PURE__ */ new Set([...existingScopes, ...requestedScopes])].join(" ");
+        const requestedScopes = resolveScopes(preset ?? scope);
+        const mergedScopes = mergeScopes(existingScopes, requestedScopes);
         const state = generateSecureState();
         const authorizeUrl = buildAuthorizeUrl(creds.clientId, mergedScopes, state);
         startOAuthCallbackServer(creds.clientId, creds.clientSecret, state).then(
@@ -3247,7 +4020,8 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_whoami",
     "\uD604\uC7AC \uC778\uC99D\uB41C NAVER WORKS \uACC4\uC815 \uC815\uBCF4\uC640 \uD1A0\uD070 \uC720\uD6A8 \uC0C1\uD0DC\uB97C \uD655\uC778\uD569\uB2C8\uB2E4. \uC778\uC99D \uBB38\uC81C \uC9C4\uB2E8 \uC2DC \uBA3C\uC800 \uD638\uCD9C",
     {},
@@ -3258,10 +4032,10 @@ OAuth Redirect URI: http://localhost:9876/callback`,
         const userToken = await loadUserToken();
         const isValid = token ? token.expiresAt > Date.now() / 1e3 : false;
         const userTokenValid = userToken ? userToken.expiresAt > Date.now() / 1e3 : false;
-        const mask = (s) => s.length <= 4 ? "****" : `****${s.slice(-4)}`;
+        const mask2 = (s) => s.length <= 4 ? "****" : `****${s.slice(-4)}`;
         const info = {
           serviceAccount: creds.serviceAccount ?? null,
-          clientId: mask(creds.clientId),
+          clientId: mask2(creds.clientId),
           botId: creds.botId ?? null,
           tokenValid: isValid,
           userOAuth: userToken ? { valid: userTokenValid, scope: userToken.scope } : null
@@ -3277,7 +4051,8 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+  defineTool(
+    server,
     "nworks_logout",
     "\uC800\uC7A5\uB41C NAVER WORKS \uC778\uC99D \uC815\uBCF4\uC640 \uD1A0\uD070\uC744 \uBAA8\uB450 \uC0AD\uC81C\uD569\uB2C8\uB2E4",
     {},
@@ -3315,7 +4090,141 @@ OAuth Redirect URI: http://localhost:9876/callback`,
       }
     }
   );
-  server.tool(
+}
+
+// src/commands/doctor.ts
+import { Command as Command12 } from "commander";
+import { existsSync as existsSync3 } from "fs";
+import { readFile as readFile5 } from "fs/promises";
+import { resolve as resolve2, join as join4, sep as sep2 } from "path";
+function mask(value) {
+  return value.length <= 4 ? "****" : `****${value.slice(-4)}`;
+}
+async function runChecks(profile) {
+  const results = [];
+  let creds;
+  try {
+    creds = await loadCredentials(profile);
+    results.push({ check: "credentials", status: "OK", detail: `clientId: ${mask(creds.clientId)}` });
+  } catch {
+    results.push({ check: "credentials", status: "FAIL", detail: "No credentials found. CLI: run `nworks login --user`. MCP: use the nworks_setup tool (env NWORKS_CLIENT_SECRET required)." });
+    return results;
+  }
+  if (hasServiceAccountCreds(creds)) {
+    results.push({ check: "serviceAccount", status: "OK", detail: creds.serviceAccount });
+  } else {
+    results.push({ check: "serviceAccount", status: "SKIP", detail: "Not set (required for bot messaging)" });
+  }
+  if (creds.privateKeyPath) {
+    if (existsSync3(creds.privateKeyPath)) {
+      try {
+        await readFile5(creds.privateKeyPath, "utf-8");
+        results.push({ check: "privateKey", status: "OK", detail: creds.privateKeyPath });
+      } catch {
+        results.push({ check: "privateKey", status: "FAIL", detail: `Cannot read: ${creds.privateKeyPath}` });
+      }
+    } else {
+      results.push({ check: "privateKey", status: "FAIL", detail: `File not found: ${creds.privateKeyPath}` });
+    }
+  } else {
+    results.push({ check: "privateKey", status: "SKIP", detail: "Not set" });
+  }
+  if (creds.privateKeyPath && existsSync3(creds.privateKeyPath)) {
+    const resolvedKey = resolve2(creds.privateKeyPath);
+    const cwd = resolve2(process.cwd());
+    const insideCwd = resolvedKey === cwd || resolvedKey.startsWith(cwd + sep2);
+    const looksLikeProject = existsSync3(join4(cwd, ".git")) || existsSync3(join4(cwd, "package.json"));
+    if (insideCwd && looksLikeProject) {
+      results.push({
+        check: "keyLocation",
+        status: "WARN",
+        detail: "Private key is inside a project directory. Risk of exposure via editor plugins, AI tools, or `npm pack` \u2014 move it outside (e.g. your home directory) and update the path."
+      });
+    }
+  }
+  if (creds.botId) {
+    results.push({ check: "botId", status: "OK", detail: creds.botId });
+  } else {
+    results.push({ check: "botId", status: "SKIP", detail: "Not set (required to send messages)" });
+  }
+  const token = await loadToken(profile);
+  if (token) {
+    const valid = token.expiresAt > Date.now() / 1e3;
+    results.push({
+      check: "serviceToken",
+      status: valid ? "OK" : "EXPIRED",
+      detail: valid ? `expires: ${new Date(token.expiresAt * 1e3).toISOString()}` : `expired: ${new Date(token.expiresAt * 1e3).toISOString()}`
+    });
+  } else {
+    results.push({ check: "serviceToken", status: "SKIP", detail: "No token" });
+  }
+  const userToken = await loadUserToken(profile);
+  if (userToken) {
+    const valid = userToken.expiresAt > Date.now() / 1e3;
+    results.push({
+      check: "userOAuth",
+      status: valid ? "OK" : "EXPIRED",
+      detail: valid ? `scope: ${userToken.scope} | expires: ${new Date(userToken.expiresAt * 1e3).toISOString()}` : `expired | scope: ${userToken.scope}`
+    });
+  } else {
+    results.push({ check: "userOAuth", status: "SKIP", detail: "No token. Run `nworks login --user`." });
+  }
+  if (hasServiceAccountCreds(creds) && token && token.expiresAt > Date.now() / 1e3) {
+    try {
+      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
+        headers: { Authorization: `Bearer ${token.accessToken}` }
+      });
+      if (res.ok) {
+        results.push({ check: "apiConnection", status: "OK", detail: "Connected to NAVER WORKS API" });
+      } else {
+        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
+      }
+    } catch (e) {
+      results.push({ check: "apiConnection", status: "FAIL", detail: `Connection failed: ${e.message}` });
+    }
+  } else if (userToken && userToken.expiresAt > Date.now() / 1e3) {
+    try {
+      const res = await fetch("https://www.worksapis.com/v1.0/users/me", {
+        headers: { Authorization: `Bearer ${userToken.accessToken}` }
+      });
+      if (res.ok) {
+        results.push({ check: "apiConnection", status: "OK", detail: "Connected to NAVER WORKS API" });
+      } else {
+        results.push({ check: "apiConnection", status: "FAIL", detail: `HTTP ${res.status}` });
+      }
+    } catch (e) {
+      results.push({ check: "apiConnection", status: "FAIL", detail: `Connection failed: ${e.message}` });
+    }
+  } else {
+    results.push({ check: "apiConnection", status: "SKIP", detail: "No valid token \u2014 skipping API test" });
+  }
+  return results;
+}
+var doctorCommand = new Command12("doctor").description("Check nworks configuration and connectivity").option("--profile <name>", "Profile name", "default").option("--json", "JSON output").action(async (opts) => {
+  try {
+    const results = await runChecks(opts.profile);
+    if (opts.json || !process.stdout.isTTY) {
+      output(results, opts);
+    } else {
+      console.log("\n  nworks doctor\n");
+      for (const r of results) {
+        const icon = r.status === "OK" ? "\u2705" : r.status === "SKIP" ? "\u2796" : r.status === "WARN" ? "\u26A0\uFE0F" : "\u274C";
+        console.log(`  ${icon} ${r.check.padEnd(16)} ${r.detail}`);
+      }
+      console.log();
+    }
+    if (results.some((r) => r.status === "FAIL")) {
+      process.exitCode = 1;
+    }
+  } catch (err) {
+    cliError(err, opts);
+  }
+});
+
+// src/mcp/tools/diagnostics.ts
+function registerDiagnosticsTools(server) {
+  defineTool(
+    server,
     "nworks_doctor",
     "NAVER WORKS \uC5F0\uACB0 \uC0C1\uD0DC\uB97C \uC9C4\uB2E8\uD569\uB2C8\uB2E4. \uC778\uC99D \uC815\uBCF4, \uD1A0\uD070, Private Key, API \uC5F0\uACB0\uC744 \uC810\uAC80\uD569\uB2C8\uB2E4.",
     {},
@@ -3348,6 +4257,21 @@ OAuth Redirect URI: http://localhost:9876/callback`,
   );
 }
 
+// src/mcp/tools.ts
+function registerTools(server) {
+  registerSetupTools(server);
+  registerMessageTools(server);
+  registerDirectoryTools(server);
+  registerCalendarTools(server);
+  registerDriveTools(server);
+  registerMailTools(server);
+  registerTaskTools(server);
+  registerBoardTools(server);
+  registerContactTools(server);
+  registerAuthTools(server);
+  registerDiagnosticsTools(server);
+}
+
 // src/mcp/server.ts
 async function startMcpServer() {
   try {
@@ -3368,7 +4292,7 @@ async function startMcpServer() {
   }
   const server = new McpServer({
     name: "nworks",
-    version: "1.0.0"
+    version: VERSION
   });
   registerTools(server);
   const transport = new StdioServerTransport();
@@ -3376,22 +4300,31 @@ async function startMcpServer() {
 }
 
 // src/commands/mcp-cmd.ts
-var mcpCommand = new Command12("mcp").description("Start MCP server (stdio transport)").option("--list-tools", "List available MCP tools").action(async (opts) => {
+function listRegisteredTools() {
+  const server = new McpServer2({ name: "nworks", version: "0.0.0" });
+  registerTools(server);
+  const registered = server._registeredTools;
+  return Object.entries(registered).map(([name, tool]) => ({
+    name,
+    summary: (tool.description ?? "").split("\n")[0]?.trim() ?? ""
+  }));
+}
+var mcpCommand = new Command13("mcp").description("Start MCP server (stdio transport)").option("--list-tools", "List available MCP tools").action(async (opts) => {
   if (opts.listTools) {
-    console.log("nworks_message_send     \u2014 Send message to user or channel");
-    console.log("nworks_message_members  \u2014 List channel members");
-    console.log("nworks_directory_members \u2014 List organization members");
-    console.log("nworks_calendar_list    \u2014 List calendar events (User OAuth)");
-    console.log("nworks_whoami           \u2014 Show auth status");
+    const tools = listRegisteredTools();
+    const width = tools.length ? Math.max(...tools.map((t) => t.name.length)) : 0;
+    for (const { name, summary } of tools) {
+      console.log(`${name.padEnd(width)}  ${summary}`);
+    }
+    console.log(`
+${tools.length} tools`);
     return;
   }
   await startMcpServer();
 });
 
 // src/index.ts
-var require2 = createRequire(import.meta.url);
-var { version } = require2("../package.json");
-var program = new Command13().name("nworks").description("NAVER WORKS CLI \u2014 built for humans and AI agents").version(version).option("--json", "Always output JSON").option("-v, --verbose", "Debug logging").option("--dry-run", "Print request without calling API").option("-p, --profile <name>", "Profile name", "default");
+var program = new Command14().name("nworks").description("NAVER WORKS CLI \u2014 built for humans and AI agents").version(VERSION);
 program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(whoamiCommand);
@@ -3402,6 +4335,7 @@ program.addCommand(driveCommand);
 program.addCommand(mailCommand);
 program.addCommand(taskCommand);
 program.addCommand(boardCommand);
+program.addCommand(contactCommand);
 program.addCommand(mcpCommand);
 program.addCommand(doctorCommand);
 program.parse();