Function bodies 134 total

func issueApprovalToken(account, action string, ttl time.Duration) (string, string, error) {
	if ttl <= 0 {
		return "", "", fmt.Errorf("ttl must be positive")
	}

	account = normalizeEmail(account)
	action = strings.ToLower(strings.TrimSpace(action))
	if account == "" || action == "" {
		return "", "", fmt.Errorf("account and action are required")
	}

	token, err := randomToken()
	if err != nil {
		return "", "", err
	}
	expiresAt := time.Now().UTC().Add(ttl)

	st := approvalTokenState{
		Token:     token,
		Account:   account,
		Action:    action,
		ExpiresAt: expiresAt.Format(time.RFC3339),
	}

	path, err := approvalTokenPath(token)
	if err != nil {
		return "", "", err
	}
	if err := rejectApprovalTokenSymlink(path); err != nil {
		return "", "", err
	}

	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
		return "", "", fmt.Errorf("ensure approvals dir: %w", err)
	}

	if err := writeApprovalTokenState(path, st); err != nil {
		return "", "", fmt.Errorf("write approval 

func consumeApprovalToken(account, action, token string) error {
	account = normalizeEmail(account)
	action = strings.ToLower(strings.TrimSpace(action))
	token = strings.TrimSpace(token)
	if account == "" || action == "" || token == "" {
		return fmt.Errorf("approval token, account, and action are required")
	}

	path, err := approvalTokenPath(token)
	if err != nil {
		return err
	}
	if err := rejectApprovalTokenSymlink(path); err != nil {
		return err
	}

	b, err := os.ReadFile(path) //nolint:gosec
	if err != nil {
		if os.IsNotExist(err) {
			return fmt.Errorf("approval token not found")
		}

		return fmt.Errorf("read approval token: %w", err)
	}

	var st approvalTokenState
	if err := json.Unmarshal(b, &st); err != nil {
		return fmt.Errorf("decode approval token: %w", err)
	}

	if st.Used {
		return fmt.Errorf("approval token already used")
	}
	if st.Account != account || st.Action != action {
		return fmt.Errorf("approval token does not match account/action")
	}

	exp, err := time.

func approvalTokenPath(token string) (string, error) {
	token = strings.TrimSpace(token)
	if err := validateApprovalToken(token); err != nil {
		return "", err
	}

	dir, err := config.EnsureDir()
	if err != nil {
		return "", fmt.Errorf("resolve config dir: %w", err)
	}

	approvalsDir := filepath.Join(dir, "approvals")
	baseAbs, err := filepath.Abs(approvalsDir)
	if err != nil {
		return "", fmt.Errorf("resolve approvals dir: %w", err)
	}

	candidate := filepath.Join(baseAbs, token+".json")
	candidateAbs, err := filepath.Abs(candidate)
	if err != nil {
		return "", fmt.Errorf("resolve approval token path: %w", err)
	}

	prefix := baseAbs + string(os.PathSeparator)
	if !strings.HasPrefix(candidateAbs, prefix) {
		return "", fmt.Errorf("invalid approval token path")
	}

	return candidateAbs, nil
}

func randomToken() (string, error) {
	b := make([]byte, 24)
	if _, err := rand.Read(b); err != nil {
		return "", fmt.Errorf("generate approval token: %w", err)
	}

	return base64.RawURLEncoding.EncodeToString(b), nil
}

func validateApprovalToken(token string) error {
	if token == "" {
		return fmt.Errorf("approval token is required")
	}

	for _, r := range token {
		switch {
		case r >= 'a' && r <= 'z':
		case r >= 'A' && r <= 'Z':
		case r >= '0' && r <= '9':
		case r == '-' || r == '_':
		default:
			return fmt.Errorf("approval token has invalid format")
		}
	}

	return nil
}

func rejectApprovalTokenSymlink(path string) error {
	info, err := os.Lstat(path)
	if err != nil {
		if os.IsNotExist(err) {
			return nil
		}

		return fmt.Errorf("stat approval token: %w", err)
	}

	if info.Mode()&os.ModeSymlink != 0 {
		return fmt.Errorf("approval token file must not be a symlink")
	}

	return nil
}

func writeApprovalTokenState(path string, st approvalTokenState) error {
	out, err := json.Marshal(st)
	if err != nil {
		return fmt.Errorf("encode approval token: %w", err)
	}

	return writeApprovalTokenBytes(path, out)
}

func writeApprovalTokenBytes(path string, data []byte) error {
	tmp, err := os.CreateTemp(filepath.Dir(path), ".approval-token-*")
	if err != nil {
		return fmt.Errorf("create temp approval token: %w", err)
	}

	tmpPath := tmp.Name()
	cleanup := true
	defer func() {
		_ = tmp.Close()
		if cleanup {
			_ = os.Remove(tmpPath)
		}
	}()

	if _, err := tmp.Write(data); err != nil {
		return fmt.Errorf("write temp approval token: %w", err)
	}
	if err := tmp.Chmod(0o600); err != nil {
		return fmt.Errorf("chmod temp approval token: %w", err)
	}
	if err := tmp.Sync(); err != nil {
		return fmt.Errorf("sync temp approval token: %w", err)
	}
	if err := tmp.Close(); err != nil {
		return fmt.Errorf("close temp approval token: %w", err)
	}
	if err := os.Rename(tmpPath, path); err != nil {
		return fmt.Errorf("commit approval token: %w", err)
	}

	cleanup = false

	return nil
}

func appendAuditLog(path string, entry auditEntry) error {
	path, err := resolveAuditLogPath(path)
	if err != nil {
		return err
	}
	if entry.Timestamp == "" {
		entry.Timestamp = time.Now().UTC().Format(time.RFC3339)
	}

	prevHash, err := lastAuditHash(path)
	if err != nil {
		return err
	}
	entry.PrevHash = prevHash
	entry.Hash = computeAuditHash(entry)

	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
		return fmt.Errorf("ensure audit log directory: %w", err)
	}

	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
	if err != nil {
		return fmt.Errorf("open audit log: %w", err)
	}
	defer f.Close()
	_ = os.Chmod(path, 0o600)

	b, err := json.Marshal(entry)
	if err != nil {
		return fmt.Errorf("encode audit log: %w", err)
	}

	if _, err := f.Write(append(b, '\n')); err != nil {
		return fmt.Errorf("write audit log: %w", err)
	}

	return nil
}

func resolveAuditLogPath(path string) (string, error) {
	base, err := config.EnsureDir()
	if err != nil {
		return "", fmt.Errorf("resolve config dir: %w", err)
	}
	baseAbs, err := filepath.Abs(base)
	if err != nil {
		return "", fmt.Errorf("resolve config dir absolute path: %w", err)
	}

	if strings.TrimSpace(path) == "" {
		return filepath.Join(baseAbs, "audit.log"), nil
	}

	candidate, err := filepath.Abs(path)
	if err != nil {
		return "", fmt.Errorf("resolve audit log path: %w", err)
	}
	if candidate == baseAbs {
		return "", fmt.Errorf("audit log path cannot be config directory itself")
	}

	prefix := baseAbs + string(os.PathSeparator)
	if !strings.HasPrefix(candidate, prefix) {
		return "", fmt.Errorf("audit log path must be under %s", baseAbs)
	}

	return candidate, nil
}

func lastAuditHash(path string) (string, error) {
	b, err := os.ReadFile(path) //nolint:gosec
	if err != nil {
		if os.IsNotExist(err) {
			return "", nil
		}

		return "", fmt.Errorf("read audit log: %w", err)
	}

	lines := strings.Split(string(b), "\n")
	for i := len(lines) - 1; i >= 0; i-- {
		line := strings.TrimSpace(lines[i])
		if line == "" {
			continue
		}

		var e auditEntry
		if err := json.Unmarshal([]byte(line), &e); err != nil {
			return "", fmt.Errorf("decode audit log tail: %w", err)
		}

		return strings.TrimSpace(e.Hash), nil
	}

	return "", nil
}

func computeAuditHash(entry auditEntry) string {
	data := strings.Join([]string{
		entry.Timestamp,
		entry.Action,
		entry.Account,
		entry.Target,
		fmt.Sprintf("%t", entry.DryRun),
		entry.PrevHash,
	}, "|")
	sum := sha256.Sum256([]byte(data))

	return hex.EncodeToString(sum[:])
}

func (c *AuthLoginCmd) Run(ctx context.Context, root *RootFlags) error {
	account := normalizeEmail(c.Account)
	services, err := parseServices(c.Services)
	if err != nil {
		return output.WriteError(output.ExitCodeError, "invalid_services", err.Error())
	}

	scopes, err := googleauth.ScopesForServices(services)
	if err != nil {
		return output.WriteError(output.ExitCodeError, "scope_error", err.Error())
	}

	creds, err := config.ReadCredentials()
	if err != nil {
		var credsMissing *config.CredentialsMissingError
		if errors.As(err, &credsMissing) {
			return output.WriteError(output.ExitCodeError, "credentials_missing", err.Error())
		}

		return output.WriteError(output.ExitCodeError, "credentials_error", err.Error())
	}

	opts := googleauth.AuthorizeOptions{
		Scopes:       scopes,
		ForceConsent: c.ForceConsent,
	}

	// Step 2: exchange code for token.
	if strings.TrimSpace(c.AuthURL) != "" {
		result, err := googleauth.Step2(ctx, creds, opts, c.AuthURL)
		if err != nil {
			return

func (c *AuthListCmd) Run(_ context.Context, _ *RootFlags) error {
	store, err := secrets.OpenDefault()
	if err != nil {
		return output.WriteError(output.ExitCodeError, "keyring_error", err.Error())
	}

	tokens, err := store.ListTokens()
	if err != nil {
		return output.WriteError(output.ExitCodeError, "list_error", err.Error())
	}

	type accountInfo struct {
		Email     string   `json:"email"`
		Services  []string `json:"services,omitempty"`
		CreatedAt string   `json:"created_at,omitempty"`
	}

	accounts := make([]accountInfo, 0, len(tokens))
	for _, tok := range tokens {
		ai := accountInfo{
			Email:    tok.Email,
			Services: tok.Services,
		}
		if !tok.CreatedAt.IsZero() {
			ai.CreatedAt = tok.CreatedAt.Format("2006-01-02T15:04:05Z")
		}
		accounts = append(accounts, ai)
	}

	return output.WriteJSON(os.Stdout, map[string]any{
		"accounts": accounts,
	})
}

func (c *AuthRemoveCmd) Run(_ context.Context, root *RootFlags) error {
	store, err := secrets.OpenDefault()
	if err != nil {
		return output.WriteError(output.ExitCodeError, "keyring_error", err.Error())
	}

	if err := store.DeleteToken(c.Account); err != nil {
		return output.WriteError(output.ExitCodeError, "remove_error", err.Error())
	}
	if err := appendAuditLog(root.AuditLog, auditEntry{
		Action:  "auth.remove",
		Account: normalizeEmail(c.Account),
		DryRun:  false,
	}); err != nil {
		return output.WriteError(output.ExitCodeError, "audit_error", err.Error())
	}

	return output.WriteJSON(os.Stdout, map[string]any{
		"removed": true,
		"email":   c.Account,
	})
}

func (c *AuthPreflightCmd) Run(_ context.Context, _ *RootFlags) error {
	account := normalizeEmail(c.Account)
	required := splitCSV(c.RequireActions)

	type checkResult struct {
		Name    string `json:"name"`
		OK      bool   `json:"ok"`
		Message string `json:"message,omitempty"`
	}

	checks := make([]checkResult, 0, 4+len(required))
	ready := true

	if _, err := config.ReadCredentials(); err != nil {
		ready = false
		checks = append(checks, checkResult{Name: "credentials", OK: false, Message: err.Error()})
	} else {
		checks = append(checks, checkResult{Name: "credentials", OK: true})
	}

	store, err := secrets.OpenDefault()
	if err != nil {
		ready = false
		checks = append(checks, checkResult{Name: "keyring", OK: false, Message: err.Error()})
	} else {
		checks = append(checks, checkResult{Name: "keyring", OK: true})
		if _, err := store.GetToken(account); err != nil {
			ready = false
			checks = append(checks, checkResult{Name: "token", OK: false, Message: err.Error()})
		} else

func (c *AuthApprovalTokenCmd) Run(_ context.Context, root *RootFlags) error {
	account := normalizeEmail(c.Account)
	action := strings.ToLower(strings.TrimSpace(c.Action))
	if action == "" {
		return output.WriteError(output.ExitCodeError, "invalid_action", "action is required")
	}

	if err := enforceActionPolicy(account, "auth.approval_token"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}
	if err := enforceActionPolicy(account, action); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	required, err := actionRequiresApproval(action)
	if err != nil {
		return output.WriteError(output.ExitCodeError, "policy_error", err.Error())
	}
	if !required {
		return output.WriteError(output.ExitCodeError, "approval_not_required",
			fmt.Sprintf("action %q does not require approval token", action))
	}

	ttl, err := time.ParseDuration(c.TTL)
	if err != nil {
		return output.WriteError(output.E

func (c *AuthEmergencyRevokeCmd) Run(_ context.Context, root *RootFlags) error {
	account := normalizeEmail(c.Account)
	store, err := secrets.OpenDefault()
	if err != nil {
		return output.WriteError(output.ExitCodeError, "keyring_error", err.Error())
	}

	if err := store.DeleteToken(account); err != nil {
		return output.WriteError(output.ExitCodeError, "remove_error", err.Error())
	}

	p, err := config.ReadPolicy()
	if err != nil {
		return output.WriteError(output.ExitCodeError, "policy_error", err.Error())
	}
	p.BlockedAccounts = append(p.BlockedAccounts, account)
	if err := config.WritePolicy(p); err != nil {
		return output.WriteError(output.ExitCodeError, "policy_error", err.Error())
	}
	if err := appendAuditLog(root.AuditLog, auditEntry{
		Action:  "auth.emergency_revoke",
		Account: account,
		DryRun:  false,
	}); err != nil {
		return output.WriteError(output.ExitCodeError, "audit_error", err.Error())
	}

	return output.WriteJSON(os.Stdout, map[string]any{
		"revoked": true,

func parseServices(csv string) ([]googleauth.Service, error) {
	parts := strings.Split(csv, ",")
	out := make([]googleauth.Service, 0, len(parts))

	for _, p := range parts {
		p = strings.TrimSpace(p)
		if p == "" {
			continue
		}

		svc, err := googleauth.ParseService(p)
		if err != nil {
			return nil, fmt.Errorf("unknown service %q", p)
		}

		out = append(out, svc)
	}

	if len(out) == 0 {
		return nil, fmt.Errorf("no services specified")
	}

	return out, nil
}

func splitCSV(v string) []string {
	if strings.TrimSpace(v) == "" {
		return nil
	}

	parts := strings.Split(v, ",")
	out := make([]string, 0, len(parts))
	for _, p := range parts {
		p = strings.ToLower(strings.TrimSpace(p))
		if p != "" {
			out = append(out, p)
		}
	}

	return out
}

func (c *CalendarCalendarsCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "calendar.calendars"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	svc, err := googleapi.NewCalendarReadOnly(ctx, c.Account)
	if err != nil {
		return calendarAuthError(err)
	}

	resp, err := svc.CalendarList.List().Do()
	if err != nil {
		return writeGoogleAPIError("calendars_error", err)
	}

	type calendarInfo struct {
		ID          string `json:"id"`
		Summary     string `json:"summary"`
		Description string `json:"description,omitempty"`
		Primary     bool   `json:"primary,omitempty"`
		AccessRole  string `json:"access_role,omitempty"`
	}

	cals := make([]calendarInfo, 0, len(resp.Items))
	for _, cal := range resp.Items {
		cals = append(cals, calendarInfo{
			ID:          cal.Id,
			Summary:     cal.Summary,
			Description: cal.Description,
			Primary:     cal.Primary,
			AccessRole:  cal.AccessRole,
		})

func (c *CalendarListCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "calendar.list"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	if err := enforceRateLimit("calendar.list", 120, time.Minute); err != nil {
		return output.WriteError(output.ExitCodeError, "rate_limited", err.Error())
	}

	if err := validateRFC3339Optional("--from", c.From); err != nil {
		return output.WriteError(output.ExitCodeError, "invalid_time", err.Error())
	}

	if err := validateRFC3339Optional("--to", c.To); err != nil {
		return output.WriteError(output.ExitCodeError, "invalid_time", err.Error())
	}

	svc, err := googleapi.NewCalendarReadOnly(ctx, c.Account)
	if err != nil {
		return calendarAuthError(err)
	}

	type eventRef struct {
		ID          string `json:"id"`
		Summary     string `json:"summary,omitempty"`
		Start       string `json:"start,omitempty"`
		End         string `json:"end,omitempty"`
		Desc

func (c *CalendarGetCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "calendar.get"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	svc, err := googleapi.NewCalendarReadOnly(ctx, c.Account)
	if err != nil {
		return calendarAuthError(err)
	}

	event, err := svc.Events.Get(c.CalendarID, c.EventID).Do()
	if err != nil {
		return writeGoogleAPIError("get_error", err)
	}

	return output.WriteJSON(os.Stdout, event)
}

func (c *CalendarCreateCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "calendar.create"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	if err := validateRFC3339("--start", c.Start); err != nil {
		return output.WriteError(output.ExitCodeError, "invalid_time", err.Error())
	}

	if err := validateRFC3339("--end", c.End); err != nil {
		return output.WriteError(output.ExitCodeError, "invalid_time", err.Error())
	}

	dryRun := root.DryRun

	if dryRun {
		if err := appendAuditLog(root.AuditLog, auditEntry{
			Action:  "calendar.create",
			Account: normalizeEmail(c.Account),
			Target:  c.CalendarID,
			DryRun:  true,
		}); err != nil {
			return output.WriteError(output.ExitCodeError, "audit_error", err.Error())
		}
		return output.WriteJSON(os.Stdout, map[string]any{
			"dry_run": true,
			"action":  "calendar.create",
			"params": map[string]any{
				"account":     c.Account,
				"c

func (c *CalendarUpdateCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "calendar.update"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	if c.Start != "" {
		if err := validateRFC3339("--start", c.Start); err != nil {
			return output.WriteError(output.ExitCodeError, "invalid_time", err.Error())
		}
	}

	if c.End != "" {
		if err := validateRFC3339("--end", c.End); err != nil {
			return output.WriteError(output.ExitCodeError, "invalid_time", err.Error())
		}
	}

	dryRun := root.DryRun

	if dryRun {
		if err := appendAuditLog(root.AuditLog, auditEntry{
			Action:  "calendar.update",
			Account: normalizeEmail(c.Account),
			Target:  c.EventID,
			DryRun:  true,
		}); err != nil {
			return output.WriteError(output.ExitCodeError, "audit_error", err.Error())
		}
		return output.WriteJSON(os.Stdout, map[string]any{
			"dry_run": true,
			"action":  "calendar.update",
			"params": map[s

func (c *CalendarDeleteCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "calendar.delete"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	dryRun := root.DryRun
	if !dryRun && !c.ConfirmDelete {
		return output.WriteError(output.ExitCodeError, "delete_requires_confirmation",
			"calendar delete requires --confirm-delete")
	}
	if !dryRun {
		required, err := actionRequiresApproval("calendar.delete")
		if err != nil {
			return output.WriteError(output.ExitCodeError, "policy_error", err.Error())
		}
		if required {
			if err := consumeApprovalToken(c.Account, "calendar.delete", c.ApprovalToken); err != nil {
				return output.WriteError(output.ExitCodePermission, "approval_required", err.Error())
			}
		}
	}

	if dryRun {
		if err := appendAuditLog(root.AuditLog, auditEntry{
			Action:  "calendar.delete",
			Account: normalizeEmail(c.Account),
			Target:  c.EventID,
			DryRun:  true,
		

func eventTimeString(edt *calendar.EventDateTime) string {
	if edt == nil {
		return ""
	}

	if edt.DateTime != "" {
		return edt.DateTime
	}

	return edt.Date
}

func validateRFC3339(flag, value string) error {
	if value == "" {
		return fmt.Errorf("%s is required", flag)
	}

	if _, err := time.Parse(time.RFC3339, value); err != nil {
		return fmt.Errorf("%s %q is not a valid RFC3339 datetime (e.g. 2026-03-01T10:00:00Z): %v", flag, value, err)
	}

	return nil
}

func validateRFC3339Optional(flag, value string) error {
	if value == "" {
		return nil
	}

	return validateRFC3339(flag, value)
}

func calendarAuthError(err error) error {
	var authErr *googleapi.AuthRequiredError
	if isAuthErr(err, &authErr) {
		return output.WriteError(output.ExitCodeAuth, "auth_required", err.Error())
	}

	return output.WriteError(output.ExitCodeError, "calendar_error", err.Error())
}

func (c *DocsInfoCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "docs.info"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	svc, err := googleapi.NewDocsReadOnly(ctx, c.Account)
	if err != nil {
		return docsAuthError(err)
	}

	doc, err := svc.Documents.Get(c.DocID).Do()
	if err != nil {
		return writeGoogleAPIError("docs_info_error", err)
	}

	return output.WriteJSON(os.Stdout, map[string]any{
		"id":             doc.DocumentId,
		"title":          doc.Title,
		"revision_id":    doc.RevisionId,
		"document_style": doc.DocumentStyle,
	})
}

func (c *DocsCatCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "docs.cat"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	if err := enforceRateLimit("docs.cat", 120, time.Minute); err != nil {
		return output.WriteError(output.ExitCodeError, "rate_limited", err.Error())
	}

	svc, err := googleapi.NewDocsReadOnly(ctx, c.Account)
	if err != nil {
		return docsAuthError(err)
	}

	doc, err := svc.Documents.Get(c.DocID).Do()
	if err != nil {
		return writeGoogleAPIError("docs_cat_error", err)
	}

	text, truncated := truncateText(docsPlainText(doc), c.MaxBytes)

	return output.WriteJSON(os.Stdout, map[string]any{
		"id":        doc.DocumentId,
		"title":     doc.Title,
		"content":   text,
		"truncated": truncated,
	})
}

func truncateText(text string, maxBytes int) (string, bool) {
	if maxBytes <= 0 || len(text) <= maxBytes {
		return text, false
	}

	return text[:maxBytes], true
}

func (c *DocsExportCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "docs.export"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}
	if err := ensureWithinAllowedOutputDir(c.Output, root.AllowedOutputDir); err != nil {
		return output.WriteError(output.ExitCodePermission, "output_not_allowed", err.Error())
	}

	mimeType, ok := exportMIMETypes[strings.ToLower(c.Format)]
	if !ok {
		return output.WriteError(output.ExitCodeError, "invalid_format",
			fmt.Sprintf("unsupported format %q; use pdf, docx, txt, odt, or html", c.Format))
	}

	dryRun := root.DryRun
	if err := ensureWithinAllowedOutputDir(c.Output, root.AllowedOutputDir); err != nil {
		return output.WriteError(output.ExitCodeError, "output_not_allowed", err.Error())
	}
	if dryRun {
		if err := appendAuditLog(root.AuditLog, auditEntry{
			Action:  "docs.export",
			Account: normalizeEmail(c.Account),
			Target:  c.Output,
			DryRun:

func (c *DocsWriteCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "docs.write"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	content := c.Content

	if c.ContentStdin {
		s, err := readStdinWithLimit(maxStdinBytes)
		if err != nil {
			return output.WriteError(output.ExitCodeError, "stdin_error", fmt.Sprintf("read stdin: %v", err))
		}

		content = s
	}

	dryRun := root.DryRun
	if c.Replace && !c.ConfirmReplace {
		return output.WriteError(output.ExitCodeError, "replace_requires_confirmation",
			"--replace requires --confirm-replace to reduce destructive mistakes")
	}
	if !dryRun && c.Replace {
		required, err := actionRequiresApproval("docs.write.replace")
		if err != nil {
			return output.WriteError(output.ExitCodeError, "policy_error", err.Error())
		}
		if required {
			if err := consumeApprovalToken(c.Account, "docs.write.replace", c.ApprovalToken); err != nil {
				return o

func (c *DocsFindReplaceCmd) Run(ctx context.Context, root *RootFlags) error {
	dryRun := root.DryRun
	if err := enforceActionPolicy(c.Account, "docs.find_replace"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}
	if !dryRun && !c.ConfirmFindReplace {
		return output.WriteError(output.ExitCodeError, "find_replace_requires_confirmation",
			"docs find-replace requires --confirm-find-replace")
	}
	if !dryRun {
		required, err := actionRequiresApproval("docs.find_replace")
		if err != nil {
			return output.WriteError(output.ExitCodeError, "policy_error", err.Error())
		}
		if required {
			if err := consumeApprovalToken(c.Account, "docs.find_replace", c.ApprovalToken); err != nil {
				return output.WriteError(output.ExitCodePermission, "approval_required", err.Error())
			}
		}
	}

	if dryRun {
		if err := appendAuditLog(root.AuditLog, auditEntry{
			Action:  "docs.find_replace",
			Account: normalizeEmail(c.Account),
			Target:  c.Do

func docsPlainText(doc *docs.Document) string {
	if doc.Body == nil {
		return ""
	}

	var sb strings.Builder

	for _, elem := range doc.Body.Content {
		if elem.Paragraph == nil {
			continue
		}

		for _, pe := range elem.Paragraph.Elements {
			if pe.TextRun != nil {
				sb.WriteString(pe.TextRun.Content)
			}
		}
	}

	return sb.String()
}

func docBodyLength(doc *docs.Document) int64 {
	if doc.Body == nil || len(doc.Body.Content) == 0 {
		return 1
	}

	last := doc.Body.Content[len(doc.Body.Content)-1]

	return last.EndIndex
}

func writeFileAtomically(outputPath string, src io.Reader, overwrite bool) (int64, error) {
	if strings.TrimSpace(outputPath) == "" {
		return 0, fmt.Errorf("output path is empty")
	}

	if !overwrite {
		if _, err := os.Stat(outputPath); err == nil {
			return 0, fmt.Errorf("output file already exists; pass --overwrite to replace it")
		} else if !os.IsNotExist(err) {
			return 0, fmt.Errorf("check output file: %w", err)
		}
	}

	dir := filepath.Dir(outputPath)
	if err := os.MkdirAll(dir, 0o700); err != nil {
		return 0, fmt.Errorf("ensure output dir: %w", err)
	}

	tmp, err := os.CreateTemp(dir, ".gog-lite-export-*")
	if err != nil {
		return 0, fmt.Errorf("create temp file: %w", err)
	}

	tmpPath := tmp.Name()
	cleanupTmp := true
	defer func() {
		_ = tmp.Close()
		if cleanupTmp {
			_ = os.Remove(tmpPath)
		}
	}()

	written, err := io.Copy(tmp, src)
	if err != nil {
		return 0, err
	}
	if err := tmp.Sync(); err != nil {
		return 0, fmt.Errorf("sync temp file: %w", err)
	}
	if err :=

func ensureWithinAllowedOutputDir(outputPath, allowedDir string) error {
	allowedDir = strings.TrimSpace(allowedDir)
	if allowedDir == "" {
		return nil
	}

	outResolved, err := resolvePathForContainment(outputPath)
	if err != nil {
		return fmt.Errorf("resolve output path: %w", err)
	}
	allowedResolved, err := resolvePathForContainment(allowedDir)
	if err != nil {
		return fmt.Errorf("resolve allowed output dir: %w", err)
	}
	if outResolved == allowedResolved {
		return nil
	}

	prefix := allowedResolved + string(os.PathSeparator)
	if allowedResolved == string(os.PathSeparator) {
		prefix = allowedResolved
	}

	if !strings.HasPrefix(outResolved, prefix) {
		return fmt.Errorf("output path must be under %s", allowedResolved)
	}

	return nil
}

func resolvePathForContainment(path string) (string, error) {
	absPath, err := filepath.Abs(path)
	if err != nil {
		return "", err
	}

	if _, err := os.Lstat(absPath); err == nil {
		resolved, err := filepath.EvalSymlinks(absPath)
		if err != nil {
			return "", err
		}

		return filepath.Clean(resolved), nil
	} else if !os.IsNotExist(err) {
		return "", err
	}

	current := absPath
	missing := make([]string, 0, 4)
	for {
		if _, err := os.Lstat(current); err == nil {
			resolved, err := filepath.EvalSymlinks(current)
			if err != nil {
				return "", err
			}
			for i := len(missing) - 1; i >= 0; i-- {
				resolved = filepath.Join(resolved, missing[i])
			}

			return filepath.Clean(resolved), nil
		} else if !os.IsNotExist(err) {
			return "", err
		}

		parent := filepath.Dir(current)
		if parent == current {
			return filepath.Clean(absPath), nil
		}

		missing = append(missing, filepath.Base(current))
		current = parent
	}
}

func docsAuthError(err error) error {
	var authErr *googleapi.AuthRequiredError
	if isAuthErr(err, &authErr) {
		return output.WriteError(output.ExitCodeAuth, "auth_required", err.Error())
	}

	return output.WriteError(output.ExitCodeError, "docs_error", err.Error())
}

func writeGoogleAPIError(defaultCode string, err error) error {
	var apiErr *gapi.Error
	if errors.As(err, &apiErr) {
		switch apiErr.Code {
		case http.StatusNotFound:
			return output.WriteError(output.ExitCodeNotFound, "not_found", err.Error())
		case http.StatusForbidden:
			return output.WriteError(output.ExitCodePermission, "permission_denied", err.Error())
		}
	}

	return output.WriteError(output.ExitCodeError, defaultCode, err.Error())
}

func (c *GmailSearchCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "gmail.search"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	if err := enforceRateLimit("gmail.search", 120, time.Minute); err != nil {
		return output.WriteError(output.ExitCodeError, "rate_limited", err.Error())
	}

	svc, err := googleapi.NewGmailReadOnly(ctx, c.Account)
	if err != nil {
		return gmailAuthError(err)
	}

	type messageRef struct {
		ID       string `json:"id"`
		ThreadID string `json:"thread_id"`
	}

	messages, nextPageToken, err := collectAllPages(c.AllPages, func(pageToken string) (string, []messageRef, error) {
		req := svc.Users.Messages.List("me").Q(c.Query).MaxResults(c.Max)
		if pageToken != "" {
			req = req.PageToken(pageToken)
		} else if c.Page != "" {
			req = req.PageToken(c.Page)
		}

		resp, err := req.Do()
		if err != nil {
			return "", nil, fmt.Errorf("gmail search: %w", err)
		}

	

func (c *GmailGetCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "gmail.get"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	svc, err := googleapi.NewGmailReadOnly(ctx, c.Account)
	if err != nil {
		return gmailAuthError(err)
	}

	msg, err := svc.Users.Messages.Get("me", c.MessageID).Format(c.Format).Do()
	if err != nil {
		return writeGoogleAPIError("get_error", err)
	}

	return output.WriteJSON(os.Stdout, msg)
}

func (c *GmailSendCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "gmail.draft"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	body := c.Body

	if c.BodyStdin {
		s, err := readStdinWithLimit(maxStdinBytes)
		if err != nil {
			return output.WriteError(output.ExitCodeError, "stdin_error", fmt.Sprintf("read stdin: %v", err))
		}

		body = s
	}

	for _, hv := range []struct {
		name  string
		value string
	}{
		{name: "account", value: c.Account},
		{name: "to", value: c.To},
		{name: "cc", value: c.CC},
		{name: "bcc", value: c.BCC},
		{name: "subject", value: c.Subject},
	} {
		if err := validateHeaderValue(hv.name, hv.value); err != nil {
			return output.WriteError(output.ExitCodeError, "invalid_header", err.Error())
		}
	}
	for _, av := range []struct {
		name  string
		value string
	}{
		{name: "to", value: c.To},
		{name: "cc", value: c.CC},
		{name: "bcc", value: c.BCC},
	} {

func validateHeaderValue(name, value string) error {
	if strings.ContainsAny(value, "\r\n") {
		return fmt.Errorf("%s must not contain CR or LF characters", name)
	}

	return nil
}

func validateAddressList(name, value string) error {
	if strings.TrimSpace(value) == "" {
		if name == "to" {
			return fmt.Errorf("%s must not be empty", name)
		}

		return nil
	}

	if _, err := mail.ParseAddressList(value); err != nil {
		return fmt.Errorf("%s contains invalid email address list: %v", name, err)
	}

	return nil
}

func (c *GmailThreadCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "gmail.thread"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	svc, err := googleapi.NewGmailReadOnly(ctx, c.Account)
	if err != nil {
		return gmailAuthError(err)
	}

	thread, err := svc.Users.Threads.Get("me", c.ThreadID).Format(c.Format).Do()
	if err != nil {
		return writeGoogleAPIError("thread_error", err)
	}

	return output.WriteJSON(os.Stdout, thread)
}

func (c *GmailLabelsCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "gmail.labels"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	svc, err := googleapi.NewGmailReadOnly(ctx, c.Account)
	if err != nil {
		return gmailAuthError(err)
	}

	resp, err := svc.Users.Labels.List("me").Do()
	if err != nil {
		return writeGoogleAPIError("labels_error", err)
	}

	type labelInfo struct {
		ID   string `json:"id"`
		Name string `json:"name"`
		Type string `json:"type,omitempty"`
	}

	labels := make([]labelInfo, 0, len(resp.Labels))
	for _, l := range resp.Labels {
		labels = append(labels, labelInfo{ID: l.Id, Name: l.Name, Type: l.Type})
	}

	return output.WriteJSON(os.Stdout, map[string]any{
		"labels": labels,
	})
}