@rex0220/formula-authoring-tools 0.1.0 → 0.2.1

package/dist/core.mjs

@@ -1,4 +1,4 @@
-/*! @rex0220/formula-authoring-tools/core 0.1.0 (c) rex0220. MIT License. 計算式エンジンと計算式プラグインのコードは利用者の計算式プラグインプラグインの zip から読む（このファイルには含まれない）。commit 69de71e. */
+/*! @rex0220/formula-authoring-tools/core 0.2.1 (c) rex0220. MIT License. 計算式エンジンと計算式プラグインのコードは利用者の計算式プラグインプラグインの zip から読む（このファイルには含まれない）。commit f2e46ef. */
 
 // src/safe-path.ts
 import { lstatSync, realpathSync } from "node:fs";
@@ -56,8 +56,8 @@ function resolveRead(target, cwd) {
   const real = realResolve(target, cwd);
   const cwdReal = realResolve(".", cwd);
   if (!isInside(real, cwdReal)) throw new PathError(`読むファイルは作業フォルダーの中に置く: ${target}`);
-  const rel = path.relative(cwdReal, real).replace(/\\/g, "/");
-  if (/^\.env(\.|$)/i.test(path.basename(real)) || /^(node_modules|\.git)(\/|$)/i.test(rel)) throw new PathError(`このファイルは tools では読まない: ${target}`);
+  const rel2 = path.relative(cwdReal, real).replace(/\\/g, "/");
+  if (/^\.env(\.|$)/i.test(path.basename(real)) || /^(node_modules|\.git)(\/|$)/i.test(rel2)) throw new PathError(`このファイルは tools では読まない: ${target}`);
   return real;
 }
 function resolveWrite(target, roots, cwd) {
@@ -74,6 +74,14 @@ function resolveWrite(target, roots, cwd) {
   if (WINDOWS_RESERVED.test(base) || /[. ]$/.test(base)) throw new PathError(`使えないファイル名: ${base}`);
   return real;
 }
+function resolveWriteDir(target, roots, cwd) {
+  if (!target || typeof target !== "string") throw new PathError("フォルダーのパスが要る");
+  const real = realResolve(target, cwd);
+  const cwdReal = realResolve(".", cwd);
+  if (!isInside(real, cwdReal)) throw new PathError(`出力フォルダーは作業フォルダーの中: ${target}`);
+  if (!roots.some((r) => isInside(real, path.join(cwdReal, r)))) throw new PathError(`出力フォルダーは ${roots.map((r) => `${r}/`).join(" か ")}（またはその下）: ${target}`);
+  return real;
+}
 function safeFileName(name, fallback) {
   let s = name.replace(/[\\/:*?"<>|\u0000-\u001f\u007f]/g, "_").replace(/[. ]+$/g, "").trim();
   if (!s || WINDOWS_RESERVED.test(s)) s = fallback;
@@ -182,7 +190,7 @@ function devMeta() {
   return { toolsVersion: pkg.version, pluginId: FORMULA_PLUGIN_ID, minPluginVersion: MIN_PLUGIN_VERSION, supportedApiVersions: [...SUPPORTED_API_VERSIONS], commit: gitCommit(AUTHORING_ROOT), builtAt: "", mode: "dev" };
 }
 function toolsMeta() {
-  if (true) return JSON.parse('{"toolsVersion":"0.1.0","pluginId":"dhgihghfgfmibkdldkeibboabfnmdpke","minPluginVersion":101,"supportedApiVersions":[1],"commit":"69de71e","builtAt":"2026-10-18T00:25:51.113Z","mode":"build"}');
+  if (true) return JSON.parse('{"toolsVersion":"0.2.1","pluginId":"dhgihghfgfmibkdldkeibboabfnmdpke","minPluginVersion":101,"supportedApiVersions":[1],"commit":"f2e46ef","builtAt":"2026-10-18T03:55:45.474Z","mode":"build"}');
   return devMeta();
 }
 
@@ -491,6 +499,9 @@ function summarizeUsers(src, origin, user) {
 }
 
 // src/engine.ts
+function momentFileOf(opt) {
+  return opt.vendorDir ? path4.join(opt.vendorDir, path4.basename(MOMENT_FILE)) : MOMENT_FILE;
+}
 var DEFAULT_CONTEXT_BASE_URL = "https://example.cybozu.com";
 var SENTINEL_USER = { id: "0", code: "__sentinel__", name: "", email: "", timezone: "Asia/Tokyo", language: "ja", isGuest: false };
 var loaded = null;
@@ -523,7 +534,7 @@ function resolvePluginSources(opt = {}, mode = opt.mode ?? toolsMeta().mode) {
     throw new PluginZipError(`計算式プラグインの zip の場所が分からない。.env に FORMULA_PLUGIN_ZIP=<計算式プラグインの zip のパス> を書く${mode === "dev" ? "（開発中に隣の formula の prod/ を読むなら環境変数 FORMULA_ALLOW_DEV_PLUGIN=1）" : ""}`, "not-configured");
   }
   if (!dev || !existsSync(path4.join(dev, ENGINE_ENTRY))) throw new PluginZipError(`計算式プラグインの zip の場所が分からない（FORMULA_ALLOW_DEV_PLUGIN=1 だが formula の prod/ が無い: ${dev}）`, "not-configured");
-  const read = (rel) => readFileSync3(path4.join(dev, rel), "utf8");
+  const read = (rel2) => readFileSync3(path4.join(dev, rel2), "utf8");
   const apiFile = path4.join(dev, API_ENTRY);
   const decimalFile = path4.join(dev, DECIMAL_ENTRY);
   const engine = read(ENGINE_ENTRY);
@@ -590,15 +601,16 @@ async function loadOnce(opt) {
   }
   if (!src.api) throw new PluginZipError(`計算式プラグインの zip に ${API_ENTRY} が無い（Ver.${MIN_PLUGIN_VERSION} 以降の zip が要る）: ${src.from}`, "no-api", known);
   if (!src.decimal) warnings.push(`zip に ${DECIMAL_ENTRY} が無い（べき乗の小数の指数がエラーになる）`);
-  if (!existsSync(MOMENT_FILE)) throw new Error(`moment が無い: ${MOMENT_FILE}（tools の npm install 時に取る。手で取るなら npm run vendor）`);
+  const momentFile = momentFileOf(opt);
+  if (!existsSync(momentFile)) throw new Error(`moment が無い: ${momentFile}（tools の npm install 時に取る。手で取るなら npm run vendor）`);
   try {
-    return await startEngine({ ...src, api: src.api }, known, warnings, stamp);
+    return await startEngine({ ...src, api: src.api }, known, warnings, stamp, momentFile);
   } catch (e) {
     poisoned = { code: e instanceof PluginZipError ? e.code : "unexpected", info: e instanceof PluginZipError ? e.info : known };
     throw e;
   }
 }
-async function startEngine(src, known, warnings, stamp) {
+async function startEngine(src, known, warnings, stamp, momentFile) {
   const g = globalThis;
   const { Window } = await import("happy-dom");
   const ctx = {
@@ -674,7 +686,7 @@ async function startEngine(src, known, warnings, stamp) {
       throw new PluginZipError(`計算式プラグインの zip のコード（${entry}）を実行できない: ${e instanceof Error ? e.message : String(e)}`, "engine-unreadable", known);
     }
   };
-  runScript(readFileSync3(MOMENT_FILE, "utf8"), MOMENT_FILE);
+  runScript(readFileSync3(momentFile, "utf8"), momentFile);
   runScript(src.momentTimezone, `${src.from}!${MOMENT_TZ_ENTRY}`, MOMENT_TZ_ENTRY);
   runScript(src.bignumber, `${src.from}!${BIGNUMBER_ENTRY}`, BIGNUMBER_ENTRY);
   if (src.decimal) runScript(src.decimal, `${src.from}!${DECIMAL_ENTRY}`, DECIMAL_ENTRY);
@@ -853,6 +865,17 @@ function loadAuth(opt) {
   if (!token && !(username && password)) throw new AuthError("KINTONE_API_TOKEN か、KINTONE_USERNAME と KINTONE_PASSWORD の両方が要る（OS の環境変数か .env）");
   return { baseUrl, token, username: token ? void 0 : username, password: token ? void 0 : password };
 }
+function loadUserApiAuth(opt) {
+  const pick = picker(opt);
+  const baseUrl = baseUrlFromEnv(opt);
+  if (!baseUrl) throw new AuthError(`KINTONE_BASE_URL が無い（OS の環境変数か .env: ${envFileOf(opt)}）`);
+  const bearer = pick(NAMES.userApiToken);
+  if (bearer) return { baseUrl, bearer };
+  const username = pick(NAMES.username);
+  const password = pick(NAMES.password);
+  if (username && password) return { baseUrl, username, password };
+  throw new AuthError("User API（users --pull）は FORMULA_USER_API_TOKEN（cybozu.com 共通管理の API トークン）か、KINTONE_USERNAME と KINTONE_PASSWORD（2 要素認証のないアカウント）で呼ぶ。kintone アプリの API トークン（KINTONE_API_TOKEN）では呼べない");
+}
 function pluginZipPath(opt) {
   const picked = pickerWithSource(opt, true)(NAMES.pluginZip);
   if (!picked) return void 0;
@@ -890,6 +913,11 @@ function jsonErrorWhere(e) {
   if (!m) return "";
   return m[2] ? `（${m[2]} 行 ${m[3]} 列）` : `（位置 ${m[1]}）`;
 }
+function jsonErrorText(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (e instanceof SyntaxError || /is not valid JSON|in JSON at position|Unexpected (token|end|non-whitespace)|Bad control character|Unterminated string/.test(msg)) return `JSON の構文の誤り${jsonErrorWhere(e)}（中身は表示しない）`;
+  return msg;
+}
 
 // src/input.ts
 var PLUGIN_NAME = "計算式プラグイン";
@@ -939,8 +967,8 @@ function readFieldsFile(file) {
   return fields;
 }
 function relativeSettingsPath(file, cwd) {
-  const rel = path6.relative(cwd, path6.resolve(cwd, file));
-  return rel.startsWith("..") ? file : rel.replace(/\\/g, "/");
+  const rel2 = path6.relative(cwd, path6.resolve(cwd, file));
+  return rel2.startsWith("..") ? file : rel2.replace(/\\/g, "/");
 }
 function quiet(fn) {
   const saved = { log: console.log, warn: console.warn, error: console.error };
@@ -988,7 +1016,7 @@ var RestError = class extends Error {
 var NotAllowedError = class extends Error {
 };
 async function readCapped(res, limit, apiPath) {
-  const tooLarge = () => new RestError(`kintone ${apiPath} の応答が大きすぎる（上限 ${limit} バイト）`, res.status, "LimitError", apiPath);
+  const tooLarge2 = () => new RestError(`kintone ${apiPath} の応答が大きすぎる（上限 ${limit} バイト）`, res.status, "LimitError", apiPath);
   const quietCancel = async (reader2) => {
     try {
       await reader2.cancel();
@@ -1001,7 +1029,7 @@ async function readCapped(res, limit, apiPath) {
   const declared = Number(res.headers?.get("content-length") ?? Number.NaN);
   if (Number.isFinite(declared) && declared > limit) {
     await quietCancel(reader);
-    throw tooLarge();
+    throw tooLarge2();
   }
   const chunks = [];
   let total = 0;
@@ -1012,7 +1040,7 @@ async function readCapped(res, limit, apiPath) {
     total += value.length;
     if (total > limit) {
       await quietCancel(reader);
-      throw tooLarge();
+      throw tooLarge2();
     }
     chunks.push(value);
   }
@@ -1651,6 +1679,7 @@ function diffSettings(before, after, names) {
 
 // src/commands/users.ts
 var PAGE = 100;
+var CODES_PER_CALL = 100;
 var DEFAULT_MAX_CALLS = 300;
 var UsersPullError = class extends Error {
 };
@@ -1708,6 +1737,95 @@ function scanUserInfoCalls(text) {
   }
   return out;
 }
+function referencedCodesOf(settings, strip) {
+  const out = { users: [], orgs: [], groups: [], dynamic: [], fields: 0 };
+  const rows = Array.isArray(settings.pluginInfos) ? settings.pluginInfos : [];
+  const add = (kind, code) => {
+    if (!out[kind].includes(code)) out[kind].push(code);
+  };
+  for (const r of rows) {
+    if (!r || typeof r.formulaSet !== "string" || !r.formulaSet.trim()) continue;
+    out.fields++;
+    const fieldcode = typeof r.fieldcode === "string" ? r.fieldcode : "?";
+    const calls = scanUserInfoCalls(strip(r.formulaSet));
+    for (const d of calls.dynamic) out.dynamic.push(`${fieldcode}: ${d}`);
+    for (const kind of ["users", "orgs", "groups"]) for (const c of calls[kind]) add(kind, c);
+  }
+  return out;
+}
+async function byCodes(client, api, key, codes, budget) {
+  const out = [];
+  for (let i = 0; i < codes.length; i += CODES_PER_CALL) {
+    if (++budget.calls > budget.max) throw new UsersPullError(`User API の呼び出しが ${budget.max} 回を超えた（--max で上げる）`);
+    const res = await client.getUser(api, { codes: codes.slice(i, i + CODES_PER_CALL), size: PAGE });
+    out.push(...res[key] ?? []);
+  }
+  return out;
+}
+var uniq = (a) => [...new Set(a)];
+var missingOf = (want, have) => {
+  const got = new Set([...have].map((x) => x.code));
+  return want.filter((c) => !got.has(c));
+};
+async function pullReferencedUsers(client, ref, opt = {}) {
+  const budget = { calls: 0, max: opt.maxCalls ?? DEFAULT_MAX_CALLS };
+  const log = opt.log ?? (() => void 0);
+  const one = async (api, key, code) => all(client, api, key, { code }, budget);
+  const orgMembers = /* @__PURE__ */ new Map();
+  for (const o of uniq(ref.orgs)) orgMembers.set(o, (await one("organization/users", "userTitles", o)).map((m) => m.user?.code).filter((c) => !!c));
+  const groupMembers = /* @__PURE__ */ new Map();
+  for (const g of uniq(ref.groups)) groupMembers.set(g, (await one("group/users", "users", g)).map((m) => m.code).filter((c) => !!c));
+  const userCodes = uniq([...ref.users, ...[...orgMembers.values()].flat(), ...[...groupMembers.values()].flat()]);
+  const rawUsers = userCodes.length ? await byCodes(client, "users", "users", userCodes, budget) : [];
+  const missingUsers = missingOf(ref.users, rawUsers);
+  if (missingUsers.length) throw new UsersPullError(`式が参照しているユーザーが無い: ${missingUsers.slice(0, 5).join(", ")}（コードを確かめる。全部取るなら --only-referenced を外す）`);
+  const valid = rawUsers.filter((u2) => u2.valid !== false);
+  log(`ユーザー ${valid.length}（参照 ${ref.users.length}、組織 ${ref.orgs.length} とグループ ${ref.groups.length} の所属を含む。ここまで ${budget.calls} 回）。所属をあと ${valid.length * 2} 回`);
+  const userOrgs = /* @__PURE__ */ new Map();
+  const userGroups = /* @__PURE__ */ new Map();
+  for (const u2 of valid) {
+    if ((budget.calls += 2) > budget.max) throw new UsersPullError(`User API の呼び出しが ${budget.max} 回を超えた（--max で上げる）`);
+    const o = await client.getUser("user/organizations", { code: u2.code });
+    userOrgs.set(u2.code, (o.organizationTitles ?? []).map((t) => t.organization).filter((x) => !!x && typeof x.code === "string"));
+    const g = await client.getUser("user/groups", { code: u2.code });
+    userGroups.set(u2.code, (g.groups ?? []).filter((x) => !!x && typeof x.code === "string"));
+  }
+  const orgDetail = /* @__PURE__ */ new Map();
+  for (const list of userOrgs.values()) for (const o of list) orgDetail.set(o.code, o);
+  const parentsOf = (orgs) => uniq([...orgs].map((o) => o.parentCode).filter((c) => !!c));
+  let pending = uniq([...ref.orgs, ...parentsOf(orgDetail.values())]).filter((c) => !orgDetail.has(c));
+  while (pending.length) {
+    const got = await byCodes(client, "organizations", "organizations", pending, budget);
+    for (const o of got) orgDetail.set(o.code, o);
+    const missing = pending.filter((c) => !orgDetail.has(c));
+    if (missing.length) throw new UsersPullError(`式が参照している組織が無い: ${missing.slice(0, 5).join(", ")}（コードを確かめる。全部取るなら --only-referenced を外す）`);
+    pending = parentsOf(got).filter((c) => !orgDetail.has(c));
+  }
+  const groupDetail = /* @__PURE__ */ new Map();
+  for (const list of userGroups.values()) for (const g of list) groupDetail.set(g.code, g);
+  const gPending = uniq(ref.groups).filter((c) => !groupDetail.has(c));
+  if (gPending.length) {
+    for (const g of await byCodes(client, "groups", "groups", gPending, budget)) groupDetail.set(g.code, g);
+    const missing = gPending.filter((c) => !groupDetail.has(c));
+    if (missing.length) throw new UsersPullError(`式が参照しているグループが無い: ${missing.slice(0, 5).join(", ")}（コードを確かめる。全部取るなら --only-referenced を外す）`);
+  }
+  const byId = (a, b) => Number(a.id) - Number(b.id) || String(a.id).localeCompare(String(b.id));
+  const orgRecords = [...orgDetail.values()].map((o) => ({
+    id: String(o.id),
+    code: o.code,
+    name: o.name,
+    parentCode: o.parentCode ?? null,
+    users: valid.filter((u2) => (orgMembers.get(o.code) ?? []).includes(u2.code) || (userOrgs.get(u2.code) ?? []).some((x) => x.code === o.code)).map((u2) => u2.code)
+  })).sort(byId);
+  const groupRecords = [...groupDetail.values()].map((g) => ({
+    id: String(g.id),
+    code: g.code,
+    name: g.name,
+    users: valid.filter((u2) => (groupMembers.get(g.code) ?? []).includes(u2.code) || (userGroups.get(u2.code) ?? []).some((x) => x.code === g.code)).map((u2) => u2.code)
+  })).sort(byId);
+  const userRecords = valid.map((u2) => ({ ...u2, id: String(u2.id), customItemValues: u2.customItemValues ?? [] })).sort(byId);
+  return { source: { users: userRecords, organizations: orgRecords, groups: groupRecords }, calls: budget.calls };
+}
 function usersFileNameOf(baseUrl) {
   try {
     return `${new URL(baseUrl).hostname}.json`;
@@ -2171,7 +2289,7 @@ function calcSettings(input) {
   const usersLabel = !table ? userInfoOn ? "なし" : "各種設定「ユーザー情報」OFF" : input.usersOrigin.kind === "file" ? input.usersOrigin.file : "既定のテストデータ（架空）";
   const contextLine = `文脈: アプリ ${input.appId}、ログインユーザー ${loginUser ? loginUser.code : "指定なし（番兵）"}、mobile ${input.mobile ? "true" : "false"}、イベント ${evType}${event ? `（${event.action.value} / ${event.status.value} → ${event.nextStatus.value}）` : ""}、ユーザー情報 ${usersLabel}、ルックアップ先 ${Object.keys(targets.lookupTargets).length}、関連レコード一覧の先 ${Object.keys(targets.relatedTargets).length}`;
   const notice = `更新していません（模擬）。EV_INFO の文脈を与えた 3 段（項目 → テーブルの行 → 2 段目）の計算で、${evType === "allUpdate" ? "設定画面の「既存レコードを変更」の文脈" : evType === "batch" ? "一覧の「一括計算」の文脈" : "画面のイベントの処理の完全な再現ではありません"}。`;
-  const markOf = (fieldcode) => {
+  const markOf2 = (fieldcode) => {
     const scan = normalized.scans.get(fieldcode);
     if (!scan) return [];
     const used = Object.keys(scan.functions);
@@ -2194,7 +2312,7 @@ function calcSettings(input) {
       const a = r.after[code]?.value;
       const raw = record[code]?.value;
       const b = isTable(raw) && isTable(rb) && raw.length !== rb.length ? raw : rb;
-      lines.push({ fieldcode: code, before: b, after: a, changed: JSON.stringify(b) !== JSON.stringify(a), marks: markOf(code) });
+      lines.push({ fieldcode: code, before: b, after: a, changed: JSON.stringify(b) !== JSON.stringify(a), marks: markOf2(code) });
     }
     const byField = /* @__PURE__ */ new Map();
     for (const e of r.errors) {
@@ -2249,15 +2367,884 @@ function calcSettings(input) {
   return { contextLine, notice, records: results, summary, text: text.join("\n") };
 }
 
+// src/commands/take.ts
+import { closeSync as closeSync2, existsSync as existsSync6, fstatSync as fstatSync2, openSync as openSync2, readdirSync as readdirSync2, readFileSync as readFileSync9, readSync as readSync2, unlinkSync } from "node:fs";
+import path12 from "node:path";
+
+// src/permission.ts
+import { existsSync as existsSync5 } from "node:fs";
+import path10 from "node:path";
+
+// src/connections.ts
+import { createHash as createHash3, createHmac, randomBytes } from "node:crypto";
+import * as nodeFs from "node:fs";
+import { realpathSync as realpathSync3 } from "node:fs";
+import path8 from "node:path";
+var CONNECTION_MAX_BYTES = 256 * 1024;
+var REAL_FS = {
+  openSync: (p, flags) => nodeFs.openSync(p, flags),
+  fstatSync: (fd) => nodeFs.fstatSync(fd),
+  readSync: (fd, buf, offset, length, position) => nodeFs.readSync(fd, buf, offset, length, position),
+  closeSync: (fd) => nodeFs.closeSync(fd),
+  statSync: (p) => nodeFs.statSync(p)
+};
+var fsOps = REAL_FS;
+var PROFILE_NAME_RE = /^[A-Za-z0-9_-]{1,40}$/;
+var ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var FALLBACK_PROFILE = "dev";
+var ConnectionError = class extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+};
+var SECRETS = /* @__PURE__ */ new WeakMap();
+var FINGERPRINT_KEY = randomBytes(32);
+var fingerprint = (parts) => createHmac("sha256", FINGERPRINT_KEY).update(JSON.stringify(parts)).digest("hex");
+var nonblank = (v) => typeof v === "string" && v.trim() ? v : void 0;
+var isPlainObject = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function appKeyOf(key) {
+  const m = /^(?:APP)?([1-9][0-9]*)$/i.exec(key);
+  if (!m) return void 0;
+  const n = Number(m[1]);
+  return Number.isSafeInteger(n) ? n : void 0;
+}
+function readProfile(name, raw, env) {
+  if (!PROFILE_NAME_RE.test(name)) return { reason: "profile の名前は英数字と - _ の 40 文字まで（フォルダーの名前になる）" };
+  if (!isPlainObject(raw)) return { reason: "profile がオブジェクトでない" };
+  if (typeof raw.baseUrl !== "string") return { reason: "baseUrl が無い、または文字列でない" };
+  for (const k of ["username", "password", "passwordEnv"]) {
+    if (raw[k] !== void 0 && typeof raw[k] !== "string") return { reason: `${k} が文字列でない` };
+  }
+  let baseUrl;
+  try {
+    baseUrl = normalizeKintoneBaseUrl(raw.baseUrl);
+  } catch {
+    return { reason: "baseUrl が kintone の URL でない（https://<サブドメイン>.cybozu.com / .kintone.com / .cybozu.cn だけ。パス・ポート・ユーザー情報なし）" };
+  }
+  let guestSpaceId = null;
+  if (raw.guestSpaceId !== void 0 && raw.guestSpaceId !== null) {
+    if (typeof raw.guestSpaceId !== "number" || !Number.isSafeInteger(raw.guestSpaceId) || raw.guestSpaceId <= 0) return { reason: "guestSpaceId は正の整数" };
+    guestSpaceId = raw.guestSpaceId;
+  }
+  const mode = raw.auth ?? "auto";
+  if (mode !== "token" && mode !== "userpass" && mode !== "auto") return { reason: "auth は token / userpass / auto のどれか" };
+  if (raw.passwordEnv !== void 0 && (typeof raw.passwordEnv !== "string" || !ENV_NAME_RE.test(raw.passwordEnv))) return { reason: "passwordEnv は環境変数の名前（英字か _ で始まる英数字と _）" };
+  if (raw.userApiToken !== void 0) {
+    if (typeof raw.userApiToken !== "string" || !raw.userApiToken.trim()) return { reason: "userApiToken が文字列でない、または空" };
+    if (raw.userApiToken.startsWith("env:") && !ENV_NAME_RE.test(raw.userApiToken.slice(4))) return { reason: "userApiToken の env: の後ろが環境変数の名前でない" };
+  }
+  const userApiToken = typeof raw.userApiToken === "string" ? raw.userApiToken : void 0;
+  const username = nonblank(raw.username);
+  const password = (typeof raw.passwordEnv === "string" ? nonblank(env[raw.passwordEnv]) : void 0) ?? nonblank(raw.password);
+  const tokens = /* @__PURE__ */ new Map();
+  if (raw.tokenMap !== void 0) {
+    if (!isPlainObject(raw.tokenMap)) return { reason: "tokenMap がオブジェクトでない" };
+    for (const key of Object.keys(raw.tokenMap)) {
+      const appId = appKeyOf(key);
+      if (appId === void 0) return { reason: `tokenMap のキー「${key.slice(0, 40)}」はアプリの番号でない（APP101 か 101。先頭に 0 を付けない）` };
+      if (tokens.has(appId)) return { reason: `tokenMap にアプリ ${appId} が 2 つある（APP${appId} と ${appId} など）` };
+      const value = raw.tokenMap[key];
+      if (typeof value !== "string" || !value.trim()) return { reason: `tokenMap の APP${appId} の値が文字列でない、または空` };
+      if (value.startsWith("env:") && !ENV_NAME_RE.test(value.slice(4))) return { reason: `tokenMap の APP${appId} の env: の後ろが環境変数の名前でない` };
+      tokens.set(appId, value);
+    }
+  }
+  const auth = mode === "auto" ? username && password ? "userpass" : "token" : mode;
+  const tokenApps = [...tokens.keys()].sort((a, b) => a - b);
+  const tokenReady = {};
+  for (const [appId, value] of tokens) tokenReady[appId] = value.startsWith("env:") ? !!nonblank(env[value.slice(4)]) : true;
+  const host = new URL(baseUrl).hostname;
+  const userApiTokenReady = userApiToken === void 0 ? false : userApiToken.startsWith("env:") ? !!nonblank(env[userApiToken.slice(4)]) : true;
+  return {
+    def: { profile: name, baseUrl, host, guestSpaceId, auth, tokenApps, tokenReady, userpassReady: !!(username && password), userApiTokenReady },
+    secrets: {
+      ...username ? { username } : {},
+      ...password ? { password } : {},
+      tokens,
+      ...userApiToken !== void 0 ? { userApiToken } : {}
+    }
+  };
+}
+function realOf(p) {
+  return realpathSync3.native(p);
+}
+var sameFile = (a, b) => a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
+var changed = (name) => new ConnectionError(`接続のファイル（${name}）が読み込みの途中で変わった`, "unreadable");
+function readStable(real, name) {
+  let fd;
+  try {
+    fd = fsOps.openSync(real, "r");
+    const before = fsOps.fstatSync(fd);
+    if (!before.isFile()) throw new ConnectionError(`接続のファイル（${name}）が普通のファイルでない（フォルダーなど）`, "unreadable");
+    if (before.size > CONNECTION_MAX_BYTES) throw new ConnectionError(`接続のファイル（${name}）が大きすぎる（上限 ${CONNECTION_MAX_BYTES} バイト）`, "unreadable");
+    const buf = Buffer.alloc(CONNECTION_MAX_BYTES + 1);
+    let off = 0;
+    for (; ; ) {
+      const n = fsOps.readSync(fd, buf, off, buf.length - off, off);
+      if (n === 0) break;
+      off += n;
+      if (off > CONNECTION_MAX_BYTES) throw new ConnectionError(`接続のファイル（${name}）が大きすぎる（上限 ${CONNECTION_MAX_BYTES} バイト）`, "unreadable");
+    }
+    const after = fsOps.fstatSync(fd);
+    let onPath;
+    try {
+      onPath = fsOps.statSync(real);
+    } catch {
+      throw changed(name);
+    }
+    if (!sameFile(before, after) || !sameFile(before, onPath) || off !== before.size) throw changed(name);
+    return { bytes: Buffer.from(buf.subarray(0, off)), stat: before };
+  } catch (e) {
+    if (e instanceof ConnectionError) throw e;
+    throw new ConnectionError(`接続のファイル（${name}）を読めない`, "unreadable");
+  } finally {
+    if (fd !== void 0) fsOps.closeSync(fd);
+  }
+}
+function readRegularFile(real, name) {
+  const first = readStable(real, name);
+  if (first.stat.ino === 0) {
+    const second = readStable(real, name);
+    if (!first.bytes.equals(second.bytes)) throw changed(name);
+  }
+  return { bytes: first.bytes, mode: first.stat.mode };
+}
+function hasInlineSecrets(rawProfiles) {
+  for (const key of Object.keys(rawProfiles)) {
+    const p = rawProfiles[key];
+    if (!isPlainObject(p)) continue;
+    if (nonblank(p.password)) return true;
+    if (typeof p.userApiToken === "string" && p.userApiToken.trim() !== "" && !p.userApiToken.startsWith("env:")) return true;
+    if (isPlainObject(p.tokenMap) && Object.values(p.tokenMap).some((v) => typeof v === "string" && v.trim() !== "" && !v.startsWith("env:"))) return true;
+  }
+  return false;
+}
+function loadConnections(file, opt) {
+  if (!file || !file.trim()) throw new ConnectionError("kintone の接続のファイルが設定されていない（ksql.config.json と同じ形のファイル）", "not-configured");
+  const name = path8.basename(file);
+  if (!path8.isAbsolute(file)) throw new ConnectionError(`接続のファイル（${name}）は絶対パスで指定する`, "unreadable");
+  let real;
+  try {
+    real = realOf(file);
+  } catch {
+    throw new ConnectionError(`接続のファイル（${name}）が無い、または読めない`, "unreadable");
+  }
+  const given = path8.resolve(file);
+  for (const root of opt.workspaceRoots) {
+    let rootReal;
+    try {
+      rootReal = realOf(root);
+    } catch {
+      continue;
+    }
+    if (isInside(real, rootReal) || isInside(given, rootReal) || isInside(given, path8.resolve(root))) {
+      throw new ConnectionError(`接続のファイル（${name}）が作業フォルダーの中にある。作業フォルダーの外に置く`, "inside-workspace");
+    }
+  }
+  const { bytes, mode } = readRegularFile(real, name);
+  let again;
+  try {
+    again = realOf(file);
+  } catch {
+    again = void 0;
+  }
+  if (again !== real) throw new ConnectionError(`接続のファイル（${name}）が読み込みの途中で変わった`, "unreadable");
+  let data;
+  try {
+    data = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new ConnectionError(`接続のファイル（${name}）を JSON として読めない`, "unreadable");
+  }
+  if (!isPlainObject(data)) throw new ConnectionError(`接続のファイル（${name}）の最上位がオブジェクトでない`, "unreadable");
+  const rawProfiles = data.profiles ?? {};
+  if (!isPlainObject(rawProfiles)) throw new ConnectionError(`接続のファイル（${name}）の profiles がオブジェクトでない`, "unreadable");
+  const profiles = /* @__PURE__ */ new Map();
+  const byProfile = /* @__PURE__ */ new Map();
+  const invalid = [];
+  for (const key of Object.keys(rawProfiles)) {
+    const r = readProfile(key, rawProfiles[key], opt.env);
+    if ("reason" in r) invalid.push({ name: key.slice(0, 40), reason: r.reason });
+    else {
+      profiles.set(key, r.def);
+      byProfile.set(key, r.secrets);
+    }
+  }
+  const lower = /* @__PURE__ */ new Map();
+  for (const key of profiles.keys()) lower.set(key.toLowerCase(), [...lower.get(key.toLowerCase()) ?? [], key]);
+  for (const keys of lower.values()) {
+    if (keys.length < 2) continue;
+    for (const key of keys) {
+      profiles.delete(key);
+      byProfile.delete(key);
+      invalid.push({ name: key, reason: `大文字小文字だけが違う profile がある（${keys.join("、")}）` });
+    }
+  }
+  if (data.defaultProfile !== void 0 && typeof data.defaultProfile !== "string") throw new ConnectionError(`接続のファイル（${name}）の defaultProfile が文字列でない`, "unreadable");
+  const defaultProfile = data.defaultProfile;
+  const warnings = [];
+  if (process.platform !== "win32" && hasInlineSecrets(rawProfiles) && (mode & 63) !== 0) warnings.push(`接続のファイル（${name}）に秘密の値が直接書いてあり、ほかの利用者も読める。chmod 600 を勧める`);
+  const set = { fileName: name, digest: createHash3("sha256").update(bytes).digest("hex"), ...defaultProfile !== void 0 ? { defaultProfile } : {}, profiles, invalid, warnings };
+  SECRETS.set(set, { env: opt.env, byProfile });
+  return set;
+}
+function pickProfile(set, name) {
+  const bad = (n) => set.invalid.find((p) => p.name === n)?.reason;
+  if (name !== void 0) {
+    const def2 = set.profiles.get(name);
+    if (def2) return def2;
+    const reason2 = bad(name);
+    if (reason2) throw new ConnectionError(`profile「${name.slice(0, 40)}」は使えない: ${reason2}`, "profile-invalid");
+    throw new ConnectionError(`profile「${name.slice(0, 40)}」は接続のファイル（${set.fileName}）に無い`, "unknown-profile");
+  }
+  if (set.defaultProfile !== void 0) {
+    const def2 = set.profiles.get(set.defaultProfile);
+    if (def2) return def2;
+    const reason2 = bad(set.defaultProfile);
+    throw new ConnectionError(`defaultProfile の「${set.defaultProfile.slice(0, 40)}」が${reason2 ? `使えない: ${reason2}` : "接続のファイルの profiles に無い"}`, "profile-invalid");
+  }
+  const def = set.profiles.get(FALLBACK_PROFILE);
+  if (def) return def;
+  const reason = bad(FALLBACK_PROFILE);
+  if (reason) throw new ConnectionError(`profile「${FALLBACK_PROFILE}」は使えない: ${reason}`, "profile-invalid");
+  throw new ConnectionError(`profile を指定するか、接続のファイル（${set.fileName}）に defaultProfile を書く（無ければ "${FALLBACK_PROFILE}" を使うが、それも無い）`, "no-default-profile");
+}
+function snapshotOf(set, def) {
+  return { ...identityOf(def), auth: def.auth, fileName: set.fileName };
+}
+function semanticDigest(set, def, appId) {
+  const held = SECRETS.get(set);
+  const secrets = held?.byProfile.get(def.profile);
+  let credential = "none";
+  if (def.auth === "userpass") credential = fingerprint(["userpass", secrets?.username ?? "", secrets?.password ?? ""]);
+  else if (appId !== void 0) {
+    const v = secrets?.tokens.get(appId);
+    const value = v === void 0 ? "" : v.startsWith("env:") ? nonblank(held?.env[v.slice(4)]) ?? "" : v;
+    credential = fingerprint(["token", v?.startsWith("env:") ? v : "inline", value]);
+  }
+  return createHash3("sha256").update(JSON.stringify([def.profile, def.baseUrl, def.guestSpaceId, def.auth, credential, appId ?? null])).digest("hex");
+}
+function assertSameConnection(before, reload, appId) {
+  const want = semanticDigest(before.set, before.def, appId);
+  let now;
+  try {
+    const set = reload();
+    now = semanticDigest(set, pickProfile(set, before.def.profile), appId);
+  } catch (e) {
+    if (e instanceof ConnectionError && (e.code === "unknown-profile" || e.code === "profile-invalid")) throw new ConnectionError(`profile「${before.def.profile}」の接続が途中で変わった（使えなくなった）。もう一度やり直す`, "connection-changed");
+    throw e;
+  }
+  if (now !== want) throw new ConnectionError(`profile「${before.def.profile}」の接続が途中で変わった。もう一度やり直す`, "connection-changed");
+}
+function authFor(set, profile, appId) {
+  const held = SECRETS.get(set);
+  const secrets = held?.byProfile.get(profile.profile);
+  if (!held || !secrets) throw new ConnectionError(`profile「${profile.profile}」の接続が読み込まれていない`, "profile-invalid");
+  if (profile.auth === "userpass") {
+    if (!secrets.username || !secrets.password) throw new ConnectionError(`profile「${profile.profile}」のログイン名とパスワードがそろわない（username と password か passwordEnv）`, "no-userpass");
+    return { baseUrl: profile.baseUrl, username: secrets.username, password: secrets.password };
+  }
+  const value = secrets.tokens.get(appId);
+  if (value === void 0) throw new ConnectionError(`profile「${profile.profile}」の tokenMap に APP${appId} が無い（そのアプリの API トークンを足す）`, "no-token");
+  if (value.startsWith("env:")) {
+    const token = nonblank(held.env[value.slice(4)]);
+    if (!token) throw new ConnectionError(`profile「${profile.profile}」の APP${appId} のトークンの環境変数が無い（環境変数を置いてから実行し直す。MCP なら再接続する: Claude Code は /mcp、Desktop は起動し直す）`, "env-missing");
+    return { baseUrl: profile.baseUrl, token };
+  }
+  return { baseUrl: profile.baseUrl, token: value };
+}
+function userApiAuthFor(set, profile) {
+  const held = SECRETS.get(set);
+  const secrets = held?.byProfile.get(profile.profile);
+  if (!held || !secrets) throw new ConnectionError(`profile「${profile.profile}」の接続が読み込まれていない`, "profile-invalid");
+  const raw = secrets.userApiToken;
+  if (raw !== void 0) {
+    const bearer = raw.startsWith("env:") ? nonblank(held.env[raw.slice(4)]) : raw;
+    if (!bearer) throw new ConnectionError(`profile「${profile.profile}」の userApiToken の環境変数が無い（設定した後、起動し直す）`, "env-missing");
+    return { baseUrl: profile.baseUrl, bearer };
+  }
+  if (secrets.username && secrets.password) return { baseUrl: profile.baseUrl, username: secrets.username, password: secrets.password };
+  throw new ConnectionError(`profile「${profile.profile}」に User API（users --pull）の認証が無い。userApiToken（cybozu.com 共通管理の API トークン。env:<環境変数> か値）か、username と password（passwordEnv）を書く。アプリの API トークン（tokenMap）では呼べない`, "no-user-api-auth");
+}
+function identityOf(def) {
+  return { profile: def.profile, baseUrl: def.baseUrl, host: def.host, guestSpaceId: def.guestSpaceId };
+}
+function sameIdentity(a, b) {
+  return a.profile === b.profile && a.baseUrl === b.baseUrl && a.guestSpaceId === b.guestSpaceId;
+}
+
+// src/permission-error.ts
+var PermissionError = class extends Error {
+};
+
+// src/workspace.ts
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync, readdirSync, readFileSync as readFileSync7, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import path9 from "node:path";
+var KINTONE_ROOT = "kintone";
+var INBOX = "inbox";
+var LEGACY_WORKSPACE_FILE = "environments.json";
+var APP_MARKER = ".formula-app.json";
+var SNAPSHOT_PREFIX = "rex0220-formula";
+var SNAPSHOT_RE = /^rex0220-formula-app(\d+)-(\d{8})-(\d{6})\.json$/;
+var EDIT_RE = /^rex0220-formula-app(\d+)-(\d{8})-(\d{6})-edit\.json$/;
+var MARKER_MAX_BYTES = 4 * 1024;
+var WorkspaceError = class extends Error {
+};
+function hasLegacyConfig(cwd) {
+  try {
+    lstatSync2(path9.join(cwd, LEGACY_WORKSPACE_FILE));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function legacyBlockedError() {
+  return new ConnectionError(
+    `${LEGACY_WORKSPACE_FILE} は tools 2.0.0 から使わない。kintone の接続のファイル（ksql.config.json と同じ形）を書いて設定し（CLI は FORMULA_KINTONE_CONFIG）、${LEGACY_WORKSPACE_FILE} を消す（バージョンアップ手順）`,
+    "legacy-config-present"
+  );
+}
+function modeOf(cwd, opt) {
+  if (opt.configFile !== void 0) {
+    if (!opt.configFile.trim()) throw new ConnectionError("kintone の接続のファイル（FORMULA_KINTONE_CONFIG）が空。ファイルのパスを書くか、設定を消す", "unreadable");
+    const load = () => loadConnections(opt.configFile, { workspaceRoots: opt.workspaceRoots, env: opt.env });
+    return { kind: "profiles", connections: { set: load(), reload: load } };
+  }
+  if (hasLegacyConfig(cwd)) return { kind: "legacy-blocked" };
+  return opt.surface === "cli" ? { kind: "single" } : { kind: "not-configured" };
+}
+function requireProfiles(mode, what) {
+  if (mode.kind === "profiles") return mode.connections;
+  if (mode.kind === "legacy-blocked") throw legacyBlockedError();
+  if (mode.kind === "not-configured") throw new ConnectionError("kintone の接続のファイルが設定されていない（ksql.config.json と同じ形のファイルを設定に選ぶ）", "not-configured");
+  throw new ConnectionError(`${what} は kintone の接続のファイル（FORMULA_KINTONE_CONFIG）があるときだけ使える`, "not-configured");
+}
+function folderNameOf(appId, appName) {
+  const name = safeFileName(appName, "");
+  return name ? `${appId}-${name}` : String(appId);
+}
+function profileDirOf(cwd, profile) {
+  if (!PROFILE_NAME_RE.test(profile)) throw new WorkspaceError(`profile の名前が使えない: ${profile.slice(0, 40)}`);
+  return path9.join(cwd, KINTONE_ROOT, profile);
+}
+function assertInsideWorkspace(cwd, p) {
+  const rel2 = path9.relative(cwd, p);
+  const root = realResolve(".", cwd);
+  if (!isInside(realResolve(rel2, cwd), root)) throw new PathError(`${rel2} の実体が作業フォルダーの外を指している（symlink など）`);
+}
+function findAppDir(cwd, profile, appId) {
+  const dir = profileDirOf(cwd, profile);
+  if (!existsSync4(dir)) return null;
+  assertInsideWorkspace(cwd, path9.join(cwd, KINTONE_ROOT));
+  assertInsideWorkspace(cwd, dir);
+  const hits = readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".") && (d.name === String(appId) || d.name.startsWith(`${appId}-`))).map((d) => d.name);
+  if (hits.length > 1) throw new WorkspaceError(`アプリ ${appId} のフォルダーが 2 つある: ${hits.join(", ")}（kintone/${profile}/ の下を 1 つにする）`);
+  return hits.length ? path9.join(dir, hits[0]) : null;
+}
+function appDirFor(cwd, profile, appId, appName) {
+  return findAppDir(cwd, profile, appId) ?? path9.join(profileDirOf(cwd, profile), folderNameOf(appId, appName));
+}
+function appFolderOfFile(cwd, file) {
+  const rel2 = path9.relative(path9.join(cwd, KINTONE_ROOT), path9.resolve(cwd, file)).replace(/\\/g, "/");
+  if (!rel2 || rel2.startsWith("..") || path9.isAbsolute(rel2)) return null;
+  const [profile, folder, ...rest] = rel2.split("/");
+  if (!profile || !folder || rest.length === 0 || !PROFILE_NAME_RE.test(profile)) return null;
+  const m = folder.match(/^([1-9]\d*)(?:-|$)/);
+  if (!m) return null;
+  return { dir: path9.join(cwd, KINTONE_ROOT, profile, folder), profile, appId: Number(m[1]) };
+}
+var pad2 = (n) => String(n).padStart(2, "0");
+function snapshotNameOf(appId, now = /* @__PURE__ */ new Date()) {
+  return `${SNAPSHOT_PREFIX}-app${appId}-${now.getFullYear()}${pad2(now.getMonth() + 1)}${pad2(now.getDate())}-${pad2(now.getHours())}${pad2(now.getMinutes())}${pad2(now.getSeconds())}.json`;
+}
+function editNameOf(snapshotFile) {
+  return snapshotFile.replace(/\.json$/, "-edit.json");
+}
+function markOf(def, appId) {
+  return { schemaVersion: 1, profile: def.profile, origin: def.baseUrl, guestSpaceId: def.guestSpaceId, appId };
+}
+function readAppMark(dir) {
+  const file = path9.join(dir, APP_MARKER);
+  let st;
+  try {
+    st = lstatSync2(file);
+  } catch {
+    return { state: "missing" };
+  }
+  if (!st.isFile() || st.size > MARKER_MAX_BYTES) return { state: "invalid" };
+  try {
+    const v = JSON.parse(readFileSync7(file, "utf8"));
+    const ok = v && v.schemaVersion === 1 && typeof v.profile === "string" && typeof v.origin === "string" && (v.guestSpaceId === null || typeof v.guestSpaceId === "number" && Number.isSafeInteger(v.guestSpaceId)) && typeof v.appId === "number" && Number.isSafeInteger(v.appId);
+    return ok ? { state: "ok", mark: v } : { state: "invalid" };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function assertAppMark(dir, def, appId) {
+  const shownDir = `kintone/${def.profile}/${path9.basename(dir)}`;
+  const r = readAppMark(dir);
+  if (r.state === "missing") {
+    throw new ConnectionError(`${shownDir} に印（${APP_MARKER}）が無い。tools が作ったフォルダーでないので使わない（名前を変えて退け、fields か pull で作り直す。中のファイルは後で移す）`, "app-marker-missing");
+  }
+  if (r.state === "invalid") throw new ConnectionError(`${shownDir} の印（${APP_MARKER}）が壊れている。名前を変えて退け、fields か pull で作り直す`, "app-marker-invalid");
+  const m = r.mark;
+  if (m.appId !== appId || !sameIdentity({ profile: m.profile, baseUrl: m.origin, host: "", guestSpaceId: m.guestSpaceId }, { profile: def.profile, baseUrl: def.baseUrl, host: "", guestSpaceId: def.guestSpaceId })) {
+    throw new ConnectionError(`${shownDir} は別の接続（profile・接続先・ゲストスペース・アプリのどれかが違う）のフォルダー。profile の接続を変えたなら、名前を変えて退け、fields か pull で作り直す`, "app-identity-conflict");
+  }
+}
+function ensureAppFolder(dir, def, appId) {
+  if (existsSync4(dir)) {
+    assertAppMark(dir, def, appId);
+    return;
+  }
+  const parent = path9.dirname(dir);
+  mkdirSync(parent, { recursive: true });
+  const tmp = path9.join(parent, `.${path9.basename(dir)}.${randomBytes2(6).toString("hex")}.tmp`);
+  mkdirSync(tmp);
+  try {
+    writeFileSync(path9.join(tmp, APP_MARKER), JSON.stringify(markOf(def, appId), null, 2) + "\n", { encoding: "utf8", flag: "wx" });
+    if (existsSync4(dir)) {
+      rmSync(tmp, { recursive: true, force: true });
+    } else {
+      try {
+        renameSync(tmp, dir);
+      } catch (e) {
+        const code = e.code;
+        if (code !== "EEXIST" && code !== "ENOTEMPTY" && code !== "EPERM") throw e;
+        rmSync(tmp, { recursive: true, force: true });
+      }
+    }
+  } catch (e) {
+    rmSync(tmp, { recursive: true, force: true });
+    throw e;
+  }
+  assertAppMark(dir, def, appId);
+}
+function assertUsableInKintone(cwd, file, mode) {
+  const abs = path9.resolve(cwd, file);
+  if (!isInside(abs, path9.join(cwd, KINTONE_ROOT))) return;
+  if (mode.kind !== "profiles") {
+    if (mode.kind === "legacy-blocked") throw legacyBlockedError();
+    throw new PermissionError("kintone/ の下は、kintone の接続のファイルがあるときだけ使う（今の形では settings/ などを使う）");
+  }
+  const folder = appFolderOfFile(cwd, abs);
+  if (!folder) throw new PermissionError(`アプリのフォルダー（kintone/<profile>/<番号>-…/）の中でない: ${path9.relative(cwd, abs)}`);
+  const def = mode.connections.set.profiles.get(folder.profile);
+  if (!def) throw new PermissionError(`profile「${folder.profile}」は接続のファイル（${mode.connections.set.fileName}）に無い（使われていないフォルダー）`);
+  assertAppMark(folder.dir, def, folder.appId);
+}
+var stampOf = (name) => {
+  const m = name.match(/-(\d{8})-(\d{6})(?:-edit)?\.json$/);
+  return m ? `${m[1]}${m[2]}` : "";
+};
+var newestFirst = (a, b) => stampOf(b).localeCompare(stampOf(a)) || b.localeCompare(a);
+function listAppFolder(dir, cwd) {
+  if (cwd !== void 0) {
+    for (const d of [dir, path9.join(dir, "records")]) if (existsSync4(d)) assertInsideWorkspace(cwd, d);
+  }
+  const files = existsSync4(dir) ? readdirSync(dir, { withFileTypes: true }) : [];
+  const names = files.filter((d) => d.isFile() && d.name.endsWith(".json") && !d.name.startsWith(".")).map((d) => d.name);
+  const sub = (name, filter) => {
+    const p = path9.join(dir, name);
+    return existsSync4(p) ? readdirSync(p).filter((n) => !n.startsWith(".") && filter(n)).sort() : [];
+  };
+  return {
+    dir,
+    hasFields: names.includes("fields.json"),
+    snapshots: names.filter((n) => SNAPSHOT_RE.test(n)).sort(newestFirst),
+    edits: names.filter((n) => EDIT_RE.test(n)).sort(newestFirst),
+    others: names.filter((n) => n !== "fields.json" && !SNAPSHOT_RE.test(n) && !EDIT_RE.test(n)).sort(),
+    records: sub("records", (n) => n.endsWith(".json"))
+  };
+}
+function appFoldersOf(cwd, def) {
+  const dir = profileDirOf(cwd, def.profile);
+  if (!existsSync4(dir)) return [];
+  assertInsideWorkspace(cwd, path9.join(cwd, KINTONE_ROOT));
+  assertInsideWorkspace(cwd, dir);
+  return readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => {
+    const m = d.name.match(/^([1-9]\d*)(?:-|$)/);
+    const appId = m ? Number(m[1]) : null;
+    const r = readAppMark(path9.join(dir, d.name));
+    if (r.state !== "ok") return { name: d.name, appId, mark: r.state };
+    const ok = appId !== null && r.mark.appId === appId && r.mark.profile === def.profile && r.mark.origin === def.baseUrl && r.mark.guestSpaceId === def.guestSpaceId;
+    return { name: d.name, appId, mark: ok ? "ok" : "conflict" };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+}
+function unusedProfileDirs(cwd, set) {
+  const root = path9.join(cwd, KINTONE_ROOT);
+  if (!existsSync4(root)) return [];
+  assertInsideWorkspace(cwd, root);
+  return readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".") && !set.profiles.has(d.name)).map((d) => d.name).sort();
+}
+
+// src/permission.ts
+var ALLOWED_CLASSES = {
+  settings: ["edit", "newsettings"],
+  snapshot: ["snapshot"],
+  fields: ["fields"],
+  record: ["record"]
+};
+var OP_LABEL = {
+  settings: "設定（-edit.json と新しい設定）",
+  snapshot: "新しい名前のダウンロード / pull",
+  fields: "fields.json",
+  record: "records/ の下"
+};
+var CREATES_FOLDER = ["fields", "snapshot"];
+function classOfAppPath(relInFolder) {
+  const rel2 = relInFolder.replace(/\\/g, "/");
+  if (rel2.split("/").some((seg) => seg.startsWith("."))) return "other";
+  if (rel2.startsWith("records/")) return rel2.toLowerCase().endsWith(".json") && rel2.split("/").length === 2 ? "record" : "other";
+  if (rel2.includes("/")) return "other";
+  if (rel2 === "fields.json") return "fields";
+  if (SNAPSHOT_RE.test(rel2)) return "snapshot";
+  if (EDIT_RE.test(rel2)) return "edit";
+  if (rel2.toLowerCase().endsWith(".json")) return "newsettings";
+  return "other";
+}
+function assertChangeAllowed(root, file, op, mode) {
+  const abs = path10.resolve(root, file);
+  if (!isInside(abs, path10.join(root, KINTONE_ROOT))) return;
+  const rel2 = path10.relative(root, abs);
+  if (mode.kind !== "profiles") {
+    if (mode.kind === "legacy-blocked") throw legacyBlockedError();
+    throw new PermissionError("kintone/ の下は、kintone の接続のファイルがあるときだけ変える（今の形では settings/ などを使う）");
+  }
+  const folder = appFolderOfFile(root, abs);
+  if (!folder) throw new PermissionError(`アプリのフォルダー（kintone/<profile>/<番号>-…/）の中でない: ${rel2}`);
+  const { set, reload } = mode.connections;
+  const def = set.profiles.get(folder.profile);
+  if (!def) throw new PermissionError(`profile「${folder.profile}」は接続のファイル（${set.fileName}）に無い（使われていないフォルダーは変えない）`);
+  const cls = classOfAppPath(path10.relative(folder.dir, abs));
+  if (cls === "snapshot" && existsSync5(abs)) throw new PermissionError(`ダウンロード / pull のファイルは書き換えない: ${rel2}。edit で -edit.json に写して直す`);
+  if (!ALLOWED_CLASSES[op].includes(cls)) throw new PermissionError(`この操作でアプリのフォルダーに書けるのは ${OP_LABEL[op]} だけ: ${rel2}`);
+  if (existsSync5(folder.dir)) assertAppMark(folder.dir, def, folder.appId);
+  else if (!CREATES_FOLDER.includes(op)) throw new PermissionError(`アプリのフォルダーが無い: ${path10.relative(root, folder.dir)}（先に fields か pull で作る）`);
+  assertSameConnection({ set, def }, reload, folder.appId);
+}
+
+// src/commit-file.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { constants, copyFileSync, linkSync, lstatSync as lstatSync3, readFileSync as readFileSync8, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import path11 from "node:path";
+var LOCK_STALE_MS = 6e4;
+var FileExistsError = class extends Error {
+};
+var LockBusyError = class extends Error {
+};
+var errCode = (e) => e?.code;
+var rand = () => randomBytes3(6).toString("hex");
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withRetry(fn, tries = 3) {
+  for (let i = 1; ; i++) {
+    try {
+      return fn();
+    } catch (e) {
+      const code = errCode(e);
+      if (i < tries && (code === "EPERM" || code === "EBUSY")) {
+        sleepSync(20 * i);
+        continue;
+      }
+      throw e;
+    }
+  }
+}
+function cleanupAll(steps, tries = 3) {
+  const errors = [];
+  for (const step of steps) {
+    try {
+      withRetry(step, tries);
+    } catch (e) {
+      errors.push(e instanceof Error ? e.message : String(e));
+    }
+  }
+  return errors;
+}
+function tempPathFor(target) {
+  return path11.join(path11.dirname(target), `.${path11.basename(target)}.${rand()}.tmp`);
+}
+function placeNew(tmp, target, link = linkSync) {
+  try {
+    link(tmp, target);
+    return;
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "EEXIST") throw new FileExistsError(`確定の直前に同じ名前のファイルができた: ${path11.basename(target)}`);
+    if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EXDEV" && code !== "ENOSYS") throw e;
+  }
+  try {
+    copyFileSync(tmp, target, constants.COPYFILE_EXCL);
+  } catch (e) {
+    if (errCode(e) === "EEXIST") throw new FileExistsError(`確定の直前に同じ名前のファイルができた: ${path11.basename(target)}`);
+    throw e;
+  }
+}
+function writeNewFile(target, text, recheck = () => {
+}) {
+  const tmp = tempPathFor(target);
+  let placed = false;
+  let failure;
+  try {
+    recheck();
+    writeFileSync2(tmp, text, { encoding: "utf8", flag: "wx" });
+    recheck();
+    placeNew(tmp, target);
+    placed = true;
+  } catch (e) {
+    failure = e;
+  }
+  const cleanup = cleanupAll([() => rmSync2(tmp, { force: true })]);
+  if (!placed) throw failure;
+  return { cleanup };
+}
+function lockPathFor(target) {
+  return path11.join(path11.dirname(target), `.${path11.basename(target)}.formula-lock`);
+}
+function lstatOrNull(p) {
+  try {
+    return lstatSync3(p);
+  } catch (e) {
+    if (errCode(e) === "ENOENT") return null;
+    throw e;
+  }
+}
+function acquireLock(target, staleMs = LOCK_STALE_MS, hooks = {}) {
+  const file = lockPathFor(target);
+  const token = randomBytes3(16).toString("hex");
+  const busy = (why = "同じファイルへの別の保存が進行中。少し待ってからやり直す") => new LockBusyError(why);
+  const tryCreate = () => {
+    try {
+      writeFileSync2(file, token, { flag: "wx" });
+      return true;
+    } catch (e) {
+      if (errCode(e) === "EEXIST") return false;
+      throw e;
+    }
+  };
+  const isStale = (st) => Date.now() - st.mtimeMs > staleMs;
+  if (!tryCreate()) {
+    const st = lstatOrNull(file);
+    if (st && !st.isFile()) throw busy(`ロックのファイルが普通のファイルでない: ${path11.basename(file)}（利用者が確かめて消す）`);
+    if (st && !isStale(st)) throw busy();
+    if (st) {
+      const aside = `${file}.${rand()}.stale`;
+      hooks.beforeClaim?.();
+      try {
+        withRetry(() => renameSync2(file, aside));
+      } catch (e) {
+        if (errCode(e) !== "ENOENT") throw e;
+      }
+      const moved = lstatOrNull(aside);
+      if (moved) {
+        if (!moved.isFile()) throw busy(`ロックのファイルが普通のファイルでない: ${path11.basename(aside)}（利用者が確かめて消す）`);
+        if (!isStale(moved)) {
+          hooks.beforeRestore?.();
+          try {
+            withRetry(() => placeNew(aside, file));
+          } catch (e) {
+            if (!(e instanceof FileExistsError)) throw busy(`新しいロックを戻せなかった（${errCode(e) ?? e.message}）: ${path11.basename(aside)} を確かめて ${path11.basename(file)} に戻すか消す`);
+          }
+          cleanupAll([() => rmSync2(aside, { force: true })]);
+          throw busy();
+        }
+        cleanupAll([() => rmSync2(aside, { force: true })]);
+      }
+    }
+    if (!tryCreate()) throw busy();
+  }
+  const owned = () => {
+    try {
+      const st = lstatSync3(file);
+      return st.isFile() && readFileSync8(file, "utf8") === token;
+    } catch {
+      return false;
+    }
+  };
+  return {
+    owned,
+    release: () => {
+      if (!owned()) return false;
+      withRetry(() => rmSync2(file, { force: true }));
+      return true;
+    }
+  };
+}
+
+// src/commands/take.ts
+function removeSource(src, warnings, rel2) {
+  try {
+    withRetry(() => unlinkSync(src));
+    return true;
+  } catch (e) {
+    warnings.push(`${rel2} は行き先に置いたが、inbox から消せなかった（${e.code ?? "理由は不明"}）。消してよい`);
+    return false;
+  }
+}
+function readInbox(src) {
+  let bytes;
+  let fd;
+  try {
+    fd = openSync2(src, "r");
+    if (!fstatSync2(fd).isFile()) return { reason: "普通のファイルでない" };
+    const buf = Buffer.alloc(MAX_INPUT_BYTES + 1);
+    let off = 0;
+    for (; ; ) {
+      const n = readSync2(fd, buf, off, buf.length - off, off);
+      if (n === 0) break;
+      off += n;
+      if (off > MAX_INPUT_BYTES) return { reason: `大きすぎる（上限 ${MAX_INPUT_BYTES.toLocaleString()} バイト）` };
+    }
+    bytes = buf.subarray(0, off);
+  } catch (e) {
+    return { reason: `読めない（${e.code ?? "理由は不明"}）` };
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+  }
+  const text = bytes.toString("utf8");
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch (e) {
+    return { reason: `JSON として読めない${jsonErrorWhere(e)}（中身は返さない）` };
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) return { reason: "JSON の最上位がオブジェクトでない" };
+  return { text, data };
+}
+function takeInbox(cwdIn, mode, profile) {
+  const connections = requireProfiles(mode, "take");
+  const def = pickProfile(connections.set, profile);
+  const cwd = realResolve(".", cwdIn);
+  const result = { moved: [], skipped: [], warnings: [] };
+  const inbox = path12.join(cwd, INBOX);
+  if (!existsSync6(inbox)) return result;
+  assertInsideWorkspace(cwd, inbox);
+  const candidates = [];
+  for (const name of readdirSync2(inbox).filter((n) => n.toLowerCase().endsWith(".json")).sort()) {
+    const rel2 = `${INBOX}/${name}`;
+    const src = resolveRead(rel2, cwd);
+    const read = readInbox(src);
+    if ("reason" in read) {
+      result.skipped.push({ file: rel2, reason: read.reason });
+      continue;
+    }
+    const data = read.data;
+    if (data.pluginID !== FORMULA_CONFIG_PLUGIN_ID) {
+      result.skipped.push({ file: rel2, reason: "計算式プラグインの設定のファイルではない（pluginID が違う）" });
+      continue;
+    }
+    const appId = data.appId;
+    if (typeof appId !== "number" || !Number.isSafeInteger(appId) || appId <= 0) {
+      result.skipped.push({ file: rel2, reason: "封筒の appId が無い" });
+      continue;
+    }
+    if (!SNAPSHOT_RE.test(name)) {
+      result.skipped.push({ file: rel2, reason: "ダウンロードの名前（rex0220-formula-app<番号>-<日時>.json）ではない。設定画面のダウンロードの名前のまま inbox/ に置く" });
+      continue;
+    }
+    const m = name.match(/-app(\d+)-/);
+    if (m && Number(m[1]) !== appId) {
+      result.skipped.push({ file: rel2, reason: `ファイル名のアプリ ${m[1]} と封筒の appId ${appId} が違う` });
+      continue;
+    }
+    candidates.push({ rel: rel2, src, name, appId, appName: typeof data.appName === "string" ? data.appName : "", text: read.text });
+  }
+  const dirByApp = /* @__PURE__ */ new Map();
+  for (const appId of new Set(candidates.map((c) => c.appId))) {
+    const newest = candidates.filter((c) => c.appId === appId).reduce((a, b) => b.name > a.name ? b : a);
+    dirByApp.set(appId, appDirFor(cwd, def.profile, appId, newest.appName));
+  }
+  const plans = candidates.map((c) => {
+    const dir = dirByApp.get(c.appId);
+    return { ...c, dir, dest: resolveWrite(path12.join(dir, c.name), WRITE_ROOTS.kintone, cwd) };
+  });
+  const checked = /* @__PURE__ */ new Set();
+  for (const p of plans) {
+    if (checked.has(p.dir) || !existsSync6(p.dir)) continue;
+    assertAppMark(p.dir, def, p.appId);
+    checked.add(p.dir);
+  }
+  for (const p of plans) {
+    try {
+      if (existsSync6(p.dest)) {
+        if (readFileSync9(p.dest, "utf8") !== p.text) {
+          result.skipped.push({ file: p.rel, reason: `行き先に同じ名前の別の中身がある: ${path12.relative(cwd, p.dest)}` });
+          continue;
+        }
+        assertAppMark(p.dir, def, p.appId);
+        assertSameConnection({ set: connections.set, def }, connections.reload, p.appId);
+        const removed2 = removeSource(p.src, result.warnings, p.rel);
+        result.moved.push({ file: p.rel, to: path12.relative(cwd, p.dest), same: true, ...removed2 ? {} : { leftInInbox: true } });
+        continue;
+      }
+      if (!existsSync6(p.dir)) {
+        const found = findAppDir(cwd, def.profile, p.appId);
+        if (found !== null && found !== p.dir) {
+          result.skipped.push({ file: p.rel, reason: `同じアプリのフォルダーが移す途中で別の名前で作られた: ${path12.relative(cwd, found)}。もう一度 take する` });
+          continue;
+        }
+      }
+      assertChangeAllowed(cwd, p.dest, "snapshot", mode);
+      ensureAppFolder(p.dir, def, p.appId);
+      const { cleanup } = writeNewFile(p.dest, p.text, () => {
+        if (resolveWrite(path12.join(p.dir, p.name), WRITE_ROOTS.kintone, cwd) !== p.dest) throw new PermissionError(`書く先のフォルダーが途中で変わった（symlink など）: ${path12.relative(cwd, p.dest)}`);
+        assertChangeAllowed(cwd, p.dest, "snapshot", mode);
+      });
+      for (const c of cleanup) result.warnings.push(`${p.rel} は行き先に置いたが、一時ファイルを消せなかった（${c}）。${path12.relative(cwd, path12.dirname(p.dest))} の .${p.name}.*.tmp を消してよい`);
+    } catch (e) {
+      if (e instanceof ConnectionError) {
+        throw new ConnectionError(`${e.message}（この呼び出しで移したのは ${result.moved.length} 件。inbox に残ったものは、直した後にもう一度 take する）`, e.code);
+      }
+      if (e instanceof PermissionError) {
+        result.skipped.push({ file: p.rel, reason: e.message });
+        continue;
+      }
+      if (e instanceof FileExistsError) {
+        result.skipped.push({ file: p.rel, reason: `行き先に同じ名前のファイルができた（移す途中で）: ${path12.relative(cwd, p.dest)}。もう一度 take する` });
+        continue;
+      }
+      throw e;
+    }
+    const removed = removeSource(p.src, result.warnings, p.rel);
+    result.moved.push({ file: p.rel, to: path12.relative(cwd, p.dest), same: false, ...removed ? {} : { leftInInbox: true } });
+  }
+  return result;
+}
+
+// src/commands/save.ts
+import { createHash as createHash4 } from "node:crypto";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync10, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import path14 from "node:path";
+
 // src/worker/run.ts
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { Worker } from "node:worker_threads";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import path8 from "node:path";
+import path13 from "node:path";
 
 // src/worker/eval-run.ts
+function classifyEvalError(e) {
+  const message = String(e?.message ?? e);
+  if (e instanceof InputError) return { kind: "input", name: "InputError", message };
+  if (e instanceof PluginZipError) return { kind: "zip", name: "PluginZipError", message, code: e.code };
+  if (e instanceof UsersDataError) return { kind: "users", name: "UsersDataError", message };
+  if (e instanceof PolicyError) return { kind: "policy", name: "PolicyError", message };
+  return { kind: "other", name: builtinErrorName(e), message };
+}
+function builtinErrorName(e) {
+  if (e instanceof TypeError) return "TypeError";
+  if (e instanceof RangeError) return "RangeError";
+  if (e instanceof ReferenceError) return "ReferenceError";
+  if (e instanceof SyntaxError) return "SyntaxError";
+  if (e instanceof URIError) return "URIError";
+  return "Error";
+}
 async function runEvalJob(job) {
-  const engine = await loadEngine({ pluginZip: job.pluginZip, devPluginDir: job.devPluginDir, mode: job.mode });
+  const engine = await loadEngine({ pluginZip: job.pluginZip, devPluginDir: job.devPluginDir, mode: job.mode, vendorDir: job.vendorDir });
   if (job.baseUrl) engine.setContext({ baseUrl: job.baseUrl });
   const usersInfo = buildUsersInfo(job.usersSource);
   const usersLabel = job.usersOrigin.kind === "file" ? job.usersOrigin.file : "既定のテストデータ（架空）";
@@ -2274,7 +3261,16 @@ async function runEvalJob(job) {
     usersOrigin: job.usersOrigin
   });
   const outcome = {
-    normalize: { summary: res.summary, hasErrors: res.findings.hasErrors, warnings: res.findings.count("warning"), output: res.output, checkDiffs: res.checkDiffs },
+    normalize: {
+      summary: res.summary,
+      hasErrors: res.findings.hasErrors,
+      warnings: res.findings.count("warning"),
+      findings: [...res.findings.items],
+      output: res.output,
+      checkDiffs: res.checkDiffs,
+      appId: res.appId,
+      size: res.size
+    },
     engineWarnings: [...engine.warnings]
   };
   if (job.kind === "calc" && job.calc && !res.findings.hasErrors) {
@@ -2292,7 +3288,7 @@ async function runEvalJob(job) {
       usersInfo,
       usersOrigin: job.usersOrigin
     });
-    outcome.calc = { text: r.text, failed: r.records.some((x) => x.errors.length > 0 || x.failed) };
+    outcome.calc = { text: r.text, failed: r.records.some((x) => x.errors.length > 0 || x.failed), records: r.records, contextLine: r.contextLine, notice: r.notice, summary: r.summary };
   }
   return outcome;
 }
@@ -2305,79 +3301,388 @@ var EvalTimeoutError = class extends Error {
 var EvalError = class extends Error {
   innerName;
   code;
-  constructor(message, innerName, code) {
+  kind;
+  constructor(message, innerName, code, kind = "other") {
     super(message);
     this.innerName = innerName;
     this.code = code;
+    this.kind = kind;
   }
 };
 function workerEntry() {
   const here2 = fileURLToPath2(import.meta.url);
-  const dir = path8.dirname(here2);
-  const built = path8.join(dir, "eval-worker.mjs");
-  if (here2.endsWith(".mjs") && existsSync4(built)) return built;
-  const src = path8.join(dir, "eval-worker.ts");
-  if (existsSync4(src)) return src;
+  const dir = path13.dirname(here2);
+  const built = path13.join(dir, "eval-worker.mjs");
+  if (here2.endsWith(".mjs") && existsSync7(built)) return built;
+  const src = path13.join(dir, "eval-worker.ts");
+  if (existsSync7(src)) return src;
   throw new Error(`Worker の入口が無い: ${built}`);
 }
 async function runEval(job, opt = {}) {
   const timeoutSec = Math.min(Math.max(opt.timeoutSec ?? DEFAULT_TIMEOUT_SEC, 1), MAX_TIMEOUT_SEC);
-  if (opt.inline) return runEvalJob(job);
-  const entry = workerEntry();
+  if (opt.inline) {
+    try {
+      return await runEvalJob(job);
+    } catch (e) {
+      const c = classifyEvalError(e);
+      throw new EvalError(c.message, c.name, c.code, c.kind);
+    }
+  }
+  let entry;
+  if (opt.workerFile !== void 0) {
+    if (!path13.isAbsolute(opt.workerFile) || !existsSync7(opt.workerFile)) throw new Error(`Worker の入口が無い（絶対パスで指定する）: ${opt.workerFile}`);
+    entry = opt.workerFile;
+  } else entry = workerEntry();
+  const capture = opt.captureOutput;
   return new Promise((resolve, reject) => {
-    const worker = new Worker(entry, { workerData: job, stdout: false, stderr: false });
+    const worker = new Worker(entry, { workerData: job, stdout: capture !== void 0, stderr: capture !== void 0 });
+    if (capture) {
+      worker.stdout.on("data", (d) => capture(String(d), "stdout"));
+      worker.stderr.on("data", (d) => capture(String(d), "stderr"));
+    }
     let settled = false;
-    const finish = (fn) => {
+    const finish2 = (fn) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
       fn();
     };
     const timer = setTimeout(() => {
-      finish(() => {
+      finish2(() => {
         void worker.terminate();
         reject(new EvalTimeoutError(`評価が ${timeoutSec} 秒を超えたので止めた（式が重いか無限に近い繰り返し。--timeout <秒> で上げられる。上限 ${MAX_TIMEOUT_SEC}）`));
       });
     }, timeoutSec * 1e3);
     worker.on("message", (m) => {
-      finish(() => {
+      finish2(() => {
         if (m.ok) resolve(m.outcome);
-        else reject(new EvalError(m.error.message, m.error.name, m.error.code));
+        else reject(new EvalError(m.error.message, m.error.name, m.error.code, m.error.kind ?? "other"));
       });
     });
-    worker.on("error", (e) => finish(() => reject(e)));
-    worker.on("exit", (code) => finish(() => reject(new Error(`評価の Worker が結果を返さずに終わった（exit ${code}）`))));
+    worker.on("error", (e) => finish2(() => reject(new EvalError(e?.message ?? String(e), builtinErrorName(e), void 0, "other"))));
+    worker.on("exit", (code) => finish2(() => reject(new Error(`評価の Worker が結果を返さずに終わった（exit ${code}）`))));
   });
 }
 
+// src/commands/save.ts
+var MAX_SAVE_INPUT_BYTES = 256 * 1024;
+var MAX_UPDATE_ROWS = 50;
+var COMMON_KEYS2 = ["pluginEnable", "pluginProductEnv", "toolEnable", "pluginComment", "pluginDescription", "pluginBtnInfo", "pluginListInfo", "authority", "pluginMiscInfo"];
+function digestOf(text) {
+  return createHash4("sha256").update(text).digest("hex");
+}
+var rel = (root, abs) => path14.relative(root, abs).replace(/\\/g, "/");
+var SaveDenied = class extends Error {
+};
+var ConflictError = class extends Error {
+};
+var isPlainObject2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function parseInput(text, what) {
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    throw new InputError(`${what} を JSON として読めない${jsonErrorWhere(e)}（中身は返さない）`);
+  }
+}
+function tooLarge(text) {
+  return Buffer.byteLength(text, "utf8") > MAX_SAVE_INPUT_BYTES;
+}
+function fieldsFileFor(ctx, target, fields, envelope) {
+  const folder = appFolderOfFile(ctx.root, target);
+  if (folder) {
+    const own = resolveRead(path14.join(folder.dir, "fields.json"), ctx.root);
+    assertUsableInKintone(ctx.root, own, ctx.mode);
+    if (!existsSync8(own)) throw new InputError(`アプリのフォルダーに fields.json が無い: ${rel(ctx.root, own)}（fields コマンドか fml_fields で取る）`);
+    if (fields !== void 0 && resolveRead(fields, ctx.root) !== own) throw new SaveDenied(`アプリのフォルダーの中の設定は、同じフォルダーの fields.json で検査する（fields は渡さないか、${rel(ctx.root, own)} にする）`);
+    return own;
+  }
+  const appId = typeof envelope.appId === "number" && Number.isInteger(envelope.appId) && envelope.appId > 0 ? envelope.appId : void 0;
+  const relFile = fields ?? (appId !== void 0 ? path14.join("fields", `${appId}.json`) : void 0);
+  if (!relFile) throw new InputError("fields（項目定義のファイル）が要る（設定の封筒に appId があれば fields/<appId>.json を既定にする。アプリのフォルダー kintone/<profile>/<番号>-…/ の中なら同じフォルダーの fields.json を使う）");
+  const file = resolveRead(relFile, ctx.root);
+  assertUsableInKintone(ctx.root, file, ctx.mode);
+  if (!existsSync8(file)) throw new InputError(`項目定義のファイルが無い: ${rel(ctx.root, file)}（fields コマンドか fml_fields で取る）`);
+  return file;
+}
+async function normalizeText(ctx, target, text, fieldsFile) {
+  const job = {
+    kind: "normalize",
+    pluginZip: ctx.source.pluginZip,
+    devPluginDir: ctx.source.devPluginDir,
+    mode: ctx.source.mode,
+    vendorDir: ctx.source.vendorDir,
+    baseUrl: ctx.baseUrl,
+    settingsText: text,
+    settingsFile: rel(ctx.root, target),
+    fields: readFieldsFile(fieldsFile),
+    usersSource: ctx.usersSource ?? DEFAULT_USERS,
+    usersOrigin: ctx.usersOrigin ?? { kind: "default" },
+    policy: ctx.policy,
+    lang: ctx.lang
+  };
+  return runEval(job, ctx.run);
+}
+function commit(ctx, target, text, mode, recheck) {
+  const tmp = tempPathFor(target);
+  let lock;
+  let digest;
+  let failure;
+  const checkTarget = () => {
+    if (resolveWrite(rel(ctx.root, target), WRITE_ROOTS.settings, ctx.root) !== target) throw new SaveDenied("書く先のフォルダーが途中で変わった（symlink など）");
+    assertChangeAllowed(ctx.root, target, "settings", ctx.mode);
+    if (SNAPSHOT_RE.test(path14.basename(target))) throw new SaveDenied("ダウンロード / pull のファイルは書き換えない。edit で -edit.json に写して直す");
+  };
+  try {
+    checkTarget();
+    mkdirSync2(path14.dirname(target), { recursive: true });
+    writeFileSync3(tmp, text, { encoding: "utf8", flag: "wx" });
+    lock = acquireLock(target);
+    checkTarget();
+    recheck();
+    if (!lock.owned()) throw new ConflictError("ロックを失った（保存が 60 秒より長く止まった）。fml_summary で読み直してやり直す");
+    if (mode === "new") withRetry(() => placeNew(tmp, target));
+    else withRetry(() => renameSync3(tmp, target));
+    digest = digestOf(text);
+    ctx.afterPlace?.();
+  } catch (e) {
+    failure = e;
+  }
+  const cleanup = cleanupAll([...lock ? [() => void lock.release()] : [], () => rmSync3(tmp, { force: true })]);
+  if (digest === void 0) throw failure;
+  return { digest, cleanup };
+}
+function statusOf(e) {
+  if (e instanceof ConnectionError) return connectionStatusOf(e);
+  if (e instanceof ConflictError || e instanceof FileExistsError || e instanceof LockBusyError) return "conflict";
+  if (e instanceof SaveDenied || e instanceof PermissionError || e instanceof PathError) return "denied";
+  if (e instanceof InputError || e instanceof SyntaxError) return "invalid";
+  if (e instanceof EvalError && e.kind === "input") return "invalid";
+  return "failed";
+}
+function connectionStatusOf(e) {
+  switch (e.code) {
+    case "inside-workspace":
+      return "denied";
+    case "unknown-profile":
+    case "guest-mismatch":
+      return "invalid";
+    case "app-marker-missing":
+    case "app-marker-invalid":
+    case "app-identity-conflict":
+    case "connection-changed":
+      return "conflict";
+    default:
+      return "failed";
+  }
+}
+function codeOf(e) {
+  if (e instanceof ConnectionError) return e.code;
+  if (e instanceof ConflictError || e instanceof FileExistsError || e instanceof LockBusyError) return "ConflictError";
+  if (e instanceof SaveDenied || e instanceof PermissionError) return "PermissionError";
+  if (e instanceof EvalError) return { input: "InputError", zip: "PluginZipError", users: "UsersDataError", policy: "PolicyError", other: e.innerName }[e.kind];
+  if (e instanceof EvalTimeoutError) return "EvalTimeoutError";
+  if (e instanceof InputError) return "InputError";
+  if (e instanceof PathError) return "PathError";
+  return builtinErrorName(e);
+}
+function safeMessageOf(e) {
+  if (e instanceof ConnectionError || e instanceof ConflictError || e instanceof FileExistsError || e instanceof LockBusyError || e instanceof SaveDenied || e instanceof PermissionError || e instanceof PathError || e instanceof InputError || e instanceof EvalTimeoutError) return e.message;
+  if (e instanceof EvalError) return e.kind === "other" ? `評価の途中で想定外の誤り（${e.innerName}）。誤りの文は値やパスを含みうるので返さない` : e.message;
+  if (e instanceof SyntaxError) return "JSON の構文の誤り（中身は返さない）";
+  return `想定外の誤り（${builtinErrorName(e)}）。誤りの文は値やパスを含みうるので返さない`;
+}
+function errorResult(root, target, e, findings = []) {
+  return { status: statusOf(e), code: codeOf(e), path: rel(root, target), findings, message: safeMessageOf(e), ...e instanceof EvalError && e.kind === "zip" && e.code ? { zipCode: e.code } : {} };
+}
+function finish(ctx, target, outcome, run, extra = {}) {
+  const findings = outcome.normalize.findings;
+  try {
+    const { digest, cleanup } = run();
+    return {
+      status: "ok",
+      path: rel(ctx.root, target),
+      digest,
+      findings,
+      summary: outcome.normalize.summary,
+      ...extra,
+      ...cleanup.length ? { cleanup, message: `確定したが、一時ファイルかロックを消せなかった（.${path14.basename(target)}.* を消してよい）` } : {}
+    };
+  } catch (e) {
+    return { ...errorResult(ctx.root, target, e, findings), summary: outcome.normalize.summary };
+  }
+}
+async function saveNewSettings(ctx, opt) {
+  if (opt.expectedAbsent !== true) return { status: "invalid", code: "InputError", path: opt.path, findings: [], message: "新しい設定の保存は expectedAbsent: true が要る（既存のファイルを直すなら fml_update_fields）" };
+  if (tooLarge(opt.content)) return { status: "invalid", code: "InputError", path: opt.path, findings: [], message: `content は ${MAX_SAVE_INPUT_BYTES.toLocaleString()} バイトまで` };
+  let target;
+  try {
+    target = resolveWrite(opt.path, WRITE_ROOTS.settings, ctx.root);
+    const name = path14.basename(target);
+    if (SNAPSHOT_RE.test(name)) throw new SaveDenied("ダウンロード / pull の名前（rex0220-formula-app<番号>-<日時>.json）では新しく保存しない");
+    if (EDIT_RE.test(name)) throw new SaveDenied("-edit.json の名前では新しく保存しない（ダウンロード / pull を直すなら edit（fml_edit）で写してから fml_update_fields）");
+    assertChangeAllowed(ctx.root, target, "settings", ctx.mode);
+  } catch (e) {
+    return errorResult(ctx.root, path14.resolve(ctx.root, opt.path), e);
+  }
+  if (existsSync8(target)) return { status: "conflict", code: "ConflictError", path: rel(ctx.root, target), findings: [], message: "同じ名前のファイルがある（新しい設定の保存は上書きしない。直すなら fml_update_fields）" };
+  let outcome;
+  try {
+    const envelope = parseInput(opt.content, "content");
+    if (!isPlainObject2(envelope)) throw new InputError("content の最上位はオブジェクト（封筒形式の設定 JSON）");
+    outcome = await normalizeText(ctx, target, opt.content, fieldsFileFor(ctx, target, opt.fields, envelope));
+  } catch (e) {
+    return errorResult(ctx.root, target, e);
+  }
+  if (outcome.normalize.hasErrors || !outcome.normalize.output) return { status: "invalid", code: "NormalizeError", path: rel(ctx.root, target), findings: outcome.normalize.findings, summary: outcome.normalize.summary, message: "normalize のエラーがあるので保存しない" };
+  const text = JSON.stringify(outcome.normalize.output, null, 2) + "\n";
+  return finish(
+    ctx,
+    target,
+    outcome,
+    () => commit(ctx, target, text, "new", () => {
+      if (existsSync8(target)) throw new ConflictError("確定の直前に同じ名前のファイルができた");
+    })
+  );
+}
+function parseRows(text, current) {
+  const v = parseInput(text, "rows");
+  if (!Array.isArray(v)) throw new InputError("rows は行（fieldcode を持つオブジェクト）の配列");
+  if (v.length === 0) throw new InputError("rows が空");
+  if (v.length > MAX_UPDATE_ROWS) throw new InputError(`rows は 1 回に ${MAX_UPDATE_ROWS} 行まで（${v.length} 行）`);
+  const known = new Set(ROW_SOURCE_KEYS);
+  const codes = new Set(current.map((r) => isPlainObject2(r) ? String(r.fieldcode ?? "") : ""));
+  const out = /* @__PURE__ */ new Map();
+  v.forEach((row, i) => {
+    if (!isPlainObject2(row)) throw new InputError(`rows[${i}] はオブジェクト`);
+    const code = row.fieldcode;
+    if (typeof code !== "string" || !code) throw new InputError(`rows[${i}] に fieldcode（文字列）が要る`);
+    const unknown = Object.keys(row).filter((k) => !known.has(k));
+    if (unknown.length) throw new InputError(`rows[${i}]（${code}）に行の元の値でないキーがある: ${unknown.join(", ")}（使えるのは ${ROW_SOURCE_KEYS.join(", ")}。画面の値（type、fieldlabel など）は normalize が項目定義から補う）`);
+    if (out.has(code)) throw new InputError(`rows の fieldcode が重複: ${code}`);
+    if (!codes.has(code)) throw new InputError(`設定に無い fieldcode: ${code}（項目はアプリの項目定義で決まる。fml_fields で項目定義を取り直し、fml_summary で設定の項目を確かめる）`);
+    out.set(code, row);
+  });
+  return out;
+}
+function parseCommon(text) {
+  const v = parseInput(text, "common");
+  if (!isPlainObject2(v)) throw new InputError(`common は共通の設定のキー（${COMMON_KEYS2.join("、")}）を持つオブジェクト`);
+  const fixed = Object.keys(v).filter((k) => k === "pluginInfos" || ENVELOPE_KEYS2.includes(k));
+  if (fixed.length) throw new InputError(`common で変えられないキー: ${fixed.join(", ")}（項目の行は rows、封筒（appId など）は変えない）`);
+  const unknown = Object.keys(v).filter((k) => !COMMON_KEYS2.includes(k));
+  if (unknown.length) throw new InputError(`common に共通の設定でないキーがある: ${unknown.join(", ")}（使えるのは ${COMMON_KEYS2.join("、")}）`);
+  if (!Object.keys(v).length) throw new InputError("common が空（変えないなら渡さない）");
+  return v;
+}
+async function updateFields(ctx, opt) {
+  if (tooLarge(opt.rows)) return { status: "invalid", code: "InputError", path: opt.path, findings: [], message: `rows は ${MAX_SAVE_INPUT_BYTES.toLocaleString()} バイトまで` };
+  if (opt.common !== void 0 && tooLarge(opt.common)) return { status: "invalid", code: "InputError", path: opt.path, findings: [], message: `common は ${MAX_SAVE_INPUT_BYTES.toLocaleString()} バイトまで` };
+  let target;
+  try {
+    target = resolveRead(opt.path, ctx.root);
+    resolveWrite(opt.path, WRITE_ROOTS.settings, ctx.root);
+    if (SNAPSHOT_RE.test(path14.basename(target))) throw new SaveDenied("ダウンロード / pull のファイルは書き換えない。edit（fml_edit）で -edit.json に写して直す");
+    assertUsableInKintone(ctx.root, target, ctx.mode);
+    assertChangeAllowed(ctx.root, target, "settings", ctx.mode);
+  } catch (e) {
+    return errorResult(ctx.root, path14.resolve(ctx.root, opt.path), e);
+  }
+  if (!existsSync8(target)) return { status: "conflict", code: "ConflictError", path: rel(ctx.root, target), findings: [], message: "ファイルが無い（新しい設定なら fml_save_settings）" };
+  const current = readFileSync10(target);
+  if (digestOf(current) !== opt.expectedDigest) return { status: "conflict", code: "ConflictError", path: rel(ctx.root, target), findings: [], message: "読んだ後にファイルが変わった（digest が違う）。fml_summary で読み直す" };
+  let settings;
+  try {
+    const v = parseInput(current.toString("utf8").replace(/^/, ""), "設定のファイル");
+    if (!isPlainObject2(v)) throw new InputError("設定のファイルの最上位はオブジェクト");
+    if (v.pluginID !== FORMULA_CONFIG_PLUGIN_ID) throw new InputError(`計算式プラグインの設定のファイルではない（封筒の pluginID が "${FORMULA_CONFIG_PLUGIN_ID}" でない）`);
+    if (!Array.isArray(v.pluginInfos)) throw new InputError("設定のファイルに pluginInfos（項目の行）が無い");
+    settings = v;
+  } catch (e) {
+    return errorResult(ctx.root, target, e);
+  }
+  const rows = settings.pluginInfos;
+  let next;
+  try {
+    const replace = parseRows(opt.rows, rows);
+    const common = opt.common !== void 0 ? parseCommon(opt.common) : {};
+    const merged = rows.map((r) => {
+      const code = isPlainObject2(r) ? String(r.fieldcode ?? "") : "";
+      const rep = replace.get(code);
+      return rep ? { ...r, ...rep } : r;
+    });
+    next = { ...settings, ...common, pluginInfos: merged };
+  } catch (e) {
+    return errorResult(ctx.root, target, e);
+  }
+  let outcome;
+  try {
+    outcome = await normalizeText(ctx, target, JSON.stringify(next), fieldsFileFor(ctx, target, opt.fields, settings));
+  } catch (e) {
+    return errorResult(ctx.root, target, e);
+  }
+  if (outcome.normalize.hasErrors || !outcome.normalize.output) return { status: "invalid", code: "NormalizeError", path: rel(ctx.root, target), findings: outcome.normalize.findings, summary: outcome.normalize.summary, message: "normalize のエラーがあるので保存しない（ファイルは変えていない）" };
+  const output = outcome.normalize.output;
+  const text = JSON.stringify(output, null, 2) + "\n";
+  const name = rel(ctx.root, target);
+  const d = diffSettings(settings, output, { before: `${name}（前）`, after: name });
+  return finish(
+    ctx,
+    target,
+    outcome,
+    () => commit(ctx, target, text, "replace", () => {
+      if (digestOf(readFileSync10(target)) !== opt.expectedDigest) throw new ConflictError("確定の直前にファイルが変わった（digest が違う）。fml_summary で読み直す");
+    }),
+    { diff: { fields: d.fields, common: d.common } }
+  );
+}
+
 // src/core.ts
-var CORE_API_VERSION = 1;
+var CORE_API_VERSION = 2;
 export {
   ALLOWED_APIS,
   ALLOWED_USER_APIS,
+  APP_MARKER,
   AuthError,
+  COMMON_KEYS2 as COMMON_KEYS,
+  CONNECTION_MAX_BYTES,
   CORE_API_VERSION,
+  ConnectionError,
   DEFAULT_CONTEXT_BASE_URL,
   DEFAULT_EVENT,
   DEFAULT_MAX_CALLS,
   DEFAULT_POLICY,
   DEFAULT_TIMEOUT_SEC,
   DEFAULT_USERS,
+  EDIT_RE,
+  ENVELOPE_KEYS2 as ENVELOPE_KEYS,
   EVENT_RE,
   EvalError,
   EvalTimeoutError,
+  FALLBACK_PROFILE,
+  FORMULA_CONFIG_PLUGIN_ID,
   FORMULA_PLUGIN_ID,
+  FileExistsError,
   Findings,
+  INBOX,
   InputError,
+  KINTONE_ROOT,
   KintoneUrlError,
+  LEGACY_WORKSPACE_FILE,
   LIST_LIMIT,
+  LOCK_STALE_MS,
+  LockBusyError,
   MAX_INPUT_BYTES,
+  MAX_SAVE_INPUT_BYTES,
   MAX_TIMEOUT_SEC,
+  MAX_UPDATE_ROWS,
   MIN_PLUGIN_VERSION,
   NotAllowedError,
+  OUTER_KEYS,
   PLUGIN_NAME,
   POLICY_FILE,
+  PROFILE_NAME_RE,
   PathError,
+  PermissionError,
   PluginZipError,
   PolicyError,
   QUERY_MAX,
@@ -2385,17 +3690,38 @@ export {
   RECEIVE_LIMITS,
   RECORDS_MAX,
   REQUIRED_API,
+  ROW_SCREEN_KEYS,
+  ROW_SOURCE_KEYS,
   RestError,
   SENTINEL_USER,
   SHAPE_TEXT_MAX,
+  SNAPSHOT_PREFIX,
+  SNAPSHOT_RE,
   SUPPORTED_API_VERSIONS,
+  USER_INFO_FUNCTIONS,
   UsersDataError,
   UsersPullError,
   WRITE_ROOTS,
+  WorkspaceError,
+  acquireLock,
+  appDirFor,
+  appFolderOfFile,
+  appFoldersOf,
+  assertAppMark,
+  assertChangeAllowed,
+  assertInsideWorkspace,
+  assertSameConnection,
+  assertUsableInKintone,
+  authFor,
   baseUrlFromEnv,
   bodyOf,
   buildUsersInfo,
+  builtinErrorName,
   calcSettings,
+  classOfAppPath,
+  classifyEvalError,
+  cleanupAll,
+  connectionStatusOf,
   contextTargetsOf,
   createContext,
   createRestClient,
@@ -2404,57 +3730,96 @@ export {
   describeAuth,
   describeRecord,
   diffSettings,
+  digestOf,
+  editNameOf,
+  ensureAppFolder,
   fetchFields,
   fetchRecord,
+  findAppDir,
   findCycles,
+  folderNameOf,
   formatDate,
+  hasLegacyConfig,
+  identityOf,
   isInside,
   isKintoneBaseUrl,
   isSupportedPluginVersion,
   jsonDiff,
+  jsonErrorText,
+  jsonErrorWhere,
   kintoneConfigPath,
+  legacyBlockedError,
+  listAppFolder,
   listFields,
   listQueryOf,
   listRecordShapes,
   loadAuth,
+  loadConnections,
   loadEngine,
   loadPolicy,
+  loadUserApiAuth,
+  lockPathFor,
+  markOf,
   materialsOf,
+  modeOf,
+  momentFileOf,
   narrowRecord,
   normalizeKintoneBaseUrl,
   normalizeSettings,
   parsePolicy,
+  pickProfile,
+  placeNew,
   pluginIdOf,
   pluginZipPath,
+  profileDirOf,
+  pullReferencedUsers,
   pullSettings,
   pullUsers,
+  readAppMark,
   readFieldsFile,
   readJsonLimited,
   readPluginZip,
   readTextLimited,
   realResolve,
   referenceTablesOf,
+  referencedCodesOf,
   relativeSettingsPath,
+  requireProfiles,
   resolvePluginSources,
   resolveRead,
   resolveWrite,
+  resolveWriteDir,
   rowsOf,
   runEval,
   runEvalJob,
+  safeFileName,
+  sameIdentity,
+  saveNewSettings,
   scanFormula,
   scanFormulas,
+  scanUserInfoCalls,
   schemaRevisionOf,
+  semanticDigest,
   shapeLines,
+  snapshotNameOf,
+  snapshotOf,
   stronglyConnected,
   summarizeFields,
   summarizeRecord,
   summarizeSettings,
   summarizeUsers,
+  takeInbox,
+  tempPathFor,
   toolsMeta,
   unquote,
+  unusedProfileDirs,
+  updateFields,
   usedFieldCodes,
+  userApiAuthFor,
   usersFileNameOf,
   validateEvent,
   validateUsersSource,
-  viewsOf
+  viewsOf,
+  withRetry,
+  writeNewFile
 };