@rex0220/kintone-sql-tools 1.12.1 → 1.13.1

package/dist-cli/ksql.js

@@ -34,6 +34,7 @@ __export(index_exports, {
   parseConsoleMetaCommand: () => parseConsoleMetaCommand,
   parseTokenFile: () => parseTokenFile,
   parseTokenMap: () => parseTokenMap,
+  runWithArgv: () => runWithArgv,
   shouldExitOnEmpty: () => shouldExitOnEmpty,
   writeBatchOutput: () => writeBatchOutput
 });
@@ -6849,6 +6850,114 @@ function buildBatchEnvelope(batch, options = {}) {
 }
 
 // src/node/config.ts
+var LOGICAL_APP_NAME_RE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+var PHYSICAL_APP_KEY_RE = /^APP\d+$/i;
+var NUMERIC_APP_KEY_RE = /^\d+$/;
+var LOGICAL_SQL_KEY_RE = /^LAPP_/i;
+function argumentError(message) {
+  return new Error(`ArgumentError: ${message}`);
+}
+function normalizeLogicalApps(profileName, value) {
+  if (value === void 0) return void 0;
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw argumentError(`logicalApps for profile "${profileName}" must be an object.`);
+  }
+  const normalized = {};
+  const physicalIdOwners = /* @__PURE__ */ new Map();
+  for (const [rawName, rawAppId] of Object.entries(value)) {
+    if (PHYSICAL_APP_KEY_RE.test(rawName) || NUMERIC_APP_KEY_RE.test(rawName) || LOGICAL_SQL_KEY_RE.test(rawName)) {
+      throw argumentError(
+        `logical app key "${rawName}" in profile "${profileName}" must be a logical name without APP, numeric, or LAPP_ syntax.`
+      );
+    }
+    if (!LOGICAL_APP_NAME_RE.test(rawName)) {
+      throw argumentError(
+        `logical app key "${rawName}" in profile "${profileName}" must match [A-Z][A-Z0-9_]{0,63}.`
+      );
+    }
+    const logicalName = rawName.toUpperCase();
+    if (Object.prototype.hasOwnProperty.call(normalized, logicalName)) {
+      throw argumentError(
+        `logical app name "${logicalName}" is duplicated after case normalization in profile "${profileName}".`
+      );
+    }
+    if (typeof rawAppId !== "number" || !Number.isSafeInteger(rawAppId) || rawAppId <= 0) {
+      throw argumentError(
+        `physical app ID for logical app "${logicalName}" in profile "${profileName}" must be a positive safe integer.`
+      );
+    }
+    const existingName = physicalIdOwners.get(rawAppId);
+    if (existingName !== void 0) {
+      throw argumentError(
+        `logical apps "${existingName}" and "${logicalName}" in profile "${profileName}" map to the same physical app ID ${rawAppId}; physical app aliases are not supported yet.`
+      );
+    }
+    physicalIdOwners.set(rawAppId, logicalName);
+    normalized[logicalName] = rawAppId;
+  }
+  return normalized;
+}
+function validateKsqlConfig(config) {
+  if (config === null || typeof config !== "object" || Array.isArray(config)) {
+    throw argumentError("config must be an object.");
+  }
+  if (config.profiles === void 0) return config;
+  if (config.profiles === null || typeof config.profiles !== "object" || Array.isArray(config.profiles)) {
+    throw argumentError("profiles must be an object.");
+  }
+  for (const [profileName, profile] of Object.entries(config.profiles)) {
+    if (profile === null || typeof profile !== "object" || Array.isArray(profile)) {
+      throw argumentError(`profile "${profileName}" must be an object.`);
+    }
+    if (profile.allowPhysicalAppRefs !== void 0 && typeof profile.allowPhysicalAppRefs !== "boolean") {
+      throw argumentError(`allowPhysicalAppRefs for profile "${profileName}" must be boolean.`);
+    }
+    const logicalApps = normalizeLogicalApps(profileName, profile.logicalApps);
+    if (logicalApps !== void 0) profile.logicalApps = logicalApps;
+  }
+  return config;
+}
+function createAppResolutionContext(config, defaultProfile) {
+  const profiles = Object.fromEntries(
+    Object.entries(config.profiles ?? {}).map(([name, profile]) => [
+      name,
+      {
+        logicalApps: profile.logicalApps === void 0 ? void 0 : { ...profile.logicalApps },
+        allowPhysicalAppRefs: profile.allowPhysicalAppRefs
+      }
+    ])
+  );
+  const implicitDefaultProfile = {};
+  function requireProfile(profileName) {
+    const profile = profiles[profileName];
+    if (!profile && profileName === defaultProfile) return implicitDefaultProfile;
+    if (!profile) throw argumentError(`profile "${profileName}" is not defined.`);
+    return profile;
+  }
+  return {
+    resolveLogicalApp(name, profile) {
+      if (!LOGICAL_APP_NAME_RE.test(name)) {
+        throw argumentError(`logical app name "${name}" must match [A-Z][A-Z0-9_]{0,63}.`);
+      }
+      const profileName = profile || defaultProfile;
+      const logicalName = name.toUpperCase();
+      const appId = requireProfile(profileName).logicalApps?.[logicalName];
+      if (appId === void 0) {
+        throw argumentError(`logical app LAPP_${logicalName}@${profileName} is not defined.`);
+      }
+      return appId;
+    },
+    assertPhysicalAppAllowed(profile) {
+      const profileName = profile || defaultProfile;
+      if (!profiles[profileName]) return;
+      if (requireProfile(profileName).allowPhysicalAppRefs === false) {
+        throw argumentError(
+          `physical app references are not allowed for profile "${profileName}"; use LAPP_<NAME>.`
+        );
+      }
+    }
+  };
+}
 function envString(name) {
   const v = process.env[name];
   return v && v.trim() ? v : null;
@@ -6860,20 +6969,354 @@ function envInt(name) {
   if (!Number.isInteger(n) || n <= 0) return null;
   return n;
 }
-function envNonNegativeInt(name) {
-  const v = envString(name);
-  if (v === null) return null;
-  const n = Number(v);
-  if (!Number.isInteger(n) || n < 0) return null;
-  return n;
+function envNonNegativeInt(name) {
+  const v = envString(name);
+  if (v === null) return null;
+  const n = Number(v);
+  if (!Number.isInteger(n) || n < 0) return null;
+  return n;
+}
+function resolveRequestGateOptions(base) {
+  return {
+    ...base,
+    maxConcurrent: envInt("KSQL_MAX_CONCURRENT") ?? base.maxConcurrent,
+    // KSQL_RETRY=0（リトライ無効）は有効値のため envNonNegativeInt で読む
+    maxRetries: envNonNegativeInt("KSQL_RETRY") ?? base.maxRetries
+  };
+}
+function resolveTokenValue(raw) {
+  if (raw.startsWith("env:")) {
+    const envKey = raw.slice(4);
+    const envVal = process.env[envKey];
+    if (!envVal) throw new Error(`AuthError: environment variable "${envKey}" is not set.`);
+    return envVal;
+  }
+  return raw;
+}
+
+// src/api/requestGate.ts
+var DEFAULT_MAX_CONCURRENT = 10;
+var DEFAULT_MAX_RETRIES = 3;
+var DEFAULT_BASE_DELAY_MS = 500;
+var DEFAULT_MAX_DELAY_MS = 8e3;
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
+function isRetryableError(err) {
+  if (!(err instanceof Error)) return false;
+  const status = err.message.match(/^kintone API error (\d{3}):/);
+  if (status) return RETRYABLE_STATUSES.has(Number(status[1]));
+  if (err.name === "AbortError" || err.name === "TimeoutError") return true;
+  if (/fetch failed/i.test(err.message)) return true;
+  return false;
+}
+var RequestGate = class {
+  constructor(options = {}) {
+    this.active = 0;
+    this.waiters = [];
+    this.maxConcurrent = clampInt(options.maxConcurrent ?? DEFAULT_MAX_CONCURRENT, 1, 50);
+    this.maxRetries = clampInt(options.maxRetries ?? DEFAULT_MAX_RETRIES, 0, 10);
+    this.baseDelayMs = clampInt(options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS, 1, 6e4);
+    this.maxDelayMs = Math.max(
+      clampInt(options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS, 1, 6e5),
+      this.baseDelayMs
+    );
+    this.sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.random = options.random ?? Math.random;
+  }
+  /** 現在の同時実行数（テスト・診断用） */
+  get activeCount() {
+    return this.active;
+  }
+  get limit() {
+    return this.maxConcurrent;
+  }
+  /** 解決済みの GET リトライ回数（テスト・診断用） */
+  get retries() {
+    return this.maxRetries;
+  }
+  /** 解決済みのバックオフ初期値ミリ秒（テスト・診断用） */
+  get retryBaseDelayMs() {
+    return this.baseDelayMs;
+  }
+  /** 解決済みのバックオフ上限ミリ秒（テスト・診断用） */
+  get retryMaxDelayMs() {
+    return this.maxDelayMs;
+  }
+  /** GET 系: セマフォ + リトライ付きで実行する */
+  async runReadOnly(fn) {
+    let attempt = 0;
+    while (true) {
+      try {
+        return await this.withSlot(fn);
+      } catch (err) {
+        if (attempt >= this.maxRetries || !isRetryableError(err)) throw err;
+        await this.sleep(this.backoffDelay(attempt));
+        attempt += 1;
+      }
+    }
+  }
+  /** 書き込み系: セマフォのみ（リトライしない — 二重実行防止） */
+  async runMutation(fn) {
+    return this.withSlot(fn);
+  }
+  async withSlot(fn) {
+    await this.acquire();
+    try {
+      return await fn();
+    } finally {
+      this.release();
+    }
+  }
+  async acquire() {
+    if (this.active < this.maxConcurrent) {
+      this.active += 1;
+      return;
+    }
+    await new Promise((resolve2) => this.waiters.push(resolve2));
+    this.active += 1;
+  }
+  release() {
+    this.active -= 1;
+    const next = this.waiters.shift();
+    if (next) next();
+  }
+  /** 指数バックオフ + ジッタ（attempt: 0 始まり） */
+  backoffDelay(attempt) {
+    const base = Math.min(this.baseDelayMs * 2 ** attempt, this.maxDelayMs);
+    const jitter = 1 + (this.random() - 0.5) * 0.5;
+    return Math.round(base * jitter);
+  }
+};
+function withRequestGate(client, gate) {
+  return {
+    getRecords: (params) => gate.runReadOnly(() => client.getRecords(params)),
+    getApps: () => gate.runReadOnly(() => client.getApps()),
+    getFields: (appId) => gate.runReadOnly(() => client.getFields(appId)),
+    postRecords: (params) => gate.runMutation(() => client.postRecords(params)),
+    putRecords: (params) => gate.runMutation(() => client.putRecords(params)),
+    deleteRecords: (params) => gate.runMutation(() => client.deleteRecords(params))
+  };
+}
+var globalGate = null;
+function getGlobalRequestGate(options) {
+  if (globalGate === null) {
+    globalGate = new RequestGate(
+      typeof options === "number" ? { maxConcurrent: options } : options ?? {}
+    );
+  }
+  return globalGate;
+}
+function clampInt(v, min, max) {
+  if (!Number.isFinite(v)) return min;
+  return Math.max(min, Math.min(max, Math.trunc(v)));
+}
+
+// src/cli/nodeKintoneClient.ts
+function createNodeKintoneClient(baseUrl, tokenResolver) {
+  const normalizedBaseUrl = baseUrl.replace(/\/+$/, "");
+  const apiBasePath = tokenResolver.guestSpaceId && tokenResolver.guestSpaceId > 0 ? `/k/guest/${tokenResolver.guestSpaceId}/v1` : "/k/v1";
+  async function requestJson(path, init, appIdForToken) {
+    const headers = new Headers(init.headers ?? {});
+    if (tokenResolver.auth.type === "token") {
+      headers.set("X-Cybozu-API-Token", tokenResolver.auth.resolveToken(appIdForToken));
+    } else {
+      const credentials = `${tokenResolver.auth.username}:${tokenResolver.auth.password}`;
+      const encoded = Buffer.from(credentials, "utf-8").toString("base64");
+      headers.set("X-Cybozu-Authorization", encoded);
+    }
+    headers.set("Accept", "application/json");
+    const method = String(init.method ?? "GET").toUpperCase();
+    if (method !== "GET" && method !== "HEAD") {
+      headers.set("Content-Type", "application/json");
+    }
+    const timeoutMs = tokenResolver.timeoutMs ?? 3e4;
+    const url = `${normalizedBaseUrl}${path}`;
+    if (tokenResolver.debug) {
+      tokenResolver.log?.(`[debug] request ${String(init.method ?? "GET")} ${url}`);
+      if (tokenResolver.debugHeaders) {
+        const authHeader = headers.get("X-Cybozu-API-Token") ? "X-Cybozu-API-Token=***" : headers.get("X-Cybozu-Authorization") ? "X-Cybozu-Authorization=***" : "Auth=(none)";
+        tokenResolver.log?.(
+          `[debug] request-headers ${authHeader} Content-Type=${headers.get("Content-Type") ?? "(none)"} Accept=${headers.get("Accept") ?? "(none)"}`
+        );
+      }
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    timeout.unref?.();
+    let res;
+    try {
+      res = await fetch(url, {
+        ...init,
+        headers,
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (!res.ok) {
+      const bodyText = await res.text();
+      if (tokenResolver.debug) {
+        tokenResolver.log?.(`[debug] response status=${res.status} body=${bodyText}`);
+      }
+      throw new Error(`kintone API error ${res.status}: ${bodyText}`);
+    }
+    if (tokenResolver.debug) {
+      tokenResolver.log?.(`[debug] response status=${res.status}`);
+    }
+    return await res.json();
+  }
+  function shouldRetryWithRecordNumberOrder(path, bodyText) {
+    if (!path.includes("/v1/records.json?")) return false;
+    if (!bodyText.includes('"code":"CB_IL02"')) return false;
+    const queryPart = path.split("query=")[1] ?? "";
+    const query = decodeURIComponent(queryPart.split("&")[0] ?? "");
+    if (!query.includes("limit")) return false;
+    if (!query.includes("offset")) return false;
+    if (query.toLowerCase().includes("order by")) return false;
+    return true;
+  }
+  function rewriteQueryWithRecordNumberOrder(path) {
+    const [base, rest] = path.split("query=");
+    if (!rest) return path;
+    const [encodedQuery, ...tail] = rest.split("&");
+    const query = decodeURIComponent(encodedQuery ?? "");
+    const rewritten = `order by \u30EC\u30B3\u30FC\u30C9\u756A\u53F7 asc ${query}`.trim();
+    const nextQuery = encodeURIComponent(rewritten);
+    return `${base}query=${nextQuery}${tail.length > 0 ? `&${tail.join("&")}` : ""}`;
+  }
+  return {
+    async getRecords(params) {
+      const queryPart = `query=${encodeURIComponent(params.query)}`;
+      const appPart = `app=${encodeURIComponent(String(params.app))}`;
+      const fieldParts = params.fields.map((f) => `fields[]=${encodeURIComponent(f)}`);
+      const qs = [appPart, queryPart, ...fieldParts].join("&");
+      if (tokenResolver.debug) {
+        tokenResolver.log?.(
+          `[debug] getRecords app=${params.app} query="${params.query}" fields=${params.fields.length > 0 ? params.fields.join(",") : "(all)"} auth=${tokenResolver.auth.type}`
+        );
+      }
+      const path = `${apiBasePath}/records.json?${qs}`;
+      try {
+        return await requestJson(
+          path,
+          { method: "GET" },
+          params.app
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (!shouldRetryWithRecordNumberOrder(path, msg)) throw err;
+        const retryPath = rewriteQueryWithRecordNumberOrder(path);
+        if (tokenResolver.debug) {
+          tokenResolver.log?.("[debug] retry with fallback query order by \u30EC\u30B3\u30FC\u30C9\u756A\u53F7 asc");
+        }
+        return await requestJson(
+          retryPath,
+          { method: "GET" },
+          params.app
+        );
+      }
+    },
+    async postRecords(_params) {
+      const res = await requestJson(
+        `${apiBasePath}/records.json`,
+        {
+          method: "POST",
+          body: JSON.stringify({
+            app: _params.app,
+            records: _params.records
+          })
+        },
+        _params.app
+      );
+      return { ids: res.ids };
+    },
+    async putRecords(_params) {
+      await requestJson(
+        `${apiBasePath}/records.json`,
+        {
+          method: "PUT",
+          body: JSON.stringify({
+            app: _params.app,
+            records: _params.records
+          })
+        },
+        _params.app
+      );
+    },
+    async deleteRecords(_params) {
+      await requestJson(
+        `${apiBasePath}/records.json`,
+        {
+          method: "DELETE",
+          body: JSON.stringify({
+            app: _params.app,
+            ids: _params.ids
+          })
+        },
+        _params.app
+      );
+    },
+    async getApps() {
+      const PAGE = 100;
+      const all = [];
+      let offset = 0;
+      while (true) {
+        const qs = new URLSearchParams();
+        qs.set("limit", String(PAGE));
+        qs.set("offset", String(offset));
+        const res = await requestJson(
+          `${apiBasePath}/apps.json?${qs.toString()}`,
+          { method: "GET" },
+          0
+        );
+        for (const app of res.apps) {
+          all.push({
+            appId: Number(app.appId),
+            name: app.name,
+            description: app.description
+          });
+        }
+        if (res.apps.length < PAGE) break;
+        offset += PAGE;
+      }
+      return all;
+    },
+    async getFields(appId) {
+      const qs = new URLSearchParams();
+      qs.set("app", String(appId));
+      const res = await requestJson(
+        `${apiBasePath}/app/form/fields.json?${qs.toString()}`,
+        { method: "GET" },
+        appId
+      );
+      return Object.values(res.properties).map((f) => ({
+        code: f.code,
+        label: f.label,
+        fieldType: f.type,
+        optionOrder: toOptionOrderMap(f.options),
+        sortKind: detectSortKind(f.type, f.format)
+      }));
+    }
+  };
+}
+function toOptionOrderMap(options) {
+  if (!options || typeof options !== "object") return void 0;
+  const order = {};
+  let hasAny = false;
+  for (const [label, meta] of Object.entries(options)) {
+    const n = Number(meta?.index);
+    if (!Number.isFinite(n)) continue;
+    order[label] = n;
+    hasAny = true;
+  }
+  return hasAny ? order : void 0;
 }
-function resolveRequestGateOptions(base) {
-  return {
-    ...base,
-    maxConcurrent: envInt("KSQL_MAX_CONCURRENT") ?? base.maxConcurrent,
-    // KSQL_RETRY=0（リトライ無効）は有効値のため envNonNegativeInt で読む
-    maxRetries: envNonNegativeInt("KSQL_RETRY") ?? base.maxRetries
-  };
+function detectSortKind(fieldType, calcFormat) {
+  if (fieldType === "NUMBER" || fieldType === "RECORD_NUMBER") return "number";
+  if (fieldType === "CALC") {
+    if (calcFormat === "NUMBER" || calcFormat === "NUMBER_DIGIT") return "number";
+    return "string";
+  }
+  return void 0;
 }
 
 // src/node/appProfiles.ts
@@ -6908,7 +7351,9 @@ function normalizeAppKey(v) {
 }
 function extractAppIds(sql) {
   const out = /* @__PURE__ */ new Set();
-  for (const t of collectAppProfileTokens(sql)) out.add(t.appId);
+  for (const t of collectAppProfileTokens(sql)) {
+    if (t.source === "physical") out.add(t.appId);
+  }
   return [...out];
 }
 function isSqlIdentContinue(ch) {
@@ -6921,16 +7366,42 @@ function isProfileNameChar(ch) {
   const cp = ch.codePointAt(0);
   return cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp >= 48 && cp <= 57 || ch === "_" || ch === "-" || ch === "." || ch === "$";
 }
+function isAsciiLogicalNameStart(ch) {
+  return /^[A-Za-z]$/.test(ch);
+}
+function isAsciiLogicalNameContinue(ch) {
+  return /^[A-Za-z0-9_]$/.test(ch);
+}
 function tryParseAppProfileToken(sql, start) {
-  const head = sql.slice(start, start + 3);
-  if (head.toUpperCase() !== "APP") return null;
   const prev = start > 0 ? sql[start - 1] : "";
   if (isSqlIdentContinue(prev)) return null;
-  let i = start + 3;
-  const digitStart = i;
-  while (i < sql.length && /[0-9]/.test(sql[i])) i++;
-  const digitEnd = i;
-  if (digitEnd === digitStart) return null;
+  let source;
+  let appId;
+  let logicalName;
+  let referenceValueStart;
+  let referenceValueEnd;
+  let i;
+  if (sql.slice(start, start + 5).toUpperCase() === "LAPP_") {
+    source = "logical";
+    i = start + 5;
+    referenceValueStart = i;
+    if (!isAsciiLogicalNameStart(sql[i] ?? "")) return null;
+    i++;
+    while (i < sql.length && isAsciiLogicalNameContinue(sql[i])) i++;
+    referenceValueEnd = i;
+    if (referenceValueEnd - referenceValueStart > 64) return null;
+    logicalName = sql.slice(referenceValueStart, referenceValueEnd).toUpperCase();
+  } else if (sql.slice(start, start + 3).toUpperCase() === "APP") {
+    source = "physical";
+    i = start + 3;
+    referenceValueStart = i;
+    while (i < sql.length && /[0-9]/.test(sql[i])) i++;
+    referenceValueEnd = i;
+    if (referenceValueEnd === referenceValueStart) return null;
+    appId = Number(sql.slice(referenceValueStart, referenceValueEnd));
+  } else {
+    return null;
+  }
   if (sql[i] === "$") {
     i++;
     const subStart = i;
@@ -6948,15 +7419,15 @@ function tryParseAppProfileToken(sql, start) {
   }
   const next = i < sql.length ? sql[i] : "";
   if (isSqlIdentContinue(next)) return null;
-  return {
-    appId: Number(sql.slice(digitStart, digitEnd)),
+  const common = {
     profile,
     start,
-    digitStart,
-    digitEnd,
+    referenceValueStart,
+    referenceValueEnd,
     appEnd,
     fullEnd: i
   };
+  return source === "physical" ? { ...common, source, appId } : { ...common, source, logicalName };
 }
 function collectAppProfileTokens(sql) {
   const tokens = [];
@@ -7016,12 +7487,13 @@ function nextVirtualAppId(used) {
   used.add(id);
   return id;
 }
-function normalizeSqlAppProfiles(sql, defaultProfile = "dev") {
+function normalizeSqlAppProfiles(sql, defaultProfile = "dev", resolutionContext) {
   const tokens = collectAppProfileTokens(sql);
   const hasProfileSyntax = tokens.some((t) => t.profile !== null);
   const profilesByApp = /* @__PURE__ */ new Map();
   const normalizedProfile = (profile) => profile ?? defaultProfile;
   for (const t of tokens) {
+    if (t.source !== "physical") continue;
     const p = normalizedProfile(t.profile);
     let set = profilesByApp.get(t.appId);
     if (!set) {
@@ -7030,7 +7502,24 @@ function normalizeSqlAppProfiles(sql, defaultProfile = "dev") {
     }
     set.add(p.toLowerCase());
   }
-  const usedAppIds = new Set(tokens.map((t) => t.appId));
+  const usedAppIds = new Set(
+    tokens.filter((t) => t.source === "physical").map((t) => t.appId)
+  );
+  const resolvedLogicalApps = /* @__PURE__ */ new Map();
+  for (const t of tokens) {
+    if (t.source !== "logical") continue;
+    const pLower = normalizedProfile(t.profile).toLowerCase();
+    const logicalKey = `logical:${t.logicalName}@${pLower}`;
+    if (resolvedLogicalApps.has(logicalKey)) continue;
+    if (!resolutionContext) {
+      throw new Error(
+        `ArgumentError: logical app LAPP_${t.logicalName}@${pLower} requires logicalApps configuration.`
+      );
+    }
+    const resolvedAppId = resolutionContext.resolveLogicalApp(t.logicalName, pLower);
+    resolvedLogicalApps.set(logicalKey, resolvedAppId);
+    usedAppIds.add(resolvedAppId);
+  }
   const pairToMapped = /* @__PURE__ */ new Map();
   const appBindingByMappedApp = /* @__PURE__ */ new Map();
   for (const [appId, pSet] of profilesByApp.entries()) {
@@ -7038,39 +7527,117 @@ function normalizeSqlAppProfiles(sql, defaultProfile = "dev") {
     if (profiles.length <= 1) continue;
     for (const pLower of profiles) {
       const mapped = nextVirtualAppId(usedAppIds);
-      pairToMapped.set(`${appId}@${pLower}`, mapped);
-      appBindingByMappedApp.set(mapped, { appId, profile: pLower });
+      pairToMapped.set(`physical:${appId}@${pLower}`, mapped);
+      appBindingByMappedApp.set(mapped, {
+        source: "physical",
+        mappedAppId: mapped,
+        appId,
+        profile: pLower
+      });
     }
   }
   const out = [];
+  const rewriteSegments = [];
+  let normalizedLength = 0;
   let cursor = 0;
+  const appendSegment = (text, sourceStart, sourceEnd, bindingMappedAppId) => {
+    if (!text && sourceStart === sourceEnd) return;
+    const normalizedStart = normalizedLength;
+    out.push(text);
+    normalizedLength += text.length;
+    rewriteSegments.push({
+      normalizedStart,
+      normalizedEnd: normalizedLength,
+      sourceStart,
+      sourceEnd,
+      ...bindingMappedAppId === void 0 ? {} : { bindingMappedAppId }
+    });
+  };
   for (const t of tokens) {
     const p = normalizedProfile(t.profile);
     const pLower = p.toLowerCase();
-    const mapped = pairToMapped.get(`${t.appId}@${pLower}`) ?? t.appId;
-    appBindingByMappedApp.set(mapped, { appId: t.appId, profile: pLower });
-    out.push(sql.slice(cursor, t.start));
-    out.push(sql.slice(t.start, t.digitStart));
-    out.push(String(mapped));
-    out.push(sql.slice(t.digitEnd, t.appEnd));
+    let binding;
+    if (t.source === "physical") {
+      const mapped = pairToMapped.get(`physical:${t.appId}@${pLower}`) ?? t.appId;
+      binding = {
+        source: "physical",
+        mappedAppId: mapped,
+        appId: t.appId,
+        profile: pLower
+      };
+    } else {
+      const logicalKey = `logical:${t.logicalName}@${pLower}`;
+      let mapped = pairToMapped.get(logicalKey);
+      if (mapped === void 0) {
+        mapped = nextVirtualAppId(usedAppIds);
+        pairToMapped.set(logicalKey, mapped);
+      }
+      binding = {
+        source: "logical",
+        logicalName: t.logicalName,
+        mappedAppId: mapped,
+        appId: resolvedLogicalApps.get(logicalKey),
+        profile: pLower
+      };
+    }
+    appBindingByMappedApp.set(binding.mappedAppId, binding);
+    appendSegment(sql.slice(cursor, t.start), cursor, t.start);
+    const subtableSuffix = sql.slice(t.referenceValueEnd, t.appEnd);
+    const normalizedReference = t.source === "physical" ? `${sql.slice(t.start, t.referenceValueStart)}${binding.mappedAppId}${subtableSuffix}` : `APP${binding.mappedAppId}${subtableSuffix}`;
+    appendSegment(
+      normalizedReference,
+      t.start,
+      t.fullEnd,
+      binding.mappedAppId
+    );
     cursor = t.fullEnd;
   }
-  out.push(sql.slice(cursor));
+  appendSegment(sql.slice(cursor), cursor, sql.length);
   return {
     normalizedSql: out.join(""),
     hasProfileSyntax,
-    appBindingByMappedApp
+    appBindingByMappedApp,
+    rewriteSegments
   };
 }
 function buildCacheContext(defaultProfile, appBindingByMappedApp) {
   if (appBindingByMappedApp.size === 0) return `default:${defaultProfile.toLowerCase()}`;
-  const pairs = [...appBindingByMappedApp.entries()].sort((a, b) => a[0] - b[0]).map(([mappedAppId, b]) => `M${mappedAppId}=APP${b.appId}@${b.profile}`);
+  const pairs = [...appBindingByMappedApp.entries()].sort((a, b) => a[0] - b[0]).map(([mappedAppId, b]) => b.source === "logical" ? `M${mappedAppId}=logical:${b.logicalName}:APP${b.appId}@${b.profile}` : `M${mappedAppId}=physical:APP${b.appId}@${b.profile}`);
   return `apps:${pairs.join(",")}`;
 }
-function formatResolvedAppProfiles(sql, defaultProfile) {
-  const parsed = normalizeSqlAppProfiles(sql, defaultProfile);
+function formatResolvedAppProfiles(sql, defaultProfile, resolutionContext) {
+  const parsed = normalizeSqlAppProfiles(sql, defaultProfile, resolutionContext);
   if (parsed.appBindingByMappedApp.size === 0) return "(none)";
-  return [...parsed.appBindingByMappedApp.values()].map((b) => `APP${b.appId}->${b.profile}`).join(", ");
+  return [...parsed.appBindingByMappedApp.values()].map((b) => b.source === "logical" ? `LAPP_${b.logicalName}@${b.profile}->APP${b.appId}@${b.profile}` : `APP${b.appId}->${b.profile}`).join(", ");
+}
+
+// src/node/runtime.ts
+function resolveTokenByMappedApp(args) {
+  const tokenByMappedApp = /* @__PURE__ */ new Map();
+  const tokenByPhysicalApp = /* @__PURE__ */ new Map();
+  const missing = [];
+  for (const mappedAppId of args.mappedAppIds) {
+    const binding = args.bindings.get(mappedAppId);
+    if (!binding && args.logicalBindingLabels.has(mappedAppId)) {
+      throw new Error(`InternalError: binding is missing for logical app ${args.logicalBindingLabels.get(mappedAppId)}.`);
+    }
+    const appId = binding?.appId ?? mappedAppId;
+    const profile = binding?.profile ?? args.profileName;
+    const fromMap = args.effectiveTokenMap[`APP${appId}`];
+    if (fromMap) {
+      const token = resolveTokenValue(fromMap);
+      tokenByMappedApp.set(mappedAppId, token);
+      tokenByPhysicalApp.set(appId, token);
+      continue;
+    }
+    if (binding?.source !== "logical" && args.mappedAppIds.length === 1 && args.singleToken) {
+      tokenByMappedApp.set(mappedAppId, args.singleToken);
+      tokenByPhysicalApp.set(appId, args.singleToken);
+      continue;
+    }
+    missing.push(binding?.source === "logical" ? `LAPP_${binding.logicalName} (APP${appId})@${profile}` : `APP${appId}@${profile}`);
+  }
+  return { tokenByMappedApp, tokenByPhysicalApp, missing };
 }
 
 // src/cli/consoleInput.ts
@@ -7095,366 +7662,99 @@ function decideRun(buffer) {
   if (buffer.trim().length === 0) {
     return { kind: "error", message: "ArgumentError: input buffer is empty (nothing to :run)" };
   }
-  const parsed = tryParseStatements(buffer);
-  if (parsed.kind === "fail") return { kind: "error", message: parsed.message };
-  return { kind: "execute-batch", sql: buffer };
-}
-function isBatchConstruction(buffer) {
-  return /^create\s+temp\s+table\b/i.test(stripLeadingCommentsAndWs(buffer));
-}
-function stripLeadingCommentsAndWs(sql) {
-  let s = sql;
-  while (true) {
-    const before = s;
-    s = s.replace(/^\s+/, "");
-    s = s.replace(/^--[^\n]*(\n|$)/, "");
-    s = s.replace(/^\/\*[\s\S]*?\*\//, "");
-    if (s === before) return s;
-  }
-}
-function toParseInput(sql) {
-  try {
-    return normalizeSqlAppProfiles(sql, "console").normalizedSql;
-  } catch {
-    return sql;
-  }
-}
-function tryParseStatements(sql) {
-  try {
-    const stmts = new Parser(new Lexer(toParseInput(sql)).tokenize()).parseStatements();
-    return {
-      kind: "ok",
-      count: stmts.length,
-      hasTempTable: stmts.some(
-        (s) => s.type === "CREATE_TEMP_TABLE" || s.type === "DROP_TEMP_TABLE"
-      )
-    };
-  } catch (e) {
-    if (e instanceof LexError) {
-      return { kind: "fail", continuable: e.unterminated, message: e.message };
-    }
-    if (e instanceof ParseError) {
-      return { kind: "fail", continuable: e.token.kind === "EOF" /* EOF */, message: e.message };
-    }
-    throw e;
-  }
-}
-
-// src/api/requestGate.ts
-var DEFAULT_MAX_CONCURRENT = 10;
-var DEFAULT_MAX_RETRIES = 3;
-var DEFAULT_BASE_DELAY_MS = 500;
-var DEFAULT_MAX_DELAY_MS = 8e3;
-var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
-function isRetryableError(err) {
-  if (!(err instanceof Error)) return false;
-  const status = err.message.match(/^kintone API error (\d{3}):/);
-  if (status) return RETRYABLE_STATUSES.has(Number(status[1]));
-  if (err.name === "AbortError" || err.name === "TimeoutError") return true;
-  if (/fetch failed/i.test(err.message)) return true;
-  return false;
-}
-var RequestGate = class {
-  constructor(options = {}) {
-    this.active = 0;
-    this.waiters = [];
-    this.maxConcurrent = clampInt(options.maxConcurrent ?? DEFAULT_MAX_CONCURRENT, 1, 50);
-    this.maxRetries = clampInt(options.maxRetries ?? DEFAULT_MAX_RETRIES, 0, 10);
-    this.baseDelayMs = clampInt(options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS, 1, 6e4);
-    this.maxDelayMs = Math.max(
-      clampInt(options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS, 1, 6e5),
-      this.baseDelayMs
-    );
-    this.sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    this.random = options.random ?? Math.random;
-  }
-  /** 現在の同時実行数（テスト・診断用） */
-  get activeCount() {
-    return this.active;
-  }
-  get limit() {
-    return this.maxConcurrent;
-  }
-  /** 解決済みの GET リトライ回数（テスト・診断用） */
-  get retries() {
-    return this.maxRetries;
-  }
-  /** 解決済みのバックオフ初期値ミリ秒（テスト・診断用） */
-  get retryBaseDelayMs() {
-    return this.baseDelayMs;
-  }
-  /** 解決済みのバックオフ上限ミリ秒（テスト・診断用） */
-  get retryMaxDelayMs() {
-    return this.maxDelayMs;
-  }
-  /** GET 系: セマフォ + リトライ付きで実行する */
-  async runReadOnly(fn) {
-    let attempt = 0;
-    while (true) {
-      try {
-        return await this.withSlot(fn);
-      } catch (err) {
-        if (attempt >= this.maxRetries || !isRetryableError(err)) throw err;
-        await this.sleep(this.backoffDelay(attempt));
-        attempt += 1;
-      }
-    }
-  }
-  /** 書き込み系: セマフォのみ（リトライしない — 二重実行防止） */
-  async runMutation(fn) {
-    return this.withSlot(fn);
-  }
-  async withSlot(fn) {
-    await this.acquire();
-    try {
-      return await fn();
-    } finally {
-      this.release();
-    }
-  }
-  async acquire() {
-    if (this.active < this.maxConcurrent) {
-      this.active += 1;
-      return;
-    }
-    await new Promise((resolve2) => this.waiters.push(resolve2));
-    this.active += 1;
-  }
-  release() {
-    this.active -= 1;
-    const next = this.waiters.shift();
-    if (next) next();
-  }
-  /** 指数バックオフ + ジッタ（attempt: 0 始まり） */
-  backoffDelay(attempt) {
-    const base = Math.min(this.baseDelayMs * 2 ** attempt, this.maxDelayMs);
-    const jitter = 1 + (this.random() - 0.5) * 0.5;
-    return Math.round(base * jitter);
-  }
-};
-function withRequestGate(client, gate) {
-  return {
-    getRecords: (params) => gate.runReadOnly(() => client.getRecords(params)),
-    getApps: () => gate.runReadOnly(() => client.getApps()),
-    getFields: (appId) => gate.runReadOnly(() => client.getFields(appId)),
-    postRecords: (params) => gate.runMutation(() => client.postRecords(params)),
-    putRecords: (params) => gate.runMutation(() => client.putRecords(params)),
-    deleteRecords: (params) => gate.runMutation(() => client.deleteRecords(params))
-  };
+  const parsed = tryParseStatements(buffer);
+  if (parsed.kind === "fail") return { kind: "error", message: parsed.message };
+  return { kind: "execute-batch", sql: buffer };
 }
-var globalGate = null;
-function getGlobalRequestGate(options) {
-  if (globalGate === null) {
-    globalGate = new RequestGate(
-      typeof options === "number" ? { maxConcurrent: options } : options ?? {}
-    );
+function isBatchConstruction(buffer) {
+  return /^create\s+temp\s+table\b/i.test(stripLeadingCommentsAndWs(buffer));
+}
+function stripLeadingCommentsAndWs(sql) {
+  let s = sql;
+  while (true) {
+    const before = s;
+    s = s.replace(/^\s+/, "");
+    s = s.replace(/^--[^\n]*(\n|$)/, "");
+    s = s.replace(/^\/\*[\s\S]*?\*\//, "");
+    if (s === before) return s;
   }
-  return globalGate;
 }
-function clampInt(v, min, max) {
-  if (!Number.isFinite(v)) return min;
-  return Math.max(min, Math.min(max, Math.trunc(v)));
+function toParseInput(sql) {
+  try {
+    return normalizeSqlAppProfiles(sql, "console").normalizedSql;
+  } catch {
+    return sql;
+  }
 }
-
-// src/cli/nodeKintoneClient.ts
-function createNodeKintoneClient(baseUrl, tokenResolver) {
-  const normalizedBaseUrl = baseUrl.replace(/\/+$/, "");
-  const apiBasePath = tokenResolver.guestSpaceId && tokenResolver.guestSpaceId > 0 ? `/k/guest/${tokenResolver.guestSpaceId}/v1` : "/k/v1";
-  async function requestJson(path, init, appIdForToken) {
-    const headers = new Headers(init.headers ?? {});
-    if (tokenResolver.auth.type === "token") {
-      headers.set("X-Cybozu-API-Token", tokenResolver.auth.resolveToken(appIdForToken));
-    } else {
-      const credentials = `${tokenResolver.auth.username}:${tokenResolver.auth.password}`;
-      const encoded = Buffer.from(credentials, "utf-8").toString("base64");
-      headers.set("X-Cybozu-Authorization", encoded);
-    }
-    headers.set("Accept", "application/json");
-    const method = String(init.method ?? "GET").toUpperCase();
-    if (method !== "GET" && method !== "HEAD") {
-      headers.set("Content-Type", "application/json");
-    }
-    const timeoutMs = tokenResolver.timeoutMs ?? 3e4;
-    const url = `${normalizedBaseUrl}${path}`;
-    if (tokenResolver.debug) {
-      tokenResolver.log?.(`[debug] request ${String(init.method ?? "GET")} ${url}`);
-      if (tokenResolver.debugHeaders) {
-        const authHeader = headers.get("X-Cybozu-API-Token") ? "X-Cybozu-API-Token=***" : headers.get("X-Cybozu-Authorization") ? "X-Cybozu-Authorization=***" : "Auth=(none)";
-        tokenResolver.log?.(
-          `[debug] request-headers ${authHeader} Content-Type=${headers.get("Content-Type") ?? "(none)"} Accept=${headers.get("Accept") ?? "(none)"}`
-        );
-      }
-    }
-    const res = await fetch(url, {
-      ...init,
-      headers,
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!res.ok) {
-      const bodyText = await res.text();
-      if (tokenResolver.debug) {
-        tokenResolver.log?.(`[debug] response status=${res.status} body=${bodyText}`);
-      }
-      throw new Error(`kintone API error ${res.status}: ${bodyText}`);
+function tryParseStatements(sql) {
+  try {
+    const stmts = new Parser(new Lexer(toParseInput(sql)).tokenize()).parseStatements();
+    return {
+      kind: "ok",
+      count: stmts.length,
+      hasTempTable: stmts.some(
+        (s) => s.type === "CREATE_TEMP_TABLE" || s.type === "DROP_TEMP_TABLE"
+      )
+    };
+  } catch (e) {
+    if (e instanceof LexError) {
+      return { kind: "fail", continuable: e.unterminated, message: e.message };
     }
-    if (tokenResolver.debug) {
-      tokenResolver.log?.(`[debug] response status=${res.status}`);
+    if (e instanceof ParseError) {
+      return { kind: "fail", continuable: e.token.kind === "EOF" /* EOF */, message: e.message };
     }
-    return await res.json();
+    throw e;
   }
-  function shouldRetryWithRecordNumberOrder(path, bodyText) {
-    if (!path.includes("/v1/records.json?")) return false;
-    if (!bodyText.includes('"code":"CB_IL02"')) return false;
-    const queryPart = path.split("query=")[1] ?? "";
-    const query = decodeURIComponent(queryPart.split("&")[0] ?? "");
-    if (!query.includes("limit")) return false;
-    if (!query.includes("offset")) return false;
-    if (query.toLowerCase().includes("order by")) return false;
-    return true;
+}
+
+// src/node/sqlDiagnostics.ts
+function restoreSqlDiagnosticValue(value, bindings) {
+  if (typeof value === "string") {
+    let restored = value;
+    for (const binding of bindings.values()) {
+      const internal = `APP${binding.mappedAppId}`;
+      const display = binding.source === "logical" ? `LAPP_${binding.logicalName}@${binding.profile}` : `APP${binding.appId}@${binding.profile}`;
+      restored = restored.split(`${internal} (${binding.mappedAppId})`).join(display).split(internal).join(display);
+    }
+    return restored;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => restoreSqlDiagnosticValue(item, bindings));
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, restoreSqlDiagnosticValue(item, bindings)])
+    );
   }
-  function rewriteQueryWithRecordNumberOrder(path) {
-    const [base, rest] = path.split("query=");
-    if (!rest) return path;
-    const [encodedQuery, ...tail] = rest.split("&");
-    const query = decodeURIComponent(encodedQuery ?? "");
-    const rewritten = `order by \u30EC\u30B3\u30FC\u30C9\u756A\u53F7 asc ${query}`.trim();
-    const nextQuery = encodeURIComponent(rewritten);
-    return `${base}query=${nextQuery}${tail.length > 0 ? `&${tail.join("&")}` : ""}`;
+  return value;
+}
+function restoreSqlContextError(err, sourceSql, context) {
+  if (!(err instanceof Error)) return err;
+  let message = err.message;
+  for (const binding of context.bindings.values()) {
+    if (binding.source === "logical") {
+      message = message.split(`APP${binding.mappedAppId}`).join(`LAPP_${binding.logicalName}@${binding.profile}`);
+    }
   }
-  return {
-    async getRecords(params) {
-      const queryPart = `query=${encodeURIComponent(params.query)}`;
-      const appPart = `app=${encodeURIComponent(String(params.app))}`;
-      const fieldParts = params.fields.map((f) => `fields[]=${encodeURIComponent(f)}`);
-      const qs = [appPart, queryPart, ...fieldParts].join("&");
-      if (tokenResolver.debug) {
-        tokenResolver.log?.(
-          `[debug] getRecords app=${params.app} query="${params.query}" fields=${params.fields.length > 0 ? params.fields.join(",") : "(all)"} auth=${tokenResolver.auth.type}`
-        );
-      }
-      const path = `${apiBasePath}/records.json?${qs}`;
-      try {
-        return await requestJson(
-          path,
-          { method: "GET" },
-          params.app
-        );
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        if (!shouldRetryWithRecordNumberOrder(path, msg)) throw err;
-        const retryPath = rewriteQueryWithRecordNumberOrder(path);
-        if (tokenResolver.debug) {
-          tokenResolver.log?.("[debug] retry with fallback query order by \u30EC\u30B3\u30FC\u30C9\u756A\u53F7 asc");
-        }
-        return await requestJson(
-          retryPath,
-          { method: "GET" },
-          params.app
-        );
-      }
-    },
-    async postRecords(_params) {
-      const res = await requestJson(
-        `${apiBasePath}/records.json`,
-        {
-          method: "POST",
-          body: JSON.stringify({
-            app: _params.app,
-            records: _params.records
-          })
-        },
-        _params.app
-      );
-      return { ids: res.ids };
-    },
-    async putRecords(_params) {
-      await requestJson(
-        `${apiBasePath}/records.json`,
-        {
-          method: "PUT",
-          body: JSON.stringify({
-            app: _params.app,
-            records: _params.records
-          })
-        },
-        _params.app
-      );
-    },
-    async deleteRecords(_params) {
-      await requestJson(
-        `${apiBasePath}/records.json`,
-        {
-          method: "DELETE",
-          body: JSON.stringify({
-            app: _params.app,
-            ids: _params.ids
-          })
-        },
-        _params.app
+  const token = err.token;
+  if (typeof token?.pos === "number") {
+    const segment = context.rewriteSegments.find(
+      (candidate) => token.pos >= candidate.normalizedStart && token.pos < candidate.normalizedEnd
+    );
+    if (segment) {
+      const sourcePos = segment.sourceStart + Math.min(
+        token.pos - segment.normalizedStart,
+        Math.max(0, segment.sourceEnd - segment.sourceStart - 1)
       );
-    },
-    async getApps() {
-      const PAGE = 100;
-      const all = [];
-      let offset = 0;
-      while (true) {
-        const qs = new URLSearchParams();
-        qs.set("limit", String(PAGE));
-        qs.set("offset", String(offset));
-        const res = await requestJson(
-          `${apiBasePath}/apps.json?${qs.toString()}`,
-          { method: "GET" },
-          0
-        );
-        for (const app of res.apps) {
-          all.push({
-            appId: Number(app.appId),
-            name: app.name,
-            description: app.description
-          });
-        }
-        if (res.apps.length < PAGE) break;
-        offset += PAGE;
+      message = message.replace(/（位置 \d+、トークン:/, `\uFF08\u4F4D\u7F6E ${sourcePos}\u3001\u30C8\u30FC\u30AF\u30F3:`);
+      const originalRef = sourceSql.slice(segment.sourceStart, segment.sourceEnd);
+      if (segment.bindingMappedAppId !== void 0 && originalRef) {
+        message = message.replace(/(トークン: 「)[^」]*(」)/, `$1${originalRef}$2`);
       }
-      return all;
-    },
-    async getFields(appId) {
-      const qs = new URLSearchParams();
-      qs.set("app", String(appId));
-      const res = await requestJson(
-        `${apiBasePath}/app/form/fields.json?${qs.toString()}`,
-        { method: "GET" },
-        appId
-      );
-      return Object.values(res.properties).map((f) => ({
-        code: f.code,
-        label: f.label,
-        fieldType: f.type,
-        optionOrder: toOptionOrderMap(f.options),
-        sortKind: detectSortKind(f.type, f.format)
-      }));
     }
-  };
-}
-function toOptionOrderMap(options) {
-  if (!options || typeof options !== "object") return void 0;
-  const order = {};
-  let hasAny = false;
-  for (const [label, meta] of Object.entries(options)) {
-    const n = Number(meta?.index);
-    if (!Number.isFinite(n)) continue;
-    order[label] = n;
-    hasAny = true;
-  }
-  return hasAny ? order : void 0;
-}
-function detectSortKind(fieldType, calcFormat) {
-  if (fieldType === "NUMBER" || fieldType === "RECORD_NUMBER") return "number";
-  if (fieldType === "CALC") {
-    if (calcFormat === "NUMBER" || calcFormat === "NUMBER_DIGIT") return "number";
-    return "string";
   }
-  return void 0;
+  err.message = message;
+  return err;
 }
 
 // src/cli/index.ts
@@ -7835,7 +8135,7 @@ function loadConfig(configPath) {
   const raw = (0, import_fs2.readFileSync)(configPath, "utf-8");
   return JSON.parse(raw);
 }
-function resolveTokenValue(raw) {
+function resolveTokenValue2(raw) {
   if (raw.startsWith("env:")) {
     const envKey = raw.slice(4);
     const envVal = process.env[envKey];
@@ -7866,12 +8166,12 @@ function envFormat(name) {
   const v = envString2(name);
   return normalizeOutputFormat(v);
 }
-function envOnLimit(name) {
+function envOnLimit2(name) {
   const v = envString2(name);
   if (v === "error" || v === "truncate") return v;
   return null;
 }
-function envAuth(name) {
+function envAuth2(name) {
   const v = envString2(name);
   if (v === "token" || v === "userpass" || v === "auto") return v;
   return null;
@@ -8296,10 +8596,10 @@ async function runWithArgvCapture(argv) {
     process.stdout.write = original;
   }
 }
-async function confirmDmlInConsole(sql, opts, queue, defaultProfile = "dev") {
+async function confirmDmlInConsole(sql, opts, queue, defaultProfile = "dev", resolutionContext) {
   if (!opts.allowDml || opts.yes || opts.dryRun) return true;
   try {
-    const normalized = normalizeSqlAppProfiles(sql, defaultProfile);
+    const normalized = normalizeSqlAppProfiles(sql, defaultProfile, resolutionContext);
     const statements = parseSqlStatements(normalized.normalizedSql);
     if (statements.length > 1) {
       const analysis = analyzeBatch(statements);
@@ -8387,6 +8687,14 @@ async function runConsole(base) {
   let buffer = "";
   let emptyPromptSigintArmed = false;
   const queue = createConsoleEventQueue(rl);
+  const consoleConfigPath = base.configPath ?? envString2("KSQL_CONFIG") ?? "./ksql.config.json";
+  let consoleConfig = {};
+  try {
+    consoleConfig = validateKsqlConfig(loadConfig(consoleConfigPath));
+  } catch {
+  }
+  const consoleResolutionContext = () => createAppResolutionContext(consoleConfig, profile ?? "dev");
+  const formatConsoleProfiles = (sql) => formatResolvedAppProfiles(sql, profile ?? "dev", consoleResolutionContext());
   process.stdout.write("kSQL Console (type :help)\n");
   process.stdout.write(
     [
@@ -8444,7 +8752,7 @@ async function runConsole(base) {
               allowDml: base.allowDml,
               yes: base.yes,
               dryRun
-            }, queue, profile ?? "dev");
+            }, queue, profile ?? "dev", consoleResolutionContext());
             if (!ok) {
               process.stderr.write("DML was cancelled by user.\n");
               continue;
@@ -8452,7 +8760,7 @@ async function runConsole(base) {
           }
           buffer = "";
           lastSql = sql2;
-          lastResolvedProfiles = formatResolvedAppProfiles(sql2, profile ?? "dev");
+          lastResolvedProfiles = formatConsoleProfiles(sql2);
           history.push(sql2);
           appendHistory(sql2);
           const { code: code2, stdout: stdout2 } = await runWithArgvCapture(buildReplExecArgvWithProfile(base, sql2, dryRun, format, profile));
@@ -8559,13 +8867,13 @@ async function runConsole(base) {
             allowDml: base.allowDml,
             yes: base.yes,
             dryRun
-          }, queue, profile ?? "dev");
+          }, queue, profile ?? "dev", consoleResolutionContext());
           if (!ok) {
             process.stderr.write("DML was cancelled by user.\n");
             continue;
           }
           lastSql = sql2;
-          lastResolvedProfiles = formatResolvedAppProfiles(sql2, profile ?? "dev");
+          lastResolvedProfiles = formatConsoleProfiles(sql2);
           process.stdout.write(`rerun: ${sql2.replace(/\s+/g, " ").trim()}
 `);
           const { code: code2, stdout: stdout2 } = await runWithArgvCapture(buildReplExecArgvWithProfile(base, sql2, dryRun, format, profile));
@@ -8637,14 +8945,14 @@ async function runConsole(base) {
           allowDml: base.allowDml,
           yes: base.yes,
           dryRun
-        }, queue, profile ?? "dev");
+        }, queue, profile ?? "dev", consoleResolutionContext());
         if (!ok) {
           process.stderr.write("DML was cancelled by user.\n");
           continue;
         }
       }
       lastSql = sql;
-      lastResolvedProfiles = formatResolvedAppProfiles(sql, profile ?? "dev");
+      lastResolvedProfiles = formatConsoleProfiles(sql);
       history.push(sql);
       appendHistory(sql);
       const { code, stdout } = await runWithArgvCapture(buildReplExecArgvWithProfile(base, sql, dryRun, format, profile));
@@ -8698,6 +9006,8 @@ async function run() {
   const profileName = args.profile ?? envString2("KSQL_PROFILE") ?? config.defaultProfile ?? "dev";
   const profile = config.profiles?.[profileName] ?? {};
   let sql = null;
+  let sourceSql = null;
+  let sqlDiagnosticContext = null;
   let hasProfileSyntax = false;
   let appBindingByMappedApp = /* @__PURE__ */ new Map();
   let parsedStmt = null;
@@ -8715,9 +9025,16 @@ async function run() {
       process.stderr.write("ArgumentError: SQL is empty.\n");
       return 2;
     }
+    sourceSql = sql;
     try {
-      const normalized = normalizeSqlAppProfiles(sql, profileName);
+      const validatedConfig = validateKsqlConfig(config);
+      const resolutionContext = createAppResolutionContext(validatedConfig, profileName);
+      const normalized = normalizeSqlAppProfiles(sql, profileName, resolutionContext);
+      for (const binding of normalized.appBindingByMappedApp.values()) {
+        if (binding.source === "physical") resolutionContext.assertPhysicalAppAllowed(binding.profile);
+      }
       sql = normalized.normalizedSql;
+      sqlDiagnosticContext = normalized;
       hasProfileSyntax = normalized.hasProfileSyntax;
       appBindingByMappedApp = normalized.appBindingByMappedApp;
     } catch (err) {
@@ -8746,14 +9063,18 @@ async function run() {
         }
       }
     } catch (err) {
-      process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+      const restored = sourceSql && sqlDiagnosticContext ? restoreSqlContextError(err, sourceSql, {
+        bindings: sqlDiagnosticContext.appBindingByMappedApp,
+        rewriteSegments: sqlDiagnosticContext.rewriteSegments
+      }) : err;
+      process.stderr.write(`${restored instanceof Error ? restored.message : String(restored)}
 `);
       return 1;
     }
   }
   const maxRecords = args.maxRecords ?? envInt2("KSQL_MAX_RECORDS") ?? profile.query?.maxRecords ?? 500;
   const fetchParallel = args.fetchParallel ?? envInt2("KSQL_FETCH_PARALLEL") ?? profile.query?.fetchParallel ?? 3;
-  const onLimit = args.onLimit ?? envOnLimit("KSQL_ON_LIMIT") ?? profile.query?.onLimit ?? "error";
+  const onLimit = args.onLimit ?? envOnLimit2("KSQL_ON_LIMIT") ?? profile.query?.onLimit ?? "error";
   const timeout = args.timeout ?? envInt2("KSQL_TIMEOUT") ?? profile.query?.timeout ?? 3e4;
   const tempTableMaxRows = args.tempTableMaxRows ?? envInt2("KSQL_TEMP_TABLE_MAX_ROWS") ?? profile.query?.tempTableMaxRows ?? void 0;
   if (!Number.isInteger(fetchParallel) || fetchParallel < 1 || fetchParallel > 10) {
@@ -8804,9 +9125,21 @@ async function run() {
       return 2;
     }
     if (args.dryRun) {
-      const plans = buildBatchExplainPlans(sql);
+      let plans;
+      try {
+        plans = buildBatchExplainPlans(sql);
+      } catch (err) {
+        const restored = sourceSql && sqlDiagnosticContext ? restoreSqlContextError(err, sourceSql, {
+          bindings: sqlDiagnosticContext.appBindingByMappedApp,
+          rewriteSegments: sqlDiagnosticContext.rewriteSegments
+        }) : err;
+        process.stderr.write(`${restored instanceof Error ? restored.message : String(restored)}
+`);
+        return toExitCodeFromError(restored);
+      }
       const out = [];
-      plans.statements.forEach((p) => {
+      const restoredStatements = sqlDiagnosticContext ? restoreSqlDiagnosticValue(plans.statements, sqlDiagnosticContext.appBindingByMappedApp) : plans.statements;
+      restoredStatements.forEach((p) => {
         if (p.index > 0) out.push("");
         out.push(`[${p.index + 1}] ${p.type}`);
         out.push(...p.plan);
@@ -8872,7 +9205,7 @@ async function run() {
 `);
         return 3;
       }
-      const authReq = args.auth ?? envAuth("KSQL_AUTH") ?? p.auth ?? "auto";
+      const authReq = args.auth ?? envAuth2("KSQL_AUTH") ?? p.auth ?? "auto";
       const username = args.username ?? envString2("KSQL_USERNAME") ?? p.username ?? null;
       const passwordFromEnvRef = p.passwordEnv ? envString2(p.passwordEnv) : null;
       const password = args.password ?? envString2("KSQL_PASSWORD") ?? passwordFromEnvRef ?? p.password ?? null;
@@ -8900,25 +9233,22 @@ async function run() {
       }
       const mapFromConfigRaw = p.tokenMap ?? {};
       const mapFromConfig = Object.fromEntries(
-        Object.entries(mapFromConfigRaw).map(([k, v]) => [normalizeAppKey(k), resolveTokenValue(String(v))])
+        Object.entries(mapFromConfigRaw).map(([k, v]) => [normalizeAppKey(k), resolveTokenValue2(String(v))])
       );
       const effectiveTokenMap = { ...mapFromConfig, ...mapFromEnv, ...mapFromFile, ...mapFromArg };
       const assignedAppIds = appIds.filter((appId) => appProfileByApp.get(appId) === pName);
-      const tokenByApp = /* @__PURE__ */ new Map();
-      for (const mappedAppId of assignedAppIds) {
-        const realAppId = appBindingByMappedApp.get(mappedAppId)?.appId ?? mappedAppId;
-        const key = `APP${realAppId}`;
-        const fromMap = effectiveTokenMap[key];
-        if (fromMap) {
-          tokenByApp.set(mappedAppId, resolveTokenValue(fromMap));
-          continue;
-        }
-        if (assignedAppIds.length === 1 && singleToken) {
-          tokenByApp.set(mappedAppId, singleToken);
-          continue;
-        }
-        missingAppProfiles.push(`APP${realAppId}@${pName}`);
-      }
+      const resolvedTokens = resolveTokenByMappedApp({
+        mappedAppIds: assignedAppIds,
+        profileName: pName,
+        bindings: appBindingByMappedApp,
+        logicalBindingLabels: new Map(
+          [...appBindingByMappedApp.values()].filter((b) => b.source === "logical").map((b) => [b.mappedAppId, `LAPP_${b.logicalName}@${b.profile}`])
+        ),
+        effectiveTokenMap,
+        singleToken
+      });
+      const tokenByApp = resolvedTokens.tokenByPhysicalApp;
+      missingAppProfiles.push(...resolvedTokens.missing);
       profileClientMap.set(pName, createNodeKintoneClient(baseUrl, {
         guestSpaceId,
         timeoutMs: timeout,
@@ -8932,7 +9262,7 @@ async function run() {
         auth: {
           type: "token",
           resolveToken(appId) {
-            const token = tokenByApp.get(appId) ?? tokenByApp.get(assignedAppIds[0]);
+            const token = tokenByApp.get(appId);
             if (!token) throw new Error(`AuthError: token is not resolved for APP${appId}@${pName}.`);
             return token;
           }
@@ -8963,7 +9293,7 @@ async function run() {
 `);
         return 3;
       }
-      const authReq = args.auth ?? envAuth("KSQL_AUTH") ?? diagProfile.auth ?? "auto";
+      const authReq = args.auth ?? envAuth2("KSQL_AUTH") ?? diagProfile.auth ?? "auto";
       const username = args.username ?? envString2("KSQL_USERNAME") ?? diagProfile.username ?? null;
       const passwordFromEnvRef = diagProfile.passwordEnv ? envString2(diagProfile.passwordEnv) : null;
       const password = args.password ?? envString2("KSQL_PASSWORD") ?? passwordFromEnvRef ?? diagProfile.password ?? null;
@@ -8990,7 +9320,7 @@ async function run() {
         } else {
           const mapFromConfigRaw = diagProfile.tokenMap ?? {};
           const mapFromConfig = Object.fromEntries(
-            Object.entries(mapFromConfigRaw).map(([k, v]) => [normalizeAppKey(k), resolveTokenValue(String(v))])
+            Object.entries(mapFromConfigRaw).map(([k, v]) => [normalizeAppKey(k), resolveTokenValue2(String(v))])
           );
           const effectiveTokenMap = { ...mapFromConfig, ...mapFromEnv, ...mapFromFile, ...mapFromArg };
           const diagToken = effectiveTokenMap[`APP${defaultApp}`] ?? (singleToken && appIds.length <= 1 ? singleToken : null);
@@ -9008,7 +9338,7 @@ async function run() {
             debug,
             debugHeaders,
             debugUrlOnly: args.debugUrl,
-            auth: { type: "token", token: resolveTokenValue(diagToken) }
+            auth: { type: "token", token: resolveTokenValue2(diagToken) }
           });
         }
         return 0;
@@ -9158,14 +9488,18 @@ query=${label}`);
     if (shouldExitOnEmpty(args.dryRun, exitOnEmpty, result.rowCount)) return 1;
     return 0;
   } catch (err) {
-    if (err instanceof OperationCancelledError) {
-      process.stderr.write(`${err.message}
+    const restored = sourceSql && sqlDiagnosticContext ? restoreSqlContextError(err, sourceSql, {
+      bindings: sqlDiagnosticContext.appBindingByMappedApp,
+      rewriteSegments: sqlDiagnosticContext.rewriteSegments
+    }) : err;
+    if (restored instanceof OperationCancelledError) {
+      process.stderr.write(`${restored.message}
 `);
       return 2;
     }
-    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+    process.stderr.write(`${restored instanceof Error ? restored.message : String(restored)}
 `);
-    return toExitCodeFromError(err);
+    return toExitCodeFromError(restored);
   }
 }
 function isDirectCliRun() {
@@ -9192,6 +9526,7 @@ if (isDirectCliRun()) {
   parseConsoleMetaCommand,
   parseTokenFile,
   parseTokenMap,
+  runWithArgv,
   shouldExitOnEmpty,
   writeBatchOutput
 });