@rex0220/print-craft-authoring-tools 1.1.0 → 1.3.0

package/dist/cli.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-/*! @rex0220/print-craft-authoring-tools 1.1.0 (c) rex0220. MIT License. 計算式エンジンと印刷屋のコードは利用者の印刷屋プラグインの zip から読む（このファイルには含まれない）。commit eb915ae. */
+/*! @rex0220/print-craft-authoring-tools 1.3.0 (c) rex0220. MIT License. 計算式エンジンと印刷屋のコードは利用者の印刷屋プラグインの zip から読む（このファイルには含まれない）。commit 5abbe71. */
 
 // src/cli.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import path10 from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
+import path13 from "node:path";
 
 // src/env.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -51,6 +51,11 @@ var NAMES = {
   password: ["KINTONE_PASSWORD", "KSQL_PASSWORD"],
   pluginZip: ["PCRAFT_PLUGIN_ZIP"]
 };
+function unquote(raw) {
+  const value = raw.trim();
+  if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) return value.slice(1, -1);
+  return value;
+}
 function parseDotEnv(text) {
   const out = {};
   for (const raw of text.split(/\r?\n/)) {
@@ -58,33 +63,36 @@ function parseDotEnv(text) {
     if (!line || line.startsWith("#")) continue;
     const m = line.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
     if (!m) continue;
-    let value = m[2].trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-    out[m[1]] = value;
+    out[m[1]] = unquote(m[2]);
   }
   return out;
 }
 var AuthError = class extends Error {
 };
-function picker(opt) {
-  const osEnv = opt.env ?? process.env;
+function pickerWithSource(opt, unquoteProcess = false) {
+  const osEnv = opt.env;
   const file = envFileOf(opt);
   const fromFile = existsSync(file) ? parseDotEnv(readFileSync(file, "utf8")) : {};
   return (names) => {
-    for (const src of [osEnv, fromFile]) {
+    for (const [src, source] of [[osEnv, "process"], [fromFile, "file"]]) {
       for (const n of names) {
-        const v = src[n];
-        if (v && v.trim()) return v.trim();
+        const raw = src[n] ?? "";
+        const v = source === "process" && unquoteProcess ? unquote(raw) : raw.trim();
+        if (v) return { value: v, source, ...source === "file" ? { file } : {} };
       }
     }
     return void 0;
   };
 }
+function picker(opt, unquoteProcess = false) {
+  const pick = pickerWithSource(opt, unquoteProcess);
+  return (names) => pick(names)?.value;
+}
 function envFileOf(opt) {
-  return opt.envFile ?? path.join(opt.cwd ?? process.cwd(), ".env");
+  return opt.envFile ?? path.join(opt.cwd, ".env");
 }
-function baseUrlFromEnv(opt = {}) {
-  const raw = picker(opt)(NAMES.baseUrl);
+function baseUrlFromEnv(opt) {
+  const raw = picker(opt, true)(NAMES.baseUrl);
   if (!raw) return void 0;
   try {
     return normalizeKintoneBaseUrl(raw);
@@ -92,7 +100,7 @@ function baseUrlFromEnv(opt = {}) {
     throw new AuthError(`KINTONE_BASE_URL が不正: ${e instanceof KintoneUrlError ? e.message : String(e)}（https://<サブドメイン>.cybozu.com の形で書く）`);
   }
 }
-function loadAuth(opt = {}) {
+function loadAuth(opt) {
   const pick = picker(opt);
   const file = envFileOf(opt);
   const baseUrl = baseUrlFromEnv(opt);
@@ -103,7 +111,7 @@ function loadAuth(opt = {}) {
   if (!token && !(username && password)) throw new AuthError("KINTONE_API_TOKEN か、KINTONE_USERNAME と KINTONE_PASSWORD の両方が要る（OS の環境変数か .env）");
   return { baseUrl, token, username: token ? void 0 : username, password: token ? void 0 : password };
 }
-function loadAuthForEnv(env, cwd = process.cwd()) {
+function loadAuthForEnv(env, cwd) {
   const file = path.join(cwd, env.envFile);
   if (!existsSync(file)) throw new AuthError(`環境「${env.name}」の認証のファイルが無い: ${env.envFile}（${env.envFile === ".env" ? ".env.example を写して作る" : "env/ に作る。.env と同じ書き方"}）`);
   const vars = parseDotEnv(readFileSync(file, "utf8"));
@@ -127,10 +135,12 @@ function loadAuthForEnv(env, cwd = process.cwd()) {
   if (!token && !(username && password)) throw new AuthError(`${env.envFile} に KINTONE_API_TOKEN か、KINTONE_USERNAME と KINTONE_PASSWORD の両方が要る（環境「${env.name}」。OS の環境変数は読まない）`);
   return { baseUrl: env.baseUrl, token, username: token ? void 0 : username, password: token ? void 0 : password };
 }
-function pluginZipPath(opt = {}) {
-  const v = picker(opt)(NAMES.pluginZip);
-  if (!v) return void 0;
-  return path.resolve(path.dirname(envFileOf(opt)), v);
+function pluginZipPath(opt) {
+  const picked = pickerWithSource(opt, true)(NAMES.pluginZip);
+  if (!picked) return void 0;
+  if (picked.source === "file") return path.resolve(path.dirname(picked.file ?? envFileOf(opt)), picked.value);
+  if (!path.isAbsolute(picked.value)) throw new AuthError(`PCRAFT_PLUGIN_ZIP（OS の環境変数）は絶対パスで書く: ${picked.value}（.env に書くなら .env のフォルダーからの相対パスでもよい）`);
+  return path.normalize(picked.value);
 }
 function describeAuth(auth) {
   return auth.token ? "API トークン" : "ログインユーザー";
@@ -157,7 +167,7 @@ function norm(p) {
   const r = path2.resolve(p);
   return process.platform === "win32" ? r.toLowerCase() : r;
 }
-function realResolve(target, cwd = process.cwd()) {
+function realResolve(target, cwd) {
   const abs = path2.resolve(cwd, target);
   let dir = abs;
   const rest = [];
@@ -190,7 +200,7 @@ function isInside(child, parent) {
   const p = norm(parent);
   return c === p || c.startsWith(p.endsWith(path2.sep) ? p : p + path2.sep);
 }
-function resolveRead(target, cwd = process.cwd()) {
+function resolveRead(target, cwd) {
   if (!target || typeof target !== "string") throw new PathError("ファイルのパスが要る");
   const real = realResolve(target, cwd);
   const cwdReal = realResolve(".", cwd);
@@ -199,7 +209,7 @@ function resolveRead(target, cwd = process.cwd()) {
   if (/^\.env(\.|$)/i.test(path2.basename(real)) || /^(node_modules|\.git)(\/|$)/i.test(rel)) throw new PathError(`このファイルは tools では読まない: ${target}`);
   return real;
 }
-function resolveWrite(target, roots, cwd = process.cwd()) {
+function resolveWrite(target, roots, cwd) {
   if (!target || typeof target !== "string") throw new PathError("書き込み先のパスが要る");
   const real = realResolve(target, cwd);
   const cwdReal = realResolve(".", cwd);
@@ -213,7 +223,7 @@ function resolveWrite(target, roots, cwd = process.cwd()) {
   if (WINDOWS_RESERVED.test(base) || /[. ]$/.test(base)) throw new PathError(`使えないファイル名: ${base}`);
   return real;
 }
-function resolveWriteDir(target, roots, cwd = process.cwd()) {
+function resolveWriteDir(target, roots, cwd) {
   if (!target || typeof target !== "string") throw new PathError("フォルダーのパスが要る");
   const real = realResolve(target, cwd);
   const cwdReal = realResolve(".", cwd);
@@ -239,6 +249,7 @@ var ENV_FILE = /^(\.env|env\/[A-Za-z0-9._-]{1,64}\.env)$/;
 var MAX_BYTES = 256 * 1024;
 var WorkspaceError = class extends Error {
 };
+var ENV_ROLES = ["development", "production"];
 var isEnvName = (s) => ENV_NAME.test(s);
 function parseWorkspace(text, where = WORKSPACE_FILE) {
   let raw;
@@ -258,7 +269,9 @@ function parseWorkspace(text, where = WORKSPACE_FILE) {
   for (const [name, v] of Object.entries(envsRaw)) {
     if (!isEnvName(name)) throw new WorkspaceError(`${where}: 環境の名前は英数字と _ - の 32 文字まで: ${name}`);
     const e = obj(v, `environments.${name}`);
-    for (const k of Object.keys(e)) if (!["baseUrl", "envFile"].includes(k)) throw new WorkspaceError(`${where}: environments.${name} に使えるキーは baseUrl / envFile: ${k}`);
+    for (const k of Object.keys(e)) if (!["baseUrl", "envFile", "role"].includes(k)) throw new WorkspaceError(`${where}: environments.${name} に使えるキーは baseUrl / envFile / role: ${k}`);
+    if (e.role !== void 0 && !ENV_ROLES.includes(e.role)) throw new WorkspaceError(`${where}: environments.${name}.role は development（開発）か production（本番）: ${String(e.role)}`);
+    const role = e.role === void 0 ? "unclassified" : e.role;
     let baseUrl;
     try {
       baseUrl = normalizeKintoneBaseUrl(String(e.baseUrl ?? ""));
@@ -267,7 +280,7 @@ function parseWorkspace(text, where = WORKSPACE_FILE) {
     }
     const envFile = e.envFile === void 0 ? ".env" : String(e.envFile).replace(/\\/g, "/");
     if (!ENV_FILE.test(envFile)) throw new WorkspaceError(`${where}: environments.${name}.envFile は .env か env/<名前>.env: ${envFile}`);
-    environments[name] = { name, baseUrl, host: new URL(baseUrl).hostname, envFile };
+    environments[name] = { name, role, baseUrl, host: new URL(baseUrl).hostname, envFile };
   }
   if (Object.keys(environments).length === 0) throw new WorkspaceError(`${where}: environments に環境が 1 つも無い`);
   const defaultEnv = root.default === void 0 ? Object.keys(environments)[0] : String(root.default);
@@ -294,7 +307,7 @@ function parseWorkspace(text, where = WORKSPACE_FILE) {
   }
   return { defaultEnv, environments, apps };
 }
-function loadWorkspace(cwd = process.cwd()) {
+function loadWorkspace(cwd) {
   const file = path3.join(cwd, WORKSPACE_FILE);
   if (!existsSync2(file)) return null;
   const size = statSync(file).size;
@@ -377,10 +390,16 @@ function listAppFolder(dir) {
 function envsOfHost(ws, host) {
   return Object.values(ws.environments).filter((e) => e.host === host);
 }
+function envOfAppFolder(ws, host, appId) {
+  const hits = envsOfHost(ws, host);
+  if (hits.length === 1) return hits[0];
+  const byApp = hits.filter((e) => ws.apps.some((a) => a.ids[e.name] === appId));
+  return byApp.length === 1 ? byApp[0] : void 0;
+}
 
 // src/commands/take.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync6, unlinkSync, writeFileSync, mkdirSync } from "node:fs";
-import path8 from "node:path";
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync7, unlinkSync, mkdirSync } from "node:fs";
+import path10 from "node:path";
 
 // src/commands/normalize.ts
 import { readFileSync as readFileSync5, statSync as statSync3 } from "node:fs";
@@ -425,7 +444,6 @@ import { readFileSync as readFileSync3 } from "node:fs";
 import path5 from "node:path";
 
 // src/paths.ts
-import { existsSync as existsSync3, realpathSync as realpathSync2 } from "node:fs";
 import path4 from "node:path";
 import { fileURLToPath } from "node:url";
 var here = path4.dirname(fileURLToPath(import.meta.url));
@@ -433,24 +451,6 @@ var AUTHORING_ROOT = path4.resolve(here, "..");
 var REPO_ROOT = path4.resolve(AUTHORING_ROOT, "..");
 var VENDOR_DIR = path4.join(AUTHORING_ROOT, "vendor");
 var MOMENT_FILE = path4.join(VENDOR_DIR, "moment-with-locales.min.js");
-function linkedRoot(name, envVar, fallback) {
-  const env = process.env[envVar];
-  if (env) return env;
-  const linked = path4.join(AUTHORING_ROOT, "node_modules", name);
-  if (existsSync3(path4.join(linked, "package.json"))) {
-    try {
-      return realpathSync2(linked);
-    } catch {
-      return linked;
-    }
-  }
-  return fallback;
-}
-var PRINT_CRAFT_ROOT = linkedRoot("print-craft", "PCRAFT_PRINT_CRAFT_ROOT", path4.resolve(REPO_ROOT, "..", "print-craft"));
-function devPluginDir() {
-  const dir = path4.join(PRINT_CRAFT_ROOT, "prod");
-  return existsSync3(path4.join(dir, "desktop_js", "KintoneFormulaPCraft.min.js")) ? dir : null;
-}
 
 // src/meta.ts
 var PRINT_CRAFT_PLUGIN_ID = "lcapkanpjdabgphknkabojmcfhonhkhp";
@@ -523,7 +523,7 @@ function devMeta() {
   return { toolsVersion: pkg.version, pluginId: PRINT_CRAFT_PLUGIN_ID, minPluginVersion: MIN_PLUGIN_VERSION, supportedApiVersions: [...SUPPORTED_API_VERSIONS], commit: gitCommit(AUTHORING_ROOT), builtAt: "", mode: "dev" };
 }
 function toolsMeta() {
-  if (true) return JSON.parse('{"toolsVersion":"1.1.0","pluginId":"lcapkanpjdabgphknkabojmcfhonhkhp","minPluginVersion":6,"supportedApiVersions":[1,2],"commit":"eb915ae","builtAt":"2026-10-08T00:26:18.929Z","mode":"build"}');
+  if (true) return JSON.parse('{"toolsVersion":"1.3.0","pluginId":"lcapkanpjdabgphknkabojmcfhonhkhp","minPluginVersion":6,"supportedApiVersions":[1,2],"commit":"5abbe71","builtAt":"2026-10-09T13:34:14.744Z","mode":"build"}');
   return devMeta();
 }
 
@@ -1042,9 +1042,9 @@ async function checkHtml(html, opt = {}) {
   const doc = new w.DOMParser().parseFromString(`<!doctype html><html><body>${html}</body></html>`, "text/html");
   const root = doc.body ?? doc.documentElement;
   if (!root) return { errors, warnings, externals };
-  const walk = (el, path11) => {
+  const walk = (el, path14) => {
     const tag = el.tagName.toLowerCase();
-    const here2 = `${path11}>${tag}`;
+    const here2 = `${path14}>${tag}`;
     const denied = tagError(tag, here2);
     if (denied) {
       errors.push(denied);
@@ -1107,7 +1107,7 @@ function expressionsOf(html) {
 }
 
 // src/normalize/policy.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
 import path6 from "node:path";
 var PolicyError = class extends Error {
 };
@@ -1208,9 +1208,9 @@ function isExternalRefsAllowed(policy, settingsFile) {
     return false;
   }
 }
-function loadPolicy(opt = {}) {
-  const file = path6.join(opt.cwd ?? process.cwd(), POLICY_FILE);
-  if (!existsSync4(file)) return { allowExternal: [] };
+function loadPolicy(opt) {
+  const file = path6.join(opt.cwd, POLICY_FILE);
+  if (!existsSync3(file)) return { allowExternal: [] };
   if (statSync2(file).size > MAX_POLICY_BYTES) throw new PolicyError(`${file} が大きすぎる（${MAX_POLICY_BYTES} バイトまで）`);
   return parsePolicy(readFileSync4(file, "utf8"), file);
 }
@@ -1698,13 +1698,157 @@ async function readFieldsFile(file) {
   if (typeof fields2.appId !== "number" || !Number.isInteger(fields2.appId) || fields2.appId <= 0) throw new InputError(`${file} の appId が正の整数でない`);
   return fields2;
 }
-function relativeSettingsPath(file) {
-  const rel = path7.relative(process.cwd(), path7.resolve(file));
+function relativeSettingsPath(file, cwd) {
+  const rel = path7.relative(cwd, path7.resolve(cwd, file));
   return rel.startsWith("..") ? file : rel.replace(/\\/g, "/");
 }
 
+// src/permission.ts
+import { existsSync as existsSync4 } from "node:fs";
+import path8 from "node:path";
+var PermissionError = class extends Error {
+};
+var ALLOWED_CLASSES = {
+  settings: ["edit", "report"],
+  snapshot: ["snapshot"],
+  fields: ["fields"],
+  record: ["record"],
+  preview: ["out"]
+};
+var OP_LABEL = {
+  settings: "設定（-edit.json と新しい帳票）",
+  snapshot: "新しい名前のダウンロード / pull",
+  fields: "fields.json",
+  record: "records/ の下",
+  preview: "out/ の下"
+};
+function classOfAppPath(relInFolder) {
+  const rel = relInFolder.replace(/\\/g, "/");
+  if (rel.startsWith("records/")) return rel.toLowerCase().endsWith(".json") ? "record" : "other";
+  if (rel.startsWith("out/")) return "out";
+  if (rel.includes("/")) return "other";
+  if (rel === "fields.json") return "fields";
+  if (SNAPSHOT_RE.test(rel)) return "snapshot";
+  if (EDIT_RE.test(rel)) return "edit";
+  if (rel.toLowerCase().endsWith(".json")) return "report";
+  return "other";
+}
+function roleOfTarget(root, file) {
+  const abs = path8.resolve(root, file);
+  if (!isInside(abs, path8.join(root, KINTONE_ROOT))) return null;
+  const ws = loadWorkspace(root);
+  const folder = appFolderOfFile(root, abs);
+  const cls = folder ? classOfAppPath(path8.relative(folder.dir, abs)) : void 0;
+  if (!ws) return { role: "unclassified", why: `${WORKSPACE_FILE} が無い`, cls };
+  if (!folder) return { role: "unclassified", why: "アプリのフォルダー（kintone/<ホスト名>/<番号>-…/）の中でない" };
+  const env = envOfAppFolder(ws, folder.host, folder.appId);
+  if (!env) return { role: "unclassified", why: `フォルダー（${folder.host} のアプリ ${folder.appId}）がどの環境のものか ${WORKSPACE_FILE} から決まらない（同じホストの環境が 2 つ以上あるときは、apps にアプリの番号を足す）`, cls };
+  return env.role === "unclassified" ? { role: "unclassified", envName: env.name, why: `環境「${env.name}」に role が無い`, cls } : { role: env.role, envName: env.name, cls };
+}
+function assertChangeAllowed(root, file, op) {
+  const target = roleOfTarget(root, file);
+  if (!target) return;
+  const abs = path8.resolve(root, file);
+  if (target.role === "unclassified") {
+    throw new PermissionError(`${target.why}ので kintone/ の下を変更できない。${WORKSPACE_FILE} の環境に role（development か production）を書く（利用者が書く）`);
+  }
+  if (target.role === "production" && op !== "snapshot") {
+    throw new PermissionError(`環境「${target.envName}」は本番（role: production）なので変更できない。開発の環境で作る・直す（本番のフォルダーは pull / ダウンロードで今の設定を見るだけ）`);
+  }
+  const cls = target.cls ?? "other";
+  if (cls === "snapshot" && existsSync4(abs)) {
+    throw new PermissionError(`ダウンロード / pull のファイルは書き換えない: ${path8.relative(root, abs)}。edit で -edit.json に写して直す`);
+  }
+  if (!ALLOWED_CLASSES[op].includes(cls)) {
+    throw new PermissionError(`この操作でアプリのフォルダーに書けるのは ${OP_LABEL[op]} だけ: ${path8.relative(root, abs)}`);
+  }
+}
+
+// src/commit-file.ts
+import { randomBytes } from "node:crypto";
+import { constants, copyFileSync, linkSync, lstatSync as lstatSync2, readFileSync as readFileSync6, renameSync, rmSync, writeFileSync } from "node:fs";
+import path9 from "node:path";
+var FileExistsError = class extends Error {
+};
+var errCode = (e) => e?.code;
+var rand = () => randomBytes(6).toString("hex");
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withRetry(fn, tries = 3) {
+  for (let i = 1; ; i++) {
+    try {
+      return fn();
+    } catch (e) {
+      const code = errCode(e);
+      if (i < tries && (code === "EPERM" || code === "EBUSY")) {
+        sleepSync(20 * i);
+        continue;
+      }
+      throw e;
+    }
+  }
+}
+function cleanupAll(steps, tries = 3) {
+  const errors = [];
+  for (const step of steps) {
+    try {
+      withRetry(step, tries);
+    } catch (e) {
+      errors.push(e instanceof Error ? e.message : String(e));
+    }
+  }
+  return errors;
+}
+function tempPathFor(target) {
+  return path9.join(path9.dirname(target), `.${path9.basename(target)}.${rand()}.tmp`);
+}
+function placeNew(tmp, target, link = linkSync) {
+  try {
+    link(tmp, target);
+    return;
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "EEXIST") throw new FileExistsError(`確定の直前に同じ名前のファイルができた: ${path9.basename(target)}`);
+    if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EXDEV" && code !== "ENOSYS") throw e;
+  }
+  try {
+    copyFileSync(tmp, target, constants.COPYFILE_EXCL);
+  } catch (e) {
+    if (errCode(e) === "EEXIST") throw new FileExistsError(`確定の直前に同じ名前のファイルができた: ${path9.basename(target)}`);
+    throw e;
+  }
+}
+function writeNewFile(target, text, recheck = () => {
+}) {
+  const tmp = tempPathFor(target);
+  let placed = false;
+  let failure;
+  try {
+    recheck();
+    writeFileSync(tmp, text, { encoding: "utf8", flag: "wx" });
+    recheck();
+    placeNew(tmp, target);
+    placed = true;
+  } catch (e) {
+    failure = e;
+  }
+  const cleanup = cleanupAll([() => rmSync(tmp, { force: true })]);
+  if (!placed) throw failure;
+  return { cleanup };
+}
+
 // src/commands/take.ts
 var PRINT_CRAFT_PLUGIN_ID2 = "rex0220 Print craft plugin";
+function removeSource(src, warnings, rel) {
+  try {
+    withRetry(() => unlinkSync(src));
+    return true;
+  } catch (e) {
+    warnings.push(`${rel} は行き先に置いたが、inbox から消せなかった（${e.code ?? e.message}）。消してよい`);
+    return false;
+  }
+}
 function envFor(ws, appId, envName) {
   if (envName) return ws.environments[envName] ?? `環境「${envName}」は environments.json に無い`;
   const hits = Object.values(ws.environments).filter((e) => ws.apps.some((a) => a.ids[e.name] === appId));
@@ -1714,9 +1858,10 @@ function envFor(ws, appId, envName) {
   if (all.length === 1) return all[0];
   return `アプリ ${appId} は environments.json の apps に無く、環境が 2 つ以上ある。apps に足すか --env で選ぶ`;
 }
-function takeInbox(cwd, ws, envName) {
-  const result = { moved: [], skipped: [] };
-  const inbox = path8.join(cwd, INBOX);
+function takeInbox(cwdIn, ws, envName) {
+  const cwd = realResolve(".", cwdIn);
+  const result = { moved: [], skipped: [], warnings: [] };
+  const inbox = path10.join(cwd, INBOX);
   if (!existsSync5(inbox)) return result;
   for (const name of readdirSync2(inbox).filter((n) => n.toLowerCase().endsWith(".json")).sort()) {
     const rel = `${INBOX}/${name}`;
@@ -1737,6 +1882,10 @@ function takeInbox(cwd, ws, envName) {
       result.skipped.push({ file: rel, reason: "封筒の appId が無い" });
       continue;
     }
+    if (!SNAPSHOT_RE.test(name)) {
+      result.skipped.push({ file: rel, reason: "ダウンロードの名前（rex0220-print-craft-app<番号>-<日時>.json）ではない。設定画面のダウンロードの名前のまま inbox/ に置く" });
+      continue;
+    }
     const m = name.match(/-app(\d+)-/);
     if (m && Number(m[1]) !== appId) {
       result.skipped.push({ file: rel, reason: `ファイル名のアプリ ${m[1]} と封筒の appId ${appId} が違う` });
@@ -1748,27 +1897,55 @@ function takeInbox(cwd, ws, envName) {
       continue;
     }
     const dir = appDirFor(cwd, env, appId, typeof data.appName === "string" ? data.appName : "");
-    const dest = resolveWrite(path8.join(dir, name), WRITE_ROOTS.kintone, cwd);
-    const text = readFileSync6(src, "utf8");
+    const dest = resolveWrite(path10.join(dir, name), WRITE_ROOTS.kintone, cwd);
+    const text = readFileSync7(src, "utf8");
     if (existsSync5(dest)) {
-      if (readFileSync6(dest, "utf8") !== text) {
-        result.skipped.push({ file: rel, reason: `行き先に同じ名前の別の中身がある: ${path8.relative(cwd, dest)}` });
+      if (readFileSync7(dest, "utf8") !== text) {
+        result.skipped.push({ file: rel, reason: `行き先に同じ名前の別の中身がある: ${path10.relative(cwd, dest)}` });
         continue;
       }
-      unlinkSync(src);
-      result.moved.push({ file: rel, to: path8.relative(cwd, dest), same: true });
+      const removed2 = removeSource(src, result.warnings, rel);
+      result.moved.push({ file: rel, to: path10.relative(cwd, dest), same: true, ...removed2 ? {} : { leftInInbox: true } });
       continue;
     }
-    mkdirSync(path8.dirname(dest), { recursive: true });
-    writeFileSync(dest, text, "utf8");
-    unlinkSync(src);
-    result.moved.push({ file: rel, to: path8.relative(cwd, dest), same: false });
+    try {
+      assertChangeAllowed(cwd, dest, "snapshot");
+      mkdirSync(path10.dirname(dest), { recursive: true });
+      const { cleanup } = writeNewFile(dest, text, () => {
+        if (resolveWrite(path10.join(dir, name), WRITE_ROOTS.kintone, cwd) !== dest) throw new PermissionError(`書く先のフォルダーが途中で変わった（symlink など）: ${path10.relative(cwd, dest)}`);
+        assertChangeAllowed(cwd, dest, "snapshot");
+      });
+      for (const c of cleanup) result.warnings.push(`${rel} は行き先に置いたが、一時ファイルを消せなかった（${c}）。${path10.relative(cwd, path10.dirname(dest))} の .${name}.*.tmp を消してよい`);
+    } catch (e) {
+      if (e instanceof PermissionError) {
+        result.skipped.push({ file: rel, reason: e.message });
+        continue;
+      }
+      if (e instanceof FileExistsError) {
+        result.skipped.push({ file: rel, reason: `行き先に同じ名前のファイルができた（移す途中で）: ${path10.relative(cwd, dest)}。もう一度 take する` });
+        continue;
+      }
+      throw e;
+    }
+    const removed = removeSource(src, result.warnings, rel);
+    result.moved.push({ file: rel, to: path10.relative(cwd, dest), same: false, ...removed ? {} : { leftInInbox: true } });
   }
   return result;
 }
 
 // src/kintone-rest.ts
-var ALLOWED_APIS = ["app", "app/form/fields", "app/form/layout", "record", "preview/app/form/fields", "preview/app/form/layout", "app/plugin/config", "preview/app/plugin/config"];
+var ALLOWED_APIS = ["app", "app/form/fields", "app/form/layout", "record", "records", "preview/app/form/fields", "preview/app/form/layout", "app/plugin/config", "preview/app/plugin/config"];
+var RECEIVE_LIMITS = {
+  app: 64 * 1024,
+  "app/form/fields": 8 * 1024 * 1024,
+  "app/form/layout": 8 * 1024 * 1024,
+  "preview/app/form/fields": 8 * 1024 * 1024,
+  "preview/app/form/layout": 8 * 1024 * 1024,
+  record: 8 * 1024 * 1024,
+  records: 8 * 1024 * 1024,
+  "app/plugin/config": 2 * 1024 * 1024,
+  "preview/app/plugin/config": 2 * 1024 * 1024
+};
 var RestError = class extends Error {
   status;
   code;
@@ -1783,6 +1960,37 @@ var RestError = class extends Error {
 };
 var NotAllowedError = class extends Error {
 };
+async function readCapped(res, limit, apiPath) {
+  const tooLarge = () => new RestError(`kintone ${apiPath} の応答が大きすぎる（上限 ${limit} バイト）`, res.status, "LimitError", apiPath);
+  const quietCancel = async (reader2) => {
+    try {
+      await reader2.cancel();
+    } catch {
+    }
+  };
+  if (res.body === null) return "";
+  if (!res.body || typeof res.body.getReader !== "function") throw new RestError(`kintone ${apiPath} の応答に本文のストリームが無い`, res.status, "ResponseError", apiPath);
+  const reader = res.body.getReader();
+  const declared = Number(res.headers?.get("content-length") ?? Number.NaN);
+  if (Number.isFinite(declared) && declared > limit) {
+    await quietCancel(reader);
+    throw tooLarge();
+  }
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.length;
+    if (total > limit) {
+      await quietCancel(reader);
+      throw tooLarge();
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf8");
+}
 function apiPathOf(api, guestSpaceId) {
   if (!ALLOWED_APIS.includes(api)) throw new NotAllowedError(`この API は authoring tools では呼ばない: ${api}（許可: ${ALLOWED_APIS.join(", ")}）`);
   if (guestSpaceId !== void 0 && (!Number.isInteger(guestSpaceId) || guestSpaceId <= 0)) throw new NotAllowedError(`ゲストスペースの ID が不正: ${String(guestSpaceId)}`);
@@ -1810,7 +2018,7 @@ function createRestClient(auth, fetchImpl = fetch) {
       for (const [k, v] of Object.entries(params)) if (v !== void 0) url.searchParams.set(k, String(v));
       if (url.origin !== baseUrl || url.username || url.password) throw new NotAllowedError(`送信先が kintone の接続先と違うので送らない: ${url.origin}`);
       const res = await fetchImpl(url.href, { method: "GET", headers });
-      const text = await res.text();
+      const text = await readCapped(res, RECEIVE_LIMITS[api], apiPath);
       if (!res.ok) {
         let code;
         try {
@@ -1821,7 +2029,11 @@ function createRestClient(auth, fetchImpl = fetch) {
         const hint = res.status === 401 ? "（認証情報かアクセス権を確かめる。API トークンならそのアプリで有効か）" : res.status === 403 ? "（アクセス権が無い）" : res.status === 404 ? "（アプリかレコードが無い）" : "";
         throw new RestError(`kintone ${apiPath} が HTTP ${res.status}${code ? ` ${code}` : ""}${hint}`, res.status, code, apiPath);
       }
-      return JSON.parse(text);
+      try {
+        return JSON.parse(text);
+      } catch {
+        throw new RestError(`kintone ${apiPath} の応答が JSON でない${text ? "" : "（本文が空）"}`, res.status, "ResponseError", apiPath);
+      }
     }
   };
 }
@@ -2061,8 +2273,12 @@ function columnShape(type, values) {
   return `最大 ${longest}${multiLine ? `（複数行の値 ${multiLine} 行）` : ""}${filled.length < shapes.length ? `、空 ${shapes.length - filled.length} 行` : ""}`;
 }
 function describeRecord(file) {
+  const header = `アプリ ${file.appId} レコード ${file.id}（取得 ${file.fetchedAt}${file.keptFields ? `、--fields-from で ${file.keptFields.length} 項目に絞った` : ""}）。値は出さない（形だけ）`;
+  return [header, ...shapeLines(file.record)].join("\n");
+}
+function shapeLines(record2) {
   const lines = [];
-  for (const [code, fv] of Object.entries(file.record)) {
+  for (const [code, fv] of Object.entries(record2)) {
     if (code === "$id" || code === "$revision" || !fv) continue;
     if (fv.type === "SUBTABLE" && Array.isArray(fv.value)) {
       const rows = fv.value;
@@ -2080,8 +2296,7 @@ function describeRecord(file) {
     }
     lines.push(`${code}  ${fv.type}  ${shapeOf(fv)}`);
   }
-  const header = `アプリ ${file.appId} レコード ${file.id}（取得 ${file.fetchedAt}${file.keptFields ? `、--fields-from で ${file.keptFields.length} 項目に絞った` : ""}）。値は出さない（形だけ）`;
-  return [header, ...lines].join("\n");
+  return lines;
 }
 function summarizeRecord(file) {
   const codes = Object.keys(file.record);
@@ -2090,6 +2305,30 @@ function summarizeRecord(file) {
   return `アプリ ${file.appId} レコード ${file.id}: 項目 ${codes.length}${tables.length ? `（テーブル ${rows.join(", ")}）` : ""}${file.keptFields ? `。--fields-from で ${file.keptFields.length} 項目に絞った` : ""}。値は表示しない`;
 }
 
+// src/dev-paths.ts
+import { existsSync as existsSync6, realpathSync as realpathSync2 } from "node:fs";
+import path11 from "node:path";
+function linkedRoot(env, name, envVar, fallback) {
+  const v = env[envVar];
+  if (v) return v;
+  const linked = path11.join(AUTHORING_ROOT, "node_modules", name);
+  if (existsSync6(path11.join(linked, "package.json"))) {
+    try {
+      return realpathSync2(linked);
+    } catch {
+      return linked;
+    }
+  }
+  return fallback;
+}
+function printCraftRootOf(env) {
+  return linkedRoot(env, "print-craft", "PCRAFT_PRINT_CRAFT_ROOT", path11.resolve(REPO_ROOT, "..", "print-craft"));
+}
+function printCraftProdDir(env) {
+  return path11.join(printCraftRootOf(env), "prod");
+}
+var PRINT_CRAFT_ROOT = printCraftRootOf(process.env);
+
 // src/normalize/line-diff.ts
 var MAX_CELLS = 4e6;
 function lineDiff(a, b) {
@@ -2369,13 +2608,13 @@ function defaultPullName(appName, appId) {
 }
 
 // src/engine.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
-import path9 from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "node:fs";
+import path12 from "node:path";
 import vm from "node:vm";
 
 // src/plugin-zip.ts
 import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
+import { readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
 import { inflateRawSync } from "node:zlib";
 var SIG_EOCD = 101010256;
 var SIG_CENTRAL = 33639248;
@@ -2487,7 +2726,7 @@ function readPluginZip(file) {
   try {
     const size = statSync4(file).size;
     if (size > ZIP_LIMITS.maxOuterBytes) throw new PluginZipError(`大きすぎる（${size} バイト）`);
-    outer = unzip(readFileSync7(file));
+    outer = unzip(readFileSync8(file));
   } catch (e) {
     throw new PluginZipError(`印刷屋の zip を読めない: ${file}（${e instanceof Error ? e.message : String(e)}）`);
   }
@@ -2540,23 +2779,23 @@ var DEFAULT_CONTEXT_BASE_URL = "https://example.cybozu.com";
 var DEFAULT_USER = { id: "1", code: "authoring", name: "authoring", email: "", language: "ja" };
 var loaded = null;
 function resolvePluginSources(opt = {}, mode = opt.mode ?? toolsMeta().mode) {
-  const zip = opt.pluginZip ?? process.env.PCRAFT_PLUGIN_ZIP;
+  const zip = opt.pluginZip;
   if (zip) {
-    if (!existsSync6(zip)) throw new PluginZipError(`印刷屋の zip が無い: ${zip}（.env の PCRAFT_PLUGIN_ZIP）`);
+    if (!existsSync7(zip)) throw new PluginZipError(`印刷屋の zip が無い: ${zip}（.env の PCRAFT_PLUGIN_ZIP）`);
     return { ...readPluginZip(zip), kind: "zip" };
   }
-  const devAllowed = mode === "dev" && process.env.PCRAFT_ALLOW_DEV_PLUGIN === "1";
+  const dev = opt.devPluginDir;
+  const devAllowed = mode === "dev" && !!dev;
   if (!devAllowed) {
     throw new PluginZipError(`印刷屋の zip の場所が分からない。.env に PCRAFT_PLUGIN_ZIP=<印刷屋プラグインの zip のパス> を書く${mode === "dev" ? "（開発中に隣の print-craft の prod/ を読むなら環境変数 PCRAFT_ALLOW_DEV_PLUGIN=1）" : ""}`);
   }
-  const dev = devPluginDir();
-  if (!dev) throw new PluginZipError("印刷屋の zip の場所が分からない（PCRAFT_ALLOW_DEV_PLUGIN=1 だが隣の print-craft の prod/ が無い）。.env に PCRAFT_PLUGIN_ZIP を書く");
-  const read = (rel) => readFileSync8(path9.join(dev, rel), "utf8");
-  const apiFile = path9.join(dev, API_ENTRY);
+  if (!dev || !existsSync7(path12.join(dev, ENGINE_ENTRY))) throw new PluginZipError(`印刷屋の zip の場所が分からない（PCRAFT_ALLOW_DEV_PLUGIN=1 だが print-craft の prod/ が無い: ${dev}）。.env に PCRAFT_PLUGIN_ZIP を書く`);
+  const read = (rel) => readFileSync9(path12.join(dev, rel), "utf8");
+  const apiFile = path12.join(dev, API_ENTRY);
   const engine = read(ENGINE_ENTRY);
   const bignumber = read(BIGNUMBER_ENTRY);
   const momentTimezone = read(MOMENT_TZ_ENTRY);
-  const api = existsSync6(apiFile) ? readFileSync8(apiFile, "utf8") : void 0;
+  const api = existsSync7(apiFile) ? readFileSync9(apiFile, "utf8") : void 0;
   const manifest = JSON.parse(read(MANIFEST_ENTRY));
   return {
     kind: "dev",
@@ -2620,7 +2859,7 @@ async function loadEngine(opt = {}) {
   window.kintone = g.kintone;
   window.cybozu = g.cybozu;
   window.rex0220_users_info3 = g.rex0220_users_info3;
-  if (!existsSync6(MOMENT_FILE)) throw new Error(`moment が無い: ${MOMENT_FILE}（tools の npm install 時に取る。手で取るなら npm run vendor）`);
+  if (!existsSync7(MOMENT_FILE)) throw new Error(`moment が無い: ${MOMENT_FILE}（tools の npm install 時に取る。手で取るなら npm run vendor）`);
   const runScript = (code, filename) => {
     vm.runInThisContext(code, { filename });
     for (const k of ["moment", "rex0220_BigNumber", "rex0220_Decimal", "rex0220p", "rex0220PrintCraftAuthoring"]) {
@@ -2628,7 +2867,7 @@ async function loadEngine(opt = {}) {
       if (window[k] === void 0 && g[k] !== void 0) window[k] = g[k];
     }
   };
-  runScript(readFileSync8(MOMENT_FILE, "utf8"), MOMENT_FILE);
+  runScript(readFileSync9(MOMENT_FILE, "utf8"), MOMENT_FILE);
   runScript(src.momentTimezone, `${src.from}!${MOMENT_TZ_ENTRY}`);
   runScript(src.bignumber, `${src.from}!${BIGNUMBER_ENTRY}`);
   runScript(src.engine, `${src.from}!${ENGINE_ENTRY}`);
@@ -2853,6 +3092,18 @@ async function runPreview(input) {
   return { findings, results, skipped, summary };
 }
 
+// src/context.ts
+function createContext(opt) {
+  return Object.freeze({ root: realResolve(".", opt.cwd), env: Object.freeze({ ...opt.env }) });
+}
+
+// src/commands/save.ts
+import { createHash as createHash4 } from "node:crypto";
+var MAX_SAVE_INPUT_BYTES = 256 * 1024;
+function digestOf(text) {
+  return createHash4("sha256").update(text).digest("hex");
+}
+
 // src/cli.ts
 var USAGE = `使い方: npx @rex0220/print-craft-authoring-tools <command> [options]
 （短い npx pcraft-authoring は使わない。npm ci の前だと npm の公開レジストリの同じ名前のパッケージを取りに行く）
@@ -2866,14 +3117,16 @@ var USAGE = `使い方: npx @rex0220/print-craft-authoring-tools <command> [opti
       取得済みの fields/<N>.json を 1 項目 1 行で（レイアウトの順。型・ラベル・書式・単位・選択肢・ルックアップ）。通信しない。
   pull --app N [--preview] [--guest <spaceId>] [--out settings/<file>] [--force] [--plugin-id <ID>]
       アプリに入っている印刷屋の今の設定を取って、設定画面の「設定をダウンロード」と同じ封筒形式で settings/APP<N>-<アプリ名>.json に保存（GET だけ）。
-      kintone の API ラボ「アプリに追加されているプラグインの設定情報を取得する」を有効にした環境だけ。権限は運用中の設定がレコード閲覧＋追加、
-      --preview（動作テスト環境 = 保存して未反映の設定）がアプリ管理。プラグイン ID は印刷屋の zip から。既にあるファイルは --force で上書き。
+      kintone の API ラボ「アプリに追加されているプラグインの設定情報を取得する」を有効にした環境だけ。権限は運用中の設定がレコード閲覧（API トークンでも可）、
+      --preview（動作テスト環境 = 保存して未反映の設定）がアプリ管理。プラグイン ID は印刷屋の zip から。既にあるファイルは --force で上書き
+      （--force は settings/ に置くときだけ。environments.json があるときはダウンロードと同じ日時の名前で新しく置き、上書きしない）。
   record --app N --id R [--fields-from <settings.json>] [--guest <spaceId>] [--out records/<file>]
       レコードを records/<N>-<R>.json に保存。--fields-from で設定が使う項目だけ残す。
   record --app N --id R --summary
       取得済みの records/<N>-<R>.json を 1 項目 1 行で。値は出さず形だけ（文字数・行数・数値の桁・テーブルの行数・添付の件数と種類）。通信しない。
-  buttons <settings.json> [--button <名前>]
+  buttons <settings.json> [--button <名前>] [--json]
       設定のボタン一覧（画面・保存先・用紙・表示条件・ファイル名・帳票の行・更新項目）。--button でそのボタンの HTML / CSS / 計算式（data: の URL は長さだけ）。
+      --json はファイルの digest（sha256）とボタンの名前の一覧も（直すときの照合に使う）。
   normalize <settings.json> --fields <fields.json> [--out settings/<file>] [--dry-run] [--check] [--json]
       設定画面と同じ手順で派生値を作り直し、検査して、エラーが無ければ書き戻す（既定は同じファイルに上書き。--dry-run は書かない）。
       --check は入力の派生値と生成した値の差を出す。外部 URL の承認は policy/authoring-policy.json（場所は固定。利用者が書く）。
@@ -2906,6 +3159,12 @@ kintone には GET しか送らない。
 var FLAGS = /* @__PURE__ */ new Set(["preview", "check", "json", "dry-run", "derived", "summary", "force"]);
 var UsageError = class extends Error {
 };
+var W;
+var resolveRead2 = (target) => resolveRead(target, W.root);
+var resolveWrite2 = (target, roots) => resolveWrite(target, roots, W.root);
+var resolveWriteDir2 = (target, roots) => resolveWriteDir(target, roots, W.root);
+var authOpt = () => ({ cwd: W.root, env: W.env });
+var allow = (file, op) => assertChangeAllowed(W.root, file, op);
 function option(args, name) {
   const i = args.indexOf(`--${name}`);
   return i >= 0 ? args[i + 1] : void 0;
@@ -2938,20 +3197,35 @@ function rejectRemovedOptions(args) {
     if (args.includes(`--${name}`)) throw new UsageError(`--${name} は使えない。.env と policy/authoring-policy.json と PCRAFT_PLUGIN_ZIP は作業フォルダーのものに固定（AI が書けるファイルを読ませないため）`);
   }
 }
-function writeJson(file, data) {
-  mkdirSync2(path10.dirname(file), { recursive: true });
-  writeFileSync2(file, JSON.stringify(data, null, 2) + "\n", "utf8");
+function writeText(file, text, roots, op, opt = {}) {
+  const real = resolveWrite2(file, roots);
+  allow(real, op);
+  mkdirSync2(path13.dirname(real), { recursive: true });
+  if (opt.exclusive ?? op === "snapshot") {
+    try {
+      const { cleanup } = writeNewFile(real, text, () => {
+        if (resolveWrite2(file, roots) !== real) throw new InputError(`書く先のフォルダーが途中で変わった（symlink など）: ${shown(real)}`);
+        allow(real, op);
+      });
+      for (const c of cleanup) console.error(`注意: 書いたが一時ファイルを消せなかった（${c}）`);
+    } catch (e) {
+      if (e instanceof FileExistsError) throw new InputError(`${shown(real)} は既にある（確かめた後に作られた）。上書きしない`);
+      throw e;
+    }
+    return real;
+  }
+  writeFileSync2(real, text, "utf8");
+  return real;
 }
-function writeText(file, text) {
-  mkdirSync2(path10.dirname(file), { recursive: true });
-  writeFileSync2(file, text, "utf8");
+function writeJson(file, data, roots, op, opt = {}) {
+  return writeText(file, JSON.stringify(data, null, 2) + "\n", roots, op, opt);
 }
 function shown(file) {
-  const rel = path10.relative(process.cwd(), file);
+  const rel = path13.relative(W.root, file);
   return rel && !rel.startsWith("..") ? rel : file;
 }
 async function engineFor() {
-  const engine = await loadEngine({ pluginZip: pluginZipPath() });
+  const engine = await loadEngine({ pluginZip: pluginZipPath(authOpt()), devPluginDir: W.env.PCRAFT_ALLOW_DEV_PLUGIN === "1" ? printCraftProdDir(W.env) : void 0 });
   for (const w of engine.warnings) console.error(`注意: ${w}`);
   return engine;
 }
@@ -2996,7 +3270,7 @@ async function version(args) {
   return info.ok ? 0 : 1;
 }
 function context(args) {
-  const ws = loadWorkspace();
+  const ws = loadWorkspace(W.root);
   const name = option(args, "env");
   if (args.includes("--env")) {
     if (!name || !isEnvName(name)) throw new UsageError("--env には environments.json の環境の名前を続ける（ファイルの場所は指定できない）");
@@ -3005,7 +3279,7 @@ function context(args) {
   return ws ? { ws, env: pickEnv(ws, name) } : { ws: null };
 }
 function client(ctx) {
-  const auth = ctx?.ws && ctx.env ? loadAuthForEnv(ctx.env) : loadAuth();
+  const auth = ctx?.ws && ctx.env ? loadAuthForEnv(ctx.env, W.root) : loadAuth(authOpt());
   return { client: createRestClient(auth), authLabel: describeAuth(auth) };
 }
 var envFlag = (ctx) => ctx.ws && ctx.env && ctx.env.name !== ctx.ws.defaultEnv ? ` --env ${ctx.env.name}` : "";
@@ -3016,7 +3290,7 @@ function appOf(args, ctx) {
   return resolveApp(ctx.ws, ctx.env, v).appId;
 }
 function existingAppDir(ctx, appId) {
-  const dir = findAppDir(process.cwd(), ctx.env, appId);
+  const dir = findAppDir(W.root, ctx.env, appId);
   if (!dir) throw new InputError(`アプリ ${appId} のフォルダー（kintone/${ctx.env.host}/${appId}-…）が無い。先に npx @rex0220/print-craft-authoring-tools fields --app ${appId}${envFlag(ctx)}`);
   return dir;
 }
@@ -3024,38 +3298,39 @@ function noOutInWorkspace(args, ctx) {
   if (ctx.ws && args.includes("--out")) throw new UsageError("environments.json があるときは --out を使わない（保存先はアプリのフォルダー kintone/<ホスト名>/<番号>-<アプリ名>/）");
 }
 function existingFile(rel, howToFetch) {
-  const file = resolveRead(rel);
-  if (!existsSync7(file)) throw new InputError(`${shown(file)} が無い。先に npx @rex0220/print-craft-authoring-tools ${howToFetch}`);
+  const file = resolveRead2(rel);
+  if (!existsSync8(file)) throw new InputError(`${shown(file)} が無い。先に npx @rex0220/print-craft-authoring-tools ${howToFetch}`);
   return file;
 }
 function folderDefaults(settingsFile) {
-  return loadWorkspace() ? appFolderOfFile(process.cwd(), settingsFile) : null;
+  return loadWorkspace(W.root) ? appFolderOfFile(W.root, settingsFile) : null;
 }
 function fieldsFileOf(args, folder) {
   const arg = option(args, "fields");
-  if (arg) return resolveRead(arg);
+  if (arg) return resolveRead2(arg);
   if (!folder) throw new UsageError("--fields <fields.json> が要る（fields コマンドの出力。kintone/<ホスト名>/<番号>-…/ の中のファイルなら同じフォルダーの fields.json を使う）");
-  return existingFile(path10.join(folder.dir, "fields.json"), `fields --app ${folder.appId}`);
+  return existingFile(path13.join(folder.dir, "fields.json"), `fields --app ${folder.appId}`);
 }
 function trustedBaseUrl(folder) {
-  const ws = loadWorkspace();
+  const ws = loadWorkspace(W.root);
   if (ws && folder) return envsOfHost(ws, folder.host)[0]?.baseUrl;
-  return baseUrlFromEnv();
+  return baseUrlFromEnv(authOpt());
 }
 async function fields(args) {
   const ctx = context(args);
   const app = appOf(args, ctx);
   noOutInWorkspace(args, ctx);
   if (flag(args, "summary")) {
-    const rel = ctx.ws ? path10.join(existingAppDir(ctx, app), "fields.json") : path10.join("fields", `${app}.json`);
+    const rel = ctx.ws ? path13.join(existingAppDir(ctx, app), "fields.json") : path13.join("fields", `${app}.json`);
     console.log(listFields(await readFieldsFile(existingFile(rel, `fields --app ${app}${envFlag(ctx)}`))));
     return 0;
   }
   const guestSpaceId = intOption(args, "guest", false);
   const { client: c, authLabel } = client(ctx);
   const file = await fetchFields(c, { app, lang: option(args, "lang"), preview: flag(args, "preview"), guestSpaceId });
-  const out = ctx.ws ? resolveWrite(path10.join(appDirFor(process.cwd(), ctx.env, app, file.appName), "fields.json"), WRITE_ROOTS.kintone) : resolveWrite(option(args, "out") ?? path10.join("fields", `${app}.json`), WRITE_ROOTS.fields);
-  writeJson(out, file);
+  const out = ctx.ws ? resolveWrite2(path13.join(appDirFor(W.root, ctx.env, app, file.appName), "fields.json"), WRITE_ROOTS.kintone) : resolveWrite2(option(args, "out") ?? path13.join("fields", `${app}.json`), WRITE_ROOTS.fields);
+  allow(out, "fields");
+  writeJson(out, file, ctx.ws ? WRITE_ROOTS.kintone : WRITE_ROOTS.fields, "fields");
   console.log(`${summarizeFields(file)}
 ${authLabel}で ${c.baseUrl} から取得 → ${shown(out)}`);
   return 0;
@@ -3065,7 +3340,7 @@ async function record(args) {
   const app = appOf(args, ctx);
   const id = intOption(args, "id", true);
   noOutInWorkspace(args, ctx);
-  const defaultRel = () => ctx.ws ? path10.join(existingAppDir(ctx, app), "records", `${id}.json`) : path10.join("records", `${app}-${id}.json`);
+  const defaultRel = () => ctx.ws ? path13.join(existingAppDir(ctx, app), "records", `${id}.json`) : path13.join("records", `${app}-${id}.json`);
   if (flag(args, "summary")) {
     const file2 = existingFile(defaultRel(), `record --app ${app} --id ${id}${envFlag(ctx)}`);
     const data = readJsonLimited(file2);
@@ -3074,18 +3349,19 @@ async function record(args) {
     return 0;
   }
   const guestSpaceId = intOption(args, "guest", false);
-  const out = resolveWrite(option(args, "out") ?? defaultRel(), WRITE_ROOTS.records);
+  const out = resolveWrite2(option(args, "out") ?? defaultRel(), WRITE_ROOTS.records);
   const from = option(args, "fields-from");
   let keep;
   if (from) {
-    const settings = readJsonLimited(resolveRead(from));
+    const settings = readJsonLimited(resolveRead2(from));
     const codes = usedFieldCodes(settings);
     if (!codes) console.log(`${from} に使う項目の情報が無いので絞らない（normalize した設定なら usedFields から絞れる）`);
     else keep = codes;
   }
   const { client: c, authLabel } = client(ctx);
+  allow(out, "record");
   const file = await fetchRecord(c, { app, id, guestSpaceId, keep });
-  writeJson(out, file);
+  writeJson(out, file, WRITE_ROOTS.records, "record");
   console.log(`${summarizeRecord(file)}
 ${authLabel}で ${c.baseUrl} から取得 → ${shown(out)}（個人情報を含む。コミットしない）`);
   return 0;
@@ -3093,24 +3369,25 @@ ${authLabel}で ${c.baseUrl} から取得 → ${shown(out)}（個人情報を含
 async function normalize(args) {
   const [settingsArg] = positional(args);
   if (!settingsArg) throw new UsageError("設定 JSON のパスが要る");
-  const settingsFile = resolveRead(settingsArg);
+  const settingsFile = resolveRead2(settingsArg);
   const folder = folderDefaults(settingsFile);
   const fieldsFile = fieldsFileOf(args, folder);
   const write = !flag(args, "dry-run");
-  if (write && folder && !option(args, "out") && SNAPSHOT_RE.test(path10.basename(settingsFile))) {
+  if (write && folder && !option(args, "out") && SNAPSHOT_RE.test(path13.basename(settingsFile))) {
     throw new UsageError(`ダウンロード / pull のファイルは書き換えない。npx @rex0220/print-craft-authoring-tools edit ${shown(settingsFile)} で -edit.json に写してから直す（検査だけなら --dry-run）`);
   }
-  const out = write ? resolveWrite(option(args, "out") ?? settingsFile, WRITE_ROOTS.settings) : void 0;
+  const out = write ? resolveWrite2(option(args, "out") ?? settingsFile, WRITE_ROOTS.settings) : void 0;
+  if (out) allow(out, "settings");
   const fieldsData = await readFieldsFile(fieldsFile);
   const baseUrl = trustedBaseUrl(folder);
   const engine = await engineFor();
   engine.setContext({ baseUrl: baseUrl ?? DEFAULT_CONTEXT_BASE_URL, appId: fieldsData.appId });
   const result = await normalizeSettings({
     settingsText: readTextLimited(settingsFile),
-    settingsFile: relativeSettingsPath(settingsArg),
+    settingsFile: relativeSettingsPath(settingsArg, W.root),
     fields: fieldsData,
     engine,
-    policy: loadPolicy(),
+    policy: loadPolicy({ cwd: W.root }),
     check: flag(args, "check"),
     baseUrl
   });
@@ -3130,7 +3407,7 @@ async function normalize(args) {
     return 1;
   }
   if (out) {
-    writeJson(out, result.output);
+    writeJson(out, result.output, WRITE_ROOTS.settings, "settings");
     if (!flag(args, "json")) console.log(`出力: ${shown(out)}（封筒の date を更新。派生値を生成）`);
   }
   return 0;
@@ -3138,8 +3415,8 @@ async function normalize(args) {
 async function diff(args) {
   const [before, after] = positional(args);
   if (!before || !after) throw new UsageError("diff <before.json> <after.json>");
-  const a = readJsonLimited(resolveRead(before));
-  const b = readJsonLimited(resolveRead(after));
+  const a = readJsonLimited(resolveRead2(before));
+  const b = readJsonLimited(resolveRead2(after));
   console.log(diffSettings(a, b, { derived: flag(args, "derived") }));
   return 0;
 }
@@ -3147,6 +3424,7 @@ async function pull(args) {
   const ctx = context(args);
   const app = appOf(args, ctx);
   noOutInWorkspace(args, ctx);
+  if (ctx.ws && flag(args, "force")) throw new UsageError("environments.json があるときの pull は、ダウンロードと同じ日時の名前で新しく置く（ダウンロード / pull のファイルは上書きしない）ので --force は使えない");
   const guestSpaceId = intOption(args, "guest", false);
   const preview2 = flag(args, "preview");
   const outArg = option(args, "out");
@@ -3160,13 +3438,15 @@ async function pull(args) {
     result = await pullSettings(c, engine, { app, preview: preview2, guestSpaceId, pluginId });
   } catch (e) {
     if (e instanceof RestError && /plugin\/config/.test(e.apiPath ?? "")) {
-      throw new RestError(`${e.message}。確かめること: kintone の API ラボ「アプリに追加されているプラグインの設定情報を取得または更新するREST API」が有効か（cybozu.com 共通管理者がアップデートオプションの「検討中の新機能」で）、権限（運用中: レコード閲覧＋レコード追加 / --preview: アプリ管理）、アプリに印刷屋プラグイン（ID ${pluginId}）が入っているか`, e.status, e.code, e.apiPath);
+      throw new RestError(`${e.message}。確かめること: kintone の API ラボ「アプリに追加されているプラグインの設定情報を取得または更新するREST API」が有効か（cybozu.com 共通管理者がアップデートオプションの「検討中の新機能」で）、権限（運用中: レコード閲覧。API トークンでも可 / --preview: アプリ管理）、アプリに印刷屋プラグイン（ID ${pluginId}）が入っているか`, e.status, e.code, e.apiPath);
     }
     throw e;
   }
-  const out = ctx.ws ? resolveWrite(path10.join(appDirFor(process.cwd(), ctx.env, app, result.appName), snapshotNameOf(app)), WRITE_ROOTS.kintone) : resolveWrite(outArg ?? path10.join("settings", defaultPullName(result.appName, app)), WRITE_ROOTS.settings);
-  if (existsSync7(out) && !flag(args, "force")) throw new InputError(`${shown(out)} は既にある。上書きするなら --force（上書きの前の内容は git の差分で確かめる）、別の名前なら --out settings/<ファイル>`);
-  writeJson(out, result.envelope);
+  const out = ctx.ws ? resolveWrite2(path13.join(appDirFor(W.root, ctx.env, app, result.appName), snapshotNameOf(app)), WRITE_ROOTS.kintone) : resolveWrite2(outArg ?? path13.join("settings", defaultPullName(result.appName, app)), WRITE_ROOTS.settings);
+  if (existsSync8(out) && ctx.ws) throw new InputError(`${shown(out)} は既にある（同じ日時の名前）。少し待ってからやり直す（ダウンロード / pull のファイルは上書きしない）`);
+  if (existsSync8(out) && !flag(args, "force")) throw new InputError(`${shown(out)} は既にある。上書きするなら --force（上書きの前の内容は git の差分で確かめる）、別の名前なら --out settings/<ファイル>`);
+  allow(out, ctx.ws ? "snapshot" : "settings");
+  writeJson(out, result.envelope, ctx.ws ? WRITE_ROOTS.kintone : WRITE_ROOTS.settings, ctx.ws ? "snapshot" : "settings", { exclusive: !!ctx.ws || !flag(args, "force") });
   console.log(`pull: アプリ ${app} ${result.appName}（${preview2 ? "動作テスト環境" : "運用中"}の設定、revision ${result.revision}、保存形式 ${result.format}）を${authLabel}で ${c.baseUrl} から取得 → ${shown(out)}`);
   console.log(listButtons(result.envelope, { file: shown(out) }));
   return 0;
@@ -3179,20 +3459,37 @@ async function buttons(args) {
     const app = appOf(args, ctx);
     const list = listAppFolder(existingAppDir(ctx, app));
     if (!list.snapshots.length) throw new InputError(`${shown(list.dir)} にダウンロード / pull のファイルが無い（設定画面でダウンロードして inbox/ に置き take、または pull --app ${app}${envFlag(ctx)}）`);
-    settingsArg = shown(path10.join(list.dir, list.snapshots[0]));
+    settingsArg = shown(path13.join(list.dir, list.snapshots[0]));
   }
   if (!settingsArg) throw new UsageError("設定 JSON のパスが要る");
   const button = option(args, "button");
   if (args.includes("--button") && !button) throw new UsageError("--button にはボタン名を続ける");
-  console.log(listButtons(readJsonLimited(resolveRead(settingsArg)), { file: settingsArg, button }));
+  const file = resolveRead2(settingsArg);
+  const bytes = readFileSync10(file);
+  if (bytes.length > MAX_INPUT_BYTES) throw new InputError(`${shown(file)} が大きすぎる（${bytes.length.toLocaleString()} バイト。上限 ${MAX_INPUT_BYTES.toLocaleString()}）`);
+  let settings;
+  try {
+    settings = JSON.parse(bytes.toString("utf8"));
+  } catch (e) {
+    throw new InputError(`${shown(file)} を JSON として読めない: ${e.message}`);
+  }
+  if (!settings || typeof settings !== "object" || Array.isArray(settings)) throw new InputError(`${shown(file)} の最上位はオブジェクト`);
+  const text = listButtons(settings, { file: settingsArg, button });
+  if (flag(args, "json")) {
+    const menus = (Array.isArray(settings.pluginInfos) ? settings.pluginInfos : []).map((r) => String(r.menu ?? ""));
+    console.log(JSON.stringify({ file: shown(file), digest: digestOf(bytes), menus, text }, null, 2));
+  } else {
+    console.log(text);
+  }
   return 0;
 }
 async function take(args) {
   const ctx = context(args);
   if (!ctx.ws) throw new UsageError("take は environments.json があるときだけ使える（inbox/ のダウンロードをアプリのフォルダーへ移す）");
-  const r = takeInbox(process.cwd(), ctx.ws, args.includes("--env") ? ctx.env.name : void 0);
-  for (const m of r.moved) console.log(`${m.file} → ${m.to}${m.same ? "（同じものが既にあったので inbox から消した）" : ""}`);
+  const r = takeInbox(W.root, ctx.ws, args.includes("--env") ? ctx.env.name : void 0);
+  for (const m of r.moved) console.log(`${m.file} → ${m.to}${m.leftInInbox ? "（置いたが inbox に残った）" : m.same ? "（同じものが既にあったので inbox から消した）" : ""}`);
   for (const s of r.skipped) console.error(`移さない: ${s.file}（${s.reason}）`);
+  for (const w of r.warnings) console.error(`注意: ${w}`);
   if (!r.moved.length && !r.skipped.length) console.log(`${INBOX}/ に設定のファイルが無い`);
   return r.skipped.length ? 1 : 0;
 }
@@ -3204,15 +3501,16 @@ async function edit(args) {
     const app = appOf(args, ctx);
     const list = listAppFolder(existingAppDir(ctx, app));
     if (!list.snapshots.length) throw new InputError(`${shown(list.dir)} にダウンロード / pull のファイルが無い`);
-    src = path10.join(list.dir, list.snapshots[0]);
+    src = path13.join(list.dir, list.snapshots[0]);
   }
-  const file = resolveRead(src);
-  if (!SNAPSHOT_RE.test(path10.basename(file)) || !appFolderOfFile(process.cwd(), file)) throw new UsageError(`edit に渡すのはアプリのフォルダーのダウンロード / pull のファイル（rex0220-print-craft-app<番号>-<日時>.json）: ${src}`);
-  const dest = resolveWrite(editNameOf(file), WRITE_ROOTS.kintone);
-  if (existsSync7(dest)) {
+  const file = resolveRead2(src);
+  if (!SNAPSHOT_RE.test(path13.basename(file)) || !appFolderOfFile(W.root, file)) throw new UsageError(`edit に渡すのはアプリのフォルダーのダウンロード / pull のファイル（rex0220-print-craft-app<番号>-<日時>.json）: ${src}`);
+  const dest = resolveWrite2(editNameOf(file), WRITE_ROOTS.kintone);
+  if (existsSync8(dest)) {
     console.log(`既にある（続けて直す）: ${shown(dest)}`);
   } else {
-    writeText(dest, readTextLimited(file));
+    allow(dest, "settings");
+    writeText(dest, readTextLimited(file), WRITE_ROOTS.kintone, "settings");
     console.log(`${shown(file)} → ${shown(dest)}（ここを直す。ダウンロードのファイルは書き換えない）`);
   }
   console.log(`次: 直したら npx @rex0220/print-craft-authoring-tools normalize ${shown(dest)} → diff ${shown(file)} ${shown(dest)}`);
@@ -3240,40 +3538,41 @@ async function files(args) {
 async function preview(args) {
   const [settingsArg] = positional(args);
   if (!settingsArg) throw new UsageError("設定 JSON のパスが要る");
-  const settingsFile = resolveRead(settingsArg);
+  const settingsFile = resolveRead2(settingsArg);
   const folder = folderDefaults(settingsFile);
   const fieldsFile = fieldsFileOf(args, folder);
   const recordArg = option(args, "record");
   if (!recordArg) throw new UsageError("--record <record.json> が要る（record コマンドの出力。アプリのフォルダーの中のファイルならレコード番号だけでよい: --record 3）");
-  const recordFile = folder && /^\d+$/.test(recordArg) ? existingFile(path10.join(folder.dir, "records", `${recordArg}.json`), `record --app ${folder.appId} --id ${recordArg}`) : resolveRead(recordArg);
-  const outDir = resolveWriteDir(option(args, "out-dir") ?? (folder ? path10.join(folder.dir, "out") : "out"), WRITE_ROOTS.out);
+  const recordFile = folder && /^\d+$/.test(recordArg) ? existingFile(path13.join(folder.dir, "records", `${recordArg}.json`), `record --app ${folder.appId} --id ${recordArg}`) : resolveRead2(recordArg);
+  const outDir = resolveWriteDir2(option(args, "out-dir") ?? (folder ? path13.join(folder.dir, "out") : "out"), WRITE_ROOTS.out);
   const fieldsData = await readFieldsFile(fieldsFile);
   const engine = await engineFor();
   const result = await runPreview({
     settingsText: readTextLimited(settingsFile),
-    settingsFile: relativeSettingsPath(settingsArg),
+    settingsFile: relativeSettingsPath(settingsArg, W.root),
     fields: fieldsData,
     recordFile: readJsonLimited(recordFile),
     engine,
-    policy: loadPolicy(),
+    policy: loadPolicy({ cwd: W.root }),
     button: option(args, "button"),
     baseUrl: trustedBaseUrl(folder)
   });
   const written = [];
   if (!result.findings.hasErrors) {
     for (const r of result.results) {
-      const file = resolveWrite(path10.join(outDir, r.file), WRITE_ROOTS.out);
-      writeText(file, r.html);
+      const file = resolveWrite2(path13.join(outDir, r.file), WRITE_ROOTS.out);
+      allow(file, "preview");
+      writeText(file, r.html, WRITE_ROOTS.out, "preview");
       written.push(shown(file));
     }
   }
   if (flag(args, "json")) {
-    console.log(JSON.stringify({ summary: result.summary, findings: result.findings.items, results: result.results.map((r) => ({ menu: r.menu, file: shown(path10.join(outDir, r.file)), fileName: r.fileName, pages: r.pages, errors: r.errors })), skipped: result.skipped, written }, null, 2));
+    console.log(JSON.stringify({ summary: result.summary, findings: result.findings.items, results: result.results.map((r) => ({ menu: r.menu, file: shown(path13.join(outDir, r.file)), fileName: r.fileName, pages: r.pages, errors: r.errors })), skipped: result.skipped, written }, null, 2));
   } else {
     console.log(`preview: ${settingsArg}（${result.summary}）`);
     console.log(result.findings.format());
     for (const r of result.results) {
-      console.log(`${r.menu}: ${r.pages} ページ、ファイル名 ${r.fileName}${r.errors.length ? `、式のエラー ${r.errors.length}` : ""} → ${shown(path10.join(outDir, r.file))}`);
+      console.log(`${r.menu}: ${r.pages} ページ、ファイル名 ${r.fileName}${r.errors.length ? `、式のエラー ${r.errors.length}` : ""} → ${shown(path13.join(outDir, r.file))}`);
       for (const e of r.errors) console.log(`  ${e}`);
     }
     for (const s of result.skipped) console.log(`対象外: ${s}`);
@@ -3284,6 +3583,7 @@ async function preview(args) {
 }
 async function main(argv) {
   const [command, ...args] = argv;
+  W = createContext({ cwd: process.cwd(), env: process.env });
   rejectRemovedOptions(args);
   if (args.includes("--env")) context(args);
   switch (command) {
@@ -3330,7 +3630,7 @@ main(process.argv.slice(2)).then(
       console.error(`${e.message}
 ${USAGE}`);
       process.exitCode = 2;
-    } else if (e instanceof AuthError || e instanceof RestError || e instanceof NotAllowedError || e instanceof PluginZipError || e instanceof PolicyError || e instanceof InputError || e instanceof KintoneUrlError || e instanceof ButtonNotFoundError || e instanceof WorkspaceError) {
+    } else if (e instanceof AuthError || e instanceof RestError || e instanceof NotAllowedError || e instanceof PluginZipError || e instanceof PolicyError || e instanceof InputError || e instanceof KintoneUrlError || e instanceof ButtonNotFoundError || e instanceof WorkspaceError || e instanceof PermissionError) {
       console.error(e.message);
       process.exitCode = 1;
     } else {