@rex0220/print-craft-authoring-tools 1.2.0 → 1.3.0

package/dist/core.mjs

@@ -0,0 +1,3422 @@
+/*! @rex0220/print-craft-authoring-tools/core 1.3.0 (c) rex0220. MIT License. 計算式エンジンと印刷屋のコードは利用者の印刷屋プラグインの zip から読む（このファイルには含まれない）。commit 5abbe71. */
+
+// src/safe-path.ts
+import { lstatSync, realpathSync } from "node:fs";
+import path from "node:path";
+var PathError = class extends Error {
+};
+var WRITE_ROOTS = {
+  fields: ["fields", "kintone"],
+  records: ["records", "kintone"],
+  settings: ["settings", "temp", "kintone"],
+  out: ["out", "kintone"],
+  kintone: ["kintone"]
+};
+var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
+function norm(p) {
+  const r = path.resolve(p);
+  return process.platform === "win32" ? r.toLowerCase() : r;
+}
+function realResolve(target, cwd) {
+  const abs = path.resolve(cwd, target);
+  let dir = abs;
+  const rest = [];
+  for (; ; ) {
+    try {
+      lstatSync(dir);
+      break;
+    } catch (e) {
+      const code = e.code;
+      if (code === "ENOENT" || code === "ENOTDIR") {
+        const parent = path.dirname(dir);
+        if (parent === dir) throw new PathError(`パスを解決できない: ${target}`);
+        rest.unshift(path.basename(dir));
+        dir = parent;
+        continue;
+      }
+      throw new PathError(`パスを解決できない（アクセスできない: ${code ?? "不明"}）: ${target}`);
+    }
+  }
+  let real;
+  try {
+    real = realpathSync.native(dir);
+  } catch (e) {
+    throw new PathError(`パスを解決できない（リンク切れ・ループ・アクセスできない場所: ${e.code ?? "不明"}）: ${target}`);
+  }
+  return rest.length ? path.join(real, ...rest) : real;
+}
+function isInside(child, parent) {
+  const c = norm(child);
+  const p = norm(parent);
+  return c === p || c.startsWith(p.endsWith(path.sep) ? p : p + path.sep);
+}
+function resolveRead(target, cwd) {
+  if (!target || typeof target !== "string") throw new PathError("ファイルのパスが要る");
+  const real = realResolve(target, cwd);
+  const cwdReal = realResolve(".", cwd);
+  if (!isInside(real, cwdReal)) throw new PathError(`読むファイルは作業フォルダーの中に置く: ${target}`);
+  const rel2 = path.relative(cwdReal, real).replace(/\\/g, "/");
+  if (/^\.env(\.|$)/i.test(path.basename(real)) || /^(node_modules|\.git)(\/|$)/i.test(rel2)) throw new PathError(`このファイルは tools では読まない: ${target}`);
+  return real;
+}
+function resolveWrite(target, roots, cwd) {
+  if (!target || typeof target !== "string") throw new PathError("書き込み先のパスが要る");
+  const real = realResolve(target, cwd);
+  const cwdReal = realResolve(".", cwd);
+  if (!isInside(real, cwdReal)) throw new PathError(`書き込み先は作業フォルダーの中: ${target}`);
+  const ok = roots.some((r) => {
+    const root = path.join(cwdReal, r);
+    return isInside(real, root) && norm(real) !== norm(root);
+  });
+  if (!ok) throw new PathError(`書き込み先は ${roots.map((r) => `${r}/`).join(" か ")} の下: ${target}`);
+  const base = path.basename(real);
+  if (WINDOWS_RESERVED.test(base) || /[. ]$/.test(base)) throw new PathError(`使えないファイル名: ${base}`);
+  return real;
+}
+function safeFileName(name, fallback) {
+  let s = name.replace(/[\\/:*?"<>|\u0000-\u001f\u007f]/g, "_").replace(/[. ]+$/g, "").trim();
+  if (!s || WINDOWS_RESERVED.test(s)) s = fallback;
+  return s.length > 120 ? s.slice(0, 120) : s;
+}
+
+// src/context.ts
+function createContext(opt) {
+  return Object.freeze({ root: realResolve(".", opt.cwd), env: Object.freeze({ ...opt.env }) });
+}
+
+// src/permission.ts
+import { existsSync as existsSync2 } from "node:fs";
+import path3 from "node:path";
+
+// src/workspace.ts
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import path2 from "node:path";
+
+// src/kintone-url.ts
+var KINTONE_HOST_SUFFIXES = [".cybozu.com", ".kintone.com", ".cybozu.cn"];
+var KintoneUrlError = class extends Error {
+};
+function normalizeKintoneBaseUrl(raw) {
+  const text = String(raw ?? "").trim();
+  let u;
+  try {
+    u = new URL(text);
+  } catch {
+    throw new KintoneUrlError(`kintone の URL として読めない: ${text.slice(0, 80)}`);
+  }
+  if (u.protocol !== "https:") throw new KintoneUrlError("kintone の URL は https で始める");
+  if (u.username || u.password) throw new KintoneUrlError("kintone の URL にユーザー名やパスワード（@）を入れない");
+  if (u.port) throw new KintoneUrlError("kintone の URL にポートを付けない");
+  if (u.search || u.hash) throw new KintoneUrlError("kintone の URL にクエリや # を付けない");
+  if (u.pathname !== "/" && u.pathname !== "") throw new KintoneUrlError("kintone の URL にパスを付けない（https://<サブドメイン>.cybozu.com だけ）");
+  const host = u.hostname.toLowerCase();
+  const wellFormed = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host);
+  const suffix = KINTONE_HOST_SUFFIXES.find((s) => host.endsWith(s) && host.length > s.length);
+  if (!wellFormed || !suffix) {
+    throw new KintoneUrlError(`kintone のドメインではない: ${host}（使えるのは ${KINTONE_HOST_SUFFIXES.map((s) => `*${s}`).join(" / ")}）`);
+  }
+  return `https://${host}`;
+}
+function isKintoneBaseUrl(raw) {
+  try {
+    normalizeKintoneBaseUrl(raw);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/workspace.ts
+var WORKSPACE_FILE = "environments.json";
+var KINTONE_ROOT = "kintone";
+var INBOX = "inbox";
+var SNAPSHOT_PREFIX = "rex0220-print-craft";
+var SNAPSHOT_RE = /^rex0220-print-craft-app(\d+)-(\d{8})-(\d{6})\.json$/;
+var EDIT_RE = /^rex0220-print-craft-app(\d+)-(\d{8})-(\d{6})-edit\.json$/;
+var ENV_NAME = /^[A-Za-z0-9_-]{1,32}$/;
+var ENV_FILE = /^(\.env|env\/[A-Za-z0-9._-]{1,64}\.env)$/;
+var MAX_BYTES = 256 * 1024;
+var WorkspaceError = class extends Error {
+};
+var ENV_ROLES = ["development", "production"];
+var isEnvName = (s) => ENV_NAME.test(s);
+function parseWorkspace(text, where = WORKSPACE_FILE) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (e) {
+    throw new WorkspaceError(`${where} を JSON として読めない: ${e.message}`);
+  }
+  const obj = (v, at) => {
+    if (!v || typeof v !== "object" || Array.isArray(v)) throw new WorkspaceError(`${where}: ${at} はオブジェクト`);
+    return v;
+  };
+  const root = obj(raw, "最上位");
+  for (const k of Object.keys(root)) if (!["default", "environments", "apps"].includes(k)) throw new WorkspaceError(`${where}: 使えるキーは default / environments / apps: ${k}`);
+  const envsRaw = obj(root.environments, "environments");
+  const environments = {};
+  for (const [name, v] of Object.entries(envsRaw)) {
+    if (!isEnvName(name)) throw new WorkspaceError(`${where}: 環境の名前は英数字と _ - の 32 文字まで: ${name}`);
+    const e = obj(v, `environments.${name}`);
+    for (const k of Object.keys(e)) if (!["baseUrl", "envFile", "role"].includes(k)) throw new WorkspaceError(`${where}: environments.${name} に使えるキーは baseUrl / envFile / role: ${k}`);
+    if (e.role !== void 0 && !ENV_ROLES.includes(e.role)) throw new WorkspaceError(`${where}: environments.${name}.role は development（開発）か production（本番）: ${String(e.role)}`);
+    const role = e.role === void 0 ? "unclassified" : e.role;
+    let baseUrl;
+    try {
+      baseUrl = normalizeKintoneBaseUrl(String(e.baseUrl ?? ""));
+    } catch (err) {
+      throw new WorkspaceError(`${where}: environments.${name}.baseUrl が不正: ${err instanceof KintoneUrlError ? err.message : String(err)}`);
+    }
+    const envFile = e.envFile === void 0 ? ".env" : String(e.envFile).replace(/\\/g, "/");
+    if (!ENV_FILE.test(envFile)) throw new WorkspaceError(`${where}: environments.${name}.envFile は .env か env/<名前>.env: ${envFile}`);
+    environments[name] = { name, role, baseUrl, host: new URL(baseUrl).hostname, envFile };
+  }
+  if (Object.keys(environments).length === 0) throw new WorkspaceError(`${where}: environments に環境が 1 つも無い`);
+  const defaultEnv = root.default === void 0 ? Object.keys(environments)[0] : String(root.default);
+  if (!environments[defaultEnv]) throw new WorkspaceError(`${where}: default の環境が environments に無い: ${defaultEnv}`);
+  const apps = [];
+  if (root.apps !== void 0) {
+    if (!Array.isArray(root.apps)) throw new WorkspaceError(`${where}: apps は配列`);
+    const names = /* @__PURE__ */ new Set();
+    for (const [i, v] of root.apps.entries()) {
+      const a = obj(v, `apps[${i}]`);
+      const name = typeof a.name === "string" ? a.name.trim() : "";
+      if (!name || name.length > 100 || /^\d+$/.test(name)) throw new WorkspaceError(`${where}: apps[${i}].name は 100 文字までの名前（数字だけは不可）`);
+      if (names.has(name)) throw new WorkspaceError(`${where}: apps の名前が重複: ${name}`);
+      names.add(name);
+      const ids = {};
+      for (const [k, n] of Object.entries(a)) {
+        if (k === "name") continue;
+        if (!environments[k]) throw new WorkspaceError(`${where}: apps[${i}] の ${k} は environments に無い環境`);
+        if (typeof n !== "number" || !Number.isInteger(n) || n <= 0) throw new WorkspaceError(`${where}: apps[${i}].${k} はアプリ番号（正の整数）`);
+        ids[k] = n;
+      }
+      apps.push({ name, ids });
+    }
+  }
+  return { defaultEnv, environments, apps };
+}
+function loadWorkspace(cwd) {
+  const file = path2.join(cwd, WORKSPACE_FILE);
+  if (!existsSync(file)) return null;
+  const size = statSync(file).size;
+  if (size > MAX_BYTES) throw new WorkspaceError(`${WORKSPACE_FILE} が大きすぎる（${size} バイト）`);
+  return parseWorkspace(readFileSync(file, "utf8"));
+}
+function pickEnv(ws, name) {
+  const n = name ?? ws.defaultEnv;
+  const e = ws.environments[n];
+  if (!e) throw new WorkspaceError(`環境「${n}」は ${WORKSPACE_FILE} に無い（${Object.keys(ws.environments).join(", ")}）`);
+  return e;
+}
+function resolveApp(ws, env, app) {
+  if (/^\d+$/.test(app)) {
+    const appId2 = Number(app);
+    const def2 = ws.apps.find((a) => a.ids[env.name] === appId2);
+    return { appId: appId2, ...def2 ? { name: def2.name } : {} };
+  }
+  const def = ws.apps.find((a) => a.name === app);
+  if (!def) throw new WorkspaceError(`アプリ「${app}」は ${WORKSPACE_FILE} の apps に無い（番号で書くか、apps に足す）`);
+  const appId = def.ids[env.name];
+  if (!appId) throw new WorkspaceError(`アプリ「${app}」の環境「${env.name}」の番号が ${WORKSPACE_FILE} に無い`);
+  return { appId, name: def.name };
+}
+function folderNameOf(appId, appName) {
+  const name = safeFileName(appName, "");
+  return name ? `${appId}-${name}` : String(appId);
+}
+function hostDirOf(cwd, env) {
+  return path2.join(cwd, KINTONE_ROOT, env.host);
+}
+function findAppDir(cwd, env, appId) {
+  const hostDir = hostDirOf(cwd, env);
+  if (!existsSync(hostDir)) return null;
+  const hits = readdirSync(hostDir, { withFileTypes: true }).filter((d) => d.isDirectory() && (d.name === String(appId) || d.name.startsWith(`${appId}-`))).map((d) => d.name);
+  if (hits.length > 1) throw new WorkspaceError(`アプリ ${appId} のフォルダーが 2 つある: ${hits.join(", ")}（kintone/${env.host}/ の下を 1 つにする）`);
+  return hits.length ? path2.join(hostDir, hits[0]) : null;
+}
+function appDirFor(cwd, env, appId, appName) {
+  return findAppDir(cwd, env, appId) ?? path2.join(hostDirOf(cwd, env), folderNameOf(appId, appName));
+}
+function appFolderOfFile(cwd, file) {
+  const rel2 = path2.relative(path2.join(cwd, KINTONE_ROOT), path2.resolve(cwd, file)).replace(/\\/g, "/");
+  if (!rel2 || rel2.startsWith("..")) return null;
+  const [host, folder, ...rest] = rel2.split("/");
+  if (!host || !folder || rest.length === 0) return null;
+  const m = folder.match(/^(\d+)(?:-|$)/);
+  if (!m) return null;
+  return { dir: path2.join(cwd, KINTONE_ROOT, host, folder), host, appId: Number(m[1]) };
+}
+var pad = (n) => String(n).padStart(2, "0");
+function snapshotNameOf(appId, now = /* @__PURE__ */ new Date()) {
+  return `${SNAPSHOT_PREFIX}-app${appId}-${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}.json`;
+}
+function editNameOf(snapshotFile) {
+  return snapshotFile.replace(/\.json$/, "-edit.json");
+}
+var stampOf = (name) => {
+  const m = name.match(/-(\d{8})-(\d{6})(?:-edit)?\.json$/);
+  return m ? `${m[1]}${m[2]}` : "";
+};
+var newestFirst = (a, b) => stampOf(b).localeCompare(stampOf(a)) || b.localeCompare(a);
+function listAppFolder(dir) {
+  const files = existsSync(dir) ? readdirSync(dir, { withFileTypes: true }) : [];
+  const names = files.filter((d) => d.isFile() && d.name.endsWith(".json")).map((d) => d.name);
+  const sub = (name, filter) => {
+    const p = path2.join(dir, name);
+    return existsSync(p) ? readdirSync(p).filter(filter).sort() : [];
+  };
+  return {
+    dir,
+    hasFields: names.includes("fields.json"),
+    snapshots: names.filter((n) => SNAPSHOT_RE.test(n)).sort(newestFirst),
+    edits: names.filter((n) => EDIT_RE.test(n)).sort(newestFirst),
+    reports: names.filter((n) => n !== "fields.json" && !SNAPSHOT_RE.test(n) && !EDIT_RE.test(n)).sort(),
+    records: sub("records", (n) => n.endsWith(".json")),
+    outs: sub("out", (n) => n.endsWith(".html")).length
+  };
+}
+function envsOfHost(ws, host) {
+  return Object.values(ws.environments).filter((e) => e.host === host);
+}
+function envOfAppFolder(ws, host, appId) {
+  const hits = envsOfHost(ws, host);
+  if (hits.length === 1) return hits[0];
+  const byApp = hits.filter((e) => ws.apps.some((a) => a.ids[e.name] === appId));
+  return byApp.length === 1 ? byApp[0] : void 0;
+}
+
+// src/permission.ts
+var PermissionError = class extends Error {
+};
+var ALLOWED_CLASSES = {
+  settings: ["edit", "report"],
+  snapshot: ["snapshot"],
+  fields: ["fields"],
+  record: ["record"],
+  preview: ["out"]
+};
+var OP_LABEL = {
+  settings: "設定（-edit.json と新しい帳票）",
+  snapshot: "新しい名前のダウンロード / pull",
+  fields: "fields.json",
+  record: "records/ の下",
+  preview: "out/ の下"
+};
+function classOfAppPath(relInFolder) {
+  const rel2 = relInFolder.replace(/\\/g, "/");
+  if (rel2.startsWith("records/")) return rel2.toLowerCase().endsWith(".json") ? "record" : "other";
+  if (rel2.startsWith("out/")) return "out";
+  if (rel2.includes("/")) return "other";
+  if (rel2 === "fields.json") return "fields";
+  if (SNAPSHOT_RE.test(rel2)) return "snapshot";
+  if (EDIT_RE.test(rel2)) return "edit";
+  if (rel2.toLowerCase().endsWith(".json")) return "report";
+  return "other";
+}
+function roleOfTarget(root, file) {
+  const abs = path3.resolve(root, file);
+  if (!isInside(abs, path3.join(root, KINTONE_ROOT))) return null;
+  const ws = loadWorkspace(root);
+  const folder = appFolderOfFile(root, abs);
+  const cls = folder ? classOfAppPath(path3.relative(folder.dir, abs)) : void 0;
+  if (!ws) return { role: "unclassified", why: `${WORKSPACE_FILE} が無い`, cls };
+  if (!folder) return { role: "unclassified", why: "アプリのフォルダー（kintone/<ホスト名>/<番号>-…/）の中でない" };
+  const env = envOfAppFolder(ws, folder.host, folder.appId);
+  if (!env) return { role: "unclassified", why: `フォルダー（${folder.host} のアプリ ${folder.appId}）がどの環境のものか ${WORKSPACE_FILE} から決まらない（同じホストの環境が 2 つ以上あるときは、apps にアプリの番号を足す）`, cls };
+  return env.role === "unclassified" ? { role: "unclassified", envName: env.name, why: `環境「${env.name}」に role が無い`, cls } : { role: env.role, envName: env.name, cls };
+}
+function assertChangeAllowed(root, file, op) {
+  const target = roleOfTarget(root, file);
+  if (!target) return;
+  const abs = path3.resolve(root, file);
+  if (target.role === "unclassified") {
+    throw new PermissionError(`${target.why}ので kintone/ の下を変更できない。${WORKSPACE_FILE} の環境に role（development か production）を書く（利用者が書く）`);
+  }
+  if (target.role === "production" && op !== "snapshot") {
+    throw new PermissionError(`環境「${target.envName}」は本番（role: production）なので変更できない。開発の環境で作る・直す（本番のフォルダーは pull / ダウンロードで今の設定を見るだけ）`);
+  }
+  const cls = target.cls ?? "other";
+  if (cls === "snapshot" && existsSync2(abs)) {
+    throw new PermissionError(`ダウンロード / pull のファイルは書き換えない: ${path3.relative(root, abs)}。edit で -edit.json に写して直す`);
+  }
+  if (!ALLOWED_CLASSES[op].includes(cls)) {
+    throw new PermissionError(`この操作でアプリのフォルダーに書けるのは ${OP_LABEL[op]} だけ: ${path3.relative(root, abs)}`);
+  }
+}
+
+// src/meta.ts
+import { execFileSync } from "node:child_process";
+import { readFileSync as readFileSync2 } from "node:fs";
+import path5 from "node:path";
+
+// src/paths.ts
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+var here = path4.dirname(fileURLToPath(import.meta.url));
+var AUTHORING_ROOT = path4.resolve(here, "..");
+var REPO_ROOT = path4.resolve(AUTHORING_ROOT, "..");
+var VENDOR_DIR = path4.join(AUTHORING_ROOT, "vendor");
+var MOMENT_FILE = path4.join(VENDOR_DIR, "moment-with-locales.min.js");
+
+// src/meta.ts
+var PRINT_CRAFT_PLUGIN_ID = "lcapkanpjdabgphknkabojmcfhonhkhp";
+var MIN_PLUGIN_VERSION = 6;
+var SUPPORTED_API_VERSIONS = [1, 2];
+function isSupportedPluginVersion(version) {
+  return /^[1-9]\d{0,5}$/.test(version) && Number(version) >= MIN_PLUGIN_VERSION;
+}
+var REQUIRED_API = {
+  apiVersion: "number",
+  pluginVersion: "string",
+  pluginId: "string",
+  CONFIG_SCHEMA: "object",
+  CONFIG_LIMITS: "object",
+  PAGE_SIZES: "object",
+  DPI_OPTIONS: "object",
+  PAPER_NAMES: "object",
+  PRINT_MODES: "object",
+  buildMenuRows: "function",
+  normalizeTagsInfo: "function",
+  normalizeCssRows: "function",
+  toSavedRows: "function",
+  computeUsage: "function",
+  computePluginUOG: "function",
+  createCheckRecord: "function",
+  createFieldsInfo: "function",
+  isTargetType: "function",
+  stripComments: "function",
+  defaultCssRows: "function",
+  defaultMenuInfo: "function",
+  expandFields: "function",
+  buildReportCss: "function",
+  fileNameOf: "function",
+  formulaOf: "function",
+  mountReportHtml: "function",
+  replaceTags: "function",
+  getPaperSize: "function",
+  webFontOf: "function",
+  DUMMY_IMAGE: "string",
+  validate: "function",
+  parseJsonSafely: "function",
+  ValidationError: "function",
+  writeConfig: "function",
+  DEFAULT_LIMITS: "object",
+  ConfigStoreError: "function",
+  // pull（アプリのプラグインの設定を読んで封筒形式にする。2026-10-05）
+  readConfig: "function",
+  buildExportData: "function"
+};
+function gitCommit(dir) {
+  try {
+    const head = execFileSync("git", ["-C", dir, "rev-parse", "--short", "HEAD"], { encoding: "utf8" }).trim();
+    const dirty = execFileSync("git", ["-C", dir, "status", "--porcelain", "--untracked-files=no"], { encoding: "utf8" }).trim() !== "";
+    return dirty ? `${head}+dirty` : head;
+  } catch {
+    return "unknown";
+  }
+}
+function devMeta() {
+  const pkg = JSON.parse(readFileSync2(path5.join(AUTHORING_ROOT, "package.json"), "utf8"));
+  return { toolsVersion: pkg.version, pluginId: PRINT_CRAFT_PLUGIN_ID, minPluginVersion: MIN_PLUGIN_VERSION, supportedApiVersions: [...SUPPORTED_API_VERSIONS], commit: gitCommit(AUTHORING_ROOT), builtAt: "", mode: "dev" };
+}
+function toolsMeta() {
+  if (true) return JSON.parse('{"toolsVersion":"1.3.0","pluginId":"lcapkanpjdabgphknkabojmcfhonhkhp","minPluginVersion":6,"supportedApiVersions":[1,2],"commit":"5abbe71","builtAt":"2026-10-09T13:34:14.744Z","mode":"build"}');
+  return devMeta();
+}
+
+// src/engine.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import path6 from "node:path";
+import vm from "node:vm";
+
+// src/plugin-zip.ts
+import { createHash } from "node:crypto";
+import { readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
+import { inflateRawSync } from "node:zlib";
+var SIG_EOCD = 101010256;
+var SIG_CENTRAL = 33639248;
+var SIG_LOCAL = 67324752;
+var PluginZipError = class extends Error {
+};
+var ZIP_LIMITS = {
+  maxOuterBytes: 64 * 1024 * 1024,
+  maxEntries: 500,
+  maxEntryBytes: 32 * 1024 * 1024,
+  maxTotalBytes: 128 * 1024 * 1024
+};
+var CRC_TABLE = (() => {
+  const t = new Uint32Array(256);
+  for (let n = 0; n < 256; n++) {
+    let c = n;
+    for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+    t[n] = c >>> 0;
+  }
+  return t;
+})();
+function crc32(buf) {
+  let c = 4294967295;
+  for (let i = 0; i < buf.length; i++) c = CRC_TABLE[(c ^ buf[i]) & 255] ^ c >>> 8;
+  return (c ^ 4294967295) >>> 0;
+}
+function u16(buf, p, what) {
+  if (p < 0 || p + 2 > buf.length) throw new PluginZipError(`zip が壊れている（${what} が範囲外）`);
+  return buf.readUInt16LE(p);
+}
+function u32(buf, p, what) {
+  if (p < 0 || p + 4 > buf.length) throw new PluginZipError(`zip が壊れている（${what} が範囲外）`);
+  return buf.readUInt32LE(p);
+}
+function unzip(buf, limits = ZIP_LIMITS) {
+  if (buf.length > limits.maxOuterBytes) throw new PluginZipError(`zip が大きすぎる（${buf.length} バイト。上限 ${limits.maxOuterBytes}）`);
+  const minEocd = 22;
+  let eocd = -1;
+  for (let i = buf.length - minEocd; i >= Math.max(0, buf.length - minEocd - 65535); i--) {
+    if (buf.readUInt32LE(i) === SIG_EOCD) {
+      eocd = i;
+      break;
+    }
+  }
+  if (eocd < 0) throw new PluginZipError("zip の終端（EOCD）が無い");
+  const total = u16(buf, eocd + 10, "entry 数");
+  const cdSize = u32(buf, eocd + 12, "central directory の大きさ");
+  const cdOffset = u32(buf, eocd + 16, "central directory の位置");
+  if (total > limits.maxEntries) throw new PluginZipError(`zip の entry が多すぎる（${total}。上限 ${limits.maxEntries}）`);
+  if (cdOffset + cdSize > eocd) throw new PluginZipError("zip が壊れている（central directory が終端を越える）");
+  const out = /* @__PURE__ */ new Map();
+  let p = cdOffset;
+  let totalBytes = 0;
+  for (let n = 0; n < total; n++) {
+    if (u32(buf, p, "central directory") !== SIG_CENTRAL) throw new PluginZipError(`zip の central directory が壊れている（entry ${n}）`);
+    const method = u16(buf, p + 10, "圧縮方式");
+    const crc = u32(buf, p + 16, "CRC");
+    const compSize = u32(buf, p + 20, "圧縮後の大きさ");
+    const uncompSize = u32(buf, p + 24, "展開後の大きさ");
+    const nameLen = u16(buf, p + 28, "名前の長さ");
+    const extraLen = u16(buf, p + 30, "extra の長さ");
+    const commentLen = u16(buf, p + 32, "コメントの長さ");
+    const localOffset = u32(buf, p + 42, "local header の位置");
+    if (p + 46 + nameLen > eocd) throw new PluginZipError(`zip が壊れている（entry ${n} の名前が範囲外）`);
+    const name = buf.subarray(p + 46, p + 46 + nameLen).toString("utf8");
+    p += 46 + nameLen + extraLen + commentLen;
+    if (name.endsWith("/")) continue;
+    if (name.startsWith("/") || name.split("/").includes("..")) throw new PluginZipError(`zip の entry 名が不正: ${name}`);
+    if (out.has(name)) throw new PluginZipError(`zip に同じ名前の entry が 2 つある: ${name}`);
+    if (uncompSize > limits.maxEntryBytes) throw new PluginZipError(`zip の entry が大きすぎる: ${name}（${uncompSize} バイト。上限 ${limits.maxEntryBytes}）`);
+    totalBytes += uncompSize;
+    if (totalBytes > limits.maxTotalBytes) throw new PluginZipError(`zip の展開後の合計が大きすぎる（上限 ${limits.maxTotalBytes} バイト）`);
+    if (u32(buf, localOffset, `local header（${name}）`) !== SIG_LOCAL) throw new PluginZipError(`zip の local header が壊れている: ${name}`);
+    const localNameLen = u16(buf, localOffset + 26, "local の名前の長さ");
+    const localExtraLen = u16(buf, localOffset + 28, "local の extra の長さ");
+    const localName = buf.subarray(localOffset + 30, localOffset + 30 + localNameLen).toString("utf8");
+    if (localName !== name) throw new PluginZipError(`zip の entry 名が central directory と local header で違う: ${name} / ${localName}`);
+    const dataStart = localOffset + 30 + localNameLen + localExtraLen;
+    if (dataStart + compSize > cdOffset) throw new PluginZipError(`zip が壊れている（${name} のデータが central directory に重なる）`);
+    const data = buf.subarray(dataStart, dataStart + compSize);
+    let content;
+    if (method === 0) content = Buffer.from(data);
+    else if (method === 8) {
+      try {
+        content = inflateRawSync(data, { maxOutputLength: Math.max(1, uncompSize) });
+      } catch (e) {
+        throw new PluginZipError(`zip の entry を展開できない: ${name}（${e instanceof Error ? e.message : String(e)}）`);
+      }
+    } else throw new PluginZipError(`zip の圧縮方式 ${method} には対応していない: ${name}`);
+    if (content.length !== uncompSize) throw new PluginZipError(`zip の entry の大きさが合わない: ${name}（${content.length} / ${uncompSize}）`);
+    if (crc32(content) !== crc) throw new PluginZipError(`zip の entry の CRC が合わない（壊れているか改変されている）: ${name}`);
+    out.set(name, content);
+  }
+  return out;
+}
+var ENGINE_ENTRY = "desktop_js/KintoneFormulaPCraft.min.js";
+var BIGNUMBER_ENTRY = "desktop_js/bignumber.min.js";
+var MOMENT_TZ_ENTRY = "desktop_js/moment-timezone-with-data.min.js";
+var API_ENTRY = "config_js/print-craft-authoring-api.js";
+var MANIFEST_ENTRY = "manifest.json";
+function sha256Hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+function pluginIdOf(publicKey) {
+  return sha256Hex(publicKey).slice(0, 32).replace(/[0-9a-f]/g, (c) => "abcdefghijklmnop"["0123456789abcdef".indexOf(c)]);
+}
+function readPluginZip(file) {
+  let outer;
+  try {
+    const size = statSync2(file).size;
+    if (size > ZIP_LIMITS.maxOuterBytes) throw new PluginZipError(`大きすぎる（${size} バイト）`);
+    outer = unzip(readFileSync3(file));
+  } catch (e) {
+    throw new PluginZipError(`印刷屋の zip を読めない: ${file}（${e instanceof Error ? e.message : String(e)}）`);
+  }
+  const contents = outer.get("contents.zip");
+  if (!contents) throw new PluginZipError(`印刷屋の zip ではない（contents.zip が無い）: ${file}`);
+  let inner;
+  try {
+    inner = unzip(contents);
+  } catch (e) {
+    throw new PluginZipError(`印刷屋の zip の contents.zip を読めない: ${file}（${e instanceof Error ? e.message : String(e)}）`);
+  }
+  const need = (name) => {
+    const b = inner.get(name);
+    if (!b) throw new PluginZipError(`印刷屋の zip に ${name} が無い: ${file}`);
+    return b;
+  };
+  let manifest;
+  try {
+    manifest = JSON.parse(need(MANIFEST_ENTRY).toString("utf8"));
+  } catch (e) {
+    throw new PluginZipError(`印刷屋の zip の manifest.json を読めない: ${file}（${e instanceof Error ? e.message : String(e)}）`);
+  }
+  if (!manifest || typeof manifest !== "object") throw new PluginZipError(`印刷屋の zip の manifest.json が不正: ${file}`);
+  const engine = need(ENGINE_ENTRY);
+  const bignumber = need(BIGNUMBER_ENTRY);
+  const momentTimezone = need(MOMENT_TZ_ENTRY);
+  const api = inner.get(API_ENTRY);
+  const pubkey = outer.get("PUBKEY");
+  return {
+    from: file,
+    ...pubkey ? { pluginId: pluginIdOf(pubkey) } : {},
+    manifest,
+    pluginVersion: String(manifest.version ?? ""),
+    engine: engine.toString("utf8"),
+    bignumber: bignumber.toString("utf8"),
+    momentTimezone: momentTimezone.toString("utf8"),
+    api: api?.toString("utf8"),
+    sha256: {
+      engine: sha256Hex(engine),
+      ...api ? { api: sha256Hex(api) } : {},
+      bignumber: sha256Hex(bignumber),
+      momentTimezone: sha256Hex(momentTimezone),
+      contents: sha256Hex(contents)
+    }
+  };
+}
+
+// src/engine.ts
+var DEFAULT_CONTEXT_BASE_URL = "https://example.cybozu.com";
+var DEFAULT_USER = { id: "1", code: "authoring", name: "authoring", email: "", language: "ja" };
+var loaded = null;
+function resolvePluginSources(opt = {}, mode = opt.mode ?? toolsMeta().mode) {
+  const zip = opt.pluginZip;
+  if (zip) {
+    if (!existsSync3(zip)) throw new PluginZipError(`印刷屋の zip が無い: ${zip}（.env の PCRAFT_PLUGIN_ZIP）`);
+    return { ...readPluginZip(zip), kind: "zip" };
+  }
+  const dev = opt.devPluginDir;
+  const devAllowed = mode === "dev" && !!dev;
+  if (!devAllowed) {
+    throw new PluginZipError(`印刷屋の zip の場所が分からない。.env に PCRAFT_PLUGIN_ZIP=<印刷屋プラグインの zip のパス> を書く${mode === "dev" ? "（開発中に隣の print-craft の prod/ を読むなら環境変数 PCRAFT_ALLOW_DEV_PLUGIN=1）" : ""}`);
+  }
+  if (!dev || !existsSync3(path6.join(dev, ENGINE_ENTRY))) throw new PluginZipError(`印刷屋の zip の場所が分からない（PCRAFT_ALLOW_DEV_PLUGIN=1 だが print-craft の prod/ が無い: ${dev}）。.env に PCRAFT_PLUGIN_ZIP を書く`);
+  const read = (rel2) => readFileSync4(path6.join(dev, rel2), "utf8");
+  const apiFile = path6.join(dev, API_ENTRY);
+  const engine = read(ENGINE_ENTRY);
+  const bignumber = read(BIGNUMBER_ENTRY);
+  const momentTimezone = read(MOMENT_TZ_ENTRY);
+  const api = existsSync3(apiFile) ? readFileSync4(apiFile, "utf8") : void 0;
+  const manifest = JSON.parse(read(MANIFEST_ENTRY));
+  return {
+    kind: "dev",
+    from: dev,
+    manifest,
+    pluginVersion: String(manifest.version ?? ""),
+    engine,
+    bignumber,
+    momentTimezone,
+    api,
+    sha256: { engine: sha256Hex(engine), ...api ? { api: sha256Hex(api) } : {}, bignumber: sha256Hex(bignumber), momentTimezone: sha256Hex(momentTimezone) }
+  };
+}
+async function loadEngine(opt = {}) {
+  if (loaded) return loaded;
+  const meta = toolsMeta();
+  const src = resolvePluginSources(opt, opt.mode ?? meta.mode);
+  const warnings = [];
+  if (src.kind === "zip" && src.pluginId !== PRINT_CRAFT_PLUGIN_ID) {
+    throw new PluginZipError(`印刷屋プラグインの zip ではない（プラグイン ID ${src.pluginId ?? "不明（PUBKEY が無い）"}。印刷屋は ${PRINT_CRAFT_PLUGIN_ID}）: ${src.from}。配布元から入手した印刷屋の zip を PCRAFT_PLUGIN_ZIP に書く`);
+  }
+  if (src.kind === "dev") warnings.push(`開発中の print-craft（${src.from}。PCRAFT_ALLOW_DEV_PLUGIN=1）から読む。プラグイン ID は確かめない`);
+  if (!isSupportedPluginVersion(src.pluginVersion)) {
+    throw new PluginZipError(`印刷屋プラグインの版 ${src.pluginVersion || "不明"}（${src.from}）には対応していない。tools が扱うのは Ver.${MIN_PLUGIN_VERSION} 以降`);
+  }
+  if (!src.api) throw new PluginZipError(`印刷屋の zip に ${API_ENTRY} が無い（Ver.${MIN_PLUGIN_VERSION} 以降の zip が要る）: ${src.from}`);
+  const g = globalThis;
+  const { Window } = await import("happy-dom");
+  const ctx = { baseUrl: DEFAULT_CONTEXT_BASE_URL, appId: 1, loginUser: { ...DEFAULT_USER } };
+  const window = new Window({ url: `${ctx.baseUrl}/k/${ctx.appId}/show` });
+  for (const k of ["document", "Node", "Element", "HTMLElement", "HTMLDivElement", "HTMLImageElement", "HTMLIFrameElement", "DOMParser", "Event", "CSS", "getComputedStyle", "Blob", "File", "URL", "DOMRect", "requestAnimationFrame", "cancelAnimationFrame"]) {
+    const v = window[k];
+    if (v !== void 0 && g[k] === void 0) g[k] = k === "getComputedStyle" && typeof v === "function" ? v.bind(window) : v;
+  }
+  g.window = window;
+  const kintone = {
+    getLoginUser: () => ({ ...ctx.loginUser, isGuest: false }),
+    app: { getId: () => ctx.appId },
+    mobile: { app: { getId: () => ctx.appId } },
+    api: Object.assign(() => Promise.reject(new Error("kintone.api is not available in authoring tools")), {
+      url: (p, _guest) => `${ctx.baseUrl}${p.startsWith("/") ? "" : "/"}${p}`
+    }),
+    $PLUGIN_ID: "authoring"
+  };
+  g.kintone = kintone;
+  g.cybozu = { data: { IS_MOBILE_DEVICE: false } };
+  const u = ctx.loginUser;
+  const infoUser = { id: u.id, code: u.code, name: u.name, email: u.email, primaryOrganization: null, organizations: [], groups: [] };
+  const usersInfo = {
+    users: [infoUser],
+    organizations: [],
+    groups: [],
+    userCodes: { [u.code]: infoUser },
+    orgCodes: {},
+    groupCodes: {},
+    userIds: { [u.id]: u.code },
+    orgIds: {},
+    groupIds: {}
+  };
+  g.rex0220_users_info3 = { request: () => void 0, getUsersInfo: async () => usersInfo, data: usersInfo };
+  window.kintone = g.kintone;
+  window.cybozu = g.cybozu;
+  window.rex0220_users_info3 = g.rex0220_users_info3;
+  if (!existsSync3(MOMENT_FILE)) throw new Error(`moment が無い: ${MOMENT_FILE}（tools の npm install 時に取る。手で取るなら npm run vendor）`);
+  const runScript = (code, filename) => {
+    vm.runInThisContext(code, { filename });
+    for (const k of ["moment", "rex0220_BigNumber", "rex0220_Decimal", "rex0220p", "rex0220PrintCraftAuthoring"]) {
+      if (g[k] === void 0 && window[k] !== void 0) g[k] = window[k];
+      if (window[k] === void 0 && g[k] !== void 0) window[k] = g[k];
+    }
+  };
+  runScript(readFileSync4(MOMENT_FILE, "utf8"), MOMENT_FILE);
+  runScript(src.momentTimezone, `${src.from}!${MOMENT_TZ_ENTRY}`);
+  runScript(src.bignumber, `${src.from}!${BIGNUMBER_ENTRY}`);
+  runScript(src.engine, `${src.from}!${ENGINE_ENTRY}`);
+  runScript(src.api, `${src.from}!${API_ENTRY}`);
+  const rex0220p = window.rex0220p;
+  const Ctor = rex0220p?.KintoneFormulaPCraft;
+  if (typeof Ctor !== "function") throw new Error("KintoneFormulaPCraft is not loaded");
+  const api = window.rex0220PrintCraftAuthoring;
+  if (!api || typeof api !== "object") throw new PluginZipError("印刷屋の authoring API（rex0220PrintCraftAuthoring）が読めない");
+  if (!SUPPORTED_API_VERSIONS.includes(api.apiVersion)) throw new PluginZipError(`印刷屋の authoring API の版 ${String(api.apiVersion)} には対応していない（tools は ${SUPPORTED_API_VERSIONS.join(", ")}）。tools を新しい版にする`);
+  if (String(api.pluginVersion) !== src.pluginVersion) throw new PluginZipError(`authoring API の印刷屋の版 ${String(api.pluginVersion)} が zip の manifest の版 ${src.pluginVersion} と違う（組み替えられた zip）`);
+  const bad = Object.entries(REQUIRED_API).filter(([k, t]) => typeof api[k] !== t).map(([k]) => k);
+  if (bad.length) throw new PluginZipError(`印刷屋の authoring API に tools が使うものが無い、または型が違う: ${bad.join(", ")}（tools と印刷屋の版を合わせる）`);
+  loaded = {
+    window,
+    Ctor,
+    api,
+    source: { kind: src.kind, from: src.from, pluginVersion: src.pluginVersion, engineSha256: src.sha256.engine, apiSha256: src.sha256.api, ...src.pluginId ? { pluginId: src.pluginId } : {} },
+    warnings,
+    setContext(next) {
+      if (next.baseUrl) ctx.baseUrl = next.baseUrl.replace(/\/+$/, "");
+      if (next.appId) ctx.appId = next.appId;
+      if (next.loginUser) ctx.loginUser = { ...ctx.loginUser, ...next.loginUser };
+    },
+    checker: (pp, crec) => new Ctor("formula", pp, crec, true, true),
+    runner: (pp, record) => new Ctor("formula", pp, record, true),
+    functionNames: () => Object.keys(new Ctor("formula", {}, {}, true, true).funs).sort()
+  };
+  return loaded;
+}
+
+// src/env.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
+import path7 from "node:path";
+var NAMES = {
+  baseUrl: ["KINTONE_BASE_URL", "KSQL_BASE_URL"],
+  token: ["KINTONE_API_TOKEN", "KSQL_TOKEN"],
+  username: ["KINTONE_USERNAME", "KSQL_USERNAME"],
+  password: ["KINTONE_PASSWORD", "KSQL_PASSWORD"],
+  pluginZip: ["PCRAFT_PLUGIN_ZIP"]
+};
+function unquote(raw) {
+  const value = raw.trim();
+  if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) return value.slice(1, -1);
+  return value;
+}
+function parseDotEnv(text) {
+  const out = {};
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const m = line.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+    if (!m) continue;
+    out[m[1]] = unquote(m[2]);
+  }
+  return out;
+}
+var AuthError = class extends Error {
+};
+function pickerWithSource(opt, unquoteProcess = false) {
+  const osEnv = opt.env;
+  const file = envFileOf(opt);
+  const fromFile = existsSync4(file) ? parseDotEnv(readFileSync5(file, "utf8")) : {};
+  return (names) => {
+    for (const [src, source] of [[osEnv, "process"], [fromFile, "file"]]) {
+      for (const n of names) {
+        const raw = src[n] ?? "";
+        const v = source === "process" && unquoteProcess ? unquote(raw) : raw.trim();
+        if (v) return { value: v, source, ...source === "file" ? { file } : {} };
+      }
+    }
+    return void 0;
+  };
+}
+function picker(opt, unquoteProcess = false) {
+  const pick = pickerWithSource(opt, unquoteProcess);
+  return (names) => pick(names)?.value;
+}
+function envFileOf(opt) {
+  return opt.envFile ?? path7.join(opt.cwd, ".env");
+}
+function baseUrlFromEnv(opt) {
+  const raw = picker(opt, true)(NAMES.baseUrl);
+  if (!raw) return void 0;
+  try {
+    return normalizeKintoneBaseUrl(raw);
+  } catch (e) {
+    throw new AuthError(`KINTONE_BASE_URL が不正: ${e instanceof KintoneUrlError ? e.message : String(e)}（https://<サブドメイン>.cybozu.com の形で書く）`);
+  }
+}
+function loadAuth(opt) {
+  const pick = picker(opt);
+  const file = envFileOf(opt);
+  const baseUrl = baseUrlFromEnv(opt);
+  if (!baseUrl) throw new AuthError(`KINTONE_BASE_URL が無い（OS の環境変数か .env: ${file}。kintone 公式 MCP と同じ変数。dashboard の KSQL_BASE_URL でもよい）`);
+  const token = pick(NAMES.token);
+  const username = pick(NAMES.username);
+  const password = pick(NAMES.password);
+  if (!token && !(username && password)) throw new AuthError("KINTONE_API_TOKEN か、KINTONE_USERNAME と KINTONE_PASSWORD の両方が要る（OS の環境変数か .env）");
+  return { baseUrl, token, username: token ? void 0 : username, password: token ? void 0 : password };
+}
+function loadAuthForEnv(env, cwd) {
+  const file = path7.join(cwd, env.envFile);
+  if (!existsSync4(file)) throw new AuthError(`環境「${env.name}」の認証のファイルが無い: ${env.envFile}（${env.envFile === ".env" ? ".env.example を写して作る" : "env/ に作る。.env と同じ書き方"}）`);
+  const vars = parseDotEnv(readFileSync5(file, "utf8"));
+  const pick = (names) => {
+    for (const n of names) if (vars[n] && vars[n].trim()) return vars[n].trim();
+    return void 0;
+  };
+  const fileBase = pick(NAMES.baseUrl);
+  if (fileBase) {
+    let normalized = "";
+    try {
+      normalized = normalizeKintoneBaseUrl(fileBase);
+    } catch {
+      normalized = "";
+    }
+    if (normalized !== env.baseUrl) throw new AuthError(`${env.envFile} の KINTONE_BASE_URL が environments.json の環境「${env.name}」の baseUrl（${env.baseUrl}）と違う。取り違えを防ぐため止める（どちらかを直す）`);
+  }
+  const token = pick(NAMES.token);
+  const username = pick(NAMES.username);
+  const password = pick(NAMES.password);
+  if (!token && !(username && password)) throw new AuthError(`${env.envFile} に KINTONE_API_TOKEN か、KINTONE_USERNAME と KINTONE_PASSWORD の両方が要る（環境「${env.name}」。OS の環境変数は読まない）`);
+  return { baseUrl: env.baseUrl, token, username: token ? void 0 : username, password: token ? void 0 : password };
+}
+function pluginZipPath(opt) {
+  const picked = pickerWithSource(opt, true)(NAMES.pluginZip);
+  if (!picked) return void 0;
+  if (picked.source === "file") return path7.resolve(path7.dirname(picked.file ?? envFileOf(opt)), picked.value);
+  if (!path7.isAbsolute(picked.value)) throw new AuthError(`PCRAFT_PLUGIN_ZIP（OS の環境変数）は絶対パスで書く: ${picked.value}（.env に書くなら .env のフォルダーからの相対パスでもよい）`);
+  return path7.normalize(picked.value);
+}
+function describeAuth(auth) {
+  return auth.token ? "API トークン" : "ログインユーザー";
+}
+
+// src/kintone-rest.ts
+var ALLOWED_APIS = ["app", "app/form/fields", "app/form/layout", "record", "records", "preview/app/form/fields", "preview/app/form/layout", "app/plugin/config", "preview/app/plugin/config"];
+var RECEIVE_LIMITS = {
+  app: 64 * 1024,
+  "app/form/fields": 8 * 1024 * 1024,
+  "app/form/layout": 8 * 1024 * 1024,
+  "preview/app/form/fields": 8 * 1024 * 1024,
+  "preview/app/form/layout": 8 * 1024 * 1024,
+  record: 8 * 1024 * 1024,
+  records: 8 * 1024 * 1024,
+  "app/plugin/config": 2 * 1024 * 1024,
+  "preview/app/plugin/config": 2 * 1024 * 1024
+};
+var RestError = class extends Error {
+  status;
+  code;
+  apiPath;
+  // Node の型の除去で動かすため、コンストラクターのパラメータープロパティは使わない
+  constructor(message, status, code, apiPath) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.apiPath = apiPath;
+  }
+};
+var NotAllowedError = class extends Error {
+};
+async function readCapped(res, limit, apiPath) {
+  const tooLarge2 = () => new RestError(`kintone ${apiPath} の応答が大きすぎる（上限 ${limit} バイト）`, res.status, "LimitError", apiPath);
+  const quietCancel = async (reader2) => {
+    try {
+      await reader2.cancel();
+    } catch {
+    }
+  };
+  if (res.body === null) return "";
+  if (!res.body || typeof res.body.getReader !== "function") throw new RestError(`kintone ${apiPath} の応答に本文のストリームが無い`, res.status, "ResponseError", apiPath);
+  const reader = res.body.getReader();
+  const declared = Number(res.headers?.get("content-length") ?? Number.NaN);
+  if (Number.isFinite(declared) && declared > limit) {
+    await quietCancel(reader);
+    throw tooLarge2();
+  }
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.length;
+    if (total > limit) {
+      await quietCancel(reader);
+      throw tooLarge2();
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf8");
+}
+function apiPathOf(api, guestSpaceId) {
+  if (!ALLOWED_APIS.includes(api)) throw new NotAllowedError(`この API は authoring tools では呼ばない: ${api}（許可: ${ALLOWED_APIS.join(", ")}）`);
+  if (guestSpaceId !== void 0 && (!Number.isInteger(guestSpaceId) || guestSpaceId <= 0)) throw new NotAllowedError(`ゲストスペースの ID が不正: ${String(guestSpaceId)}`);
+  const prefix = guestSpaceId ? `/k/guest/${guestSpaceId}/v1/` : "/k/v1/";
+  return `${prefix}${api}.json`;
+}
+function authHeaders(auth) {
+  if (auth.token) return { "X-Cybozu-API-Token": auth.token };
+  if (auth.username && auth.password) return { "X-Cybozu-Authorization": Buffer.from(`${auth.username}:${auth.password}`, "utf8").toString("base64") };
+  throw new NotAllowedError("認証情報が無い");
+}
+function createRestClient(auth, fetchImpl = fetch) {
+  let baseUrl;
+  try {
+    baseUrl = normalizeKintoneBaseUrl(auth.baseUrl);
+  } catch (e) {
+    throw new NotAllowedError(`接続先が kintone ではないので送らない: ${e instanceof KintoneUrlError ? e.message : String(e)}`);
+  }
+  const headers = { ...authHeaders(auth), Accept: "application/json" };
+  return {
+    baseUrl,
+    async get(api, params, guestSpaceId) {
+      const apiPath = apiPathOf(api, guestSpaceId);
+      const url = new URL(apiPath, baseUrl);
+      for (const [k, v] of Object.entries(params)) if (v !== void 0) url.searchParams.set(k, String(v));
+      if (url.origin !== baseUrl || url.username || url.password) throw new NotAllowedError(`送信先が kintone の接続先と違うので送らない: ${url.origin}`);
+      const res = await fetchImpl(url.href, { method: "GET", headers });
+      const text = await readCapped(res, RECEIVE_LIMITS[api], apiPath);
+      if (!res.ok) {
+        let code;
+        try {
+          const body = JSON.parse(text);
+          code = typeof body.code === "string" ? body.code.slice(0, 40) : void 0;
+        } catch {
+        }
+        const hint = res.status === 401 ? "（認証情報かアクセス権を確かめる。API トークンならそのアプリで有効か）" : res.status === 403 ? "（アクセス権が無い）" : res.status === 404 ? "（アプリかレコードが無い）" : "";
+        throw new RestError(`kintone ${apiPath} が HTTP ${res.status}${code ? ` ${code}` : ""}${hint}`, res.status, code, apiPath);
+      }
+      try {
+        return JSON.parse(text);
+      } catch {
+        throw new RestError(`kintone ${apiPath} の応答が JSON でない${text ? "" : "（本文が空）"}`, res.status, "ResponseError", apiPath);
+      }
+    }
+  };
+}
+
+// src/commands/normalize.ts
+import { readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
+import path9 from "node:path";
+
+// src/normalize/findings.ts
+var Findings = class {
+  items = [];
+  add(level, rule, where, message) {
+    this.items.push({ level, rule, where, message });
+  }
+  error(rule, where, message) {
+    this.add("error", rule, where, message);
+  }
+  warning(rule, where, message) {
+    this.add("warning", rule, where, message);
+  }
+  info(rule, where, message) {
+    this.add("info", rule, where, message);
+  }
+  count(level) {
+    return this.items.filter((f) => f.level === level).length;
+  }
+  get hasErrors() {
+    return this.count("error") > 0;
+  }
+  /** 画面に出す表（レベル → 場所 → 文言） */
+  format() {
+    const label = { error: "エラー", warning: "警告", info: "情報" };
+    const lines = [`エラー ${this.count("error")} / 警告 ${this.count("warning")} / 情報 ${this.count("info")}`];
+    for (const level of ["error", "warning", "info"]) {
+      for (const f of this.items.filter((x) => x.level === level)) lines.push(`[${label[level]}] ${f.where}: ${f.message}（${f.rule}）`);
+    }
+    return lines.join("\n");
+  }
+};
+
+// src/normalize/model.ts
+var PSEUDO_FIELDS = /* @__PURE__ */ new Set(["$id", "$revision", "$out", "$html", "$rseq"]);
+var UOG_MARK = "$UGO$";
+var EXEC_CONDITION_LABEL = "実行条件";
+var clone = (v) => JSON.parse(JSON.stringify(v));
+function buildModel(file, api, trustedBaseUrl) {
+  const pp = { ...clone(file.properties) };
+  pp["$id"] = { type: "RECORD_NUMBER", code: "$id", label: "$id" };
+  pp["$revision"] = { type: "__REVISION__", code: "$revision", label: "$revision" };
+  pp["$html"] = { type: "MULTI_LINE_TEXT", code: "$html", label: "$html" };
+  const crec = api.createCheckRecord(pp);
+  const ppRun = api.expandFields(clone(file.properties), EXEC_CONDITION_LABEL);
+  const calcCandidates = api.createFieldsInfo(pp, clone(file.layout)).filter((c) => !c.ptcode && c.type !== "SUBTABLE");
+  const calcByCode = /* @__PURE__ */ new Map();
+  for (const c of calcCandidates) calcByCode.set(c.fieldcode, c);
+  const baseUrl = trustedBaseUrl ?? "";
+  const fieldsBaseUrl = typeof file.baseUrl === "string" && isKintoneBaseUrl(file.baseUrl) ? normalizeKintoneBaseUrl(file.baseUrl) : "";
+  return { api, file, baseUrl, fieldsBaseUrl, appId: file.appId, pp, crec, ppRun, calcCandidates, calcByCode };
+}
+function fieldExists(model, code) {
+  if (PSEUDO_FIELDS.has(code)) return true;
+  const p = model.pp[code];
+  if (!p) return false;
+  if (p.ptcode) return !!model.pp[p.ptcode];
+  return true;
+}
+function calcIneligibleReason(model, code) {
+  if (model.calcByCode.has(code)) return null;
+  const p = model.pp[code];
+  if (!p) return "fields に無い";
+  if (p.ptcode) return `テーブル ${p.ptcode} の中`;
+  if (!model.api.isTargetType(p.type)) return `更新できない型（${p.type}）`;
+  if (p.expression) return "計算項目";
+  if (p.copyfield) return "ルックアップのコピー先";
+  return "レイアウトに無い";
+}
+
+// src/normalize/derive.ts
+var ENVELOPE_KEYS = ["date", "pluginName", "pluginID", "PluginVersion", "appId", "appName"];
+var SHELL_KEYS = ["pluginProductEnv", "pluginLastUpdate", "pluginUpdater", "startDate", "name", "version", "ldate"];
+var META_CALC_KEYS = ["row_type", "type", "lookup", "ptcode", "fieldlabel", "required"];
+function evaluateFormula(engine, model, formulaSet) {
+  const formula = model.api.stripComments(formulaSet.replace(/\r\n?/g, "\n"));
+  if (!formula.trim()) return { formula, usedFields: {} };
+  const kf = engine.checker(model.pp, model.crec);
+  kf.usedFields({});
+  try {
+    kf.dq(formula);
+  } catch (e) {
+    return { formula, usedFields: {}, error: String(e?.message ?? e) };
+  }
+  return { formula, usedFields: kf.usedFields() };
+}
+function rowLabel(row, index) {
+  return row.menu || `ボタン ${index + 1}`;
+}
+function tagRowLabel(tag, index) {
+  const kind = index === 0 ? "ボタン表示条件" : index === 1 ? "ファイル名" : tag.desc || tag.fieldcode || "本文";
+  return `HTML 設定 ${index + 1} 行目 (${kind})`;
+}
+function bodyOf(envelope) {
+  const skip = /* @__PURE__ */ new Set([...ENVELOPE_KEYS, ...SHELL_KEYS]);
+  const out = {};
+  for (const k of Object.keys(envelope)) if (!skip.has(k)) out[k] = envelope[k];
+  return out;
+}
+function deriveBody(input, model, engine, f) {
+  const api = model.api;
+  const rows = api.buildMenuRows(input, "ja");
+  rows.forEach((row, i) => {
+    const label = rowLabel(row, i);
+    const tags = api.normalizeTagsInfo(row.tagsInfo);
+    if (tags) {
+      tags.fieldsInfo = tags.fieldsInfo.map((t, j) => {
+        const base = { ...t, id: j + 1, formulaSet: String(t.formulaSet ?? "").replace(/\r\n?/g, "\n") };
+        if (!t.state) return { ...base, formula: "", usedFields: {} };
+        const r = evaluateFormula(engine, model, base.formulaSet);
+        if (r.error) f.error("formula.syntax", `${label} / ${tagRowLabel(t, j)}`, `計算式を評価できない: ${r.error}`);
+        return { ...base, formula: r.formula, usedFields: r.usedFields };
+      });
+      row.tagsInfo = tags;
+    }
+    const given = row.calcInfo.fieldsInfo;
+    if (given.length === 0) {
+      row.calcInfo.usedFields = {};
+      row.calcInfo.flinkage = false;
+      return;
+    }
+    const outRow = given.find((x) => x.fieldcode === "$out");
+    const rebuilt = [];
+    rebuilt.push(
+      outRow ? { ...outRow, row_type: outRow.row_type || "更新条件", type: "BOOL", lookup: false, ptcode: "", fieldlabel: "", fieldcode: "$out", required: false } : { id: 1, state: false, row_type: "更新条件", type: "BOOL", lookup: false, ptcode: "", fieldlabel: "", fieldcode: "$out", required: false, remark: "", formulaSet: "1", formula: "1", usedFields: {} }
+    );
+    if (!outRow) f.info("calc.out", `${label} / 更新項目`, "先頭の $out（更新条件）が無いので既定（1 = 常に更新）を足した");
+    const seen = /* @__PURE__ */ new Set(["$out"]);
+    for (const x of given) {
+      if (x.fieldcode === "$out") continue;
+      if (seen.has(x.fieldcode)) {
+        f.error("calc.duplicate", `${label} / 更新項目 ${x.fieldcode}`, "同じ項目が 2 回ある");
+        continue;
+      }
+      seen.add(x.fieldcode);
+      const cand = model.calcByCode.get(x.fieldcode);
+      if (!cand) {
+        f.error("calc.ineligible", `${label} / 更新項目 ${x.fieldcode}`, `${x.fieldcode} は更新項目にできない: ${calcIneligibleReason(model, x.fieldcode)}`);
+        continue;
+      }
+      const diffs = META_CALC_KEYS.filter((k) => x[k] !== void 0 && x[k] !== "" && String(x[k]) !== String(cand[k] ?? ""));
+      if (diffs.length) f.info("calc.meta", `${label} / 更新項目 ${x.fieldcode}`, `fields の定義で上書き: ${diffs.map((k) => `${k} ${JSON.stringify(x[k])} → ${JSON.stringify(cand[k] ?? "")}`).join(", ")}`);
+      rebuilt.push({
+        id: 0,
+        state: !!x.state,
+        row_type: cand.row_type,
+        type: cand.type,
+        lookup: cand.lookup,
+        ptcode: cand.ptcode || "",
+        fieldlabel: cand.fieldlabel,
+        fieldcode: cand.fieldcode,
+        required: !!cand.required,
+        remark: String(x.remark ?? ""),
+        formulaSet: String(x.formulaSet ?? "").replace(/\r\n?/g, "\n"),
+        formula: "",
+        usedFields: {}
+      });
+    }
+    let used = {};
+    row.calcInfo.fieldsInfo = rebuilt.map((c, j) => {
+      const base = { ...c, id: j + 1 };
+      if (!c.state) return { ...base, formula: "", usedFields: {} };
+      const r = evaluateFormula(engine, model, base.formulaSet);
+      if (r.error) f.error("formula.syntax", `${label} / 更新項目 ${j + 1} 行目 (${c.fieldcode})`, `計算式を評価できない: ${r.error}`);
+      used = { ...used, ...r.usedFields };
+      return { ...base, formula: r.formula, usedFields: r.usedFields };
+    });
+    row.calcInfo.usedFields = used;
+    row.calcInfo.flinkage = false;
+  });
+  const saved = api.toSavedRows(rows);
+  const usage = api.computeUsage(rows, model.pp);
+  const body = {
+    pluginEnable: input.pluginEnable === void 0 ? true : !!input.pluginEnable,
+    menuInfo: input.menuInfo && typeof input.menuInfo === "object" ? input.menuInfo : api.defaultMenuInfo("ja"),
+    // ゲストの行番号は tools が振る（docs/設定ファイル仕様.md の guestsInfo[].id）
+    guestsInfo: Array.isArray(input.guestsInfo) ? input.guestsInfo.map((g, i) => g && typeof g === "object" && !Array.isArray(g) ? { ...g, id: i + 1 } : g) : [],
+    pluginComment: String(input.pluginComment ?? ""),
+    pluginDescription: String(input.pluginDescription ?? ""),
+    commonCssEnable: input.commonCssEnable === void 0 ? true : !!input.commonCssEnable,
+    // 共通 CSS は書いたときだけ出す。印刷屋 Ver.6 のアップロードの一部置換・追加は、ファイルに cssInfo があれば共通 CSS を丸ごと置き換えるかを
+    // 利用者が選ぶ（既定は置き換えない。Takashi 2026-10-05）。既定の 4 行を足しても意味がなく、置き換えを選ぶとアプリの共通 CSS が既定に戻る。無ければ印刷屋は既定の 4 行を使う
+    ...Array.isArray(input.cssInfo) ? { cssInfo: api.normalizeCssRows(input.cssInfo) } : {},
+    ...input.fontInfo && typeof input.fontInfo === "object" ? { fontInfo: input.fontInfo } : {},
+    // 外部参照（Ver.6 の共通の設定。設定画面は常に明示して保存する）。キーが無ければ印刷屋は Ver.5 の設定として「許可」で動く（Takashi 2026-10-04）ので
+    // "allow" を明示する（checks.ts が利用者の承認を求める）。"block" / "allow" 以外はそのまま残して checks.ts がエラーにする
+    externalRefs: input.externalRefs === void 0 ? "allow" : input.externalRefs,
+    pluginInfos: saved,
+    usedFields: usage.usedFields,
+    pluginUOG: usage.pluginUOG
+  };
+  for (const k of Object.keys(input)) if (!(k in body)) body[k] = input[k];
+  if (input.externalRefs === void 0) f.info("externalRefs.legacy", "共通の設定", `外部参照（externalRefs）が無い（Ver.5 の設定か、書き忘れ）。印刷屋はキーが無い設定を「許可」（何も除かない）として動かすので "allow" を明示した。新しい設定なら "block" を書く`);
+  return body;
+}
+
+// src/normalize/css-check.ts
+var PLACEHOLDER_RE = /^#\{&(?:p|n|f\([^{}]*\)|q\([^{}]*\))\}$/s;
+var STR_MARK = "
";
+var STR_TOKEN = /\u0001(\d+)\u0001/g;
+function cleanUrl(raw) {
+  let v = String(raw ?? "").replace(/[\t\n\r]/g, "");
+  v = v.replace(/^[\u0000- ]+|[\u0000- ]+$/g, "");
+  if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) v = v.slice(1, -1);
+  return v.replace(/^[\u0000- ]+|[\u0000- ]+$/g, "");
+}
+function classifyUrl(raw) {
+  const v = cleanUrl(raw);
+  if (v === "") return "relative";
+  if (v.startsWith("#{&")) return PLACEHOLDER_RE.test(v) ? "placeholder" : "bad";
+  if (v.startsWith("#")) return "fragment";
+  if (/[\u0000-\u001f\u007f]/.test(v)) return "bad";
+  const scheme = v.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):/)?.[1]?.toLowerCase();
+  if (!scheme) return v.replace(/\\/g, "/").startsWith("//") ? "bad" : "relative";
+  if (scheme === "https") return "https";
+  if (scheme === "data") {
+    if (/^data:image\/svg\+xml[;,]/i.test(v)) return "data-svg";
+    return /^data:image\/[a-z0-9.+-]+[;,]/i.test(v) ? "data-image" : "bad";
+  }
+  return "bad";
+}
+function parseSrcsetUrls(value) {
+  const urls = [];
+  const n = value.length;
+  let i = 0;
+  while (i < n) {
+    while (i < n && /[\s,]/.test(value[i])) i++;
+    if (i >= n) break;
+    const start = i;
+    while (i < n && !/\s/.test(value[i])) i++;
+    let url = value.slice(start, i);
+    if (url.endsWith(",")) {
+      url = url.replace(/,+$/, "");
+      if (url) urls.push(url);
+      continue;
+    }
+    if (url) urls.push(url);
+    let depth = 0;
+    while (i < n) {
+      const c = value[i];
+      if (c === "(") depth++;
+      else if (c === ")") depth--;
+      else if (c === "," && depth <= 0) {
+        i++;
+        break;
+      }
+      i++;
+    }
+  }
+  return urls;
+}
+function tokenizeCss(css) {
+  const strings = [];
+  let code = "";
+  let i = 0;
+  const n = css.length;
+  const readEscape = () => {
+    const hex = css.slice(i + 1, i + 7).match(/^[0-9a-fA-F]{1,6}/);
+    if (hex) {
+      i += 1 + hex[0].length;
+      if (css.startsWith("\r\n", i)) i += 2;
+      else if (i < n && /[ \t\r\n\f]/.test(css[i])) i++;
+      const cp = parseInt(hex[0], 16);
+      return cp === 0 || cp > 1114111 || cp >= 55296 && cp <= 57343 ? "�" : String.fromCodePoint(cp);
+    }
+    const c = css[i + 1];
+    if (c === void 0) {
+      i += 1;
+      return "�";
+    }
+    if (c === "\r" && css[i + 2] === "\n") {
+      i += 3;
+      return "";
+    }
+    if (c === "\n" || c === "\r" || c === "\f") {
+      i += 2;
+      return "";
+    }
+    i += 2;
+    return c;
+  };
+  while (i < n) {
+    const c = css[i];
+    if (c === "/" && css[i + 1] === "*") {
+      const end = css.indexOf("*/", i + 2);
+      i = end < 0 ? n : end + 2;
+      code += " ";
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      const q = c;
+      i++;
+      let s = "";
+      while (i < n) {
+        const d = css[i];
+        if (d === "\\") {
+          s += readEscape();
+          continue;
+        }
+        if (d === q) {
+          i++;
+          break;
+        }
+        if (d === "\n" || d === "\r" || d === "\f") break;
+        s += d;
+        i++;
+      }
+      strings.push(s);
+      code += `${STR_MARK}${strings.length - 1}${STR_MARK}`;
+      continue;
+    }
+    if (c === "\\") {
+      code += readEscape();
+      continue;
+    }
+    code += c;
+    i++;
+  }
+  return { code, strings };
+}
+function extractUrls(css) {
+  const out = [];
+  const t = tokenizeCss(css);
+  const code = t.code;
+  const str = (token) => t.strings[Number(token.slice(1, -1))] ?? "";
+  const re = /\burl\(\s*/gi;
+  let m;
+  while (m = re.exec(code)) {
+    const i = m.index + m[0].length;
+    const ph = code.slice(i).match(/^\u0001\d+\u0001/);
+    let value = "";
+    if (ph) value = str(ph[0]);
+    else if (code.startsWith("#{&", i)) {
+      const end = code.indexOf(")}", i);
+      value = code.slice(i, end < 0 ? code.length : end + 2);
+    } else {
+      const end = code.indexOf(")", i);
+      value = code.slice(i, end < 0 ? code.length : end);
+    }
+    out.push({ url: value.trim(), via: "url()" });
+  }
+  const fns = /\b(?:-webkit-)?(image-set|image|src)\(((?:[^()]|\([^()]*\))*)\)/gi;
+  while (m = fns.exec(code)) {
+    for (const s of m[2].matchAll(STR_TOKEN)) out.push({ url: str(s[0]).trim(), via: m[1].toLowerCase() });
+  }
+  const imp = /@import\s+(?:url\([^)]*\)|(\u0001\d+\u0001))/gi;
+  while (m = imp.exec(code)) if (m[1] !== void 0) out.push({ url: str(m[1]).trim(), via: "@import" });
+  return out;
+}
+function checkCss(css) {
+  const errors = [];
+  const externals = [];
+  const { code } = tokenizeCss(css);
+  if (/@import\b/i.test(code)) errors.push("@import は使えない（外部の CSS を読む）");
+  if (/\bexpression\s*\(/i.test(code)) errors.push("expression( は使えない");
+  if (/\bbehavior\s*:/i.test(code)) errors.push("behavior: は使えない");
+  if (/-moz-binding\s*:/i.test(code)) errors.push("-moz-binding: は使えない");
+  for (const u of extractUrls(css)) {
+    const kind = classifyUrl(u.url);
+    if (kind === "https") externals.push({ url: cleanUrl(u.url), via: u.via });
+    else if (kind === "bad") errors.push(`${u.via} の URL が使えない形: ${u.url.slice(0, 80)}（https:、data:image/、#{&f(…)} だけ）`);
+  }
+  return { errors, externals };
+}
+
+// src/normalize/html-check.ts
+var ALLOWED_TAGS = /* @__PURE__ */ new Set([
+  "div",
+  "span",
+  "p",
+  "br",
+  "hr",
+  "img",
+  "table",
+  "thead",
+  "tbody",
+  "tfoot",
+  "tr",
+  "th",
+  "td",
+  "caption",
+  "colgroup",
+  "col",
+  "ul",
+  "ol",
+  "li",
+  "dl",
+  "dt",
+  "dd",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "strong",
+  "b",
+  "em",
+  "i",
+  "u",
+  "s",
+  "small",
+  "sub",
+  "sup",
+  "mark",
+  "del",
+  "ins",
+  "a",
+  "section",
+  "article",
+  "header",
+  "footer",
+  "main",
+  "nav",
+  "aside",
+  "figure",
+  "figcaption",
+  "pre",
+  "code",
+  "blockquote",
+  "q",
+  "cite",
+  "abbr",
+  "time",
+  "address",
+  "label",
+  "wbr",
+  "iframe",
+  "style",
+  "ruby",
+  "rt",
+  "rp",
+  "bdi",
+  "bdo",
+  "big",
+  "center",
+  "font",
+  "tt",
+  "kbd",
+  "samp",
+  "var",
+  "dfn"
+]);
+var DENIED_REASON = {
+  script: "スクリプト",
+  object: "外部の内容を埋め込む",
+  embed: "外部の内容を埋め込む",
+  applet: "外部の内容を埋め込む",
+  link: "外部の CSS を読む",
+  base: "リンクの基準を変える",
+  meta: "文書の動きを変える（refresh など）",
+  noscript: "",
+  template: "",
+  slot: "",
+  portal: "",
+  form: "送信の経路",
+  input: "入力欄",
+  button: "入力欄",
+  select: "入力欄",
+  textarea: "入力欄",
+  option: "入力欄",
+  optgroup: "入力欄",
+  frame: "",
+  frameset: "",
+  svg: 'インラインの SVG は使わない（図は <img src="data:image/svg+xml,…"> か添付ファイルの #{&f(…)} で入れる）',
+  math: "MathML は使わない",
+  video: "動画は PDF にならない",
+  audio: "音声は PDF にならない",
+  source: "",
+  track: "",
+  picture: "<img src> だけ使う",
+  canvas: "",
+  map: "",
+  area: "",
+  dialog: "",
+  details: "",
+  summary: "",
+  marquee: "",
+  xmp: "",
+  plaintext: "",
+  listing: "",
+  html: "",
+  head: "",
+  body: "",
+  title: ""
+};
+var GLOBAL_ATTRS = /* @__PURE__ */ new Set(["class", "id", "style", "title", "lang", "dir", "hidden", "translate", "role", "align", "valign", "bgcolor", "border", "width", "height", "color", "nowrap", "char", "charoff"]);
+var TAG_ATTRS = {
+  img: ["src", "srcset", "alt", "loading", "decoding", "sizes"],
+  a: ["href", "target", "rel", "name"],
+  td: ["colspan", "rowspan", "headers", "scope", "abbr"],
+  th: ["colspan", "rowspan", "headers", "scope", "abbr"],
+  col: ["span"],
+  colgroup: ["span"],
+  table: ["cellpadding", "cellspacing", "summary", "rules", "frame"],
+  ol: ["start", "reversed", "type"],
+  ul: ["type"],
+  li: ["value"],
+  time: ["datetime"],
+  q: ["cite"],
+  blockquote: ["cite"],
+  ins: ["cite", "datetime"],
+  del: ["cite", "datetime"],
+  iframe: ["src", "name", "frameborder", "scrolling"],
+  label: ["for"],
+  style: ["media", "type"],
+  font: ["face", "size"]
+};
+var URL_ATTRS = /* @__PURE__ */ new Set(["src", "srcset", "href", "cite"]);
+function tagError(tag, where = "") {
+  const t = tag.toLowerCase();
+  if (ALLOWED_TAGS.has(t)) return null;
+  const reason = DENIED_REASON[t];
+  return `<${t}> は使えない（${where}${where ? "。" : ""}${reason ? reason : "許可の一覧に無い要素"}）`;
+}
+function attrAllowed(tag, name) {
+  if (GLOBAL_ATTRS.has(name)) return true;
+  if (name.startsWith("data-") || name.startsWith("aria-")) return true;
+  if (tag === void 0) return Object.values(TAG_ATTRS).some((list) => list.includes(name));
+  return (TAG_ATTRS[tag] ?? []).includes(name);
+}
+var windowPromise = null;
+async function dom() {
+  if (!windowPromise) {
+    windowPromise = (async () => {
+      const { Window } = await import("happy-dom");
+      return new Window({ url: "https://authoring.local/" });
+    })();
+  }
+  return windowPromise;
+}
+function sameOrigin(url, baseUrl) {
+  if (!baseUrl) return false;
+  try {
+    return new URL(url).origin === new URL(baseUrl).origin;
+  } catch {
+    return false;
+  }
+}
+async function checkHtml(html, opt = {}) {
+  const errors = [];
+  const warnings = [];
+  const externals = [];
+  if (!html.trim()) return { errors, warnings, externals };
+  const w = await dom();
+  const doc = new w.DOMParser().parseFromString(`<!doctype html><html><body>${html}</body></html>`, "text/html");
+  const root = doc.body ?? doc.documentElement;
+  if (!root) return { errors, warnings, externals };
+  const walk = (el, path13) => {
+    const tag = el.tagName.toLowerCase();
+    const here2 = `${path13}>${tag}`;
+    const denied = tagError(tag, here2);
+    if (denied) {
+      errors.push(denied);
+      return;
+    }
+    if (tag === "style") {
+      const r = checkCss(el.textContent ?? "");
+      for (const e of r.errors) errors.push(`<style>: ${e}`);
+      for (const u of r.externals) externals.push({ url: u.url, via: `<style> ${u.via}` });
+    }
+    for (const a of Array.from(el.attributes)) {
+      const name = a.name.toLowerCase();
+      const value = a.value ?? "";
+      if (name.startsWith("on")) {
+        errors.push(`${name} 属性（イベント）は使えない（${here2}）`);
+        continue;
+      }
+      if (!attrAllowed(tag, name)) {
+        errors.push(`${name} 属性は使えない（${here2}。許可の一覧に無い属性）`);
+        continue;
+      }
+      if (value.includes("${")) {
+        errors.push(`属性値に \${式} を置けない（${here2}[${name}]。ESC_HTML は引用符を逃がさないので属性が壊れる。属性の値は固定にする）`);
+        continue;
+      }
+      if (name === "style") {
+        const r = checkCss(`x{${value}}`);
+        for (const e of r.errors) errors.push(`style 属性: ${e}（${here2}）`);
+        for (const u of r.externals) externals.push({ url: u.url, via: `${here2}[style] ${u.via}` });
+        continue;
+      }
+      if (URL_ATTRS.has(name)) {
+        const urls = name === "srcset" ? parseSrcsetUrls(value) : [value];
+        for (const u of urls) {
+          const kind = classifyUrl(u);
+          const shown = cleanUrl(u).slice(0, 80);
+          if (kind === "bad") {
+            errors.push(`${name} の URL が使えない形: ${shown}（${here2}。https:、data:image/、#{&f(…)}、相対だけ）`);
+            continue;
+          }
+          if (tag === "a" && (kind === "data-image" || kind === "data-svg")) {
+            errors.push(`href に data: は使えない（${here2}）`);
+            continue;
+          }
+          if (tag === "iframe" && name === "src") {
+            if (kind !== "https" || !sameOrigin(cleanUrl(u), opt.baseUrl)) errors.push(`iframe の src は利用者の kintone（${opt.baseUrl ?? ".env の KINTONE_BASE_URL。未設定なので iframe は使えない"}）だけ: ${shown}（${here2}）`);
+            continue;
+          }
+          if (kind === "https") externals.push({ url: cleanUrl(u), via: `${here2}[${name}]` });
+        }
+      }
+    }
+    for (const c of Array.from(el.children)) walk(c, here2);
+  };
+  for (const c of Array.from(root.children)) walk(c, "");
+  return { errors, warnings, externals };
+}
+function expressionsOf(html) {
+  return [...html.matchAll(/\$\{(.*?)\}/g)].map((m) => m[1].trim());
+}
+
+// src/normalize/policy.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6, statSync as statSync3 } from "node:fs";
+import path8 from "node:path";
+var PolicyError = class extends Error {
+};
+var POLICY_FILE = path8.join("policy", "authoring-policy.json");
+var DEFAULT_ALLOWED_ORIGINS = ["https://fonts.googleapis.com", "https://fonts.gstatic.com"];
+var MAX_POLICY_BYTES = 1024 * 1024;
+var MAX_RULES = 200;
+var MAX_FILES = 100;
+function normalizeRel(p) {
+  let s = String(p).replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+  while (s.startsWith("./")) s = s.slice(2);
+  if (s.startsWith("/") || /^[a-zA-Z]:/.test(s) || s.split("/").includes("..")) throw new PolicyError(`files は作業フォルダーからの相対パスで書く（.. や絶対パスは使えない）: ${p}`);
+  return process.platform === "win32" ? s.toLowerCase() : s;
+}
+function fail(file, where, msg) {
+  throw new PolicyError(`${file} の形が不正（${where}）: ${msg}`);
+}
+function parsePolicy(text, file) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (e) {
+    fail(file, "$", `JSON として読めない: ${e.message}`);
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) fail(file, "$", "最上位はオブジェクト");
+  const obj = raw;
+  for (const k of Object.keys(obj)) if (k !== "allowExternal" && k !== "allowExternalRefs") fail(file, `$.${k}`, "使えるキーは allowExternal と allowExternalRefs だけ");
+  let allowExternalRefs;
+  if (obj.allowExternalRefs !== void 0) {
+    const files = obj.allowExternalRefs;
+    if (!Array.isArray(files) || files.some((f) => typeof f !== "string")) fail(file, "$.allowExternalRefs", "設定ファイルの相対パスの配列で書く");
+    if (files.length > MAX_FILES) fail(file, "$.allowExternalRefs", `${MAX_FILES} 件まで`);
+    allowExternalRefs = files.map((f) => {
+      try {
+        return normalizeRel(f);
+      } catch (e) {
+        return fail(file, "$.allowExternalRefs", e.message);
+      }
+    });
+  }
+  const list = obj.allowExternal ?? [];
+  if (!Array.isArray(list)) fail(file, "$.allowExternal", "配列で書く");
+  if (list.length > MAX_RULES) fail(file, "$.allowExternal", `${MAX_RULES} 件まで`);
+  const rules = [];
+  list.forEach((r, i) => {
+    const at = `$.allowExternal[${i}]`;
+    if (!r || typeof r !== "object" || Array.isArray(r)) fail(file, at, "オブジェクトで書く");
+    const o = r;
+    for (const k of Object.keys(o)) if (!["origin", "url", "files", "note"].includes(k)) fail(file, `${at}.${k}`, "使えるキーは origin / url / files / note");
+    const rule = {};
+    if (o.origin !== void 0) {
+      if (typeof o.origin !== "string") fail(file, `${at}.origin`, "文字列で書く");
+      let u;
+      try {
+        u = new URL(o.origin);
+      } catch {
+        fail(file, `${at}.origin`, `URL として読めない: ${o.origin}`);
+      }
+      if (u.protocol !== "https:" || u.username || u.password || u.origin !== o.origin.replace(/\/$/, "")) fail(file, `${at}.origin`, `https のオリジンだけを書く（例 https://cdn.example.com）: ${o.origin}`);
+      rule.origin = u.origin;
+    }
+    if (o.url !== void 0) {
+      if (typeof o.url !== "string") fail(file, `${at}.url`, "文字列で書く");
+      let u;
+      try {
+        u = new URL(o.url);
+      } catch {
+        fail(file, `${at}.url`, `URL として読めない: ${o.url}`);
+      }
+      if (u.protocol !== "https:" || u.username || u.password) fail(file, `${at}.url`, `https の完全な URL を書く: ${o.url}`);
+      rule.url = u.href;
+    }
+    if (rule.origin === void 0 && rule.url === void 0) fail(file, at, "origin か url のどちらかが要る");
+    if (o.files !== void 0) {
+      if (!Array.isArray(o.files) || o.files.some((f) => typeof f !== "string")) fail(file, `${at}.files`, "文字列の配列で書く");
+      if (o.files.length > MAX_FILES) fail(file, `${at}.files`, `${MAX_FILES} 件まで`);
+      rule.files = o.files.map((f) => {
+        try {
+          return normalizeRel(f);
+        } catch (e) {
+          return fail(file, `${at}.files`, e.message);
+        }
+      });
+    }
+    if (o.note !== void 0) {
+      if (typeof o.note !== "string") fail(file, `${at}.note`, "文字列で書く");
+      rule.note = o.note;
+    }
+    rules.push(rule);
+  });
+  return { allowExternal: rules, ...allowExternalRefs ? { allowExternalRefs } : {}, file };
+}
+function isExternalRefsAllowed(policy, settingsFile) {
+  if (!policy.allowExternalRefs?.length || !settingsFile) return false;
+  try {
+    return policy.allowExternalRefs.includes(normalizeRel(settingsFile));
+  } catch {
+    return false;
+  }
+}
+function loadPolicy(opt) {
+  const file = path8.join(opt.cwd, POLICY_FILE);
+  if (!existsSync5(file)) return { allowExternal: [] };
+  if (statSync3(file).size > MAX_POLICY_BYTES) throw new PolicyError(`${file} が大きすぎる（${MAX_POLICY_BYTES} バイトまで）`);
+  return parsePolicy(readFileSync6(file, "utf8"), file);
+}
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function hrefOf(url) {
+  try {
+    return new URL(url).href;
+  } catch {
+    return null;
+  }
+}
+function isAllowed(policy, url, settingsFile) {
+  const u = cleanUrl(url);
+  const origin = originOf(u);
+  const href = hrefOf(u);
+  if (origin && DEFAULT_ALLOWED_ORIGINS.includes(origin)) return true;
+  let rel2;
+  if (settingsFile) {
+    try {
+      rel2 = normalizeRel(settingsFile);
+    } catch {
+      rel2 = void 0;
+    }
+  }
+  for (const r of policy.allowExternal) {
+    const hit = r.url && href && r.url === href || r.origin && origin && r.origin === origin;
+    if (!hit) continue;
+    if (r.files && r.files.length) {
+      if (!rel2) continue;
+      if (!r.files.includes(rel2)) continue;
+    }
+    return true;
+  }
+  return false;
+}
+
+// src/normalize/checks.ts
+var RAW_HTML_FUNCTIONS = ["HTML", "FVAL", "TABLE_HTML", "RECS_HTML", "FIELDS_HTML", "PAGE_HTML", "TAGS_HTML", "UNESC_HTML", "ADD_TAGS", "TAG", "VTAG", "ATTR", "BATTR", "STYLE"];
+var SAFE_VALUE_TYPES = /* @__PURE__ */ new Set(["NUMBER", "CALC", "DATE", "DATETIME", "TIME", "CREATED_TIME", "UPDATED_TIME", "RECORD_NUMBER", "__REVISION__", "__ID__"]);
+var FORMAT_FUNCTIONS = /* @__PURE__ */ new Set(["FVAL", "DATE_FORMAT", "DATE_ADD", "YEN", "FIXED", "ROUND", "ROUNDUP", "ROUNDDOWN", "INT", "FLOOR", "CEIL", "ABS", "FSIZE", "DURATION_FORMAT", "TODAY", "NOW"]);
+var STRING_LITERAL = /^"(?:[^"\\]|\\.)*"$/s;
+var NUMBER_LITERAL = /^-?\d+(?:\.\d+)?$/;
+var IDENT = /^[\p{L}_$][\p{L}\p{N}_$]*$/u;
+var isPlainLiteral = (s) => STRING_LITERAL.test(s) && !/[<>&"']/.test(s.slice(1, -1));
+var isSafeReplacement = (s) => isPlainLiteral(s) || /^"<br\s*\/?>"$/i.test(s);
+var isSafeSearch = (s) => STRING_LITERAL.test(s) || /^NEWLINE\(\s*\)$/.test(s);
+function backslashEscapes(formula) {
+  return [...new Set([...formula.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => m[0]).filter((lit) => /\\[nrt]/.test(lit)))];
+}
+function splitTopLevel(s, sep = ",") {
+  const out = [];
+  let depth = 0;
+  let cur = "";
+  let quote = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (quote) {
+      cur += c;
+      if (c === "\\" && i + 1 < s.length) {
+        cur += s[++i];
+        continue;
+      }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      cur += c;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth < 0) return null;
+    }
+    if (c === sep && depth === 0) {
+      out.push(cur.trim());
+      cur = "";
+      continue;
+    }
+    cur += c;
+  }
+  if (depth !== 0 || quote) return null;
+  if (cur.trim() !== "" || out.length) out.push(cur.trim());
+  return out;
+}
+function parseCall(e) {
+  const m = e.match(/^([A-Z_][A-Z0-9_]*)\s*\(([\s\S]*)\)$/);
+  if (!m) return null;
+  const args = splitTopLevel(m[2]);
+  if (!args) return null;
+  return { name: m[1], args: args.length === 1 && args[0] === "" ? [] : args };
+}
+function commentInsideString(formulaSet) {
+  let inString = false;
+  for (let i = 0; i < formulaSet.length; i++) {
+    const c = formulaSet[i];
+    if (inString) {
+      if (c === "\\" && formulaSet[i + 1] === '"') i++;
+      else if (c === '"') inString = false;
+      else if (c === "/" && formulaSet[i + 1] === "/") return true;
+      continue;
+    }
+    if (c === '"') inString = true;
+    else if (c === "/" && formulaSet[i + 1] === "/") {
+      const nl = formulaSet.indexOf("\n", i);
+      if (nl < 0) return false;
+      i = nl;
+    }
+  }
+  return false;
+}
+function stringLiterals(formula) {
+  return [...formula.matchAll(/"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'/g)].map((m) => (m[1] ?? m[2] ?? "").replace(/\\(.)/g, "$1"));
+}
+function callsOf(formula, name) {
+  const out = [];
+  const re = new RegExp(`\\b${name}\\s*\\(`, "g");
+  let m;
+  while (m = re.exec(formula)) {
+    let depth = 1;
+    let i = m.index + m[0].length;
+    let quote = null;
+    const start = i;
+    for (; i < formula.length; i++) {
+      const c = formula[i];
+      if (quote) {
+        if (c === "\\") i++;
+        else if (c === quote) quote = null;
+        continue;
+      }
+      if (c === '"' || c === "'") quote = c;
+      else if (c === "(") depth++;
+      else if (c === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    const args = splitTopLevel(formula.slice(start, i));
+    if (args) out.push(args.length === 1 && args[0] === "" ? [] : args);
+  }
+  return out;
+}
+function isNumericSafe(arg, pp) {
+  const a = arg.trim();
+  if (!a) return false;
+  const call = parseCall(a);
+  if (call && FORMAT_FUNCTIONS.has(call.name)) return isSafeExpression(a, pp);
+  const tokens = a.match(/[\p{L}_$][\p{L}\p{N}_$]*|\d+(?:\.\d+)?|[+\-*/()]|\s+|[\s\S]/gu) ?? [];
+  for (const t of tokens) {
+    if (/^\s+$/.test(t) || /^[+\-*/()]$/.test(t) || NUMBER_LITERAL.test(t)) continue;
+    if (IDENT.test(t)) {
+      if (!SAFE_VALUE_TYPES.has(pp[t]?.type ?? "")) return false;
+      continue;
+    }
+    return false;
+  }
+  return true;
+}
+function isSafeExpression(expr, pp) {
+  const e = expr.trim();
+  if (!e) return false;
+  const terms = splitTopLevel(e, "&");
+  if (terms && terms.length > 1) return terms.every((t) => t !== "" && isSafeExpression(t, pp));
+  if (NUMBER_LITERAL.test(e)) return true;
+  if (STRING_LITERAL.test(e)) return isPlainLiteral(e);
+  if (IDENT.test(e)) return SAFE_VALUE_TYPES.has(pp[e]?.type ?? "");
+  const call = parseCall(e);
+  if (!call) return false;
+  if (call.name === "ESC_HTML") return call.args.length >= 1;
+  if (call.name === "REPLACE") return call.args.length === 3 && parseCall(call.args[0])?.name === "ESC_HTML" && isSafeSearch(call.args[1]) && isSafeReplacement(call.args[2]);
+  if (FORMAT_FUNCTIONS.has(call.name)) {
+    if (call.name === "TODAY" || call.name === "NOW") return call.args.length === 0;
+    if (call.args.length === 0 || !isNumericSafe(call.args[0], pp)) return false;
+    return call.args.slice(1).every((a) => STRING_LITERAL.test(a) ? !/[<>&]/.test(a) : NUMBER_LITERAL.test(a));
+  }
+  return false;
+}
+function approvedFinding(f, opt, where, url, via) {
+  if (isAllowed(opt.policy, url, opt.settingsFile)) {
+    f.info("external.allowed", where, `外部の URL（承認済み）: ${url}（${via}）`);
+  } else {
+    f.warning("external.url", where, `外部の URL: ${url}（${via}）。利用者が承認するなら policy/authoring-policy.json の allowExternal に origin か url を書く（AI は書かない）`);
+  }
+}
+function externalFinding(f, ctx, where, url, via, certain = true) {
+  if (ctx.mode === "block") {
+    const msg = `外部の URL: ${url}（${via}）。外部参照が「除く」（externalRefs: "block"）の設定では、印刷屋は描画の前に kintone 以外への読み込みを除くので帳票に出ない。添付ファイルの #{&f(…)} か data:image/ にする。外部をそのまま使うなら、利用者が externalRefs を "allow" にして policy/authoring-policy.json の allowExternalRefs にこの設定ファイルを書く（AI は書かない）`;
+    if (certain) f.error("external.blocked", where, msg);
+    else f.warning("external.blocked", where, `${msg}。計算式の文字列なので警告（帳票に入れば除かれる）`);
+    return;
+  }
+  approvedFinding(f, ctx, where, url, via);
+}
+function escapeFinding(f, where, formulas) {
+  const lits = [...new Set(formulas.flatMap(backslashEscapes))];
+  if (lits.length) f.warning("formula.escape", where, `計算式の文字列は \\ を解釈しない: ${lits.slice(0, 3).join(" ")}（"\\n" は改行でなく \\ と n の 2 文字なので、REPLACE(…, "\\n", "<br>") は何も置き換えない）。改行は NEWLINE()（例 REPLACE(ESC_HTML(備考), NEWLINE(), "<br>")）`);
+}
+var HTML_LIKE = /<\s*[a-zA-Z!/]/;
+var CSS_LIKE = /url\s*\(|@import|image-set\s*\(|expression\s*\(|behavior\s*:/i;
+async function checkFormulaHtml(formula, where, f, ctx) {
+  const raw = RAW_HTML_FUNCTIONS.filter((fn) => new RegExp(`\\b${fn}\\s*\\(`).test(formula));
+  if (raw.length) f.warning("formula.rawHtml", where, `HTML を作る・入れる関数: ${raw.join(", ")}（結果がそのまま帳票の HTML になる。印刷屋が描画の前に外部への読み込みとスクリプトを除くが、崩れは防げない。差分で人が見る）`);
+  const dynamic = [];
+  for (const name of ["TAG", "VTAG"]) {
+    for (const args of callsOf(formula, name)) if (args[0] !== void 0 && !STRING_LITERAL.test(args[0])) dynamic.push(`${name} の要素名 ${args[0]}`);
+  }
+  for (const name of ["ATTR", "STYLE"]) {
+    for (const args of callsOf(formula, name)) {
+      args.forEach((a, i) => {
+        if (a !== "" && !STRING_LITERAL.test(a)) dynamic.push(`${name} の${i % 2 === 0 ? "名前" : "値"} ${a}`);
+      });
+    }
+  }
+  for (const args of callsOf(formula, "BATTR")) for (const a of args) if (a !== "" && !STRING_LITERAL.test(a)) dynamic.push(`BATTR の属性名 ${a}`);
+  if (dynamic.length) {
+    const shown = [...new Set(dynamic)];
+    f.warning("formula.attr", where, `要素名や属性にレコードの値や式を入れている: ${shown.slice(0, 5).join(" / ")}${shown.length > 5 ? ` 他 ${shown.length - 5}` : ""}（定数だけにする。印刷屋は描画の前に外部 URL と on 属性を除くが、属性の崩れは防げない）`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const lit of stringLiterals(formula)) {
+    if (seen.has(lit)) continue;
+    seen.add(lit);
+    if (HTML_LIKE.test(lit)) {
+      const h = await checkHtml(lit, { baseUrl: ctx.baseUrl });
+      for (const e of h.errors) f.warning("formula.html", where, `計算式の文字列の HTML: ${e}（印刷屋が描画の前に外部への読み込みとスクリプトを除く。差分で人が見る）`);
+      for (const u of h.externals) externalFinding(f, ctx, where, u.url, `計算式の文字列 ${u.via}`, false);
+    } else if (CSS_LIKE.test(lit)) {
+      const c = checkCss(/[{}]/.test(lit) ? lit : `x{${lit}}`);
+      for (const e of c.errors) f.warning("formula.html", where, `計算式の文字列の CSS: ${e}（印刷屋が描画の前に外部への読み込みを除く）`);
+      for (const u of c.externals) externalFinding(f, ctx, where, u.url, `計算式の文字列 CSS ${u.via}`, false);
+    }
+  }
+}
+async function checkBody(body, model, f, opt) {
+  const { PAPER_NAMES, PAGE_SIZES, DPI_OPTIONS, PRINT_MODES } = model.api;
+  const rows = body.pluginInfos ?? [];
+  const pp = model.pp;
+  const ext = body.externalRefs;
+  const mode = ext === "allow" ? "allow" : "block";
+  const ctx = { ...opt, mode, baseUrl: model.baseUrl || void 0 };
+  if (ext !== "block" && ext !== "allow") {
+    f.error("externalRefs.value", "共通の設定", `externalRefs は "block"（印刷屋が描画の前に kintone 以外への読み込みとスクリプトを除く）か "allow"（何も除かない。自己責任）: ${JSON.stringify(ext)}`);
+  } else if (ext === "allow") {
+    if (isExternalRefsAllowed(opt.policy, opt.settingsFile)) {
+      f.info("externalRefs.allowed", "共通の設定", `外部参照は「許可」（利用者が policy/authoring-policy.json の allowExternalRefs で承認済み）。印刷屋は帳票の HTML / CSS から何も除かない（Ver.5 と同じ。自己責任）。外部の URL は allowExternal で承認する`);
+    } else {
+      f.error("externalRefs.unapproved", "共通の設定", `外部参照が「許可」（externalRefs: "allow"。キーが無い Ver.5 の設定も印刷屋は許可で動く）。印刷屋は帳票の HTML / CSS から kintone 以外への読み込みとスクリプトを除かない（自己責任）ので利用者の承認が要る: 利用者が policy/authoring-policy.json の allowExternalRefs にこの設定ファイル（${opt.settingsFile ?? "ファイル名が分からない"}）を書く（AI は書かない）。新しい設定は "block"（描画の前に除く）を明示する`);
+    }
+  }
+  for (const [i, c] of (body.cssInfo ?? []).entries()) {
+    if (!c.state || !c.css) continue;
+    const where = `共通 CSS ${i + 1} 行目 (${c.name})`;
+    const r = checkCss(c.css);
+    for (const e of r.errors) f.error("css.rule", where, e);
+    for (const u of r.externals) externalFinding(f, ctx, where, u.url, `CSS ${u.via}`);
+  }
+  const font = body.fontInfo;
+  if (font?.enabled && font.cssUrl) {
+    if (!/^https:\/\//.test(font.cssUrl)) f.error("font.url", "Web フォント", `cssUrl は https の URL: ${font.cssUrl.slice(0, 80)}`);
+    else approvedFinding(f, opt, "Web フォント", font.cssUrl, "fontInfo.cssUrl");
+  }
+  const seenMenus = /* @__PURE__ */ new Map();
+  for (const [i, row] of rows.entries()) {
+    const label = rowLabel(row, i);
+    if (row.state) {
+      const prev = seenMenus.get(row.menu);
+      if (prev !== void 0) f.error("menu.duplicate", label, `有効なボタンの名前が ${prev + 1} 番目と同じ: ${row.menu}（diff と preview の出力が区別できない。名前を変える）`);
+      else seenMenus.set(row.menu, i);
+    }
+    const tags = row.tagsInfo;
+    if (!tags) {
+      if (row.state) f.error("tags.rows", label, "有効なボタンに HTML 設定（tagsInfo）が無い（ボタンは出るが帳票を作れない。無効にするか HTML 設定を書く）");
+      else f.info("tags.missing", label, "無効なボタンに HTML 設定が無い");
+      continue;
+    }
+    if (!PAPER_NAMES.includes(tags.pageSize)) f.error("tags.pageSize", label, `pageSize が使えない値: ${tags.pageSize}（${PAPER_NAMES.join(", ")}）`);
+    else if (!PAGE_SIZES.includes(tags.pageSize)) f.warning("tags.pageSize", label, `pageSize ${tags.pageSize} は設定画面の候補に無い（動くが画面で選べない）`);
+    if (tags.orientation !== "p" && tags.orientation !== "l") f.error("tags.orientation", label, `orientation は p か l: ${tags.orientation}`);
+    if (!DPI_OPTIONS.includes(String(tags.dpi))) f.error("tags.dpi", label, `dpi は "96" か "150": ${JSON.stringify(tags.dpi)}`);
+    if (tags.printMode !== void 0 && !PRINT_MODES.includes(tags.printMode)) f.error("tags.printMode", label, `printMode は ${PRINT_MODES.join(" / ")}: ${tags.printMode}`);
+    if (row.list && tags.printMode && tags.printMode !== "preview") f.info("tags.printMode", label, "一覧帳票では printMode は効かない（常にプレビュー）");
+    if (tags.filecode) {
+      const p = model.pp[tags.filecode];
+      if (!p) f.error("tags.filecode", label, `filecode の項目が fields に無い: ${tags.filecode}`);
+      else if (p.type !== "FILE") f.error("tags.filecode", label, `filecode は添付ファイル項目: ${tags.filecode} は ${p.type}`);
+      else if (p.ptcode) f.error("tags.filecode", label, `filecode はテーブルの外の添付ファイル項目: ${tags.filecode} はテーブル ${p.ptcode} の中`);
+    } else if (row.list === false && row.state) {
+      f.info("tags.filecode", label, "保存先が無い（PC はダウンロード、iPhone は共有シート、Android の kintone アプリは案内）");
+    }
+    const fieldsInfo = tags.fieldsInfo;
+    if (fieldsInfo.length < 2) f.error("tags.rows", label, `HTML 設定は 1 行目 $out（ボタン表示条件）、2 行目 $fname（ファイル名）、3 行目以降が帳票。行が ${fieldsInfo.length} しか無い`);
+    if (fieldsInfo[0] && fieldsInfo[0].fieldcode !== "$out") f.error("tags.rows", label, `1 行目の fieldcode は $out: ${fieldsInfo[0].fieldcode}`);
+    if (fieldsInfo[1] && fieldsInfo[1].fieldcode !== "$fname") f.error("tags.rows", label, `2 行目の fieldcode は $fname: ${fieldsInfo[1].fieldcode}`);
+    if (!fieldsInfo.slice(2).some((t) => t.state && (t.html || t.formulaSet))) f.warning("tags.rows", label, "有効な帳票の行（3 行目以降の html か計算式）が無い");
+    for (const [j, t] of fieldsInfo.entries()) {
+      const where = `${label} / ${tagRowLabel(t, j)}`;
+      for (const code of Object.keys(t.usedFields ?? {})) {
+        if (code === UOG_MARK) continue;
+        if (!fieldExists(model, code)) f.error("field.unknown", where, `項目が fields に無い: ${code}（ラベルで書いた、別アプリの項目、綴りの違い）`);
+      }
+      if (!t.state) continue;
+      if (t.formulaSet && commentInsideString(t.formulaSet)) f.error("formula.comment", where, '計算式の文字列の中に // がある（"https://…" など）。印刷屋は文字列の中でも // 以降をコメントとして捨てるので式が壊れる。URL は HTML の属性か ##目印## に置く');
+      escapeFinding(f, where, [t.formula || "", ...t.html ? expressionsOf(t.html) : []]);
+      const formula = t.formula || "";
+      if (formula && j >= 2) await checkFormulaHtml(formula, where, f, ctx);
+      if (t.html) {
+        const r = await checkHtml(t.html, { baseUrl: ctx.baseUrl });
+        for (const e of r.errors) f.error("html.rule", where, e);
+        for (const w of r.warnings) f.warning("html.rule", where, w);
+        for (const u of r.externals) externalFinding(f, ctx, where, u.url, u.via);
+        const rawExprs = expressionsOf(t.html).filter((e) => !isSafeExpression(e, pp));
+        if (rawExprs.length) f.warning("html.rawExpression", where, `\${式} が文字列をエスケープせずに差し込んでいる: ${rawExprs.slice(0, 5).map((e) => `\${${e}}`).join(" ")}${rawExprs.length > 5 ? ` 他 ${rawExprs.length - 5}` : ""}（文字列の項目は \${ESC_HTML(項目)}、複数行は \${REPLACE(ESC_HTML(項目), NEWLINE(), "<br>")}。数値・日付の項目と FVAL / DATE_FORMAT はそのままでよい）`);
+      }
+      if (t.css) {
+        const r = checkCss(t.css);
+        for (const e of r.errors) f.error("css.rule", where, e);
+        for (const u of r.externals) externalFinding(f, ctx, where, u.url, `CSS ${u.via}`);
+      }
+    }
+    const outRow = fieldsInfo[0];
+    if (outRow?.state && outRow.usedFields && UOG_MARK in outRow.usedFields && !body.pluginUOG) {
+      f.info("uog.condition", label, "ボタン表示条件で UINFO / OINFO / GINFO を使っているが pluginUOG は偽（更新項目だけで決まる仕様。実機では評価できる）");
+    }
+    for (const [j, c] of row.calcInfo.fieldsInfo.entries()) {
+      if (!c.state) continue;
+      if (c.formulaSet && commentInsideString(c.formulaSet)) f.error("formula.comment", `${label} / 更新項目 ${j + 1} 行目 (${c.fieldcode})`, "計算式の文字列の中に // がある。印刷屋は文字列の中でも // 以降をコメントとして捨てるので式が壊れる");
+      escapeFinding(f, `${label} / 更新項目 ${j + 1} 行目 (${c.fieldcode})`, [c.formula || ""]);
+      for (const code of Object.keys(c.usedFields ?? {})) {
+        if (code === UOG_MARK) continue;
+        if (!fieldExists(model, code)) f.error("field.unknown", `${label} / 更新項目 ${j + 1} 行目 (${c.fieldcode})`, `項目が fields に無い: ${code}`);
+      }
+    }
+  }
+}
+
+// src/normalize/size.ts
+async function measureStored(data, api) {
+  const limits = api.DEFAULT_LIMITS;
+  try {
+    const stored = await api.writeConfig(data, "compressed");
+    const entries = Object.entries(stored);
+    const totalBytes = entries.reduce((n, [k, v]) => n + Buffer.byteLength(k, "utf8") + Buffer.byteLength(v, "utf8"), 0);
+    const split = entries.filter(([k]) => /^json\d*$/.test(k)).length;
+    return { ok: true, totalBytes, maxTotalBytes: limits.maxTotalBytes, splitCount: split, maxValueLength: Math.max(0, ...entries.map(([, v]) => v.length)), maxValueLimit: limits.maxValueLength };
+  } catch (e) {
+    const message = e instanceof api.ConfigStoreError ? e.message : String(e?.message ?? e);
+    return { ok: false, totalBytes: 0, maxTotalBytes: limits.maxTotalBytes, splitCount: 0, maxValueLength: 0, maxValueLimit: limits.maxValueLength, error: message };
+  }
+}
+function formatSize(s) {
+  if (!s.ok) return `保存値が kintone の制限を超える: ${s.error}`;
+  const pct = Math.round(s.totalBytes / s.maxTotalBytes * 100);
+  return `保存値（compressed）${s.totalBytes.toLocaleString()} bytes / 上限 ${s.maxTotalBytes.toLocaleString()}（${pct}%。残り ${(s.maxTotalBytes - s.totalBytes).toLocaleString()}）、分割 ${s.splitCount}`;
+}
+
+// src/commands/normalize.ts
+var PLUGIN_NAME = "印刷屋プラグイン";
+var MAX_INPUT_BYTES = 16 * 1024 * 1024;
+var InputError = class extends Error {
+};
+var pad2 = (n) => String(n).padStart(2, "0");
+function formatDate(d) {
+  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}`;
+}
+function jsonDiff(a, b, pathStr, out) {
+  if (JSON.stringify(a) === JSON.stringify(b)) return;
+  if (a && b && typeof a === "object" && typeof b === "object" && !Array.isArray(a) && !Array.isArray(b)) {
+    for (const k of /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])) jsonDiff(a[k], b[k], `${pathStr}.${k}`, out);
+    return;
+  }
+  if (Array.isArray(a) && Array.isArray(b) && a.length === b.length) {
+    a.forEach((x, i) => jsonDiff(x, b[i], `${pathStr}[${i}]`, out));
+    return;
+  }
+  const short = (v) => {
+    const s = JSON.stringify(v);
+    return s === void 0 ? "undefined" : s.length > 100 ? s.slice(0, 100) + "…" : s;
+  };
+  out.push(`${pathStr}: ${short(a)} → ${short(b)}`);
+}
+async function normalizeSettings(input) {
+  const f = new Findings();
+  const api = input.engine.api;
+  const pluginVersion = api.pluginVersion;
+  const where = input.settingsFile ?? "settings";
+  let envelope;
+  try {
+    envelope = api.parseJsonSafely(input.settingsText, api.CONFIG_LIMITS);
+  } catch (e) {
+    f.error("json", where, `JSON として読めない、または大きすぎる（${api.CONFIG_LIMITS.maxBytes.toLocaleString()} バイトまで）: ${e.message}`);
+    return { findings: f, summary: "JSON を読めない" };
+  }
+  if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+    f.error("json", where, "JSON の最上位はオブジェクト（封筒形式）");
+    return { findings: f, summary: "封筒形式でない" };
+  }
+  if (envelope.pluginID !== api.pluginId) f.error("envelope.pluginID", where, `pluginID は "${api.pluginId}": ${JSON.stringify(envelope.pluginID)}（封筒なしの素の設定は作らない）`);
+  const envVersion = String(envelope.PluginVersion ?? "");
+  if (!isSupportedPluginVersion(envVersion)) f.error("envelope.version", where, `PluginVersion は印刷屋の版（Ver.${MIN_PLUGIN_VERSION} 以降、zip は ${pluginVersion}）: ${JSON.stringify(envelope.PluginVersion)}`);
+  else if (Number(envVersion) > Number(pluginVersion)) f.error("envelope.version", where, `PluginVersion ${envVersion} の設定を、それより古い印刷屋の zip（版 ${pluginVersion}）で検査しようとしている。アプリに入れた版の zip を .env の PCRAFT_PLUGIN_ZIP に書く`);
+  else if (envVersion !== pluginVersion) f.info("envelope.version.upgrade", where, `PluginVersion ${envVersion} の設定を印刷屋の版 ${pluginVersion}（zip）で検査し、書き出す封筒は ${pluginVersion} にする`);
+  if (envelope.appId !== void 0) {
+    if (typeof envelope.appId !== "number" || !Number.isInteger(envelope.appId) || envelope.appId <= 0) f.error("envelope.appId", where, `appId は正の整数（数値）: ${JSON.stringify(envelope.appId)}`);
+    else if (envelope.appId !== input.fields.appId) f.warning("envelope.appId", where, `appId ${envelope.appId} が fields のアプリ ${input.fields.appId} と違う`);
+  }
+  if (f.hasErrors) return { findings: f, summary: "封筒の誤り" };
+  const inputBody = bodyOf(envelope);
+  let inputClean;
+  try {
+    inputClean = api.validate(inputBody, api.CONFIG_SCHEMA, api.CONFIG_LIMITS);
+  } catch (e) {
+    if (e instanceof api.ValidationError) {
+      f.error("schema", where, `設定のスキーマに合わない: ${e.message}`);
+      return { findings: f, summary: "スキーマの誤り" };
+    }
+    throw e;
+  }
+  const model = buildModel(input.fields, api, input.baseUrl);
+  if (input.baseUrl && typeof input.fields.baseUrl === "string" && input.fields.baseUrl && model.fieldsBaseUrl !== input.baseUrl) {
+    f.warning("fields.baseUrl", where, `fields の baseUrl（${input.fields.baseUrl.slice(0, 60)}）が .env の KINTONE_BASE_URL と違う。iframe の判定は .env の接続先で行う。fields を取り直すなら npx @rex0220/print-craft-authoring-tools fields --app ${input.fields.appId}`);
+  }
+  const body = deriveBody(JSON.parse(JSON.stringify(inputClean)), model, input.engine, f);
+  const policy = input.policy ?? { allowExternal: [] };
+  await checkBody(body, model, f, { policy, settingsFile: input.settingsFile });
+  let cleaned;
+  try {
+    cleaned = api.validate(body, api.CONFIG_SCHEMA, api.CONFIG_LIMITS);
+  } catch (e) {
+    if (e instanceof api.ValidationError) {
+      f.error("schema", where, `正規化した設定がスキーマに合わない: ${e.message}`);
+      return { findings: f, body, summary: "スキーマの誤り" };
+    }
+    throw e;
+  }
+  const size = await measureStored(cleaned, api);
+  if (!size.ok) f.error("size", where, formatSize(size));
+  else f.info("size", where, formatSize(size));
+  let checkDiffs;
+  if (input.check) {
+    checkDiffs = [];
+    jsonDiff(inputClean, cleaned, "$", checkDiffs);
+  }
+  const rows = cleaned.pluginInfos ?? [];
+  const summary = `アプリ ${input.fields.appId} ${input.fields.appName}、ボタン ${rows.length}（有効 ${rows.filter((r) => r.state).length}）`;
+  if (f.hasErrors) return { findings: f, body: cleaned, size, checkDiffs, summary };
+  const now = (input.now ?? (() => /* @__PURE__ */ new Date()))();
+  const output = {
+    date: formatDate(now),
+    pluginName: typeof envelope.pluginName === "string" && envelope.pluginName ? envelope.pluginName : PLUGIN_NAME,
+    pluginID: api.pluginId,
+    PluginVersion: pluginVersion,
+    appId: input.fields.appId,
+    appName: typeof envelope.appName === "string" && envelope.appName ? envelope.appName : input.fields.appName
+  };
+  for (const k of ENVELOPE_KEYS) if (!(k in output)) output[k] = envelope[k];
+  Object.assign(output, cleaned);
+  return { findings: f, output, body: cleaned, size, checkDiffs, summary };
+}
+function readTextLimited(file, maxBytes = MAX_INPUT_BYTES) {
+  const size = statSync4(file).size;
+  if (size > maxBytes) throw new InputError(`${file} が大きすぎる（${size.toLocaleString()} バイト。上限 ${maxBytes.toLocaleString()}）`);
+  return readFileSync7(file, "utf8");
+}
+function readJsonLimited(file, maxBytes = MAX_INPUT_BYTES) {
+  let v;
+  try {
+    v = JSON.parse(readTextLimited(file, maxBytes));
+  } catch (e) {
+    if (e instanceof InputError) throw e;
+    throw new InputError(`${file} を JSON として読めない: ${e.message}`);
+  }
+  if (!v || typeof v !== "object" || Array.isArray(v)) throw new InputError(`${file} の最上位はオブジェクト`);
+  return v;
+}
+async function readFieldsFile(file) {
+  const fields = readJsonLimited(file);
+  if (!fields.properties || typeof fields.properties !== "object") throw new InputError(`${file} は fields コマンドの出力ではない（properties が無い）`);
+  if (typeof fields.appId !== "number" || !Number.isInteger(fields.appId) || fields.appId <= 0) throw new InputError(`${file} の appId が正の整数でない`);
+  return fields;
+}
+function relativeSettingsPath(file, cwd) {
+  const rel2 = path9.relative(cwd, path9.resolve(cwd, file));
+  return rel2.startsWith("..") ? file : rel2.replace(/\\/g, "/");
+}
+
+// src/commands/save.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync6, mkdirSync, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import path11 from "node:path";
+
+// src/commit-file.ts
+import { randomBytes } from "node:crypto";
+import { constants, copyFileSync, linkSync, lstatSync as lstatSync2, readFileSync as readFileSync8, renameSync, rmSync, writeFileSync } from "node:fs";
+import path10 from "node:path";
+var LOCK_STALE_MS = 6e4;
+var FileExistsError = class extends Error {
+};
+var LockBusyError = class extends Error {
+};
+var errCode = (e) => e?.code;
+var rand = () => randomBytes(6).toString("hex");
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withRetry(fn, tries = 3) {
+  for (let i = 1; ; i++) {
+    try {
+      return fn();
+    } catch (e) {
+      const code = errCode(e);
+      if (i < tries && (code === "EPERM" || code === "EBUSY")) {
+        sleepSync(20 * i);
+        continue;
+      }
+      throw e;
+    }
+  }
+}
+function cleanupAll(steps, tries = 3) {
+  const errors = [];
+  for (const step of steps) {
+    try {
+      withRetry(step, tries);
+    } catch (e) {
+      errors.push(e instanceof Error ? e.message : String(e));
+    }
+  }
+  return errors;
+}
+function tempPathFor(target) {
+  return path10.join(path10.dirname(target), `.${path10.basename(target)}.${rand()}.tmp`);
+}
+function placeNew(tmp, target, link = linkSync) {
+  try {
+    link(tmp, target);
+    return;
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "EEXIST") throw new FileExistsError(`確定の直前に同じ名前のファイルができた: ${path10.basename(target)}`);
+    if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EXDEV" && code !== "ENOSYS") throw e;
+  }
+  try {
+    copyFileSync(tmp, target, constants.COPYFILE_EXCL);
+  } catch (e) {
+    if (errCode(e) === "EEXIST") throw new FileExistsError(`確定の直前に同じ名前のファイルができた: ${path10.basename(target)}`);
+    throw e;
+  }
+}
+function writeNewFile(target, text, recheck = () => {
+}) {
+  const tmp = tempPathFor(target);
+  let placed = false;
+  let failure;
+  try {
+    recheck();
+    writeFileSync(tmp, text, { encoding: "utf8", flag: "wx" });
+    recheck();
+    placeNew(tmp, target);
+    placed = true;
+  } catch (e) {
+    failure = e;
+  }
+  const cleanup = cleanupAll([() => rmSync(tmp, { force: true })]);
+  if (!placed) throw failure;
+  return { cleanup };
+}
+function lockPathFor(target) {
+  return path10.join(path10.dirname(target), `.${path10.basename(target)}.pcraft-lock`);
+}
+function lstatOrNull(p) {
+  try {
+    return lstatSync2(p);
+  } catch (e) {
+    if (errCode(e) === "ENOENT") return null;
+    throw e;
+  }
+}
+function acquireLock(target, staleMs = LOCK_STALE_MS, hooks = {}) {
+  const file = lockPathFor(target);
+  const token = randomBytes(16).toString("hex");
+  const busy = (why = "同じファイルへの別の保存が進行中。少し待ってからやり直す") => new LockBusyError(why);
+  const tryCreate = () => {
+    try {
+      writeFileSync(file, token, { flag: "wx" });
+      return true;
+    } catch (e) {
+      if (errCode(e) === "EEXIST") return false;
+      throw e;
+    }
+  };
+  const isStale = (st) => Date.now() - st.mtimeMs > staleMs;
+  if (!tryCreate()) {
+    const st = lstatOrNull(file);
+    if (st && !st.isFile()) throw busy(`ロックのファイルが普通のファイルでない: ${path10.basename(file)}（利用者が確かめて消す）`);
+    if (st && !isStale(st)) throw busy();
+    if (st) {
+      const aside = `${file}.${rand()}.stale`;
+      hooks.beforeClaim?.();
+      try {
+        withRetry(() => renameSync(file, aside));
+      } catch (e) {
+        if (errCode(e) !== "ENOENT") throw e;
+      }
+      const moved = lstatOrNull(aside);
+      if (moved) {
+        if (!moved.isFile()) throw busy(`ロックのファイルが普通のファイルでない: ${path10.basename(aside)}（利用者が確かめて消す）`);
+        if (!isStale(moved)) {
+          hooks.beforeRestore?.();
+          try {
+            withRetry(() => placeNew(aside, file));
+          } catch (e) {
+            if (!(e instanceof FileExistsError)) throw busy(`新しいロックを戻せなかった（${errCode(e) ?? e.message}）: ${path10.basename(aside)} を確かめて ${path10.basename(file)} に戻すか消す`);
+          }
+          cleanupAll([() => rmSync(aside, { force: true })]);
+          throw busy();
+        }
+        cleanupAll([() => rmSync(aside, { force: true })]);
+      }
+    }
+    if (!tryCreate()) throw busy();
+  }
+  const owned = () => {
+    try {
+      const st = lstatSync2(file);
+      return st.isFile() && readFileSync8(file, "utf8") === token;
+    } catch {
+      return false;
+    }
+  };
+  return {
+    owned,
+    release: () => {
+      if (!owned()) return false;
+      withRetry(() => rmSync(file, { force: true }));
+      return true;
+    }
+  };
+}
+
+// src/commands/save.ts
+var MAX_SAVE_INPUT_BYTES = 256 * 1024;
+function digestOf(text) {
+  return createHash2("sha256").update(text).digest("hex");
+}
+var rel = (root, abs) => path11.relative(root, abs).replace(/\\/g, "/");
+var SaveDenied = class extends Error {
+};
+var ConflictError = class extends Error {
+};
+function fieldsFileFor(ctx, target, fields) {
+  const folder = appFolderOfFile(ctx.root, target);
+  if (folder) {
+    const own = resolveRead(path11.join(folder.dir, "fields.json"), ctx.root);
+    if (!existsSync6(own)) throw new InputError(`アプリのフォルダーに fields.json が無い: ${rel(ctx.root, own)}（fields コマンドか pcraft_fields で取る）`);
+    if (fields !== void 0 && resolveRead(fields, ctx.root) !== own) throw new SaveDenied(`アプリのフォルダーの中の設定は、同じフォルダーの fields.json で検査する（fields は渡さないか、${rel(ctx.root, own)} にする）`);
+    return own;
+  }
+  if (!fields) throw new InputError("fields（項目定義のファイル）が要る（アプリのフォルダー kintone/<ホスト名>/<番号>-…/ の中なら同じフォルダーの fields.json を使う）");
+  const file = resolveRead(fields, ctx.root);
+  if (!existsSync6(file)) throw new InputError(`項目定義のファイルが無い: ${rel(ctx.root, file)}（fields コマンドか pcraft_fields で取る）`);
+  return file;
+}
+function tooLarge(text) {
+  return Buffer.byteLength(text, "utf8") > MAX_SAVE_INPUT_BYTES;
+}
+function commit(ctx, target, text, mode, recheck) {
+  const tmp = tempPathFor(target);
+  let lock;
+  let digest;
+  let failure;
+  const checkTarget = () => {
+    if (resolveWrite(rel(ctx.root, target), WRITE_ROOTS.settings, ctx.root) !== target) throw new SaveDenied("書く先のフォルダーが途中で変わった（symlink など）");
+    assertChangeAllowed(ctx.root, target, "settings");
+    if (SNAPSHOT_RE.test(path11.basename(target))) throw new SaveDenied("ダウンロード / pull のファイルは書き換えない。edit で -edit.json に写して直す");
+  };
+  try {
+    checkTarget();
+    mkdirSync(path11.dirname(target), { recursive: true });
+    writeFileSync2(tmp, text, { encoding: "utf8", flag: "wx" });
+    lock = acquireLock(target);
+    checkTarget();
+    recheck();
+    if (!lock.owned()) throw new ConflictError("ロックを失った（保存が 60 秒より長く止まった）。pcraft_buttons で読み直してやり直す");
+    if (mode === "new") withRetry(() => placeNew(tmp, target));
+    else withRetry(() => renameSync2(tmp, target));
+    digest = digestOf(text);
+    ctx.afterPlace?.();
+  } catch (e) {
+    failure = e;
+  }
+  const cleanup = cleanupAll([...lock ? [() => void lock.release()] : [], () => rmSync2(tmp, { force: true })]);
+  if (digest === void 0) throw failure;
+  return { digest, cleanup };
+}
+async function normalizeText(ctx, target, text, fields) {
+  const fieldsData = await readFieldsFile(fieldsFileFor(ctx, target, fields));
+  ctx.engine.setContext({ baseUrl: ctx.baseUrl ?? "https://example.cybozu.com", appId: fieldsData.appId });
+  return normalizeSettings({ settingsText: text, settingsFile: rel(ctx.root, target), fields: fieldsData, engine: ctx.engine, policy: ctx.policy, baseUrl: ctx.baseUrl });
+}
+function statusOf(e) {
+  if (e instanceof ConflictError || e instanceof FileExistsError || e instanceof LockBusyError) return "conflict";
+  if (e instanceof SaveDenied || e instanceof PermissionError || e instanceof PathError) return "denied";
+  if (e instanceof InputError || e instanceof SyntaxError) return "invalid";
+  return "failed";
+}
+function codeOf(e) {
+  if (e instanceof ConflictError || e instanceof FileExistsError || e instanceof LockBusyError) return "ConflictError";
+  if (e instanceof SaveDenied || e instanceof PermissionError) return "PermissionError";
+  return e instanceof Error ? e.constructor.name : "Error";
+}
+function errorResult(root, target, e, findings = []) {
+  return { status: statusOf(e), code: codeOf(e), path: rel(root, target), findings, message: e instanceof Error ? e.message : String(e) };
+}
+function finish(ctx, target, findings, run) {
+  try {
+    const { digest, cleanup } = run();
+    return { status: "ok", path: rel(ctx.root, target), digest, findings, ...cleanup.length ? { cleanup, message: `確定したが、一時ファイルかロックを消せなかった（.${path11.basename(target)}.* を消してよい）` } : {} };
+  } catch (e) {
+    return errorResult(ctx.root, target, e, findings);
+  }
+}
+async function saveNewSettings(ctx, opt) {
+  if (opt.expectedAbsent !== true) return { status: "invalid", code: "InputError", path: opt.path, findings: [], message: "新しい設定の保存は expectedAbsent: true が要る（既存のファイルを直すなら pcraft_update_button）" };
+  if (tooLarge(opt.content)) return { status: "invalid", code: "InputError", path: opt.path, findings: [], message: `content は ${MAX_SAVE_INPUT_BYTES} バイトまで` };
+  let target;
+  try {
+    target = resolveWrite(opt.path, WRITE_ROOTS.settings, ctx.root);
+    if (SNAPSHOT_RE.test(path11.basename(target))) throw new SaveDenied("ダウンロード / pull の名前（rex0220-print-craft-app<番号>-<日時>.json）では新しく保存しない");
+    assertChangeAllowed(ctx.root, target, "settings");
+  } catch (e) {
+    return errorResult(ctx.root, path11.resolve(ctx.root, opt.path), e);
+  }
+  if (existsSync6(target)) return { status: "conflict", code: "ConflictError", path: rel(ctx.root, target), findings: [], message: "同じ名前のファイルがある（新しい設定の保存は上書きしない。直すなら pcraft_update_button）" };
+  let result;
+  try {
+    result = await normalizeText(ctx, target, opt.content, opt.fields);
+  } catch (e) {
+    return errorResult(ctx.root, target, e);
+  }
+  if (!result.output) return { status: "invalid", code: "NormalizeError", path: rel(ctx.root, target), findings: result.findings.items, message: "normalize のエラーがあるので保存しない" };
+  const text = JSON.stringify(result.output, null, 2) + "\n";
+  return finish(
+    ctx,
+    target,
+    result.findings.items,
+    () => commit(ctx, target, text, "new", () => {
+      if (existsSync6(target)) throw new ConflictError("確定の直前に同じ名前のファイルができた");
+    })
+  );
+}
+async function updateButton(ctx, opt) {
+  if (tooLarge(opt.replacement)) return { status: "invalid", code: "InputError", path: opt.path, findings: [], message: `replacement は ${MAX_SAVE_INPUT_BYTES} バイトまで` };
+  let target;
+  try {
+    target = resolveRead(opt.path, ctx.root);
+    resolveWrite(opt.path, WRITE_ROOTS.settings, ctx.root);
+    if (SNAPSHOT_RE.test(path11.basename(target))) throw new SaveDenied("ダウンロード / pull のファイルは書き換えない。edit で -edit.json に写して直す");
+    assertChangeAllowed(ctx.root, target, "settings");
+  } catch (e) {
+    return errorResult(ctx.root, path11.resolve(ctx.root, opt.path), e);
+  }
+  if (!existsSync6(target)) return { status: "conflict", code: "ConflictError", path: rel(ctx.root, target), findings: [], message: "ファイルが無い（新しい設定なら pcraft_save_settings）" };
+  const current = readFileSync9(target);
+  if (digestOf(current) !== opt.expectedDigest) return { status: "conflict", code: "ConflictError", path: rel(ctx.root, target), findings: [], message: "読んだ後にファイルが変わった（digest が違う）。pcraft_buttons で読み直す" };
+  let settings;
+  let replacement;
+  try {
+    settings = JSON.parse(current.toString("utf8"));
+    replacement = JSON.parse(opt.replacement);
+  } catch (e) {
+    return { status: "invalid", code: "InputError", path: rel(ctx.root, target), findings: [], message: `JSON として読めない: ${e.message}` };
+  }
+  if (!replacement || typeof replacement !== "object" || Array.isArray(replacement) || replacement.menu !== opt.button) {
+    return { status: "invalid", code: "InputError", path: rel(ctx.root, target), findings: [], message: "replacement はボタン 1 つ（pluginInfos の 1 行）のオブジェクトで、menu が button と同じ" };
+  }
+  const rows = Array.isArray(settings.pluginInfos) ? [...settings.pluginInfos] : [];
+  const i = rows.findIndex((r) => r && r.menu === opt.button);
+  if (i >= 0) rows[i] = replacement;
+  else rows.push(replacement);
+  let result;
+  try {
+    result = await normalizeText(ctx, target, JSON.stringify({ ...settings, pluginInfos: rows }), opt.fields);
+  } catch (e) {
+    return errorResult(ctx.root, target, e);
+  }
+  if (!result.output) return { status: "invalid", code: "NormalizeError", path: rel(ctx.root, target), findings: result.findings.items, message: "normalize のエラーがあるので保存しない" };
+  const text = JSON.stringify(result.output, null, 2) + "\n";
+  return finish(
+    ctx,
+    target,
+    result.findings.items,
+    () => commit(ctx, target, text, "replace", () => {
+      if (digestOf(readFileSync9(target)) !== opt.expectedDigest) throw new ConflictError("確定の直前にファイルが変わった（digest が違う）。pcraft_buttons で読み直す");
+    })
+  );
+}
+
+// src/commands/buttons.ts
+import { createHash as createHash3 } from "node:crypto";
+var ButtonNotFoundError = class extends Error {
+};
+var kb = (v) => `${(Buffer.byteLength(JSON.stringify(v) ?? "", "utf8") / 1024).toFixed(1)} KB`;
+var oneLine = (s, max = 160) => {
+  const t = s.replace(/\s+/g, " ").trim();
+  return t.length > max ? `${t.slice(0, max)}…` : t;
+};
+var chars = (s) => [...s ?? ""].length;
+function shortenDataUrls(s, opt = {}) {
+  return s.replace(/data:[^"'\s)<>]{120,}/g, (m) => `${m.slice(0, 40)}…（data URL ${m.length.toLocaleString()} 文字${opt.hash ? `、sha256 ${createHash3("sha256").update(m).digest("hex").slice(0, 8)}` : ""}）`);
+}
+function screensOf(b) {
+  const ids = (b.viewsCsv ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  const lists = ids.filter((x) => x !== "-");
+  const listText = ids.length === 0 ? "すべての一覧" : lists.length ? `一覧 ${lists.join(",")}` : "";
+  if (b.list) return `一覧帳票（${listText || "どの一覧にも出ない"}）`;
+  const detail2 = ids.length === 0 || ids.includes("-");
+  return [detail2 ? "詳細画面" : "", listText ? `${listText}で一括処理` : ""].filter(Boolean).join(" + ") || "どの画面にも出ない";
+}
+function headline(b, i) {
+  const t = b.tagsInfo ?? {};
+  const parts = [
+    b.state ? "有効" : "無効",
+    screensOf(b),
+    t.filecode ? `保存先 ${t.filecode}` : "保存先なし（ダウンロード）",
+    `${t.pageSize ?? "?"} ${t.orientation === "l" ? "横" : t.orientation === "p" ? "縦" : t.orientation ?? "?"} ${t.dpi ?? "?"} dpi`,
+    `押したとき ${t.printMode ?? "preview"}`,
+    ...b.authority ? ["権限で絞る"] : [],
+    kb(b)
+  ];
+  return `${i + 1}. ${b.menu ?? "(名前なし)"}（${parts.join("、")}）`;
+}
+function overview(b) {
+  const rows = b.tagsInfo?.fieldsInfo ?? [];
+  const [out, fname, ...body] = rows;
+  const lines = [];
+  lines.push(`   表示条件: ${out ? out.state && out.formulaSet?.trim() ? oneLine(out.formulaSet) : "なし（常に出す）" : "（1 行目が無い）"}`);
+  lines.push(`   ファイル名: ${fname ? fname.state && fname.formulaSet?.trim() ? oneLine(fname.formulaSet) : "なし" : "（2 行目が無い）"}`);
+  const bodies = body.map((r, j) => `${j + 3} 行目 ${r.desc || "(説明なし)"}${r.state ? "" : "（無効）"}: HTML ${chars(r.html).toLocaleString()} 文字、CSS ${chars(r.css).toLocaleString()} 文字、計算式 ${(r.formulaSet ?? "").trim() ? (r.formulaSet ?? "").split("\n").length : 0} 行`);
+  lines.push(`   帳票: ${bodies.length ? bodies.join(" / ") : "なし"}`);
+  const calc = (b.calcInfo?.fieldsInfo ?? []).filter((c) => c.fieldcode !== "$out");
+  lines.push(`   更新項目: ${calc.length ? calc.map((c) => `${c.fieldcode}${c.state ? "" : "（無効）"}`).join(", ") : "なし"}`);
+  return lines;
+}
+function detail(b, i) {
+  const lines = [headline(b, i)];
+  for (const k of ["menu_en", "menu_ja", "menu_zh", "desc", "desc_en", "desc_ja", "desc_zh", "remark", "users", "organizations", "groups", "guest"]) {
+    const v = b[k];
+    if (typeof v === "string" && v) lines.push(`${k}: ${oneLine(v, 400)}`);
+  }
+  for (const [j, r] of (b.tagsInfo?.fieldsInfo ?? []).entries()) {
+    const role = j === 0 ? "$out ボタン表示条件" : j === 1 ? "$fname ファイル名" : "帳票";
+    lines.push(`--- HTML 設定 ${j + 1} 行目 ${role}（${r.state ? "有効" : "無効"}）${r.desc ? ` ${r.desc}` : ""}${r.remark ? ` 備考: ${oneLine(r.remark, 200)}` : ""}`);
+    if (j >= 2 && r.css) lines.push("CSS:", shortenDataUrls(r.css));
+    if (j >= 2 && r.html) lines.push("HTML:", shortenDataUrls(r.html));
+    if (r.formulaSet) lines.push("計算式:", shortenDataUrls(r.formulaSet));
+  }
+  const calc = b.calcInfo?.fieldsInfo ?? [];
+  lines.push(`--- 更新項目 ${calc.length ? `${calc.length} 行` : "なし"}`);
+  for (const [j, c] of calc.entries()) lines.push(`${j + 1} 行目 ${c.fieldcode}（${c.state ? "有効" : "無効"}）: ${shortenDataUrls(c.formulaSet ?? "")}${c.remark ? `  備考: ${oneLine(c.remark, 200)}` : ""}`);
+  return lines;
+}
+function listButtons(settings, opt) {
+  const buttons = Array.isArray(settings.pluginInfos) ? settings.pluginInfos : [];
+  if (opt.button !== void 0) {
+    const hits = buttons.map((b, i) => ({ b, i })).filter(({ b }) => b.menu === opt.button);
+    if (!hits.length) throw new ButtonNotFoundError(`ボタン「${opt.button}」は ${opt.file} に無い（${buttons.map((b) => b.menu).join(", ") || "ボタンなし"}）`);
+    return [...hits.flatMap(({ b, i }) => detail(b, i)), "（data: の URL は先頭と長さだけ。ファイルには元のまま）"].join("\n");
+  }
+  const normalized = buttons.some((b) => (b.tagsInfo?.fieldsInfo ?? []).some((r) => typeof r.formula === "string"));
+  const font = settings.fontInfo;
+  const css = Array.isArray(settings.cssInfo) ? settings.cssInfo.length : 0;
+  const ext = settings.externalRefs;
+  const header = [
+    settings.appId !== void 0 ? `アプリ ${String(settings.appId)} ${typeof settings.appName === "string" ? settings.appName : ""}`.trim() : "アプリ不明",
+    `ボタン ${buttons.length}（有効 ${buttons.filter((b) => b.state).length}）`,
+    `外部参照 ${ext === "block" || ext === "allow" ? ext : ext === void 0 ? "キー無し（印刷屋は allow で動く）" : JSON.stringify(ext)}`,
+    `共通 CSS ${settings.commonCssEnable === false ? "無効" : css ? `${css} 行` : "既定（省略）"}`,
+    `Web フォント ${font?.enabled ? font.family ?? "有効" : "なし"}`,
+    normalized ? "派生値あり（normalize 済み）" : "派生値なし",
+    kb(settings)
+  ];
+  const lines = [`${opt.file}（${header.join("、")}）`];
+  for (const [i, b] of buttons.entries()) lines.push(headline(b, i), ...overview(b));
+  lines.push("中身は --button <名前>");
+  return lines.join("\n");
+}
+
+// src/normalize/line-diff.ts
+var MAX_CELLS = 4e6;
+function lineDiff(a, b) {
+  const A = a.split("\n");
+  const B = b.split("\n");
+  if (A.length * B.length > MAX_CELLS) {
+    return [...A.map((t) => ({ kind: "-", text: t })), ...B.map((t) => ({ kind: "+", text: t }))];
+  }
+  const n = A.length;
+  const m = B.length;
+  const dp = [];
+  for (let i2 = 0; i2 <= n; i2++) dp.push(new Uint32Array(m + 1));
+  for (let i2 = n - 1; i2 >= 0; i2--) for (let j2 = m - 1; j2 >= 0; j2--) dp[i2][j2] = A[i2] === B[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+  const out = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (A[i] === B[j]) {
+      out.push({ kind: " ", text: A[i] });
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      out.push({ kind: "-", text: A[i] });
+      i++;
+    } else {
+      out.push({ kind: "+", text: B[j] });
+      j++;
+    }
+  }
+  while (i < n) out.push({ kind: "-", text: A[i++] });
+  while (j < m) out.push({ kind: "+", text: B[j++] });
+  return out;
+}
+function formatDiff(lines, context = 2) {
+  const keep = new Array(lines.length).fill(false);
+  lines.forEach((l, i) => {
+    if (l.kind === " ") return;
+    for (let k = Math.max(0, i - context); k <= Math.min(lines.length - 1, i + context); k++) keep[k] = true;
+  });
+  const out = [];
+  let skipping = false;
+  lines.forEach((l, i) => {
+    if (!keep[i]) {
+      if (!skipping) out.push("  …");
+      skipping = true;
+      return;
+    }
+    skipping = false;
+    out.push(`${l.kind} ${l.text}`);
+  });
+  return out.join("\n");
+}
+
+// src/commands/diff.ts
+var DERIVED = /* @__PURE__ */ new Set(["formula", "usedFields", "id", "views", "pluginUOG"]);
+var ROW_SCALARS = ["state", "menu", "menu_en", "menu_ja", "menu_zh", "mcheck", "list", "authority", "guest", "users", "organizations", "groups", "desc", "desc_en", "desc_ja", "desc_zh", "remark", "viewsCsv"];
+var TAGS_SCALARS = ["filecode", "pageSize", "orientation", "dpi", "printMode"];
+var TAG_ROW_SCALARS = ["state", "desc", "remark", "fieldcode"];
+var TAG_ROW_TEXTS = ["css", "html", "formulaSet"];
+var show = (v) => v === void 0 ? "（無し）" : JSON.stringify(v);
+function scalarDiffs(a, b, keys, out, prefix) {
+  for (const k of keys) {
+    const x = a?.[k];
+    const y = b?.[k];
+    if (JSON.stringify(x) !== JSON.stringify(y)) out.push(`${prefix}${k}: ${show(x)} → ${show(y)}`);
+  }
+}
+function textDiff(label, a, b, out) {
+  if (a === b) return;
+  out.push(`${label}:`);
+  out.push(formatDiff(lineDiff(a, b)));
+}
+function diffSettings(beforeEnvelope, afterEnvelope, opt = {}) {
+  const out = [];
+  const a = bodyOf(beforeEnvelope);
+  const b = bodyOf(afterEnvelope);
+  for (const k of ["appId", "appName", "PluginVersion"]) if (JSON.stringify(beforeEnvelope[k]) !== JSON.stringify(afterEnvelope[k])) out.push(`封筒 ${k}: ${show(beforeEnvelope[k])} → ${show(afterEnvelope[k])}`);
+  scalarDiffs(a, b, ["pluginEnable", "pluginComment", "pluginDescription", "commonCssEnable", "externalRefs"], out, "");
+  if (JSON.stringify(a.menuInfo) !== JSON.stringify(b.menuInfo)) out.push(`menuInfo: ${show(a.menuInfo)} → ${show(b.menuInfo)}`);
+  if (JSON.stringify(a.fontInfo) !== JSON.stringify(b.fontInfo)) out.push(`Web フォント: ${show(a.fontInfo)} → ${show(b.fontInfo)}`);
+  if (JSON.stringify(a.guestsInfo) !== JSON.stringify(b.guestsInfo)) out.push(`ゲスト: ${show(a.guestsInfo)} → ${show(b.guestsInfo)}`);
+  const cssA = new Map((a.cssInfo ?? []).map((c, i) => [String(c.name ?? i), c]));
+  const cssB = new Map((b.cssInfo ?? []).map((c, i) => [String(c.name ?? i), c]));
+  for (const name of /* @__PURE__ */ new Set([...cssA.keys(), ...cssB.keys()])) {
+    const x = cssA.get(name);
+    const y = cssB.get(name);
+    if (!x) out.push(`共通 CSS ${name}: 追加`);
+    else if (!y) out.push(`共通 CSS ${name}: 削除`);
+    else {
+      scalarDiffs(x, y, ["state", "desc"], out, `共通 CSS ${name} / `);
+      textDiff(`共通 CSS ${name} / css`, String(x.css ?? ""), String(y.css ?? ""), out);
+    }
+  }
+  const key = (r, i, seen) => {
+    const base = String(r.menu ?? `#${i + 1}`);
+    const n = (seen.get(base) ?? 0) + 1;
+    seen.set(base, n);
+    return n === 1 ? base : `${base} (${n})`;
+  };
+  const seenA = /* @__PURE__ */ new Map();
+  const seenB = /* @__PURE__ */ new Map();
+  const rowsA = new Map((a.pluginInfos ?? []).map((r, i) => [key(r, i, seenA), r]));
+  const rowsB = new Map((b.pluginInfos ?? []).map((r, i) => [key(r, i, seenB), r]));
+  for (const name of /* @__PURE__ */ new Set([...rowsA.keys(), ...rowsB.keys()])) {
+    const x = rowsA.get(name);
+    const y = rowsB.get(name);
+    const p = `ボタン ${name} / `;
+    if (!x) {
+      out.push(`ボタン ${name}: 追加`);
+      continue;
+    }
+    if (!y) {
+      out.push(`ボタン ${name}: 削除`);
+      continue;
+    }
+    scalarDiffs(x, y, ROW_SCALARS, out, p);
+    const tx = x.tagsInfo;
+    const ty = y.tagsInfo;
+    if (!!tx !== !!ty) out.push(`${p}HTML 設定: ${tx ? "削除" : "追加"}`);
+    else if (tx && ty) {
+      scalarDiffs(tx, ty, TAGS_SCALARS, out, `${p}HTML 設定 / `);
+      const fa = tx.fieldsInfo ?? [];
+      const fb = ty.fieldsInfo ?? [];
+      for (let i = 0; i < Math.max(fa.length, fb.length); i++) {
+        const ra = fa[i];
+        const rb = fb[i];
+        const q = `${p}HTML 設定 ${i + 1} 行目 / `;
+        if (!ra) {
+          out.push(`${q}追加 (${show(rb?.desc)})`);
+          continue;
+        }
+        if (!rb) {
+          out.push(`${q}削除 (${show(ra.desc)})`);
+          continue;
+        }
+        scalarDiffs(ra, rb, TAG_ROW_SCALARS, out, q);
+        for (const k of TAG_ROW_TEXTS) textDiff(`${q}${k}`, String(ra[k] ?? ""), String(rb[k] ?? ""), out);
+        if (opt.derived) scalarDiffs(ra, rb, ["id", "formula", "usedFields"], out, `${q}派生 `);
+      }
+    }
+    const ca = new Map((x.calcInfo?.fieldsInfo ?? []).map((c) => [String(c.fieldcode), c]));
+    const cb = new Map((y.calcInfo?.fieldsInfo ?? []).map((c) => [String(c.fieldcode), c]));
+    for (const code of /* @__PURE__ */ new Set([...ca.keys(), ...cb.keys()])) {
+      const u = ca.get(code);
+      const v = cb.get(code);
+      const q = `${p}更新項目 ${code} / `;
+      if (!u) {
+        if (v?.state || v?.formulaSet) out.push(`${q}追加（state ${show(v?.state)}）`);
+        continue;
+      }
+      if (!v) {
+        if (u.state || u.formulaSet) out.push(`${q}削除`);
+        continue;
+      }
+      scalarDiffs(u, v, ["state", "remark"], out, q);
+      textDiff(`${q}formulaSet`, String(u.formulaSet ?? ""), String(v.formulaSet ?? ""), out);
+      if (opt.derived) scalarDiffs(u, v, ["formula", "usedFields", "type", "ptcode"], out, `${q}派生 `);
+    }
+    if (opt.derived) scalarDiffs(x, y, ["id", "views"], out, `${p}派生 `);
+  }
+  if (opt.derived) scalarDiffs(a, b, ["usedFields", "pluginUOG"], out, "派生 ");
+  const derivedNote = opt.derived ? "" : "（派生値 formula / usedFields / id / views / pluginUOG は除く。--derived で含める）";
+  const body = shortenDataUrls(out.join("\n"), { hash: true });
+  const dataNote = body.includes("…（data URL ") ? "（data: の URL は先頭・長さ・sha256 の先頭だけ）" : "";
+  return out.length ? `${body}
+${derivedNote}${dataNote}`.trim() : `差分なし${derivedNote}`;
+}
+var DERIVED_KEYS = DERIVED;
+
+// src/commands/fields.ts
+async function fetchFields(client, opt) {
+  const lang = opt.lang ?? "ja";
+  const app = await client.get("app", { id: opt.app }, opt.guestSpaceId);
+  const fields = await client.get(opt.preview ? "preview/app/form/fields" : "app/form/fields", { app: opt.app, lang }, opt.guestSpaceId);
+  const layout = await client.get(opt.preview ? "preview/app/form/layout" : "app/form/layout", { app: opt.app }, opt.guestSpaceId);
+  return {
+    tool: "pcraft-authoring fields",
+    fetchedAt: (opt.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+    baseUrl: client.baseUrl,
+    appId: Number(app.appId),
+    appName: app.name,
+    ...opt.guestSpaceId ? { guestSpaceId: opt.guestSpaceId } : {},
+    preview: !!opt.preview,
+    lang,
+    revision: String(fields.revision ?? layout.revision ?? ""),
+    properties: fields.properties ?? {},
+    layout: layout.layout ?? []
+  };
+}
+function layoutOrder(layout) {
+  const out = [];
+  const walk = (rows) => {
+    for (const r of rows ?? []) {
+      if (r.type === "GROUP") {
+        if (r.code) out.push(r.code);
+        walk(r.layout);
+      } else if (r.type === "SUBTABLE") {
+        if (r.code) out.push(r.code);
+      } else {
+        for (const f of r.fields ?? []) if (f.code) out.push(f.code);
+      }
+    }
+  };
+  walk(layout);
+  return out;
+}
+var SELECT_TYPES = /* @__PURE__ */ new Set(["CHECK_BOX", "RADIO_BUTTON", "DROP_DOWN", "MULTI_SELECT"]);
+function fieldNotes(p, inTable, copyTargets) {
+  const notes = [];
+  if (p.type === "CALC" && typeof p.format === "string") notes.push(`書式 ${p.format}`);
+  if (p.type === "SINGLE_LINE_TEXT" && typeof p.expression === "string" && p.expression) notes.push("自動計算");
+  if (p.type === "NUMBER" || p.type === "CALC") {
+    if (p.digit === true) notes.push("桁区切り");
+    if (p.displayScale !== void 0 && p.displayScale !== "") notes.push(`小数 ${p.displayScale} 桁`);
+    if (typeof p.unit === "string" && p.unit) notes.push(`単位「${p.unit}」${p.unitPosition === "BEFORE" ? "前" : "後"}`);
+  }
+  if (SELECT_TYPES.has(p.type) && p.options && typeof p.options === "object") {
+    const labels = Object.values(p.options).sort((a, b) => Number(a.index) - Number(b.index)).map((o) => o.label);
+    notes.push(`選択肢 ${labels.slice(0, 8).join(" / ")}${labels.length > 8 ? ` 他 ${labels.length - 8}` : ""}`);
+  }
+  const lookup = p.lookup;
+  if (lookup && typeof lookup === "object") notes.push(`ルックアップ（アプリ ${lookup.relatedApp?.app ?? "?"} の ${lookup.relatedKeyField ?? "?"}）`);
+  if (copyTargets.has(p.code)) notes.push("ルックアップのコピー先");
+  if (p.type === "FILE" && !inTable) notes.push("保存先 filecode にできる");
+  return notes.length ? `（${notes.join("、")}）` : "";
+}
+function listFields(file) {
+  const props = file.properties;
+  const copyTargets = /* @__PURE__ */ new Set();
+  const collect = (p) => {
+    const maps = p.lookup?.fieldMappings;
+    for (const m of maps ?? []) if (m.field) copyTargets.add(m.field);
+    for (const c of Object.values(p.fields ?? {})) collect(c);
+  };
+  for (const p of Object.values(props)) collect(p);
+  const line = (p, indent, inTable) => `${indent}${p.code}${p.label && p.label !== p.code ? `「${p.label}」` : ""}  ${p.type}${fieldNotes(p, inTable, copyTargets)}`;
+  const lines = [];
+  const shown = /* @__PURE__ */ new Set();
+  for (const code of layoutOrder(file.layout)) {
+    const p = props[code];
+    if (!p || shown.has(code)) continue;
+    shown.add(code);
+    lines.push(line(p, "", false));
+    if (p.type === "SUBTABLE") for (const c of Object.values(p.fields ?? {})) lines.push(line(c, "  ", true));
+  }
+  const rest = Object.values(props).filter((p) => !shown.has(p.code));
+  const header = `アプリ ${file.appId} ${file.appName}（${file.preview ? "preview" : "運用中"}、lang=${file.lang}、取得 ${file.fetchedAt}）項目 ${Object.keys(props).length}。レイアウトの順、テーブルの子は字下げ（TABLE_HTML と計算式で使う。更新項目にはできない）`;
+  const tail = rest.length ? [`レイアウトに無い項目: ${rest.map((p) => `${p.code} ${p.type}`).join(", ")}`] : [];
+  return [header, ...lines, ...tail].join("\n");
+}
+function summarizeFields(file) {
+  const props = Object.values(file.properties);
+  const tables = props.filter((p) => p.type === "SUBTABLE");
+  const byType = /* @__PURE__ */ new Map();
+  for (const p of props) byType.set(p.type, (byType.get(p.type) ?? 0) + 1);
+  const types = [...byType.entries()].sort((a, b) => b[1] - a[1]).map(([t, n]) => `${t} ${n}`).join(", ");
+  const tableLines = tables.map((t) => `  テーブル ${t.code}: ${Object.keys(t.fields ?? {}).join(", ")}`);
+  return [`アプリ ${file.appId} ${file.appName}（${file.preview ? "preview" : "運用中"}、lang=${file.lang}）`, `項目 ${props.length}（${types}）`, ...tableLines].join("\n");
+}
+
+// src/commands/record.ts
+var ALWAYS = /* @__PURE__ */ new Set(["$id", "$revision"]);
+function identifiersOf(expr) {
+  return expr.replace(/"[^"]*"/g, " ").split(/[^\p{L}\p{N}_・＿＄￥$]+/u).filter((t) => t && !/^\d+$/.test(t));
+}
+function usedFieldCodes(settings) {
+  const codes = /* @__PURE__ */ new Set();
+  const s = settings;
+  if (!s || typeof s !== "object") return null;
+  const addKeys = (o) => {
+    if (o && typeof o === "object") for (const k of Object.keys(o)) codes.add(k);
+  };
+  const addWords = (text) => {
+    if (typeof text === "string") for (const w of identifiersOf(text)) codes.add(w);
+  };
+  const addFormula = (f) => addWords(typeof f.formula === "string" && f.formula ? f.formula : f.formulaSet);
+  addKeys(s.usedFields);
+  for (const row of s.pluginInfos ?? []) {
+    const tags = row.tagsInfo;
+    for (const f of tags?.fieldsInfo ?? []) {
+      addKeys(f.usedFields);
+      addFormula(f);
+      if (typeof f.html === "string") for (const e of expressionsOf(f.html)) addWords(e);
+    }
+    if (tags?.filecode) codes.add(tags.filecode);
+    const calc = row.calcInfo;
+    addKeys(calc?.usedFields);
+    for (const f of calc?.fieldsInfo ?? []) {
+      if (f.state && typeof f.fieldcode === "string" && !f.fieldcode.startsWith("$")) codes.add(f.fieldcode);
+      addKeys(f.usedFields);
+      addFormula(f);
+    }
+  }
+  for (const c of [...codes]) if (c.startsWith("$")) codes.delete(c);
+  return codes.size ? codes : null;
+}
+function narrowRecord(record, keep) {
+  const out = {};
+  const kept = [];
+  for (const [code, fv] of Object.entries(record)) {
+    if (ALWAYS.has(code)) {
+      out[code] = fv;
+      continue;
+    }
+    if (fv?.type === "SUBTABLE" && Array.isArray(fv.value)) {
+      const rows = fv.value;
+      const childCodes = new Set(rows.flatMap((r) => Object.keys(r.value ?? {})));
+      const wholeTable = keep.has(code);
+      const usedChildren = [...childCodes].filter((c) => keep.has(c));
+      if (!wholeTable && usedChildren.length === 0) continue;
+      out[code] = {
+        type: "SUBTABLE",
+        value: rows.map((r) => {
+          if (wholeTable) return r;
+          const v = {};
+          for (const c of usedChildren) if (r.value[c]) v[c] = r.value[c];
+          return { ...r.id ? { id: r.id } : {}, value: v };
+        })
+      };
+      kept.push(wholeTable ? code : `${code}(${usedChildren.join(",")})`);
+      continue;
+    }
+    if (keep.has(code)) {
+      out[code] = fv;
+      kept.push(code);
+    }
+  }
+  return { record: out, kept };
+}
+function missingInRecord(settings, fields, record) {
+  const used = usedFieldCodes(settings);
+  if (!used) return [];
+  const missing = [];
+  for (const [code, p] of Object.entries(fields.properties ?? {})) {
+    if (p.type === "SUBTABLE") {
+      const table = record[code];
+      const rows = Array.isArray(table?.value) ? table.value : null;
+      for (const child of Object.keys(p.fields ?? {})) {
+        if (!used.has(child)) continue;
+        if (!rows || rows.length > 0 && !rows.some((r) => r.value && child in r.value)) missing.push(`${code}.${child}`);
+      }
+      if (used.has(code) && !table) missing.push(code);
+      continue;
+    }
+    if (used.has(code) && !(code in record)) missing.push(code);
+  }
+  return [...new Set(missing)];
+}
+async function fetchRecord(client, opt) {
+  const res = await client.get("record", { app: opt.app, id: opt.id }, opt.guestSpaceId);
+  let record = res.record ?? {};
+  let keptFields;
+  if (opt.keep) {
+    const n = narrowRecord(record, opt.keep);
+    record = n.record;
+    keptFields = n.kept;
+  }
+  return {
+    tool: "pcraft-authoring record",
+    fetchedAt: (opt.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+    baseUrl: client.baseUrl,
+    appId: opt.app,
+    id: opt.id,
+    ...opt.guestSpaceId ? { guestSpaceId: opt.guestSpaceId } : {},
+    ...keptFields ? { keptFields } : {},
+    record
+  };
+}
+var MULTI_TYPES = /* @__PURE__ */ new Set(["CHECK_BOX", "MULTI_SELECT", "CATEGORY"]);
+var ENTITY_TYPES = /* @__PURE__ */ new Set(["USER_SELECT", "ORGANIZATION_SELECT", "GROUP_SELECT", "STATUS_ASSIGNEE"]);
+var DATE_TYPES = { DATE: "日付", DATETIME: "日時", CREATED_TIME: "日時", UPDATED_TIME: "日時", TIME: "時刻" };
+var NUMERIC = /^-?\d+(\.\d+)?$/;
+function shapeOf(fv) {
+  const v = fv.value;
+  if (v === null || v === void 0 || v === "" || Array.isArray(v) && v.length === 0) return "空";
+  if (fv.type === "FILE" && Array.isArray(v)) {
+    const byType = /* @__PURE__ */ new Map();
+    for (const f of v) byType.set(f.contentType ?? "?", (byType.get(f.contentType ?? "?") ?? 0) + 1);
+    return `${v.length} 件（${[...byType].map(([t, n]) => `${t} ${n}`).join("、")}）`;
+  }
+  if (MULTI_TYPES.has(fv.type) && Array.isArray(v)) return `${v.length} 個`;
+  if (ENTITY_TYPES.has(fv.type) && Array.isArray(v)) return `${v.length} 件`;
+  if (DATE_TYPES[fv.type]) return DATE_TYPES[fv.type];
+  if (fv.type === "RECORD_NUMBER") return "あり";
+  if (typeof v === "string") {
+    if ((fv.type === "NUMBER" || fv.type === "CALC") && NUMERIC.test(v)) {
+      const [int, dec] = v.replace("-", "").split(".");
+      return `数値 ${v.startsWith("-") ? "負 " : ""}整数 ${int.length} 桁${dec ? `、小数 ${dec.length} 桁` : ""}`;
+    }
+    const lines = v.split("\n").length;
+    return `${fv.type === "RICH_TEXT" ? "HTML " : ""}${[...v].length} 文字${lines > 1 ? `、${lines} 行` : ""}`;
+  }
+  if (typeof v === "object") return "あり";
+  return typeof v;
+}
+function columnShape(type, values) {
+  const shapes = values.map((value) => shapeOf({ type, value }));
+  const filled = shapes.filter((s) => s !== "空");
+  if (!filled.length) return "全行 空";
+  const longest = filled.reduce((a, b) => Number(b.match(/\d+/)?.[0] ?? 0) > Number(a.match(/\d+/)?.[0] ?? 0) ? b : a);
+  const multiLine = filled.filter((s) => /\d+ 行$/.test(s)).length;
+  return `最大 ${longest}${multiLine ? `（複数行の値 ${multiLine} 行）` : ""}${filled.length < shapes.length ? `、空 ${shapes.length - filled.length} 行` : ""}`;
+}
+function describeRecord(file) {
+  const header = `アプリ ${file.appId} レコード ${file.id}（取得 ${file.fetchedAt}${file.keptFields ? `、--fields-from で ${file.keptFields.length} 項目に絞った` : ""}）。値は出さない（形だけ）`;
+  return [header, ...shapeLines(file.record)].join("\n");
+}
+function shapeLines(record) {
+  const lines = [];
+  for (const [code, fv] of Object.entries(record)) {
+    if (code === "$id" || code === "$revision" || !fv) continue;
+    if (fv.type === "SUBTABLE" && Array.isArray(fv.value)) {
+      const rows = fv.value;
+      lines.push(`${code}  SUBTABLE  ${rows.length} 行`);
+      const children = /* @__PURE__ */ new Map();
+      for (const r of rows) {
+        for (const [c, cv] of Object.entries(r.value ?? {})) {
+          const e = children.get(c) ?? { type: cv.type, values: [] };
+          e.values.push(cv.value);
+          children.set(c, e);
+        }
+      }
+      for (const [c, e] of children) lines.push(`  ${c}  ${e.type}  ${columnShape(e.type, e.values)}`);
+      continue;
+    }
+    lines.push(`${code}  ${fv.type}  ${shapeOf(fv)}`);
+  }
+  return lines;
+}
+function summarizeRecord(file) {
+  const codes = Object.keys(file.record);
+  const tables = codes.filter((c) => file.record[c]?.type === "SUBTABLE");
+  const rows = tables.map((t) => `${t} ${Array.isArray(file.record[t].value) ? file.record[t].value.length : 0} 行`);
+  return `アプリ ${file.appId} レコード ${file.id}: 項目 ${codes.length}${tables.length ? `（テーブル ${rows.join(", ")}）` : ""}${file.keptFields ? `。--fields-from で ${file.keptFields.length} 項目に絞った` : ""}。値は表示しない`;
+}
+
+// src/commands/records.ts
+var LIST_LIMIT = 5;
+var QUERY_MAX = 500;
+var SHAPE_TEXT_MAX = 64 * 1024;
+var QueryError = class extends Error {
+};
+function withoutQuoted(q) {
+  return q.replace(/"(?:[^"\\]|\\.)*"/g, '""');
+}
+function listQueryOf(query) {
+  const q = (query ?? "").trim();
+  if ([...q].length > QUERY_MAX) throw new QueryError(`query は ${QUERY_MAX} 文字まで`);
+  if (/\b(limit|offset)\b/i.test(withoutQuoted(q))) throw new QueryError("query に limit / offset は書かない（件数はサーバーが決める）");
+  return q ? `${q} limit ${LIST_LIMIT}` : `limit ${LIST_LIMIT}`;
+}
+async function listRecordShapes(client, opt) {
+  const max = opt.maxBytes ?? SHAPE_TEXT_MAX;
+  const query = listQueryOf(opt.query);
+  const res = await client.get("records", { app: opt.app, query }, opt.guestSpaceId);
+  const out = [];
+  let truncated = false;
+  for (const record of (res.records ?? []).slice(0, LIST_LIMIT)) {
+    const idValue = record.$id?.value;
+    const shape = { id: typeof idValue === "string" ? idValue : String(idValue ?? ""), lines: shapeLines(record) };
+    if (Buffer.byteLength(JSON.stringify({ appId: opt.app, query, records: [...out, shape], truncated: false }), "utf8") > max) {
+      truncated = true;
+      break;
+    }
+    out.push(shape);
+  }
+  return { appId: opt.app, query, records: out, truncated };
+}
+
+// src/preview/render.ts
+var PREVIEW_CSP = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'";
+var OUTER_CSP = "script-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'none'";
+function fontOrigins(cssUrl) {
+  let origin;
+  try {
+    const u = new URL(cssUrl);
+    if (u.protocol !== "https:") return null;
+    origin = u.origin;
+  } catch {
+    return null;
+  }
+  const font = [origin];
+  if (origin === "https://fonts.googleapis.com") font.push("https://fonts.gstatic.com");
+  return { style: [origin], font };
+}
+function previewCsp(font) {
+  const o = font ? fontOrigins(font.cssUrl) : null;
+  if (!o) return PREVIEW_CSP;
+  return `default-src 'none'; img-src data:; style-src 'unsafe-inline' ${o.style.join(" ")}; font-src data: ${o.font.join(" ")}; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'`;
+}
+var PREVIEW_REMOVE_SELECTOR = "script,meta,link,base,form,input,button,select,textarea,iframe,frame,object,embed,applet,noscript,template,video,audio,source,track,canvas,map,area,animate,animatemotion,animatetransform,animatecolor,set,foreignobject,math";
+var REMOVE_ATTRS = /* @__PURE__ */ new Set(["srcdoc", "formaction", "action", "ping", "target", "download", "background", "poster", "manifest"]);
+var PAGES_CSS = `body { margin: 0; background: #f7f7f7; }
+.xp-rex0220-print-craft-overlay-pages { display: block; width: fit-content; font-size: 16px; line-height: 1.5; font-family: "メイリオ", Meiryo, "Hiragino Kaku Gothic ProN", "ヒラギノ角ゴ ProN W3", "ＭＳ Ｐゴシック", "Lucida Grande", "Lucida Sans Unicode", Arial, Verdana, sans-serif; -webkit-text-size-adjust: 100%; }
+.pcraft-authoring-error { color: #b00020; background: #fde7e9; border: 1px solid #b00020; border-radius: 3px; padding: 0 4px; font-size: 12px; font-family: monospace; }`;
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function escapeCssText(css) {
+  return css.replace(/</g, "\\3c ").replace(/-->/g, "--\\3e ");
+}
+function errorSpan(expression, e) {
+  const message = e instanceof Error ? e.message : String(e);
+  return `<span class="pcraft-authoring-error">式のエラー: ${escapeHtml(expression)} — ${escapeHtml(message)}</span>`;
+}
+function renderRows(api, row, record, kf, errors) {
+  const rows = row.tagsInfo?.fieldsInfo ?? [];
+  let html = "";
+  for (let index = 2; index < rows.length; index++) {
+    const info = rows[index];
+    if (!info.state) continue;
+    let tmp = info.html ? info.html.replace(/\$\{(.*?)\}/g, (_m, key) => {
+      try {
+        const v = kf.dq(key);
+        return v == null ? "" : String(v);
+      } catch (e) {
+        errors.push(`HTML 設定 ${index + 1} 行目 \${${key}}: ${e instanceof Error ? e.message : String(e)}`);
+        return errorSpan(`\${${key}}`, e);
+      }
+    }) : "";
+    const formula = api.formulaOf(info);
+    if (formula) {
+      record.$html = { value: tmp, type: "MULTI_LINE_TEXT" };
+      try {
+        const v = kf.dq(formula);
+        tmp = v == null ? "" : String(v);
+      } catch (e) {
+        errors.push(`HTML 設定 ${index + 1} 行目の計算式: ${e instanceof Error ? e.message : String(e)}`);
+        tmp += errorSpan(formula.length > 120 ? formula.slice(0, 120) + "…" : formula, e);
+      }
+    }
+    html += tmp;
+  }
+  return html.replace(/\\/g, "&yen;");
+}
+function sanitizePreviewDom(host) {
+  let removedElements = 0;
+  let removedAttributes = 0;
+  for (const el of Array.from(host.querySelectorAll(PREVIEW_REMOVE_SELECTOR))) {
+    el.remove();
+    removedElements++;
+  }
+  for (const el of Array.from(host.querySelectorAll("*"))) {
+    for (const a of Array.from(el.attributes)) {
+      const name = a.name.toLowerCase();
+      const value = String(a.value ?? "").replace(/[\t\n\r]/g, "").trim();
+      const isLink = name === "href" || name === "xlink:href";
+      if (name.startsWith("on") || REMOVE_ATTRS.has(name) || isLink && !value.startsWith("#") || /^[\u0000- ]*javascript:/i.test(value)) {
+        el.removeAttribute(a.name);
+        removedAttributes++;
+      }
+    }
+    if (el.tagName.toLowerCase() === "style") el.textContent = escapeCssText(el.textContent ?? "");
+  }
+  return { removedElements, removedAttributes };
+}
+function renderButton(input) {
+  const { row, model, engine, body } = input;
+  const api = model.api;
+  const tags = row.tagsInfo;
+  if (!tags) throw new Error(`${row.menu}: HTML 設定が無い`);
+  const errors = [];
+  const record = JSON.parse(JSON.stringify(input.record));
+  const paper = api.getPaperSize(tags.pageSize || "A4", tags.orientation || "p", Number(tags.dpi) || 96);
+  const kf = engine.runner(model.ppRun, record);
+  const fileName = api.fileNameOf(row, kf);
+  const font = api.webFontOf(body.fontInfo);
+  const cssBody = Array.isArray(body.cssInfo) ? body : { ...body, cssInfo: api.defaultCssRows() };
+  const css = api.buildReportCss(cssBody, row, paper.scr, font);
+  const html = renderRows(api, row, record, kf, errors);
+  const doc = engine.window.document;
+  const host = doc.createElement("div");
+  const pages = api.mountReportHtml(host, html, { sanitize: body.externalRefs !== "allow" });
+  api.replaceTags(pages, {}, {}, api.DUMMY_IMAGE);
+  if (pages.length === 0) errors.push('ページ要素（class="rex0220-pcraft-page"）が無い。印刷屋は 0 ページの PDF を作る');
+  sanitizePreviewDom(host);
+  const wf = input.webFont ?? null;
+  const useFont = wf && wf.approved && fontOrigins(wf.font.cssUrl) ? wf.font : null;
+  const fontLink = useFont ? `
+<link rel="stylesheet" href="${escapeHtml(useFont.cssUrl)}">` : "";
+  const inner = `<!doctype html>
+<html lang="ja"><head><meta charset="utf-8">
+<meta http-equiv="Content-Security-Policy" content="${previewCsp(useFont)}">${fontLink}
+<title>${escapeHtml(row.menu)}</title>
+<style>${PAGES_CSS}</style>
+<style class="xp-rex0220-print-craft-page-style">${escapeCssText(css)}</style>
+</head><body><div class="xp-rex0220-print-craft-overlay-pages">${host.innerHTML}</div></body></html>`;
+  const width = paper.scr.width + 40;
+  const height = Math.max(1, pages.length) * (paper.scr.height + 40) + 40;
+  const errorList = errors.length ? `<ul class="errors">${errors.map((e) => `<li>${escapeHtml(e)}</li>`).join("")}</ul>` : "";
+  const fontNote = useFont ? `Web フォント「${escapeHtml(useFont.family)}」は ${escapeHtml(fontOrigins(useFont.cssUrl).style[0])} から読みます（承認済み。preview の外部通信はこれだけ）。` : wf ? `Web フォント「${escapeHtml(wf.font.family)}」は配信元が未承認のため読みません（OS の書体で代替。利用者が policy/authoring-policy.json の allowExternal に書けば読みます）。` : "Web フォントは使いません。";
+  const outer = `<!doctype html>
+<html lang="ja"><head><meta charset="utf-8">
+<meta http-equiv="Content-Security-Policy" content="${OUTER_CSP}">
+<title>preview: ${escapeHtml(row.menu)}</title>
+<style>
+body { margin: 0; font-family: system-ui, sans-serif; background: #e9ecef; color: #222; }
+header { padding: 12px 16px; background: #fff; border-bottom: 1px solid #ccc; }
+h1 { margin: 0 0 4px; font-size: 18px; }
+header p { margin: 2px 0; font-size: 13px; color: #555; }
+.errors { margin: 8px 0 0; padding: 8px 12px 8px 28px; background: #fde7e9; border: 1px solid #b00020; color: #b00020; font-size: 13px; }
+iframe { display: block; margin: 12px auto; border: 0; background: #f7f7f7; }
+</style></head><body>
+<header>
+<h1>${escapeHtml(row.menu)}</h1>
+<p>ファイル名: ${escapeHtml(fileName)} / 用紙: ${escapeHtml(tags.pageSize)} ${tags.orientation === "l" ? "横" : "縦"} ${escapeHtml(String(tags.dpi))} dpi / ページ: ${pages.length}</p>
+<p>これは近似のプレビューです。添付ファイルの画像と QR はダミーです。${fontNote} PDF の見た目は印刷屋プラグインで確かめてください。帳票は sandbox の iframe の中に置き、スクリプトと外部への通信（承認した Web フォントの配信元を除く）は CSP と sandbox で止め、リンクと埋め込みの要素は外してあります（文字だけ残る）。</p>
+${errorList}
+</header>
+<iframe sandbox="" title="${escapeHtml(row.menu)}" width="${width}" height="${height}" srcdoc="${escapeHtml(inner)}"></iframe>
+</body></html>
+`;
+  return { menu: row.menu, fileName, pageSize: tags.pageSize, orientation: tags.orientation, dpi: String(tags.dpi), pages: pages.length, errors, webFont: useFont ? useFont.cssUrl : null, inner, html: outer };
+}
+
+// src/commands/preview.ts
+function extractRecord(file) {
+  if (!file || typeof file !== "object") throw new Error("レコードの JSON がオブジェクトでない");
+  const o = file;
+  if (o.record && typeof o.record === "object") return o.record;
+  const values = Object.values(o);
+  if (values.length && values.every((v) => v && typeof v === "object" && "type" in v && "value" in v)) return o;
+  throw new Error("レコードの JSON の形が分からない（record コマンドの出力か、/k/v1/record の応答か、{ 項目: { type, value } } の形）");
+}
+function previewFileNames(rows) {
+  const used = /* @__PURE__ */ new Map();
+  return rows.map((row, i) => {
+    const base = safeFileName(row.menu, `button-${i + 1}`);
+    const n = used.get(base.toLowerCase()) ?? 0;
+    used.set(base.toLowerCase(), n + 1);
+    return n ? `${base}-${n + 1}.html` : `${base}.html`;
+  });
+}
+async function runPreview(input) {
+  const normalized = await normalizeSettings({ settingsText: input.settingsText, settingsFile: input.settingsFile, fields: input.fields, engine: input.engine, policy: input.policy, baseUrl: input.baseUrl });
+  const findings = normalized.findings;
+  const results = [];
+  const skipped = [];
+  if (!normalized.body) return { findings, results, skipped, summary: normalized.summary };
+  const record = extractRecord(input.recordFile);
+  const missing = missingInRecord(normalized.body, input.fields, record);
+  if (missing.length) findings.warning("preview.record", "レコード", `設定が使う項目がプレビューのレコードに無い: ${missing.slice(0, 10).join(", ")}${missing.length > 10 ? ` 他 ${missing.length - 10}` : ""}（帳票では空になる。record --fields-from <この設定> で取り直す）`);
+  const model = buildModel(input.fields, input.engine.api, input.baseUrl);
+  input.engine.setContext({ baseUrl: model.baseUrl || DEFAULT_CONTEXT_BASE_URL, appId: input.fields.appId });
+  const rows = normalized.body.pluginInfos ?? [];
+  const targets = rows.filter((row) => row.state && row.tagsInfo && (input.button === void 0 || row.menu === input.button));
+  const names = previewFileNames(targets);
+  const font = input.engine.api.webFontOf(normalized.body.fontInfo);
+  const webFont = font ? { font: { family: font.family, cssUrl: font.cssUrl }, approved: isAllowed(input.policy ?? { allowExternal: [] }, font.cssUrl, input.settingsFile) } : null;
+  targets.forEach((row, i) => {
+    if (row.list) {
+      skipped.push(`${row.menu}: 一覧帳票は 1 レコードのプレビューの対象外（段階 2）`);
+      return;
+    }
+    const r = renderButton({ body: normalized.body, row, model, engine: input.engine, record, webFont });
+    results.push({ ...r, file: names[i] });
+  });
+  if (input.button !== void 0 && results.length === 0 && !skipped.length) findings.error("preview.button", input.button, "その名前の有効なボタンが無い");
+  const summary = `${normalized.summary}。プレビュー ${results.length} 件${skipped.length ? `、対象外 ${skipped.length}` : ""}、式のエラー ${results.reduce((n, r) => n + r.errors.length, 0)}`;
+  return { findings, results, skipped, summary };
+}
+
+// src/commands/pull.ts
+var PLUGIN_ID_PATTERN = /^[a-p]{32}$/;
+async function pullSettings(client, engine, opt) {
+  if (!PLUGIN_ID_PATTERN.test(opt.pluginId)) throw new InputError(`プラグイン ID の形が違う: ${opt.pluginId}（a〜p の 32 文字）`);
+  const app = await client.get("app", { id: opt.app }, opt.guestSpaceId);
+  const res = await client.get(opt.preview ? "preview/app/plugin/config" : "app/plugin/config", { app: opt.app, id: opt.pluginId }, opt.guestSpaceId);
+  const stored = res.config && typeof res.config === "object" && !Array.isArray(res.config) ? res.config : {};
+  if (Object.keys(stored).length === 0) throw new InputError(`アプリ ${opt.app} の印刷屋の設定が空（${opt.preview ? "動作テスト環境" : "運用中"}。設定画面でまだ保存していないか、${opt.preview ? "" : "保存して運用環境に反映していないか、"}別のプラグイン ID）`);
+  for (const [k, v] of Object.entries(stored)) if (typeof v !== "string") throw new InputError(`プラグインの設定の値が文字列でない: ${k}`);
+  const api = engine.api;
+  const { data, format } = await api.readConfig(stored);
+  const raw = data && typeof data === "object" && !Array.isArray(data) ? data : {};
+  const body = api.validate(raw, api.CONFIG_SCHEMA, api.CONFIG_LIMITS);
+  const envelope = api.buildExportData({ pluginName: PLUGIN_NAME, pluginId: api.pluginId, pluginVersion: engine.source.pluginVersion, appId: opt.app, appName: app.name }, body, (opt.now ?? (() => /* @__PURE__ */ new Date()))());
+  return { envelope, appName: app.name, revision: String(res.revision ?? ""), format };
+}
+function defaultPullName(appName, appId) {
+  const name = safeFileName(appName, "");
+  return name ? `APP${appId}-${name}.json` : `APP${appId}.json`;
+}
+
+// src/commands/take.ts
+import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync10, unlinkSync, mkdirSync as mkdirSync2 } from "node:fs";
+import path12 from "node:path";
+var PRINT_CRAFT_PLUGIN_ID2 = "rex0220 Print craft plugin";
+function removeSource(src, warnings, rel2) {
+  try {
+    withRetry(() => unlinkSync(src));
+    return true;
+  } catch (e) {
+    warnings.push(`${rel2} は行き先に置いたが、inbox から消せなかった（${e.code ?? e.message}）。消してよい`);
+    return false;
+  }
+}
+function envFor(ws, appId, envName) {
+  if (envName) return ws.environments[envName] ?? `環境「${envName}」は environments.json に無い`;
+  const hits = Object.values(ws.environments).filter((e) => ws.apps.some((a) => a.ids[e.name] === appId));
+  if (hits.length === 1) return hits[0];
+  if (hits.length > 1) return `アプリ ${appId} が ${hits.map((e) => e.name).join(" と ")} の両方にある。--env で選ぶ`;
+  const all = Object.values(ws.environments);
+  if (all.length === 1) return all[0];
+  return `アプリ ${appId} は environments.json の apps に無く、環境が 2 つ以上ある。apps に足すか --env で選ぶ`;
+}
+function takeInbox(cwdIn, ws, envName) {
+  const cwd = realResolve(".", cwdIn);
+  const result = { moved: [], skipped: [], warnings: [] };
+  const inbox = path12.join(cwd, INBOX);
+  if (!existsSync7(inbox)) return result;
+  for (const name of readdirSync2(inbox).filter((n) => n.toLowerCase().endsWith(".json")).sort()) {
+    const rel2 = `${INBOX}/${name}`;
+    const src = resolveRead(rel2, cwd);
+    let data;
+    try {
+      data = readJsonLimited(src);
+    } catch (e) {
+      result.skipped.push({ file: rel2, reason: e.message });
+      continue;
+    }
+    if (data.pluginID !== PRINT_CRAFT_PLUGIN_ID2) {
+      result.skipped.push({ file: rel2, reason: "印刷屋の設定のファイルではない（pluginID が違う）" });
+      continue;
+    }
+    const appId = data.appId;
+    if (typeof appId !== "number" || !Number.isInteger(appId) || appId <= 0) {
+      result.skipped.push({ file: rel2, reason: "封筒の appId が無い" });
+      continue;
+    }
+    if (!SNAPSHOT_RE.test(name)) {
+      result.skipped.push({ file: rel2, reason: "ダウンロードの名前（rex0220-print-craft-app<番号>-<日時>.json）ではない。設定画面のダウンロードの名前のまま inbox/ に置く" });
+      continue;
+    }
+    const m = name.match(/-app(\d+)-/);
+    if (m && Number(m[1]) !== appId) {
+      result.skipped.push({ file: rel2, reason: `ファイル名のアプリ ${m[1]} と封筒の appId ${appId} が違う` });
+      continue;
+    }
+    const env = envFor(ws, appId, envName);
+    if (typeof env === "string") {
+      result.skipped.push({ file: rel2, reason: env });
+      continue;
+    }
+    const dir = appDirFor(cwd, env, appId, typeof data.appName === "string" ? data.appName : "");
+    const dest = resolveWrite(path12.join(dir, name), WRITE_ROOTS.kintone, cwd);
+    const text = readFileSync10(src, "utf8");
+    if (existsSync7(dest)) {
+      if (readFileSync10(dest, "utf8") !== text) {
+        result.skipped.push({ file: rel2, reason: `行き先に同じ名前の別の中身がある: ${path12.relative(cwd, dest)}` });
+        continue;
+      }
+      const removed2 = removeSource(src, result.warnings, rel2);
+      result.moved.push({ file: rel2, to: path12.relative(cwd, dest), same: true, ...removed2 ? {} : { leftInInbox: true } });
+      continue;
+    }
+    try {
+      assertChangeAllowed(cwd, dest, "snapshot");
+      mkdirSync2(path12.dirname(dest), { recursive: true });
+      const { cleanup } = writeNewFile(dest, text, () => {
+        if (resolveWrite(path12.join(dir, name), WRITE_ROOTS.kintone, cwd) !== dest) throw new PermissionError(`書く先のフォルダーが途中で変わった（symlink など）: ${path12.relative(cwd, dest)}`);
+        assertChangeAllowed(cwd, dest, "snapshot");
+      });
+      for (const c of cleanup) result.warnings.push(`${rel2} は行き先に置いたが、一時ファイルを消せなかった（${c}）。${path12.relative(cwd, path12.dirname(dest))} の .${name}.*.tmp を消してよい`);
+    } catch (e) {
+      if (e instanceof PermissionError) {
+        result.skipped.push({ file: rel2, reason: e.message });
+        continue;
+      }
+      if (e instanceof FileExistsError) {
+        result.skipped.push({ file: rel2, reason: `行き先に同じ名前のファイルができた（移す途中で）: ${path12.relative(cwd, dest)}。もう一度 take する` });
+        continue;
+      }
+      throw e;
+    }
+    const removed = removeSource(src, result.warnings, rel2);
+    result.moved.push({ file: rel2, to: path12.relative(cwd, dest), same: false, ...removed ? {} : { leftInInbox: true } });
+  }
+  return result;
+}
+
+// src/core.ts
+var CORE_API_VERSION = 1;
+export {
+  ALLOWED_APIS,
+  AuthError,
+  ButtonNotFoundError,
+  CORE_API_VERSION,
+  DEFAULT_CONTEXT_BASE_URL,
+  DERIVED_KEYS,
+  EDIT_RE,
+  FileExistsError,
+  INBOX,
+  InputError,
+  KINTONE_ROOT,
+  KintoneUrlError,
+  LIST_LIMIT,
+  LockBusyError,
+  MAX_INPUT_BYTES,
+  MAX_SAVE_INPUT_BYTES,
+  MIN_PLUGIN_VERSION,
+  NotAllowedError,
+  PRINT_CRAFT_PLUGIN_ID,
+  PathError,
+  PermissionError,
+  PluginZipError,
+  QUERY_MAX,
+  QueryError,
+  RECEIVE_LIMITS,
+  RestError,
+  SHAPE_TEXT_MAX,
+  SNAPSHOT_RE,
+  SUPPORTED_API_VERSIONS,
+  WORKSPACE_FILE,
+  WRITE_ROOTS,
+  WorkspaceError,
+  appDirFor,
+  appFolderOfFile,
+  assertChangeAllowed,
+  baseUrlFromEnv,
+  classOfAppPath,
+  createContext,
+  createRestClient,
+  defaultPullName,
+  describeAuth,
+  describeRecord,
+  diffSettings,
+  digestOf,
+  editNameOf,
+  envOfAppFolder,
+  extractRecord,
+  fetchFields,
+  fetchRecord,
+  findAppDir,
+  folderNameOf,
+  isInside,
+  isKintoneBaseUrl,
+  isSupportedPluginVersion,
+  listAppFolder,
+  listButtons,
+  listFields,
+  listQueryOf,
+  listRecordShapes,
+  loadAuth,
+  loadAuthForEnv,
+  loadEngine,
+  loadPolicy,
+  loadWorkspace,
+  missingInRecord,
+  narrowRecord,
+  normalizeKintoneBaseUrl,
+  normalizeSettings,
+  parseWorkspace,
+  pickEnv,
+  pluginZipPath,
+  previewFileNames,
+  pullSettings,
+  readFieldsFile,
+  readJsonLimited,
+  readTextLimited,
+  realResolve,
+  relativeSettingsPath,
+  resolveApp,
+  resolveRead,
+  resolveWrite,
+  roleOfTarget,
+  runPreview,
+  saveNewSettings,
+  shapeLines,
+  shortenDataUrls,
+  snapshotNameOf,
+  summarizeFields,
+  summarizeRecord,
+  takeInbox,
+  toolsMeta,
+  unquote,
+  updateButton,
+  usedFieldCodes,
+  writeNewFile
+};