kintone-migrator 0.24.3 → 0.24.5

package/dist/index.mjs

@@ -7,6 +7,7 @@ import { parse, stringify } from "yaml";
 import { KintoneRestAPIClient, KintoneRestAPIError } from "@kintone/rest-api-client";
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, join, resolve } from "node:path";
+import { realpathSync } from "node:fs";
 import * as v from "valibot";
 import pc from "picocolors";
 
@@ -290,6 +291,10 @@ var ConflictError = class extends ApplicationError {
 function isConflictError(error) {
 	return error instanceof ConflictError;
 }
+const UnauthenticatedErrorCode = {
+	AuthenticationRequired: "AUTHENTICATION_REQUIRED",
+	InvalidCredentials: "INVALID_CREDENTIALS"
+};
 var UnauthenticatedError = class extends ApplicationError {
 	name = "UnauthenticatedError";
 	constructor(code, message, cause) {
@@ -300,6 +305,7 @@ var UnauthenticatedError = class extends ApplicationError {
 function isUnauthenticatedError(error) {
 	return error instanceof UnauthenticatedError;
 }
+const ForbiddenErrorCode = { InsufficientPermissions: "INSUFFICIENT_PERMISSIONS" };
 var ForbiddenError = class extends ApplicationError {
 	name = "ForbiddenError";
 	constructor(code, message, cause) {
@@ -340,6 +346,16 @@ function isSystemError(error) {
 	return error instanceof SystemError;
 }
 
+//#endregion
+//#region src/core/application/applyFromConfigBase.ts
+async function applyFromConfig(config) {
+	const result = await config.getStorage();
+	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, config.notFoundMessage);
+	const parsed = config.parseConfig(result.content);
+	const remote = await config.fetchRemote();
+	await config.update(parsed, remote);
+}
+
 //#endregion
 //#region src/lib/typeGuards.ts
 /**
@@ -525,16 +541,74 @@ function parseActionConfigText(rawText) {
 //#endregion
 //#region src/core/application/action/applyAction.ts
 async function applyAction({ container }) {
-	const result = await container.actionStorage.get();
-	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "Action config file not found");
-	const config = parseActionConfigText(result.content);
-	const current = await container.actionConfigurator.getActions();
-	await container.actionConfigurator.updateActions({
-		actions: config.actions,
-		revision: current.revision
+	await applyFromConfig({
+		getStorage: () => container.actionStorage.get(),
+		parseConfig: parseActionConfigText,
+		fetchRemote: () => container.actionConfigurator.getActions(),
+		update: async (config, current) => {
+			await container.actionConfigurator.updateActions({
+				actions: config.actions,
+				revision: current.revision
+			});
+		},
+		notFoundMessage: "Action config file not found"
 	});
 }
 
+//#endregion
+//#region src/core/adapters/kintone/wrapKintoneError.ts
+const KINTONE_REVISION_CONFLICT_CODE = "GAIA_CO02";
+const KINTONE_MAINTENANCE_MODE_CODE = "GAIA_NO02";
+function formatMessage(message, error) {
+	if (error instanceof KintoneRestAPIError && error.message) return `${message}: ${error.message}`;
+	if (error instanceof Error && error.message) return `${message}: ${error.message}`;
+	return message;
+}
+/**
+* Converts an unknown error thrown during a kintone API call into the
+* appropriate application-layer error.
+*
+* - {@link BusinessRuleError} and {@link ApplicationError} (including all
+*   subclasses such as {@link SystemError}, {@link ValidationError}, etc.)
+*   are re-thrown as-is so that errors raised inside a try block are never
+*   silently converted.
+* - {@link KintoneRestAPIError} is mapped by HTTP status (401/403/404/409/400)
+*   and kintone-specific codes (`GAIA_CO02` revision conflict, `GAIA_NO02`
+*   maintenance mode).
+* - Everything else becomes a {@link SystemError} with code `ExternalApiError`.
+*
+* **Note on 400 mapping**: All 400 errors (except `GAIA_CO02`) are mapped to
+* {@link ValidationError}. This is intentionally simplified — some 400 codes
+* (e.g. `GAIA_RE18` record limit, `GAIA_AP01` app unavailable) may have
+* different semantics, but for this CLI tool a single `ValidationError`
+* with the original kintone message in the error detail is sufficient.
+*
+* @throws {UnauthenticatedError} when kintone returns 401
+* @throws {ForbiddenError} when kintone returns 403 (non-GAIA_NO02)
+* @throws {SystemError} when kintone returns 403 with GAIA_NO02 (maintenance mode)
+* @throws {NotFoundError} when kintone returns 404
+* @throws {ConflictError} when kintone returns 409 or GAIA_CO02
+* @throws {ValidationError} when kintone returns 400 (non-GAIA_CO02)
+* @throws {SystemError} for all other kintone errors and unknown errors
+*/
+function wrapKintoneError(error, message) {
+	if (isBusinessRuleError(error)) throw error;
+	if (error instanceof ApplicationError) throw error;
+	const detail = formatMessage(message, error);
+	if (error instanceof KintoneRestAPIError) {
+		if (error.status === 401) throw new UnauthenticatedError(UnauthenticatedErrorCode.InvalidCredentials, detail, error);
+		if (error.status === 403) {
+			if (error.code === KINTONE_MAINTENANCE_MODE_CODE) throw new SystemError(SystemErrorCode.ExternalApiError, `${detail} (app is in maintenance mode — GAIA_NO02)`, error);
+			throw new ForbiddenError(ForbiddenErrorCode.InsufficientPermissions, detail, error);
+		}
+		if (error.status === 404) throw new NotFoundError(NotFoundErrorCode.NotFound, detail, error);
+		if (error.code === KINTONE_REVISION_CONFLICT_CODE) throw new ConflictError(ConflictErrorCode.Conflict, `${detail} (revision conflict — GAIA_CO02). Please retry the operation.`, error);
+		if (error.status === 409) throw new ConflictError(ConflictErrorCode.Conflict, detail, error);
+		if (error.status === 400) throw new ValidationError(ValidationErrorCode.InvalidInput, detail, error);
+	}
+	throw new SystemError(SystemErrorCode.ExternalApiError, detail, error);
+}
+
 //#endregion
 //#region src/core/adapters/kintone/actionConfigurator.ts
 function fromKintoneDestApp(raw) {
@@ -620,9 +694,7 @@ var KintoneActionConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get app actions", error);
+			throw wrapKintoneError(error, "Failed to get app actions");
 		}
 	}
 	async updateActions(params) {
@@ -636,15 +708,22 @@ var KintoneActionConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateAppActions(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update app actions", error);
+			throw wrapKintoneError(error, "Failed to update app actions");
 		}
 	}
 };
 
 //#endregion
 //#region src/core/adapters/kintone/appDeployer.ts
+const VALID_DEPLOY_STATUSES = new Set([
+	"PROCESSING",
+	"SUCCESS",
+	"FAIL",
+	"CANCEL"
+]);
+function isDeployStatus(value) {
+	return VALID_DEPLOY_STATUSES.has(value);
+}
 const DEFAULT_POLL_INTERVAL_MS = 1e3;
 const DEFAULT_MAX_RETRIES = 180;
 var KintoneAppDeployer = class {
@@ -659,12 +738,10 @@ var KintoneAppDeployer = class {
 	async deploy() {
 		try {
 			await this.client.app.deployApp({ apps: [{ app: this.appId }] });
-			await this.waitForDeployment();
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to deploy app", error);
+			throw wrapKintoneError(error, "Failed to deploy app");
 		}
+		await this.waitForDeployment();
 	}
 	async waitForDeployment() {
 		let lastPollError;
@@ -678,20 +755,21 @@ var KintoneAppDeployer = class {
 				consecutivePollFailures = 0;
 			} catch (error) {
 				if (isBusinessRuleError(error)) throw error;
-				if (error instanceof SystemError) throw error;
+				if (error instanceof ApplicationError) throw error;
 				lastPollError = error;
 				consecutivePollFailures++;
 				if (consecutivePollFailures >= maxConsecutivePollFailures) throw new SystemError(SystemErrorCode.ExternalApiError, `Deploy status polling failed ${maxConsecutivePollFailures} consecutive times`, lastPollError);
 				continue;
 			}
-			const status = apps[0]?.status;
-			switch (status) {
+			if (apps.length === 0) throw new SystemError(SystemErrorCode.ExternalApiError, "Deploy status response contained no apps");
+			const rawStatus = apps[0].status;
+			if (rawStatus === void 0) throw new SystemError(SystemErrorCode.ExternalApiError, "Deploy status unavailable");
+			if (!isDeployStatus(rawStatus)) throw new SystemError(SystemErrorCode.ExternalApiError, `Unexpected deploy status: ${rawStatus}`);
+			switch (rawStatus) {
 				case "SUCCESS": return;
 				case "FAIL": throw new SystemError(SystemErrorCode.ExternalApiError, "App deployment failed");
 				case "CANCEL": throw new SystemError(SystemErrorCode.ExternalApiError, "App deployment was cancelled");
 				case "PROCESSING": continue;
-				case void 0: throw new SystemError(SystemErrorCode.ExternalApiError, "Deploy status unavailable");
-				default: throw new SystemError(SystemErrorCode.ExternalApiError, `Unexpected deploy status: ${status}`);
 			}
 		}
 		throw new SystemError(SystemErrorCode.ExternalApiError, "App deployment timed out", lastPollError);
@@ -820,9 +898,7 @@ var KintoneCustomizationConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get app customization", error);
+			throw wrapKintoneError(error, "Failed to get app customization");
 		}
 	}
 	async updateCustomization(params) {
@@ -843,9 +919,7 @@ var KintoneCustomizationConfigurator = class {
 			const response = await this.client.app.updateAppCustomize(requestParams);
 			return { revision: String(response.revision) };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update app customization", error);
+			throw wrapKintoneError(error, "Failed to update app customization");
 		}
 	}
 };
@@ -857,31 +931,77 @@ var KintoneFileDownloader = class {
 		this.client = client;
 	}
 	async download(fileKey) {
-		if (!fileKey) throw new SystemError(SystemErrorCode.ExternalApiError, "fileKey must not be empty");
+		if (!fileKey) throw new ValidationError(ValidationErrorCode.InvalidInput, "fileKey must not be empty");
 		try {
 			return await this.client.file.downloadFile({ fileKey });
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, `Failed to download file: ${fileKey}`, error);
+			throw wrapKintoneError(error, `Failed to download file: ${fileKey}`);
 		}
 	}
 };
 
+//#endregion
+//#region src/lib/safePath.ts
+/**
+* Returns `true` if {@link targetPath} resolves to a location within
+* {@link baseDir}. Follows symlinks via `realpathSync` for both the base
+* directory and the target path when they exist on disk, falling back to
+* textual `resolve` otherwise (e.g. in tests with virtual paths or when
+* the target does not yet exist).
+*
+* {@link targetPath} may be either a relative path (resolved against
+* {@link baseDir}) or an absolute path (used as-is by `path.resolve`).
+* When callers have already resolved the path via `path.resolve(baseDir, x)`,
+* passing the result as an absolute path is safe — `resolve(base, absPath)`
+* returns `absPath` unchanged.
+*
+* **Limitation — symlinks**: If the target path does not exist on disk,
+* symlink components within it cannot be resolved. The check falls back
+* to a textual prefix comparison, which still catches `..` traversal but
+* cannot detect symlink-based escapes for non-existent paths.
+*
+* **Limitation — TOCTOU**: This check is inherently subject to a
+* time-of-check-to-time-of-use race: the filesystem may change between
+* this call and the subsequent file operation. This is acceptable for a
+* CLI tool where the user controls the local environment.
+*
+* **Note**: This function performs synchronous I/O (`realpathSync`).
+*
+* Callers decide how to handle the result.
+*/
+function isSafePath(targetPath, baseDir) {
+	if (targetPath.includes("\0") || baseDir.includes("\0")) return false;
+	let resolvedBase;
+	try {
+		resolvedBase = realpathSync(baseDir);
+	} catch {
+		resolvedBase = resolve(baseDir);
+	}
+	const textualTarget = resolve(resolvedBase, targetPath);
+	let resolvedTarget;
+	try {
+		resolvedTarget = realpathSync(textualTarget);
+	} catch {
+		resolvedTarget = textualTarget;
+	}
+	return resolvedTarget.startsWith(`${resolvedBase}/`) || resolvedTarget === resolvedBase;
+}
+
 //#endregion
 //#region src/core/adapters/kintone/fileUploader.ts
 var KintoneFileUploader = class {
-	constructor(client) {
+	constructor(client, baseDir) {
 		this.client = client;
+		this.baseDir = baseDir;
 	}
 	async upload(filePath) {
-		if (!filePath) throw new SystemError(SystemErrorCode.ExternalApiError, "filePath must not be empty");
+		if (!filePath) throw new ValidationError(ValidationErrorCode.InvalidInput, "filePath must not be empty");
+		const resolvedPath = resolve(this.baseDir, filePath);
+		if (!isSafePath(resolvedPath, this.baseDir)) throw new ValidationError(ValidationErrorCode.InvalidInput, `Path traversal detected: "${resolvedPath}" escapes base directory "${this.baseDir}"`);
 		try {
-			return { fileKey: (await this.client.file.uploadFile({ file: { path: filePath } })).fileKey };
+			return { fileKey: (await this.client.file.uploadFile({ file: { path: resolvedPath } })).fileKey };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, `Failed to upload file: ${filePath}`, error);
+			throw wrapKintoneError(error, `Failed to upload file: ${filePath}`);
 		}
 	}
 };
@@ -962,10 +1082,6 @@ const DECORATION_TYPES$1 = new Set([
 	"SPACER",
 	"HR"
 ]);
-const KINTONE_REVISION_CONFLICT_CODE = "GAIA_CO02";
-function isRevisionConflict(error) {
-	return error instanceof KintoneRestAPIError && error.code === KINTONE_REVISION_CONFLICT_CODE;
-}
 /**
 * Tracks the latest known kintone form revision for optimistic concurrency control.
 *
@@ -978,10 +1094,13 @@ function isRevisionConflict(error) {
 var RevisionTracker = class {
 	revision = void 0;
 	track(revision) {
-		if (this.revision === void 0 || Number(revision) > Number(this.revision)) this.revision = revision;
+		if (revision === "") throw new SystemError(SystemErrorCode.ExternalApiError, "Unexpected empty revision from kintone API");
+		const revisionNum = Number(revision);
+		if (!Number.isFinite(revisionNum)) throw new SystemError(SystemErrorCode.ExternalApiError, `Unexpected non-numeric revision from kintone API: "${revision}"`);
+		if (this.revision === void 0 || revisionNum > this.revision) this.revision = revisionNum;
 	}
 	get current() {
-		return this.revision;
+		return this.revision !== void 0 ? String(this.revision) : void 0;
 	}
 };
 function assertRecord(value, fieldPath) {
@@ -1253,7 +1372,7 @@ var KintoneFormConfigurator = class {
 				app: this.appId,
 				preview: true
 			});
-			this.revisionTracker.track(revision);
+			if (revision) this.revisionTracker.track(revision);
 			const fields = /* @__PURE__ */ new Map();
 			for (const [code, prop] of Object.entries(properties)) {
 				const kintoneProp = prop;
@@ -1264,9 +1383,7 @@ var KintoneFormConfigurator = class {
 			}
 			return fields;
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get form fields", error);
+			throw wrapKintoneError(error, "Failed to get form fields");
 		}
 	}
 	async addFields(fields) {
@@ -1280,10 +1397,7 @@ var KintoneFormConfigurator = class {
 			});
 			if (response.revision) this.revisionTracker.track(response.revision);
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			if (isRevisionConflict(error)) throw new ConflictError(ConflictErrorCode.Conflict, "Form configuration was modified by another process. Please retry the operation.", error);
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to add form fields", error);
+			throw wrapKintoneError(error, "Failed to add form fields");
 		}
 	}
 	async updateFields(fields) {
@@ -1297,10 +1411,7 @@ var KintoneFormConfigurator = class {
 			});
 			if (response.revision) this.revisionTracker.track(response.revision);
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			if (isRevisionConflict(error)) throw new ConflictError(ConflictErrorCode.Conflict, "Form configuration was modified by another process. Please retry the operation.", error);
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update form fields", error);
+			throw wrapKintoneError(error, "Failed to update form fields");
 		}
 	}
 	async deleteFields(fieldCodes) {
@@ -1312,10 +1423,7 @@ var KintoneFormConfigurator = class {
 			});
 			if (response.revision) this.revisionTracker.track(response.revision);
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			if (isRevisionConflict(error)) throw new ConflictError(ConflictErrorCode.Conflict, "Form configuration was modified by another process. Please retry the operation.", error);
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to delete form fields", error);
+			throw wrapKintoneError(error, "Failed to delete form fields");
 		}
 	}
 	async getLayout() {
@@ -1324,12 +1432,10 @@ var KintoneFormConfigurator = class {
 				app: this.appId,
 				preview: true
 			});
-			this.revisionTracker.track(response.revision);
+			if (response.revision) this.revisionTracker.track(response.revision);
 			return response.layout.map(fromKintoneLayoutItem);
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get form layout", error);
+			throw wrapKintoneError(error, "Failed to get form layout");
 		}
 	}
 	async updateLayout(layout) {
@@ -1342,10 +1448,7 @@ var KintoneFormConfigurator = class {
 			});
 			if (response.revision) this.revisionTracker.track(response.revision);
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			if (isRevisionConflict(error)) throw new ConflictError(ConflictErrorCode.Conflict, "Form configuration was modified by another process. Please retry the operation.", error);
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update form layout", error);
+			throw wrapKintoneError(error, "Failed to update form layout");
 		}
 	}
 };
@@ -1466,9 +1569,7 @@ var KintoneRecordManager = class {
 				};
 			});
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get records", error);
+			throw wrapKintoneError(error, "Failed to get records");
 		}
 	}
 	async addRecords(records) {
@@ -1479,9 +1580,7 @@ var KintoneRecordManager = class {
 				records: records.map(toKintoneRecord)
 			});
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to add records", error);
+			throw wrapKintoneError(error, "Failed to add records");
 		}
 	}
 	async updateRecords(records) {
@@ -1495,9 +1594,7 @@ var KintoneRecordManager = class {
 				}))
 			});
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update records", error);
+			throw wrapKintoneError(error, "Failed to update records");
 		}
 	}
 	async deleteAllRecords() {
@@ -1514,9 +1611,7 @@ var KintoneRecordManager = class {
 			});
 			return { deletedCount: records.length };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to delete all records", error);
+			throw wrapKintoneError(error, "Failed to delete all records");
 		}
 	}
 };
@@ -1530,10 +1625,15 @@ function createLocalFileCustomizationStorage(filePath) {
 //#endregion
 //#region src/core/adapters/local/fileWriter.ts
 var LocalFileWriter = class {
+	constructor(baseDir = process.cwd()) {
+		this.baseDir = baseDir;
+	}
 	async write(filePath, data) {
+		const resolvedPath = resolve(this.baseDir, filePath);
+		if (!isSafePath(resolvedPath, this.baseDir)) throw new ValidationError(ValidationErrorCode.InvalidInput, `Path traversal detected: "${resolvedPath}" escapes base directory "${this.baseDir}"`);
 		try {
-			await mkdir(dirname(filePath), { recursive: true });
-			await writeFile(filePath, Buffer.from(new Uint8Array(data)));
+			await mkdir(dirname(resolvedPath), { recursive: true });
+			await writeFile(resolvedPath, Buffer.from(new Uint8Array(data)));
 		} catch (error) {
 			throw new SystemError(SystemErrorCode.StorageError, `Failed to write file: ${filePath}`, error);
 		}
@@ -1562,11 +1662,7 @@ function buildKintoneAuth(auth) {
 	};
 }
 function createCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		formConfigurator: new KintoneFormConfigurator(client, config.appId),
 		schemaStorage: createLocalFileSchemaStorage(config.schemaFilePath),
@@ -1575,38 +1671,36 @@ function createCliContainer(config) {
 }
 function createSeedCliContainer(config) {
 	return {
-		recordManager: new KintoneRecordManager(new KintoneRestAPIClient({
-			baseUrl: config.baseUrl,
-			auth: buildKintoneAuth(config.auth),
-			guestSpaceId: config.guestSpaceId
-		}), config.appId),
+		recordManager: new KintoneRecordManager(config.client ?? createKintoneClient(config), config.appId),
 		seedStorage: createLocalFileSeedStorage(config.seedFilePath)
 	};
 }
 function createCustomizationCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		customizationConfigurator: new KintoneCustomizationConfigurator(client, config.appId),
 		customizationStorage: createLocalFileCustomizationStorage(config.customizeFilePath),
-		fileUploader: new KintoneFileUploader(client),
+		fileUploader: new KintoneFileUploader(client, process.cwd()),
 		fileDownloader: new KintoneFileDownloader(client),
-		fileWriter: new LocalFileWriter(),
+		fileWriter: new LocalFileWriter(process.cwd()),
 		appDeployer: new KintoneAppDeployer(client, config.appId)
 	};
 }
 
 //#endregion
-//#region src/core/application/container/actionCli.ts
-function createActionCliContainer(config) {
-	const client = new KintoneRestAPIClient({
+//#region src/core/application/container/kintoneClient.ts
+function createKintoneClient(config) {
+	return new KintoneRestAPIClient({
 		baseUrl: config.baseUrl,
 		auth: buildKintoneAuth(config.auth),
 		guestSpaceId: config.guestSpaceId
 	});
+}
+
+//#endregion
+//#region src/core/application/container/actionCli.ts
+function createActionCliContainer(config) {
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		actionConfigurator: new KintoneActionConfigurator(client, config.appId),
 		actionStorage: createLocalFileActionStorage(config.actionFilePath),
@@ -2543,15 +2637,25 @@ const ActionConfigSerializer = { serialize: (config) => {
 } };
 
 //#endregion
-//#region src/core/application/action/captureAction.ts
-async function captureAction({ container }) {
-	const { actions } = await container.actionConfigurator.getActions();
+//#region src/core/application/captureFromConfigBase.ts
+async function captureFromConfig(config) {
+	const remote = await config.fetchRemote();
 	return {
-		configText: ActionConfigSerializer.serialize({ actions }),
-		hasExistingConfig: (await container.actionStorage.get()).exists
+		configText: config.serialize(remote),
+		hasExistingConfig: (await config.getStorage()).exists
 	};
 }
 
+//#endregion
+//#region src/core/application/action/captureAction.ts
+async function captureAction({ container }) {
+	return captureFromConfig({
+		fetchRemote: () => container.actionConfigurator.getActions(),
+		serialize: ({ actions }) => ActionConfigSerializer.serialize({ actions }),
+		getStorage: () => container.actionStorage.get()
+	});
+}
+
 //#endregion
 //#region src/core/application/action/saveAction.ts
 async function saveAction({ container, input }) {
@@ -2883,13 +2987,17 @@ function parseAdminNotesConfigText(rawText) {
 //#endregion
 //#region src/core/application/adminNotes/applyAdminNotes.ts
 async function applyAdminNotes({ container }) {
-	const result = await container.adminNotesStorage.get();
-	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "Admin notes config file not found");
-	const config = parseAdminNotesConfigText(result.content);
-	const current = await container.adminNotesConfigurator.getAdminNotes();
-	await container.adminNotesConfigurator.updateAdminNotes({
-		config,
-		revision: current.revision
+	await applyFromConfig({
+		getStorage: () => container.adminNotesStorage.get(),
+		parseConfig: parseAdminNotesConfigText,
+		fetchRemote: () => container.adminNotesConfigurator.getAdminNotes(),
+		update: async (config, current) => {
+			await container.adminNotesConfigurator.updateAdminNotes({
+				config,
+				revision: current.revision
+			});
+		},
+		notFoundMessage: "Admin notes config file not found"
 	});
 }
 
@@ -2914,9 +3022,7 @@ var KintoneAdminNotesConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get admin notes", error);
+			throw wrapKintoneError(error, "Failed to get admin notes");
 		}
 	}
 	async updateAdminNotes(params) {
@@ -2929,9 +3035,7 @@ var KintoneAdminNotesConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateAdminNotes(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update admin notes", error);
+			throw wrapKintoneError(error, "Failed to update admin notes");
 		}
 	}
 };
@@ -2945,11 +3049,7 @@ function createLocalFileAdminNotesStorage(filePath) {
 //#endregion
 //#region src/core/application/container/adminNotesCli.ts
 function createAdminNotesCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		adminNotesConfigurator: new KintoneAdminNotesConfigurator(client, config.appId),
 		adminNotesStorage: createLocalFileAdminNotesStorage(config.adminNotesFilePath),
@@ -3037,11 +3137,11 @@ const AdminNotesConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/adminNotes/captureAdminNotes.ts
 async function captureAdminNotes({ container }) {
-	const { config } = await container.adminNotesConfigurator.getAdminNotes();
-	return {
-		configText: AdminNotesConfigSerializer.serialize(config),
-		hasExistingConfig: (await container.adminNotesStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.adminNotesConfigurator.getAdminNotes(),
+		serialize: ({ config }) => AdminNotesConfigSerializer.serialize(config),
+		getStorage: () => container.adminNotesStorage.get()
+	});
 }
 
 //#endregion
@@ -3207,13 +3307,17 @@ function parseAppPermissionConfigText(rawText) {
 //#endregion
 //#region src/core/application/appPermission/applyAppPermission.ts
 async function applyAppPermission({ container }) {
-	const result = await container.appPermissionStorage.get();
-	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "App permission config file not found");
-	const config = parseAppPermissionConfigText(result.content);
-	const current = await container.appPermissionConfigurator.getAppPermissions();
-	await container.appPermissionConfigurator.updateAppPermissions({
-		rights: config.rights,
-		revision: current.revision
+	await applyFromConfig({
+		getStorage: () => container.appPermissionStorage.get(),
+		parseConfig: parseAppPermissionConfigText,
+		fetchRemote: () => container.appPermissionConfigurator.getAppPermissions(),
+		update: async (config, current) => {
+			await container.appPermissionConfigurator.updateAppPermissions({
+				rights: config.rights,
+				revision: current.revision
+			});
+		},
+		notFoundMessage: "App permission config file not found"
 	});
 }
 
@@ -3281,9 +3385,7 @@ var KintoneAppPermissionConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get app ACL", error);
+			throw wrapKintoneError(error, "Failed to get app ACL");
 		}
 	}
 	async updateAppPermissions(params) {
@@ -3295,9 +3397,7 @@ var KintoneAppPermissionConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateAppAcl(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update app ACL", error);
+			throw wrapKintoneError(error, "Failed to update app ACL");
 		}
 	}
 };
@@ -3311,11 +3411,7 @@ function createLocalFileAppPermissionStorage(filePath) {
 //#endregion
 //#region src/core/application/container/appPermissionCli.ts
 function createAppPermissionCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		appPermissionConfigurator: new KintoneAppPermissionConfigurator(client, config.appId),
 		appPermissionStorage: createLocalFileAppPermissionStorage(config.appAclFilePath),
@@ -3416,11 +3512,11 @@ const AppPermissionConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/appPermission/captureAppPermission.ts
 async function captureAppPermission({ container }) {
-	const { rights } = await container.appPermissionConfigurator.getAppPermissions();
-	return {
-		configText: AppPermissionConfigSerializer.serialize({ rights }),
-		hasExistingConfig: (await container.appPermissionStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.appPermissionConfigurator.getAppPermissions(),
+		serialize: ({ rights }) => AppPermissionConfigSerializer.serialize({ rights }),
+		getStorage: () => container.appPermissionStorage.get()
+	});
 }
 
 //#endregion
@@ -3856,8 +3952,8 @@ function planResources(resources, platformDir, resourceType, relativeBaseDir) {
 		filesToDownload
 	};
 }
-function planPlatform(remotePlatform, platformName, args) {
-	const platformDir = join(args.input.basePath, args.input.filePrefix, platformName);
+function planPlatform(remotePlatform, platformName, basePath, filePrefix) {
+	const platformDir = join(basePath, filePrefix, platformName);
 	const platformPrefix = platformName;
 	const jsPlan = planResources(remotePlatform.js, platformDir, "js", platformPrefix);
 	const cssPlan = planResources(remotePlatform.css, platformDir, "css", platformPrefix);
@@ -3885,18 +3981,18 @@ async function downloadFiles(files, container) {
 		await container.fileWriter.write(file.absolutePath, data);
 	}));
 }
-async function captureCustomization(args) {
-	const existing = await args.container.customizationStorage.get();
-	const { scope, desktop, mobile } = await args.container.customizationConfigurator.getCustomization();
-	const desktopPlan = planPlatform(desktop, "desktop", args);
-	const mobilePlan = planPlatform(mobile, "mobile", args);
+async function captureCustomization({ container, input }) {
+	const existing = await container.customizationStorage.get();
+	const { scope, desktop, mobile } = await container.customizationConfigurator.getCustomization();
+	const desktopPlan = planPlatform(desktop, "desktop", input.basePath, input.filePrefix);
+	const mobilePlan = planPlatform(mobile, "mobile", input.basePath, input.filePrefix);
 	const config = {
 		scope,
 		desktop: desktopPlan.platform,
 		mobile: mobilePlan.platform
 	};
 	const configText = CustomizationConfigSerializer.serialize(config);
-	await downloadFiles([...desktopPlan.filesToDownload, ...mobilePlan.filesToDownload], args.container);
+	await downloadFiles([...desktopPlan.filesToDownload, ...mobilePlan.filesToDownload], container);
 	return {
 		configText,
 		hasExistingConfig: existing.exists,
@@ -4194,9 +4290,7 @@ var KintoneFieldPermissionConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get field ACL", error);
+			throw wrapKintoneError(error, "Failed to get field ACL");
 		}
 	}
 	async updateFieldPermissions(params) {
@@ -4208,9 +4302,7 @@ var KintoneFieldPermissionConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateFieldAcl(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update field ACL", error);
+			throw wrapKintoneError(error, "Failed to update field ACL");
 		}
 	}
 };
@@ -4224,11 +4316,7 @@ function createLocalFileFieldPermissionStorage(filePath) {
 //#endregion
 //#region src/core/application/container/fieldPermissionCli.ts
 function createFieldPermissionCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		fieldPermissionConfigurator: new KintoneFieldPermissionConfigurator(client, config.appId),
 		fieldPermissionStorage: createLocalFileFieldPermissionStorage(config.fieldAclFilePath),
@@ -4303,13 +4391,17 @@ function parseFieldPermissionConfigText(rawText) {
 //#endregion
 //#region src/core/application/fieldPermission/applyFieldPermission.ts
 async function applyFieldPermission({ container }) {
-	const result = await container.fieldPermissionStorage.get();
-	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "Field permission config file not found");
-	const config = parseFieldPermissionConfigText(result.content);
-	const current = await container.fieldPermissionConfigurator.getFieldPermissions();
-	await container.fieldPermissionConfigurator.updateFieldPermissions({
-		rights: config.rights,
-		revision: current.revision
+	await applyFromConfig({
+		getStorage: () => container.fieldPermissionStorage.get(),
+		parseConfig: parseFieldPermissionConfigText,
+		fetchRemote: () => container.fieldPermissionConfigurator.getFieldPermissions(),
+		update: async (config, current) => {
+			await container.fieldPermissionConfigurator.updateFieldPermissions({
+				rights: config.rights,
+				revision: current.revision
+			});
+		},
+		notFoundMessage: "Field permission config file not found"
 	});
 }
 
@@ -4404,11 +4496,11 @@ const FieldPermissionConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/fieldPermission/captureFieldPermission.ts
 async function captureFieldPermission({ container }) {
-	const { rights } = await container.fieldPermissionConfigurator.getFieldPermissions();
-	return {
-		configText: FieldPermissionConfigSerializer.serialize({ rights }),
-		hasExistingConfig: (await container.fieldPermissionStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.fieldPermissionConfigurator.getFieldPermissions(),
+		serialize: ({ rights }) => FieldPermissionConfigSerializer.serialize({ rights }),
+		getStorage: () => container.fieldPermissionStorage.get()
+	});
 }
 
 //#endregion
@@ -4539,6 +4631,14 @@ var field_acl_default = define({
 	run: () => {}
 });
 
+//#endregion
+//#region src/core/adapters/kintone/parseKintoneIntegerField.ts
+function parseKintoneIntegerField(raw, fieldName) {
+	const n = Number(raw);
+	if (!Number.isFinite(n) || !Number.isInteger(n)) throw new SystemError(SystemErrorCode.ExternalApiError, `Unexpected non-integer ${fieldName} from kintone API: ${raw}`);
+	return n;
+}
+
 //#endregion
 //#region src/core/adapters/kintone/generalSettingsConfigurator.ts
 const VALID_THEMES$1 = new Set([
@@ -4583,8 +4683,8 @@ function fromKintoneTitleField(raw) {
 function fromKintoneNumberPrecision(raw) {
 	if (!VALID_ROUNDING_MODES$1.has(raw.roundingMode)) throw new SystemError(SystemErrorCode.ExternalApiError, `Unexpected roundingMode from kintone API: ${raw.roundingMode}`);
 	return {
-		digits: Number(raw.digits),
-		decimalPlaces: Number(raw.decimalPlaces),
+		digits: parseKintoneIntegerField(raw.digits, "digits"),
+		decimalPlaces: parseKintoneIntegerField(raw.decimalPlaces, "decimalPlaces"),
 		roundingMode: raw.roundingMode
 	};
 }
@@ -4602,7 +4702,7 @@ function fromKintoneSettings(raw) {
 		...raw.enableDuplicateRecord !== void 0 ? { enableDuplicateRecord: raw.enableDuplicateRecord } : {},
 		...raw.enableInlineRecordEditing !== void 0 ? { enableInlineRecordEditing: raw.enableInlineRecordEditing } : {},
 		...raw.numberPrecision !== void 0 ? { numberPrecision: fromKintoneNumberPrecision(raw.numberPrecision) } : {},
-		...raw.firstMonthOfFiscalYear !== void 0 ? { firstMonthOfFiscalYear: Number(raw.firstMonthOfFiscalYear) } : {}
+		...raw.firstMonthOfFiscalYear !== void 0 ? { firstMonthOfFiscalYear: parseKintoneIntegerField(raw.firstMonthOfFiscalYear, "firstMonthOfFiscalYear") } : {}
 	};
 }
 function toKintoneIcon(icon) {
@@ -4655,9 +4755,7 @@ var KintoneGeneralSettingsConfigurator = class {
 				revision: raw.revision ?? "-1"
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get general settings", error);
+			throw wrapKintoneError(error, "Failed to get general settings");
 		}
 	}
 	async updateGeneralSettings(params) {
@@ -4669,9 +4767,7 @@ var KintoneGeneralSettingsConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateAppSettings(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update general settings", error);
+			throw wrapKintoneError(error, "Failed to update general settings");
 		}
 	}
 };
@@ -4685,11 +4781,7 @@ function createLocalFileGeneralSettingsStorage(filePath) {
 //#endregion
 //#region src/core/application/container/generalSettingsCli.ts
 function createGeneralSettingsCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		generalSettingsConfigurator: new KintoneGeneralSettingsConfigurator(client, config.appId),
 		generalSettingsStorage: createLocalFileGeneralSettingsStorage(config.settingsFilePath),
@@ -4750,8 +4842,7 @@ function fromKintonePerRecordNotification(raw) {
 	};
 }
 function fromKintoneReminderNotification(raw) {
-	const daysLater = Number(raw.timing.daysLater);
-	if (!Number.isFinite(daysLater)) throw new SystemError(SystemErrorCode.ExternalApiError, `Unexpected non-numeric daysLater from kintone API: ${raw.timing.daysLater}`);
+	const daysLater = parseKintoneIntegerField(raw.timing.daysLater, "daysLater");
 	const result = {
 		code: raw.timing.code,
 		daysLater,
@@ -4760,8 +4851,7 @@ function fromKintoneReminderNotification(raw) {
 		targets: raw.targets.map(fromKintoneTarget)
 	};
 	if ("hoursLater" in raw.timing) {
-		const hoursLater = Number(raw.timing.hoursLater);
-		if (!Number.isFinite(hoursLater)) throw new SystemError(SystemErrorCode.ExternalApiError, `Unexpected non-numeric hoursLater from kintone API: ${raw.timing.hoursLater}`);
+		const hoursLater = parseKintoneIntegerField(raw.timing.hoursLater, "hoursLater");
 		return {
 			...result,
 			hoursLater
@@ -4836,9 +4926,7 @@ var KintoneNotificationConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get general notifications", error);
+			throw wrapKintoneError(error, "Failed to get general notifications");
 		}
 	}
 	async updateGeneralNotifications(params) {
@@ -4851,9 +4939,7 @@ var KintoneNotificationConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateGeneralNotifications(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update general notifications", error);
+			throw wrapKintoneError(error, "Failed to update general notifications");
 		}
 	}
 	async getPerRecordNotifications() {
@@ -4867,9 +4953,7 @@ var KintoneNotificationConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get per-record notifications", error);
+			throw wrapKintoneError(error, "Failed to get per-record notifications");
 		}
 	}
 	async updatePerRecordNotifications(params) {
@@ -4881,9 +4965,7 @@ var KintoneNotificationConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updatePerRecordNotifications(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update per-record notifications", error);
+			throw wrapKintoneError(error, "Failed to update per-record notifications");
 		}
 	}
 	async getReminderNotifications() {
@@ -4899,9 +4981,7 @@ var KintoneNotificationConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get reminder notifications", error);
+			throw wrapKintoneError(error, "Failed to get reminder notifications");
 		}
 	}
 	async updateReminderNotifications(params) {
@@ -4914,9 +4994,7 @@ var KintoneNotificationConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateReminderNotifications(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update reminder notifications", error);
+			throw wrapKintoneError(error, "Failed to update reminder notifications");
 		}
 	}
 };
@@ -4930,11 +5008,7 @@ function createLocalFileNotificationStorage(filePath) {
 //#endregion
 //#region src/core/application/container/notificationCli.ts
 function createNotificationCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		notificationConfigurator: new KintoneNotificationConfigurator(client, config.appId),
 		notificationStorage: createLocalFileNotificationStorage(config.notificationFilePath),
@@ -4964,22 +5038,18 @@ var KintonePluginConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get plugins", error);
+			throw wrapKintoneError(error, "Failed to get plugins");
 		}
 	}
 	async addPlugins(params) {
 		try {
 			return { revision: (await this.client.app.addPlugins({
 				app: this.appId,
-				ids: params.ids,
+				ids: [...params.ids],
 				revision: params.revision
 			})).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to add plugins", error);
+			throw wrapKintoneError(error, "Failed to add plugins");
 		}
 	}
 };
@@ -4993,11 +5063,7 @@ function createLocalFilePluginStorage(filePath) {
 //#endregion
 //#region src/core/application/container/pluginCli.ts
 function createPluginCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		pluginConfigurator: new KintonePluginConfigurator(client, config.appId),
 		pluginStorage: createLocalFilePluginStorage(config.pluginFilePath),
@@ -5116,9 +5182,7 @@ var KintoneProcessManagementConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get process management settings", error);
+			throw wrapKintoneError(error, "Failed to get process management settings");
 		}
 	}
 	async updateProcessManagement(params) {
@@ -5134,9 +5198,7 @@ var KintoneProcessManagementConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateProcessManagement(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update process management settings", error);
+			throw wrapKintoneError(error, "Failed to update process management settings");
 		}
 	}
 };
@@ -5150,11 +5212,7 @@ function createLocalFileProcessManagementStorage(filePath) {
 //#endregion
 //#region src/core/application/container/processManagementCli.ts
 function createProcessManagementCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		processManagementConfigurator: new KintoneProcessManagementConfigurator(client, config.appId),
 		processManagementStorage: createLocalFileProcessManagementStorage(config.processFilePath),
@@ -5223,9 +5281,7 @@ var KintoneRecordPermissionConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get record ACL", error);
+			throw wrapKintoneError(error, "Failed to get record ACL");
 		}
 	}
 	async updateRecordPermissions(params) {
@@ -5237,9 +5293,7 @@ var KintoneRecordPermissionConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateRecordAcl(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update record ACL", error);
+			throw wrapKintoneError(error, "Failed to update record ACL");
 		}
 	}
 };
@@ -5253,11 +5307,7 @@ function createLocalFileRecordPermissionStorage(filePath) {
 //#endregion
 //#region src/core/application/container/recordPermissionCli.ts
 function createRecordPermissionCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		recordPermissionConfigurator: new KintoneRecordPermissionConfigurator(client, config.appId),
 		recordPermissionStorage: createLocalFileRecordPermissionStorage(config.recordAclFilePath),
@@ -5516,9 +5566,7 @@ var KintoneReportConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get reports", error);
+			throw wrapKintoneError(error, "Failed to get reports");
 		}
 	}
 	async updateReports(params) {
@@ -5532,9 +5580,7 @@ var KintoneReportConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateReports(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update reports", error);
+			throw wrapKintoneError(error, "Failed to update reports");
 		}
 	}
 };
@@ -5548,11 +5594,7 @@ function createLocalFileReportStorage(filePath) {
 //#endregion
 //#region src/core/application/container/reportCli.ts
 function createReportCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		reportConfigurator: new KintoneReportConfigurator(client, config.appId),
 		reportStorage: createLocalFileReportStorage(config.reportFilePath),
@@ -5588,21 +5630,17 @@ function fromKintoneView(name, raw) {
 	}
 	return {
 		type: raw.type,
-		index: (() => {
-			const idx = typeof raw.index === "string" ? Number(raw.index) : raw.index;
-			if (!Number.isFinite(idx)) throw new SystemError(SystemErrorCode.ExternalApiError, `Unexpected non-numeric index from kintone API: ${raw.index}`);
-			return idx;
-		})(),
+		index: parseKintoneIntegerField(raw.index, "index"),
 		name,
-		...raw.builtinType !== void 0 && { builtinType: raw.builtinType },
-		...raw.fields !== void 0 && { fields: raw.fields },
-		...raw.date !== void 0 && { date: raw.date },
-		...raw.title !== void 0 && { title: raw.title },
-		...raw.html !== void 0 && { html: raw.html },
-		...raw.pager !== void 0 && { pager: raw.pager },
-		...device !== void 0 && { device },
-		...raw.filterCond !== void 0 && { filterCond: raw.filterCond },
-		...raw.sort !== void 0 && { sort: raw.sort }
+		...raw.builtinType !== void 0 ? { builtinType: raw.builtinType } : {},
+		...raw.fields !== void 0 ? { fields: raw.fields } : {},
+		...raw.date !== void 0 ? { date: raw.date } : {},
+		...raw.title !== void 0 ? { title: raw.title } : {},
+		...raw.html !== void 0 ? { html: raw.html } : {},
+		...raw.pager !== void 0 ? { pager: raw.pager } : {},
+		...device !== void 0 ? { device } : {},
+		...raw.filterCond !== void 0 ? { filterCond: raw.filterCond } : {},
+		...raw.sort !== void 0 ? { sort: raw.sort } : {}
 	};
 }
 function toKintoneView(config) {
@@ -5642,9 +5680,7 @@ var KintoneViewConfigurator = class {
 				revision: response.revision
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to get views", error);
+			throw wrapKintoneError(error, "Failed to get views");
 		}
 	}
 	async updateViews(params) {
@@ -5658,9 +5694,7 @@ var KintoneViewConfigurator = class {
 			if (params.revision !== void 0) requestParams.revision = params.revision;
 			return { revision: (await this.client.app.updateViews(requestParams)).revision };
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to update views", error);
+			throw wrapKintoneError(error, "Failed to update views");
 		}
 	}
 };
@@ -5674,11 +5708,7 @@ function createLocalFileViewStorage(filePath) {
 //#endregion
 //#region src/core/application/container/viewCli.ts
 function createViewCliContainer(config) {
-	const client = new KintoneRestAPIClient({
-		baseUrl: config.baseUrl,
-		auth: buildKintoneAuth(config.auth),
-		guestSpaceId: config.guestSpaceId
-	});
+	const client = config.client ?? createKintoneClient(config);
 	return {
 		viewConfigurator: new KintoneViewConfigurator(client, config.appId),
 		viewStorage: createLocalFileViewStorage(config.viewFilePath),
@@ -5689,11 +5719,13 @@ function createViewCliContainer(config) {
 //#endregion
 //#region src/core/application/container/captureAllCli.ts
 function createCliCaptureContainers(input) {
+	const client = createKintoneClient(input);
 	const base = {
 		baseUrl: input.baseUrl,
 		auth: input.auth,
 		appId: input.appId,
-		guestSpaceId: input.guestSpaceId
+		guestSpaceId: input.guestSpaceId,
+		client
 	};
 	const paths = buildAppFilePaths(input.appName, input.baseDir);
 	return {
@@ -5778,7 +5810,7 @@ var KintoneSpaceReader = class {
 		this.client = client;
 	}
 	async getSpaceApps(spaceId) {
-		if (!spaceId) throw new SystemError(SystemErrorCode.ExternalApiError, "spaceId must not be empty");
+		if (!spaceId) throw new ValidationError(ValidationErrorCode.InvalidInput, "spaceId must not be empty");
 		try {
 			const rawApps = (await this.client.space.getSpace({ id: spaceId })).attachedApps;
 			if (rawApps === void 0) throw new SystemError(SystemErrorCode.ExternalApiError, `Space API response for space ID ${spaceId} does not contain attachedApps. The kintone API response format may have changed.`);
@@ -5797,9 +5829,7 @@ var KintoneSpaceReader = class {
 			}
 			return result;
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, `Failed to get space info for space ID: ${spaceId}`, error);
+			throw wrapKintoneError(error, `Failed to get space info for space ID: ${spaceId}`);
 		}
 	}
 };
@@ -5814,11 +5844,7 @@ function createLocalFileProjectConfigStorage(filePath) {
 //#region src/core/application/container/initCli.ts
 function createInitCliContainer(config) {
 	return {
-		spaceReader: new KintoneSpaceReader(new KintoneRestAPIClient({
-			baseUrl: config.baseUrl,
-			auth: buildKintoneAuth(config.auth),
-			guestSpaceId: config.guestSpaceId
-		})),
+		spaceReader: new KintoneSpaceReader(config.client ?? createKintoneClient(config)),
 		projectConfigStorage: createLocalFileProjectConfigStorage(config.configFilePath)
 	};
 }
@@ -6038,11 +6064,11 @@ const GeneralSettingsConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/generalSettings/captureGeneralSettings.ts
 async function captureGeneralSettings({ container }) {
-	const { config } = await container.generalSettingsConfigurator.getGeneralSettings();
-	return {
-		configText: GeneralSettingsConfigSerializer.serialize(config),
-		hasExistingConfig: (await container.generalSettingsStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.generalSettingsConfigurator.getGeneralSettings(),
+		serialize: ({ config }) => GeneralSettingsConfigSerializer.serialize(config),
+		getStorage: () => container.generalSettingsStorage.get()
+	});
 }
 
 //#endregion
@@ -6112,9 +6138,11 @@ const NotificationConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/notification/captureNotification.ts
 async function captureNotification({ container }) {
-	const general = await container.notificationConfigurator.getGeneralNotifications();
-	const perRecord = await container.notificationConfigurator.getPerRecordNotifications();
-	const reminder = await container.notificationConfigurator.getReminderNotifications();
+	const [general, perRecord, reminder] = await Promise.all([
+		container.notificationConfigurator.getGeneralNotifications(),
+		container.notificationConfigurator.getPerRecordNotifications(),
+		container.notificationConfigurator.getReminderNotifications()
+	]);
 	const config = {
 		general: {
 			notifyToCommenter: general.notifyToCommenter,
@@ -6151,11 +6179,11 @@ const PluginConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/plugin/capturePlugin.ts
 async function capturePlugin({ container }) {
-	const { plugins } = await container.pluginConfigurator.getPlugins();
-	return {
-		configText: PluginConfigSerializer.serialize({ plugins }),
-		hasExistingConfig: (await container.pluginStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.pluginConfigurator.getPlugins(),
+		serialize: ({ plugins }) => PluginConfigSerializer.serialize({ plugins }),
+		getStorage: () => container.pluginStorage.get()
+	});
 }
 
 //#endregion
@@ -6201,11 +6229,11 @@ const ProcessManagementConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/processManagement/captureProcessManagement.ts
 async function captureProcessManagement({ container }) {
-	const { config } = await container.processManagementConfigurator.getProcessManagement();
-	return {
-		configText: ProcessManagementConfigSerializer.serialize(config),
-		hasExistingConfig: (await container.processManagementStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.processManagementConfigurator.getProcessManagement(),
+		serialize: ({ config }) => ProcessManagementConfigSerializer.serialize(config),
+		getStorage: () => container.processManagementStorage.get()
+	});
 }
 
 //#endregion
@@ -6238,11 +6266,11 @@ const RecordPermissionConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/recordPermission/captureRecordPermission.ts
 async function captureRecordPermission({ container }) {
-	const { rights } = await container.recordPermissionConfigurator.getRecordPermissions();
-	return {
-		configText: RecordPermissionConfigSerializer.serialize({ rights }),
-		hasExistingConfig: (await container.recordPermissionStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.recordPermissionConfigurator.getRecordPermissions(),
+		serialize: ({ rights }) => RecordPermissionConfigSerializer.serialize({ rights }),
+		getStorage: () => container.recordPermissionStorage.get()
+	});
 }
 
 //#endregion
@@ -6309,11 +6337,11 @@ const ReportConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/report/captureReport.ts
 async function captureReport({ container }) {
-	const { reports } = await container.reportConfigurator.getReports();
-	return {
-		configText: ReportConfigSerializer.serialize({ reports }),
-		hasExistingConfig: (await container.reportStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.reportConfigurator.getReports(),
+		serialize: ({ reports }) => ReportConfigSerializer.serialize({ reports }),
+		getStorage: () => container.reportStorage.get()
+	});
 }
 
 //#endregion
@@ -6393,11 +6421,11 @@ const ViewConfigSerializer = { serialize: (config) => {
 //#endregion
 //#region src/core/application/view/captureView.ts
 async function captureView({ container }) {
-	const { views } = await container.viewConfigurator.getViews();
-	return {
-		configText: ViewConfigSerializer.serialize({ views }),
-		hasExistingConfig: (await container.viewStorage.get()).exists
-	};
+	return captureFromConfig({
+		fetchRemote: () => container.viewConfigurator.getViews(),
+		serialize: ({ views }) => ViewConfigSerializer.serialize({ views }),
+		getStorage: () => container.viewStorage.get()
+	});
 }
 
 //#endregion
@@ -6596,12 +6624,11 @@ function generateProjectConfig(input) {
 			files: buildAppFilePaths(name, input.baseDir)
 		};
 	}
-	const config = {
+	return stringify({
 		domain: input.domain,
+		...input.guestSpaceId !== void 0 ? { guestSpaceId: input.guestSpaceId } : {},
 		apps
-	};
-	if (input.guestSpaceId !== void 0) config.guestSpaceId = input.guestSpaceId;
-	return stringify(config, { lineWidth: 0 });
+	}, { lineWidth: 0 });
 }
 
 //#endregion
@@ -6861,6 +6888,15 @@ function parseNotificationConfigText(rawText) {
 
 //#endregion
 //#region src/core/application/notification/applyNotification.ts
+/**
+* Apply notification settings to kintone.
+*
+* Each notification section (general, perRecord, reminder) is updated
+* independently via separate API calls. If one section fails after others
+* have already been applied, the app will be in a partially-updated state.
+* This is a kintone API limitation — there is no transactional update
+* across notification types. Re-running the command is safe and idempotent.
+*/
 async function applyNotification({ container }) {
 	const result = await container.notificationStorage.get();
 	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "Notification config file not found");
@@ -7926,13 +7962,17 @@ function parseRecordPermissionConfigText(rawText) {
 //#endregion
 //#region src/core/application/recordPermission/applyRecordPermission.ts
 async function applyRecordPermission({ container }) {
-	const result = await container.recordPermissionStorage.get();
-	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "Record permission config file not found");
-	const config = parseRecordPermissionConfigText(result.content);
-	const current = await container.recordPermissionConfigurator.getRecordPermissions();
-	await container.recordPermissionConfigurator.updateRecordPermissions({
-		rights: config.rights,
-		revision: current.revision
+	await applyFromConfig({
+		getStorage: () => container.recordPermissionStorage.get(),
+		parseConfig: parseRecordPermissionConfigText,
+		fetchRemote: () => container.recordPermissionConfigurator.getRecordPermissions(),
+		update: async (config, current) => {
+			await container.recordPermissionConfigurator.updateRecordPermissions({
+				rights: config.rights,
+				revision: current.revision
+			});
+		},
+		notFoundMessage: "Record permission config file not found"
 	});
 }
 
@@ -8308,13 +8348,17 @@ function parseReportConfigText(rawText) {
 //#endregion
 //#region src/core/application/report/applyReport.ts
 async function applyReport({ container }) {
-	const result = await container.reportStorage.get();
-	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "Report config file not found");
-	const config = parseReportConfigText(result.content);
-	const current = await container.reportConfigurator.getReports();
-	await container.reportConfigurator.updateReports({
-		reports: config.reports,
-		revision: current.revision
+	await applyFromConfig({
+		getStorage: () => container.reportStorage.get(),
+		parseConfig: parseReportConfigText,
+		fetchRemote: () => container.reportConfigurator.getReports(),
+		update: async (config, current) => {
+			await container.reportConfigurator.updateReports({
+				reports: config.reports,
+				revision: current.revision
+			});
+		},
+		notFoundMessage: "Report config file not found"
 	});
 }
 
@@ -9108,12 +9152,25 @@ function parseSchemaText(rawText) {
 
 //#endregion
 //#region src/core/application/formSchema/detectDiff.ts
+function fieldPropertiesToDto(field) {
+	if (field.type === "SUBTABLE") {
+		const innerFields = {};
+		for (const [code, def] of field.properties.fields) innerFields[code] = {
+			code: def.code,
+			type: def.type,
+			label: def.label,
+			properties: def.properties
+		};
+		return { fields: innerFields };
+	}
+	return { ...field.properties };
+}
 function toFieldDto(field) {
 	return {
 		code: field.code,
 		type: field.type,
 		label: field.label,
-		properties: field.properties
+		properties: fieldPropertiesToDto(field)
 	};
 }
 async function detectDiff({ container }) {
@@ -9198,15 +9255,19 @@ var KintoneFormDumpReader = class {
 	}
 	async getRawFormData() {
 		try {
-			const [fields, layout] = await Promise.all([this.client.app.getFormFields({ app: this.appId }), this.client.app.getFormLayout({ app: this.appId })]);
+			const [fields, layout] = await Promise.all([this.client.app.getFormFields({
+				app: this.appId,
+				preview: true
+			}), this.client.app.getFormLayout({
+				app: this.appId,
+				preview: true
+			})]);
 			return {
 				fields,
 				layout
 			};
 		} catch (error) {
-			if (isBusinessRuleError(error)) throw error;
-			if (error instanceof SystemError) throw error;
-			throw new SystemError(SystemErrorCode.ExternalApiError, "Failed to fetch raw form data for dump", error);
+			throw wrapKintoneError(error, "Failed to fetch raw form data for dump");
 		}
 	}
 };
@@ -9214,11 +9275,16 @@ var KintoneFormDumpReader = class {
 //#endregion
 //#region src/core/adapters/local/dumpStorage.ts
 var LocalFileDumpStorage = class {
-	constructor(filePrefix) {
+	constructor(filePrefix, baseDir = process.cwd()) {
 		this.filePrefix = filePrefix;
+		this.baseDir = baseDir;
+		const fieldsPath = resolve(this.baseDir, `${this.filePrefix}fields.json`);
+		if (!isSafePath(fieldsPath, this.baseDir)) throw new ValidationError(ValidationErrorCode.InvalidInput, `Path traversal detected: "${fieldsPath}" escapes base directory "${this.baseDir}"`);
+		const layoutPath = resolve(this.baseDir, `${this.filePrefix}layout.json`);
+		if (!isSafePath(layoutPath, this.baseDir)) throw new ValidationError(ValidationErrorCode.InvalidInput, `Path traversal detected: "${layoutPath}" escapes base directory "${this.baseDir}"`);
 	}
 	async saveFields(content) {
-		const filePath = `${this.filePrefix}fields.json`;
+		const filePath = resolve(this.baseDir, `${this.filePrefix}fields.json`);
 		try {
 			await mkdir(dirname(filePath), { recursive: true });
 			await writeFile(filePath, content, "utf-8");
@@ -9227,7 +9293,7 @@ var LocalFileDumpStorage = class {
 		}
 	}
 	async saveLayout(content) {
-		const filePath = `${this.filePrefix}layout.json`;
+		const filePath = resolve(this.baseDir, `${this.filePrefix}layout.json`);
 		try {
 			await mkdir(dirname(filePath), { recursive: true });
 			await writeFile(filePath, content, "utf-8");
@@ -9241,12 +9307,8 @@ var LocalFileDumpStorage = class {
 //#region src/core/application/container/dumpCli.ts
 function createDumpCliContainer(config) {
 	return {
-		formDumpReader: new KintoneFormDumpReader(new KintoneRestAPIClient({
-			baseUrl: config.baseUrl,
-			auth: buildKintoneAuth(config.auth),
-			guestSpaceId: config.guestSpaceId
-		}), config.appId),
-		dumpStorage: new LocalFileDumpStorage(config.filePrefix)
+		formDumpReader: new KintoneFormDumpReader(config.client ?? createKintoneClient(config), config.appId),
+		dumpStorage: new LocalFileDumpStorage(config.filePrefix, process.cwd())
 	};
 }
 
@@ -9317,6 +9379,22 @@ var dump_default = define({
 	}
 });
 
+//#endregion
+//#region src/core/domain/formSchema/services/subtableFieldSplitter.ts
+function splitSubtableInnerFields(desired, current) {
+	const newInnerFields = /* @__PURE__ */ new Map();
+	const existingInnerFields = /* @__PURE__ */ new Map();
+	const deletedInnerFieldCodes = [];
+	for (const [code, def] of desired.properties.fields) if (current.properties.fields.has(code)) existingInnerFields.set(code, def);
+	else newInnerFields.set(code, def);
+	for (const code of current.properties.fields.keys()) if (!desired.properties.fields.has(code)) deletedInnerFieldCodes.push(code);
+	return {
+		newInnerFields,
+		existingInnerFields,
+		deletedInnerFieldCodes
+	};
+}
+
 //#endregion
 //#region src/core/domain/formSchema/services/schemaValidator.ts
 const SELECTION_TYPES = new Set([
@@ -9420,6 +9498,11 @@ function validateReferenceTableRelatedApp(field) {
 	if (app.trim().length === 0) return [issue("error", field.code, field.type, "EMPTY_RELATED_APP", `Field "${field.code}" referenceTable.relatedApp.app must be non-empty`)];
 	return [];
 }
+function validateSubtableHasInnerFields(field) {
+	if (field.type !== "SUBTABLE") return [];
+	if (field.properties.fields.size === 0) return [issue("error", field.code, field.type, "EMPTY_SUBTABLE", `Subtable "${field.code}" must have at least one inner field`)];
+	return [];
+}
 const FIELD_VALIDATORS = [
 	validateLabelNonEmpty,
 	validateSelectionOptions,
@@ -9429,7 +9512,8 @@ const FIELD_VALIDATORS = [
 	validateFileThumbnailSize,
 	validateReferenceTableSize,
 	validateLookupStructure,
-	validateReferenceTableRelatedApp
+	validateReferenceTableRelatedApp,
+	validateSubtableHasInnerFields
 ];
 function validateField(field) {
 	return FIELD_VALIDATORS.flatMap((validator) => validator(field));
@@ -9478,6 +9562,7 @@ async function executeMigration({ container }) {
 	const deleted = diff.entries.filter((e) => e.type === "deleted");
 	const fieldsToAdd = [];
 	const fieldsToUpdate = [];
+	const innerFieldsToDelete = [];
 	for (const entry of added) {
 		if (entry.after === void 0) continue;
 		if (subtableInnerCodes.has(entry.fieldCode)) continue;
@@ -9489,25 +9574,21 @@ async function executeMigration({ container }) {
 		const after = entry.after;
 		const before = entry.before;
 		if (after.type === "SUBTABLE" && before !== void 0 && before.type === "SUBTABLE") {
-			const newInnerFields = /* @__PURE__ */ new Map();
-			const existingInnerFields = /* @__PURE__ */ new Map();
-			for (const [code, def] of after.properties.fields) if (before.properties.fields.has(code)) existingInnerFields.set(code, def);
-			else newInnerFields.set(code, def);
-			if (newInnerFields.size > 0) fieldsToAdd.push({
-				...after,
-				properties: { fields: newInnerFields }
-			});
+			const { newInnerFields, existingInnerFields, deletedInnerFieldCodes } = splitSubtableInnerFields(after, before);
+			if (newInnerFields.size > 0) throw new ValidationError(ValidationErrorCode.InvalidInput, `kintone REST API does not support adding fields to an existing subtable. Use the schema override command instead. Subtable: ${after.code}`);
 			if (existingInnerFields.size > 0) fieldsToUpdate.push({
 				...after,
 				properties: { fields: existingInnerFields }
 			});
-		} else fieldsToUpdate.push(after);
+			for (const code of deletedInnerFieldCodes) innerFieldsToDelete.push(code);
+		} else if (before !== void 0 && before.type !== after.type) throw new ValidationError(ValidationErrorCode.InvalidInput, `Field type change detected for "${after.code}" (${before.type} → ${after.type}). Use the schema override command instead.`);
+		else fieldsToUpdate.push(after);
 	}
 	if (fieldsToAdd.length > 0) await container.formConfigurator.addFields(fieldsToAdd);
 	if (fieldsToUpdate.length > 0) await container.formConfigurator.updateFields(fieldsToUpdate);
-	if (deleted.length > 0) {
+	if (deleted.length > 0 || innerFieldsToDelete.length > 0) {
 		const currentSubtableInnerCodes = collectSubtableInnerFieldCodes(currentFields);
-		const fieldCodes = deleted.filter((e) => !currentSubtableInnerCodes.has(e.fieldCode)).map((e) => e.fieldCode);
+		const fieldCodes = [...deleted.filter((e) => !currentSubtableInnerCodes.has(e.fieldCode)).map((e) => e.fieldCode), ...innerFieldsToDelete];
 		if (fieldCodes.length > 0) await container.formConfigurator.deleteFields(fieldCodes);
 	}
 	if (hasLayoutChanges) await container.formConfigurator.updateLayout(schema.layout);
@@ -9622,25 +9703,35 @@ async function forceOverrideForm({ container }) {
 	const toAdd = [];
 	const toUpdate = [];
 	const toDelete = [];
+	const innerFieldsToDelete = [];
 	for (const [fieldCode, schemaDef] of schema.fields) {
 		if (subtableInnerCodes.has(fieldCode)) continue;
 		if (currentFields.has(fieldCode)) if (schemaDef.type === "SUBTABLE") {
 			const currentDef = currentFields.get(fieldCode);
 			if (currentDef !== void 0 && currentDef.type === "SUBTABLE") {
-				const newInnerFields = /* @__PURE__ */ new Map();
-				const existingInnerFields = /* @__PURE__ */ new Map();
-				for (const [code, def] of schemaDef.properties.fields) if (currentDef.properties.fields.has(code)) existingInnerFields.set(code, def);
-				else newInnerFields.set(code, def);
-				if (newInnerFields.size > 0) toAdd.push({
-					...schemaDef,
-					properties: { fields: newInnerFields }
-				});
-				if (existingInnerFields.size > 0) toUpdate.push({
-					...schemaDef,
-					properties: { fields: existingInnerFields }
-				});
+				const { newInnerFields, existingInnerFields, deletedInnerFieldCodes } = splitSubtableInnerFields(schemaDef, currentDef);
+				const allInnerFieldsRemoved = existingInnerFields.size === 0 && deletedInnerFieldCodes.length > 0;
+				if (newInnerFields.size > 0 || allInnerFieldsRemoved) {
+					toDelete.push(fieldCode);
+					toAdd.push(schemaDef);
+				} else {
+					toUpdate.push({
+						...schemaDef,
+						properties: { fields: existingInnerFields }
+					});
+					for (const code of deletedInnerFieldCodes) innerFieldsToDelete.push(code);
+				}
+			} else {
+				toDelete.push(fieldCode);
+				toAdd.push(schemaDef);
+			}
+		} else {
+			const currentDef = currentFields.get(fieldCode);
+			if (currentDef !== void 0 && currentDef.type !== schemaDef.type) {
+				toDelete.push(fieldCode);
+				toAdd.push(schemaDef);
 			} else toUpdate.push(schemaDef);
-		} else toUpdate.push(schemaDef);
+		}
 		else toAdd.push(schemaDef);
 	}
 	const currentSubtableInnerCodes = collectSubtableInnerFieldCodes(currentFields);
@@ -9648,9 +9739,9 @@ async function forceOverrideForm({ container }) {
 		if (currentSubtableInnerCodes.has(fieldCode)) continue;
 		if (!schema.fields.has(fieldCode)) toDelete.push(fieldCode);
 	}
+	if (toDelete.length > 0 || innerFieldsToDelete.length > 0) await container.formConfigurator.deleteFields([...toDelete, ...innerFieldsToDelete]);
 	if (toAdd.length > 0) await container.formConfigurator.addFields(toAdd);
 	if (toUpdate.length > 0) await container.formConfigurator.updateFields(toUpdate);
-	if (toDelete.length > 0) await container.formConfigurator.deleteFields(toDelete);
 	await container.formConfigurator.updateLayout(schema.layout);
 }
 
@@ -9797,9 +9888,9 @@ async function validateSchema({ container }) {
 	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "Schema file not found");
 	let schema;
 	try {
-		schema = SchemaParser.parse(result.content);
+		schema = parseSchemaText(result.content);
 	} catch (error) {
-		if (isBusinessRuleError(error)) return {
+		if (isValidationError(error)) return {
 			parseError: error.message,
 			fieldCount: 0
 		};
@@ -9908,6 +9999,50 @@ var schema_default = define({
 	run: () => {}
 });
 
+//#endregion
+//#region src/core/domain/seedData/services/upsertPlanner.ts
+function recordsEqual(seed, existing, keyField) {
+	const seedKeys = Object.keys(seed).filter((k) => k !== keyField);
+	for (const key of seedKeys) {
+		const seedValue = seed[key];
+		const existingValue = existing[key];
+		if (seedValue === void 0 && existingValue === void 0) continue;
+		if (seedValue === void 0 || existingValue === void 0) return false;
+		if (!deepEqual(seedValue, existingValue)) return false;
+	}
+	return true;
+}
+const UpsertPlanner = { plan: (key, seedRecords, existingRecords) => {
+	const keyField = key;
+	const existingMap = /* @__PURE__ */ new Map();
+	for (const { id, record } of existingRecords) {
+		const keyValue = record[keyField];
+		if (typeof keyValue === "string") existingMap.set(keyValue, {
+			id,
+			record
+		});
+	}
+	const toAdd = [];
+	const toUpdate = [];
+	let unchanged = 0;
+	for (const seedRecord of seedRecords) {
+		const keyValue = seedRecord[keyField];
+		if (typeof keyValue !== "string") throw new BusinessRuleError(SeedDataErrorCode.SdInvalidKeyFieldValue, `Key field "${keyField}" value must be a string, got ${typeof keyValue}`);
+		const existing = existingMap.get(keyValue);
+		if (existing === void 0) toAdd.push(seedRecord);
+		else if (recordsEqual(seedRecord, existing.record, keyField)) unchanged++;
+		else toUpdate.push({
+			id: existing.id,
+			record: seedRecord
+		});
+	}
+	return {
+		toAdd,
+		toUpdate,
+		unchanged
+	};
+} };
+
 //#endregion
 //#region src/core/domain/seedData/services/seedParser.ts
 function normalizeValue(value) {
@@ -9969,55 +10104,17 @@ const SeedParser = { parse: (rawText) => {
 } };
 
 //#endregion
-//#region src/core/domain/seedData/services/upsertPlanner.ts
-function recordsEqual(seed, existing, keyField) {
-	const seedKeys = Object.keys(seed).filter((k) => k !== keyField);
-	for (const key of seedKeys) {
-		const seedValue = seed[key];
-		const existingValue = existing[key];
-		if (seedValue === void 0 && existingValue === void 0) continue;
-		if (seedValue === void 0 || existingValue === void 0) return false;
-		if (!deepEqual(seedValue, existingValue)) return false;
-	}
-	return true;
+//#region src/core/application/seedData/parseConfig.ts
+function parseSeedText(rawText) {
+	return wrapBusinessRuleError(() => SeedParser.parse(rawText));
 }
-const UpsertPlanner = { plan: (key, seedRecords, existingRecords) => {
-	const keyField = key;
-	const existingMap = /* @__PURE__ */ new Map();
-	for (const { id, record } of existingRecords) {
-		const keyValue = record[keyField];
-		if (typeof keyValue === "string") existingMap.set(keyValue, {
-			id,
-			record
-		});
-	}
-	const toAdd = [];
-	const toUpdate = [];
-	let unchanged = 0;
-	for (const seedRecord of seedRecords) {
-		const keyValue = seedRecord[keyField];
-		if (typeof keyValue !== "string") throw new BusinessRuleError(SeedDataErrorCode.SdInvalidKeyFieldValue, `Key field "${keyField}" value must be a string, got ${typeof keyValue}`);
-		const existing = existingMap.get(keyValue);
-		if (existing === void 0) toAdd.push(seedRecord);
-		else if (recordsEqual(seedRecord, existing.record, keyField)) unchanged++;
-		else toUpdate.push({
-			id: existing.id,
-			record: seedRecord
-		});
-	}
-	return {
-		toAdd,
-		toUpdate,
-		unchanged
-	};
-} };
 
 //#endregion
 //#region src/core/application/seedData/upsertSeed.ts
 async function upsertSeed({ container, input }) {
 	const result = await container.seedStorage.get();
 	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "Seed file not found");
-	const seedData = SeedParser.parse(result.content);
+	const seedData = parseSeedText(result.content);
 	if (input.clean) {
 		const { deletedCount } = await container.recordManager.deleteAllRecords();
 		if (seedData.records.length > 0) await container.recordManager.addRecords(seedData.records);
@@ -10341,13 +10438,17 @@ function parseGeneralSettingsConfigText(rawText) {
 //#endregion
 //#region src/core/application/generalSettings/applyGeneralSettings.ts
 async function applyGeneralSettings({ container }) {
-	const result = await container.generalSettingsStorage.get();
-	if (!result.exists) throw new ValidationError(ValidationErrorCode.InvalidInput, "General settings config file not found");
-	const config = parseGeneralSettingsConfigText(result.content);
-	const current = await container.generalSettingsConfigurator.getGeneralSettings();
-	await container.generalSettingsConfigurator.updateGeneralSettings({
-		config,
-		revision: current.revision
+	await applyFromConfig({
+		getStorage: () => container.generalSettingsStorage.get(),
+		parseConfig: parseGeneralSettingsConfigText,
+		fetchRemote: () => container.generalSettingsConfigurator.getGeneralSettings(),
+		update: async (config, current) => {
+			await container.generalSettingsConfigurator.updateGeneralSettings({
+				config,
+				revision: current.revision
+			});
+		},
+		notFoundMessage: "General settings config file not found"
 	});
 }