qfai 0.2.5

package/dist/cli/index.mjs

@@ -0,0 +1,1980 @@
+#!/usr/bin/env node
+
+// src/cli/commands/init.ts
+import path3 from "path";
+
+// src/cli/lib/fs.ts
+import { access, copyFile, mkdir, readdir } from "fs/promises";
+import path from "path";
+async function copyTemplateTree(sourceRoot, destRoot, options) {
+  const files = await collectTemplateFiles(sourceRoot);
+  return copyFiles(files, sourceRoot, destRoot, options);
+}
+async function copyFiles(files, sourceRoot, destRoot, options) {
+  const copied = [];
+  const skipped = [];
+  const conflicts = [];
+  if (!options.force) {
+    for (const file of files) {
+      const relative = path.relative(sourceRoot, file);
+      const dest = path.join(destRoot, relative);
+      if (!await shouldWrite(dest, options.force)) {
+        conflicts.push(dest);
+      }
+    }
+    if (conflicts.length > 0) {
+      throw new Error(formatConflictMessage(conflicts));
+    }
+  }
+  for (const file of files) {
+    const relative = path.relative(sourceRoot, file);
+    const dest = path.join(destRoot, relative);
+    if (!await shouldWrite(dest, options.force)) {
+      skipped.push(dest);
+      continue;
+    }
+    if (!options.dryRun) {
+      await mkdir(path.dirname(dest), { recursive: true });
+      await copyFile(file, dest);
+    }
+    copied.push(dest);
+  }
+  return { copied, skipped };
+}
+function formatConflictMessage(conflicts) {
+  return [
+    "\u65E2\u5B58\u30D5\u30A1\u30A4\u30EB\u3068\u885D\u7A81\u3057\u307E\u3057\u305F\u3002\u5B89\u5168\u306E\u305F\u3081\u505C\u6B62\u3057\u307E\u3059\u3002",
+    "",
+    "\u885D\u7A81\u30D5\u30A1\u30A4\u30EB:",
+    ...conflicts.map((conflict) => `- ${conflict}`),
+    "",
+    "\u4E0A\u66F8\u304D\u3057\u3066\u7D9A\u884C\u3059\u308B\u5834\u5408\u306F --force \u3092\u4ED8\u3051\u3066\u518D\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+  ].join("\n");
+}
+async function collectTemplateFiles(root) {
+  const entries = [];
+  if (!await exists(root)) {
+    return entries;
+  }
+  const items = await readdir(root, { withFileTypes: true });
+  for (const item of items) {
+    const fullPath = path.join(root, item.name);
+    if (item.isDirectory()) {
+      const nested = await collectTemplateFiles(fullPath);
+      entries.push(...nested);
+      continue;
+    }
+    if (item.isFile()) {
+      entries.push(fullPath);
+    }
+  }
+  return entries;
+}
+async function shouldWrite(target, force) {
+  if (force) {
+    return true;
+  }
+  return !await exists(target);
+}
+async function exists(target) {
+  try {
+    await access(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/cli/lib/assets.ts
+import path2 from "path";
+import { fileURLToPath } from "url";
+function getInitAssetsDir() {
+  const base = import.meta.url;
+  const basePath = base.startsWith("file:") ? fileURLToPath(base) : base;
+  return path2.resolve(path2.dirname(basePath), "../../assets/init");
+}
+
+// src/cli/lib/logger.ts
+function info(message) {
+  process.stdout.write(`${message}
+`);
+}
+function error(message) {
+  process.stderr.write(`${message}
+`);
+}
+
+// src/cli/commands/init.ts
+async function runInit(options) {
+  const assetsRoot = getInitAssetsDir();
+  const rootAssets = path3.join(assetsRoot, "root");
+  const qfaiAssets = path3.join(assetsRoot, "qfai");
+  const destRoot = path3.resolve(options.dir);
+  const destQfai = path3.join(destRoot, "qfai");
+  const rootResult = await copyTemplateTree(rootAssets, destRoot, {
+    force: options.force,
+    dryRun: options.dryRun
+  });
+  const qfaiResult = await copyTemplateTree(qfaiAssets, destQfai, {
+    force: options.force,
+    dryRun: options.dryRun
+  });
+  report(
+    [...rootResult.copied, ...qfaiResult.copied],
+    [...rootResult.skipped, ...qfaiResult.skipped],
+    options.dryRun,
+    "init"
+  );
+}
+function report(copied, skipped, dryRun, label) {
+  info(`qfai ${label}: ${dryRun ? "dry-run" : "done"}`);
+  if (copied.length > 0) {
+    info(`  created: ${copied.length}`);
+  }
+  if (skipped.length > 0) {
+    info(`  skipped: ${skipped.length}`);
+  }
+}
+
+// src/cli/commands/report.ts
+import { mkdir as mkdir2, readFile as readFile8, writeFile } from "fs/promises";
+import path9 from "path";
+
+// src/core/config.ts
+import { readFile } from "fs/promises";
+import path4 from "path";
+import { parse as parseYaml } from "yaml";
+var defaultConfig = {
+  paths: {
+    specDir: "qfai/spec",
+    decisionsDir: "qfai/spec/decisions",
+    scenariosDir: "qfai/spec",
+    rulesDir: "qfai/rules",
+    contractsDir: "qfai/contracts",
+    uiContractsDir: "qfai/contracts/ui",
+    apiContractsDir: "qfai/contracts/api",
+    dataContractsDir: "qfai/contracts/db",
+    srcDir: "src",
+    testsDir: "tests"
+  },
+  validation: {
+    failOn: "error",
+    require: {
+      specSections: [
+        "\u80CC\u666F",
+        "\u30B9\u30B3\u30FC\u30D7",
+        "\u975E\u30B4\u30FC\u30EB",
+        "\u7528\u8A9E",
+        "\u524D\u63D0",
+        "\u6C7A\u5B9A\u4E8B\u9805",
+        "\u696D\u52D9\u30EB\u30FC\u30EB"
+      ]
+    },
+    traceability: {
+      brMustHaveSc: true,
+      scMustTouchContracts: true,
+      allowOrphanContracts: false
+    }
+  },
+  output: {
+    format: "text",
+    jsonPath: ".qfai/out/validate.json"
+  }
+};
+function getConfigPath(root) {
+  return path4.join(root, "qfai.config.yaml");
+}
+async function loadConfig(root) {
+  const configPath = getConfigPath(root);
+  const issues = [];
+  let parsed;
+  try {
+    const raw = await readFile(configPath, "utf-8");
+    parsed = parseYaml(raw);
+  } catch (error2) {
+    if (isMissingFile(error2)) {
+      return { config: defaultConfig, issues, configPath };
+    }
+    issues.push(configIssue(configPath, formatError(error2)));
+    return { config: defaultConfig, issues, configPath };
+  }
+  const normalized = normalizeConfig(parsed, configPath, issues);
+  return { config: normalized, issues, configPath };
+}
+function resolvePath(root, config, key) {
+  return path4.resolve(root, config.paths[key]);
+}
+function normalizeConfig(raw, configPath, issues) {
+  if (!isRecord(raw)) {
+    issues.push(configIssue(configPath, "\u8A2D\u5B9A\u30D5\u30A1\u30A4\u30EB\u306E\u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059\u3002"));
+    return defaultConfig;
+  }
+  return {
+    paths: normalizePaths(raw.paths, configPath, issues),
+    validation: normalizeValidation(raw.validation, configPath, issues),
+    output: normalizeOutput(raw.output, configPath, issues)
+  };
+}
+function normalizePaths(raw, configPath, issues) {
+  const base = defaultConfig.paths;
+  if (!raw) {
+    return base;
+  }
+  if (!isRecord(raw)) {
+    issues.push(
+      configIssue(configPath, "paths \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+    );
+    return base;
+  }
+  return {
+    specDir: readString(
+      raw.specDir,
+      base.specDir,
+      "paths.specDir",
+      configPath,
+      issues
+    ),
+    decisionsDir: readString(
+      raw.decisionsDir,
+      base.decisionsDir,
+      "paths.decisionsDir",
+      configPath,
+      issues
+    ),
+    scenariosDir: readString(
+      raw.scenariosDir,
+      base.scenariosDir,
+      "paths.scenariosDir",
+      configPath,
+      issues
+    ),
+    rulesDir: readString(
+      raw.rulesDir,
+      base.rulesDir,
+      "paths.rulesDir",
+      configPath,
+      issues
+    ),
+    contractsDir: readString(
+      raw.contractsDir,
+      base.contractsDir,
+      "paths.contractsDir",
+      configPath,
+      issues
+    ),
+    uiContractsDir: readString(
+      raw.uiContractsDir,
+      base.uiContractsDir,
+      "paths.uiContractsDir",
+      configPath,
+      issues
+    ),
+    apiContractsDir: readString(
+      raw.apiContractsDir,
+      base.apiContractsDir,
+      "paths.apiContractsDir",
+      configPath,
+      issues
+    ),
+    dataContractsDir: readString(
+      raw.dataContractsDir,
+      base.dataContractsDir,
+      "paths.dataContractsDir",
+      configPath,
+      issues
+    ),
+    srcDir: readString(
+      raw.srcDir,
+      base.srcDir,
+      "paths.srcDir",
+      configPath,
+      issues
+    ),
+    testsDir: readString(
+      raw.testsDir,
+      base.testsDir,
+      "paths.testsDir",
+      configPath,
+      issues
+    )
+  };
+}
+function normalizeValidation(raw, configPath, issues) {
+  const base = defaultConfig.validation;
+  if (!raw) {
+    return base;
+  }
+  if (!isRecord(raw)) {
+    issues.push(
+      configIssue(
+        configPath,
+        "validation \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002"
+      )
+    );
+    return base;
+  }
+  let requireRaw;
+  if (raw.require === void 0) {
+    requireRaw = void 0;
+  } else if (isRecord(raw.require)) {
+    requireRaw = raw.require;
+  } else {
+    issues.push(
+      configIssue(
+        configPath,
+        "validation.require \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002"
+      )
+    );
+    requireRaw = void 0;
+  }
+  let traceabilityRaw;
+  if (raw.traceability === void 0) {
+    traceabilityRaw = void 0;
+  } else if (isRecord(raw.traceability)) {
+    traceabilityRaw = raw.traceability;
+  } else {
+    issues.push(
+      configIssue(
+        configPath,
+        "validation.traceability \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002"
+      )
+    );
+    traceabilityRaw = void 0;
+  }
+  return {
+    failOn: readFailOn(
+      raw.failOn,
+      base.failOn,
+      "validation.failOn",
+      configPath,
+      issues
+    ),
+    require: {
+      specSections: readStringArray(
+        requireRaw?.specSections,
+        base.require.specSections,
+        "validation.require.specSections",
+        configPath,
+        issues
+      )
+    },
+    traceability: {
+      brMustHaveSc: readBoolean(
+        traceabilityRaw?.brMustHaveSc,
+        base.traceability.brMustHaveSc,
+        "validation.traceability.brMustHaveSc",
+        configPath,
+        issues
+      ),
+      scMustTouchContracts: readBoolean(
+        traceabilityRaw?.scMustTouchContracts,
+        base.traceability.scMustTouchContracts,
+        "validation.traceability.scMustTouchContracts",
+        configPath,
+        issues
+      ),
+      allowOrphanContracts: readBoolean(
+        traceabilityRaw?.allowOrphanContracts,
+        base.traceability.allowOrphanContracts,
+        "validation.traceability.allowOrphanContracts",
+        configPath,
+        issues
+      )
+    }
+  };
+}
+function normalizeOutput(raw, configPath, issues) {
+  const base = defaultConfig.output;
+  if (!raw) {
+    return base;
+  }
+  if (!isRecord(raw)) {
+    issues.push(
+      configIssue(configPath, "output \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002")
+    );
+    return base;
+  }
+  return {
+    format: readOutputFormat(
+      raw.format,
+      base.format,
+      "output.format",
+      configPath,
+      issues
+    ),
+    jsonPath: readString(
+      raw.jsonPath,
+      base.jsonPath,
+      "output.jsonPath",
+      configPath,
+      issues
+    )
+  };
+}
+function readString(value, fallback, label, configPath, issues) {
+  if (typeof value === "string" && value.trim().length > 0) {
+    return value;
+  }
+  if (value !== void 0) {
+    issues.push(
+      configIssue(configPath, `${label} \u306F\u6587\u5B57\u5217\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`)
+    );
+  }
+  return fallback;
+}
+function readStringArray(value, fallback, label, configPath, issues) {
+  if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+    return value;
+  }
+  if (value !== void 0) {
+    issues.push(
+      configIssue(configPath, `${label} \u306F\u6587\u5B57\u5217\u914D\u5217\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`)
+    );
+  }
+  return fallback;
+}
+function readBoolean(value, fallback, label, configPath, issues) {
+  if (typeof value === "boolean") {
+    return value;
+  }
+  if (value !== void 0) {
+    issues.push(
+      configIssue(configPath, `${label} \u306F\u771F\u507D\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`)
+    );
+  }
+  return fallback;
+}
+function readFailOn(value, fallback, label, configPath, issues) {
+  if (value === "never" || value === "warning" || value === "error") {
+    return value;
+  }
+  if (value !== void 0) {
+    issues.push(
+      configIssue(
+        configPath,
+        `${label} \u306F never|warning|error \u306E\u3044\u305A\u308C\u304B\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`
+      )
+    );
+  }
+  return fallback;
+}
+function readOutputFormat(value, fallback, label, configPath, issues) {
+  if (value === "text" || value === "json" || value === "github") {
+    return value;
+  }
+  if (value !== void 0) {
+    issues.push(
+      configIssue(
+        configPath,
+        `${label} \u306F text|json|github \u306E\u3044\u305A\u308C\u304B\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`
+      )
+    );
+  }
+  return fallback;
+}
+function configIssue(file, message) {
+  return {
+    code: "QFAI_CONFIG_INVALID",
+    severity: "error",
+    message,
+    file,
+    rule: "config.invalid"
+  };
+}
+function isMissingFile(error2) {
+  if (error2 && typeof error2 === "object" && "code" in error2) {
+    return error2.code === "ENOENT";
+  }
+  return false;
+}
+function formatError(error2) {
+  if (error2 instanceof Error) {
+    return error2.message;
+  }
+  return String(error2);
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/core/report.ts
+import { readFile as readFile7 } from "fs/promises";
+
+// src/core/discovery.ts
+import path6 from "path";
+
+// src/core/fs.ts
+import { access as access2, readdir as readdir2 } from "fs/promises";
+import path5 from "path";
+var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  ".pnpm",
+  "tmp",
+  ".mcp-tools"
+]);
+async function collectFiles(root, options = {}) {
+  const entries = [];
+  if (!await exists2(root)) {
+    return entries;
+  }
+  const ignoreDirs = /* @__PURE__ */ new Set([
+    ...DEFAULT_IGNORE_DIRS,
+    ...options.ignoreDirs ?? []
+  ]);
+  const extensions = options.extensions?.map((ext) => ext.toLowerCase()) ?? [];
+  await walk(root, root, ignoreDirs, extensions, entries);
+  return entries;
+}
+async function walk(base, current, ignoreDirs, extensions, out) {
+  const items = await readdir2(current, { withFileTypes: true });
+  for (const item of items) {
+    const fullPath = path5.join(current, item.name);
+    if (item.isDirectory()) {
+      if (ignoreDirs.has(item.name)) {
+        continue;
+      }
+      await walk(base, fullPath, ignoreDirs, extensions, out);
+      continue;
+    }
+    if (item.isFile()) {
+      if (extensions.length > 0) {
+        const ext = path5.extname(item.name).toLowerCase();
+        if (!extensions.includes(ext)) {
+          continue;
+        }
+      }
+      out.push(fullPath);
+    }
+  }
+}
+async function exists2(target) {
+  try {
+    await access2(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/core/discovery.ts
+var LEGACY_SPEC_NAME = "spec.md";
+var SPEC_NAMED_PATTERN = /^spec-\d{4}-[^/\\]+\.md$/i;
+async function collectSpecFiles(specRoot) {
+  const files = await collectFiles(specRoot, { extensions: [".md"] });
+  return files.filter((file) => isSpecFile(file));
+}
+async function collectUiContractFiles(uiRoot) {
+  return collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+}
+async function collectApiContractFiles(apiRoot) {
+  return collectFiles(apiRoot, { extensions: [".yaml", ".yml", ".json"] });
+}
+async function collectDataContractFiles(dataRoot) {
+  return collectFiles(dataRoot, { extensions: [".sql"] });
+}
+async function collectContractFiles(uiRoot, apiRoot, dataRoot) {
+  const [ui, api, db] = await Promise.all([
+    collectUiContractFiles(uiRoot),
+    collectApiContractFiles(apiRoot),
+    collectDataContractFiles(dataRoot)
+  ]);
+  return { ui, api, db };
+}
+function isSpecFile(filePath) {
+  const name = path6.basename(filePath).toLowerCase();
+  return name === LEGACY_SPEC_NAME || SPEC_NAMED_PATTERN.test(name);
+}
+
+// src/core/ids.ts
+var ID_PATTERNS = {
+  SPEC: /\bSPEC-[A-Z0-9-]+\b/g,
+  BR: /\bBR-[A-Z0-9-]+\b/g,
+  SC: /\bSC-[A-Z0-9-]+\b/g,
+  UI: /\bUI-[A-Z0-9-]+\b/g,
+  API: /\bAPI-[A-Z0-9-]+\b/g,
+  DATA: /\bDATA-[A-Z0-9-]+\b/g
+};
+var LOOSE_ID_PATTERNS = {
+  SPEC: /\bSPEC-[A-Za-z0-9_-]+\b/gi,
+  BR: /\bBR-[A-Za-z0-9_-]+\b/gi,
+  SC: /\bSC-[A-Za-z0-9_-]+\b/gi,
+  UI: /\bUI-[A-Za-z0-9_-]+\b/gi,
+  API: /\bAPI-[A-Za-z0-9_-]+\b/gi,
+  DATA: /\bDATA-[A-Za-z0-9_-]+\b/gi
+};
+function extractIds(text, prefix) {
+  const pattern = ID_PATTERNS[prefix];
+  const matches = text.match(pattern);
+  return unique(matches ?? []);
+}
+function extractAllIds(text) {
+  const all = [];
+  Object.keys(ID_PATTERNS).forEach((prefix) => {
+    all.push(...extractIds(text, prefix));
+  });
+  return unique(all);
+}
+function extractInvalidIds(text, prefixes) {
+  const invalid = [];
+  for (const prefix of prefixes) {
+    const candidates = text.match(LOOSE_ID_PATTERNS[prefix]) ?? [];
+    for (const candidate of candidates) {
+      if (!isValidId(candidate, prefix)) {
+        invalid.push(candidate);
+      }
+    }
+  }
+  return unique(invalid);
+}
+function unique(values) {
+  return Array.from(new Set(values));
+}
+function isValidId(value, prefix) {
+  const pattern = ID_PATTERNS[prefix];
+  const strict = new RegExp(pattern.source);
+  return strict.test(value);
+}
+
+// src/core/types.ts
+var VALIDATION_SCHEMA_VERSION = "0.2";
+
+// src/core/version.ts
+import { readFile as readFile2 } from "fs/promises";
+import path7 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+async function resolveToolVersion() {
+  if ("0.2.5".length > 0) {
+    return "0.2.5";
+  }
+  try {
+    const packagePath = resolvePackageJsonPath();
+    const raw = await readFile2(packagePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const version = typeof parsed.version === "string" ? parsed.version : "";
+    return version.length > 0 ? version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function resolvePackageJsonPath() {
+  const base = import.meta.url;
+  const basePath = base.startsWith("file:") ? fileURLToPath2(base) : base;
+  return path7.resolve(path7.dirname(basePath), "../../package.json");
+}
+
+// src/core/validators/contracts.ts
+import { readFile as readFile3 } from "fs/promises";
+import path8 from "path";
+import { parse as parseYaml2 } from "yaml";
+var SQL_DANGEROUS_PATTERNS = [
+  { pattern: /\bDROP\s+TABLE\b/i, label: "DROP TABLE" },
+  { pattern: /\bDROP\s+DATABASE\b/i, label: "DROP DATABASE" },
+  { pattern: /\bTRUNCATE\b/i, label: "TRUNCATE" },
+  {
+    pattern: /\bALTER\s+TABLE\b[\s\S]*\bDROP\b/i,
+    label: "ALTER TABLE ... DROP"
+  }
+];
+async function validateContracts(root, config) {
+  const issues = [];
+  issues.push(
+    ...await validateUiContracts(resolvePath(root, config, "uiContractsDir"))
+  );
+  issues.push(
+    ...await validateApiContracts(
+      resolvePath(root, config, "apiContractsDir")
+    )
+  );
+  issues.push(
+    ...await validateDataContracts(
+      resolvePath(root, config, "dataContractsDir")
+    )
+  );
+  return issues;
+}
+async function validateUiContracts(uiRoot) {
+  const files = await collectUiContractFiles(uiRoot);
+  if (files.length === 0) {
+    return [
+      issue(
+        "QFAI-UI-000",
+        "UI \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "info",
+        uiRoot,
+        "contracts.ui.files"
+      )
+    ];
+  }
+  const issues = [];
+  for (const file of files) {
+    const text = await readFile3(file, "utf-8");
+    const invalidIds = extractInvalidIds(text, [
+      "SPEC",
+      "BR",
+      "SC",
+      "UI",
+      "API",
+      "DATA"
+    ]);
+    if (invalidIds.length > 0) {
+      issues.push(
+        issue(
+          "QFAI_ID_INVALID_FORMAT",
+          `ID \u30D5\u30A9\u30FC\u30DE\u30C3\u30C8\u304C\u4E0D\u6B63\u3067\u3059: ${invalidIds.join(", ")}`,
+          "error",
+          file,
+          "id.format",
+          invalidIds
+        )
+      );
+    }
+    try {
+      const doc = parseYaml2(text);
+      const id = typeof doc.id === "string" ? doc.id : "";
+      if (!id.startsWith("UI-")) {
+        issues.push(
+          issue(
+            "QFAI-UI-001",
+            "UI \u5951\u7D04\u306E id \u306F UI- \u3067\u59CB\u307E\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002",
+            "error",
+            file,
+            "contracts.ui.id"
+          )
+        );
+      }
+    } catch (error2) {
+      issues.push(
+        issue(
+          "QFAI-UI-002",
+          `UI YAML \u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${formatError2(error2)}`,
+          "error",
+          file,
+          "contracts.ui.parse"
+        )
+      );
+    }
+  }
+  return issues;
+}
+async function validateApiContracts(apiRoot) {
+  const files = await collectApiContractFiles(apiRoot);
+  if (files.length === 0) {
+    return [
+      issue(
+        "QFAI-API-000",
+        "API \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "info",
+        apiRoot,
+        "contracts.api.files"
+      )
+    ];
+  }
+  const issues = [];
+  for (const file of files) {
+    const text = await readFile3(file, "utf-8");
+    const invalidIds = extractInvalidIds(text, [
+      "SPEC",
+      "BR",
+      "SC",
+      "UI",
+      "API",
+      "DATA"
+    ]);
+    if (invalidIds.length > 0) {
+      issues.push(
+        issue(
+          "QFAI_ID_INVALID_FORMAT",
+          `ID \u30D5\u30A9\u30FC\u30DE\u30C3\u30C8\u304C\u4E0D\u6B63\u3067\u3059: ${invalidIds.join(", ")}`,
+          "error",
+          file,
+          "id.format",
+          invalidIds
+        )
+      );
+    }
+    try {
+      const doc = parseStructured(file, text);
+      if (!doc || !hasOpenApi(doc)) {
+        issues.push(
+          issue(
+            "QFAI-API-001",
+            "OpenAPI \u5B9A\u7FA9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+            "error",
+            file,
+            "contracts.api.openapi"
+          )
+        );
+      }
+    } catch (error2) {
+      issues.push(
+        issue(
+          "QFAI-API-002",
+          `API \u5B9A\u7FA9\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${formatError2(error2)}`,
+          "error",
+          file,
+          "contracts.api.parse"
+        )
+      );
+    }
+  }
+  return issues;
+}
+async function validateDataContracts(dataRoot) {
+  const files = await collectDataContractFiles(dataRoot);
+  if (files.length === 0) {
+    return [
+      issue(
+        "QFAI-DATA-000",
+        "DATA \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "info",
+        dataRoot,
+        "contracts.data.files"
+      )
+    ];
+  }
+  const issues = [];
+  for (const file of files) {
+    const text = await readFile3(file, "utf-8");
+    const invalidIds = extractInvalidIds(text, [
+      "SPEC",
+      "BR",
+      "SC",
+      "UI",
+      "API",
+      "DATA"
+    ]);
+    if (invalidIds.length > 0) {
+      issues.push(
+        issue(
+          "QFAI_ID_INVALID_FORMAT",
+          `ID \u30D5\u30A9\u30FC\u30DE\u30C3\u30C8\u304C\u4E0D\u6B63\u3067\u3059: ${invalidIds.join(", ")}`,
+          "error",
+          file,
+          "id.format",
+          invalidIds
+        )
+      );
+    }
+    issues.push(...lintSql(text, file));
+  }
+  return issues;
+}
+function lintSql(text, file) {
+  const issues = [];
+  for (const { pattern, label } of SQL_DANGEROUS_PATTERNS) {
+    if (pattern.test(text)) {
+      issues.push(
+        issue(
+          "QFAI-DATA-001",
+          `\u5371\u967A\u306A SQL \u64CD\u4F5C\u304C\u542B\u307E\u308C\u3066\u3044\u307E\u3059: ${label}`,
+          "warning",
+          file,
+          "contracts.data.sql"
+        )
+      );
+    }
+  }
+  return issues;
+}
+function parseStructured(file, text) {
+  const ext = path8.extname(file).toLowerCase();
+  if (ext === ".json") {
+    return JSON.parse(text);
+  }
+  return parseYaml2(text);
+}
+function hasOpenApi(doc) {
+  return typeof doc.openapi === "string" && doc.openapi.length > 0;
+}
+function formatError2(error2) {
+  if (error2 instanceof Error) {
+    return error2.message;
+  }
+  return String(error2);
+}
+function issue(code, message, severity, file, rule, refs) {
+  const issue5 = {
+    code,
+    severity,
+    message
+  };
+  if (file) {
+    issue5.file = file;
+  }
+  if (rule) {
+    issue5.rule = rule;
+  }
+  if (refs && refs.length > 0) {
+    issue5.refs = refs;
+  }
+  return issue5;
+}
+
+// src/core/validators/scenario.ts
+import { readFile as readFile4 } from "fs/promises";
+var GIVEN_PATTERN = /\bGiven\b/;
+var WHEN_PATTERN = /\bWhen\b/;
+var THEN_PATTERN = /\bThen\b/;
+async function validateScenarios(root, config) {
+  const scenariosRoot = resolvePath(root, config, "scenariosDir");
+  const files = await collectFiles(scenariosRoot, {
+    extensions: [".feature"]
+  });
+  if (files.length === 0) {
+    return [
+      issue2(
+        "QFAI-SC-000",
+        "Scenario \u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "info",
+        scenariosRoot,
+        "scenario.files"
+      )
+    ];
+  }
+  const issues = [];
+  for (const file of files) {
+    const text = await readFile4(file, "utf-8");
+    issues.push(...validateScenarioContent(text, file));
+  }
+  return issues;
+}
+function validateScenarioContent(text, file) {
+  const issues = [];
+  const invalidIds = extractInvalidIds(text, [
+    "SPEC",
+    "BR",
+    "SC",
+    "UI",
+    "API",
+    "DATA"
+  ]);
+  if (invalidIds.length > 0) {
+    issues.push(
+      issue2(
+        "QFAI_ID_INVALID_FORMAT",
+        `ID \u30D5\u30A9\u30FC\u30DE\u30C3\u30C8\u304C\u4E0D\u6B63\u3067\u3059: ${invalidIds.join(", ")}`,
+        "error",
+        file,
+        "id.format",
+        invalidIds
+      )
+    );
+  }
+  const scIds = extractIds(text, "SC");
+  if (scIds.length === 0) {
+    issues.push(
+      issue2(
+        "QFAI-SC-001",
+        "SC ID \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "error",
+        file,
+        "scenario.id"
+      )
+    );
+  }
+  const specIds = extractIds(text, "SPEC");
+  if (specIds.length === 0) {
+    issues.push(
+      issue2(
+        "QFAI-SC-002",
+        "SC \u306F SPEC \u3092\u53C2\u7167\u3059\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002",
+        "error",
+        file,
+        "scenario.spec"
+      )
+    );
+  }
+  const brIds = extractIds(text, "BR");
+  if (brIds.length === 0) {
+    issues.push(
+      issue2(
+        "QFAI-SC-003",
+        "SC \u306F BR \u3092\u53C2\u7167\u3059\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002",
+        "error",
+        file,
+        "scenario.br"
+      )
+    );
+  }
+  const missingSteps = [];
+  if (!GIVEN_PATTERN.test(text)) {
+    missingSteps.push("Given");
+  }
+  if (!WHEN_PATTERN.test(text)) {
+    missingSteps.push("When");
+  }
+  if (!THEN_PATTERN.test(text)) {
+    missingSteps.push("Then");
+  }
+  if (missingSteps.length > 0) {
+    issues.push(
+      issue2(
+        "QFAI-SC-005",
+        `Given/When/Then \u304C\u4E0D\u8DB3\u3057\u3066\u3044\u307E\u3059: ${missingSteps.join(", ")}`,
+        "warning",
+        file,
+        "scenario.steps"
+      )
+    );
+  }
+  return issues;
+}
+function issue2(code, message, severity, file, rule, refs) {
+  const issue5 = {
+    code,
+    severity,
+    message
+  };
+  if (file) {
+    issue5.file = file;
+  }
+  if (rule) {
+    issue5.rule = rule;
+  }
+  if (refs && refs.length > 0) {
+    issue5.refs = refs;
+  }
+  return issue5;
+}
+
+// src/core/validators/spec.ts
+import { readFile as readFile5 } from "fs/promises";
+async function validateSpecs(root, config) {
+  const specsRoot = resolvePath(root, config, "specDir");
+  const files = await collectSpecFiles(specsRoot);
+  if (files.length === 0) {
+    return [
+      issue3(
+        "QFAI-SPEC-000",
+        "Spec \u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "info",
+        specsRoot,
+        "spec.files"
+      )
+    ];
+  }
+  const issues = [];
+  for (const file of files) {
+    const text = await readFile5(file, "utf-8");
+    issues.push(
+      ...validateSpecContent(
+        text,
+        file,
+        config.validation.require.specSections
+      )
+    );
+  }
+  return issues;
+}
+function validateSpecContent(text, file, requiredSections) {
+  const issues = [];
+  const invalidIds = extractInvalidIds(text, [
+    "SPEC",
+    "BR",
+    "SC",
+    "UI",
+    "API",
+    "DATA"
+  ]);
+  if (invalidIds.length > 0) {
+    issues.push(
+      issue3(
+        "QFAI_ID_INVALID_FORMAT",
+        `ID \u30D5\u30A9\u30FC\u30DE\u30C3\u30C8\u304C\u4E0D\u6B63\u3067\u3059: ${invalidIds.join(", ")}`,
+        "error",
+        file,
+        "id.format",
+        invalidIds
+      )
+    );
+  }
+  const specIds = extractIds(text, "SPEC");
+  if (specIds.length === 0) {
+    issues.push(
+      issue3(
+        "QFAI-SPEC-001",
+        "SPEC ID \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "error",
+        file,
+        "spec.id"
+      )
+    );
+  }
+  const brIds = extractIds(text, "BR");
+  if (brIds.length === 0) {
+    issues.push(
+      issue3(
+        "QFAI-SPEC-002",
+        "BR ID \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "error",
+        file,
+        "spec.br"
+      )
+    );
+  }
+  const scIds = extractIds(text, "SC");
+  if (scIds.length > 0) {
+    issues.push(
+      issue3(
+        "QFAI-SPEC-003",
+        "Spec \u306F SC \u3092\u53C2\u7167\u3057\u306A\u3044\u30EB\u30FC\u30EB\u3067\u3059\u3002",
+        "warning",
+        file,
+        "spec.noSc",
+        scIds
+      )
+    );
+  }
+  for (const section of requiredSections) {
+    if (!text.includes(section)) {
+      issues.push(
+        issue3(
+          "QFAI-SPEC-004",
+          `\u5FC5\u9808\u30BB\u30AF\u30B7\u30E7\u30F3\u304C\u4E0D\u8DB3\u3057\u3066\u3044\u307E\u3059: ${section}`,
+          "error",
+          file,
+          "spec.requiredSection"
+        )
+      );
+    }
+  }
+  return issues;
+}
+function issue3(code, message, severity, file, rule, refs) {
+  const issue5 = {
+    code,
+    severity,
+    message
+  };
+  if (file) {
+    issue5.file = file;
+  }
+  if (rule) {
+    issue5.rule = rule;
+  }
+  if (refs && refs.length > 0) {
+    issue5.refs = refs;
+  }
+  return issue5;
+}
+
+// src/core/validators/traceability.ts
+import { readFile as readFile6 } from "fs/promises";
+async function validateTraceability(root, config) {
+  const issues = [];
+  const specsRoot = resolvePath(root, config, "specDir");
+  const decisionsRoot = resolvePath(root, config, "decisionsDir");
+  const scenariosRoot = resolvePath(root, config, "scenariosDir");
+  const srcRoot = resolvePath(root, config, "srcDir");
+  const testsRoot = resolvePath(root, config, "testsDir");
+  const specFiles = await collectSpecFiles(specsRoot);
+  const decisionFiles = await collectFiles(decisionsRoot, {
+    extensions: [".md"]
+  });
+  const scenarioFiles = await collectFiles(scenariosRoot, {
+    extensions: [".feature"]
+  });
+  const upstreamIds = /* @__PURE__ */ new Set();
+  const brIdsInSpecs = /* @__PURE__ */ new Set();
+  const brIdsInScenarios = /* @__PURE__ */ new Set();
+  const scIdsInScenarios = /* @__PURE__ */ new Set();
+  const scenarioContractIds = /* @__PURE__ */ new Set();
+  const scWithContracts = /* @__PURE__ */ new Set();
+  for (const file of [...specFiles, ...decisionFiles]) {
+    const text = await readFile6(file, "utf-8");
+    extractAllIds(text).forEach((id) => upstreamIds.add(id));
+    extractIds(text, "BR").forEach((id) => brIdsInSpecs.add(id));
+  }
+  for (const file of scenarioFiles) {
+    const text = await readFile6(file, "utf-8");
+    extractAllIds(text).forEach((id) => upstreamIds.add(id));
+    const brIds = extractIds(text, "BR");
+    brIds.forEach((id) => brIdsInScenarios.add(id));
+    const scIds = extractIds(text, "SC");
+    scIds.forEach((id) => scIdsInScenarios.add(id));
+    const contractIds = [
+      ...extractIds(text, "UI"),
+      ...extractIds(text, "API"),
+      ...extractIds(text, "DATA")
+    ];
+    contractIds.forEach((id) => scenarioContractIds.add(id));
+    if (contractIds.length > 0) {
+      scIds.forEach((id) => scWithContracts.add(id));
+    }
+  }
+  if (upstreamIds.size === 0) {
+    return [
+      issue4(
+        "QFAI-TRACE-000",
+        "\u4E0A\u6D41 ID \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "info",
+        specsRoot,
+        "traceability.upstream"
+      )
+    ];
+  }
+  if (config.validation.traceability.brMustHaveSc && brIdsInSpecs.size > 0) {
+    const orphanBrIds = Array.from(brIdsInSpecs).filter(
+      (id) => !brIdsInScenarios.has(id)
+    );
+    if (orphanBrIds.length > 0) {
+      issues.push(
+        issue4(
+          "QFAI_TRACE_BR_ORPHAN",
+          `BR \u304C SC \u306B\u7D10\u3065\u3044\u3066\u3044\u307E\u305B\u3093: ${orphanBrIds.join(", ")}`,
+          "error",
+          specsRoot,
+          "traceability.brMustHaveSc",
+          orphanBrIds
+        )
+      );
+    }
+  }
+  if (config.validation.traceability.scMustTouchContracts && scIdsInScenarios.size > 0) {
+    const scWithoutContracts = Array.from(scIdsInScenarios).filter(
+      (id) => !scWithContracts.has(id)
+    );
+    if (scWithoutContracts.length > 0) {
+      issues.push(
+        issue4(
+          "QFAI_TRACE_SC_NO_CONTRACT",
+          `SC \u304C\u5951\u7D04(UI/API/DATA)\u306B\u63A5\u7D9A\u3057\u3066\u3044\u307E\u305B\u3093: ${scWithoutContracts.join(
+            ", "
+          )}`,
+          "error",
+          scenariosRoot,
+          "traceability.scMustTouchContracts",
+          scWithoutContracts
+        )
+      );
+    }
+  }
+  if (!config.validation.traceability.allowOrphanContracts) {
+    const contractIds = await collectContractIds(root, config);
+    if (contractIds.size > 0) {
+      const orphanContracts = Array.from(contractIds).filter(
+        (id) => !scenarioContractIds.has(id)
+      );
+      if (orphanContracts.length > 0) {
+        issues.push(
+          issue4(
+            "QFAI_CONTRACT_ORPHAN",
+            `\u5951\u7D04\u304C SC \u304B\u3089\u53C2\u7167\u3055\u308C\u3066\u3044\u307E\u305B\u3093: ${orphanContracts.join(", ")}`,
+            "error",
+            scenariosRoot,
+            "traceability.allowOrphanContracts",
+            orphanContracts
+          )
+        );
+      }
+    }
+  }
+  issues.push(
+    ...await validateCodeReferences(upstreamIds, srcRoot, testsRoot)
+  );
+  return issues;
+}
+async function collectContractIds(root, config) {
+  const contractIds = /* @__PURE__ */ new Set();
+  const uiRoot = resolvePath(root, config, "uiContractsDir");
+  const apiRoot = resolvePath(root, config, "apiContractsDir");
+  const dataRoot = resolvePath(root, config, "dataContractsDir");
+  const uiFiles = await collectUiContractFiles(uiRoot);
+  const apiFiles = await collectApiContractFiles(apiRoot);
+  const dataFiles = await collectDataContractFiles(dataRoot);
+  await collectIdsFromFiles(uiFiles, ["UI"], contractIds);
+  await collectIdsFromFiles(apiFiles, ["API"], contractIds);
+  await collectIdsFromFiles(dataFiles, ["DATA"], contractIds);
+  return contractIds;
+}
+async function collectIdsFromFiles(files, prefixes, out) {
+  for (const file of files) {
+    const text = await readFile6(file, "utf-8");
+    for (const prefix of prefixes) {
+      extractIds(text, prefix).forEach((id) => out.add(id));
+    }
+  }
+}
+async function validateCodeReferences(upstreamIds, srcRoot, testsRoot) {
+  const issues = [];
+  const codeFiles = await collectFiles(srcRoot, {
+    extensions: [".ts", ".tsx", ".js", ".jsx"]
+  });
+  const testFiles = await collectFiles(testsRoot, {
+    extensions: [".ts", ".tsx", ".js", ".jsx"]
+  });
+  const targetFiles = [...codeFiles, ...testFiles];
+  if (targetFiles.length === 0) {
+    issues.push(
+      issue4(
+        "QFAI-TRACE-001",
+        "\u53C2\u7167\u5BFE\u8C61\u306E\u30B3\u30FC\u30C9/\u30C6\u30B9\u30C8\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "info",
+        srcRoot,
+        "traceability.codeReferences"
+      )
+    );
+    return issues;
+  }
+  const pattern = buildIdPattern(Array.from(upstreamIds));
+  let found = false;
+  for (const file of targetFiles) {
+    const text = await readFile6(file, "utf-8");
+    if (pattern.test(text)) {
+      found = true;
+      break;
+    }
+  }
+  if (!found) {
+    issues.push(
+      issue4(
+        "QFAI-TRACE-002",
+        "\u4E0A\u6D41 ID \u304C\u30B3\u30FC\u30C9/\u30C6\u30B9\u30C8\u306B\u53C2\u7167\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002",
+        "warning",
+        srcRoot,
+        "traceability.codeReferences"
+      )
+    );
+  }
+  return issues;
+}
+function buildIdPattern(ids) {
+  const escaped = ids.map((id) => id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  return new RegExp(`\\b(${escaped.join("|")})\\b`);
+}
+function issue4(code, message, severity, file, rule, refs) {
+  const issue5 = {
+    code,
+    severity,
+    message
+  };
+  if (file) {
+    issue5.file = file;
+  }
+  if (rule) {
+    issue5.rule = rule;
+  }
+  if (refs && refs.length > 0) {
+    issue5.refs = refs;
+  }
+  return issue5;
+}
+
+// src/core/validate.ts
+async function validateProject(root, configResult) {
+  const resolved = configResult ?? await loadConfig(root);
+  const { config, issues: configIssues } = resolved;
+  const issues = [
+    ...configIssues,
+    ...await validateSpecs(root, config),
+    ...await validateScenarios(root, config),
+    ...await validateContracts(root, config),
+    ...await validateTraceability(root, config)
+  ];
+  const toolVersion = await resolveToolVersion();
+  return {
+    schemaVersion: VALIDATION_SCHEMA_VERSION,
+    toolVersion,
+    issues,
+    counts: countIssues(issues)
+  };
+}
+function countIssues(issues) {
+  return issues.reduce(
+    (acc, issue5) => {
+      acc[issue5.severity] += 1;
+      return acc;
+    },
+    { info: 0, warning: 0, error: 0 }
+  );
+}
+
+// src/core/report.ts
+var ID_PREFIXES = ["SPEC", "BR", "SC", "UI", "API", "DATA"];
+async function createReportData(root, validation, configResult) {
+  const resolved = configResult ?? await loadConfig(root);
+  const config = resolved.config;
+  const configPath = resolved.configPath;
+  const specRoot = resolvePath(root, config, "specDir");
+  const decisionsRoot = resolvePath(root, config, "decisionsDir");
+  const scenariosRoot = resolvePath(root, config, "scenariosDir");
+  const rulesRoot = resolvePath(root, config, "rulesDir");
+  const apiRoot = resolvePath(root, config, "apiContractsDir");
+  const uiRoot = resolvePath(root, config, "uiContractsDir");
+  const dbRoot = resolvePath(root, config, "dataContractsDir");
+  const srcRoot = resolvePath(root, config, "srcDir");
+  const testsRoot = resolvePath(root, config, "testsDir");
+  const specFiles = await collectSpecFiles(specRoot);
+  const scenarioFiles = await collectFiles(scenariosRoot, {
+    extensions: [".feature"]
+  });
+  const decisionFiles = await collectFiles(decisionsRoot, {
+    extensions: [".md"]
+  });
+  const ruleFiles = await collectFiles(rulesRoot, { extensions: [".md"] });
+  const {
+    api: apiFiles,
+    ui: uiFiles,
+    db: dbFiles
+  } = await collectContractFiles(uiRoot, apiRoot, dbRoot);
+  const idsByPrefix = await collectIds([
+    ...specFiles,
+    ...scenarioFiles,
+    ...decisionFiles,
+    ...ruleFiles,
+    ...apiFiles,
+    ...uiFiles,
+    ...dbFiles
+  ]);
+  const upstreamIds = await collectUpstreamIds([
+    ...specFiles,
+    ...scenarioFiles
+  ]);
+  const traceability = await evaluateTraceability(
+    upstreamIds,
+    srcRoot,
+    testsRoot
+  );
+  const resolvedValidation = validation ?? await validateProject(root, resolved);
+  const version = await resolveToolVersion();
+  return {
+    tool: "qfai",
+    version,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    root,
+    configPath,
+    summary: {
+      specs: specFiles.length,
+      scenarios: scenarioFiles.length,
+      decisions: decisionFiles.length,
+      rules: ruleFiles.length,
+      contracts: {
+        api: apiFiles.length,
+        ui: uiFiles.length,
+        db: dbFiles.length
+      },
+      counts: resolvedValidation.counts
+    },
+    ids: {
+      spec: idsByPrefix.SPEC,
+      br: idsByPrefix.BR,
+      sc: idsByPrefix.SC,
+      ui: idsByPrefix.UI,
+      api: idsByPrefix.API,
+      data: idsByPrefix.DATA
+    },
+    traceability: {
+      upstreamIdsFound: upstreamIds.size,
+      referencedInCodeOrTests: traceability
+    },
+    issues: resolvedValidation.issues
+  };
+}
+function formatReportMarkdown(data) {
+  const lines = [];
+  lines.push("# QFAI Report");
+  lines.push(`- \u751F\u6210\u65E5\u6642: ${data.generatedAt}`);
+  lines.push(`- \u30EB\u30FC\u30C8: ${data.root}`);
+  lines.push(`- \u8A2D\u5B9A: ${data.configPath}`);
+  lines.push(`- \u7248: ${data.version}`);
+  lines.push("");
+  lines.push("## \u6982\u8981");
+  lines.push(`- specs: ${data.summary.specs}`);
+  lines.push(`- scenarios: ${data.summary.scenarios}`);
+  lines.push(`- decisions: ${data.summary.decisions}`);
+  lines.push(`- rules: ${data.summary.rules}`);
+  lines.push(
+    `- contracts: api ${data.summary.contracts.api} / ui ${data.summary.contracts.ui} / db ${data.summary.contracts.db}`
+  );
+  lines.push(
+    `- issues: info ${data.summary.counts.info} / warning ${data.summary.counts.warning} / error ${data.summary.counts.error}`
+  );
+  lines.push("");
+  lines.push("## ID\u96C6\u8A08");
+  lines.push(formatIdLine("SPEC", data.ids.spec));
+  lines.push(formatIdLine("BR", data.ids.br));
+  lines.push(formatIdLine("SC", data.ids.sc));
+  lines.push(formatIdLine("UI", data.ids.ui));
+  lines.push(formatIdLine("API", data.ids.api));
+  lines.push(formatIdLine("DATA", data.ids.data));
+  lines.push("");
+  lines.push("## \u30C8\u30EC\u30FC\u30B5\u30D3\u30EA\u30C6\u30A3");
+  lines.push(`- \u4E0A\u6D41ID\u691C\u51FA\u6570: ${data.traceability.upstreamIdsFound}`);
+  lines.push(
+    `- \u30B3\u30FC\u30C9/\u30C6\u30B9\u30C8\u53C2\u7167: ${data.traceability.referencedInCodeOrTests ? "\u3042\u308A" : "\u306A\u3057"}`
+  );
+  lines.push("");
+  lines.push("## Hotspots");
+  const hotspots = buildHotspots(data.issues);
+  if (hotspots.length === 0) {
+    lines.push("- (none)");
+  } else {
+    for (const spot of hotspots) {
+      lines.push(
+        `- ${spot.file}: total ${spot.total} (error ${spot.error} / warning ${spot.warning} / info ${spot.info})`
+      );
+    }
+  }
+  lines.push("");
+  lines.push("## \u30C8\u30EC\u30FC\u30B5\u30D3\u30EA\u30C6\u30A3\uFF08\u691C\u8A3C\uFF09");
+  const traceIssues = data.issues.filter(
+    (item) => item.rule?.startsWith("traceability.") || item.code.startsWith("QFAI_TRACE") || item.code === "QFAI_CONTRACT_ORPHAN"
+  );
+  if (traceIssues.length === 0) {
+    lines.push("- (none)");
+  } else {
+    for (const item of traceIssues) {
+      const location = item.file ? ` (${item.file})` : "";
+      lines.push(
+        `- ${item.severity.toUpperCase()} [${item.code}] ${item.message}${location}`
+      );
+    }
+  }
+  lines.push("");
+  lines.push("## \u691C\u8A3C\u7D50\u679C");
+  if (data.issues.length === 0) {
+    lines.push("- (none)");
+  } else {
+    for (const item of data.issues) {
+      const location = item.file ? ` (${item.file})` : "";
+      const refs = item.refs && item.refs.length > 0 ? ` refs=${item.refs.join(",")}` : "";
+      lines.push(
+        `- ${item.severity.toUpperCase()} [${item.code}] ${item.message}${location}${refs}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function formatReportJson(data) {
+  return JSON.stringify(data, null, 2);
+}
+async function collectIds(files) {
+  const result = {
+    SPEC: /* @__PURE__ */ new Set(),
+    BR: /* @__PURE__ */ new Set(),
+    SC: /* @__PURE__ */ new Set(),
+    UI: /* @__PURE__ */ new Set(),
+    API: /* @__PURE__ */ new Set(),
+    DATA: /* @__PURE__ */ new Set()
+  };
+  for (const file of files) {
+    const text = await readFile7(file, "utf-8");
+    for (const prefix of ID_PREFIXES) {
+      const ids = extractIds(text, prefix);
+      ids.forEach((id) => result[prefix].add(id));
+    }
+  }
+  return {
+    SPEC: toSortedArray(result.SPEC),
+    BR: toSortedArray(result.BR),
+    SC: toSortedArray(result.SC),
+    UI: toSortedArray(result.UI),
+    API: toSortedArray(result.API),
+    DATA: toSortedArray(result.DATA)
+  };
+}
+async function collectUpstreamIds(files) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    const text = await readFile7(file, "utf-8");
+    extractAllIds(text).forEach((id) => ids.add(id));
+  }
+  return ids;
+}
+async function evaluateTraceability(upstreamIds, srcRoot, testsRoot) {
+  if (upstreamIds.size === 0) {
+    return false;
+  }
+  const codeFiles = await collectFiles(srcRoot, {
+    extensions: [".ts", ".tsx", ".js", ".jsx"]
+  });
+  const testFiles = await collectFiles(testsRoot, {
+    extensions: [".ts", ".tsx", ".js", ".jsx"]
+  });
+  const targetFiles = [...codeFiles, ...testFiles];
+  if (targetFiles.length === 0) {
+    return false;
+  }
+  const pattern = buildIdPattern2(Array.from(upstreamIds));
+  for (const file of targetFiles) {
+    const text = await readFile7(file, "utf-8");
+    if (pattern.test(text)) {
+      return true;
+    }
+  }
+  return false;
+}
+function buildIdPattern2(ids) {
+  const escaped = ids.map((id) => id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  return new RegExp(`\\b(${escaped.join("|")})\\b`);
+}
+function formatIdLine(label, values) {
+  if (values.length === 0) {
+    return `- ${label}: (none)`;
+  }
+  return `- ${label}: ${values.join(", ")}`;
+}
+function toSortedArray(values) {
+  return Array.from(values).sort((a, b) => a.localeCompare(b));
+}
+function buildHotspots(issues) {
+  const map = /* @__PURE__ */ new Map();
+  for (const issue5 of issues) {
+    if (!issue5.file) {
+      continue;
+    }
+    const current = map.get(issue5.file) ?? {
+      file: issue5.file,
+      total: 0,
+      error: 0,
+      warning: 0,
+      info: 0
+    };
+    current.total += 1;
+    current[issue5.severity] += 1;
+    map.set(issue5.file, current);
+  }
+  return Array.from(map.values()).sort(
+    (a, b) => b.total !== a.total ? b.total - a.total : a.file.localeCompare(b.file)
+  );
+}
+
+// src/cli/commands/report.ts
+async function runReport(options) {
+  const root = path9.resolve(options.root);
+  const configResult = await loadConfig(root);
+  const input = options.jsonPath ?? configResult.config.output.jsonPath;
+  const inputPath = path9.isAbsolute(input) ? input : path9.resolve(root, input);
+  let validation;
+  try {
+    validation = await readValidationResult(inputPath);
+  } catch (err) {
+    if (isMissingFileError(err)) {
+      error(
+        [
+          `qfai report: \u5165\u529B\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${inputPath}`,
+          "",
+          "\u307E\u305A validate.json \u3092\u751F\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u4F8B:",
+          `  qfai validate --json-path ${input}`,
+          "",
+          "GitHub Actions \u30C6\u30F3\u30D7\u30EC\u3092\u4F7F\u3063\u3066\u3044\u308B\u5834\u5408\u306F\u3001workflow \u306E validate \u30B8\u30E7\u30D6\u3092\u5148\u306B\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+        ].join("\n")
+      );
+      process.exitCode = 2;
+      return;
+    }
+    throw err;
+  }
+  const data = await createReportData(root, validation, configResult);
+  const output = options.format === "json" ? formatReportJson(data) : formatReportMarkdown(data);
+  const defaultOut = options.format === "json" ? ".qfai/out/report.json" : ".qfai/out/report.md";
+  const out = options.outPath ?? defaultOut;
+  const outPath = path9.isAbsolute(out) ? out : path9.resolve(root, out);
+  await mkdir2(path9.dirname(outPath), { recursive: true });
+  await writeFile(outPath, `${output}
+`, "utf-8");
+  info(
+    `report: info=${validation.counts.info} warning=${validation.counts.warning} error=${validation.counts.error}`
+  );
+  info(`wrote report: ${outPath}`);
+}
+async function readValidationResult(inputPath) {
+  const raw = await readFile8(inputPath, "utf-8");
+  const parsed = JSON.parse(raw);
+  if (!isValidationResult(parsed)) {
+    throw new Error(`validate.json \u306E\u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${inputPath}`);
+  }
+  if (parsed.schemaVersion !== VALIDATION_SCHEMA_VERSION) {
+    throw new Error(
+      `validate.json \u306E schemaVersion \u304C\u4E0D\u4E00\u81F4\u3067\u3059: expected ${VALIDATION_SCHEMA_VERSION}, actual ${parsed.schemaVersion}`
+    );
+  }
+  return parsed;
+}
+function isValidationResult(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const record = value;
+  if (typeof record.schemaVersion !== "string") {
+    return false;
+  }
+  if (typeof record.toolVersion !== "string") {
+    return false;
+  }
+  if (!Array.isArray(record.issues)) {
+    return false;
+  }
+  const counts = record.counts;
+  if (!counts) {
+    return false;
+  }
+  return typeof counts.info === "number" && typeof counts.warning === "number" && typeof counts.error === "number";
+}
+function isMissingFileError(error2) {
+  if (!error2 || typeof error2 !== "object") {
+    return false;
+  }
+  const record = error2;
+  return record.code === "ENOENT";
+}
+
+// src/cli/commands/validate.ts
+import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
+import path10 from "path";
+
+// src/cli/lib/failOn.ts
+function shouldFail(result, failOn) {
+  if (failOn === "never") {
+    return false;
+  }
+  if (failOn === "error") {
+    return result.counts.error > 0;
+  }
+  return result.counts.error + result.counts.warning > 0;
+}
+
+// src/cli/commands/validate.ts
+async function runValidate(options) {
+  const root = path10.resolve(options.root);
+  const configResult = await loadConfig(root);
+  const result = await validateProject(root, configResult);
+  const format = options.format ?? configResult.config.output.format;
+  const explicitJsonPath = options.jsonPath;
+  if (format === "text") {
+    emitText(result);
+  }
+  if (format === "github") {
+    result.issues.forEach(emitGitHub);
+  }
+  const shouldWriteJson = format === "json" || explicitJsonPath !== void 0;
+  if (shouldWriteJson) {
+    const jsonPath = format === "json" ? options.jsonPath ?? configResult.config.output.jsonPath : explicitJsonPath;
+    if (jsonPath) {
+      await emitJson(result, root, jsonPath);
+    }
+  }
+  const failOn = resolveFailOn(options, configResult.config.validation.failOn);
+  return shouldFail(result, failOn) ? 1 : 0;
+}
+function resolveFailOn(options, fallback) {
+  if (options.failOn) {
+    return options.failOn;
+  }
+  if (options.strict) {
+    return "warning";
+  }
+  return fallback;
+}
+function emitText(result) {
+  for (const item of result.issues) {
+    const location = item.file ? ` (${item.file})` : "";
+    const refs = item.refs && item.refs.length > 0 ? ` refs=${item.refs.join(",")}` : "";
+    process.stdout.write(
+      `[${item.severity}] ${item.code} ${item.message}${location}${refs}
+`
+    );
+  }
+  process.stdout.write(
+    `counts: info=${result.counts.info} warning=${result.counts.warning} error=${result.counts.error}
+`
+  );
+}
+function emitGitHub(issue5) {
+  const level = issue5.severity === "error" ? "error" : issue5.severity === "warning" ? "warning" : "notice";
+  const file = issue5.file ? `file=${issue5.file}` : "";
+  const line = issue5.loc?.line ? `,line=${issue5.loc.line}` : "";
+  const column = issue5.loc?.column ? `,col=${issue5.loc.column}` : "";
+  const location = file ? ` ${file}${line}${column}` : "";
+  process.stdout.write(
+    `::${level}${location}::${issue5.code}: ${issue5.message}
+`
+  );
+}
+async function emitJson(result, root, jsonPath) {
+  const abs = path10.isAbsolute(jsonPath) ? jsonPath : path10.resolve(root, jsonPath);
+  await mkdir3(path10.dirname(abs), { recursive: true });
+  await writeFile2(abs, `${JSON.stringify(result, null, 2)}
+`, "utf-8");
+}
+
+// src/cli/lib/args.ts
+function parseArgs(argv, cwd) {
+  const options = {
+    root: cwd,
+    dir: cwd,
+    force: false,
+    yes: false,
+    dryRun: false,
+    reportFormat: "md",
+    validateFormat: "text",
+    strict: false,
+    help: false
+  };
+  const args = [...argv];
+  let command = args.shift() ?? null;
+  if (command === "--help" || command === "-h") {
+    options.help = true;
+    command = null;
+  }
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    switch (arg) {
+      case "--root":
+        options.root = args[i + 1] ?? options.root;
+        i += 1;
+        break;
+      case "--dir":
+        options.dir = args[i + 1] ?? options.dir;
+        i += 1;
+        break;
+      case "--force":
+        options.force = true;
+        break;
+      case "--yes":
+        options.yes = true;
+        break;
+      case "--dry-run":
+        options.dryRun = true;
+        break;
+      case "--format": {
+        const next = args[i + 1];
+        applyFormatOption(command, next, options);
+        i += 1;
+        break;
+      }
+      case "--strict":
+        options.strict = true;
+        break;
+      case "--fail-on": {
+        const next = args[i + 1];
+        if (next === "never" || next === "warning" || next === "error") {
+          options.failOn = next;
+        }
+        i += 1;
+        break;
+      }
+      case "--json-path":
+        {
+          const next = args[i + 1];
+          if (next) {
+            options.jsonPath = next;
+          }
+        }
+        i += 1;
+        break;
+      case "--out":
+        {
+          const next = args[i + 1];
+          if (next) {
+            options.reportOut = next;
+          }
+        }
+        i += 1;
+        break;
+      case "--help":
+      case "-h":
+        options.help = true;
+        break;
+      default:
+        break;
+    }
+  }
+  return { command, options };
+}
+function applyFormatOption(command, value, options) {
+  if (!value) {
+    return;
+  }
+  if (command === "report") {
+    if (value === "md" || value === "json") {
+      options.reportFormat = value;
+    }
+    return;
+  }
+  if (command === "validate") {
+    if (value === "text" || value === "json" || value === "github") {
+      options.validateFormat = value;
+    }
+    return;
+  }
+  if (value === "md" || value === "json") {
+    options.reportFormat = value;
+  }
+  if (value === "text" || value === "json" || value === "github") {
+    options.validateFormat = value;
+  }
+}
+
+// src/cli/main.ts
+async function run(argv, cwd) {
+  const { command, options } = parseArgs(argv, cwd);
+  if (!command || options.help) {
+    info(usage());
+    return;
+  }
+  switch (command) {
+    case "init":
+      await runInit({
+        dir: options.dir,
+        force: options.force,
+        dryRun: options.dryRun,
+        yes: options.yes
+      });
+      return;
+    case "validate":
+      process.exitCode = await runValidate({
+        root: options.root,
+        strict: options.strict,
+        format: options.validateFormat,
+        ...options.failOn !== void 0 ? { failOn: options.failOn } : {},
+        ...options.jsonPath !== void 0 ? { jsonPath: options.jsonPath } : {}
+      });
+      return;
+    case "report":
+      await runReport({
+        root: options.root,
+        format: options.reportFormat,
+        ...options.jsonPath !== void 0 ? { jsonPath: options.jsonPath } : {},
+        ...options.reportOut !== void 0 ? { outPath: options.reportOut } : {}
+      });
+      return;
+    default:
+      error(`Unknown command: ${command}`);
+      info(usage());
+      return;
+  }
+}
+function usage() {
+  return `qfai <command> [options]
+
+Commands:
+  init       \u30C6\u30F3\u30D7\u30EC\u3092\u751F\u6210
+  validate   \u4ED5\u69D8/\u5951\u7D04/\u53C2\u7167\u306E\u691C\u67FB
+  report     \u691C\u8A3C\u7D50\u679C\u3068\u96C6\u8A08\u3092\u51FA\u529B
+
+Options:
+  --root <path>   \u5BFE\u8C61\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA
+  --dir <path>    init \u306E\u51FA\u529B\u5148
+  --force         \u65E2\u5B58\u30D5\u30A1\u30A4\u30EB\u3092\u4E0A\u66F8\u304D
+  --yes           init: \u975E\u5BFE\u8A71\u3067\u30C7\u30D5\u30A9\u30EB\u30C8\u3092\u63A1\u7528\uFF08\u73FE\u5728\u306F\u975E\u5BFE\u8A71\u304C\u65E2\u5B9A\u3001\u5C06\u6765\u306E\u5BFE\u8A71\u5C0E\u5165\u6642\u3082\u81EA\u52D5Yes\uFF09
+  --dry-run       \u5909\u66F4\u3092\u884C\u308F\u305A\u8868\u793A\u306E\u307F
+  --format <text|json|github>  validate \u306E\u51FA\u529B\u5F62\u5F0F
+  --format <md|json>           report \u306E\u51FA\u529B\u5F62\u5F0F
+  --strict              validate: warning \u4EE5\u4E0A\u3067 exit 1
+  --fail-on <error|warning|never>  validate: \u5931\u6557\u6761\u4EF6
+  --json-path <path>     validate: JSON \u51FA\u529B\u5148 / report: validate JSON \u5165\u529B
+  --out <path>           report: \u51FA\u529B\u5148
+  -h, --help      \u30D8\u30EB\u30D7\u8868\u793A
+`;
+}
+
+// src/cli/index.ts
+run(process.argv.slice(2), process.cwd()).catch((err) => {
+  process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=index.mjs.map