qfai 1.0.2 → 1.0.3

package/dist/index.cjs

@@ -456,7 +456,15 @@ function isRecord(value) {
 }
 
 // src/core/ids.ts
-var ID_PREFIXES = ["SPEC", "BR", "SC", "UI", "API", "DB"];
+var ID_PREFIXES = [
+  "SPEC",
+  "BR",
+  "SC",
+  "UI",
+  "API",
+  "DB",
+  "THEMA"
+];
 var STRICT_ID_PATTERNS = {
   SPEC: /\bSPEC-\d{4}\b/g,
   BR: /\bBR-\d{4}\b/g,
@@ -464,6 +472,7 @@ var STRICT_ID_PATTERNS = {
   UI: /\bUI-\d{4}\b/g,
   API: /\bAPI-\d{4}\b/g,
   DB: /\bDB-\d{4}\b/g,
+  THEMA: /\bTHEMA-\d{3}\b/g,
   ADR: /\bADR-\d{4}\b/g
 };
 var LOOSE_ID_PATTERNS = {
@@ -473,6 +482,7 @@ var LOOSE_ID_PATTERNS = {
   UI: /\bUI-[A-Za-z0-9_-]+\b/gi,
   API: /\bAPI-[A-Za-z0-9_-]+\b/gi,
   DB: /\bDB-[A-Za-z0-9_-]+\b/gi,
+  THEMA: /\bTHEMA-[A-Za-z0-9_-]+\b/gi,
   ADR: /\bADR-[A-Za-z0-9_-]+\b/gi
 };
 function extractIds(text, prefix) {
@@ -510,14 +520,15 @@ function isValidId(value, prefix) {
 
 // src/core/report.ts
 var import_promises15 = require("fs/promises");
-var import_node_path14 = __toESM(require("path"), 1);
+var import_node_path16 = __toESM(require("path"), 1);
 
 // src/core/contractIndex.ts
 var import_promises5 = require("fs/promises");
-var import_node_path4 = __toESM(require("path"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 
 // src/core/discovery.ts
 var import_promises4 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
 
 // src/core/fs.ts
 var import_promises2 = require("fs/promises");
@@ -666,7 +677,12 @@ async function collectScenarioFiles(specsRoot) {
   return filterExisting(entries.map((entry) => entry.scenarioPath));
 }
 async function collectUiContractFiles(uiRoot) {
-  return collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  const files = await collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  return filterByBasenamePrefix(files, "ui-");
+}
+async function collectThemaContractFiles(uiRoot) {
+  const files = await collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  return filterByBasenamePrefix(files, "thema-");
 }
 async function collectApiContractFiles(apiRoot) {
   return collectFiles(apiRoot, { extensions: [".yaml", ".yml", ".json"] });
@@ -675,12 +691,13 @@ async function collectDbContractFiles(dbRoot) {
   return collectFiles(dbRoot, { extensions: [".sql"] });
 }
 async function collectContractFiles(uiRoot, apiRoot, dbRoot) {
-  const [ui, api, db] = await Promise.all([
+  const [ui, thema, api, db] = await Promise.all([
     collectUiContractFiles(uiRoot),
+    collectThemaContractFiles(uiRoot),
     collectApiContractFiles(apiRoot),
     collectDbContractFiles(dbRoot)
   ]);
-  return { ui, api, db };
+  return { ui, thema, api, db };
 }
 async function filterExisting(files) {
   const existing = [];
@@ -699,10 +716,16 @@ async function exists3(target) {
     return false;
   }
 }
+function filterByBasenamePrefix(files, prefix) {
+  const lowerPrefix = prefix.toLowerCase();
+  return files.filter(
+    (file) => import_node_path4.default.basename(file).toLowerCase().startsWith(lowerPrefix)
+  );
+}
 
 // src/core/contractsDecl.ts
-var CONTRACT_DECLARATION_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*((?:API|UI|DB)-\d{4})\s*(?:\*\/)?\s*$/gm;
-var CONTRACT_DECLARATION_LINE_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*(?:API|UI|DB)-\d{4}\s*(?:\*\/)?\s*$/;
+var CONTRACT_DECLARATION_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*((?:API|UI|DB)-\d{4}|THEMA-\d{3})\s*(?:\*\/)?\s*$/gm;
+var CONTRACT_DECLARATION_LINE_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*(?:(?:API|UI|DB)-\d{4}|THEMA-\d{3})\s*(?:\*\/)?\s*$/;
 function extractDeclaredContractIds(text) {
   const ids = [];
   for (const match of text.matchAll(CONTRACT_DECLARATION_RE)) {
@@ -720,20 +743,22 @@ function stripContractDeclarationLines(text) {
 // src/core/contractIndex.ts
 async function buildContractIndex(root, config) {
   const contractsRoot = resolvePath(root, config, "contractsDir");
-  const uiRoot = import_node_path4.default.join(contractsRoot, "ui");
-  const apiRoot = import_node_path4.default.join(contractsRoot, "api");
-  const dbRoot = import_node_path4.default.join(contractsRoot, "db");
-  const [uiFiles, apiFiles, dbFiles] = await Promise.all([
+  const uiRoot = import_node_path5.default.join(contractsRoot, "ui");
+  const apiRoot = import_node_path5.default.join(contractsRoot, "api");
+  const dbRoot = import_node_path5.default.join(contractsRoot, "db");
+  const [uiFiles, themaFiles, apiFiles, dbFiles] = await Promise.all([
     collectUiContractFiles(uiRoot),
+    collectThemaContractFiles(uiRoot),
     collectApiContractFiles(apiRoot),
     collectDbContractFiles(dbRoot)
   ]);
   const index = {
     ids: /* @__PURE__ */ new Set(),
     idToFiles: /* @__PURE__ */ new Map(),
-    files: { ui: uiFiles, api: apiFiles, db: dbFiles }
+    files: { ui: uiFiles, thema: themaFiles, api: apiFiles, db: dbFiles }
   };
   await indexContractFiles(uiFiles, index);
+  await indexContractFiles(themaFiles, index);
   await indexContractFiles(apiFiles, index);
   await indexContractFiles(dbFiles, index);
   return index;
@@ -752,15 +777,15 @@ function record(index, id, file) {
 }
 
 // src/core/paths.ts
-var import_node_path5 = __toESM(require("path"), 1);
+var import_node_path6 = __toESM(require("path"), 1);
 function toRelativePath(root, target) {
   if (!target) {
     return target;
   }
-  if (!import_node_path5.default.isAbsolute(target)) {
+  if (!import_node_path6.default.isAbsolute(target)) {
     return toPosixPath(target);
   }
-  const relative = import_node_path5.default.relative(root, target);
+  const relative = import_node_path6.default.relative(root, target);
   if (!relative) {
     return ".";
   }
@@ -808,7 +833,7 @@ function normalizeValidationResult(root, result) {
 }
 
 // src/core/parse/contractRefs.ts
-var CONTRACT_REF_ID_RE = /^(?:API|UI|DB)-\d{4}$/;
+var CONTRACT_REF_ID_RE = /^(?:(?:API|UI|DB)-\d{4}|THEMA-\d{3})$/;
 function parseContractRefs(text, options = {}) {
   const linePattern = buildLinePattern(options);
   const lines = [];
@@ -979,7 +1004,7 @@ function parseSpec(md, file) {
 
 // src/core/traceability.ts
 var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_node_path7 = __toESM(require("path"), 1);
 
 // src/core/gherkin/parse.ts
 var import_gherkin = require("@cucumber/gherkin");
@@ -1207,7 +1232,7 @@ async function collectScTestReferences(root, globs, excludeGlobs) {
     };
   }
   const normalizedFiles = Array.from(
-    new Set(scanResult.files.map((file) => import_node_path6.default.normalize(file)))
+    new Set(scanResult.files.map((file) => import_node_path7.default.normalize(file)))
   );
   for (const file of normalizedFiles) {
     const text = await (0, import_promises6.readFile)(file, "utf-8");
@@ -1270,11 +1295,11 @@ function formatError3(error) {
 
 // src/core/version.ts
 var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_node_path8 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 async function resolveToolVersion() {
-  if ("1.0.2".length > 0) {
-    return "1.0.2";
+  if ("1.0.3".length > 0) {
+    return "1.0.3";
   }
   try {
     const packagePath = resolvePackageJsonPath();
@@ -1289,18 +1314,18 @@ async function resolveToolVersion() {
 function resolvePackageJsonPath() {
   const base = __filename;
   const basePath = base.startsWith("file:") ? (0, import_node_url.fileURLToPath)(base) : base;
-  return import_node_path7.default.resolve(import_node_path7.default.dirname(basePath), "../../package.json");
+  return import_node_path8.default.resolve(import_node_path8.default.dirname(basePath), "../../package.json");
 }
 
 // src/core/validators/contracts.ts
 var import_promises8 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_node_path10 = __toESM(require("path"), 1);
 
 // src/core/contracts.ts
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_path9 = __toESM(require("path"), 1);
 var import_yaml2 = require("yaml");
 function parseStructuredContract(file, text) {
-  const ext = import_node_path8.default.extname(file).toLowerCase();
+  const ext = import_node_path9.default.extname(file).toLowerCase();
   if (ext === ".json") {
     return JSON.parse(text);
   }
@@ -1317,17 +1342,23 @@ var SQL_DANGEROUS_PATTERNS = [
     label: "ALTER TABLE ... DROP"
   }
 ];
+var THEMA_ID_RE = /^THEMA-\d{3}$/;
 async function validateContracts(root, config) {
   const issues = [];
-  const contractsRoot = resolvePath(root, config, "contractsDir");
-  issues.push(...await validateUiContracts(import_node_path9.default.join(contractsRoot, "ui")));
-  issues.push(...await validateApiContracts(import_node_path9.default.join(contractsRoot, "api")));
-  issues.push(...await validateDbContracts(import_node_path9.default.join(contractsRoot, "db")));
   const contractIndex = await buildContractIndex(root, config);
+  const contractsRoot = resolvePath(root, config, "contractsDir");
+  const uiRoot = import_node_path10.default.join(contractsRoot, "ui");
+  const themaIds = new Set(
+    Array.from(contractIndex.ids).filter((id) => id.startsWith("THEMA-"))
+  );
+  issues.push(...await validateUiContracts(uiRoot, themaIds));
+  issues.push(...await validateThemaContracts(uiRoot));
+  issues.push(...await validateApiContracts(import_node_path10.default.join(contractsRoot, "api")));
+  issues.push(...await validateDbContracts(import_node_path10.default.join(contractsRoot, "db")));
   issues.push(...validateDuplicateContractIds(contractIndex));
   return issues;
 }
-async function validateUiContracts(uiRoot) {
+async function validateUiContracts(uiRoot, themaIds) {
   const files = await collectUiContractFiles(uiRoot);
   if (files.length === 0) {
     return [
@@ -1341,6 +1372,60 @@ async function validateUiContracts(uiRoot) {
     ];
   }
   const issues = [];
+  for (const file of files) {
+    const text = await (0, import_promises8.readFile)(file, "utf-8");
+    const declaredIds = extractDeclaredContractIds(text);
+    issues.push(...validateDeclaredContractIds(declaredIds, file, "UI"));
+    let doc = null;
+    try {
+      doc = parseStructuredContract(file, stripContractDeclarationLines(text));
+    } catch (error) {
+      issues.push(
+        issue(
+          "QFAI-CONTRACT-001",
+          `UI \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
+          "error",
+          file,
+          "contracts.ui.parse"
+        )
+      );
+    }
+    const invalidIds = extractInvalidIds(text, [
+      "SPEC",
+      "BR",
+      "SC",
+      "UI",
+      "API",
+      "DB",
+      "THEMA",
+      "ADR"
+    ]).filter((id) => !shouldIgnoreInvalidId(id, doc));
+    if (invalidIds.length > 0) {
+      issues.push(
+        issue(
+          "QFAI-ID-002",
+          `ID \u30D5\u30A9\u30FC\u30DE\u30C3\u30C8\u304C\u4E0D\u6B63\u3067\u3059: ${invalidIds.join(", ")}`,
+          "error",
+          file,
+          "id.format",
+          invalidIds
+        )
+      );
+    }
+    if (doc) {
+      issues.push(
+        ...await validateUiContractDoc(doc, file, uiRoot, themaIds)
+      );
+    }
+  }
+  return issues;
+}
+async function validateThemaContracts(uiRoot) {
+  const files = await collectThemaContractFiles(uiRoot);
+  if (files.length === 0) {
+    return [];
+  }
+  const issues = [];
   for (const file of files) {
     const text = await (0, import_promises8.readFile)(file, "utf-8");
     const invalidIds = extractInvalidIds(text, [
@@ -1350,6 +1435,7 @@ async function validateUiContracts(uiRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1365,17 +1451,95 @@ async function validateUiContracts(uiRoot) {
       );
     }
     const declaredIds = extractDeclaredContractIds(text);
-    issues.push(...validateDeclaredContractIds(declaredIds, file, "UI"));
+    if (declaredIds.length === 0) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-010",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306B QFAI-CONTRACT-ID \u304C\u3042\u308A\u307E\u305B\u3093: ${file}`,
+          "error",
+          file,
+          "contracts.thema.declaration"
+        )
+      );
+      continue;
+    }
+    if (declaredIds.length > 1) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-011",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306B\u8907\u6570\u306E QFAI-CONTRACT-ID \u304C\u5BA3\u8A00\u3055\u308C\u3066\u3044\u307E\u3059: ${declaredIds.join(
+            ", "
+          )}`,
+          "error",
+          file,
+          "contracts.thema.declaration",
+          declaredIds
+        )
+      );
+      continue;
+    }
+    const declaredId = declaredIds[0] ?? "";
+    if (!THEMA_ID_RE.test(declaredId)) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-012",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E ID \u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${declaredId}`,
+          "error",
+          file,
+          "contracts.thema.idFormat",
+          [declaredId]
+        )
+      );
+    }
+    let doc;
     try {
-      parseStructuredContract(file, stripContractDeclarationLines(text));
+      doc = parseStructuredContract(file, stripContractDeclarationLines(text));
     } catch (error) {
       issues.push(
         issue(
-          "QFAI-CONTRACT-001",
-          `UI \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
+          "QFAI-THEMA-001",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
           "error",
           file,
-          "contracts.ui.parse"
+          "contracts.thema.parse"
+        )
+      );
+      continue;
+    }
+    const docId = typeof doc.id === "string" ? doc.id : "";
+    if (!THEMA_ID_RE.test(docId)) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-012",
+          docId.length > 0 ? `thema \u306E id \u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${docId}` : "thema \u306E id \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+          "error",
+          file,
+          "contracts.thema.idFormat",
+          docId.length > 0 ? [docId] : void 0
+        )
+      );
+    }
+    const name = typeof doc.name === "string" ? doc.name : "";
+    if (!name) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-014",
+          "thema \u306E name \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+          "error",
+          file,
+          "contracts.thema.name"
+        )
+      );
+    }
+    if (declaredId && docId && declaredId !== docId) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-013",
+          `thema \u306E\u5BA3\u8A00 ID \u3068 id \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093: ${declaredId} / ${docId}`,
+          "error",
+          file,
+          "contracts.thema.idMismatch",
+          [declaredId, docId]
         )
       );
     }
@@ -1405,6 +1569,7 @@ async function validateApiContracts(apiRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1473,6 +1638,7 @@ async function validateDbContracts(dbRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1579,6 +1745,278 @@ function validateDuplicateContractIds(contractIndex) {
 function hasOpenApi(doc) {
   return typeof doc.openapi === "string" && doc.openapi.length > 0;
 }
+async function validateUiContractDoc(doc, file, uiRoot, themaIds) {
+  const issues = [];
+  if (Object.prototype.hasOwnProperty.call(doc, "themaRef")) {
+    const themaRef = doc.themaRef;
+    if (typeof themaRef !== "string" || themaRef.length === 0) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          "themaRef \u306F THEMA-001 \u5F62\u5F0F\u306E\u6587\u5B57\u5217\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          file,
+          "contracts.ui.themaRef"
+        )
+      );
+    } else if (!THEMA_ID_RE.test(themaRef)) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          `themaRef \u306E\u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${themaRef}`,
+          "error",
+          file,
+          "contracts.ui.themaRef",
+          [themaRef]
+        )
+      );
+    } else if (!themaIds.has(themaRef)) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          `themaRef \u304C\u5B58\u5728\u3057\u306A\u3044 THEMA \u3092\u53C2\u7167\u3057\u3066\u3044\u307E\u3059: ${themaRef}`,
+          "error",
+          file,
+          "contracts.ui.themaRef",
+          [themaRef]
+        )
+      );
+    }
+  }
+  const assets = doc.assets;
+  if (assets && typeof assets === "object") {
+    issues.push(
+      ...await validateUiAssets(
+        assets,
+        file,
+        uiRoot
+      )
+    );
+  }
+  return issues;
+}
+async function validateUiAssets(assets, file, uiRoot) {
+  const issues = [];
+  const packValue = assets.pack;
+  const useValue = assets.use;
+  if (packValue === void 0 && useValue === void 0) {
+    return issues;
+  }
+  if (typeof packValue !== "string" || packValue.length === 0) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        "assets.pack \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "error",
+        file,
+        "assets.pack"
+      )
+    );
+    return issues;
+  }
+  if (!isSafeRelativePath(packValue)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306F ui/ \u914D\u4E0B\u306E\u76F8\u5BFE\u30D1\u30B9\u306E\u307F\u8A31\u53EF\u3055\u308C\u307E\u3059: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  const packDir = import_node_path10.default.resolve(uiRoot, packValue);
+  const packRelative = import_node_path10.default.relative(uiRoot, packDir);
+  if (packRelative.startsWith("..") || import_node_path10.default.isAbsolute(packRelative)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306F ui/ \u914D\u4E0B\u306B\u9650\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  if (!await exists4(packDir)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u5B58\u5728\u3057\u307E\u305B\u3093: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  const assetsYamlPath = import_node_path10.default.join(packDir, "assets.yaml");
+  if (!await exists4(assetsYamlPath)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-002",
+        `assets.yaml \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${assetsYamlPath}`,
+        "error",
+        assetsYamlPath,
+        "assets.yaml"
+      )
+    );
+    return issues;
+  }
+  let manifest;
+  try {
+    const manifestText = await (0, import_promises8.readFile)(assetsYamlPath, "utf-8");
+    manifest = parseStructuredContract(assetsYamlPath, manifestText);
+  } catch (error) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-002",
+        `assets.yaml \u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${assetsYamlPath} (${formatError4(error)})`,
+        "error",
+        assetsYamlPath,
+        "assets.yaml"
+      )
+    );
+    return issues;
+  }
+  const items = Array.isArray(manifest.items) ? manifest.items : [];
+  const itemIds = /* @__PURE__ */ new Set();
+  const itemPaths = [];
+  for (const item of items) {
+    if (!item || typeof item !== "object") {
+      continue;
+    }
+    const record2 = item;
+    const id = typeof record2.id === "string" ? record2.id : void 0;
+    const pathValue = typeof record2.path === "string" ? record2.path : void 0;
+    if (id) {
+      itemIds.add(id);
+    }
+    itemPaths.push({ id, path: pathValue });
+  }
+  if (useValue !== void 0) {
+    if (!Array.isArray(useValue) || useValue.some((entry) => typeof entry !== "string")) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-003",
+          "assets.use \u306F\u6587\u5B57\u5217\u914D\u5217\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          file,
+          "assets.use"
+        )
+      );
+    } else {
+      const missing = useValue.filter((entry) => !itemIds.has(entry));
+      if (missing.length > 0) {
+        issues.push(
+          issue(
+            "QFAI-ASSET-003",
+            `assets.use \u304C assets.yaml \u306B\u5B58\u5728\u3057\u307E\u305B\u3093: ${missing.join(", ")}`,
+            "error",
+            file,
+            "assets.use",
+            missing
+          )
+        );
+      }
+    }
+  }
+  for (const entry of itemPaths) {
+    if (!entry.path) {
+      continue;
+    }
+    if (!isSafeRelativePath(entry.path)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C\u4E0D\u6B63\u3067\u3059: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+      continue;
+    }
+    const assetPath = import_node_path10.default.resolve(packDir, entry.path);
+    const assetRelative = import_node_path10.default.relative(packDir, assetPath);
+    if (assetRelative.startsWith("..") || import_node_path10.default.isAbsolute(assetRelative)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C packDir \u3092\u9038\u8131\u3057\u3066\u3044\u307E\u3059: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+      continue;
+    }
+    if (!await exists4(assetPath)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C\u5B58\u5728\u3057\u307E\u305B\u3093: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+    }
+  }
+  return issues;
+}
+function shouldIgnoreInvalidId(value, doc) {
+  if (!doc) {
+    return false;
+  }
+  const assets = doc.assets;
+  if (!assets || typeof assets !== "object") {
+    return false;
+  }
+  const packValue = assets.pack;
+  if (typeof packValue !== "string" || packValue.length === 0) {
+    return false;
+  }
+  const normalized = packValue.replace(/\\/g, "/");
+  const basename = import_node_path10.default.posix.basename(normalized);
+  if (!basename) {
+    return false;
+  }
+  return value.toLowerCase() === basename.toLowerCase();
+}
+function isSafeRelativePath(value) {
+  if (!value) {
+    return false;
+  }
+  if (import_node_path10.default.isAbsolute(value)) {
+    return false;
+  }
+  const normalized = value.replace(/\\/g, "/");
+  if (/^[A-Za-z]:/.test(normalized)) {
+    return false;
+  }
+  const segments = normalized.split("/");
+  if (segments.some((segment) => segment === "..")) {
+    return false;
+  }
+  return true;
+}
+async function exists4(target) {
+  try {
+    await (0, import_promises8.access)(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function formatError4(error) {
   if (error instanceof Error) {
     return error.message;
@@ -1609,7 +2047,7 @@ function issue(code, message, severity, file, rule, refs, category = "compatibil
 
 // src/core/validators/delta.ts
 var import_promises9 = require("fs/promises");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_node_path11 = __toESM(require("path"), 1);
 var SECTION_RE = /^##\s+変更区分/m;
 var COMPAT_LINE_RE = /^\s*-\s*\[[ xX]\]\s*Compatibility\b/m;
 var CHANGE_LINE_RE = /^\s*-\s*\[[ xX]\]\s*Change\/Improvement\b/m;
@@ -1623,7 +2061,7 @@ async function validateDeltas(root, config) {
   }
   const issues = [];
   for (const pack of packs) {
-    const deltaPath = import_node_path10.default.join(pack, "delta.md");
+    const deltaPath = import_node_path11.default.join(pack, "delta.md");
     let text;
     try {
       text = await (0, import_promises9.readFile)(deltaPath, "utf-8");
@@ -1703,7 +2141,7 @@ function issue2(code, message, severity, file, rule, refs, category = "change",
 
 // src/core/validators/ids.ts
 var import_promises10 = require("fs/promises");
-var import_node_path11 = __toESM(require("path"), 1);
+var import_node_path12 = __toESM(require("path"), 1);
 var SC_TAG_RE3 = /^SC-\d{4}$/;
 async function validateDefinedIds(root, config) {
   const issues = [];
@@ -1769,7 +2207,7 @@ function recordId(out, id, file) {
 }
 function formatFileList(files, root) {
   return files.map((file) => {
-    const relative = import_node_path11.default.relative(root, file);
+    const relative = import_node_path12.default.relative(root, file);
     return relative.length > 0 ? relative : file;
   }).join(", ");
 }
@@ -1797,19 +2235,19 @@ function issue3(code, message, severity, file, rule, refs, category = "compatibi
 
 // src/core/promptsIntegrity.ts
 var import_promises11 = require("fs/promises");
-var import_node_path13 = __toESM(require("path"), 1);
+var import_node_path14 = __toESM(require("path"), 1);
 
 // src/shared/assets.ts
 var import_node_fs = require("fs");
-var import_node_path12 = __toESM(require("path"), 1);
+var import_node_path13 = __toESM(require("path"), 1);
 var import_node_url2 = require("url");
 function getInitAssetsDir() {
   const base = __filename;
   const basePath = base.startsWith("file:") ? (0, import_node_url2.fileURLToPath)(base) : base;
-  const baseDir = import_node_path12.default.dirname(basePath);
+  const baseDir = import_node_path13.default.dirname(basePath);
   const candidates = [
-    import_node_path12.default.resolve(baseDir, "../../../assets/init"),
-    import_node_path12.default.resolve(baseDir, "../../assets/init")
+    import_node_path13.default.resolve(baseDir, "../../../assets/init"),
+    import_node_path13.default.resolve(baseDir, "../../assets/init")
   ];
   for (const candidate of candidates) {
     if ((0, import_node_fs.existsSync)(candidate)) {
@@ -1827,10 +2265,10 @@ function getInitAssetsDir() {
 
 // src/core/promptsIntegrity.ts
 async function diffProjectPromptsAgainstInitAssets(root) {
-  const promptsDir = import_node_path13.default.resolve(root, ".qfai", "prompts");
+  const promptsDir = import_node_path14.default.resolve(root, ".qfai", "prompts");
   let templateDir;
   try {
-    templateDir = import_node_path13.default.join(getInitAssetsDir(), ".qfai", "prompts");
+    templateDir = import_node_path14.default.join(getInitAssetsDir(), ".qfai", "prompts");
   } catch {
     return {
       status: "skipped_missing_assets",
@@ -1907,7 +2345,7 @@ function normalizeNewlines(text) {
   return text.replace(/\r\n/g, "\n");
 }
 function toRel(base, abs) {
-  const rel = import_node_path13.default.relative(base, abs);
+  const rel = import_node_path14.default.relative(base, abs);
   return rel.replace(/[\\/]+/g, "/");
 }
 function intersectKeys(a, b) {
@@ -1953,6 +2391,7 @@ async function validatePromptsIntegrity(root) {
 
 // src/core/validators/scenario.ts
 var import_promises12 = require("fs/promises");
+var import_node_path15 = __toESM(require("path"), 1);
 var GIVEN_PATTERN = /\bGiven\b/;
 var WHEN_PATTERN = /\bWhen\b/;
 var THEN_PATTERN = /\bThen\b/;
@@ -1975,6 +2414,18 @@ async function validateScenarios(root, config) {
   }
   const issues = [];
   for (const entry of entries) {
+    const legacyScenarioPath = import_node_path15.default.join(entry.dir, "scenario.md");
+    if (await fileExists(legacyScenarioPath)) {
+      issues.push(
+        issue4(
+          "QFAI-SC-004",
+          "scenario.md \u306F\u975E\u5BFE\u5FDC\u3067\u3059\u3002scenario.feature \u3078\u79FB\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          legacyScenarioPath,
+          "scenario.legacy"
+        )
+      );
+    }
     let text;
     try {
       text = await (0, import_promises12.readFile)(entry.scenarioPath, "utf-8");
@@ -2006,6 +2457,7 @@ function validateScenarioContent(text, file) {
     "UI",
     "API",
     "DB",
+    "THEMA",
     "ADR"
   ]);
   if (invalidIds.length > 0) {
@@ -2149,6 +2601,14 @@ function isMissingFileError3(error) {
   }
   return error.code === "ENOENT";
 }
+async function fileExists(target) {
+  try {
+    await (0, import_promises12.access)(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/core/validators/spec.ts
 var import_promises13 = require("fs/promises");
@@ -2208,6 +2668,7 @@ function validateSpecContent(text, file, requiredSections) {
     "UI",
     "API",
     "DB",
+    "THEMA",
     "ADR"
   ]);
   if (invalidIds.length > 0) {
@@ -2387,7 +2848,7 @@ async function validateTraceability(root, config) {
             "QFAI-TRACE-021",
             `Spec \u306E\u5951\u7D04 ID \u304C\u4E0D\u6B63\u3067\u3059: ${contractRefs.invalidTokens.join(
               ", "
-            )} (\u4F8B: UI-0001 / API-0001 / DB-0001)`,
+            )} (\u4F8B: UI-0001 / API-0001 / DB-0001 / THEMA-001)`,
             "error",
             file,
             "traceability.specContractRefFormat",
@@ -2451,7 +2912,7 @@ async function validateTraceability(root, config) {
             "QFAI-TRACE-032",
             `Scenario \u306E\u5951\u7D04 ID \u304C\u4E0D\u6B63\u3067\u3059: ${scenarioContractRefs.invalidTokens.join(
               ", "
-            )} (\u4F8B: UI-0001 / API-0001 / DB-0001)`,
+            )} (\u4F8B: UI-0001 / API-0001 / DB-0001 / THEMA-001)`,
             "error",
             file,
             "traceability.scenarioContractRefFormat",
@@ -2830,17 +3291,25 @@ function countIssues(issues) {
 }
 
 // src/core/report.ts
-var ID_PREFIXES2 = ["SPEC", "BR", "SC", "UI", "API", "DB"];
+var ID_PREFIXES2 = [
+  "SPEC",
+  "BR",
+  "SC",
+  "UI",
+  "API",
+  "DB",
+  "THEMA"
+];
 async function createReportData(root, validation, configResult) {
-  const resolvedRoot = import_node_path14.default.resolve(root);
+  const resolvedRoot = import_node_path16.default.resolve(root);
   const resolved = configResult ?? await loadConfig(resolvedRoot);
   const config = resolved.config;
   const configPath = resolved.configPath;
   const specsRoot = resolvePath(resolvedRoot, config, "specsDir");
   const contractsRoot = resolvePath(resolvedRoot, config, "contractsDir");
-  const apiRoot = import_node_path14.default.join(contractsRoot, "api");
-  const uiRoot = import_node_path14.default.join(contractsRoot, "ui");
-  const dbRoot = import_node_path14.default.join(contractsRoot, "db");
+  const apiRoot = import_node_path16.default.join(contractsRoot, "api");
+  const uiRoot = import_node_path16.default.join(contractsRoot, "ui");
+  const dbRoot = import_node_path16.default.join(contractsRoot, "db");
   const srcRoot = resolvePath(resolvedRoot, config, "srcDir");
   const testsRoot = resolvePath(resolvedRoot, config, "testsDir");
   const specFiles = await collectSpecFiles(specsRoot);
@@ -2848,7 +3317,8 @@ async function createReportData(root, validation, configResult) {
   const {
     api: apiFiles,
     ui: uiFiles,
-    db: dbFiles
+    db: dbFiles,
+    thema: themaFiles
   } = await collectContractFiles(uiRoot, apiRoot, dbRoot);
   const contractIndex = await buildContractIndex(resolvedRoot, config);
   const contractIdList = Array.from(contractIndex.ids);
@@ -2875,7 +3345,8 @@ async function createReportData(root, validation, configResult) {
     ...scenarioFiles,
     ...apiFiles,
     ...uiFiles,
-    ...dbFiles
+    ...dbFiles,
+    ...themaFiles
   ]);
   const upstreamIds = await collectUpstreamIds([
     ...specFiles,
@@ -2912,7 +3383,8 @@ async function createReportData(root, validation, configResult) {
       contracts: {
         api: apiFiles.length,
         ui: uiFiles.length,
-        db: dbFiles.length
+        db: dbFiles.length,
+        thema: themaFiles.length
       },
       counts: normalizedValidation.counts
     },
@@ -2922,7 +3394,8 @@ async function createReportData(root, validation, configResult) {
       sc: idsByPrefix.SC,
       ui: idsByPrefix.UI,
       api: idsByPrefix.API,
-      db: idsByPrefix.DB
+      db: idsByPrefix.DB,
+      thema: idsByPrefix.THEMA
     },
     traceability: {
       upstreamIdsFound: upstreamIds.size,
@@ -2992,7 +3465,7 @@ function formatReportMarkdown(data, options = {}) {
   lines.push(`- specs: ${data.summary.specs}`);
   lines.push(`- scenarios: ${data.summary.scenarios}`);
   lines.push(
-    `- contracts: api ${data.summary.contracts.api} / ui ${data.summary.contracts.ui} / db ${data.summary.contracts.db}`
+    `- contracts: api ${data.summary.contracts.api} / ui ${data.summary.contracts.ui} / db ${data.summary.contracts.db} / thema ${data.summary.contracts.thema}`
   );
   lines.push(
     `- issues(total): info ${data.summary.counts.info} / warning ${data.summary.counts.warning} / error ${data.summary.counts.error}`
@@ -3136,6 +3609,7 @@ function formatReportMarkdown(data, options = {}) {
   lines.push(formatIdLine("UI", data.ids.ui));
   lines.push(formatIdLine("API", data.ids.api));
   lines.push(formatIdLine("DB", data.ids.db));
+  lines.push(formatIdLine("THEMA", data.ids.thema));
   lines.push("");
   lines.push("## Traceability");
   lines.push("");
@@ -3357,7 +3831,8 @@ async function collectIds(files) {
     SC: /* @__PURE__ */ new Set(),
     UI: /* @__PURE__ */ new Set(),
     API: /* @__PURE__ */ new Set(),
-    DB: /* @__PURE__ */ new Set()
+    DB: /* @__PURE__ */ new Set(),
+    THEMA: /* @__PURE__ */ new Set()
   };
   for (const file of files) {
     const text = await (0, import_promises15.readFile)(file, "utf-8");
@@ -3372,7 +3847,8 @@ async function collectIds(files) {
     SC: toSortedArray2(result.SC),
     UI: toSortedArray2(result.UI),
     API: toSortedArray2(result.API),
-    DB: toSortedArray2(result.DB)
+    DB: toSortedArray2(result.DB),
+    THEMA: toSortedArray2(result.THEMA)
   };
 }
 async function collectUpstreamIds(files) {