qfai 1.0.2 → 1.0.3

package/dist/index.mjs

@@ -399,7 +399,15 @@ function isRecord(value) {
 }
 
 // src/core/ids.ts
-var ID_PREFIXES = ["SPEC", "BR", "SC", "UI", "API", "DB"];
+var ID_PREFIXES = [
+  "SPEC",
+  "BR",
+  "SC",
+  "UI",
+  "API",
+  "DB",
+  "THEMA"
+];
 var STRICT_ID_PATTERNS = {
   SPEC: /\bSPEC-\d{4}\b/g,
   BR: /\bBR-\d{4}\b/g,
@@ -407,6 +415,7 @@ var STRICT_ID_PATTERNS = {
   UI: /\bUI-\d{4}\b/g,
   API: /\bAPI-\d{4}\b/g,
   DB: /\bDB-\d{4}\b/g,
+  THEMA: /\bTHEMA-\d{3}\b/g,
   ADR: /\bADR-\d{4}\b/g
 };
 var LOOSE_ID_PATTERNS = {
@@ -416,6 +425,7 @@ var LOOSE_ID_PATTERNS = {
   UI: /\bUI-[A-Za-z0-9_-]+\b/gi,
   API: /\bAPI-[A-Za-z0-9_-]+\b/gi,
   DB: /\bDB-[A-Za-z0-9_-]+\b/gi,
+  THEMA: /\bTHEMA-[A-Za-z0-9_-]+\b/gi,
   ADR: /\bADR-[A-Za-z0-9_-]+\b/gi
 };
 function extractIds(text, prefix) {
@@ -453,14 +463,15 @@ function isValidId(value, prefix) {
 
 // src/core/report.ts
 import { readFile as readFile12 } from "fs/promises";
-import path14 from "path";
+import path16 from "path";
 
 // src/core/contractIndex.ts
 import { readFile as readFile2 } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 
 // src/core/discovery.ts
 import { access as access3 } from "fs/promises";
+import path4 from "path";
 
 // src/core/fs.ts
 import { access as access2, readdir } from "fs/promises";
@@ -609,7 +620,12 @@ async function collectScenarioFiles(specsRoot) {
   return filterExisting(entries.map((entry) => entry.scenarioPath));
 }
 async function collectUiContractFiles(uiRoot) {
-  return collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  const files = await collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  return filterByBasenamePrefix(files, "ui-");
+}
+async function collectThemaContractFiles(uiRoot) {
+  const files = await collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  return filterByBasenamePrefix(files, "thema-");
 }
 async function collectApiContractFiles(apiRoot) {
   return collectFiles(apiRoot, { extensions: [".yaml", ".yml", ".json"] });
@@ -618,12 +634,13 @@ async function collectDbContractFiles(dbRoot) {
   return collectFiles(dbRoot, { extensions: [".sql"] });
 }
 async function collectContractFiles(uiRoot, apiRoot, dbRoot) {
-  const [ui, api, db] = await Promise.all([
+  const [ui, thema, api, db] = await Promise.all([
     collectUiContractFiles(uiRoot),
+    collectThemaContractFiles(uiRoot),
     collectApiContractFiles(apiRoot),
     collectDbContractFiles(dbRoot)
   ]);
-  return { ui, api, db };
+  return { ui, thema, api, db };
 }
 async function filterExisting(files) {
   const existing = [];
@@ -642,10 +659,16 @@ async function exists3(target) {
     return false;
   }
 }
+function filterByBasenamePrefix(files, prefix) {
+  const lowerPrefix = prefix.toLowerCase();
+  return files.filter(
+    (file) => path4.basename(file).toLowerCase().startsWith(lowerPrefix)
+  );
+}
 
 // src/core/contractsDecl.ts
-var CONTRACT_DECLARATION_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*((?:API|UI|DB)-\d{4})\s*(?:\*\/)?\s*$/gm;
-var CONTRACT_DECLARATION_LINE_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*(?:API|UI|DB)-\d{4}\s*(?:\*\/)?\s*$/;
+var CONTRACT_DECLARATION_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*((?:API|UI|DB)-\d{4}|THEMA-\d{3})\s*(?:\*\/)?\s*$/gm;
+var CONTRACT_DECLARATION_LINE_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*(?:(?:API|UI|DB)-\d{4}|THEMA-\d{3})\s*(?:\*\/)?\s*$/;
 function extractDeclaredContractIds(text) {
   const ids = [];
   for (const match of text.matchAll(CONTRACT_DECLARATION_RE)) {
@@ -663,20 +686,22 @@ function stripContractDeclarationLines(text) {
 // src/core/contractIndex.ts
 async function buildContractIndex(root, config) {
   const contractsRoot = resolvePath(root, config, "contractsDir");
-  const uiRoot = path4.join(contractsRoot, "ui");
-  const apiRoot = path4.join(contractsRoot, "api");
-  const dbRoot = path4.join(contractsRoot, "db");
-  const [uiFiles, apiFiles, dbFiles] = await Promise.all([
+  const uiRoot = path5.join(contractsRoot, "ui");
+  const apiRoot = path5.join(contractsRoot, "api");
+  const dbRoot = path5.join(contractsRoot, "db");
+  const [uiFiles, themaFiles, apiFiles, dbFiles] = await Promise.all([
     collectUiContractFiles(uiRoot),
+    collectThemaContractFiles(uiRoot),
     collectApiContractFiles(apiRoot),
     collectDbContractFiles(dbRoot)
   ]);
   const index = {
     ids: /* @__PURE__ */ new Set(),
     idToFiles: /* @__PURE__ */ new Map(),
-    files: { ui: uiFiles, api: apiFiles, db: dbFiles }
+    files: { ui: uiFiles, thema: themaFiles, api: apiFiles, db: dbFiles }
   };
   await indexContractFiles(uiFiles, index);
+  await indexContractFiles(themaFiles, index);
   await indexContractFiles(apiFiles, index);
   await indexContractFiles(dbFiles, index);
   return index;
@@ -695,15 +720,15 @@ function record(index, id, file) {
 }
 
 // src/core/paths.ts
-import path5 from "path";
+import path6 from "path";
 function toRelativePath(root, target) {
   if (!target) {
     return target;
   }
-  if (!path5.isAbsolute(target)) {
+  if (!path6.isAbsolute(target)) {
     return toPosixPath(target);
   }
-  const relative = path5.relative(root, target);
+  const relative = path6.relative(root, target);
   if (!relative) {
     return ".";
   }
@@ -751,7 +776,7 @@ function normalizeValidationResult(root, result) {
 }
 
 // src/core/parse/contractRefs.ts
-var CONTRACT_REF_ID_RE = /^(?:API|UI|DB)-\d{4}$/;
+var CONTRACT_REF_ID_RE = /^(?:(?:API|UI|DB)-\d{4}|THEMA-\d{3})$/;
 function parseContractRefs(text, options = {}) {
   const linePattern = buildLinePattern(options);
   const lines = [];
@@ -922,7 +947,7 @@ function parseSpec(md, file) {
 
 // src/core/traceability.ts
 import { readFile as readFile3 } from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 
 // src/core/gherkin/parse.ts
 import {
@@ -1154,7 +1179,7 @@ async function collectScTestReferences(root, globs, excludeGlobs) {
     };
   }
   const normalizedFiles = Array.from(
-    new Set(scanResult.files.map((file) => path6.normalize(file)))
+    new Set(scanResult.files.map((file) => path7.normalize(file)))
   );
   for (const file of normalizedFiles) {
     const text = await readFile3(file, "utf-8");
@@ -1217,11 +1242,11 @@ function formatError3(error) {
 
 // src/core/version.ts
 import { readFile as readFile4 } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 import { fileURLToPath } from "url";
 async function resolveToolVersion() {
-  if ("1.0.2".length > 0) {
-    return "1.0.2";
+  if ("1.0.3".length > 0) {
+    return "1.0.3";
   }
   try {
     const packagePath = resolvePackageJsonPath();
@@ -1236,18 +1261,18 @@ async function resolveToolVersion() {
 function resolvePackageJsonPath() {
   const base = import.meta.url;
   const basePath = base.startsWith("file:") ? fileURLToPath(base) : base;
-  return path7.resolve(path7.dirname(basePath), "../../package.json");
+  return path8.resolve(path8.dirname(basePath), "../../package.json");
 }
 
 // src/core/validators/contracts.ts
-import { readFile as readFile5 } from "fs/promises";
-import path9 from "path";
+import { access as access4, readFile as readFile5 } from "fs/promises";
+import path10 from "path";
 
 // src/core/contracts.ts
-import path8 from "path";
+import path9 from "path";
 import { parse as parseYaml2 } from "yaml";
 function parseStructuredContract(file, text) {
-  const ext = path8.extname(file).toLowerCase();
+  const ext = path9.extname(file).toLowerCase();
   if (ext === ".json") {
     return JSON.parse(text);
   }
@@ -1264,17 +1289,23 @@ var SQL_DANGEROUS_PATTERNS = [
     label: "ALTER TABLE ... DROP"
   }
 ];
+var THEMA_ID_RE = /^THEMA-\d{3}$/;
 async function validateContracts(root, config) {
   const issues = [];
-  const contractsRoot = resolvePath(root, config, "contractsDir");
-  issues.push(...await validateUiContracts(path9.join(contractsRoot, "ui")));
-  issues.push(...await validateApiContracts(path9.join(contractsRoot, "api")));
-  issues.push(...await validateDbContracts(path9.join(contractsRoot, "db")));
   const contractIndex = await buildContractIndex(root, config);
+  const contractsRoot = resolvePath(root, config, "contractsDir");
+  const uiRoot = path10.join(contractsRoot, "ui");
+  const themaIds = new Set(
+    Array.from(contractIndex.ids).filter((id) => id.startsWith("THEMA-"))
+  );
+  issues.push(...await validateUiContracts(uiRoot, themaIds));
+  issues.push(...await validateThemaContracts(uiRoot));
+  issues.push(...await validateApiContracts(path10.join(contractsRoot, "api")));
+  issues.push(...await validateDbContracts(path10.join(contractsRoot, "db")));
   issues.push(...validateDuplicateContractIds(contractIndex));
   return issues;
 }
-async function validateUiContracts(uiRoot) {
+async function validateUiContracts(uiRoot, themaIds) {
   const files = await collectUiContractFiles(uiRoot);
   if (files.length === 0) {
     return [
@@ -1288,6 +1319,60 @@ async function validateUiContracts(uiRoot) {
     ];
   }
   const issues = [];
+  for (const file of files) {
+    const text = await readFile5(file, "utf-8");
+    const declaredIds = extractDeclaredContractIds(text);
+    issues.push(...validateDeclaredContractIds(declaredIds, file, "UI"));
+    let doc = null;
+    try {
+      doc = parseStructuredContract(file, stripContractDeclarationLines(text));
+    } catch (error) {
+      issues.push(
+        issue(
+          "QFAI-CONTRACT-001",
+          `UI \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
+          "error",
+          file,
+          "contracts.ui.parse"
+        )
+      );
+    }
+    const invalidIds = extractInvalidIds(text, [
+      "SPEC",
+      "BR",
+      "SC",
+      "UI",
+      "API",
+      "DB",
+      "THEMA",
+      "ADR"
+    ]).filter((id) => !shouldIgnoreInvalidId(id, doc));
+    if (invalidIds.length > 0) {
+      issues.push(
+        issue(
+          "QFAI-ID-002",
+          `ID \u30D5\u30A9\u30FC\u30DE\u30C3\u30C8\u304C\u4E0D\u6B63\u3067\u3059: ${invalidIds.join(", ")}`,
+          "error",
+          file,
+          "id.format",
+          invalidIds
+        )
+      );
+    }
+    if (doc) {
+      issues.push(
+        ...await validateUiContractDoc(doc, file, uiRoot, themaIds)
+      );
+    }
+  }
+  return issues;
+}
+async function validateThemaContracts(uiRoot) {
+  const files = await collectThemaContractFiles(uiRoot);
+  if (files.length === 0) {
+    return [];
+  }
+  const issues = [];
   for (const file of files) {
     const text = await readFile5(file, "utf-8");
     const invalidIds = extractInvalidIds(text, [
@@ -1297,6 +1382,7 @@ async function validateUiContracts(uiRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1312,17 +1398,95 @@ async function validateUiContracts(uiRoot) {
       );
     }
     const declaredIds = extractDeclaredContractIds(text);
-    issues.push(...validateDeclaredContractIds(declaredIds, file, "UI"));
+    if (declaredIds.length === 0) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-010",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306B QFAI-CONTRACT-ID \u304C\u3042\u308A\u307E\u305B\u3093: ${file}`,
+          "error",
+          file,
+          "contracts.thema.declaration"
+        )
+      );
+      continue;
+    }
+    if (declaredIds.length > 1) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-011",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306B\u8907\u6570\u306E QFAI-CONTRACT-ID \u304C\u5BA3\u8A00\u3055\u308C\u3066\u3044\u307E\u3059: ${declaredIds.join(
+            ", "
+          )}`,
+          "error",
+          file,
+          "contracts.thema.declaration",
+          declaredIds
+        )
+      );
+      continue;
+    }
+    const declaredId = declaredIds[0] ?? "";
+    if (!THEMA_ID_RE.test(declaredId)) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-012",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E ID \u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${declaredId}`,
+          "error",
+          file,
+          "contracts.thema.idFormat",
+          [declaredId]
+        )
+      );
+    }
+    let doc;
     try {
-      parseStructuredContract(file, stripContractDeclarationLines(text));
+      doc = parseStructuredContract(file, stripContractDeclarationLines(text));
     } catch (error) {
       issues.push(
         issue(
-          "QFAI-CONTRACT-001",
-          `UI \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
+          "QFAI-THEMA-001",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
           "error",
           file,
-          "contracts.ui.parse"
+          "contracts.thema.parse"
+        )
+      );
+      continue;
+    }
+    const docId = typeof doc.id === "string" ? doc.id : "";
+    if (!THEMA_ID_RE.test(docId)) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-012",
+          docId.length > 0 ? `thema \u306E id \u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${docId}` : "thema \u306E id \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+          "error",
+          file,
+          "contracts.thema.idFormat",
+          docId.length > 0 ? [docId] : void 0
+        )
+      );
+    }
+    const name = typeof doc.name === "string" ? doc.name : "";
+    if (!name) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-014",
+          "thema \u306E name \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+          "error",
+          file,
+          "contracts.thema.name"
+        )
+      );
+    }
+    if (declaredId && docId && declaredId !== docId) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-013",
+          `thema \u306E\u5BA3\u8A00 ID \u3068 id \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093: ${declaredId} / ${docId}`,
+          "error",
+          file,
+          "contracts.thema.idMismatch",
+          [declaredId, docId]
         )
       );
     }
@@ -1352,6 +1516,7 @@ async function validateApiContracts(apiRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1420,6 +1585,7 @@ async function validateDbContracts(dbRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1526,6 +1692,278 @@ function validateDuplicateContractIds(contractIndex) {
 function hasOpenApi(doc) {
   return typeof doc.openapi === "string" && doc.openapi.length > 0;
 }
+async function validateUiContractDoc(doc, file, uiRoot, themaIds) {
+  const issues = [];
+  if (Object.prototype.hasOwnProperty.call(doc, "themaRef")) {
+    const themaRef = doc.themaRef;
+    if (typeof themaRef !== "string" || themaRef.length === 0) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          "themaRef \u306F THEMA-001 \u5F62\u5F0F\u306E\u6587\u5B57\u5217\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          file,
+          "contracts.ui.themaRef"
+        )
+      );
+    } else if (!THEMA_ID_RE.test(themaRef)) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          `themaRef \u306E\u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${themaRef}`,
+          "error",
+          file,
+          "contracts.ui.themaRef",
+          [themaRef]
+        )
+      );
+    } else if (!themaIds.has(themaRef)) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          `themaRef \u304C\u5B58\u5728\u3057\u306A\u3044 THEMA \u3092\u53C2\u7167\u3057\u3066\u3044\u307E\u3059: ${themaRef}`,
+          "error",
+          file,
+          "contracts.ui.themaRef",
+          [themaRef]
+        )
+      );
+    }
+  }
+  const assets = doc.assets;
+  if (assets && typeof assets === "object") {
+    issues.push(
+      ...await validateUiAssets(
+        assets,
+        file,
+        uiRoot
+      )
+    );
+  }
+  return issues;
+}
+async function validateUiAssets(assets, file, uiRoot) {
+  const issues = [];
+  const packValue = assets.pack;
+  const useValue = assets.use;
+  if (packValue === void 0 && useValue === void 0) {
+    return issues;
+  }
+  if (typeof packValue !== "string" || packValue.length === 0) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        "assets.pack \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "error",
+        file,
+        "assets.pack"
+      )
+    );
+    return issues;
+  }
+  if (!isSafeRelativePath(packValue)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306F ui/ \u914D\u4E0B\u306E\u76F8\u5BFE\u30D1\u30B9\u306E\u307F\u8A31\u53EF\u3055\u308C\u307E\u3059: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  const packDir = path10.resolve(uiRoot, packValue);
+  const packRelative = path10.relative(uiRoot, packDir);
+  if (packRelative.startsWith("..") || path10.isAbsolute(packRelative)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306F ui/ \u914D\u4E0B\u306B\u9650\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  if (!await exists4(packDir)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u5B58\u5728\u3057\u307E\u305B\u3093: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  const assetsYamlPath = path10.join(packDir, "assets.yaml");
+  if (!await exists4(assetsYamlPath)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-002",
+        `assets.yaml \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${assetsYamlPath}`,
+        "error",
+        assetsYamlPath,
+        "assets.yaml"
+      )
+    );
+    return issues;
+  }
+  let manifest;
+  try {
+    const manifestText = await readFile5(assetsYamlPath, "utf-8");
+    manifest = parseStructuredContract(assetsYamlPath, manifestText);
+  } catch (error) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-002",
+        `assets.yaml \u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${assetsYamlPath} (${formatError4(error)})`,
+        "error",
+        assetsYamlPath,
+        "assets.yaml"
+      )
+    );
+    return issues;
+  }
+  const items = Array.isArray(manifest.items) ? manifest.items : [];
+  const itemIds = /* @__PURE__ */ new Set();
+  const itemPaths = [];
+  for (const item of items) {
+    if (!item || typeof item !== "object") {
+      continue;
+    }
+    const record2 = item;
+    const id = typeof record2.id === "string" ? record2.id : void 0;
+    const pathValue = typeof record2.path === "string" ? record2.path : void 0;
+    if (id) {
+      itemIds.add(id);
+    }
+    itemPaths.push({ id, path: pathValue });
+  }
+  if (useValue !== void 0) {
+    if (!Array.isArray(useValue) || useValue.some((entry) => typeof entry !== "string")) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-003",
+          "assets.use \u306F\u6587\u5B57\u5217\u914D\u5217\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          file,
+          "assets.use"
+        )
+      );
+    } else {
+      const missing = useValue.filter((entry) => !itemIds.has(entry));
+      if (missing.length > 0) {
+        issues.push(
+          issue(
+            "QFAI-ASSET-003",
+            `assets.use \u304C assets.yaml \u306B\u5B58\u5728\u3057\u307E\u305B\u3093: ${missing.join(", ")}`,
+            "error",
+            file,
+            "assets.use",
+            missing
+          )
+        );
+      }
+    }
+  }
+  for (const entry of itemPaths) {
+    if (!entry.path) {
+      continue;
+    }
+    if (!isSafeRelativePath(entry.path)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C\u4E0D\u6B63\u3067\u3059: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+      continue;
+    }
+    const assetPath = path10.resolve(packDir, entry.path);
+    const assetRelative = path10.relative(packDir, assetPath);
+    if (assetRelative.startsWith("..") || path10.isAbsolute(assetRelative)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C packDir \u3092\u9038\u8131\u3057\u3066\u3044\u307E\u3059: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+      continue;
+    }
+    if (!await exists4(assetPath)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C\u5B58\u5728\u3057\u307E\u305B\u3093: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+    }
+  }
+  return issues;
+}
+function shouldIgnoreInvalidId(value, doc) {
+  if (!doc) {
+    return false;
+  }
+  const assets = doc.assets;
+  if (!assets || typeof assets !== "object") {
+    return false;
+  }
+  const packValue = assets.pack;
+  if (typeof packValue !== "string" || packValue.length === 0) {
+    return false;
+  }
+  const normalized = packValue.replace(/\\/g, "/");
+  const basename = path10.posix.basename(normalized);
+  if (!basename) {
+    return false;
+  }
+  return value.toLowerCase() === basename.toLowerCase();
+}
+function isSafeRelativePath(value) {
+  if (!value) {
+    return false;
+  }
+  if (path10.isAbsolute(value)) {
+    return false;
+  }
+  const normalized = value.replace(/\\/g, "/");
+  if (/^[A-Za-z]:/.test(normalized)) {
+    return false;
+  }
+  const segments = normalized.split("/");
+  if (segments.some((segment) => segment === "..")) {
+    return false;
+  }
+  return true;
+}
+async function exists4(target) {
+  try {
+    await access4(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function formatError4(error) {
   if (error instanceof Error) {
     return error.message;
@@ -1556,7 +1994,7 @@ function issue(code, message, severity, file, rule, refs, category = "compatibil
 
 // src/core/validators/delta.ts
 import { readFile as readFile6 } from "fs/promises";
-import path10 from "path";
+import path11 from "path";
 var SECTION_RE = /^##\s+変更区分/m;
 var COMPAT_LINE_RE = /^\s*-\s*\[[ xX]\]\s*Compatibility\b/m;
 var CHANGE_LINE_RE = /^\s*-\s*\[[ xX]\]\s*Change\/Improvement\b/m;
@@ -1570,7 +2008,7 @@ async function validateDeltas(root, config) {
   }
   const issues = [];
   for (const pack of packs) {
-    const deltaPath = path10.join(pack, "delta.md");
+    const deltaPath = path11.join(pack, "delta.md");
     let text;
     try {
       text = await readFile6(deltaPath, "utf-8");
@@ -1650,7 +2088,7 @@ function issue2(code, message, severity, file, rule, refs, category = "change",
 
 // src/core/validators/ids.ts
 import { readFile as readFile7 } from "fs/promises";
-import path11 from "path";
+import path12 from "path";
 var SC_TAG_RE3 = /^SC-\d{4}$/;
 async function validateDefinedIds(root, config) {
   const issues = [];
@@ -1716,7 +2154,7 @@ function recordId(out, id, file) {
 }
 function formatFileList(files, root) {
   return files.map((file) => {
-    const relative = path11.relative(root, file);
+    const relative = path12.relative(root, file);
     return relative.length > 0 ? relative : file;
   }).join(", ");
 }
@@ -1744,19 +2182,19 @@ function issue3(code, message, severity, file, rule, refs, category = "compatibi
 
 // src/core/promptsIntegrity.ts
 import { readFile as readFile8 } from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 
 // src/shared/assets.ts
 import { existsSync } from "fs";
-import path12 from "path";
+import path13 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getInitAssetsDir() {
   const base = import.meta.url;
   const basePath = base.startsWith("file:") ? fileURLToPath2(base) : base;
-  const baseDir = path12.dirname(basePath);
+  const baseDir = path13.dirname(basePath);
   const candidates = [
-    path12.resolve(baseDir, "../../../assets/init"),
-    path12.resolve(baseDir, "../../assets/init")
+    path13.resolve(baseDir, "../../../assets/init"),
+    path13.resolve(baseDir, "../../assets/init")
   ];
   for (const candidate of candidates) {
     if (existsSync(candidate)) {
@@ -1774,10 +2212,10 @@ function getInitAssetsDir() {
 
 // src/core/promptsIntegrity.ts
 async function diffProjectPromptsAgainstInitAssets(root) {
-  const promptsDir = path13.resolve(root, ".qfai", "prompts");
+  const promptsDir = path14.resolve(root, ".qfai", "prompts");
   let templateDir;
   try {
-    templateDir = path13.join(getInitAssetsDir(), ".qfai", "prompts");
+    templateDir = path14.join(getInitAssetsDir(), ".qfai", "prompts");
   } catch {
     return {
       status: "skipped_missing_assets",
@@ -1854,7 +2292,7 @@ function normalizeNewlines(text) {
   return text.replace(/\r\n/g, "\n");
 }
 function toRel(base, abs) {
-  const rel = path13.relative(base, abs);
+  const rel = path14.relative(base, abs);
   return rel.replace(/[\\/]+/g, "/");
 }
 function intersectKeys(a, b) {
@@ -1899,7 +2337,8 @@ async function validatePromptsIntegrity(root) {
 }
 
 // src/core/validators/scenario.ts
-import { readFile as readFile9 } from "fs/promises";
+import { access as access5, readFile as readFile9 } from "fs/promises";
+import path15 from "path";
 var GIVEN_PATTERN = /\bGiven\b/;
 var WHEN_PATTERN = /\bWhen\b/;
 var THEN_PATTERN = /\bThen\b/;
@@ -1922,6 +2361,18 @@ async function validateScenarios(root, config) {
   }
   const issues = [];
   for (const entry of entries) {
+    const legacyScenarioPath = path15.join(entry.dir, "scenario.md");
+    if (await fileExists(legacyScenarioPath)) {
+      issues.push(
+        issue4(
+          "QFAI-SC-004",
+          "scenario.md \u306F\u975E\u5BFE\u5FDC\u3067\u3059\u3002scenario.feature \u3078\u79FB\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          legacyScenarioPath,
+          "scenario.legacy"
+        )
+      );
+    }
     let text;
     try {
       text = await readFile9(entry.scenarioPath, "utf-8");
@@ -1953,6 +2404,7 @@ function validateScenarioContent(text, file) {
     "UI",
     "API",
     "DB",
+    "THEMA",
     "ADR"
   ]);
   if (invalidIds.length > 0) {
@@ -2096,6 +2548,14 @@ function isMissingFileError3(error) {
   }
   return error.code === "ENOENT";
 }
+async function fileExists(target) {
+  try {
+    await access5(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/core/validators/spec.ts
 import { readFile as readFile10 } from "fs/promises";
@@ -2155,6 +2615,7 @@ function validateSpecContent(text, file, requiredSections) {
     "UI",
     "API",
     "DB",
+    "THEMA",
     "ADR"
   ]);
   if (invalidIds.length > 0) {
@@ -2334,7 +2795,7 @@ async function validateTraceability(root, config) {
             "QFAI-TRACE-021",
             `Spec \u306E\u5951\u7D04 ID \u304C\u4E0D\u6B63\u3067\u3059: ${contractRefs.invalidTokens.join(
               ", "
-            )} (\u4F8B: UI-0001 / API-0001 / DB-0001)`,
+            )} (\u4F8B: UI-0001 / API-0001 / DB-0001 / THEMA-001)`,
             "error",
             file,
             "traceability.specContractRefFormat",
@@ -2398,7 +2859,7 @@ async function validateTraceability(root, config) {
             "QFAI-TRACE-032",
             `Scenario \u306E\u5951\u7D04 ID \u304C\u4E0D\u6B63\u3067\u3059: ${scenarioContractRefs.invalidTokens.join(
               ", "
-            )} (\u4F8B: UI-0001 / API-0001 / DB-0001)`,
+            )} (\u4F8B: UI-0001 / API-0001 / DB-0001 / THEMA-001)`,
             "error",
             file,
             "traceability.scenarioContractRefFormat",
@@ -2777,17 +3238,25 @@ function countIssues(issues) {
 }
 
 // src/core/report.ts
-var ID_PREFIXES2 = ["SPEC", "BR", "SC", "UI", "API", "DB"];
+var ID_PREFIXES2 = [
+  "SPEC",
+  "BR",
+  "SC",
+  "UI",
+  "API",
+  "DB",
+  "THEMA"
+];
 async function createReportData(root, validation, configResult) {
-  const resolvedRoot = path14.resolve(root);
+  const resolvedRoot = path16.resolve(root);
   const resolved = configResult ?? await loadConfig(resolvedRoot);
   const config = resolved.config;
   const configPath = resolved.configPath;
   const specsRoot = resolvePath(resolvedRoot, config, "specsDir");
   const contractsRoot = resolvePath(resolvedRoot, config, "contractsDir");
-  const apiRoot = path14.join(contractsRoot, "api");
-  const uiRoot = path14.join(contractsRoot, "ui");
-  const dbRoot = path14.join(contractsRoot, "db");
+  const apiRoot = path16.join(contractsRoot, "api");
+  const uiRoot = path16.join(contractsRoot, "ui");
+  const dbRoot = path16.join(contractsRoot, "db");
   const srcRoot = resolvePath(resolvedRoot, config, "srcDir");
   const testsRoot = resolvePath(resolvedRoot, config, "testsDir");
   const specFiles = await collectSpecFiles(specsRoot);
@@ -2795,7 +3264,8 @@ async function createReportData(root, validation, configResult) {
   const {
     api: apiFiles,
     ui: uiFiles,
-    db: dbFiles
+    db: dbFiles,
+    thema: themaFiles
   } = await collectContractFiles(uiRoot, apiRoot, dbRoot);
   const contractIndex = await buildContractIndex(resolvedRoot, config);
   const contractIdList = Array.from(contractIndex.ids);
@@ -2822,7 +3292,8 @@ async function createReportData(root, validation, configResult) {
     ...scenarioFiles,
     ...apiFiles,
     ...uiFiles,
-    ...dbFiles
+    ...dbFiles,
+    ...themaFiles
   ]);
   const upstreamIds = await collectUpstreamIds([
     ...specFiles,
@@ -2859,7 +3330,8 @@ async function createReportData(root, validation, configResult) {
       contracts: {
         api: apiFiles.length,
         ui: uiFiles.length,
-        db: dbFiles.length
+        db: dbFiles.length,
+        thema: themaFiles.length
       },
       counts: normalizedValidation.counts
     },
@@ -2869,7 +3341,8 @@ async function createReportData(root, validation, configResult) {
       sc: idsByPrefix.SC,
       ui: idsByPrefix.UI,
       api: idsByPrefix.API,
-      db: idsByPrefix.DB
+      db: idsByPrefix.DB,
+      thema: idsByPrefix.THEMA
     },
     traceability: {
       upstreamIdsFound: upstreamIds.size,
@@ -2939,7 +3412,7 @@ function formatReportMarkdown(data, options = {}) {
   lines.push(`- specs: ${data.summary.specs}`);
   lines.push(`- scenarios: ${data.summary.scenarios}`);
   lines.push(
-    `- contracts: api ${data.summary.contracts.api} / ui ${data.summary.contracts.ui} / db ${data.summary.contracts.db}`
+    `- contracts: api ${data.summary.contracts.api} / ui ${data.summary.contracts.ui} / db ${data.summary.contracts.db} / thema ${data.summary.contracts.thema}`
   );
   lines.push(
     `- issues(total): info ${data.summary.counts.info} / warning ${data.summary.counts.warning} / error ${data.summary.counts.error}`
@@ -3083,6 +3556,7 @@ function formatReportMarkdown(data, options = {}) {
   lines.push(formatIdLine("UI", data.ids.ui));
   lines.push(formatIdLine("API", data.ids.api));
   lines.push(formatIdLine("DB", data.ids.db));
+  lines.push(formatIdLine("THEMA", data.ids.thema));
   lines.push("");
   lines.push("## Traceability");
   lines.push("");
@@ -3304,7 +3778,8 @@ async function collectIds(files) {
     SC: /* @__PURE__ */ new Set(),
     UI: /* @__PURE__ */ new Set(),
     API: /* @__PURE__ */ new Set(),
-    DB: /* @__PURE__ */ new Set()
+    DB: /* @__PURE__ */ new Set(),
+    THEMA: /* @__PURE__ */ new Set()
   };
   for (const file of files) {
     const text = await readFile12(file, "utf-8");
@@ -3319,7 +3794,8 @@ async function collectIds(files) {
     SC: toSortedArray2(result.SC),
     UI: toSortedArray2(result.UI),
     API: toSortedArray2(result.API),
-    DB: toSortedArray2(result.DB)
+    DB: toSortedArray2(result.DB),
+    THEMA: toSortedArray2(result.THEMA)
   };
 }
 async function collectUpstreamIds(files) {