qfai 1.0.2 → 1.0.4

package/dist/index.mjs

@@ -6,7 +6,6 @@ var defaultConfig = {
   paths: {
     contractsDir: ".qfai/contracts",
     specsDir: ".qfai/specs",
-    rulesDir: ".qfai/rules",
     outDir: ".qfai/out",
     promptsDir: ".qfai/prompts",
     srcDir: "src",
@@ -119,13 +118,6 @@ function normalizePaths(raw, configPath, issues) {
       configPath,
       issues
     ),
-    rulesDir: readString(
-      raw.rulesDir,
-      base.rulesDir,
-      "paths.rulesDir",
-      configPath,
-      issues
-    ),
     outDir: readString(
       raw.outDir,
       base.outDir,
@@ -399,7 +391,15 @@ function isRecord(value) {
 }
 
 // src/core/ids.ts
-var ID_PREFIXES = ["SPEC", "BR", "SC", "UI", "API", "DB"];
+var ID_PREFIXES = [
+  "SPEC",
+  "BR",
+  "SC",
+  "UI",
+  "API",
+  "DB",
+  "THEMA"
+];
 var STRICT_ID_PATTERNS = {
   SPEC: /\bSPEC-\d{4}\b/g,
   BR: /\bBR-\d{4}\b/g,
@@ -407,6 +407,7 @@ var STRICT_ID_PATTERNS = {
   UI: /\bUI-\d{4}\b/g,
   API: /\bAPI-\d{4}\b/g,
   DB: /\bDB-\d{4}\b/g,
+  THEMA: /\bTHEMA-\d{3}\b/g,
   ADR: /\bADR-\d{4}\b/g
 };
 var LOOSE_ID_PATTERNS = {
@@ -416,6 +417,7 @@ var LOOSE_ID_PATTERNS = {
   UI: /\bUI-[A-Za-z0-9_-]+\b/gi,
   API: /\bAPI-[A-Za-z0-9_-]+\b/gi,
   DB: /\bDB-[A-Za-z0-9_-]+\b/gi,
+  THEMA: /\bTHEMA-[A-Za-z0-9_-]+\b/gi,
   ADR: /\bADR-[A-Za-z0-9_-]+\b/gi
 };
 function extractIds(text, prefix) {
@@ -453,14 +455,15 @@ function isValidId(value, prefix) {
 
 // src/core/report.ts
 import { readFile as readFile12 } from "fs/promises";
-import path14 from "path";
+import path16 from "path";
 
 // src/core/contractIndex.ts
 import { readFile as readFile2 } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 
 // src/core/discovery.ts
 import { access as access3 } from "fs/promises";
+import path4 from "path";
 
 // src/core/fs.ts
 import { access as access2, readdir } from "fs/promises";
@@ -609,7 +612,12 @@ async function collectScenarioFiles(specsRoot) {
   return filterExisting(entries.map((entry) => entry.scenarioPath));
 }
 async function collectUiContractFiles(uiRoot) {
-  return collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  const files = await collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  return filterByBasenamePrefix(files, "ui-");
+}
+async function collectThemaContractFiles(uiRoot) {
+  const files = await collectFiles(uiRoot, { extensions: [".yaml", ".yml"] });
+  return filterByBasenamePrefix(files, "thema-");
 }
 async function collectApiContractFiles(apiRoot) {
   return collectFiles(apiRoot, { extensions: [".yaml", ".yml", ".json"] });
@@ -618,12 +626,13 @@ async function collectDbContractFiles(dbRoot) {
   return collectFiles(dbRoot, { extensions: [".sql"] });
 }
 async function collectContractFiles(uiRoot, apiRoot, dbRoot) {
-  const [ui, api, db] = await Promise.all([
+  const [ui, thema, api, db] = await Promise.all([
     collectUiContractFiles(uiRoot),
+    collectThemaContractFiles(uiRoot),
     collectApiContractFiles(apiRoot),
     collectDbContractFiles(dbRoot)
   ]);
-  return { ui, api, db };
+  return { ui, thema, api, db };
 }
 async function filterExisting(files) {
   const existing = [];
@@ -642,10 +651,16 @@ async function exists3(target) {
     return false;
   }
 }
+function filterByBasenamePrefix(files, prefix) {
+  const lowerPrefix = prefix.toLowerCase();
+  return files.filter(
+    (file) => path4.basename(file).toLowerCase().startsWith(lowerPrefix)
+  );
+}
 
 // src/core/contractsDecl.ts
-var CONTRACT_DECLARATION_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*((?:API|UI|DB)-\d{4})\s*(?:\*\/)?\s*$/gm;
-var CONTRACT_DECLARATION_LINE_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*(?:API|UI|DB)-\d{4}\s*(?:\*\/)?\s*$/;
+var CONTRACT_DECLARATION_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*((?:API|UI|DB)-\d{4}|THEMA-\d{3})\s*(?:\*\/)?\s*$/gm;
+var CONTRACT_DECLARATION_LINE_RE = /^\s*(?:#|\/\/|--|\/\*+|\*+)?\s*QFAI-CONTRACT-ID:\s*(?:(?:API|UI|DB)-\d{4}|THEMA-\d{3})\s*(?:\*\/)?\s*$/;
 function extractDeclaredContractIds(text) {
   const ids = [];
   for (const match of text.matchAll(CONTRACT_DECLARATION_RE)) {
@@ -663,20 +678,22 @@ function stripContractDeclarationLines(text) {
 // src/core/contractIndex.ts
 async function buildContractIndex(root, config) {
   const contractsRoot = resolvePath(root, config, "contractsDir");
-  const uiRoot = path4.join(contractsRoot, "ui");
-  const apiRoot = path4.join(contractsRoot, "api");
-  const dbRoot = path4.join(contractsRoot, "db");
-  const [uiFiles, apiFiles, dbFiles] = await Promise.all([
+  const uiRoot = path5.join(contractsRoot, "ui");
+  const apiRoot = path5.join(contractsRoot, "api");
+  const dbRoot = path5.join(contractsRoot, "db");
+  const [uiFiles, themaFiles, apiFiles, dbFiles] = await Promise.all([
     collectUiContractFiles(uiRoot),
+    collectThemaContractFiles(uiRoot),
     collectApiContractFiles(apiRoot),
     collectDbContractFiles(dbRoot)
   ]);
   const index = {
     ids: /* @__PURE__ */ new Set(),
     idToFiles: /* @__PURE__ */ new Map(),
-    files: { ui: uiFiles, api: apiFiles, db: dbFiles }
+    files: { ui: uiFiles, thema: themaFiles, api: apiFiles, db: dbFiles }
   };
   await indexContractFiles(uiFiles, index);
+  await indexContractFiles(themaFiles, index);
   await indexContractFiles(apiFiles, index);
   await indexContractFiles(dbFiles, index);
   return index;
@@ -695,15 +712,15 @@ function record(index, id, file) {
 }
 
 // src/core/paths.ts
-import path5 from "path";
+import path6 from "path";
 function toRelativePath(root, target) {
   if (!target) {
     return target;
   }
-  if (!path5.isAbsolute(target)) {
+  if (!path6.isAbsolute(target)) {
     return toPosixPath(target);
   }
-  const relative = path5.relative(root, target);
+  const relative = path6.relative(root, target);
   if (!relative) {
     return ".";
   }
@@ -751,7 +768,7 @@ function normalizeValidationResult(root, result) {
 }
 
 // src/core/parse/contractRefs.ts
-var CONTRACT_REF_ID_RE = /^(?:API|UI|DB)-\d{4}$/;
+var CONTRACT_REF_ID_RE = /^(?:(?:API|UI|DB)-\d{4}|THEMA-\d{3})$/;
 function parseContractRefs(text, options = {}) {
   const linePattern = buildLinePattern(options);
   const lines = [];
@@ -922,7 +939,7 @@ function parseSpec(md, file) {
 
 // src/core/traceability.ts
 import { readFile as readFile3 } from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 
 // src/core/gherkin/parse.ts
 import {
@@ -1154,7 +1171,7 @@ async function collectScTestReferences(root, globs, excludeGlobs) {
     };
   }
   const normalizedFiles = Array.from(
-    new Set(scanResult.files.map((file) => path6.normalize(file)))
+    new Set(scanResult.files.map((file) => path7.normalize(file)))
   );
   for (const file of normalizedFiles) {
     const text = await readFile3(file, "utf-8");
@@ -1217,11 +1234,11 @@ function formatError3(error) {
 
 // src/core/version.ts
 import { readFile as readFile4 } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 import { fileURLToPath } from "url";
 async function resolveToolVersion() {
-  if ("1.0.2".length > 0) {
-    return "1.0.2";
+  if ("1.0.4".length > 0) {
+    return "1.0.4";
   }
   try {
     const packagePath = resolvePackageJsonPath();
@@ -1236,18 +1253,18 @@ async function resolveToolVersion() {
 function resolvePackageJsonPath() {
   const base = import.meta.url;
   const basePath = base.startsWith("file:") ? fileURLToPath(base) : base;
-  return path7.resolve(path7.dirname(basePath), "../../package.json");
+  return path8.resolve(path8.dirname(basePath), "../../package.json");
 }
 
 // src/core/validators/contracts.ts
-import { readFile as readFile5 } from "fs/promises";
-import path9 from "path";
+import { access as access4, readFile as readFile5 } from "fs/promises";
+import path10 from "path";
 
 // src/core/contracts.ts
-import path8 from "path";
+import path9 from "path";
 import { parse as parseYaml2 } from "yaml";
 function parseStructuredContract(file, text) {
-  const ext = path8.extname(file).toLowerCase();
+  const ext = path9.extname(file).toLowerCase();
   if (ext === ".json") {
     return JSON.parse(text);
   }
@@ -1264,17 +1281,23 @@ var SQL_DANGEROUS_PATTERNS = [
     label: "ALTER TABLE ... DROP"
   }
 ];
+var THEMA_ID_RE = /^THEMA-\d{3}$/;
 async function validateContracts(root, config) {
   const issues = [];
-  const contractsRoot = resolvePath(root, config, "contractsDir");
-  issues.push(...await validateUiContracts(path9.join(contractsRoot, "ui")));
-  issues.push(...await validateApiContracts(path9.join(contractsRoot, "api")));
-  issues.push(...await validateDbContracts(path9.join(contractsRoot, "db")));
   const contractIndex = await buildContractIndex(root, config);
+  const contractsRoot = resolvePath(root, config, "contractsDir");
+  const uiRoot = path10.join(contractsRoot, "ui");
+  const themaIds = new Set(
+    Array.from(contractIndex.ids).filter((id) => id.startsWith("THEMA-"))
+  );
+  issues.push(...await validateUiContracts(uiRoot, themaIds));
+  issues.push(...await validateThemaContracts(uiRoot));
+  issues.push(...await validateApiContracts(path10.join(contractsRoot, "api")));
+  issues.push(...await validateDbContracts(path10.join(contractsRoot, "db")));
   issues.push(...validateDuplicateContractIds(contractIndex));
   return issues;
 }
-async function validateUiContracts(uiRoot) {
+async function validateUiContracts(uiRoot, themaIds) {
   const files = await collectUiContractFiles(uiRoot);
   if (files.length === 0) {
     return [
@@ -1288,6 +1311,60 @@ async function validateUiContracts(uiRoot) {
     ];
   }
   const issues = [];
+  for (const file of files) {
+    const text = await readFile5(file, "utf-8");
+    const declaredIds = extractDeclaredContractIds(text);
+    issues.push(...validateDeclaredContractIds(declaredIds, file, "UI"));
+    let doc = null;
+    try {
+      doc = parseStructuredContract(file, stripContractDeclarationLines(text));
+    } catch (error) {
+      issues.push(
+        issue(
+          "QFAI-CONTRACT-001",
+          `UI \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
+          "error",
+          file,
+          "contracts.ui.parse"
+        )
+      );
+    }
+    const invalidIds = extractInvalidIds(text, [
+      "SPEC",
+      "BR",
+      "SC",
+      "UI",
+      "API",
+      "DB",
+      "THEMA",
+      "ADR"
+    ]).filter((id) => !shouldIgnoreInvalidId(id, doc));
+    if (invalidIds.length > 0) {
+      issues.push(
+        issue(
+          "QFAI-ID-002",
+          `ID \u30D5\u30A9\u30FC\u30DE\u30C3\u30C8\u304C\u4E0D\u6B63\u3067\u3059: ${invalidIds.join(", ")}`,
+          "error",
+          file,
+          "id.format",
+          invalidIds
+        )
+      );
+    }
+    if (doc) {
+      issues.push(
+        ...await validateUiContractDoc(doc, file, uiRoot, themaIds)
+      );
+    }
+  }
+  return issues;
+}
+async function validateThemaContracts(uiRoot) {
+  const files = await collectThemaContractFiles(uiRoot);
+  if (files.length === 0) {
+    return [];
+  }
+  const issues = [];
   for (const file of files) {
     const text = await readFile5(file, "utf-8");
     const invalidIds = extractInvalidIds(text, [
@@ -1297,6 +1374,7 @@ async function validateUiContracts(uiRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1312,17 +1390,95 @@ async function validateUiContracts(uiRoot) {
       );
     }
     const declaredIds = extractDeclaredContractIds(text);
-    issues.push(...validateDeclaredContractIds(declaredIds, file, "UI"));
+    if (declaredIds.length === 0) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-010",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306B QFAI-CONTRACT-ID \u304C\u3042\u308A\u307E\u305B\u3093: ${file}`,
+          "error",
+          file,
+          "contracts.thema.declaration"
+        )
+      );
+      continue;
+    }
+    if (declaredIds.length > 1) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-011",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306B\u8907\u6570\u306E QFAI-CONTRACT-ID \u304C\u5BA3\u8A00\u3055\u308C\u3066\u3044\u307E\u3059: ${declaredIds.join(
+            ", "
+          )}`,
+          "error",
+          file,
+          "contracts.thema.declaration",
+          declaredIds
+        )
+      );
+      continue;
+    }
+    const declaredId = declaredIds[0] ?? "";
+    if (!THEMA_ID_RE.test(declaredId)) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-012",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E ID \u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${declaredId}`,
+          "error",
+          file,
+          "contracts.thema.idFormat",
+          [declaredId]
+        )
+      );
+    }
+    let doc;
     try {
-      parseStructuredContract(file, stripContractDeclarationLines(text));
+      doc = parseStructuredContract(file, stripContractDeclarationLines(text));
     } catch (error) {
       issues.push(
         issue(
-          "QFAI-CONTRACT-001",
-          `UI \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
+          "QFAI-THEMA-001",
+          `thema \u5951\u7D04\u30D5\u30A1\u30A4\u30EB\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${file} (${formatError4(error)})`,
           "error",
           file,
-          "contracts.ui.parse"
+          "contracts.thema.parse"
+        )
+      );
+      continue;
+    }
+    const docId = typeof doc.id === "string" ? doc.id : "";
+    if (!THEMA_ID_RE.test(docId)) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-012",
+          docId.length > 0 ? `thema \u306E id \u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${docId}` : "thema \u306E id \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+          "error",
+          file,
+          "contracts.thema.idFormat",
+          docId.length > 0 ? [docId] : void 0
+        )
+      );
+    }
+    const name = typeof doc.name === "string" ? doc.name : "";
+    if (!name) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-014",
+          "thema \u306E name \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+          "error",
+          file,
+          "contracts.thema.name"
+        )
+      );
+    }
+    if (declaredId && docId && declaredId !== docId) {
+      issues.push(
+        issue(
+          "QFAI-THEMA-013",
+          `thema \u306E\u5BA3\u8A00 ID \u3068 id \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093: ${declaredId} / ${docId}`,
+          "error",
+          file,
+          "contracts.thema.idMismatch",
+          [declaredId, docId]
         )
       );
     }
@@ -1352,6 +1508,7 @@ async function validateApiContracts(apiRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1420,6 +1577,7 @@ async function validateDbContracts(dbRoot) {
       "UI",
       "API",
       "DB",
+      "THEMA",
       "ADR"
     ]);
     if (invalidIds.length > 0) {
@@ -1526,6 +1684,278 @@ function validateDuplicateContractIds(contractIndex) {
 function hasOpenApi(doc) {
   return typeof doc.openapi === "string" && doc.openapi.length > 0;
 }
+async function validateUiContractDoc(doc, file, uiRoot, themaIds) {
+  const issues = [];
+  if (Object.prototype.hasOwnProperty.call(doc, "themaRef")) {
+    const themaRef = doc.themaRef;
+    if (typeof themaRef !== "string" || themaRef.length === 0) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          "themaRef \u306F THEMA-001 \u5F62\u5F0F\u306E\u6587\u5B57\u5217\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          file,
+          "contracts.ui.themaRef"
+        )
+      );
+    } else if (!THEMA_ID_RE.test(themaRef)) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          `themaRef \u306E\u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059: ${themaRef}`,
+          "error",
+          file,
+          "contracts.ui.themaRef",
+          [themaRef]
+        )
+      );
+    } else if (!themaIds.has(themaRef)) {
+      issues.push(
+        issue(
+          "QFAI-UI-020",
+          `themaRef \u304C\u5B58\u5728\u3057\u306A\u3044 THEMA \u3092\u53C2\u7167\u3057\u3066\u3044\u307E\u3059: ${themaRef}`,
+          "error",
+          file,
+          "contracts.ui.themaRef",
+          [themaRef]
+        )
+      );
+    }
+  }
+  const assets = doc.assets;
+  if (assets && typeof assets === "object") {
+    issues.push(
+      ...await validateUiAssets(
+        assets,
+        file,
+        uiRoot
+      )
+    );
+  }
+  return issues;
+}
+async function validateUiAssets(assets, file, uiRoot) {
+  const issues = [];
+  const packValue = assets.pack;
+  const useValue = assets.use;
+  if (packValue === void 0 && useValue === void 0) {
+    return issues;
+  }
+  if (typeof packValue !== "string" || packValue.length === 0) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        "assets.pack \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
+        "error",
+        file,
+        "assets.pack"
+      )
+    );
+    return issues;
+  }
+  if (!isSafeRelativePath(packValue)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306F ui/ \u914D\u4E0B\u306E\u76F8\u5BFE\u30D1\u30B9\u306E\u307F\u8A31\u53EF\u3055\u308C\u307E\u3059: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  const packDir = path10.resolve(uiRoot, packValue);
+  const packRelative = path10.relative(uiRoot, packDir);
+  if (packRelative.startsWith("..") || path10.isAbsolute(packRelative)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306F ui/ \u914D\u4E0B\u306B\u9650\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  if (!await exists4(packDir)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-001",
+        `assets.pack \u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u5B58\u5728\u3057\u307E\u305B\u3093: ${packValue}`,
+        "error",
+        file,
+        "assets.pack",
+        [packValue]
+      )
+    );
+    return issues;
+  }
+  const assetsYamlPath = path10.join(packDir, "assets.yaml");
+  if (!await exists4(assetsYamlPath)) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-002",
+        `assets.yaml \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${assetsYamlPath}`,
+        "error",
+        assetsYamlPath,
+        "assets.yaml"
+      )
+    );
+    return issues;
+  }
+  let manifest;
+  try {
+    const manifestText = await readFile5(assetsYamlPath, "utf-8");
+    manifest = parseStructuredContract(assetsYamlPath, manifestText);
+  } catch (error) {
+    issues.push(
+      issue(
+        "QFAI-ASSET-002",
+        `assets.yaml \u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${assetsYamlPath} (${formatError4(error)})`,
+        "error",
+        assetsYamlPath,
+        "assets.yaml"
+      )
+    );
+    return issues;
+  }
+  const items = Array.isArray(manifest.items) ? manifest.items : [];
+  const itemIds = /* @__PURE__ */ new Set();
+  const itemPaths = [];
+  for (const item of items) {
+    if (!item || typeof item !== "object") {
+      continue;
+    }
+    const record2 = item;
+    const id = typeof record2.id === "string" ? record2.id : void 0;
+    const pathValue = typeof record2.path === "string" ? record2.path : void 0;
+    if (id) {
+      itemIds.add(id);
+    }
+    itemPaths.push({ id, path: pathValue });
+  }
+  if (useValue !== void 0) {
+    if (!Array.isArray(useValue) || useValue.some((entry) => typeof entry !== "string")) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-003",
+          "assets.use \u306F\u6587\u5B57\u5217\u914D\u5217\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          file,
+          "assets.use"
+        )
+      );
+    } else {
+      const missing = useValue.filter((entry) => !itemIds.has(entry));
+      if (missing.length > 0) {
+        issues.push(
+          issue(
+            "QFAI-ASSET-003",
+            `assets.use \u304C assets.yaml \u306B\u5B58\u5728\u3057\u307E\u305B\u3093: ${missing.join(", ")}`,
+            "error",
+            file,
+            "assets.use",
+            missing
+          )
+        );
+      }
+    }
+  }
+  for (const entry of itemPaths) {
+    if (!entry.path) {
+      continue;
+    }
+    if (!isSafeRelativePath(entry.path)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C\u4E0D\u6B63\u3067\u3059: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+      continue;
+    }
+    const assetPath = path10.resolve(packDir, entry.path);
+    const assetRelative = path10.relative(packDir, assetPath);
+    if (assetRelative.startsWith("..") || path10.isAbsolute(assetRelative)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C packDir \u3092\u9038\u8131\u3057\u3066\u3044\u307E\u3059: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+      continue;
+    }
+    if (!await exists4(assetPath)) {
+      issues.push(
+        issue(
+          "QFAI-ASSET-004",
+          `assets.yaml \u306E path \u304C\u5B58\u5728\u3057\u307E\u305B\u3093: ${entry.path}`,
+          "error",
+          assetsYamlPath,
+          "assets.path",
+          entry.id ? [entry.id] : [entry.path]
+        )
+      );
+    }
+  }
+  return issues;
+}
+function shouldIgnoreInvalidId(value, doc) {
+  if (!doc) {
+    return false;
+  }
+  const assets = doc.assets;
+  if (!assets || typeof assets !== "object") {
+    return false;
+  }
+  const packValue = assets.pack;
+  if (typeof packValue !== "string" || packValue.length === 0) {
+    return false;
+  }
+  const normalized = packValue.replace(/\\/g, "/");
+  const basename = path10.posix.basename(normalized);
+  if (!basename) {
+    return false;
+  }
+  return value.toLowerCase() === basename.toLowerCase();
+}
+function isSafeRelativePath(value) {
+  if (!value) {
+    return false;
+  }
+  if (path10.isAbsolute(value)) {
+    return false;
+  }
+  const normalized = value.replace(/\\/g, "/");
+  if (/^[A-Za-z]:/.test(normalized)) {
+    return false;
+  }
+  const segments = normalized.split("/");
+  if (segments.some((segment) => segment === "..")) {
+    return false;
+  }
+  return true;
+}
+async function exists4(target) {
+  try {
+    await access4(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function formatError4(error) {
   if (error instanceof Error) {
     return error.message;
@@ -1556,12 +1986,7 @@ function issue(code, message, severity, file, rule, refs, category = "compatibil
 
 // src/core/validators/delta.ts
 import { readFile as readFile6 } from "fs/promises";
-import path10 from "path";
-var SECTION_RE = /^##\s+変更区分/m;
-var COMPAT_LINE_RE = /^\s*-\s*\[[ xX]\]\s*Compatibility\b/m;
-var CHANGE_LINE_RE = /^\s*-\s*\[[ xX]\]\s*Change\/Improvement\b/m;
-var COMPAT_CHECKED_RE = /^\s*-\s*\[[xX]\]\s*Compatibility\b/m;
-var CHANGE_CHECKED_RE = /^\s*-\s*\[[xX]\]\s*Change\/Improvement\b/m;
+import path11 from "path";
 async function validateDeltas(root, config) {
   const specsRoot = resolvePath(root, config, "specsDir");
   const packs = await collectSpecPackDirs(specsRoot);
@@ -1570,10 +1995,9 @@ async function validateDeltas(root, config) {
   }
   const issues = [];
   for (const pack of packs) {
-    const deltaPath = path10.join(pack, "delta.md");
-    let text;
+    const deltaPath = path11.join(pack, "delta.md");
     try {
-      text = await readFile6(deltaPath, "utf-8");
+      await readFile6(deltaPath, "utf-8");
     } catch (error) {
       if (isMissingFileError2(error)) {
         issues.push(
@@ -1582,41 +2006,16 @@ async function validateDeltas(root, config) {
             "delta.md \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002",
             "error",
             deltaPath,
-            "delta.exists"
+            "delta.exists",
+            void 0,
+            "change",
+            "spec-xxxx/delta.md \u3092\u4F5C\u6210\u3057\u3066\u304F\u3060\u3055\u3044\uFF08\u30C6\u30F3\u30D7\u30EC\u306F init \u751F\u6210\u7269\u3092\u53C2\u7167\u3057\u3066\u304F\u3060\u3055\u3044\uFF09\u3002"
           )
         );
         continue;
       }
       throw error;
     }
-    const hasSection = SECTION_RE.test(text);
-    const hasCompatibility = COMPAT_LINE_RE.test(text);
-    const hasChange = CHANGE_LINE_RE.test(text);
-    if (!hasSection || !hasCompatibility || !hasChange) {
-      issues.push(
-        issue2(
-          "QFAI-DELTA-002",
-          "delta.md \u306E\u5909\u66F4\u533A\u5206\u304C\u4E0D\u8DB3\u3057\u3066\u3044\u307E\u3059\u3002`## \u5909\u66F4\u533A\u5206` \u3068\u30C1\u30A7\u30C3\u30AF\u30DC\u30C3\u30AF\u30B9\uFF08Compatibility / Change/Improvement\uFF09\u3092\u8FFD\u52A0\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-          "error",
-          deltaPath,
-          "delta.section"
-        )
-      );
-      continue;
-    }
-    const compatibilityChecked = COMPAT_CHECKED_RE.test(text);
-    const changeChecked = CHANGE_CHECKED_RE.test(text);
-    if (compatibilityChecked === changeChecked) {
-      issues.push(
-        issue2(
-          "QFAI-DELTA-003",
-          "delta.md \u306E\u5909\u66F4\u533A\u5206\u306F\u3069\u3061\u3089\u304B1\u3064\u3060\u3051\u9078\u629E\u3057\u3066\u304F\u3060\u3055\u3044\uFF08\u4E21\u65B9ON/\u4E21\u65B9OFF\u306F\u7121\u52B9\u3067\u3059\uFF09\u3002",
-          "error",
-          deltaPath,
-          "delta.classification"
-        )
-      );
-    }
   }
   return issues;
 }
@@ -1650,7 +2049,7 @@ function issue2(code, message, severity, file, rule, refs, category = "change",
 
 // src/core/validators/ids.ts
 import { readFile as readFile7 } from "fs/promises";
-import path11 from "path";
+import path12 from "path";
 var SC_TAG_RE3 = /^SC-\d{4}$/;
 async function validateDefinedIds(root, config) {
   const issues = [];
@@ -1716,7 +2115,7 @@ function recordId(out, id, file) {
 }
 function formatFileList(files, root) {
   return files.map((file) => {
-    const relative = path11.relative(root, file);
+    const relative = path12.relative(root, file);
     return relative.length > 0 ? relative : file;
   }).join(", ");
 }
@@ -1744,19 +2143,19 @@ function issue3(code, message, severity, file, rule, refs, category = "compatibi
 
 // src/core/promptsIntegrity.ts
 import { readFile as readFile8 } from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 
 // src/shared/assets.ts
 import { existsSync } from "fs";
-import path12 from "path";
+import path13 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getInitAssetsDir() {
   const base = import.meta.url;
   const basePath = base.startsWith("file:") ? fileURLToPath2(base) : base;
-  const baseDir = path12.dirname(basePath);
+  const baseDir = path13.dirname(basePath);
   const candidates = [
-    path12.resolve(baseDir, "../../../assets/init"),
-    path12.resolve(baseDir, "../../assets/init")
+    path13.resolve(baseDir, "../../../assets/init"),
+    path13.resolve(baseDir, "../../assets/init")
   ];
   for (const candidate of candidates) {
     if (existsSync(candidate)) {
@@ -1773,11 +2172,12 @@ function getInitAssetsDir() {
 }
 
 // src/core/promptsIntegrity.ts
+var LEGACY_OK_EXTRA = /* @__PURE__ */ new Set(["qfai-classify-change.md"]);
 async function diffProjectPromptsAgainstInitAssets(root) {
-  const promptsDir = path13.resolve(root, ".qfai", "prompts");
+  const promptsDir = path14.resolve(root, ".qfai", "prompts");
   let templateDir;
   try {
-    templateDir = path13.join(getInitAssetsDir(), ".qfai", "prompts");
+    templateDir = path14.join(getInitAssetsDir(), ".qfai", "prompts");
   } catch {
     return {
       status: "skipped_missing_assets",
@@ -1821,6 +2221,7 @@ async function diffProjectPromptsAgainstInitAssets(root) {
       extra.push(rel);
     }
   }
+  const filteredExtra = extra.filter((rel) => !LEGACY_OK_EXTRA.has(rel));
   const common = intersectKeys(templateByRel, projectByRel);
   for (const rel of common) {
     const templateAbs = templateByRel.get(rel);
@@ -1840,13 +2241,13 @@ async function diffProjectPromptsAgainstInitAssets(root) {
       changed.push(rel);
     }
   }
-  const status = missing.length > 0 || extra.length > 0 || changed.length > 0 ? "modified" : "ok";
+  const status = missing.length > 0 || filteredExtra.length > 0 || changed.length > 0 ? "modified" : "ok";
   return {
     status,
     promptsDir,
     templateDir,
     missing: missing.sort(),
-    extra: extra.sort(),
+    extra: filteredExtra.sort(),
     changed: changed.sort()
   };
 }
@@ -1854,7 +2255,7 @@ function normalizeNewlines(text) {
   return text.replace(/\r\n/g, "\n");
 }
 function toRel(base, abs) {
-  const rel = path13.relative(base, abs);
+  const rel = path14.relative(base, abs);
   return rel.replace(/[\\/]+/g, "/");
 }
 function intersectKeys(a, b) {
@@ -1899,7 +2300,8 @@ async function validatePromptsIntegrity(root) {
 }
 
 // src/core/validators/scenario.ts
-import { readFile as readFile9 } from "fs/promises";
+import { access as access5, readFile as readFile9 } from "fs/promises";
+import path15 from "path";
 var GIVEN_PATTERN = /\bGiven\b/;
 var WHEN_PATTERN = /\bWhen\b/;
 var THEN_PATTERN = /\bThen\b/;
@@ -1922,6 +2324,18 @@ async function validateScenarios(root, config) {
   }
   const issues = [];
   for (const entry of entries) {
+    const legacyScenarioPath = path15.join(entry.dir, "scenario.md");
+    if (await fileExists(legacyScenarioPath)) {
+      issues.push(
+        issue4(
+          "QFAI-SC-004",
+          "scenario.md \u306F\u975E\u5BFE\u5FDC\u3067\u3059\u3002scenario.feature \u3078\u79FB\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+          "error",
+          legacyScenarioPath,
+          "scenario.legacy"
+        )
+      );
+    }
     let text;
     try {
       text = await readFile9(entry.scenarioPath, "utf-8");
@@ -1953,6 +2367,7 @@ function validateScenarioContent(text, file) {
     "UI",
     "API",
     "DB",
+    "THEMA",
     "ADR"
   ]);
   if (invalidIds.length > 0) {
@@ -2096,6 +2511,14 @@ function isMissingFileError3(error) {
   }
   return error.code === "ENOENT";
 }
+async function fileExists(target) {
+  try {
+    await access5(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/core/validators/spec.ts
 import { readFile as readFile10 } from "fs/promises";
@@ -2155,6 +2578,7 @@ function validateSpecContent(text, file, requiredSections) {
     "UI",
     "API",
     "DB",
+    "THEMA",
     "ADR"
   ]);
   if (invalidIds.length > 0) {
@@ -2334,7 +2758,7 @@ async function validateTraceability(root, config) {
             "QFAI-TRACE-021",
             `Spec \u306E\u5951\u7D04 ID \u304C\u4E0D\u6B63\u3067\u3059: ${contractRefs.invalidTokens.join(
               ", "
-            )} (\u4F8B: UI-0001 / API-0001 / DB-0001)`,
+            )} (\u4F8B: UI-0001 / API-0001 / DB-0001 / THEMA-001)`,
             "error",
             file,
             "traceability.specContractRefFormat",
@@ -2398,7 +2822,7 @@ async function validateTraceability(root, config) {
             "QFAI-TRACE-032",
             `Scenario \u306E\u5951\u7D04 ID \u304C\u4E0D\u6B63\u3067\u3059: ${scenarioContractRefs.invalidTokens.join(
               ", "
-            )} (\u4F8B: UI-0001 / API-0001 / DB-0001)`,
+            )} (\u4F8B: UI-0001 / API-0001 / DB-0001 / THEMA-001)`,
             "error",
             file,
             "traceability.scenarioContractRefFormat",
@@ -2777,17 +3201,25 @@ function countIssues(issues) {
 }
 
 // src/core/report.ts
-var ID_PREFIXES2 = ["SPEC", "BR", "SC", "UI", "API", "DB"];
+var ID_PREFIXES2 = [
+  "SPEC",
+  "BR",
+  "SC",
+  "UI",
+  "API",
+  "DB",
+  "THEMA"
+];
 async function createReportData(root, validation, configResult) {
-  const resolvedRoot = path14.resolve(root);
+  const resolvedRoot = path16.resolve(root);
   const resolved = configResult ?? await loadConfig(resolvedRoot);
   const config = resolved.config;
   const configPath = resolved.configPath;
   const specsRoot = resolvePath(resolvedRoot, config, "specsDir");
   const contractsRoot = resolvePath(resolvedRoot, config, "contractsDir");
-  const apiRoot = path14.join(contractsRoot, "api");
-  const uiRoot = path14.join(contractsRoot, "ui");
-  const dbRoot = path14.join(contractsRoot, "db");
+  const apiRoot = path16.join(contractsRoot, "api");
+  const uiRoot = path16.join(contractsRoot, "ui");
+  const dbRoot = path16.join(contractsRoot, "db");
   const srcRoot = resolvePath(resolvedRoot, config, "srcDir");
   const testsRoot = resolvePath(resolvedRoot, config, "testsDir");
   const specFiles = await collectSpecFiles(specsRoot);
@@ -2795,7 +3227,8 @@ async function createReportData(root, validation, configResult) {
   const {
     api: apiFiles,
     ui: uiFiles,
-    db: dbFiles
+    db: dbFiles,
+    thema: themaFiles
   } = await collectContractFiles(uiRoot, apiRoot, dbRoot);
   const contractIndex = await buildContractIndex(resolvedRoot, config);
   const contractIdList = Array.from(contractIndex.ids);
@@ -2822,7 +3255,8 @@ async function createReportData(root, validation, configResult) {
     ...scenarioFiles,
     ...apiFiles,
     ...uiFiles,
-    ...dbFiles
+    ...dbFiles,
+    ...themaFiles
   ]);
   const upstreamIds = await collectUpstreamIds([
     ...specFiles,
@@ -2859,7 +3293,8 @@ async function createReportData(root, validation, configResult) {
       contracts: {
         api: apiFiles.length,
         ui: uiFiles.length,
-        db: dbFiles.length
+        db: dbFiles.length,
+        thema: themaFiles.length
       },
       counts: normalizedValidation.counts
     },
@@ -2869,7 +3304,8 @@ async function createReportData(root, validation, configResult) {
       sc: idsByPrefix.SC,
       ui: idsByPrefix.UI,
       api: idsByPrefix.API,
-      db: idsByPrefix.DB
+      db: idsByPrefix.DB,
+      thema: idsByPrefix.THEMA
     },
     traceability: {
       upstreamIdsFound: upstreamIds.size,
@@ -2939,7 +3375,7 @@ function formatReportMarkdown(data, options = {}) {
   lines.push(`- specs: ${data.summary.specs}`);
   lines.push(`- scenarios: ${data.summary.scenarios}`);
   lines.push(
-    `- contracts: api ${data.summary.contracts.api} / ui ${data.summary.contracts.ui} / db ${data.summary.contracts.db}`
+    `- contracts: api ${data.summary.contracts.api} / ui ${data.summary.contracts.ui} / db ${data.summary.contracts.db} / thema ${data.summary.contracts.thema}`
   );
   lines.push(
     `- issues(total): info ${data.summary.counts.info} / warning ${data.summary.counts.warning} / error ${data.summary.counts.error}`
@@ -3083,6 +3519,7 @@ function formatReportMarkdown(data, options = {}) {
   lines.push(formatIdLine("UI", data.ids.ui));
   lines.push(formatIdLine("API", data.ids.api));
   lines.push(formatIdLine("DB", data.ids.db));
+  lines.push(formatIdLine("THEMA", data.ids.thema));
   lines.push("");
   lines.push("## Traceability");
   lines.push("");
@@ -3247,12 +3684,8 @@ function formatReportMarkdown(data, options = {}) {
       "- issue \u306F\u691C\u51FA\u3055\u308C\u307E\u305B\u3093\u3067\u3057\u305F\u3002\u904B\u7528\u30C6\u30F3\u30D7\u30EC\u306B\u6CBF\u3063\u3066\u7D99\u7D9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
     );
   }
-  lines.push(
-    "- \u5909\u66F4\u533A\u5206\uFF08Compatibility / Change/Improvement\uFF09\u306F `.qfai/specs/*/delta.md` \u306B\u8A18\u9332\u3057\u307E\u3059\u3002"
-  );
-  lines.push(
-    "- \u53C2\u7167\u30EB\u30FC\u30EB\u306E\u6B63\u672C: `.qfai/promptpack/steering/traceability.md` / `.qfai/promptpack/steering/compatibility-vs-change.md`"
-  );
+  lines.push("- \u5909\u66F4\u5185\u5BB9\u30FB\u53D7\u5165\u89B3\u70B9\u306F `.qfai/specs/*/delta.md` \u306B\u8A18\u9332\u3057\u307E\u3059\u3002");
+  lines.push("- \u53C2\u7167\u30EB\u30FC\u30EB\u306E\u6B63\u672C: `.qfai/promptpack/steering/traceability.md`");
   return lines.join("\n");
 }
 function formatReportJson(data) {
@@ -3304,7 +3737,8 @@ async function collectIds(files) {
     SC: /* @__PURE__ */ new Set(),
     UI: /* @__PURE__ */ new Set(),
     API: /* @__PURE__ */ new Set(),
-    DB: /* @__PURE__ */ new Set()
+    DB: /* @__PURE__ */ new Set(),
+    THEMA: /* @__PURE__ */ new Set()
   };
   for (const file of files) {
     const text = await readFile12(file, "utf-8");
@@ -3319,7 +3753,8 @@ async function collectIds(files) {
     SC: toSortedArray2(result.SC),
     UI: toSortedArray2(result.UI),
     API: toSortedArray2(result.API),
-    DB: toSortedArray2(result.DB)
+    DB: toSortedArray2(result.DB),
+    THEMA: toSortedArray2(result.THEMA)
   };
 }
 async function collectUpstreamIds(files) {