@bleedingdev/modern-js-code-tools 3.9.0-ultramodern.16 → 3.9.0-ultramodern.18

package/dist/cjs/microvertical-api-boundary.cjs

@@ -40,6 +40,7 @@ __webpack_require__.d(__webpack_exports__, {
     checkMicroVerticalApiBoundaries: ()=>checkMicroVerticalApiBoundaries,
     checkMicroVerticalApiConsumerFiles: ()=>checkMicroVerticalApiConsumerFiles,
     configuredMicroVerticalApiStem: ()=>external_microvertical_api_baseline_cjs_namespaceObject.configuredMicroVerticalApiStem,
+    createModuleGraph: ()=>external_module_graph_cjs_namespaceObject.createModuleGraph,
     microVerticalApiBaselineViolation: ()=>external_microvertical_api_baseline_cjs_namespaceObject.microVerticalApiBaselineViolation
 });
 const external_node_fs_namespaceObject = require("node:fs");
@@ -50,6 +51,7 @@ const parser_namespaceObject = require("@babel/parser");
 const types_namespaceObject = require("@babel/types");
 const external_microvertical_api_baseline_cjs_namespaceObject = require("./microvertical-api-baseline.cjs");
 const external_microvertical_api_owner_cjs_namespaceObject = require("./microvertical-api-owner.cjs");
+const external_module_graph_cjs_namespaceObject = require("./module-graph.cjs");
 const external_source_analysis_cjs_namespaceObject = require("./source-analysis.cjs");
 const external_strict_effect_runtime_cjs_namespaceObject = require("./strict-effect-runtime.cjs");
 const ignored = new Set([
@@ -453,6 +455,27 @@ function check(options, topology) {
                 const violation = (0, external_microvertical_api_baseline_cjs_namespaceObject.microVerticalApiBaselineViolation)(stem, absolute(contract), expectation);
                 if (violation) diagnostics.push(`${contract}: ${violation}`);
             }
+            if (options.contractRules?.length && exists(contract)) {
+                let graph;
+                try {
+                    graph = (0, external_module_graph_cjs_namespaceObject.createModuleGraph)(absolute(contract));
+                } catch (error) {
+                    if (!(error instanceof external_source_analysis_cjs_namespaceObject.SourceSyntaxError)) throw error;
+                    diagnostics.push(`${contract}: contract rules need a parseable contract with immutable bindings (${error.message})`);
+                }
+                if (graph) {
+                    const context = {
+                        appPath,
+                        protocol: rpc ? 'rpc' : 'rest',
+                        graph
+                    };
+                    for (const rule of options.contractRules)guarded(`${contract} (rule ${rule.name || 'anonymous'})`, ()=>{
+                        const messages = rule(context);
+                        if (!Array.isArray(messages) || !messages.every((message)=>'string' == typeof message)) throw new Error('contract rule must return an array of violation messages (return [] when the contract passes)');
+                        for (const message of messages)diagnostics.push(`${contract}: ${message}`);
+                    });
+                }
+            }
             if (client) {
                 const relativeContract = external_node_path_default().posix.relative(external_node_path_default().posix.dirname(client), contract);
                 moduleShape(client, [
@@ -549,11 +572,13 @@ const checkMicroVerticalApiConsumerFiles = (options)=>check(options, false);
 exports.checkMicroVerticalApiBoundaries = __webpack_exports__.checkMicroVerticalApiBoundaries;
 exports.checkMicroVerticalApiConsumerFiles = __webpack_exports__.checkMicroVerticalApiConsumerFiles;
 exports.configuredMicroVerticalApiStem = __webpack_exports__.configuredMicroVerticalApiStem;
+exports.createModuleGraph = __webpack_exports__.createModuleGraph;
 exports.microVerticalApiBaselineViolation = __webpack_exports__.microVerticalApiBaselineViolation;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "checkMicroVerticalApiBoundaries",
     "checkMicroVerticalApiConsumerFiles",
     "configuredMicroVerticalApiStem",
+    "createModuleGraph",
     "microVerticalApiBaselineViolation"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {

package/dist/cjs/module-graph.cjs

@@ -0,0 +1,321 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.n = (module)=>{
+        var getter = module && module.__esModule ? ()=>module['default'] : ()=>module;
+        __webpack_require__.d(getter, {
+            a: getter
+        });
+        return getter;
+    };
+})();
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    createModuleGraph: ()=>createModuleGraph,
+    exportedConst: ()=>exportedConst,
+    localConst: ()=>localConst,
+    parseConsumer: ()=>parseConsumer,
+    propertyName: ()=>propertyName
+});
+const external_node_fs_namespaceObject = require("node:fs");
+var external_node_fs_default = /*#__PURE__*/ __webpack_require__.n(external_node_fs_namespaceObject);
+const external_node_module_namespaceObject = require("node:module");
+const external_node_path_namespaceObject = require("node:path");
+var external_node_path_default = /*#__PURE__*/ __webpack_require__.n(external_node_path_namespaceObject);
+const types_namespaceObject = require("@babel/types");
+const external_resolve_exports_namespaceObject = require("resolve.exports");
+const external_source_analysis_cjs_namespaceObject = require("./source-analysis.cjs");
+const MAX_MODULES = 256;
+const MAX_LOOKUPS = 512;
+function parseConsumer(filePath) {
+    if (external_node_fs_default().statSync(filePath).size > 1000000) throw new Error(`${filePath}: consumer source exceeds 1 MB analysis budget`);
+    const file = (0, external_source_analysis_cjs_namespaceObject.parseSource)(external_node_fs_default().readFileSync(filePath, 'utf8'), filePath);
+    (0, external_source_analysis_cjs_namespaceObject.traverseSource)(file, {
+        AssignmentExpression (p) {
+            throw new external_source_analysis_cjs_namespaceObject.SourceSyntaxError(`contract bindings must be immutable at ${p.node.start}`);
+        },
+        UpdateExpression (p) {
+            throw new external_source_analysis_cjs_namespaceObject.SourceSyntaxError(`contract bindings must be immutable at ${p.node.start}`);
+        },
+        TSModuleDeclaration () {
+            throw new external_source_analysis_cjs_namespaceObject.SourceSyntaxError('contract bindings must not be merged with namespaces');
+        }
+    });
+    return file;
+}
+const propertyName = (node)=>{
+    if (void 0 !== node && (types_namespaceObject.isIdentifier(node) || types_namespaceObject.isStringLiteral(node) || types_namespaceObject.isNumericLiteral(node))) return types_namespaceObject.isIdentifier(node) ? node.name : String(node.value);
+};
+const localConst = (sourceFile, name)=>{
+    for (const item of sourceFile.program.body){
+        const statement = types_namespaceObject.isExportNamedDeclaration(item) ? item.declaration : item;
+        if (!types_namespaceObject.isVariableDeclaration(statement) || 'const' !== statement.kind) continue;
+        const matches = statement.declarations.filter((declaration)=>types_namespaceObject.isIdentifier(declaration.id, {
+                name
+            }));
+        if (1 === matches.length) return matches[0];
+    }
+};
+const exportedConst = (sourceFile, name)=>{
+    for (const statement of sourceFile.program.body)if (types_namespaceObject.isExportNamedDeclaration(statement) && 'type' !== statement.exportKind) {
+        if (types_namespaceObject.isVariableDeclaration(statement.declaration) && 'const' === statement.declaration.kind) {
+            const declaration = statement.declaration.declarations.find((value)=>types_namespaceObject.isIdentifier(value.id, {
+                    name
+                }));
+            if (declaration) return declaration;
+        }
+        if (!statement.source && statement.specifiers.some((value)=>types_namespaceObject.isExportSpecifier(value) && 'type' !== value.exportKind && types_namespaceObject.isIdentifier(value.local, {
+                name
+            }) && types_namespaceObject.isIdentifier(value.exported, {
+                name
+            }))) return localConst(sourceFile, name);
+    }
+};
+const inside = (file, boundary)=>file === boundary || file.startsWith(`${boundary}${external_node_path_default().sep}`);
+const containingWorkspace = (file)=>{
+    for(let directory = external_node_path_default().dirname(file);; directory = external_node_path_default().dirname(directory)){
+        if (external_node_fs_default().existsSync(external_node_path_default().join(directory, 'pnpm-workspace.yaml'))) return external_node_fs_default().realpathSync(directory);
+        if (directory === external_node_path_default().dirname(directory)) return;
+    }
+};
+const sourceBoundary = (file, workspace)=>{
+    for(let directory = external_node_path_default().dirname(file);; directory = external_node_path_default().dirname(directory)){
+        if (external_node_fs_default().existsSync(external_node_path_default().join(directory, 'package.json')) && directory !== workspace) return external_node_fs_default().realpathSync(directory);
+        if (directory === workspace || directory === external_node_path_default().dirname(directory)) return external_node_fs_default().realpathSync(external_node_path_default().dirname(file));
+    }
+};
+const sourceFileAt = (target, boundary)=>{
+    const stem = target.replace(/\.(?:[cm]?[jt]sx?)$/u, '');
+    for (const candidate of [
+        `${stem}.ts`,
+        `${stem}.tsx`,
+        `${stem}.mts`,
+        `${stem}.cts`,
+        target,
+        external_node_path_default().join(target, 'index.ts'),
+        external_node_path_default().join(target, 'index.tsx')
+    ])try {
+        const real = external_node_fs_default().realpathSync(candidate);
+        if (inside(real, boundary) && external_node_fs_default().statSync(real).isFile()) return real;
+    } catch  {}
+};
+const packageEntry = (specifier)=>{
+    if (specifier.startsWith('.') || specifier.startsWith('/') || specifier.startsWith('#')) return;
+    const parts = specifier.split('/');
+    const count = specifier.startsWith('@') ? 2 : 1;
+    if (parts.length < count || parts.slice(0, count).some((part)=>!part)) return;
+    return {
+        name: parts.slice(0, count).join('/'),
+        exportKey: parts.length === count ? '.' : `./${parts.slice(count).join('/')}`
+    };
+};
+const resolveModulePath = (module, specifier, workspace)=>{
+    if (/^\.\.?\//u.test(specifier)) {
+        const file = sourceFileAt(external_node_path_default().resolve(external_node_path_default().dirname(module.path), specifier), module.boundary);
+        return void 0 === file ? void 0 : {
+            kind: 'module',
+            path: file,
+            boundary: module.boundary
+        };
+    }
+    const entry = packageEntry(specifier);
+    if (!entry) return;
+    if (!workspace) return {
+        kind: 'external'
+    };
+    const paths = (0, external_node_module_namespaceObject.createRequire)(module.path).resolve.paths(entry.name) ?? [];
+    for (const lookup of paths){
+        const directory = external_node_path_default().join(lookup, entry.name);
+        const manifest = external_node_path_default().join(directory, 'package.json');
+        if (!external_node_fs_default().existsSync(manifest)) continue;
+        const boundary = external_node_fs_default().realpathSync(directory);
+        if (!inside(boundary, workspace) || boundary.split(external_node_path_default().sep).includes('node_modules')) break;
+        const pkg = JSON.parse(external_node_fs_default().readFileSync(manifest, 'utf8'));
+        if (pkg.name !== entry.name || void 0 === pkg.exports) return;
+        let target;
+        try {
+            const targets = (0, external_resolve_exports_namespaceObject.exports)(pkg, entry.exportKey, {
+                conditions: [
+                    'modern:source'
+                ]
+            });
+            target = Array.isArray(targets) ? targets[0] : void 0;
+        } catch  {
+            return;
+        }
+        if (!target || !target.startsWith('./')) return;
+        const file = sourceFileAt(external_node_path_default().resolve(boundary, target), boundary);
+        return void 0 === file ? void 0 : {
+            kind: 'module',
+            path: file,
+            boundary
+        };
+    }
+    return {
+        kind: 'external'
+    };
+};
+const importedBinding = (module, name)=>{
+    for (const statement of module.file.program.body)if (types_namespaceObject.isImportDeclaration(statement) && 'type' !== statement.importKind) {
+        for (const specifier of statement.specifiers)if (types_namespaceObject.isIdentifier(specifier.local, {
+            name
+        })) {
+            if (types_namespaceObject.isImportSpecifier(specifier) && 'type' !== specifier.importKind) return {
+                imported: propertyName(specifier.imported) ?? name,
+                specifier: statement.source.value
+            };
+            if (types_namespaceObject.isImportDefaultSpecifier(specifier)) return {
+                imported: 'default',
+                specifier: statement.source.value
+            };
+        }
+    }
+};
+const reexportedBinding = (module, name)=>{
+    for (const statement of module.file.program.body){
+        if (!types_namespaceObject.isExportNamedDeclaration(statement) || 'type' === statement.exportKind) continue;
+        const specifier = statement.specifiers.find((value)=>types_namespaceObject.isExportSpecifier(value) && 'type' !== value.exportKind && propertyName(value.exported) === name);
+        if (void 0 !== specifier && types_namespaceObject.isExportSpecifier(specifier)) return {
+            local: types_namespaceObject.isIdentifier(specifier.local) ? specifier.local.name : specifier.local.value,
+            ...statement.source ? {
+                specifier: statement.source.value
+            } : {}
+        };
+    }
+};
+const defaultExport = (module)=>{
+    for (const statement of module.file.program.body){
+        if (!types_namespaceObject.isExportDefaultDeclaration(statement)) continue;
+        const declaration = statement.declaration;
+        if (types_namespaceObject.isIdentifier(declaration)) return declaration.name;
+        return types_namespaceObject.isExpression(declaration) ? declaration : void 0;
+    }
+};
+function createModuleGraph(filePath) {
+    const realPath = external_node_fs_default().realpathSync(filePath);
+    const workspace = containingWorkspace(realPath);
+    const root = {
+        file: parseConsumer(realPath),
+        path: realPath,
+        boundary: sourceBoundary(realPath, workspace)
+    };
+    const modules = new Map([
+        [
+            root.path,
+            root
+        ]
+    ]);
+    const readModule = (modulePath, boundary)=>{
+        if (modules.has(modulePath)) return modules.get(modulePath);
+        if (modules.size >= MAX_MODULES) return;
+        let module;
+        try {
+            module = {
+                file: parseConsumer(modulePath),
+                path: modulePath,
+                boundary
+            };
+        } catch  {
+            module = void 0;
+        }
+        modules.set(modulePath, module);
+        return module;
+    };
+    const resolveBinding = (module, name, scope, chain, seen)=>{
+        const key = `${scope}:${module.path}#${name}`;
+        if (seen.has(key) || seen.size >= MAX_LOOKUPS) return;
+        seen.add(key);
+        const last = chain.at(-1);
+        const hops = last?.path === module.path && last.name === name ? chain : [
+            ...chain,
+            {
+                path: module.path,
+                name
+            }
+        ];
+        const declaration = 'export' === scope ? exportedConst(module.file, name) : localConst(module.file, name);
+        if (declaration?.init) return {
+            kind: 'declaration',
+            expression: declaration.init,
+            module,
+            chain: hops
+        };
+        const throughModule = (specifier, imported, allowExternal)=>{
+            const target = resolveModulePath(module, specifier, workspace);
+            if (target?.kind === 'external') return allowExternal ? {
+                kind: 'external',
+                specifier,
+                name: imported,
+                chain: hops
+            } : void 0;
+            const next = target && readModule(target.path, target.boundary);
+            return void 0 === next ? void 0 : resolveBinding(next, imported, 'export', hops, seen);
+        };
+        if ('local' === scope) {
+            const imported = importedBinding(module, name);
+            return void 0 === imported ? void 0 : throughModule(imported.specifier, imported.imported, true);
+        }
+        if ('default' === name) {
+            const exported = defaultExport(module);
+            if ('string' == typeof exported) return resolveBinding(module, exported, 'local', hops, seen);
+            return void 0 === exported ? void 0 : {
+                kind: 'declaration',
+                expression: exported,
+                module,
+                chain: hops
+            };
+        }
+        const reexported = reexportedBinding(module, name);
+        if (void 0 !== reexported) return void 0 === reexported.specifier ? resolveBinding(module, reexported.local, 'local', hops, seen) : throughModule(reexported.specifier, reexported.local, true);
+        for (const statement of module.file.program.body){
+            if (!types_namespaceObject.isExportAllDeclaration(statement) || 'type' === statement.exportKind) continue;
+            const resolved = throughModule(statement.source.value, name, false);
+            if (void 0 !== resolved) return resolved;
+        }
+    };
+    return {
+        root,
+        resolve: (module, name, scope)=>resolveBinding(module, name, scope, [], new Set())
+    };
+}
+exports.createModuleGraph = __webpack_exports__.createModuleGraph;
+exports.exportedConst = __webpack_exports__.exportedConst;
+exports.localConst = __webpack_exports__.localConst;
+exports.parseConsumer = __webpack_exports__.parseConsumer;
+exports.propertyName = __webpack_exports__.propertyName;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "createModuleGraph",
+    "exportedConst",
+    "localConst",
+    "parseConsumer",
+    "propertyName"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/esm/cli/microvertical-api-check.js

@@ -1,27 +1,46 @@
+import node_path from "node:path";
+import { pathToFileURL } from "node:url";
 import { checkMicroVerticalApiBoundaries, checkMicroVerticalApiConsumerFiles } from "../microvertical-api-boundary.js";
-function runMicroVerticalApiCheckCli(args = process.argv.slice(2), filesOnly = false) {
+const flags = [
+    '--workspace-root',
+    '--baseline-package-directory',
+    '--rules'
+];
+async function loadContractRules(file) {
+    const rules = (await import(pathToFileURL(node_path.resolve(file)).href)).default;
+    if (!Array.isArray(rules) || !rules.every((rule)=>'function' == typeof rule)) throw new Error(`${file}: default export must be an array of contract rule functions, e.g. \`export default [myRule]\``);
+    return rules;
+}
+async function runMicroVerticalApiCheckCli(args = process.argv.slice(2), filesOnly = false) {
     let workspaceRoot = process.env.ULTRAMODERN_WORKSPACE_ROOT ?? process.cwd();
     let baselinePackageDirectory;
+    const ruleFiles = [];
     for(let index = 0; index < args.length; index += 1){
         const argument = args[index];
         if ('--help' === argument || '-h' === argument) {
-            console.log(`${filesOnly ? 'modern-api-check-files' : 'modern-api-check'} [--workspace-root <path>] [--baseline-package-directory <path>]\n${filesOnly ? 'Checks consumer files, contracts, package exports and owner identity. Does not analyze runtime topology; run the strict Effect source phase separately.' : 'Checks consumer files, contracts, package exports, owner identity and runtime topology once per API entry.'}\nWorkspace defaults to ULTRAMODERN_WORKSPACE_ROOT then cwd. Exit codes: 0 valid, 1 consumer violation, 2 tool/configuration failure.`);
+            console.log(`${filesOnly ? 'modern-api-check-files' : 'modern-api-check'} [--workspace-root <path>] [--baseline-package-directory <path>] [--rules <module>]...\n${filesOnly ? 'Checks consumer files, contracts, package exports and owner identity. Does not analyze runtime topology; run the strict Effect source phase separately.' : 'Checks consumer files, contracts, package exports, owner identity and runtime topology once per API entry.'}\n--rules loads a module whose default export is an array of contract rules; each rule receives the module graph of every API contract.\nWorkspace defaults to ULTRAMODERN_WORKSPACE_ROOT then cwd. Exit codes: 0 valid, 1 consumer violation, 2 tool/configuration failure.`);
             return 0;
         }
-        if (![
-            '--workspace-root',
-            '--baseline-package-directory'
-        ].includes(argument ?? '') || !args[index + 1] || args[index + 1]?.startsWith('--')) {
+        if (!flags.includes(argument ?? '') || !args[index + 1] || args[index + 1]?.startsWith('--')) {
             console.error(`Invalid argument: ${argument ?? ''}. Use --help.`);
             return 2;
         }
         const value = args[++index];
         if ('--workspace-root' === argument) workspaceRoot = value;
+        else if ('--rules' === argument) ruleFiles.push(value);
         else baselinePackageDirectory = value;
     }
+    const contractRules = [];
+    for (const file of ruleFiles)try {
+        contractRules.push(...await loadContractRules(file));
+    } catch (error) {
+        console.error(`API tool error: --rules ${error instanceof Error ? error.message : String(error)}`);
+        return 2;
+    }
     const result = (filesOnly ? checkMicroVerticalApiConsumerFiles : checkMicroVerticalApiBoundaries)({
         workspaceRoot,
-        baselinePackageDirectory
+        baselinePackageDirectory,
+        contractRules
     });
     for (const diagnostic of result.diagnostics)console.error(`API violation: ${diagnostic}`);
     for (const error of result.toolErrors)console.error(`API tool error: ${error}`);

package/dist/esm/cli/workspace-source-check.js

@@ -6,6 +6,11 @@ const DEFAULT_LOCALES = [
     'en',
     'cs'
 ];
+const DEFAULT_SOURCE_ROOTS = [
+    'apps',
+    'verticals',
+    'packages'
+];
 const ignoredDirectories = new Set([
     '.modern',
     '.modernjs',
@@ -39,6 +44,8 @@ const createLocaleJsonMatcher = (locales)=>{
 const resolvePluralCategories = (locale, overrides)=>overrides?.[locale] ?? new Intl.PluralRules(locale).resolvedOptions().pluralCategories;
 const readText = (filePath)=>node_fs.readFileSync(filePath, 'utf-8');
 const localeImportPattern = (locale)=>new RegExp(`import\\s+(?:\\*\\s+as\\s+)?[A-Za-z_$][\\w$]*\\s+from\\s+['"]\\.\\./locales/${escapeRegExp(locale)}/[^'"]+\\.json['"]`, 'u');
+class SourceViolation extends Error {
+}
 const checkRuntimeResources = (root, filePath, text, locales)=>{
     const relative = relativePath(root, filePath);
     if (!relative.endsWith('/src/modern.runtime.ts')) return;
@@ -46,7 +53,7 @@ const checkRuntimeResources = (root, filePath, text, locales)=>{
     const registersResources = /initOptions\s*:\s*\{[\s\S]*?\bresources\s*[,:}]/u.test(text);
     if (missingLocales.length > 0 || !registersResources) {
         const detail = missingLocales.length > 0 ? `missing locale JSON imports for: ${missingLocales.join(', ')}` : 'initOptions does not register a `resources` entry';
-        throw new Error(`${relative} must register locale JSON resources in modern.runtime.ts so Worker SSR and hydration use the same first-render translations (${detail}).`);
+        throw new SourceViolation(`${relative} must register locale JSON resources in modern.runtime.ts so Worker SSR and hydration use the same first-render translations (${detail}).`);
     }
 };
 const visitLocaleKeys = (value, visitor, pathParts = [])=>{
@@ -66,7 +73,7 @@ const checkPluralResources = (root, filePath, json, requiredSuffixes, pluralSuff
     visitLocaleKeys(json, (key, value, pathParts)=>{
         if ('string' != typeof value || !value.includes('{{count}}')) return;
         const suffixMatch = key.match(pluralSuffixPattern);
-        if (!suffixMatch) throw new Error(`${relative} key ${pathParts.join('.')} contains {{count}} but is not plural-suffixed.`);
+        if (!suffixMatch) throw new SourceViolation(`${relative} key ${pathParts.join('.')} contains {{count}} but is not plural-suffixed.`);
         const [, base = '', suffix = ''] = suffixMatch;
         const parentPath = pathParts.slice(0, -1).join('.');
         const groupKey = `${parentPath}.${base}`;
@@ -74,7 +81,7 @@ const checkPluralResources = (root, filePath, json, requiredSuffixes, pluralSuff
         existing.add(suffix);
         groups.set(groupKey, existing);
     });
-    for (const [group, suffixes] of groups)for (const suffix of requiredSuffixes)if (!suffixes.has(suffix)) throw new Error(`${relative} plural group ${group} is missing _${suffix}.`);
+    for (const [group, suffixes] of groups)for (const suffix of requiredSuffixes)if (!suffixes.has(suffix)) throw new SourceViolation(`${relative} plural group ${group} is missing _${suffix}.`);
 };
 const runRuntimeAndLocaleResourceChecks = (root, sourceRoots, locales, pluralCategories)=>{
     if (0 === locales.length) return;
@@ -96,11 +103,7 @@ const runRuntimeAndLocaleResourceChecks = (root, sourceRoots, locales, pluralCat
         checkPluralResources(root, filePath, JSON.parse(readText(filePath)), localeCategories.get(language) ?? [], pluralSuffixPattern);
     }
 };
-const runWorkspaceSourceCheck = ({ cwd = process.cwd(), sourceRoots = [
-    'apps',
-    'verticals',
-    'packages'
-], locales = DEFAULT_LOCALES, pluralCategories } = {})=>{
+const runWorkspaceSourceCheck = ({ cwd = process.cwd(), sourceRoots = DEFAULT_SOURCE_ROOTS, locales = DEFAULT_LOCALES, pluralCategories } = {})=>{
     const oxlintResult = runOxlintRules({
         cwd,
         targets: sourceRoots,
@@ -133,13 +136,83 @@ const runWorkspaceSourceCheck = ({ cwd = process.cwd(), sourceRoots = [
     try {
         runRuntimeAndLocaleResourceChecks(cwd, sourceRoots, locales, pluralCategories);
     } catch (error) {
-        console.error(error instanceof Error ? error.message : 'UltraModern workspace source checks failed.');
-        return 1;
+        console.error(error instanceof Error ? error.message : String(error));
+        return error instanceof SourceViolation ? 1 : 2;
     }
     console.log(WORKSPACE_SOURCE_SUCCESS);
     return 0;
 };
-const main = ()=>{
-    process.exitCode = runWorkspaceSourceCheck();
+const USAGE = `modern-i18n-check [--workspace-root <path>]
+Runs the UltraModern i18n and boundary source checks for a workspace.
+Workspace defaults to ULTRAMODERN_WORKSPACE_ROOT then cwd. Options come from
+package.json "modernjs.i18nCheck": { sourceRoots, locales, pluralCategories }.
+Exit codes: 0 valid, 1 source violation, 2 tool/configuration failure.`;
+const isStringArray = (value)=>Array.isArray(value) && value.every((entry)=>'string' == typeof entry && entry.length > 0);
+const isLocaleArray = (value)=>{
+    if (!isStringArray(value)) return false;
+    try {
+        Intl.getCanonicalLocales(value);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const isRecord = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+const isWorkspaceDirectory = (root, entry)=>{
+    if (node_path.isAbsolute(entry)) return false;
+    const target = node_path.resolve(root, entry);
+    if (!node_fs.existsSync(target) || !node_fs.statSync(target).isDirectory()) return false;
+    const relative = node_path.relative(node_fs.realpathSync(root), node_fs.realpathSync(target));
+    return '' !== relative && '..' !== relative && !relative.startsWith(`..${node_path.sep}`) && !node_path.isAbsolute(relative);
+};
+const CLDR_PLURAL_CATEGORIES = new Set([
+    'zero',
+    'one',
+    'two',
+    'few',
+    'many',
+    'other'
+]);
+const isPluralCategories = (value)=>isRecord(value) && Object.values(value).every((categories)=>isStringArray(categories) && categories.includes('other') && categories.every((category)=>CLDR_PLURAL_CATEGORIES.has(category)));
+const readWorkspaceCheckOptions = (root)=>{
+    const manifestPath = node_path.join(root, 'package.json');
+    const modernjs = JSON.parse(readText(manifestPath)).modernjs;
+    const config = isRecord(modernjs) && Object.hasOwn(modernjs, 'i18nCheck') ? modernjs.i18nCheck : {};
+    const invalid = (field, expected)=>new Error(`${manifestPath} "modernjs.i18nCheck${field}" must be ${expected}.`);
+    if (!isRecord(config)) throw invalid('', 'an object');
+    const { locales, pluralCategories } = config;
+    if (void 0 !== locales && !isLocaleArray(locales)) throw invalid('.locales', 'an array of BCP 47 locale codes');
+    if (void 0 !== pluralCategories && !isPluralCategories(pluralCategories)) throw invalid('.pluralCategories', 'an object of locale -> CLDR plural categories including "other"');
+    const sourceRoots = Object.hasOwn(config, 'sourceRoots') ? config.sourceRoots : DEFAULT_SOURCE_ROOTS.filter((entry)=>isWorkspaceDirectory(root, entry));
+    if (!isStringArray(sourceRoots) || 0 === sourceRoots.length || !sourceRoots.every((entry)=>isWorkspaceDirectory(root, entry))) throw invalid('.sourceRoots', `a non-empty array of existing workspace-relative directories (default: whichever of ${DEFAULT_SOURCE_ROOTS.join(', ')} exist)`);
+    return {
+        cwd: root,
+        sourceRoots,
+        locales,
+        pluralCategories
+    };
+};
+const runWorkspaceSourceCheckCli = (args = process.argv.slice(2))=>{
+    let workspaceRoot = process.env.ULTRAMODERN_WORKSPACE_ROOT ?? process.cwd();
+    for(let index = 0; index < args.length; index += 1){
+        const argument = args[index];
+        if ('--help' === argument || '-h' === argument) {
+            console.log(USAGE);
+            return 0;
+        }
+        const value = args[index + 1];
+        if ('--workspace-root' !== argument || !value || value.startsWith('--')) {
+            console.error(`Invalid argument: ${argument ?? ''}. Use --help.`);
+            return 2;
+        }
+        workspaceRoot = value;
+        index += 1;
+    }
+    try {
+        return runWorkspaceSourceCheck(readWorkspaceCheckOptions(node_path.resolve(workspaceRoot)));
+    } catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 2;
+    }
 };
-export { main, runWorkspaceSourceCheck };
+export { runWorkspaceSourceCheck, runWorkspaceSourceCheckCli };