@bleedingdev/modern-js-code-tools 3.9.0-ultramodern.17 → 3.9.0-ultramodern.18

package/dist/esm-node/cli/microvertical-api-check.js

@@ -1,28 +1,47 @@
 import "node:module";
+import node_path from "node:path";
+import { pathToFileURL } from "node:url";
 import { checkMicroVerticalApiBoundaries, checkMicroVerticalApiConsumerFiles } from "../microvertical-api-boundary.js";
-function runMicroVerticalApiCheckCli(args = process.argv.slice(2), filesOnly = false) {
+const flags = [
+    '--workspace-root',
+    '--baseline-package-directory',
+    '--rules'
+];
+async function loadContractRules(file) {
+    const rules = (await import(pathToFileURL(node_path.resolve(file)).href)).default;
+    if (!Array.isArray(rules) || !rules.every((rule)=>'function' == typeof rule)) throw new Error(`${file}: default export must be an array of contract rule functions, e.g. \`export default [myRule]\``);
+    return rules;
+}
+async function runMicroVerticalApiCheckCli(args = process.argv.slice(2), filesOnly = false) {
     let workspaceRoot = process.env.ULTRAMODERN_WORKSPACE_ROOT ?? process.cwd();
     let baselinePackageDirectory;
+    const ruleFiles = [];
     for(let index = 0; index < args.length; index += 1){
         const argument = args[index];
         if ('--help' === argument || '-h' === argument) {
-            console.log(`${filesOnly ? 'modern-api-check-files' : 'modern-api-check'} [--workspace-root <path>] [--baseline-package-directory <path>]\n${filesOnly ? 'Checks consumer files, contracts, package exports and owner identity. Does not analyze runtime topology; run the strict Effect source phase separately.' : 'Checks consumer files, contracts, package exports, owner identity and runtime topology once per API entry.'}\nWorkspace defaults to ULTRAMODERN_WORKSPACE_ROOT then cwd. Exit codes: 0 valid, 1 consumer violation, 2 tool/configuration failure.`);
+            console.log(`${filesOnly ? 'modern-api-check-files' : 'modern-api-check'} [--workspace-root <path>] [--baseline-package-directory <path>] [--rules <module>]...\n${filesOnly ? 'Checks consumer files, contracts, package exports and owner identity. Does not analyze runtime topology; run the strict Effect source phase separately.' : 'Checks consumer files, contracts, package exports, owner identity and runtime topology once per API entry.'}\n--rules loads a module whose default export is an array of contract rules; each rule receives the module graph of every API contract.\nWorkspace defaults to ULTRAMODERN_WORKSPACE_ROOT then cwd. Exit codes: 0 valid, 1 consumer violation, 2 tool/configuration failure.`);
             return 0;
         }
-        if (![
-            '--workspace-root',
-            '--baseline-package-directory'
-        ].includes(argument ?? '') || !args[index + 1] || args[index + 1]?.startsWith('--')) {
+        if (!flags.includes(argument ?? '') || !args[index + 1] || args[index + 1]?.startsWith('--')) {
             console.error(`Invalid argument: ${argument ?? ''}. Use --help.`);
             return 2;
         }
         const value = args[++index];
         if ('--workspace-root' === argument) workspaceRoot = value;
+        else if ('--rules' === argument) ruleFiles.push(value);
         else baselinePackageDirectory = value;
     }
+    const contractRules = [];
+    for (const file of ruleFiles)try {
+        contractRules.push(...await loadContractRules(file));
+    } catch (error) {
+        console.error(`API tool error: --rules ${error instanceof Error ? error.message : String(error)}`);
+        return 2;
+    }
     const result = (filesOnly ? checkMicroVerticalApiConsumerFiles : checkMicroVerticalApiBoundaries)({
         workspaceRoot,
-        baselinePackageDirectory
+        baselinePackageDirectory,
+        contractRules
     });
     for (const diagnostic of result.diagnostics)console.error(`API violation: ${diagnostic}`);
     for (const error of result.toolErrors)console.error(`API tool error: ${error}`);

package/dist/esm-node/cli/workspace-source-check.js

@@ -7,6 +7,11 @@ const DEFAULT_LOCALES = [
     'en',
     'cs'
 ];
+const DEFAULT_SOURCE_ROOTS = [
+    'apps',
+    'verticals',
+    'packages'
+];
 const ignoredDirectories = new Set([
     '.modern',
     '.modernjs',
@@ -40,6 +45,8 @@ const createLocaleJsonMatcher = (locales)=>{
 const resolvePluralCategories = (locale, overrides)=>overrides?.[locale] ?? new Intl.PluralRules(locale).resolvedOptions().pluralCategories;
 const readText = (filePath)=>node_fs.readFileSync(filePath, 'utf-8');
 const localeImportPattern = (locale)=>new RegExp(`import\\s+(?:\\*\\s+as\\s+)?[A-Za-z_$][\\w$]*\\s+from\\s+['"]\\.\\./locales/${escapeRegExp(locale)}/[^'"]+\\.json['"]`, 'u');
+class SourceViolation extends Error {
+}
 const checkRuntimeResources = (root, filePath, text, locales)=>{
     const relative = relativePath(root, filePath);
     if (!relative.endsWith('/src/modern.runtime.ts')) return;
@@ -47,7 +54,7 @@ const checkRuntimeResources = (root, filePath, text, locales)=>{
     const registersResources = /initOptions\s*:\s*\{[\s\S]*?\bresources\s*[,:}]/u.test(text);
     if (missingLocales.length > 0 || !registersResources) {
         const detail = missingLocales.length > 0 ? `missing locale JSON imports for: ${missingLocales.join(', ')}` : 'initOptions does not register a `resources` entry';
-        throw new Error(`${relative} must register locale JSON resources in modern.runtime.ts so Worker SSR and hydration use the same first-render translations (${detail}).`);
+        throw new SourceViolation(`${relative} must register locale JSON resources in modern.runtime.ts so Worker SSR and hydration use the same first-render translations (${detail}).`);
     }
 };
 const visitLocaleKeys = (value, visitor, pathParts = [])=>{
@@ -67,7 +74,7 @@ const checkPluralResources = (root, filePath, json, requiredSuffixes, pluralSuff
     visitLocaleKeys(json, (key, value, pathParts)=>{
         if ('string' != typeof value || !value.includes('{{count}}')) return;
         const suffixMatch = key.match(pluralSuffixPattern);
-        if (!suffixMatch) throw new Error(`${relative} key ${pathParts.join('.')} contains {{count}} but is not plural-suffixed.`);
+        if (!suffixMatch) throw new SourceViolation(`${relative} key ${pathParts.join('.')} contains {{count}} but is not plural-suffixed.`);
         const [, base = '', suffix = ''] = suffixMatch;
         const parentPath = pathParts.slice(0, -1).join('.');
         const groupKey = `${parentPath}.${base}`;
@@ -75,7 +82,7 @@ const checkPluralResources = (root, filePath, json, requiredSuffixes, pluralSuff
         existing.add(suffix);
         groups.set(groupKey, existing);
     });
-    for (const [group, suffixes] of groups)for (const suffix of requiredSuffixes)if (!suffixes.has(suffix)) throw new Error(`${relative} plural group ${group} is missing _${suffix}.`);
+    for (const [group, suffixes] of groups)for (const suffix of requiredSuffixes)if (!suffixes.has(suffix)) throw new SourceViolation(`${relative} plural group ${group} is missing _${suffix}.`);
 };
 const runRuntimeAndLocaleResourceChecks = (root, sourceRoots, locales, pluralCategories)=>{
     if (0 === locales.length) return;
@@ -97,11 +104,7 @@ const runRuntimeAndLocaleResourceChecks = (root, sourceRoots, locales, pluralCat
         checkPluralResources(root, filePath, JSON.parse(readText(filePath)), localeCategories.get(language) ?? [], pluralSuffixPattern);
     }
 };
-const runWorkspaceSourceCheck = ({ cwd = process.cwd(), sourceRoots = [
-    'apps',
-    'verticals',
-    'packages'
-], locales = DEFAULT_LOCALES, pluralCategories } = {})=>{
+const runWorkspaceSourceCheck = ({ cwd = process.cwd(), sourceRoots = DEFAULT_SOURCE_ROOTS, locales = DEFAULT_LOCALES, pluralCategories } = {})=>{
     const oxlintResult = runOxlintRules({
         cwd,
         targets: sourceRoots,
@@ -134,13 +137,83 @@ const runWorkspaceSourceCheck = ({ cwd = process.cwd(), sourceRoots = [
     try {
         runRuntimeAndLocaleResourceChecks(cwd, sourceRoots, locales, pluralCategories);
     } catch (error) {
-        console.error(error instanceof Error ? error.message : 'UltraModern workspace source checks failed.');
-        return 1;
+        console.error(error instanceof Error ? error.message : String(error));
+        return error instanceof SourceViolation ? 1 : 2;
     }
     console.log(WORKSPACE_SOURCE_SUCCESS);
     return 0;
 };
-const main = ()=>{
-    process.exitCode = runWorkspaceSourceCheck();
+const USAGE = `modern-i18n-check [--workspace-root <path>]
+Runs the UltraModern i18n and boundary source checks for a workspace.
+Workspace defaults to ULTRAMODERN_WORKSPACE_ROOT then cwd. Options come from
+package.json "modernjs.i18nCheck": { sourceRoots, locales, pluralCategories }.
+Exit codes: 0 valid, 1 source violation, 2 tool/configuration failure.`;
+const isStringArray = (value)=>Array.isArray(value) && value.every((entry)=>'string' == typeof entry && entry.length > 0);
+const isLocaleArray = (value)=>{
+    if (!isStringArray(value)) return false;
+    try {
+        Intl.getCanonicalLocales(value);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const isRecord = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+const isWorkspaceDirectory = (root, entry)=>{
+    if (node_path.isAbsolute(entry)) return false;
+    const target = node_path.resolve(root, entry);
+    if (!node_fs.existsSync(target) || !node_fs.statSync(target).isDirectory()) return false;
+    const relative = node_path.relative(node_fs.realpathSync(root), node_fs.realpathSync(target));
+    return '' !== relative && '..' !== relative && !relative.startsWith(`..${node_path.sep}`) && !node_path.isAbsolute(relative);
+};
+const CLDR_PLURAL_CATEGORIES = new Set([
+    'zero',
+    'one',
+    'two',
+    'few',
+    'many',
+    'other'
+]);
+const isPluralCategories = (value)=>isRecord(value) && Object.values(value).every((categories)=>isStringArray(categories) && categories.includes('other') && categories.every((category)=>CLDR_PLURAL_CATEGORIES.has(category)));
+const readWorkspaceCheckOptions = (root)=>{
+    const manifestPath = node_path.join(root, 'package.json');
+    const modernjs = JSON.parse(readText(manifestPath)).modernjs;
+    const config = isRecord(modernjs) && Object.hasOwn(modernjs, 'i18nCheck') ? modernjs.i18nCheck : {};
+    const invalid = (field, expected)=>new Error(`${manifestPath} "modernjs.i18nCheck${field}" must be ${expected}.`);
+    if (!isRecord(config)) throw invalid('', 'an object');
+    const { locales, pluralCategories } = config;
+    if (void 0 !== locales && !isLocaleArray(locales)) throw invalid('.locales', 'an array of BCP 47 locale codes');
+    if (void 0 !== pluralCategories && !isPluralCategories(pluralCategories)) throw invalid('.pluralCategories', 'an object of locale -> CLDR plural categories including "other"');
+    const sourceRoots = Object.hasOwn(config, 'sourceRoots') ? config.sourceRoots : DEFAULT_SOURCE_ROOTS.filter((entry)=>isWorkspaceDirectory(root, entry));
+    if (!isStringArray(sourceRoots) || 0 === sourceRoots.length || !sourceRoots.every((entry)=>isWorkspaceDirectory(root, entry))) throw invalid('.sourceRoots', `a non-empty array of existing workspace-relative directories (default: whichever of ${DEFAULT_SOURCE_ROOTS.join(', ')} exist)`);
+    return {
+        cwd: root,
+        sourceRoots,
+        locales,
+        pluralCategories
+    };
+};
+const runWorkspaceSourceCheckCli = (args = process.argv.slice(2))=>{
+    let workspaceRoot = process.env.ULTRAMODERN_WORKSPACE_ROOT ?? process.cwd();
+    for(let index = 0; index < args.length; index += 1){
+        const argument = args[index];
+        if ('--help' === argument || '-h' === argument) {
+            console.log(USAGE);
+            return 0;
+        }
+        const value = args[index + 1];
+        if ('--workspace-root' !== argument || !value || value.startsWith('--')) {
+            console.error(`Invalid argument: ${argument ?? ''}. Use --help.`);
+            return 2;
+        }
+        workspaceRoot = value;
+        index += 1;
+    }
+    try {
+        return runWorkspaceSourceCheck(readWorkspaceCheckOptions(node_path.resolve(workspaceRoot)));
+    } catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 2;
+    }
 };
-export { main, runWorkspaceSourceCheck };
+export { runWorkspaceSourceCheck, runWorkspaceSourceCheckCli };

package/dist/esm-node/microvertical-api-baseline.js

@@ -1,36 +1,14 @@
 import "node:module";
-import node_fs from "node:fs";
-import { createRequire } from "node:module";
-import node_path from "node:path";
-import { exports as external_resolve_exports_exports } from "resolve.exports";
 import { baselinePublicIdentityIsExact } from "./microvertical-api-owner.js";
-import { SourceSyntaxError, parseSource, traverseSource, unwrapExpression } from "./source-analysis.js";
+import { createModuleGraph, exportedConst, localConst, propertyName } from "./module-graph.js";
+import { SourceSyntaxError, unwrapExpression } from "./source-analysis.js";
 import * as __rspack_external__babel_types_6e8337dd from "@babel/types";
-function parseConsumer(filePath) {
-    if (node_fs.statSync(filePath).size > 1000000) throw new Error(`${filePath}: consumer source exceeds 1 MB analysis budget`);
-    const file = parseSource(node_fs.readFileSync(filePath, 'utf8'), filePath);
-    traverseSource(file, {
-        AssignmentExpression (p) {
-            throw new SourceSyntaxError(`contract bindings must be immutable at ${p.node.start}`);
-        },
-        UpdateExpression (p) {
-            throw new SourceSyntaxError(`contract bindings must be immutable at ${p.node.start}`);
-        },
-        TSModuleDeclaration () {
-            throw new SourceSyntaxError('contract bindings must not be merged with namespaces');
-        }
-    });
-    return file;
-}
 const camelCaseStem = (stem)=>stem.replaceAll(/-([a-z0-9])/gu, (_match, letter)=>letter.toUpperCase());
 const pascalCaseStem = (stem)=>{
     const camelStem = camelCaseStem(stem);
     return `${camelStem.slice(0, 1).toUpperCase()}${camelStem.slice(1)}`;
 };
 const identifierName = (node)=>void 0 !== node && __rspack_external__babel_types_6e8337dd.isIdentifier(node) ? node.name : void 0;
-const propertyName = (node)=>{
-    if (void 0 !== node && (__rspack_external__babel_types_6e8337dd.isIdentifier(node) || __rspack_external__babel_types_6e8337dd.isStringLiteral(node) || __rspack_external__babel_types_6e8337dd.isNumericLiteral(node))) return __rspack_external__babel_types_6e8337dd.isIdentifier(node) ? node.name : String(node.value);
-};
 const accessPath = (node)=>{
     if (__rspack_external__babel_types_6e8337dd.isIdentifier(node)) return [
         node.name
@@ -59,201 +37,6 @@ const callExpression = (expression, callee)=>{
     const unwrapped = unwrapExpression(expression);
     return __rspack_external__babel_types_6e8337dd.isCallExpression(unwrapped) && isAccessPath(unwrapped.callee, callee) ? unwrapped : void 0;
 };
-const localConst = (sourceFile, name)=>{
-    for (const item of sourceFile.program.body){
-        const statement = __rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(item) ? item.declaration : item;
-        if (!__rspack_external__babel_types_6e8337dd.isVariableDeclaration(statement) || 'const' !== statement.kind) continue;
-        const matches = statement.declarations.filter((declaration)=>__rspack_external__babel_types_6e8337dd.isIdentifier(declaration.id, {
-                name
-            }));
-        if (1 === matches.length) return matches[0];
-    }
-};
-const exportedConst = (sourceFile, name)=>{
-    for (const statement of sourceFile.program.body)if (__rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(statement) && 'type' !== statement.exportKind) {
-        if (__rspack_external__babel_types_6e8337dd.isVariableDeclaration(statement.declaration) && 'const' === statement.declaration.kind) {
-            const declaration = statement.declaration.declarations.find((value)=>__rspack_external__babel_types_6e8337dd.isIdentifier(value.id, {
-                    name
-                }));
-            if (declaration) return declaration;
-        }
-        if (!statement.source && statement.specifiers.some((value)=>__rspack_external__babel_types_6e8337dd.isExportSpecifier(value) && 'type' !== value.exportKind && __rspack_external__babel_types_6e8337dd.isIdentifier(value.local, {
-                name
-            }) && __rspack_external__babel_types_6e8337dd.isIdentifier(value.exported, {
-                name
-            }))) return localConst(sourceFile, name);
-    }
-};
-const inside = (file, boundary)=>file === boundary || file.startsWith(`${boundary}${node_path.sep}`);
-const containingWorkspace = (file)=>{
-    for(let directory = node_path.dirname(file);; directory = node_path.dirname(directory)){
-        if (node_fs.existsSync(node_path.join(directory, 'pnpm-workspace.yaml'))) return node_fs.realpathSync(directory);
-        if (directory === node_path.dirname(directory)) return;
-    }
-};
-const sourceBoundary = (file, workspace)=>{
-    for(let directory = node_path.dirname(file);; directory = node_path.dirname(directory)){
-        if (node_fs.existsSync(node_path.join(directory, 'package.json')) && directory !== workspace) return node_fs.realpathSync(directory);
-        if (directory === workspace || directory === node_path.dirname(directory)) return node_fs.realpathSync(node_path.dirname(file));
-    }
-};
-const sourceFileAt = (target, boundary)=>{
-    const stem = target.replace(/\.(?:[cm]?[jt]sx?)$/u, '');
-    for (const candidate of [
-        `${stem}.ts`,
-        `${stem}.tsx`,
-        `${stem}.mts`,
-        `${stem}.cts`,
-        target,
-        node_path.join(target, 'index.ts'),
-        node_path.join(target, 'index.tsx')
-    ])try {
-        const real = node_fs.realpathSync(candidate);
-        if (inside(real, boundary) && node_fs.statSync(real).isFile()) return real;
-    } catch  {}
-};
-const packageEntry = (specifier)=>{
-    if (specifier.startsWith('.') || specifier.startsWith('/') || specifier.startsWith('#')) return;
-    const parts = specifier.split('/');
-    const count = specifier.startsWith('@') ? 2 : 1;
-    if (parts.length < count || parts.slice(0, count).some((part)=>!part)) return;
-    return {
-        name: parts.slice(0, count).join('/'),
-        exportKey: parts.length === count ? '.' : `./${parts.slice(count).join('/')}`
-    };
-};
-const resolveModulePath = (module, specifier, workspace)=>{
-    if (/^\.\.?\//u.test(specifier)) {
-        const file = sourceFileAt(node_path.resolve(node_path.dirname(module.path), specifier), module.boundary);
-        return void 0 === file ? void 0 : {
-            path: file,
-            boundary: module.boundary
-        };
-    }
-    const entry = packageEntry(specifier);
-    if (!entry || !workspace) return;
-    const paths = createRequire(module.path).resolve.paths(entry.name) ?? [];
-    for (const lookup of paths){
-        const directory = node_path.join(lookup, entry.name);
-        const manifest = node_path.join(directory, 'package.json');
-        if (!node_fs.existsSync(manifest)) continue;
-        const boundary = node_fs.realpathSync(directory);
-        if (!inside(boundary, workspace) || boundary.split(node_path.sep).includes('node_modules')) break;
-        const pkg = JSON.parse(node_fs.readFileSync(manifest, 'utf8'));
-        if (pkg.name !== entry.name || void 0 === pkg.exports) break;
-        let target;
-        try {
-            const targets = external_resolve_exports_exports(pkg, entry.exportKey, {
-                conditions: [
-                    'modern:source'
-                ]
-            });
-            target = Array.isArray(targets) ? targets[0] : void 0;
-        } catch  {
-            break;
-        }
-        if (!target || !target.startsWith('./')) break;
-        const file = sourceFileAt(node_path.resolve(boundary, target), boundary);
-        return void 0 === file ? void 0 : {
-            path: file,
-            boundary
-        };
-    }
-};
-const createModuleReader = (root)=>{
-    const modules = new Map([
-        [
-            root.path,
-            root
-        ]
-    ]);
-    return (filePath, boundary)=>{
-        if (modules.has(filePath)) return modules.get(filePath);
-        if (modules.size >= 256) return;
-        let module;
-        try {
-            module = {
-                file: parseConsumer(filePath),
-                path: filePath,
-                boundary
-            };
-        } catch  {
-            module = void 0;
-        }
-        modules.set(filePath, module);
-        return module;
-    };
-};
-const importedBinding = (module, name)=>{
-    for (const statement of module.file.program.body)if (__rspack_external__babel_types_6e8337dd.isImportDeclaration(statement) && 'type' !== statement.importKind) {
-        for (const specifier of statement.specifiers)if (__rspack_external__babel_types_6e8337dd.isIdentifier(specifier.local, {
-            name
-        })) {
-            if (__rspack_external__babel_types_6e8337dd.isImportSpecifier(specifier) && 'type' !== specifier.importKind) return {
-                imported: propertyName(specifier.imported) ?? name,
-                specifier: statement.source.value
-            };
-            if (__rspack_external__babel_types_6e8337dd.isImportDefaultSpecifier(specifier)) return {
-                imported: 'default',
-                specifier: statement.source.value
-            };
-        }
-    }
-};
-const reexportedBinding = (module, name)=>{
-    for (const statement of module.file.program.body){
-        if (!__rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(statement) || 'type' === statement.exportKind) continue;
-        const specifier = statement.specifiers.find((value)=>__rspack_external__babel_types_6e8337dd.isExportSpecifier(value) && 'type' !== value.exportKind && propertyName(value.exported) === name);
-        if (void 0 !== specifier && __rspack_external__babel_types_6e8337dd.isExportSpecifier(specifier)) return {
-            local: __rspack_external__babel_types_6e8337dd.isIdentifier(specifier.local) ? specifier.local.name : specifier.local.value,
-            ...statement.source ? {
-                specifier: statement.source.value
-            } : {}
-        };
-    }
-};
-const defaultExport = (module)=>{
-    for (const statement of module.file.program.body){
-        if (!__rspack_external__babel_types_6e8337dd.isExportDefaultDeclaration(statement)) continue;
-        const declaration = statement.declaration;
-        if (__rspack_external__babel_types_6e8337dd.isIdentifier(declaration)) return declaration.name;
-        return __rspack_external__babel_types_6e8337dd.isExpression(declaration) ? declaration : void 0;
-    }
-};
-const resolveBinding = (module, name, scope, readModule, workspace, seen)=>{
-    const key = `${scope}:${module.path}#${name}`;
-    if (seen.has(key) || seen.size >= 512) return;
-    seen.add(key);
-    const declaration = 'export' === scope ? exportedConst(module.file, name) : localConst(module.file, name);
-    if (declaration?.init) return {
-        expression: declaration.init,
-        module
-    };
-    const throughModule = (specifier, imported)=>{
-        const resolved = resolveModulePath(module, specifier, workspace);
-        const target = resolved && readModule(resolved.path, resolved.boundary);
-        return void 0 === target ? void 0 : resolveBinding(target, imported, 'export', readModule, workspace, seen);
-    };
-    if ('local' === scope) {
-        const imported = importedBinding(module, name);
-        return void 0 === imported ? void 0 : throughModule(imported.specifier, imported.imported);
-    }
-    if ('default' === name) {
-        const exported = defaultExport(module);
-        if ('string' == typeof exported) return resolveBinding(module, exported, 'local', readModule, workspace, seen);
-        return void 0 === exported ? void 0 : {
-            expression: exported,
-            module
-        };
-    }
-    const reexported = reexportedBinding(module, name);
-    if (void 0 !== reexported) return void 0 === reexported.specifier ? resolveBinding(module, reexported.local, 'local', readModule, workspace, seen) : throughModule(reexported.specifier, reexported.local);
-    for (const statement of module.file.program.body){
-        if (!__rspack_external__babel_types_6e8337dd.isExportAllDeclaration(statement) || 'type' === statement.exportKind) continue;
-        const resolved = throughModule(statement.source.value, name);
-        if (void 0 !== resolved) return resolved;
-    }
-};
 const objectLiteral = (expression)=>{
     if (null == expression) return;
     const unwrapped = unwrapExpression(expression);
@@ -381,9 +164,13 @@ const rootComposesFoundation = (sourceFile, declaration, stem, foundationName)=>
     return void 0 !== chain && isAccessPath(chain.base.callee, [
         'HttpApi',
         'make'
-    ]) && 1 === chain.base.arguments.length && stringLiteral(chain.base.arguments[0]) === `${pascalCaseStem(stem)}Api` && chain.methods.length > 0 && chain.methods.every((method, index)=>1 === method.arguments.length && ('add' === method.name || 'addHttpApi' === method.name || index === chain.methods.length - 1 && 'pipe' === method.name && 'identity' === identifierName(method.arguments[0]) && importsExactBindings(sourceFile, 'effect', [
+    ]) && 1 === chain.base.arguments.length && stringLiteral(chain.base.arguments[0]) === `${pascalCaseStem(stem)}Api` && chain.methods.length > 0 && chain.methods.every((method, index)=>{
+        const combinatorArity = nonEndpointCombinators.api[method.name];
+        if (void 0 !== combinatorArity) return method.arguments.length === combinatorArity;
+        return 1 === method.arguments.length && ('add' === method.name || 'addHttpApi' === method.name || index === chain.methods.length - 1 && 'pipe' === method.name && 'identity' === identifierName(method.arguments[0]) && importsExactBindings(sourceFile, 'effect', [
             'identity'
-        ]))) && first?.name === 'addHttpApi' && identifierName(first.arguments[0]) === foundationName;
+        ]));
+    }) && first?.name === 'addHttpApi' && identifierName(first.arguments[0]) === foundationName;
 };
 const nonEndpointCombinators = {
     api: {
@@ -399,9 +186,7 @@ const nonEndpointCombinators = {
         middleware: 1
     }
 };
-const reachableEndpoints = (rootModule, declaration)=>{
-    const readModule = createModuleReader(rootModule);
-    const workspace = containingWorkspace(rootModule.path);
+const reachableEndpoints = (graph, declaration)=>{
     const active = new Set();
     const endpoints = [];
     const identities = new Set();
@@ -423,8 +208,8 @@ const reachableEndpoints = (rootModule, declaration)=>{
         active.add(node);
         try {
             if (__rspack_external__babel_types_6e8337dd.isIdentifier(node)) {
-                const resolved = resolveBinding(module, node.name, 'local', readModule, workspace, new Set());
-                return void 0 !== resolved && visit(resolved.expression, resolved.module, kind, group);
+                const resolved = graph.resolve(module, node.name, 'local');
+                return resolved?.kind === 'declaration' && visit(resolved.expression, resolved.module, kind, group);
             }
             if ('endpoint' === kind) {
                 if (!__rspack_external__babel_types_6e8337dd.isCallExpression(node) || node.arguments.length < 2 || node.arguments.length > 3) return false;
@@ -479,7 +264,7 @@ const reachableEndpoints = (rootModule, declaration)=>{
             active.delete(node);
         }
     };
-    return visit(declaration?.init, rootModule, 'api') ? endpoints : void 0;
+    return visit(declaration?.init, graph.root, 'api') ? endpoints : void 0;
 };
 const operationContextFields = (property)=>{
     const constructorCall = exactCall(property.value, [
@@ -610,8 +395,8 @@ const readinessSchemaIsShared = (declaration, markerSchemaName, ownerMarkerIsIde
     return void 0 !== schema && (schema.identity && ownerMarkerIsIdentity || 1 === schema.assignments.size && identifierName(schema.assignments.get('marker')?.value) === markerSchemaName);
 };
 const declarationIsIdentifier = (declaration, identifier)=>declaration?.init != null && identifierName(unwrapExpression(declaration.init)) === identifier;
-const validateParsedContract = (module, stem, expectation)=>{
-    const sourceFile = module.file;
+const validateParsedContract = (graph, stem, expectation)=>{
+    const sourceFile = graph.root.file;
     const exportStem = camelCaseStem(stem);
     const foundationName = `${exportStem}FoundationApi`;
     const markerSchemaName = `${exportStem}MarkerSchema`;
@@ -628,7 +413,7 @@ const validateParsedContract = (module, stem, expectation)=>{
     if (!readinessSchemaIsShared(exportedConst(sourceFile, readinessSchemaName), markerSchemaName, declarationIsIdentifier(markerDeclaration, 'MicroVerticalBuildMarkerSchema'))) return 'MicroVertical readiness schema must consume the shared readiness schema without overriding shared fields';
     if (!foundationIsExact(exportedConst(sourceFile, foundationName), stem, readinessSchemaName)) return 'MicroVertical readiness foundation API must directly compose its exact readiness endpoint and foundation identity';
     if (!rootComposesFoundation(sourceFile, exportedConst(sourceFile, `${exportStem}Api`), stem, foundationName)) return 'MicroVertical root API must explicitly compose its readiness foundation API';
-    const endpoints = reachableEndpoints(module, exportedConst(sourceFile, `${exportStem}Api`));
+    const endpoints = reachableEndpoints(graph, exportedConst(sourceFile, `${exportStem}Api`));
     if (!endpoints) return 'MicroVertical root API must compose bounded native endpoint declarations without ambiguous identities';
     if (!operationMapIsConnected(exportedConst(sourceFile, `${exportStem}OperationContexts`), stem, expectation.operationPaths ?? {}, endpoints)) return 'MicroVertical operation map must construct every operation with the shared context constructor';
     if (!metadataIsExact(exportedConst(sourceFile, `${exportStem}ApiContract`), expectation, endpoints)) return 'MicroVertical root contract must keep exact owner and API path metadata without forbidden fields';
@@ -640,14 +425,9 @@ const configuredMicroVerticalApiStem = (verticalPath, verticals)=>{
 };
 const microVerticalApiBaselineViolation = (stem, filePath, expectation)=>{
     try {
-        const realPath = node_fs.realpathSync(filePath);
-        const sourceFile = parseConsumer(realPath);
+        const graph = createModuleGraph(filePath);
         if (!baselinePublicIdentityIsExact(filePath, expectation)) return 'MicroVertical baseline imports must resolve the exact framework owner public export and schema identity';
-        return validateParsedContract({
-            file: sourceFile,
-            path: realPath,
-            boundary: sourceBoundary(realPath, containingWorkspace(realPath))
-        }, stem, expectation);
+        return validateParsedContract(graph, stem, expectation);
     } catch (error) {
         if (error instanceof SourceSyntaxError) return `MicroVertical root contract must be valid TypeScript syntax (${error.message})`;
         throw error;

package/dist/esm-node/microvertical-api-boundary.js

@@ -4,7 +4,8 @@ import node_path from "node:path";
 import { parse } from "@babel/parser";
 import { configuredMicroVerticalApiStem, microVerticalApiBaselineViolation } from "./microvertical-api-baseline.js";
 import { baselinePackage, resolveBaselinePackageDirectory } from "./microvertical-api-owner.js";
-import { consumerParserPlugins } from "./source-analysis.js";
+import { createModuleGraph } from "./module-graph.js";
+import { SourceSyntaxError, consumerParserPlugins } from "./source-analysis.js";
 import { createEffectApiImportResolver, strictEffectRuntimeTopologyViolation } from "./strict-effect-runtime.js";
 import * as __rspack_external__babel_types_6e8337dd from "@babel/types";
 const ignored = new Set([
@@ -408,6 +409,27 @@ function check(options, topology) {
                 const violation = microVerticalApiBaselineViolation(stem, absolute(contract), expectation);
                 if (violation) diagnostics.push(`${contract}: ${violation}`);
             }
+            if (options.contractRules?.length && exists(contract)) {
+                let graph;
+                try {
+                    graph = createModuleGraph(absolute(contract));
+                } catch (error) {
+                    if (!(error instanceof SourceSyntaxError)) throw error;
+                    diagnostics.push(`${contract}: contract rules need a parseable contract with immutable bindings (${error.message})`);
+                }
+                if (graph) {
+                    const context = {
+                        appPath,
+                        protocol: rpc ? 'rpc' : 'rest',
+                        graph
+                    };
+                    for (const rule of options.contractRules)guarded(`${contract} (rule ${rule.name || 'anonymous'})`, ()=>{
+                        const messages = rule(context);
+                        if (!Array.isArray(messages) || !messages.every((message)=>'string' == typeof message)) throw new Error('contract rule must return an array of violation messages (return [] when the contract passes)');
+                        for (const message of messages)diagnostics.push(`${contract}: ${message}`);
+                    });
+                }
+            }
             if (client) {
                 const relativeContract = node_path.posix.relative(node_path.posix.dirname(client), contract);
                 moduleShape(client, [
@@ -501,4 +523,4 @@ function check(options, topology) {
 }
 const checkMicroVerticalApiBoundaries = (options)=>check(options, true);
 const checkMicroVerticalApiConsumerFiles = (options)=>check(options, false);
-export { checkMicroVerticalApiBoundaries, checkMicroVerticalApiConsumerFiles, configuredMicroVerticalApiStem, microVerticalApiBaselineViolation };
+export { checkMicroVerticalApiBoundaries, checkMicroVerticalApiConsumerFiles, configuredMicroVerticalApiStem, createModuleGraph, microVerticalApiBaselineViolation };