spfx-estate-doctor: Inventory an SPFx Estate Without Touching a Tenant

spfx-estate-doctor: Inventory an SPFx Estate Without Touching a Tenant A single SPFx project can be inspected deeply. An organisation's collection of projects is a different problem. Which solutions are present? Which use old SPFx versions? Which have no owner information? Which projects reuse a component or solution ID? Which directories are not packaged solutions at all? I built spfx-estate-doctor as an offline, read-only scanner for that shallow-but-wide view. Usage npx spfx-estate-doctor scan ./webparts/alpha ./webparts/bravo \ --json estate.json --md estate.md For larger explicit sets, provide a newline-delimited manifest: # projects.txt ../webparts/alpha ../webparts/bravo ../webparts/legacy npx spfx-estate-doctor scan --manifest projects.txt There is deliberately no recursive discovery. The tool scans only directories explicitly supplied by the operator. What it checks Per project: package identity; SPFx dependency and version; SPFx-to-Node compatibility snapshot; solution manifest shape; component manifest shape; owner information. Across the estate: duplicate component IDs across projects; duplicate solution IDs across projects. Missing files are reported as skipped, not quietly marked healthy. That distinction matters: no package-solution.json means “not checked,” not “verified.” Why it is intentionally boring The scanner makes no network calls, executes no project commands, reads no credentials, invokes no Microsoft 365 CLI, and writes no files inside inspected projects. Its JSON output contains no timestamps or absolute machine paths, so the same estate produces a byte-identical report that can be diffed over time. The report says exactly what it knows: Offline inventory of local project files only. This is not tenant validation, App Catalog state, deployment status, or a security audit. It cannot tell you what is deployed, whether a tenant permission is granted, whether a project builds, or whether the code is secure. Those are separate checks. Relationship to spfx-assurance spfx-assurance is the one-project deep verifier. spfx-estate-doctor is the many-projects shallow inventory layer. spfx-estate-doctor → What exists across the estate? spfx-assurance → Does this project look shippable locally? Both produce explicit evidence rather than a vague health score. Verified locally: 15 deterministic tests passing; TypeScript check and build passing; package dry run containing 9 intended runtime files; zero npm audit vulnerabilities; strict pre-publish scrub passing; compiled CLI detecting cross-project duplicate IDs; deterministic report and read-only behavior verified. No live SharePoint tenant validation has been performed. Repository: github.com/vystartasv/spfx-estate-doctor The public question is simple: does this remain useful when pointed at real project directories, without turning into an invasive dashboard or a machine that invents certainty?