spfx-estate-doctor: Inventory an SPFx Estate Without Touching a Tenant

The spfx-estate-doctor tool allows for a deep inspection of a single SPFx project, but its purpose is to provide an inventory of an organization's collection of projects. The tool can identify which solutions are present, which use outdated SPFx versions, which lack owner information, and if projects reuse component or solution IDs. It also checks if directories are simply folders of files, rather than packaged solutions.

To use the tool, the user runs the command 'npx spfx-estate-doctor scan' followed by the path to the webparts directory. The user can provide a newline-delimited manifest file, like 'projects.txt', to scan multiple projects at once. The tool scans only the directories explicitly given by the user and does not perform recursive discovery.

Per project, the tool checks the package identity, SPFx dependency and version, SPFx-to-Node compatibility snapshot, solution manifest shape, and component manifest shape. Across the estate, it identifies duplicate component IDs across projects and duplicate solution IDs across projects. Missing files are reported as "skipped," not marked as "healthy." This distinction is important because the absence of a package-solution.json file means the project was not checked, not that it is verified.

The tool does not make any network calls, execute project commands, read credentials, invoke Microsoft 365 CLI, or write files inside the inspected projects. Its JSON output contains no timestamps or absolute machine paths, allowing for byte-identical reports over time. The report provides an offline inventory of local project files only, and it is not meant for tenant validation, App Catalog state, deployment status, or security audits.

The tool is designed to be simple and boring, focusing solely on inventory and not on tenant validation, deployment status, or security audits. It produces explicit evidence rather than vague health scores. Verified locally, the tool passes 15 deterministic tests, includes TypeScript checks and build passing, ensures no npm audit vulnerabilities, and scans for cross-project duplicate IDs. The tool's deterministic report and read-only behavior are confirmed.

The repository for the tool is available at github.com/vystartasv/spfx-estate-doctor. The public question is whether the tool remains useful when pointed at real project directories without turning into an invasive dashboard or a machine that claims certainty.