spfx-estate-doctor: Inventory an SPFx Estate Without Touching a Tenant

A single SPFx project can be inspected deeply. An organisation's collection of projects is a different problem.

Which solutions are present? Which use old SPFx versions? Which have no owner information? Which projects reuse a component or solution ID? Which directories are not packaged solutions at all?

I built spfx-estate-doctor as an offline, read-only scanner for that shallow-but-wide view.

Usage

npx spfx-estate-doctor scan ./webparts/alpha ./webparts/bravo \
  --json estate.json --md estate.md

For larger explicit sets, provide a newline-delimited manifest:

# projects.txt
../webparts/alpha
../webparts/bravo
../webparts/legacy

npx spfx-estate-doctor scan --manifest projects.txt

There is deliberately no recursive discovery. The tool scans only directories explicitly supplied by the operator.

What it checks

Per project:

• package identity;
• SPFx dependency and version;
• SPFx-to-Node compatibility snapshot;
• solution manifest shape;
• component manifest shape;
• owner information.

Across the estate:

• duplicate component IDs across projects;
• duplicate solution IDs across projects.

Missing files are reported as skipped, not quietly marked healthy. That distinction matters: no package-solution.json means “not checked,” not “verified.”

Why it is intentionally boring

The scanner makes no network calls, executes no project commands, reads no credentials, invokes no Microsoft 365 CLI, and writes no files inside inspected projects. Its JSON output contains no timestamps or absolute machine paths, so the same estate produces a byte-identical report that can be diffed over time.

The report says exactly what it knows:

Offline inventory of local project files only. This is not tenant validation, App Catalog state, deployment status, or a security audit.

It cannot tell you what is deployed, whether a tenant permission is granted, whether a project builds, or whether the code is secure. Those are separate checks.

Relationship to spfx-assurance

spfx-assurance is the one-project deep verifier. spfx-estate-doctor is the many-projects shallow inventory layer.

spfx-estate-doctor  →  What exists across the estate?
spfx-assurance      →  Does this project look shippable locally?

Both produce explicit evidence rather than a vague health score.

Verified locally:

• 15 deterministic tests passing;
• TypeScript check and build passing;
• package dry run containing 9 intended runtime files;
• zero npm audit vulnerabilities;
• strict pre-publish scrub passing;
• compiled CLI detecting cross-project duplicate IDs;
• deterministic report and read-only behavior verified.

No live SharePoint tenant validation has been performed.

Repository: github.com/vystartasv/spfx-estate-doctor

The public question is simple: does this remain useful when pointed at real project directories, without turning into an invasive dashboard or a machine that invents certainty?