@hearthlog/tooling 0.0.0-stage → 0.1.1

package/src/check/check-modules.ts

@@ -0,0 +1,198 @@
+#!/usr/bin/env npx tsx
+/**
+ * Module boundary check.
+ *
+ * A module (`modules/<name>/`) may import only the platform's published API
+ * (`@hearthlog/sdk/*`, `@hearthlog/contracts`), Svelte and SvelteKit (`svelte`,
+ * `$app/*`, `@sveltejs/kit`), icons, its declared third-party dependencies, and its own files;
+ * its tests may also use Vitest, Node built-ins, and `@hearthlog/sdk/testing`.
+ * Worker code (`src/server/`) may import only the SDK's Worker-safe entries.
+ * It may not reach into the app (`#lib`, `$lib`, relative paths leaving the
+ * module) or into another module. The app may import a module only through
+ * the generated files the composer writes.
+ *
+ * Usage: pnpm check:modules
+ */
+
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { hostRoot } from "../root.js";
+
+const ROOT = hostRoot();
+const SOURCE = /\.(ts|svelte|js)$/;
+const IMPORT = /(?:^|[^\w$.])(?:import|export)\s[^'"]*?from\s+['"]([^'"]+)['"]|import\(\s*['"]([^'"]+)['"]\s*\)|^\s*import\s+['"]([^'"]+)['"]/gm;
+
+function files(directory: string): string[] {
+    // A checkout that lacks a directory (a module repository, a scratch workspace) has nothing to scan there.
+    if (!existsSync(directory)) return [];
+    return readdirSync(directory).flatMap((name) => {
+        if (name === "node_modules" || name.startsWith(".")) return [];
+        const path = join(directory, name);
+        return statSync(path).isDirectory() ? files(path) : SOURCE.test(name) ? [path] : [];
+    });
+}
+
+function specifiers(path: string): string[] {
+    return [...readFileSync(path, "utf8").matchAll(IMPORT)].map((match) => match[1] ?? match[2] ?? match[3]!).filter(Boolean);
+}
+
+export function moduleImportProblem(specifier: string, file: string, moduleRoot: string, allowedPackages: readonly string[]): string | null {
+    if (specifier.startsWith("#lib") || specifier.startsWith("$lib")) return "imports the app directly";
+    if (specifier.startsWith(".")) {
+        const target = resolve(dirname(file), specifier);
+        return target === moduleRoot || target.startsWith(moduleRoot + sep) ? null : "leaves the module with a relative path";
+    }
+    if (specifier.startsWith("@hearthlog/module-")) return "imports another module";
+    // Worker code must not drag the browser app into the gateway bundle.
+    if (file.includes(`${sep}src${sep}server${sep}`)) {
+        const WORKER_SAFE = ["server", "server-testing", "entities", "axis", "format"];
+        if (specifier.startsWith("@hearthlog/sdk/") && !WORKER_SAFE.includes(specifier.slice("@hearthlog/sdk/".length))) {
+            return "pulls browser code into Worker code (use @hearthlog/sdk/server or entities)";
+        }
+        if (specifier === "svelte" || specifier.startsWith("svelte/") || specifier.startsWith("$app/") || specifier.startsWith("~icons/")) {
+            return "uses a browser-only package in Worker code";
+        }
+    }
+    if (specifier.startsWith("@hearthlog/sdk/") || specifier === "@hearthlog/contracts") return null;
+    // The framework: `redirect`, `error`, and the like.
+    if (specifier === "@sveltejs/kit" && !file.includes(`${sep}src${sep}server${sep}`)) return null;
+    if (specifier === "svelte" || specifier.startsWith("svelte/") || specifier.startsWith("$app/") || specifier.startsWith("~icons/")) return null;
+    // Tests run under Vitest in Node.
+    if (/\.test\.ts$/.test(file) && (specifier === "vitest" || specifier.startsWith("node:"))) return null;
+    const name = specifier.startsWith("@") ? specifier.split("/").slice(0, 2).join("/") : specifier.split("/")[0]!;
+    return allowedPackages.includes(name) ? null : `uses ${name}, which its package.json does not declare`;
+}
+
+/** What the installed modules define, from the catalog the composer generates. */
+export interface ModuleDomain {
+    /** Entity names and table names, quoted in code. */
+    names: string[];
+    /** Event types (`TRANSACTION_ADDED`) of every module-owned entity. */
+    eventTypes: string[];
+}
+
+/**
+ * The names the installed modules define: their entity and table names (from the generated module
+ * catalog) and event types (from the Ledger's generated contracts). A checkout without those
+ * generated files, such as a module repository or a scratch workspace, has none to guard.
+ */
+export async function loadModuleDomain(root = ROOT): Promise<ModuleDomain> {
+    const catalog = join(root, ".generated/src/modules.generated.ts");
+    const contracts = join(root, ".generated/src/event-schemas.generated.ts");
+    if (!existsSync(catalog) || !existsSync(contracts)) return { names: [], eventTypes: [] };
+    const { MODULE_ENTITY_DEFINITIONS } = (await import(catalog)) as { MODULE_ENTITY_DEFINITIONS: ReadonlyArray<{ name: string; table: string }> };
+    const { EVENT_OWNERS } = (await import(contracts)) as { EVENT_OWNERS: Record<string, string> };
+    return {
+        names: [...new Set(MODULE_ENTITY_DEFINITIONS.flatMap((definition) => [definition.name, definition.table]))],
+        eventTypes: Object.entries(EVENT_OWNERS).filter(([, owner]) => owner !== "core").map(([type]) => type),
+    };
+}
+
+const escapeRegExp = (value: string) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * The core must not name a module's feature, entity, table, or event type: it learns them from the
+ * catalog and contracts the composer generates. A quoted feature id (`'finance'`), a quoted entity
+ * or table name, or a module's event type in core code (not comments, tests, or generated files)
+ * means a domain leaked back in.
+ */
+export function coreNamesNoDomain(
+    root = ROOT,
+    directories = ["worker", "ledger/src", "packages/tooling/src/host", "packages/cloudflare/src", "packages/ledger/src", "packages/ledger-admin/src", "packages/contracts/src", "packages/runtime/src", "packages/ui/src"],
+    domain: ModuleDomain = { names: [], eventTypes: [] },
+): string[] {
+    const modulesDirectory = join(root, "modules");
+    const featureIds = (existsSync(modulesDirectory) ? readdirSync(modulesDirectory) : []).flatMap((name) => {
+        const manifest = join(modulesDirectory, name, "hearthlog.module.json");
+        if (!existsSync(manifest)) return [];
+        return (JSON.parse(readFileSync(manifest, "utf8")) as { features?: Array<{ id: string }> }).features?.map((feature) => feature.id) ?? [];
+    });
+    const quotedNames = [...new Set([...featureIds, ...domain.names])];
+    if (!quotedNames.length && !domain.eventTypes.length) return [];
+    const quoted = quotedNames.length ? new RegExp(`(["'\`])(${quotedNames.map(escapeRegExp).join("|")})\\1`) : null;
+    const events = domain.eventTypes.length ? new RegExp(`\\b(${domain.eventTypes.map(escapeRegExp).join("|")})\\b`) : null;
+    const problems: string[] = [];
+    for (const directory of directories) {
+        for (const file of files(join(root, directory))) {
+            if (/\.generated\.ts$|\.test\.ts$|\.d\.ts$|[\\/]generated\.ts$|worker-configuration/.test(file) || file.includes(`${sep}generated${sep}`) || file.includes(`${sep}(modules)${sep}`)) continue;
+            readFileSync(file, "utf8").split("\n").forEach((line, index) => {
+                // Comments may use a domain as an example.
+                if (/^\s*(\*|\/\/|\/\*)/.test(line)) return;
+                const name = quoted?.exec(line);
+                if (name) problems.push(`${relative(root, file)}:${index + 1}: the core names ${name[1]}${name[2]}${name[1]}`);
+                const event = events?.exec(line);
+                if (event) problems.push(`${relative(root, file)}:${index + 1}: the core names the event type ${event[1]}`);
+            });
+        }
+    }
+    return problems;
+}
+
+/**
+ * Generated files (the module catalog, schema, types, and the like) are imported only through
+ * `#generated/*`, which the host maps to wherever its build writes them. A relative or `#lib` path
+ * to one would break the day the file is no longer in this tree. The SDK facade, which still reaches
+ * into `src/lib` by relative path, and the generated files themselves are exempt.
+ */
+export function directGeneratedImports(root = ROOT, directories = ["src", "worker", "ledger", "scripts", "calendar-public", "packages/tooling/src", "packages/cloudflare/src", "packages/ledger/src", "packages/ledger-admin/src", "packages/contracts/src", "packages/runtime/src", "packages/ui/src"]): string[] {
+    const problems: string[] = [];
+    const generatedFile = /(^|[\\/])[\w-]+\.generated(\.js|\.ts)?$|(^|[\\/])tenant[\\/]generated(\.js|\.ts)?$/;
+    for (const directory of directories) {
+        for (const file of files(join(root, directory))) {
+            // The scripts' own tests write fixture files whose text looks like imports, and the generators emit import lines.
+            if (/\.generated\.ts$|[\\/]generated\.ts$/.test(file) || file.includes(`${sep}generated${sep}`) || file.includes(`${sep}(modules)${sep}`) || ((directory === "scripts" || directory === "packages/tooling/src") && /\.test\.ts$|(compose-modules|generate-[a-z-]+)\.ts$/.test(file))) continue;
+            for (const specifier of specifiers(file)) {
+                if ((specifier.startsWith(".") || specifier.startsWith("#lib")) && generatedFile.test(specifier)) {
+                    problems.push(`${relative(root, file)}: "${specifier}" is a generated file (import it through #generated/*)`);
+                }
+            }
+        }
+    }
+    return problems;
+}
+
+export function checkBoundaries(root = ROOT, domain?: ModuleDomain): string[] {
+    const problems: string[] = [];
+    const modulesDirectory = join(root, "modules");
+    // A platform workspace or a tenant repository has no modules directory.
+    for (const name of existsSync(modulesDirectory) ? readdirSync(modulesDirectory) : []) {
+        const moduleRoot = join(modulesDirectory, name);
+        if (!statSync(moduleRoot).isDirectory()) continue;
+        const packageJson = JSON.parse(readFileSync(join(moduleRoot, "package.json"), "utf8")) as { dependencies?: Record<string, string> };
+        const allowed = Object.keys(packageJson.dependencies ?? {});
+        // A module's anonymous public Worker is part of the module; its build config is tooling.
+        const sourceFiles = [join(moduleRoot, "src"), join(moduleRoot, "public")]
+            .filter((directory) => existsSync(directory))
+            .flatMap((directory) => files(directory))
+            .filter((file) => !/vite\.config\.ts$/.test(file));
+        for (const file of sourceFiles) {
+            for (const specifier of specifiers(file)) {
+                const problem = moduleImportProblem(specifier, file, moduleRoot, allowed);
+                if (problem) problems.push(`${relative(root, file)}: "${specifier}" ${problem}`);
+            }
+        }
+    }
+    const generated = /\.generated\.ts$|[\\/]\(modules\)[\\/]/;
+    for (const directory of ["src", "worker", "packages"]) {
+        for (const file of files(join(root, directory))) {
+            if (generated.test(file)) continue;
+            for (const specifier of specifiers(file)) {
+                if (specifier.startsWith("@hearthlog/module-")) problems.push(`${relative(root, file)}: the core imports a module ("${specifier}")`);
+            }
+        }
+    }
+    problems.push(...coreNamesNoDomain(root, undefined, domain));
+    problems.push(...directGeneratedImports(root));
+    return problems;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    const problems = checkBoundaries(ROOT, await loadModuleDomain(ROOT));
+    if (problems.length) {
+        console.error(`Module boundaries are broken:\n  - ${problems.join("\n  - ")}`);
+        process.exitCode = 1;
+    } else {
+        console.log("Module boundaries hold.");
+    }
+}

package/src/check/check-sdk-exports.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env npx tsx
+/**
+ * Every name a module's Svelte files import from `@hearthlog/sdk/*` must be an
+ * export of that SDK entry. `tsc` does not read `.svelte` files, so a missing
+ * export would otherwise surface only in the production build.
+ *
+ * It collects the names, writes them as one virtual TypeScript file, and
+ * type-checks that file inside the root program.
+ *
+ * Usage: pnpm check:sdk-exports
+ */
+
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { hostRoot } from "../root.js";
+
+import ts from "typescript";
+
+const ROOT = hostRoot();
+const IMPORT = /import\s+(?:type\s+)?\{([^}]*)\}\s+from\s+["'](@hearthlog\/sdk\/[a-z]+)["']/g;
+
+function svelteFiles(directory: string): string[] {
+    return readdirSync(directory).flatMap((name) => {
+        if (name === "node_modules" || name.startsWith(".")) return [];
+        const path = join(directory, name);
+        return statSync(path).isDirectory() ? svelteFiles(path) : name.endsWith(".svelte") ? [path] : [];
+    });
+}
+
+export function importedNames(root = ROOT): Map<string, Set<string>> {
+    const names = new Map<string, Set<string>>();
+    for (const module of existsSync(join(root, "modules")) ? readdirSync(join(root, "modules")) : []) {
+        const source = join(root, "modules", module);
+        if (!statSync(source).isDirectory()) continue;
+        for (const file of [...svelteFiles(join(source, "src")), ...(statSync(join(source, "public"), { throwIfNoEntry: false }) ? svelteFiles(join(source, "public")) : [])]) {
+            for (const match of readFileSync(file, "utf8").matchAll(IMPORT)) {
+                const set = names.get(match[2]!) ?? new Set<string>();
+                for (const part of match[1]!.split(",")) {
+                    const name = part.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0]!.trim();
+                    if (name) set.add(name);
+                }
+                names.set(match[2]!, set);
+            }
+        }
+    }
+    return names;
+}
+
+export function missingExports(root = ROOT): string[] {
+    const names = importedNames(root);
+    const virtualFile = join(root, "modules", "__sdk-exports.ts");
+    const text = [...names].map(([entry, set]) => `import type { ${[...set].sort().join(", ")} } from '${entry}';`).join("\n");
+    const configPath = join(root, "tsconfig.json");
+    const config = ts.getParsedCommandLineOfConfigFile(configPath, {}, { ...ts.sys, onUnRecoverableConfigFileDiagnostic: () => undefined });
+    if (!config) throw new Error("Cannot read tsconfig.json");
+    const host = ts.createCompilerHost(config.options);
+    const readFile = host.readFile.bind(host);
+    const fileExists = host.fileExists.bind(host);
+    const getSourceFile = host.getSourceFile.bind(host);
+    host.fileExists = (path) => path === virtualFile || fileExists(path);
+    host.readFile = (path) => (path === virtualFile ? text : readFile(path));
+    host.getSourceFile = (path, languageVersion, onError, shouldCreate) =>
+        path === virtualFile ? ts.createSourceFile(path, text, languageVersion) : getSourceFile(path, languageVersion, onError, shouldCreate);
+    const program = ts.createProgram([virtualFile], config.options, host);
+    return ts.getPreEmitDiagnostics(program, program.getSourceFile(virtualFile))
+        .filter((diagnostic) => [2305, 2724, 2307].includes(diagnostic.code))
+        .map((diagnostic) => ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n"));
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    const problems = missingExports();
+    if (problems.length) {
+        console.error(`A module imports names the SDK does not export:\n  - ${problems.join("\n  - ")}`);
+        process.exitCode = 1;
+    } else {
+        console.log("Every SDK import in module Svelte files resolves.");
+    }
+}

package/src/check/check-tenant-config.ts

@@ -0,0 +1,208 @@
+#!/usr/bin/env npx tsx
+/**
+ * Tenant Config Check
+ *
+ * Validates tenants.json end to end and verifies the generated per-site
+ * wrangler configs. The tenant files are the single source of truth.
+ *
+ * Usage: pnpm check:tenants
+ */
+
+import { readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+
+import { gatewayEntryPath, loadModules } from "../compose/compose-modules.js";
+import {
+    infrastructureFor,
+    loadTenantConfig,
+    validateCrossSite,
+    validateDeploymentIsolation,
+    REPOSITORY_ROOT,
+    type InfrastructureDefinition,
+    type ResolvedSite,
+} from "../tenants/tenant-config.js";
+import {
+    buildTenantWranglerConfig,
+    generateTenantWranglerConfigs,
+    integrationsVariable,
+    moduleBindings,
+    serverDeclarations,
+    siteIdentityVariables,
+    siteBuildDirectory,
+    siteConfigDirectory,
+    sweepsSharedStack,
+    workerFirstEntries,
+    wranglerConfigPath,
+} from "../tenants/wrangler-config.js";
+import { WRANGLER_BASE } from "../tenants/wrangler-base.js";
+import { generateHostConfigs, hostWorkerConfigPath } from "../tenants/host-configs.js";
+import { moduleLockProblems } from "../tenants/module-lock.js";
+import { isTenantSchemaCurrent } from "../tenants/tenant-schema.js";
+
+function checkBase(): string[] {
+    const problems: string[] = [];
+    if (WRANGLER_BASE.assets.binding !== "ASSETS") problems.push('wrangler base: assets.binding must be "ASSETS"');
+    if (WRANGLER_BASE.assets.run_worker_first[0] !== "/api/ledger") problems.push('wrangler base: assets.run_worker_first must keep "/api/ledger" first');
+    if (WRANGLER_BASE.ai.binding !== "AI") problems.push("wrangler base: the AI binding is missing");
+    return problems;
+}
+
+/** A site's config carries exactly the bindings, variables, and gateway table its modules declare. */
+function checkModuleBindings(
+    label: string,
+    site: Pick<ResolvedSite, "id" | "features">,
+    infrastructure: InfrastructureDefinition,
+    config: { vars: Record<string, unknown>; r2Buckets: Array<Record<string, unknown>>; images: unknown; main: unknown; workerFirst?: readonly string[] },
+): string[] {
+    const problems: string[] = [];
+    const expected = moduleBindings(site.features, infrastructure);
+    for (const { binding, bucket_name } of expected.r2) {
+        if (config.r2Buckets.find((bucket) => bucket.binding === binding)?.bucket_name !== bucket_name) {
+            problems.push(`${label}: ${binding} bucket should be ${bucket_name}`);
+        }
+    }
+    const everyModuleBinding = loadModules().flatMap(({ manifest }) => manifest.server?.bindings ?? []);
+    const wanted = new Set(expected.r2.map((entry) => entry.binding));
+    for (const { binding, type } of everyModuleBinding) {
+        if (type === "r2" && !wanted.has(binding) && config.r2Buckets.some((bucket) => bucket.binding === binding)) {
+            problems.push(`${label}: binds ${binding}, which none of its modules declare`);
+        }
+    }
+    if (expected.images !== (typeof config.images === "object" && config.images !== null)) {
+        problems.push(`${label}: the images binding ${expected.images ? "is missing" : "belongs to a module the site does not enable"}`);
+    }
+    for (const [name, value] of Object.entries(expected.vars)) {
+        if (config.vars[name] !== value) problems.push(`${label}: vars.${name} should be ${value}`);
+    }
+    const everyVar = loadModules().flatMap(({ manifest }) => manifest.server?.vars ?? []);
+    for (const { name } of everyVar) {
+        if (!(name in expected.vars) && name in config.vars) problems.push(`${label}: vars.${name} belongs to a module the site does not enable`);
+    }
+    const entry = relative(siteConfigDirectory(site.id), gatewayEntryPath(site.id));
+    if (typeof config.main !== "string" || config.main.replace(/^\.\//, "") !== entry) {
+        problems.push(`${label}: main should be ./${entry}`);
+    }
+    // Every route a module serves must reach the Worker before the static assets.
+    for (const entry of workerFirstEntries(serverDeclarations(site.features).flatMap((server) => server.routes ?? []))) {
+        // A wildcard of a shorter prefix covers it (`/api/invoice-generation/*` covers `/api/invoice-generation/logs`).
+        const covered = (config.workerFirst ?? []).some((have) => have === entry || (have.endsWith("/*") && entry.startsWith(have.slice(0, -1))));
+        if (config.workerFirst && !covered) problems.push(`${label}: run_worker_first is missing ${entry}`);
+    }
+    return problems;
+}
+
+function checkGeneratedSite(
+    site: ResolvedSite,
+    infrastructure: InfrastructureDefinition,
+    generated: Record<string, unknown>,
+): string[] {
+    const problems: string[] = [];
+    const asRecord = (value: unknown) => (value ?? {}) as Record<string, unknown>;
+    const label = `generated ${site.id}`;
+
+    if (generated.name !== site.id) {
+        problems.push(`${label}: name is ${JSON.stringify(generated.name)}`);
+    }
+    if (asRecord(generated.assets).directory !== relative(siteConfigDirectory(site.id), join(REPOSITORY_ROOT, siteBuildDirectory(site.id)))) {
+        problems.push(
+            `${label}: assets.directory is ${JSON.stringify(
+                asRecord(generated.assets).directory,
+            )}`,
+        );
+    }
+    const vars = asRecord(generated.vars);
+    if (vars.STOR_ADMIN_ENABLED !== String(site.admin)) {
+        problems.push(`${label}: vars.STOR_ADMIN_ENABLED mismatch`);
+    }
+    if (vars.LEDGER_ADMIN_EMAIL !== infrastructure.ledgerAdminEmail) {
+        problems.push(`${label}: vars.LEDGER_ADMIN_EMAIL mismatch`);
+    }
+    if (vars.STOR_AUTHORIZED_EMAILS !== site.authorizedEmails.join(",")) {
+        problems.push(
+            `${label}: vars.STOR_AUTHORIZED_EMAILS does not match the authorized email list`,
+        );
+    }
+    if (vars.AI_CAPABILITIES !== site.ai.join(",")) {
+        problems.push(`${label}: vars.AI_CAPABILITIES does not match the site's ai list`);
+    }
+    for (const [name, value] of Object.entries(siteIdentityVariables(site, infrastructure))) {
+        if (vars[name] !== value) problems.push(`${label}: vars.${name} does not match tenants.json`);
+    }
+    if (vars.INTEGRATIONS !== integrationsVariable(site)) {
+        problems.push(`${label}: vars.INTEGRATIONS does not match the site's integrations`);
+    }
+    if (asRecord(generated.ai).binding !== "AI") {
+        problems.push(`${label}: AI binding is missing`);
+    }
+    const services = (generated.services ?? []) as Array<Record<string, unknown>>;
+    if (
+        services.find((service) => service.binding === "LEDGER")?.service !==
+        infrastructure.ledgerWorker
+    ) {
+        problems.push(`${label}: LEDGER binding does not target the Ledger`);
+    }
+    const r2Buckets = (generated.r2_buckets ?? []) as Array<Record<string, unknown>>;
+    problems.push(...checkModuleBindings(label, site, infrastructure, { vars, r2Buckets, images: generated.images, main: generated.main, workerFirst: (generated.assets as { run_worker_first?: string[] } | undefined)?.run_worker_first }));
+    return problems;
+}
+
+const { infrastructure, sites, stacks } = await loadTenantConfig();
+validateCrossSite(sites);
+validateDeploymentIsolation(sites, infrastructure);
+
+const problems: string[] = [...checkBase()];
+
+// Generate every site's config and verify the content against the tenant files.
+await generateTenantWranglerConfigs();
+for (const site of sites) {
+    const siteInfrastructure = infrastructureFor(site, infrastructure);
+    const sweeps = sweepsSharedStack(stacks, infrastructure, site);
+    const raw = readFileSync(wranglerConfigPath(site.id), "utf8");
+    const generated = JSON.parse(raw) as Record<string, unknown>;
+    problems.push(...checkGeneratedSite(site, siteInfrastructure, generated));
+    const label = `generated ${site.id}`;
+    const scheduled = serverDeclarations(site.features).some((server) => server.scheduled);
+    // The shared stack's public copies are swept by one site; a site on its own stack sweeps its own.
+    if (sweeps && scheduled && JSON.stringify(generated.triggers) !== JSON.stringify(WRANGLER_BASE.triggers)) {
+        problems.push(`${label}: this site must sweep its public Gallery bucket (triggers)`);
+    }
+    if (!(sweeps && scheduled) && generated.triggers !== undefined) {
+        problems.push(`${label}: only the site that owns the public Gallery bucket sweeps it`);
+    }
+    const expected = buildTenantWranglerConfig(site, siteInfrastructure, { sweeps });
+    if (JSON.stringify(generated) !== JSON.stringify(expected)) problems.push(`${label}: the file differs from the builder output`);
+}
+
+// The Workers of each stack: the shared one (when a site uses it) and every site's own.
+const stackNames = [...(stacks.some((stack) => stack.shared) ? ["shared"] : []), ...sites.filter((site) => site.deployment).map((site) => site.id)];
+for (const stack of stackNames) {
+    const siteInfrastructure = stack === "shared" ? infrastructure : infrastructureFor(sites.find((site) => site.id === stack)!, infrastructure);
+    await generateHostConfigs(stack);
+    const read = (worker: "ledger" | "calendar-public" | "gallery-public") => JSON.parse(readFileSync(hostWorkerConfigPath(stack, worker), "utf8")) as Record<string, unknown>;
+    const label = `generated ${stack} stack`;
+    if (read("ledger").name !== siteInfrastructure.ledgerWorker) problems.push(`${label}: the Ledger Worker should be named ${siteInfrastructure.ledgerWorker}`);
+    const feedSites = (read("calendar-public").services as Array<{ service: string }>).map((service) => service.service).sort();
+    const expectedSites = (stack === "shared" ? stacks.filter((entry) => entry.shared).map((entry) => entry.id) : [stack]).sort();
+    if (JSON.stringify(feedSites) !== JSON.stringify(expectedSites)) problems.push(`${label}: the feed Worker should bind ${expectedSites.join(", ")}`);
+    // A site on its own stack has a public Gallery Worker only when it ships the Gallery; the shared stack always has one.
+    const ownSite = stack === "shared" ? undefined : sites.find((site) => site.id === stack)!;
+    if ((!ownSite || ownSite.features.includes("gallery")) && read("gallery-public").name !== siteInfrastructure.galleryPublicWorker) problems.push(`${label}: the public Gallery Worker should be named ${siteInfrastructure.galleryPublicWorker}`);
+}
+
+for (const site of sites) problems.push(...(await moduleLockProblems(site)));
+
+if (!(await isTenantSchemaCurrent())) {
+    problems.push("tenants.schema.json is stale; run pnpm generate:tenant-schema");
+}
+
+if (problems.length > 0) {
+    console.error("Tenant configuration is inconsistent:");
+    for (const problem of problems) console.error(`  - ${problem}`);
+    process.exit(1);
+}
+
+console.log(
+    `Tenant configuration OK: ${sites.length} site(s) (${sites
+        .map((site) => site.id)
+        .join(", ")}), generated wrangler configs verified.`,
+);