@mnci/cli 1.13.0 → 1.15.0

package/README.md

@@ -24,7 +24,7 @@ first-party (or established community) Nx equivalent:
 | Hand-written Azure Function templates      | `@nx/node:application` (plain Node app) + a thin Azure Functions v4 overlay   |
 | doctor/drift sync of tool-owned files      | Nothing to drift: this CLI owns 5 small files, Nx owns the rest               |
 
-## Commands (deliberately just three)
+## Commands (deliberately just four)
 
 ```sh
 mnci new my-repo            # create a monorepo (prompts scope + registry)
@@ -61,8 +61,30 @@ mnci add flutter-internal-lib core # private shared package -> libs/
 
 mnci upgrade                  # re-apply the latest overlay (see below)
 mnci upgrade --agent windows-latest   # ...with an explicit override
+
+mnci doctor                   # check this workspace's invariants (read-only)
 ```
 
+## `mnci doctor`: checking the invariants actually hold
+
+Read-only — it never edits the workspace. Every failing finding names the command
+that fixes it (usually `mnci upgrade`), and it exits non-zero when anything failed,
+so it works as a CI step as well as a local command.
+
+Every check corresponds to an invariant that has **actually** been violated, in
+this repo or in a workspace it generated. None are hypothetical; a check nobody has
+ever needed is noise that trains people to ignore the output.
+
+| Check                                                   | The failure it catches                                                                                                             |
+| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| Exactly one root ESLint config, and no per-project ones | The config fragmenting — every `@nx/*` generator writes one, so each project ends up linting against whichever config sits nearest |
+| No stray `.prettierrc`                                  | It outranks `.prettierrc.json`, so the whole formatting opinion is silently discarded while both files look fine                   |
+| `@nx/eslint/plugin` registered in `nx.json`             | Without it `npm run lint` exits 0 while linting nothing                                                                            |
+| The **resolved** `eslint` major                         | A declared range and an installed version are different things — manifests once said `^10` while the pin said 9                    |
+| `.npmrc` matches the recorded registry                  | The two registry kinds get different files; an Azure workspace also needs its scope routed                                         |
+| `versionActions` on publishable Dart/Python packages    | Its absence aborts `nx release` for the **whole** workspace, not just that project                                                 |
+| `nx sync:check`                                         | A stale TypeScript project reference that was never committed                                                                      |
+
 Everything else is plain Nx, surfaced as a small curated set of root scripts —
 each a single cross-platform command:
 
@@ -126,7 +148,7 @@ that would just fail felt worse than being upfront that it doesn't exist yet.
    is ever pushed to `main`; future runs resolve versions from tag names.
 3. Writes `eslint.config.mjs` (three lines importing `@mnci/eslint-config` —
    the whole linting opinion, in one root config), `.prettierrc.json` +
-   `.prettierignore`, `.npmrc` (comment-only — see **Known gaps** below),
+   `.prettierignore`, `.npmrc` (publish auth — see **Publish auth** below),
    `commitlint.config.mjs`, a husky `commit-msg` hook, the chosen CI provider's
    pipeline file(s)
    (`azure-pipelines.yml` and/or `.github/workflows/ci.yml`, `--ci`, default
@@ -404,6 +426,42 @@ lint,test,build`. Pushes to `main` then:
   _only_ configured provider, since that's the one case a `GITHUB_TOKEN` is
   guaranteed to exist.
 
+### Publish auth
+
+The generated `.npmrc` differs by registry kind, because the honest answer does.
+
+**`--registry azure-artifacts`** routes the workspace's own scope to the feed and
+supplies the feed's credentials:
+
+```ini
+@my:registry=https://pkgs.dev.azure.com/<org>/<proj>/_packaging/<feed>/npm/registry/
+//pkgs.dev.azure.com/.../npm/registry/:username=AzureArtifacts
+//pkgs.dev.azure.com/.../npm/registry/:_password=${PAT}
+```
+
+Scope routing is **real protection** here, not decoration: npm prefers a scope's
+registry over the global one when publishing a scoped package, so `@my/*` cannot
+reach npmjs.org by accident. Verified against a real registry — with only the
+scope line set, npm reports `Publishing to <feed>` — and again from a generated
+workspace, whose `npm publish --dry-run` targets the feed.
+
+Only the scope is routed, deliberately. A global `registry=` would push every
+install through the feed as well, so `npm ci` would need feed auth just to fetch
+public packages; as generated, public dependencies still come from npmjs.org and
+a developer with no `PAT` set can install normally.
+
+**`--registry npm`** gets the auth line and nothing else:
+
+```ini
+//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+```
+
+There is no `@scope:registry` line, and the generated file explains why: npmjs.org
+is already the default, so routing the scope there changes nothing — and calling
+it protection against an accidental public publish would be false, because the
+public registry is the intended target. Worth stating plainly because this file
+previously claimed exactly that protection while emitting no routing line at all.
+
 **npm auth** is the base64 `PAT`, read the same way on both providers but from
 a different place: on Azure Pipelines, a **variable group**
 (`--variable-group`, default `Build`) exposes it as `$(PAT)`; on GitHub
@@ -516,13 +574,10 @@ than a surprise:
 
 ## Known gaps (accepted for the experiment)
 
-- **The generated `.npmrc` is empty (comments only), so `npm publish` will not
-  authenticate.** This is a deliberate deferral, not an oversight: the previous
-  file claimed here that scope routing made accidental public publishes
-  impossible, when in fact no `@scope:registry` line was ever emitted. Rather
-  than ship half-wired auth, the CI token export (`NODE_AUTH_TOKEN`/`PAT`) is
-  left in place so wiring it later is one line, and the generated `.npmrc`
-  carries a comment saying so. Publish-path e2e assertions are relaxed to match.
+- **A scoped package on public npm has no accidental-publish protection**, and
+  cannot: npmjs.org is the intended target there, so no `.npmrc` line could
+  prevent it. Generate with `--registry azure-artifacts` if you need a scope kept
+  off the public registry — that variant routes it (see **Publish auth** above).
 - No `doctor`/`resurrect`/`spell` — out of scope until the model is proven.
 - **Flutter apps build for web only.** Android would require the Android SDK and
   NDK on every build agent; iOS is impossible on a Linux agent regardless. Add

package/dist/cli.js

@@ -1234,11 +1234,8 @@ function readWorkspaceStack(workspaceRoot) {
   };
 }
 
-// src/commands/interactive.ts
-var import_node_path14 = require("path");
-var import_prompts8 = require("@inquirer/prompts");
-
-// src/commands/new.ts
+// src/commands/doctor.ts
+var import_node_fs7 = require("fs");
 var import_node_path12 = require("path");
 
 // src/overlay.ts
@@ -1250,15 +1247,49 @@ var TS_COMPILER_DEPENDENCIES = {
   "@typescript/native": "npm:typescript@^7.0.2",
   typescript: "npm:@typescript/typescript6@^6.0.2"
 };
-function npmrcContent(_registry, _scope) {
-  return `; Intentionally empty.
+function registryUrl(registry) {
+  if (registry.kind === "azure-artifacts") {
+    return `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}/npm/registry/`;
+  }
+  return void 0;
+}
+function npmrcContent(registry, scope) {
+  if (registry.kind === "npm") {
+    return `; Publish authentication for the public npm registry.
 ;
-; Publish authentication is not configured yet. The generated CI exports a
-; token for the release step (NODE_AUTH_TOKEN for public npm, PAT for Azure
-; Artifacts), but nothing here consumes it, so 'npm publish' will not
-; authenticate until this is wired up.
+; NODE_AUTH_TOKEN is exported by the generated CI's release step; an unset value
+; is harmless locally, so no token is needed for day-to-day work.
+//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}
+
+; There is deliberately NO '${scope}:registry' line here. npmjs.org is already
+; the default registry, so routing the scope to it would change nothing \u2014 and
+; presenting that as protection against an accidental public publish would be
+; false, because the public registry is the intended target. (An earlier version
+; of this file made exactly that claim while emitting no routing line at all.)
+; To keep a scoped package off npmjs.org, use a private feed: generate with
+; --registry azure-artifacts, which does route the scope.
+`;
+  }
+  const feedUrl = registryUrl(registry);
+  const feedKey = feedUrl.replace(/^https:/, "");
+  return `; Publish + resolution routing for this workspace's own scope.
+;
+; '${scope}:registry' sends BOTH resolution and 'npm publish' of ${scope}/* to the
+; feed: npm prefers a scope's registry over the global one when publishing a
+; scoped package, so a ${scope}/* package cannot reach npmjs.org by accident.
 ;
-; See "Known gaps" in the @mnci/cli README.
+; Only the scope is routed, on purpose. A global 'registry=' would send every
+; install through the feed as well, so 'npm ci' would need feed auth just to fetch
+; public packages.
+${scope}:registry=${feedUrl}
+
+; Feed credentials. PAT is the BASE64 value Azure Artifacts' "Connect to feed"
+; instructions give you, which is exactly what _password expects, so it is used
+; as-is. (twine wants the RAW token; the CI release step decodes it there.)
+; Azure ignores the username, and npm requires an email it never uses.
+${feedKey}:username=AzureArtifacts
+${feedKey}:_password=\${PAT}
+${feedKey}:email=npm-requires-this-and-never-uses-it
 `;
 }
 function releaseConfig(ci) {
@@ -1502,9 +1533,18 @@ function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKin
 # runs unchanged on Linux, macOS and Windows agents.
 
 trigger:
+  # While a run is in progress, queue further pushes and run them together rather
+  # than concurrently. This is the closest thing Azure Pipelines YAML has to
+  # GitHub's concurrency group, and it is load-bearing on main for the same
+  # reason: two concurrent 'nx release' runs would race to create the same tag.
+  batch: true
   branches:
     include: [main]
 
+# Note: cancelling a superseded PR validation run is NOT a YAML setting on Azure
+# \u2014 it lives in the branch policy ("Build validation -> automatically cancel").
+# Nothing here can express it, so it is left to whoever configures the policy
+# rather than faked with a batch setting that would only delay PR runs.
 pr:
   branches:
     include: [main]
@@ -1517,6 +1557,12 @@ variables:
   # for an Azure Artifacts feed, or a raw npm automation token as \`NPM_TOKEN\`
   # for public npm. Mark it secret in Library. Add app build vars here too if needed.
   - group: ${variableGroup}
+  # Relocates npm's cache inside the pipeline workspace so Cache@2 can restore it
+  # (the default ~/.npm is outside the cacheable area on hosted agents). npm reads
+  # this as an ordinary env var, so it needs no config file and works on every
+  # agent OS.
+  - name: npm_config_cache
+    value: $(Pipeline.Workspace)/.npm
 
 steps:
   - checkout: self
@@ -1541,6 +1587,20 @@ steps:
     inputs:
       version: 24.x
 
+  # The Azure counterpart of \`cache: npm\` on actions/setup-node: restores npm's
+  # download cache so \`npm ci\` does not re-fetch every tarball on every run.
+  # Keyed on the lockfile, so a dependency change misses and anything else hits;
+  # restoreKeys falls back to the newest cache for this OS on a miss, which still
+  # avoids a fully cold install. Agent.OS is in the key because a cached native
+  # module built for one OS is not reusable on another.
+  - task: Cache@2
+    displayName: Cache npm packages
+    inputs:
+      key: 'npm | "$(Agent.OS)" | package-lock.json'
+      restoreKeys: |
+        npm | "$(Agent.OS)"
+      path: $(npm_config_cache)
+
   - script: npm ci
     displayName: Install dependencies
     env:
@@ -1698,6 +1758,19 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  # One run at a time per ref, but \`cancel-in-progress\` is an **expression** on
+  # purpose rather than a flat \`true\`.
+  #
+  # A superseded PR run is pure waste, so cancel it. A run on \`main\` must never
+  # be cancelled: it publishes packages and pushes release tags, and killing it
+  # part-way can leave a tag pushed with the publish only half done \u2014 a state no
+  # rerun repairs cleanly, because the version is then already tagged. Those runs
+  # queue instead, which also stops two \`nx release\` invocations racing to create
+  # the same tag when two commits land close together.
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: \${{ github.event_name == 'pull_request' }}
+
 permissions:
   # Lets the release step push the version tag nx release creates back to main,
   # and (github-only provider) create the GitHub Release itself.
@@ -1721,6 +1794,11 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          # Caches ~/.npm keyed on package-lock.json, so \`npm ci\` restores from
+          # the local cache instead of re-downloading every tarball on every run.
+          # Nothing to invalidate by hand: the action keys on the lockfile, so a
+          # dependency change misses the cache and a no-op change hits it.
+          cache: npm
 
       - run: npm ci
         name: Install dependencies
@@ -1972,7 +2050,166 @@ function applyOverlay(workspaceRoot, options) {
   }
 }
 
+// src/commands/doctor.ts
+var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".")[0];
+function checkEslintConfigs(workspaceRoot) {
+  const rootConfigs = (0, import_node_fs7.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
+  const projectConfigs = (0, import_node_fs7.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+    cwd: workspaceRoot
+  });
+  return [
+    {
+      check: "root ESLint config",
+      ok: rootConfigs.length === 1,
+      detail: rootConfigs.length === 0 ? "no eslint.config.* at the workspace root" : `${rootConfigs.length} root configs: ${rootConfigs.join(", ")}`,
+      remedy: "run `mnci upgrade` to rewrite the root config"
+    },
+    {
+      check: "no per-project ESLint configs",
+      ok: projectConfigs.length === 0,
+      detail: `found ${projectConfigs.length}: ${projectConfigs.join(", ")}`,
+      remedy: "run `mnci upgrade`, which sweeps {apps,libs,packages}/*/eslint.config.*"
+    }
+  ];
+}
+function checkPrettierConfig(workspaceRoot) {
+  const strayExists = fileExists((0, import_node_path12.join)(workspaceRoot, ".prettierrc"));
+  return {
+    check: "Prettier config is mnci\u2019s",
+    ok: !strayExists,
+    detail: ".prettierrc exists and outranks .prettierrc.json, so mnci\u2019s config is ignored",
+    remedy: "delete .prettierrc (or run `mnci upgrade`, which deletes it)"
+  };
+}
+function checkEslintPlugin(nxJson) {
+  const plugins = nxJson.plugins ?? [];
+  const registered = plugins.some(
+    (entry) => typeof entry === "string" ? entry === "@nx/eslint/plugin" : entry.plugin === "@nx/eslint/plugin"
+  );
+  return {
+    check: "@nx/eslint/plugin registered",
+    ok: registered,
+    detail: "not in nx.json plugins \u2014 every project silently loses its lint target",
+    remedy: "run `mnci upgrade`"
+  };
+}
+function checkResolvedEslint(workspaceRoot) {
+  const manifestPath = (0, import_node_path12.join)(workspaceRoot, "node_modules/eslint/package.json");
+  if (!fileExists(manifestPath)) {
+    return void 0;
+  }
+  try {
+    const { version } = readJson(manifestPath);
+    const major = version.split(".")[0];
+    return {
+      check: `resolved eslint is ${SUPPORTED_ESLINT_MAJOR}.x`,
+      ok: major === SUPPORTED_ESLINT_MAJOR,
+      detail: `node_modules/eslint is ${version}, but this stack supports ${SUPPORTED_ESLINT_MAJOR}.x (eslint-plugin-react has no release beyond it)`,
+      remedy: `pin eslint to ${ESLINT_VERSION} in every package manifest, then reinstall`
+    };
+  } catch {
+    return void 0;
+  }
+}
+function checkNpmrc(workspaceRoot, registry, scope) {
+  const npmrcPath = (0, import_node_path12.join)(workspaceRoot, ".npmrc");
+  if (!registry || !fileExists(npmrcPath)) {
+    return void 0;
+  }
+  const npmrc = (0, import_node_fs7.readFileSync)(npmrcPath, "utf8");
+  if (registry.kind === "npm") {
+    return {
+      check: ".npmrc authenticates the public registry",
+      ok: npmrc.includes("//registry.npmjs.org/:_authToken="),
+      detail: "no npmjs.org token line \u2014 `npm publish` cannot authenticate",
+      remedy: "run `mnci upgrade`"
+    };
+  }
+  return {
+    check: ".npmrc routes the scope to the feed",
+    ok: scope !== void 0 && npmrc.includes(`${scope}:registry=`),
+    detail: `no '${scope ?? "@scope"}:registry=' line \u2014 a scoped package could publish to npmjs.org instead of the feed`,
+    remedy: "run `mnci upgrade`"
+  };
+}
+function checkVersionActions(workspaceRoot) {
+  const candidates = [
+    ...(0, import_node_fs7.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
+    ...(0, import_node_fs7.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
+  ];
+  return candidates.flatMap((manifest) => {
+    const projectRoot = manifest.slice(0, manifest.lastIndexOf("/"));
+    const projectJsonPath = (0, import_node_path12.join)(workspaceRoot, projectRoot, "project.json");
+    let hasOverride = false;
+    try {
+      const projectJson = readJson(projectJsonPath);
+      hasOverride = Boolean(projectJson.release?.version?.versionActions);
+    } catch {
+      hasOverride = false;
+    }
+    return [
+      {
+        check: `${projectRoot} keeps its versionActions override`,
+        ok: hasOverride,
+        detail: "missing \u2014 nx release aborts for the ENTIRE workspace, not just this project",
+        remedy: `add release.version.versionActions to ${projectRoot}/project.json`
+      }
+    ];
+  });
+}
+function checkSync(workspaceRoot) {
+  return {
+    check: "TypeScript project references synced",
+    ok: runShell("npx", ["nx", "sync:check"], workspaceRoot) === 0,
+    detail: "nx sync:check failed \u2014 a stale project reference was never committed",
+    remedy: "run `npx nx sync` and commit the result"
+  };
+}
+function collectFindings(workspaceRoot) {
+  const nxJsonPath = (0, import_node_path12.join)(workspaceRoot, "nx.json");
+  if (!fileExists(nxJsonPath)) {
+    throw new Error(
+      `No nx.json found in ${workspaceRoot} \u2014 run 'mnci doctor' from the workspace root.`
+    );
+  }
+  const nxJson = readJson(nxJsonPath);
+  return [
+    ...checkEslintConfigs(workspaceRoot),
+    checkPrettierConfig(workspaceRoot),
+    checkEslintPlugin(nxJson),
+    checkResolvedEslint(workspaceRoot),
+    checkNpmrc(workspaceRoot, nxJson.mnci?.registry, nxJson.mnci?.scope),
+    ...checkVersionActions(workspaceRoot),
+    checkSync(workspaceRoot)
+  ].filter((finding) => finding !== void 0);
+}
+function runDoctor(workspaceRoot) {
+  const findings = collectFindings(workspaceRoot);
+  const failed = findings.filter((finding) => !finding.ok);
+  for (const finding of findings) {
+    if (finding.ok) {
+      logger.success(finding.check);
+    } else {
+      logger.error(`${finding.check} \u2014 ${finding.detail ?? "failed"}`);
+      if (finding.remedy) {
+        logger.info(`    fix: ${finding.remedy}`);
+      }
+    }
+  }
+  if (failed.length === 0) {
+    logger.success(`All ${findings.length} checks passed.`);
+    return;
+  }
+  logger.error(`${failed.length} of ${findings.length} checks failed.`);
+  process.exitCode = 1;
+}
+
+// src/commands/interactive.ts
+var import_node_path15 = require("path");
+var import_prompts8 = require("@inquirer/prompts");
+
 // src/commands/new.ts
+var import_node_path13 = require("path");
 function nxCloudProviderValue(ci) {
   return ci === "azure" ? "azure" : "github";
 }
@@ -2037,7 +2274,7 @@ async function runNew(name, options) {
     ],
     process.cwd()
   );
-  const workspaceRoot = (0, import_node_path12.join)(process.cwd(), workspaceName);
+  const workspaceRoot = (0, import_node_path13.join)(process.cwd(), workspaceName);
   logger.step(
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
   );
@@ -2071,8 +2308,8 @@ async function runNew(name, options) {
 }
 
 // src/commands/upgrade.ts
-var import_node_fs7 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path14 = require("path");
 function resolveRegistry2(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
     const persistedAzure = persisted?.kind === "azure-artifacts" ? persisted : void 0;
@@ -2101,7 +2338,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     return persisted.workspaceName;
   }
   try {
-    const existing = (0, import_node_fs7.readdirSync)(workspaceRoot).find(
+    const existing = (0, import_node_fs8.readdirSync)(workspaceRoot).find(
       (file) => file.endsWith(".code-workspace") && file !== "undefined.code-workspace"
     );
     if (existing) {
@@ -2109,7 +2346,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     }
   } catch {
   }
-  return (0, import_node_path13.basename)(workspaceRoot);
+  return (0, import_node_path14.basename)(workspaceRoot);
 }
 function resolveOverlayOptions(workspaceRoot, options, persisted) {
   const scope = options.scope ?? persisted.scope;
@@ -2147,7 +2384,7 @@ function resolveOverlayOptions(workspaceRoot, options, persisted) {
   };
 }
 function runUpgrade(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path13.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path14.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 this does not look like an Nx workspace. Run 'mnci upgrade' from the workspace root.`
     );
@@ -2164,7 +2401,7 @@ function runUpgrade(workspaceRoot, options) {
 
 // src/commands/interactive.ts
 async function runInteractive() {
-  const inWorkspace = fileExists((0, import_node_path14.join)(process.cwd(), "nx.json"));
+  const inWorkspace = fileExists((0, import_node_path15.join)(process.cwd(), "nx.json"));
   const newChoice = { name: "Create a new monorepo", value: "new" };
   const addChoice = { name: "Add a project to this workspace", value: "add" };
   const upgradeChoice = {
@@ -2185,8 +2422,8 @@ async function runInteractive() {
 }
 
 // src/util/versionChecker.ts
-var import_node_fs8 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path16 = require("path");
 var import_cross_spawn2 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME = "@mnci/cli";
 var REGISTRY_TIMEOUT_MS = 2e3;
@@ -2242,8 +2479,8 @@ function releaseTriple(version) {
 }
 function readCliVersion(packageDirectory) {
   try {
-    const manifestPath = (0, import_node_path15.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs8.readFileSync)(manifestPath, "utf8"));
+    const manifestPath = (0, import_node_path16.join)(packageDirectory, "..", "package.json");
+    const manifest = JSON.parse((0, import_node_fs9.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -2268,6 +2505,11 @@ function buildProgram(cliVersion) {
   ).action((options) => {
     runUpgrade(process.cwd(), options);
   });
+  program.command("doctor").description(
+    "Check this workspace against the invariants mnci maintains (one ESLint config, no stray .prettierrc, the eslint plugin registered, the resolved eslint major, .npmrc vs the recorded registry, versionActions overrides, nx sync) \u2014 read-only; exits non-zero if anything failed"
+  ).action(() => {
+    runDoctor(process.cwd());
+  });
   program.command("add").addArgument(new import_commander.Argument("[kind]", "project kind").choices(PROJECT_KINDS)).argument("[name]", "project name").description("Add a project by delegating to the matching Nx plugin generator").option("--scope <scope>", "npm scope for a publishable lib (defaults to @<workspace name>)").option(
     "--framework <framework>",
     "node-app only: express | fastify | koa | nest | none (default: none)"