@verekia/warden 0.0.0

package/README.md

@@ -0,0 +1,89 @@
+# @verekia/warden
+
+Linter that checks repositories share consistent configs and tool versions.
+
+Two modes:
+
+- **Cross-project** — one warden checkout sits next to several sibling
+  repos and lints them all in one pass.
+- **Library** — a repo installs `@verekia/warden` as a devDep and lints
+  itself.
+
+## Library mode
+
+```sh
+bun add -D @verekia/warden
+```
+
+Add a `warden` script and wire it into your `all` script:
+
+```jsonc
+{
+  "scripts": {
+    "warden": "warden",
+    "all": "bun run format:check && bun run lint && bun run typecheck && bun run warden",
+  },
+  "devDependencies": {
+    "@verekia/warden": "0.0.0",
+  },
+  "warden": {
+    "checks": {
+      "configFilesPresent": {
+        "enabled": true,
+        "files": [".oxfmtrc.json", ".oxlintrc.json"],
+      },
+    },
+  },
+}
+```
+
+Omit `projects` — warden defaults to checking the cwd.
+
+## Cross-project mode
+
+Layout: warden lives next to the repos it checks.
+
+```
+<parent>/
+  warden/
+  vct7/
+  verekia.com/
+```
+
+`package.json` (in the warden checkout) declares projects and check
+options under the `"warden"` key:
+
+```jsonc
+{
+  "warden": {
+    "projects": ["../vct7", "../verekia.com"],
+    "checks": {
+      /* … */
+    },
+  },
+}
+```
+
+Run:
+
+```sh
+bun install
+bun run warden                     # check every project in the list
+bun run warden vct7 verekia.com    # check only the named subset
+```
+
+Positional arguments scope the run — useful in cloud environments where
+only some sibling repos are attached.
+
+## Available checks
+
+See [`CLAUDE.md`](./CLAUDE.md) for the full list and the failure → fix
+mapping. Each check has its own block under `"warden".checks` in
+`package.json` and toggles independently.
+
+## Adding a check
+
+1. Create `src/checks/<name>.ts` exporting a function that takes
+   `(projects, options)` and returns a `CheckResult`.
+2. Add its options shape to `WardenConfig['checks']` in `src/types.ts`.
+3. Wire it into `src/index.ts`.

package/package.json

@@ -0,0 +1,108 @@
+{
+  "name": "@verekia/warden",
+  "version": "0.0.0",
+  "description": "Linter that checks repositories share consistent configs and tool versions.",
+  "bin": {
+    "warden": "./src/index.ts"
+  },
+  "files": [
+    "src"
+  ],
+  "type": "module",
+  "scripts": {
+    "warden": "bun run src/index.ts",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check .",
+    "lint": "oxlint .",
+    "lint:fix": "oxlint --fix .",
+    "typecheck": "tsc --noEmit",
+    "all": "bun run format:check && bun run lint && bun run typecheck"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.0",
+    "oxfmt": "0.48.0",
+    "oxlint": "1.63.0",
+    "typescript": "^5.6.0"
+  },
+  "warden": {
+    "projects": [
+      "../vct7",
+      "../verekia.com",
+      "../bunext",
+      "../pixelize",
+      "../gizmo",
+      "../gputex",
+      "../gradient-normal-textures",
+      "../nanothree",
+      "../svg-to-tsl"
+    ],
+    "checks": {
+      "configFilesPresent": {
+        "enabled": true,
+        "files": [
+          ".oxfmtrc.json",
+          ".oxlintrc.json",
+          ".github/workflows/ci.yml"
+        ]
+      },
+      "matchingDependencyVersions": {
+        "enabled": true,
+        "packages": [
+          "oxfmt",
+          "oxlint"
+        ]
+      },
+      "exactDependencyVersions": {
+        "enabled": true,
+        "packages": {
+          "oxfmt": "0.48.0",
+          "oxlint": "1.63.0"
+        }
+      },
+      "requiredScripts": {
+        "enabled": true,
+        "scripts": {
+          "format": "oxfmt .",
+          "format:check": "oxfmt --check .",
+          "lint": "oxlint .",
+          "lint:fix": "oxlint --fix ."
+        }
+      },
+      "typecheckScript": {
+        "enabled": true,
+        "modes": {
+          "nanothree": "bun-filter-all"
+        }
+      },
+      "testScriptConsistency": {
+        "enabled": true,
+        "testFilePattern": "**/*.test.{ts,tsx,js,jsx}",
+        "testScript": "bun test",
+        "allWithoutTests": "bun run format:check && bun run lint && bun run typecheck && bun run warden",
+        "allWithTests": "bun run format:check && bun run lint && bun run typecheck && bun run warden && bun run test"
+      },
+      "tailwindOxfmtConfig": {
+        "enabled": true
+      },
+      "portlessNextDev": {
+        "enabled": true,
+        "version": "0.13.0"
+      },
+      "nextConfig": {
+        "enabled": true,
+        "options": {
+          "reactStrictMode": true,
+          "reactCompiler": true,
+          "output": "export"
+        },
+        "devDependencies": {
+          "babel-plugin-react-compiler": "1.0.0"
+        }
+      },
+      "wardenScript": {
+        "enabled": true,
+        "package": "@verekia/warden"
+      }
+    }
+  }
+}

package/src/checks/config-files-present.ts

@@ -0,0 +1,21 @@
+import type { CheckResult, Project, WardenConfig } from '../types.ts'
+
+export const configFilesPresent = async (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['configFilesPresent']>,
+): Promise<CheckResult> => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    for (const file of options.files) {
+      const exists = await Bun.file(`${project.path}/${file}`).exists()
+      if (!exists) {
+        passed = false
+        messages.push(`${project.name}: missing ${file}`)
+      }
+    }
+  }
+
+  return { name: 'configFilesPresent', passed, messages }
+}

package/src/checks/exact-dependency-versions.ts

@@ -0,0 +1,43 @@
+import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+
+const findVersion = (pkg: PackageJson, name: string): string | undefined =>
+  pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]
+
+const EXACT_SEMVER = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/
+
+export const exactDependencyVersions = (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['exactDependencyVersions']>,
+): CheckResult => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    if (!project.packageJson) {
+      passed = false
+      messages.push(`${project.name}: no package.json`)
+      continue
+    }
+    for (const [name, expected] of Object.entries(options.packages)) {
+      const declared = findVersion(project.packageJson, name)
+      if (declared === undefined) {
+        passed = false
+        messages.push(`${project.name}: ${name} not declared (expected ${expected})`)
+        continue
+      }
+      if (!EXACT_SEMVER.test(declared)) {
+        passed = false
+        messages.push(
+          `${project.name}: ${name} ${JSON.stringify(declared)} is not an exact version — use "${expected}"`,
+        )
+        continue
+      }
+      if (declared !== expected) {
+        passed = false
+        messages.push(`${project.name}: ${name} ${declared} does not match expected ${expected}`)
+      }
+    }
+  }
+
+  return { name: 'exactDependencyVersions', passed, messages }
+}

package/src/checks/matching-dependency-versions.ts

@@ -0,0 +1,43 @@
+import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+
+const findVersion = (pkg: PackageJson, name: string): string | undefined =>
+  pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]
+
+export const matchingDependencyVersions = (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['matchingDependencyVersions']>,
+): CheckResult => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const packageName of options.packages) {
+    const versionToProjects = new Map<string, string[]>()
+    const missing: string[] = []
+
+    for (const project of projects) {
+      const version = project.packageJson ? findVersion(project.packageJson, packageName) : undefined
+      if (version === undefined) {
+        missing.push(project.name)
+        continue
+      }
+      const existing = versionToProjects.get(version) ?? []
+      existing.push(project.name)
+      versionToProjects.set(version, existing)
+    }
+
+    if (missing.length > 0) {
+      passed = false
+      messages.push(`${packageName}: not declared in ${missing.join(', ')}`)
+    }
+
+    if (versionToProjects.size > 1) {
+      passed = false
+      const detail = [...versionToProjects.entries()]
+        .map(([version, names]) => `${version} (${names.join(', ')})`)
+        .join(' vs ')
+      messages.push(`${packageName}: version mismatch — ${detail}`)
+    }
+  }
+
+  return { name: 'matchingDependencyVersions', passed, messages }
+}

package/src/checks/next-config.ts

@@ -0,0 +1,135 @@
+import { Glob } from 'bun'
+import { dirname, resolve } from 'node:path'
+
+import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+
+const NEXT = 'next'
+const CONFIG_VARIANTS = ['next.config.js', 'next.config.mjs', 'next.config.ts', 'next.config.cjs'] as const
+
+type WorkspaceField = string[] | { packages?: string[] } | undefined
+
+const dependsOnNext = (pkg: PackageJson): boolean =>
+  NEXT in (pkg.dependencies ?? {}) || NEXT in (pkg.devDependencies ?? {}) || NEXT in (pkg.peerDependencies ?? {})
+
+const workspacePatterns = (pkg: PackageJson | null): string[] => {
+  const ws = (pkg as { workspaces?: WorkspaceField } | null)?.workspaces
+  if (Array.isArray(ws)) return ws
+  if (ws && Array.isArray(ws.packages)) return ws.packages
+  return []
+}
+
+const collectPackageJsons = async (project: Project): Promise<Array<{ relPath: string; pkg: PackageJson }>> => {
+  const results: Array<{ relPath: string; pkg: PackageJson }> = []
+  if (project.packageJson) {
+    results.push({ relPath: 'package.json', pkg: project.packageJson })
+  }
+  for (const pattern of workspacePatterns(project.packageJson)) {
+    const target = `${pattern}/package.json`
+    if (pattern.includes('*')) {
+      const glob = new Glob(target)
+      for await (const path of glob.scan({ cwd: project.path, onlyFiles: true })) {
+        if (path.startsWith('node_modules/')) continue
+        const pkgFile = Bun.file(resolve(project.path, path))
+        if (await pkgFile.exists()) {
+          results.push({ relPath: path, pkg: (await pkgFile.json()) as PackageJson })
+        }
+      }
+    } else {
+      const pkgFile = Bun.file(resolve(project.path, target))
+      if (await pkgFile.exists()) {
+        results.push({ relPath: target, pkg: (await pkgFile.json()) as PackageJson })
+      }
+    }
+  }
+  return results
+}
+
+const equal = (a: unknown, b: unknown): boolean => {
+  if (a === b) return true
+  if (a && b && typeof a === 'object' && typeof b === 'object') {
+    return JSON.stringify(a) === JSON.stringify(b)
+  }
+  return false
+}
+
+const loadConfigObject = async (absPath: string): Promise<Record<string, unknown>> => {
+  const mod = (await import(absPath)) as { default?: unknown }
+  let value: unknown = mod.default ?? mod
+  if (typeof value === 'function') {
+    value = await (value as (...args: unknown[]) => unknown)('phase-development-server', { defaultConfig: {} })
+  }
+  if (!value || typeof value !== 'object') {
+    throw new Error(`default export is not an object (got ${typeof value})`)
+  }
+  return value as Record<string, unknown>
+}
+
+export const nextConfig = async (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['nextConfig']>,
+): Promise<CheckResult> => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    const pkgs = await collectPackageJsons(project)
+
+    for (const { relPath, pkg } of pkgs) {
+      if (!dependsOnNext(pkg)) continue
+
+      const pkgDir = dirname(relPath)
+      const dirLabel = pkgDir === '.' ? '' : `${pkgDir}/`
+
+      let configRel: string | null = null
+      let configAbs: string | null = null
+      for (const variant of CONFIG_VARIANTS) {
+        const abs = resolve(project.path, pkgDir, variant)
+        if (await Bun.file(abs).exists()) {
+          configRel = `${dirLabel}${variant}`
+          configAbs = abs
+          break
+        }
+      }
+
+      if (configRel === null || configAbs === null) {
+        passed = false
+        messages.push(
+          `${project.name}/${relPath}: declares "next" but no config file found at ${dirLabel || './'} (expected one of ${CONFIG_VARIANTS.join(', ')})`,
+        )
+      } else {
+        let cfg: Record<string, unknown> | null = null
+        try {
+          cfg = await loadConfigObject(configAbs)
+        } catch (err) {
+          passed = false
+          messages.push(`${project.name}/${configRel}: failed to load — ${(err as Error).message}`)
+        }
+
+        if (cfg) {
+          for (const [key, expected] of Object.entries(options.options)) {
+            if (!equal(cfg[key], expected)) {
+              passed = false
+              const actual = key in cfg ? JSON.stringify(cfg[key]) : 'missing'
+              messages.push(
+                `${project.name}/${configRel}: "${key}" is ${actual} — expected ${JSON.stringify(expected)}`,
+              )
+            }
+          }
+        }
+      }
+
+      for (const [name, expected] of Object.entries(options.devDependencies)) {
+        const declared = pkg.devDependencies?.[name]
+        if (declared !== expected) {
+          const actual = declared === undefined ? 'missing' : JSON.stringify(declared)
+          passed = false
+          messages.push(
+            `${project.name}/${relPath}: declares "next" but devDependencies["${name}"] is ${actual} — expected exact "${expected}" (must be declared in this package.json)`,
+          )
+        }
+      }
+    }
+  }
+
+  return { name: 'nextConfig', passed, messages }
+}

package/src/checks/portless-next-dev.ts

@@ -0,0 +1,83 @@
+import { Glob } from 'bun'
+import { resolve } from 'node:path'
+
+import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+
+const NEXT_DEV_RE = /\bnext dev\b/
+const PORTLESS_WRAP_RE = /\bportless\s+\S+\s+next dev\b/
+
+type WorkspaceField = string[] | { packages?: string[] } | undefined
+
+const workspacePatterns = (pkg: PackageJson | null): string[] => {
+  const ws = (pkg as { workspaces?: WorkspaceField } | null)?.workspaces
+  if (Array.isArray(ws)) return ws
+  if (ws && Array.isArray(ws.packages)) return ws.packages
+  return []
+}
+
+const collectPackageJsons = async (project: Project): Promise<Array<{ relPath: string; pkg: PackageJson }>> => {
+  const results: Array<{ relPath: string; pkg: PackageJson }> = []
+  if (project.packageJson) {
+    results.push({ relPath: 'package.json', pkg: project.packageJson })
+  }
+  for (const pattern of workspacePatterns(project.packageJson)) {
+    const target = `${pattern}/package.json`
+    if (pattern.includes('*')) {
+      const glob = new Glob(target)
+      for await (const path of glob.scan({ cwd: project.path, onlyFiles: true })) {
+        if (path.startsWith('node_modules/')) continue
+        const pkgFile = Bun.file(resolve(project.path, path))
+        if (await pkgFile.exists()) {
+          results.push({ relPath: path, pkg: (await pkgFile.json()) as PackageJson })
+        }
+      }
+    } else {
+      const pkgFile = Bun.file(resolve(project.path, target))
+      if (await pkgFile.exists()) {
+        results.push({ relPath: target, pkg: (await pkgFile.json()) as PackageJson })
+      }
+    }
+  }
+  return results
+}
+
+export const portlessNextDev = async (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['portlessNextDev']>,
+): Promise<CheckResult> => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    const pkgs = await collectPackageJsons(project)
+
+    for (const { relPath, pkg } of pkgs) {
+      const scripts = pkg.scripts ?? {}
+      let usesNextDev = false
+
+      for (const [name, value] of Object.entries(scripts)) {
+        if (!NEXT_DEV_RE.test(value)) continue
+        usesNextDev = true
+        if (!PORTLESS_WRAP_RE.test(value)) {
+          passed = false
+          messages.push(
+            `${project.name}/${relPath}: script "${name}" is ${JSON.stringify(value)} — must be wrapped as "portless <app-name> next dev"`,
+          )
+        }
+      }
+
+      if (usesNextDev) {
+        const declared = pkg.devDependencies?.portless
+        if (declared !== options.version) {
+          const actual = declared === undefined ? 'missing' : JSON.stringify(declared)
+          passed = false
+          messages.push(
+            `${project.name}/${relPath}: uses "next dev" but devDependencies.portless is ${actual} — expected exact "${options.version}" (must be declared in this package.json)`,
+          )
+        }
+      }
+    }
+  }
+
+  return { name: 'portlessNextDev', passed, messages }
+}

package/src/checks/required-scripts.ts

@@ -0,0 +1,32 @@
+import type { CheckResult, Project, WardenConfig } from '../types.ts'
+
+export const requiredScripts = (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['requiredScripts']>,
+): CheckResult => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    const scripts = project.packageJson?.scripts
+    if (!scripts) {
+      passed = false
+      messages.push(`${project.name}: no "scripts" in package.json`)
+      continue
+    }
+    for (const [name, expected] of Object.entries(options.scripts)) {
+      const actual = scripts[name]
+      if (actual === undefined) {
+        passed = false
+        messages.push(`${project.name}: missing script "${name}" (expected ${JSON.stringify(expected)})`)
+      } else if (actual !== expected) {
+        passed = false
+        messages.push(
+          `${project.name}: script "${name}" is ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`,
+        )
+      }
+    }
+  }
+
+  return { name: 'requiredScripts', passed, messages }
+}

package/src/checks/tailwind-oxfmt-config.ts

@@ -0,0 +1,41 @@
+import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+
+const TAILWIND = 'tailwindcss'
+const OXFMT_CONFIG = '.oxfmtrc.json'
+const REQUIRED_KEY = 'sortTailwindcss'
+
+const dependsOnTailwind = (pkg: PackageJson): boolean =>
+  TAILWIND in (pkg.dependencies ?? {}) ||
+  TAILWIND in (pkg.devDependencies ?? {}) ||
+  TAILWIND in (pkg.peerDependencies ?? {})
+
+export const tailwindOxfmtConfig = async (
+  projects: Project[],
+  _options: NonNullable<WardenConfig['checks']['tailwindOxfmtConfig']>,
+): Promise<CheckResult> => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    const oxfmtFile = Bun.file(`${project.path}/${OXFMT_CONFIG}`)
+    if (!(await oxfmtFile.exists())) continue
+
+    const oxfmt = (await oxfmtFile.json()) as Record<string, unknown>
+    const present = REQUIRED_KEY in oxfmt
+
+    if (present && oxfmt[REQUIRED_KEY] !== true) {
+      passed = false
+      messages.push(
+        `${project.name}: ${OXFMT_CONFIG} "${REQUIRED_KEY}" must be \`true\` (got ${JSON.stringify(oxfmt[REQUIRED_KEY])})`,
+      )
+      continue
+    }
+
+    if (!present && project.packageJson && dependsOnTailwind(project.packageJson)) {
+      passed = false
+      messages.push(`${project.name}: depends on ${TAILWIND} but ${OXFMT_CONFIG} is missing "${REQUIRED_KEY}": true`)
+    }
+  }
+
+  return { name: 'tailwindOxfmtConfig', passed, messages }
+}

package/src/checks/test-script-consistency.ts

@@ -0,0 +1,49 @@
+import { Glob } from 'bun'
+
+import type { CheckResult, Project, WardenConfig } from '../types.ts'
+
+const projectHasTests = async (projectPath: string, pattern: string): Promise<boolean> => {
+  const glob = new Glob(pattern)
+  for await (const path of glob.scan({ cwd: projectPath, onlyFiles: true })) {
+    if (path.startsWith('node_modules/')) continue
+    return true
+  }
+  return false
+}
+
+export const testScriptConsistency = async (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['testScriptConsistency']>,
+): Promise<CheckResult> => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    const scripts = project.packageJson?.scripts ?? {}
+    const hasTests = await projectHasTests(project.path, options.testFilePattern)
+
+    if (hasTests) {
+      if (scripts.test !== options.testScript) {
+        passed = false
+        messages.push(
+          `${project.name}: has test files but "test" script is ${JSON.stringify(scripts.test)}, expected ${JSON.stringify(options.testScript)}`,
+        )
+      }
+      if (scripts.all !== options.allWithTests) {
+        passed = false
+        messages.push(
+          `${project.name}: "all" is ${JSON.stringify(scripts.all)}, expected ${JSON.stringify(options.allWithTests)} (project has tests)`,
+        )
+      }
+    } else {
+      if (scripts.all !== options.allWithoutTests) {
+        passed = false
+        messages.push(
+          `${project.name}: "all" is ${JSON.stringify(scripts.all)}, expected ${JSON.stringify(options.allWithoutTests)} (no tests detected)`,
+        )
+      }
+    }
+  }
+
+  return { name: 'testScriptConsistency', passed, messages }
+}

package/src/checks/typecheck-script.ts

@@ -0,0 +1,52 @@
+import type { CheckResult, Project, WardenConfig } from '../types.ts'
+
+const SINGLE = 'tsc --noEmit'
+const SOLUTION = 'tsc -b --noEmit'
+const FILTER_ALL = "bun run --filter '*' typecheck"
+
+const readTsconfigReferences = async (projectPath: string): Promise<boolean> => {
+  const file = Bun.file(`${projectPath}/tsconfig.json`)
+  if (!(await file.exists())) return false
+  try {
+    const tsconfig = (await file.json()) as { references?: unknown[] }
+    return Array.isArray(tsconfig.references) && tsconfig.references.length > 0
+  } catch {
+    return false
+  }
+}
+
+export const typecheckScript = async (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['typecheckScript']>,
+): Promise<CheckResult> => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    const scripts = project.packageJson?.scripts
+    if (!scripts) {
+      passed = false
+      messages.push(`${project.name}: no "scripts" in package.json`)
+      continue
+    }
+    const mode = options.modes?.[project.name] ?? 'auto'
+    const expected =
+      mode === 'bun-filter-all' ? FILTER_ALL : (await readTsconfigReferences(project.path)) ? SOLUTION : SINGLE
+    const reason =
+      mode === 'bun-filter-all'
+        ? "mode 'bun-filter-all'"
+        : `root tsconfig ${expected === SOLUTION ? 'has' : 'has no'} project references`
+    const actual = scripts.typecheck
+    if (actual === undefined) {
+      passed = false
+      messages.push(`${project.name}: missing script "typecheck" (expected ${JSON.stringify(expected)})`)
+    } else if (actual !== expected) {
+      passed = false
+      messages.push(
+        `${project.name}: script "typecheck" is ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)} (${reason})`,
+      )
+    }
+  }
+
+  return { name: 'typecheckScript', passed, messages }
+}

package/src/checks/warden-script.ts

@@ -0,0 +1,33 @@
+import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+
+const dependsOn = (pkg: PackageJson, name: string): boolean =>
+  name in (pkg.dependencies ?? {}) || name in (pkg.devDependencies ?? {}) || name in (pkg.peerDependencies ?? {})
+
+export const wardenScript = (
+  projects: Project[],
+  options: NonNullable<WardenConfig['checks']['wardenScript']>,
+): CheckResult => {
+  const messages: string[] = []
+  let passed = true
+
+  for (const project of projects) {
+    const pkg = project.packageJson
+    if (!pkg || !dependsOn(pkg, options.package)) continue
+
+    const scripts = pkg.scripts ?? {}
+    if (scripts.warden !== 'warden') {
+      passed = false
+      messages.push(
+        `${project.name}: depends on ${options.package} but "warden" script is ${JSON.stringify(scripts.warden)}, expected "warden"`,
+      )
+    }
+    if (!scripts.all || !scripts.all.includes('bun run warden')) {
+      passed = false
+      messages.push(
+        `${project.name}: depends on ${options.package} but "all" script ${JSON.stringify(scripts.all)} is missing "bun run warden"`,
+      )
+    }
+  }
+
+  return { name: 'wardenScript', passed, messages }
+}

package/src/config.ts

@@ -0,0 +1,28 @@
+import { basename, resolve } from 'node:path'
+
+import type { PackageJson, Project, WardenConfig } from './types.ts'
+
+export const loadConfig = async (baseDir: string): Promise<WardenConfig> => {
+  const packageJsonPath = `${baseDir}/package.json`
+  const packageJsonFile = Bun.file(packageJsonPath)
+  if (!(await packageJsonFile.exists())) {
+    throw new Error(`No package.json found at ${packageJsonPath}`)
+  }
+  const pkg = (await packageJsonFile.json()) as PackageJson & { warden?: WardenConfig }
+  if (!pkg.warden) {
+    throw new Error(`No "warden" key in ${packageJsonPath}`)
+  }
+  return pkg.warden
+}
+
+export const resolveProjects = async (config: WardenConfig, baseDir: string): Promise<Project[]> => {
+  const projectPaths = config.projects && config.projects.length > 0 ? config.projects : ['.']
+  return Promise.all(
+    projectPaths.map(async projectPath => {
+      const path = resolve(baseDir, projectPath)
+      const packageJsonFile = Bun.file(`${path}/package.json`)
+      const packageJson = (await packageJsonFile.exists()) ? ((await packageJsonFile.json()) as PackageJson) : null
+      return { name: basename(path), path, packageJson }
+    }),
+  )
+}

package/src/index.ts

@@ -0,0 +1,91 @@
+#!/usr/bin/env bun
+import { existsSync } from 'node:fs'
+
+import { configFilesPresent } from './checks/config-files-present.ts'
+import { exactDependencyVersions } from './checks/exact-dependency-versions.ts'
+import { matchingDependencyVersions } from './checks/matching-dependency-versions.ts'
+import { nextConfig } from './checks/next-config.ts'
+import { portlessNextDev } from './checks/portless-next-dev.ts'
+import { requiredScripts } from './checks/required-scripts.ts'
+import { tailwindOxfmtConfig } from './checks/tailwind-oxfmt-config.ts'
+import { testScriptConsistency } from './checks/test-script-consistency.ts'
+import { typecheckScript } from './checks/typecheck-script.ts'
+import { wardenScript } from './checks/warden-script.ts'
+import { loadConfig, resolveProjects } from './config.ts'
+
+import type { CheckResult } from './types.ts'
+
+const baseDir = process.cwd()
+
+const config = await loadConfig(baseDir)
+const allProjects = await resolveProjects(config, baseDir)
+
+const filterNames = process.argv.slice(2)
+const knownNames = new Set(allProjects.map(p => p.name))
+const unknown = filterNames.filter(n => !knownNames.has(n))
+if (unknown.length > 0) {
+  console.error(
+    `Unknown project(s): ${unknown.join(', ')}\nConfigured projects: ${allProjects.map(p => p.name).join(', ')}`,
+  )
+  process.exit(2)
+}
+
+const projects = filterNames.length > 0 ? allProjects.filter(p => filterNames.includes(p.name)) : allProjects
+
+const missing = projects.filter(p => !existsSync(p.path))
+if (missing.length > 0) {
+  const detail = missing.map(p => `  - ${p.name} (expected at ${p.path})`).join('\n')
+  const noun = missing.length === 1 ? 'directory is' : 'directories are'
+  console.error(
+    `Cannot run warden — the following project ${noun} not on disk:\n${detail}\n\nWarden resolves project paths relative to ${baseDir}. In a cloud env, ensure each attached repo is checked out at the expected path and pass only those names as arguments.`,
+  )
+  process.exit(2)
+}
+
+const scopeNote = filterNames.length > 0 ? ` (filtered from ${allProjects.length} configured)` : ''
+console.log(`warden — checking ${projects.length} project(s)${scopeNote}: ${projects.map(p => p.name).join(', ')}\n`)
+
+const results: CheckResult[] = []
+
+if (config.checks.configFilesPresent?.enabled) {
+  results.push(await configFilesPresent(projects, config.checks.configFilesPresent))
+}
+if (config.checks.matchingDependencyVersions?.enabled) {
+  results.push(matchingDependencyVersions(projects, config.checks.matchingDependencyVersions))
+}
+if (config.checks.exactDependencyVersions?.enabled) {
+  results.push(exactDependencyVersions(projects, config.checks.exactDependencyVersions))
+}
+if (config.checks.requiredScripts?.enabled) {
+  results.push(requiredScripts(projects, config.checks.requiredScripts))
+}
+if (config.checks.typecheckScript?.enabled) {
+  results.push(await typecheckScript(projects, config.checks.typecheckScript))
+}
+if (config.checks.testScriptConsistency?.enabled) {
+  results.push(await testScriptConsistency(projects, config.checks.testScriptConsistency))
+}
+if (config.checks.tailwindOxfmtConfig?.enabled) {
+  results.push(await tailwindOxfmtConfig(projects, config.checks.tailwindOxfmtConfig))
+}
+if (config.checks.portlessNextDev?.enabled) {
+  results.push(await portlessNextDev(projects, config.checks.portlessNextDev))
+}
+if (config.checks.nextConfig?.enabled) {
+  results.push(await nextConfig(projects, config.checks.nextConfig))
+}
+if (config.checks.wardenScript?.enabled) {
+  results.push(wardenScript(projects, config.checks.wardenScript))
+}
+
+for (const result of results) {
+  const tag = result.passed ? '[PASS]' : '[FAIL]'
+  console.log(`${tag} ${result.name}`)
+  for (const message of result.messages) {
+    console.log(`       ${message}`)
+  }
+}
+
+const failed = results.filter(r => !r.passed).length
+console.log(`\n${results.length - failed}/${results.length} checks passed`)
+process.exit(failed === 0 ? 0 : 1)

package/src/types.ts

@@ -0,0 +1,46 @@
+export type WardenConfig = {
+  projects?: string[]
+  checks: {
+    configFilesPresent?: { enabled: boolean; files: string[] }
+    matchingDependencyVersions?: { enabled: boolean; packages: string[] }
+    exactDependencyVersions?: { enabled: boolean; packages: Record<string, string> }
+    requiredScripts?: { enabled: boolean; scripts: Record<string, string> }
+    typecheckScript?: { enabled: boolean; modes?: Record<string, 'auto' | 'bun-filter-all'> }
+    testScriptConsistency?: {
+      enabled: boolean
+      testFilePattern: string
+      testScript: string
+      allWithoutTests: string
+      allWithTests: string
+    }
+    tailwindOxfmtConfig?: { enabled: boolean }
+    portlessNextDev?: { enabled: boolean; version: string }
+    nextConfig?: {
+      enabled: boolean
+      options: Record<string, unknown>
+      devDependencies: Record<string, string>
+    }
+    wardenScript?: { enabled: boolean; package: string }
+  }
+}
+
+export type PackageJson = {
+  name?: string
+  version?: string
+  scripts?: Record<string, string>
+  dependencies?: Record<string, string>
+  devDependencies?: Record<string, string>
+  peerDependencies?: Record<string, string>
+}
+
+export type Project = {
+  name: string
+  path: string
+  packageJson: PackageJson | null
+}
+
+export type CheckResult = {
+  name: string
+  passed: boolean
+  messages: string[]
+}