devdoctor

A check-up for your repo before production does it for you.

Eight checks for JavaScript and TypeScript projects in one install. They catch the migration that locks a table, the env var nobody documented, and the import that breaks your architecture.

$ npx @wealthometer/devdoctor check
See the eight checks Read the docs

Free and MIT licensed · Node 20+ · Output as text, JSON, Markdown or SARIF

0 errors 

      

    

  


  

    

      
Eight checks, one install

      
Each check is its own command, and they all run together with devdoctor check. Every problem comes with a file, a line number and a one-line fix.

      

        

          
RepoDoctorrepo health

          
Grades tests, docs, TypeScript strictness, npm scripts, CI, Docker and hygiene. You get a 0–100 score and a fix for every point lost.

          repodoctor scan ./
        

        

          
MigraGuardmigration safety

          
Finds dropped columns, NOT NULL without a default, and indexes built without CONCURRENTLY, before they lock production. Works with PostgreSQL migrations from SQL, Prisma, Drizzle and Knex.

          migraguard check --since origin/main
        

        

          
PulseAPIAPI tests

          
Write chained requests in YAML, with environments, JSON Schema checks and response-time limits. Results come out as a table or JUnit.

          pulseapi run ./api-tests
        

        

          
DepScopedependencies

          
Finds duplicate versions; unused, undeclared and outdated packages; heavy dependency trees; and import cycles. Prints graphs as Mermaid or Graphviz.

          depscope analyze
        

        

          
EnvDoctorenvironment config

          
Compares .env, .env.example, your Zod schema, the code, Docker Compose and CI. Reports never show a secret's value.

          envdoctor check --schema src/env.ts
        

        

          
CommitSmithgit history

          
Suggests Conventional Commit messages from staged changes, lints them, writes changelogs, and blocks keys and .env files from being committed.

          commitsmith suggest
        

        

          
ArchWatcharchitecture

          
You declare layers and the imports they're allowed. It catches imports that cross the line, deep imports into a module's internals, and circular imports.

          archwatch check
        

        

          
LogLenslogs

          
Reads JSON, logfmt and plain-text logs and groups the errors into a short list. Shows which exceptions keep coming back and when they spike.

          loglens analyze ./logs/app.log
        

      

    

  


  

    

      

        
8checks in one package

        
4output formats: text, JSON, Markdown and SARIF

        
0config files needed to start

        
72tests against real git repos and HTTP servers

      

    

  


  

    

      

        
Fails the pull request, not the deploy

        
Add one step to your workflow. Problems show up inline in the PR through GitHub code scanning, and the job fails before anything risky merges.

        
    
          
  • Checks only what's newMigraGuard --since origin/main skips migrations that already ran.
    • 
          
  • Your threshold--fail-on warning to be strict, or none to only report.
    • 
          
  • Readable anywhereMarkdown for PR comments, SARIF for code scanning, JSON for your own scripts.
    • 
        

      

      


# .github/workflows/checks.yml
on: pull_request
permissions:
  contents: read
  security-events: write
jobs:
  devdoctor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-node@v4
        with: { node-version: 22 }
      - run: npm ci
      - run: npx @wealthometer/devdoctor check -f sarif -o dd.sarif --fail-on none
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: dd.sarif }
      - run: npx @wealthometer/devdoctor check
      - run: npx migraguard check --since origin/main

        

          
0All clear

          
1Problems at or above --fail-on

          
2Usage or config error

        

      

    

  


  

    

      

        
Zero config to start. One file when you need it.

        
Every check works out of the box. When you want rules of your own, put them in devdoctor.config.json, which comes with a JSON Schema for editor autocomplete.

        
    
          
  • Architecture rulesLayers, forbidden imports, and folders that can only be reached through their entry file.
    • 
          
  • API environmentsLocal, staging and production base URLs for PulseAPI.
    • 
          
  • Ignore by ruleTurn off a rule for the whole repo, or for one file.
    • 
        

      


{
  "archwatch": {
    "layers": {
      "domain": "src/domain/**",
      "infra": "src/infra/**",
      "ui": "src/ui/**"
    },
    "rules": [
      { "from": "domain", "allow": [] },
      { "from": "ui", "disallow": ["infra"] }
    ]
  },
  "envdoctor": { "schema": "src/env.ts" },
  "migraguard": { "pgVersion": 16 },
  "repodoctor": { "minScore": 80 }
}

    

  


  

    

      

        
Run your first check-up.

        
It takes seconds and changes nothing in your repo.

      

      

        $ npx @wealthometer/devdoctor check