devx(sdui): re-record the manifest per registry package; move the record's readers

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SMJGPXxFBpbgAgXdnsXKVS

Author: claude

docs/releases-maintenance.md

@@ -55,11 +55,12 @@ ships the Console from the same commit as the spec it builds against.
 > root `.changeset/` before the first joint Version PR is #25831. New frontend
 > changesets go in the root `.changeset/`.
 
-#### After a registry change: regenerate the committed manifest (#12924, #17735, #25712)
+#### After a registry change: regenerate the committed manifest (#12924, #17735, #25712, #26051)
 
 The repo-root `sdui.manifest.json` (ADR-0080, the Console's public-tier component
-manifest) and its provenance record `scripts/sdui-manifest.record.json` are
-generated, and one command writes them:
+manifest), its provenance record `scripts/sdui-manifest.record.json` and one record
+per registry package under `scripts/sdui-manifest.sources/` are generated, and one
+command writes them:
 
 ```bash
 node scripts/gen-sdui-manifest-node.mjs   # no arguments
@@ -68,14 +69,20 @@ node scripts/gen-sdui-manifest-node.mjs   # no arguments
 It builds the registry packages under `ui/packages/`, enumerates them from
 `ui/apps/console` under plain Node, and serializes them through
 `@objectstack/sdui-parser` (it needs `packages/sdui-parser/dist`:
-`pnpm --filter @objectstack/sdui-parser build`). The record carries an `inTree`
-block with a digest of the registry packages' `src/`.
+`pnpm --filter @objectstack/sdui-parser build`). Each package record is one line:
+a digest of that package's own `src/` and the `sha256` of the artefact it was
+verified against. A run rewrites only the records whose line changed, so a PR that
+edits one registry package re-records that package alone; the shared record moves
+only when the artefact does, and then every package record names the new `sha256`.
 
-A required lint step reads the tracked pair on **every PR**:
+A required lint step reads the tracked files on **every PR**:
 `node scripts/check-sdui-manifest.mjs` checks the shape, the `sha256` against the
-record, and recomputes the source digest from the index. A PR that edits a registry
-package's source without regenerating goes red there, and the failure text prints
-the regeneration call. ⛔ There is no npm install route to the manifest; that was
+record, and recomputes each package's source digest from the index. A PR that edits
+a registry package's source without regenerating goes red there, naming the package,
+and the failure text prints the regeneration call. Two PRs that edit different
+registry packages touch different record files and do not conflict; two that edit
+the same package, or a PR that changes the artefact, still conflict once, and the
+later one merges `main` and re-runs the command. ⛔ There is no npm install route to the manifest; that was
 deleted by ruling 丙 on #17735.
 
 **One producer, one artefact.** `packages/console/build-dist.sh` copies the tracked

scripts/check-changeset-no-major.mjs

@@ -1365,9 +1365,10 @@ export function publishedSourceOwners(path, manifestOf) {
 // packed output — one path — and never which files it copies: the day the
 // console build ships a second tracked file, this leg sees it with no edit
 // here, and the day it stops copying the manifest, the leg stops claiming it.
-// `scripts/sdui-manifest.record.json` is measured OUT for that reason rather
-// than by choice: the build reads it for a warning line and does not copy it,
-// so it is not part of the shipped artefact.
+// `scripts/sdui-manifest.record.json` and the per-package records under
+// `scripts/sdui-manifest.sources/` are measured OUT for that reason rather than
+// by choice: the build does not copy them, so they are not part of the shipped
+// artefact.
 //
 // ⚠️ Residual, stated rather than implied: the reader understands the plain
 // shell the script is written in — `NAME="value"` assignments, `$NAME` /
@@ -4875,8 +4876,8 @@ function selfTest() {
         `this repository's ${PACKED_COPY_BUILD_SCRIPTS[0]} copies the repo-root sdui.manifest.json into packages/console/dist/ as read by this leg — got ${JSON.stringify(realPairs)}`,
       );
       assert(
-        !realPairs.some((p) => p.source === 'scripts/sdui-manifest.record.json'),
-        `measured, not chosen: the real build does not ship the manifest record — got ${JSON.stringify(realPairs)}`,
+        !realPairs.some((p) => p.source === 'scripts/sdui-manifest.record.json' || p.source.startsWith('scripts/sdui-manifest.sources/')),
+        `measured, not chosen: the real build ships neither the manifest record nor a package record — got ${JSON.stringify(realPairs)}`,
       );
 
       // ── The owner of a destination ────────────────────────────────────────
@@ -4956,14 +4957,21 @@ function selfTest() {
       const no = levelOf(copyRepo({ head: { ...PR22812, '.changeset/console-bbbb.md': changeset([[CONSOLE, 'patch']]) } }), declaredNo);
       assert(no.result.verdict === 'none-clean' && no.exitCode === 0, `the manifest moved under \`Clause-②: no\` + \`none\` is unaffected — got ${no.result.verdict} / ${no.exitCode}`);
 
-      // The record moves with every regeneration but ships nothing.
+      // The records move with regeneration but ship nothing: the shared one, and
+      // the one-line record of the registry package a ui PR re-recorded.
       const recordOnly = levelOf(
-        copyRepo({ head: { 'scripts/sdui-manifest.record.json': '{"objectuiSha":"bbbb"}\n', '.changeset/console-bbbb.md': changeset([[CONSOLE, 'patch']]) } }),
+        copyRepo({
+          head: {
+            'scripts/sdui-manifest.record.json': '{"objectuiSha":"bbbb"}\n',
+            'scripts/sdui-manifest.sources/plugin-grid.json': '{"package":"ui/packages/plugin-grid"}\n',
+            '.changeset/console-bbbb.md': changeset([[CONSOLE, 'patch']]),
+          },
+        }),
         yesWidening,
       );
       assert(
         recordOnly.touched.packages.length === 0 && recordOnly.touched.unreadable.length === 0 && recordOnly.result.verdict === 'clean',
-        `control: the record alone moves no published file — got ${JSON.stringify(recordOnly.touched)} / ${recordOnly.result.verdict}`,
+        `control: the records alone move no published file — got ${JSON.stringify(recordOnly.touched)} / ${recordOnly.result.verdict}`,
       );
 
       // #4690 on this leg: a build script that is THERE but yields no copy is

scripts/gen-sdui-manifest-node.mjs

@@ -460,7 +460,7 @@ if (pinned) {
   console.error(
     `✓ ${recordMoved ? 're-recorded' : 'left unchanged'} scripts/sdui-manifest.record.json in-tree — ${SOURCE} ${MODULES_ROOT_REL}, ` +
       `@object-ui/core workspace version ${nextRecord.inTree.objectuiWorkspaceVersion}` +
-      (carried.sha256 ? ` (artefact unchanged since ${nextRecord.generatedAt}, so the record is carried)` : '') +
+      (carried.sha256 ? ` (artefact unchanged since ${nextRecord.generatedAt}: its date and version are carried)` : '') +
       '; ' +
       (carried.objectuiSha ? `pin fields kept (artefact unchanged since pin ${carried.objectuiSha.slice(0, 12)})` : 'no pin fields'),
   );

scripts/sdui-manifest.record.json

@@ -5,10 +5,12 @@
     "scripts/gen-sdui-manifest-node.mjs, the one producer (ruling 丙 on #17735): it builds the registry packages under",
     "ui/packages/, then enumerates them from `inTree.modulesRoot` exactly as ui/apps/console/dev/manifest-dump.tsx",
     "does: eager-import the 16 registry modules, ComponentRegistry.getPublicConfigs(), manifestFromConfigs from",
-    "@objectstack/sdui-parser. `inTree.registrySourcesSha256` digests those packages' src/ as the index holds them;",
-    "`scripts/check-sdui-manifest.mjs` recomputes it, so a registry source edit without regeneration goes RED there.",
-    "`inTree.objectuiWorkspaceVersion` is provenance, not a verdict (#25712). Pin-keyed fields, where present, say the",
-    "artefact is byte-identical to the one generated at that pin.",
+    "@objectstack/sdui-parser. Each registry package has a one-line record under `inTree.registryRecords` (#26051): a",
+    "digest of that package's own src/ as the index holds them, and the sha256 of the artefact it was verified against.",
+    "`scripts/check-sdui-manifest.mjs` recomputes every digest, so a registry source edit without regeneration goes RED",
+    "there naming the package. This record moves only with the artefact; a run where only sources moved re-records only",
+    "their packages. `inTree.objectuiWorkspaceVersion` is provenance, not a verdict (#25712). Pin-keyed fields, where",
+    "present, say the artefact is byte-identical to the one generated at that pin.",
     "Regenerate + re-record: node scripts/gen-sdui-manifest-node.mjs"
   ],
   "source": "built-tree",
@@ -19,36 +21,6 @@
   "inTree": {
     "modulesRoot": "ui/apps/console",
     "objectuiWorkspaceVersion": "18.1.0",
-    "registryPackages": [
-      "ui/packages/components",
-      "ui/packages/core",
-      "ui/packages/data-objectstack",
-      "ui/packages/fields",
-      "ui/packages/i18n",
-      "ui/packages/mobile",
-      "ui/packages/permissions",
-      "ui/packages/plugin-calendar",
-      "ui/packages/plugin-charts",
-      "ui/packages/plugin-dashboard",
-      "ui/packages/plugin-detail",
-      "ui/packages/plugin-form",
-      "ui/packages/plugin-gantt",
-      "ui/packages/plugin-grid",
-      "ui/packages/plugin-kanban",
-      "ui/packages/plugin-list",
-      "ui/packages/plugin-map",
-      "ui/packages/plugin-markdown",
-      "ui/packages/plugin-report",
-      "ui/packages/plugin-timeline",
-      "ui/packages/plugin-tree",
-      "ui/packages/plugin-view",
-      "ui/packages/providers",
-      "ui/packages/react",
-      "ui/packages/react-runtime",
-      "ui/packages/sdui-parser",
-      "ui/packages/types"
-    ],
-    "registrySources": 922,
-    "registrySourcesSha256": "0e127be18a1104d857822dc5c71a6380e4f00b0db729cd8b8a230a11c120fe78"
+    "registryRecords": "scripts/sdui-manifest.sources"
   }
 }

scripts/sdui-manifest.sources/components.json

@@ -0,0 +1 @@
+{"package":"ui/packages/components","sources":226,"sha256":"7c50070c8bc750d5717fce0a081038855777bfb749567757047e672262517886","manifestSha256":"1f6e1ccb925a678eaa393f9091dfc7d0285e4e3626e0a5c61a5474687debabb7"}

scripts/sdui-manifest.sources/core.json

@@ -0,0 +1 @@
+{"package":"ui/packages/core","sources":110,"sha256":"c4ca58ee32a488b2139abc179f34d5606ba0d89b86fccf8bd5c4d7b69d07f654","manifestSha256":"1f6e1ccb925a678eaa393f9091dfc7d0285e4e3626e0a5c61a5474687debabb7"}

scripts/sdui-manifest.sources/data-objectstack.json

@@ -0,0 +1 @@
+{"package":"ui/packages/data-objectstack","sources":10,"sha256":"83f94a01a5e9704df262bda723b1dd58c619d66ec70f9dc22476cc7146e8d97a","manifestSha256":"1f6e1ccb925a678eaa393f9091dfc7d0285e4e3626e0a5c61a5474687debabb7"}

scripts/sdui-manifest.sources/fields.json

@@ -0,0 +1 @@
+{"package":"ui/packages/fields","sources":96,"sha256":"89537e9f86037ddb8d0c6ce1a9fbcfbc8d756fd38b1a990c2c5ccc277a359d1a","manifestSha256":"1f6e1ccb925a678eaa393f9091dfc7d0285e4e3626e0a5c61a5474687debabb7"}

scripts/sdui-manifest.sources/i18n.json

@@ -0,0 +1 @@
+{"package":"ui/packages/i18n","sources":31,"sha256":"683731eac82c00f4ffa54852f8ebfd947b5c95ad70847d8e2dc55ff66adbe25a","manifestSha256":"1f6e1ccb925a678eaa393f9091dfc7d0285e4e3626e0a5c61a5474687debabb7"}

scripts/sdui-manifest.sources/mobile.json

@@ -0,0 +1 @@
+{"package":"ui/packages/mobile","sources":16,"sha256":"c0a5f99d3fcf9231f398a16b7c62814de505b2de6118ed667da4f93d7cf9ba9a","manifestSha256":"1f6e1ccb925a678eaa393f9091dfc7d0285e4e3626e0a5c61a5474687debabb7"}