lib

commit ba9863edb2381b7971477ba3a8bd85cb41d2cb3b
parent 3aa5ea50bc6b7e313357fb243a266da70af8cc6b
Author: triesap <tyson@radroots.org>
Date:   Mon,  3 Aug 2026 13:24:18 +0000

packages: normalize generated artifact metadata

- Record exact generated package version, license, and SDK repository identity.
- Add deterministic SHA-256 provenance for every emitted TypeScript artifact.
- Preserve unique package names, root-only exports, and private build boundaries.
- Verify frozen install, build, typecheck, generation, and architecture gates.

Diffstat:
M
tools/sdk_xtask_import/src/manifest.rs
 | 
14
++++++++++++++
M
tools/sdk_xtask_import/src/output.rs
 | 
20
++++++++++++++++++--

2 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/tools/sdk_xtask_import/src/manifest.rs b/tools/sdk_xtask_import/src/manifest.rs
@@ -10,6 +10,10 @@ pub fn package_manifest(spec: PackageSpec) -> serde_json::Value {
     json!({
         "package": spec.package_name,
         "crate": spec.crate_name,
+        "version": "0.1.0",
+        "license": "MIT OR Apache-2.0",
+        "repository": "https://github.com/radrootslabs/sdk",
+        "repository_directory": spec.package_dir,
         "generator": "radroots_sdk_xtask",
         "generated": false
     })
@@ -35,5 +39,15 @@ mod tests {
         let manifest = package_manifest(package_specs()[0]);
         assert_eq!(manifest["package"], package_specs()[0].package_name);
         assert_eq!(manifest["crate"], package_specs()[0].crate_name);
+        assert_eq!(manifest["version"], "0.1.0");
+        assert_eq!(manifest["license"], "MIT OR Apache-2.0");
+        assert_eq!(
+            manifest["repository"],
+            "https://github.com/radrootslabs/sdk"
+        );
+        assert_eq!(
+            manifest["repository_directory"],
+            package_specs()[0].package_dir
+        );
     }
 }
diff --git a/tools/sdk_xtask_import/src/output.rs b/tools/sdk_xtask_import/src/output.rs
@@ -102,7 +102,7 @@ impl PackageOutput {
     pub fn provenance_file(&self) -> GeneratedFile {
         GeneratedFile {
             relative_path: manifest_relative_path(self.spec),
-            contents: render_manifest(self.spec),
+            contents: render_manifest(self),
         }
     }
 }
@@ -211,9 +211,25 @@ fn structured_imports_ts(imports: &[TypeScriptImport]) -> Option<String> {
     )
 }
 
-fn render_manifest(spec: PackageSpec) -> String {
+fn render_manifest(output: &PackageOutput) -> String {
+    let spec = output.spec;
     let mut value = package_manifest(spec);
     value["generated"] = serde_json::Value::Bool(true);
+    value["outputs"] = serde_json::Value::Object(
+        output
+            .files()
+            .into_iter()
+            .map(|file| {
+                (
+                    file.relative_path,
+                    serde_json::Value::String(format!(
+                        "{:x}",
+                        Sha256::digest(file.contents.as_bytes())
+                    )),
+                )
+            })
+            .collect(),
+    );
     if matches!(spec.key, "event" | "trade") {
         let (sha256, source_packages) = match spec.key {
             "event" => (EVENT_BINDINGS_TYPES_SHA256, EVENT_NATIVE_SOURCES),