feat(manifest-v2): migrate to universal widget manifest

[rubenvdlinde]

Summary

First reference migration of Phase 1d in the v2 manifest rollout. Procest's 58-page v1 manifest is now a v2 manifest — the largest in the fleet, used as the codemod stress test.

What changed

• @conduction/nextcloud-vue: ^1.0.0-beta.42 → ^1.0.0-beta.57 — first beta with the v2 schema, validator, renderer pipeline, and manifest-migrate CLI
• commander@^12.1.0 added to devDependencies (required to invoke the codemod bin from node_modules)
• src/manifest.json — full v2 transform via npx manifest-migrate:
  • $schema → v2 canonical URL
  • 12 dashboard widgets merged with layout entries into unified widgets[] with grid coords inline
  • 22 sidebar tab widgets across 17 detail pages lifted to slot: "sidebar" with tabGroup metadata
  • 10 actions gained explicit type: "handler" where implicit
  • 11 type: "custom" pages got accurate _note fields (bespoke public views, lib-gap deferrals, migration-cost deferrals — all legitimate)
  • dataSource, @resolve:, dynamicSource carried forward verbatim
• src/registry.js (new) — 13 kind: "page" entries (11 custom pages + 4 sidebar component tabs)
• src/App.vue + src/main.js — registry prop wired alongside existing customComponents; v2 renderer transparently picks the right one

Verification

• npx manifest-migrate codemod: exit 0, schema-valid output
• v2 validator (validateManifestV2(manifest)): { valid: true, errors: [] }
• npm run build: succeeds with 17 pre-existing warnings (0 errors)
• npm run lint: 14 pre-existing warnings (0 errors)

Known gaps (tracked as follow-ups)

1. VisualWorkflowEditor not in registry — its @vue-flow runtime is Vue 3 only and breaks Vue 2 builds. Page stays type: "custom" with a _note explaining the deferral. Re-register when a Vue-2-compatible flow library lands.
2. Implicit built-in widget keys — audit-trail, data, metadata, related-index, action appear in the v2 manifest but aren't in nc-vue's exported builtInWidgets registry. They render correctly today via the detail/dashboard renderer's internal handling, but strict registry lookups would log console.warn. Tracked as a follow-up against nc-vue.

Out of scope

• src/customComponents.js is preserved with its voorstelReminder function (non-component, can't be a registry entry) and as v1 backward-compat. Can be removed once procest fully moves to registry.
• Backend (PHP) is unchanged.

Hydra labels

Not adding ready-for-code-review / ready-for-security-review — Hydra is paused. Ready for manual review.

Test plan

• npx manifest-migrate --input src/manifest.json --validate-only reports v2-valid
• App boots; dashboard renders 12 widgets in grid
• Detail pages render sidebar widgets in their tab groups
• All 11 type: "custom" pages still resolve their components via the registry
• No regressions on existing routes / page transitions

[github-actions]

Quality Report — ConductionNL/procest @ 2b4ccd6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 426/426
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 0% (0/81 statements)

---

Quality workflow — 2026-05-19 10:54 UTC

Download the full PDF report from the workflow artifacts.