stats.json is non-deterministic when two component stylesheets produce the same output file #34209

Command

build

Is this a regression?

No. Present since the esbuild-based builder merged stylesheet metafiles this way.

Description

Build output is non-deterministic: two production builds of identical sources write different stats.json files, while every emitted JS, CSS and media file is byte-identical.

The cause is one loop. In packages/angular/build/src/tools/esbuild/angular/compiler-plugin.ts, build.onEnd merges each component stylesheet's esbuild metafile into the main metafile with Object.assign while iterating additionalResults.values(). That map fills as each stylesheet finishes bundling, so its order changes from build to build. When two stylesheets produce the same output file name, two components with the same file name and byte-identical SCSS, or two identical images referenced from different stylesheets, each metafile claims the output with its own inputs, and the last one merged wins. outputs[<file>].inputs then names one source on one build and the other on the next.

statsJson: true makes it visible, but the merged metafile is the one esbuild hands to every onEnd callback, so any consumer of result.metafile sees the same flip.

Minimal Reproduction

Repository: https://github.com/sdjayna/angular-metafile-merge-order-repro

npm ci
scripts/repro.sh          # builds twice, compares stats.json, hashes dist/repro/browser
scripts/repro-loop.sh 5   # repeats the pair 5 times, counts flips

The app is a fresh ng new repro --style=scss with statsJson: true and outputHashing: "all" in the production configuration, plus 60 generated standalone components: 12 pairs share a file name and byte-identical SCSS across src/app/a and src/app/b, and 4 pairs reference byte-identical PNG files from two asset folders.

Expected: two production builds of identical sources write identical stats.json.

Actual: every build pair differed in 7 to 10 of the 54 outputs entries (5 of 5 pairs). Emitted files under dist/repro/browser had identical SHA-256 hashes in every pair.

build 1: 4 s
build 2: 2 s
emitted files under dist/repro/browser: identical (8 files)
stats.json: differs
outputs: 54
outputs whose inputs differ: 9
  dup-0-4P5FWS4E.css
    run1: src/app/a/dup-0/dup-0.scss
    run2: src/app/b/dup-0/dup-0.scss
  dup-10-FB2SWP2Q.css
    run1: src/app/b/dup-10/dup-10.scss
    run2: src/app/a/dup-10/dup-10.scss
  media/pic-0-Q45TVVQX.png
    run1: angular:css-resource:src/app/a/img/pic-0.png
    run2: angular:css-resource:src/app/b/img/pic-0.png

Sorting additionalResults by key before the merge removes it: with that one-line change applied to node_modules/@angular/build, 0 of 3 pairs differed and stats.json was byte-identical. Reverting it brought the flip back. PR to follow.

Your Environment

Angular CLI       : 22.1.9
Angular           : 22.2.0
Node.js           : 26.8.1
Package Manager   : npm 11.19.0
Operating System  : darwin arm64

Package                   Installed Version
@angular/build            22.1.9
@angular/cli              22.1.9
@angular/common           22.2.0
@angular/compiler         22.2.0
@angular/compiler-cli     22.2.0
@angular/core             22.2.0
typescript                6.0.3

Anything else relevant?

Reproduced on macOS 26.7 (arm64, 16 cores). The same loop exists unchanged on main (additionalResults.values() in compiler-plugin.ts), where the file is dist/browser-stats.json.