@empire-builder-kit/nx 1.0.0-rc.29 → 1.0.0-rc.31

package/src/generators/upgrade/upgrade.js

@@ -13,12 +13,12 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const node_util_1 = require("node:util");
-const prettier_1 = require("prettier");
 const yaml_1 = require("yaml");
 const index_js_1 = require("../../blueprints/index.js");
 const index_js_2 = require("../../api-contract/index.js");
 const index_js_3 = require("../../foundation/index.js");
-const index_js_4 = require("../../ownership/index.js");
+const index_js_4 = require("../../repository-policy/index.js");
+const index_js_5 = require("../../ownership/index.js");
 const function_js_1 = require("../function/function.js");
 const feature_registry_js_1 = require("../feature-registry.js");
 const generator_js_1 = require("../preset/generator.js");
@@ -26,12 +26,25 @@ const tool_versions_js_1 = require("../preset/tool-versions.js");
 const workspace_files_js_1 = require("../preset/workspace-files.js");
 const built_in_plan_js_1 = require("../slice/built-in-plan.js");
 const workload_js_1 = require("../workload/workload.js");
+const formatting_js_1 = require("../formatting.js");
 const git_inspection_js_1 = require("../../developer-agent/git-inspection.js");
 const context_js_1 = require("../../developer-agent/context.js");
 const model_js_1 = require("../../developer-agent/model.js");
 const preview_source_js_1 = require("../../developer-agent/preview-source.js");
 const preview_changes_js_1 = require("../../developer-agent/preview-changes.js");
 const validation_js_1 = require("../../developer-agent/validation.js");
+function readRepositoryDeploymentRenderingOptions(tree) {
+    const contents = tree.read(index_js_4.REPOSITORY_POLICY_FILE, 'utf8');
+    if (contents === null) {
+        throw new Error(`${index_js_4.REPOSITORY_POLICY_FILE} is required before upgrading profile-dependent workspace, Foundation, or built-in Product Slice files.`);
+    }
+    const policy = (0, index_js_4.parseRepositoryOperatingPolicy)(contents, index_js_4.REPOSITORY_POLICY_FILE);
+    return {
+        deploymentAccounts: policy.deploymentAccounts,
+        deploymentProfile: policy.deploymentProfile,
+        deploymentRegion: policy.deploymentRegion,
+    };
+}
 function requireTargetCompositionFeatures(files, ownership) {
     if (ownership.compositions.length === 0)
         return;
@@ -355,9 +368,29 @@ const SEEDED_RECONCILIATION = {
             'journey-authority',
         ],
     },
+    'secrets/declarations.ts': {
+        category: 'secret-contract',
+        implications: [
+            'generation-authority',
+            'secret-value-ownership',
+            'stage-requirements',
+        ],
+    },
+    'secrets/metadata.json': {
+        category: 'secret-contract',
+        implications: ['logical-identity', 'management-class', 'registry-schema'],
+    },
+    'secrets/workload-access.json': {
+        category: 'secret-contract',
+        implications: [
+            'logical-identity',
+            'runtime-secret-linkage',
+            'workload-iam',
+        ],
+    },
 };
 const SEEDED_RECONCILIATION_MARKER_REFERENCE = 'PLAN:5.6/seeded-upgrade-reconciliation';
-const SEEDED_RECONCILIATION_MARKER = '// EBK-TODO(PLAN:5.6/seeded-upgrade-reconciliation): Review retained seeded async, configuration, feature, frontend, performance, reliability, and release decisions against this framework upgrade before protected promotion.';
+const SEEDED_RECONCILIATION_MARKER = '// EBK-TODO(PLAN:5.6/seeded-upgrade-reconciliation): Review retained seeded async, configuration, feature, frontend, performance, reliability, release, and secret decisions against this framework upgrade before protected promotion.';
 const SEEDED_RECONCILIATION_MARKER_ANCHOR = 'async/recovery-adapters.ts';
 const DEVELOPER_AGENT_AGENTS_HEADING = '## Developer-Agent workflow';
 function developerAgentAgentsAppendix(renderedAgents) {
@@ -431,8 +464,8 @@ const COMPOSITION_REGIONS = [
     'workload-registrations',
     'function-registrations',
     'composition-outputs',
-    'workload-role-extensions',
-    'workload-role-intent-contributions',
+    'native-runtime-extensions',
+    'native-runtime-intent-contributions',
 ];
 function preserveCompositionRegions(current, target) {
     let merged = target;
@@ -457,29 +490,117 @@ function preserveCompositionRegions(current, target) {
     }
     return merged;
 }
-function reconcileFunctionRegistrationRouterArguments(source, ownership) {
+function countExact(source, value) {
+    return source.split(value).length - 1;
+}
+function escapeRegularExpression(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+}
+function exactIndentedStringCallMatches(source, callee, argument) {
+    const pattern = new RegExp(`^    ${escapeRegularExpression(callee)}\\(\\s*(['"])${escapeRegularExpression(argument)}\\1\\s*,?\\s*\\),[ \\t]*$`, 'gmu');
+    return [...source.matchAll(pattern)];
+}
+function reconcileFunctionRegistrationArguments(source, ownership) {
     let reconciled = source;
     for (const composition of ownership.compositions) {
         if (composition.kind !== 'function')
             continue;
         const { register } = (0, function_js_1.createFunctionFilePlan)('unused-workspace', ownership.slice, composition.name, composition.feature);
-        const previous = `  ${register}(\n    api,\n    foundation.discovery.alertTopicArn,`;
-        const current = `  ${register}(\n    api,\n    foundation.router,\n    foundation.discovery.alertTopicArn,`;
-        const previousCount = reconciled.split(previous).length - 1;
-        const currentCount = reconciled.split(current).length - 1;
-        if (previousCount === 1 && currentCount === 0) {
-            reconciled = reconciled.replace(previous, current);
-            continue;
+        const registrationStart = `  ${register}(\n`;
+        if (countExact(reconciled, registrationStart) !== 1) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
         }
-        if (previousCount === 0 && currentCount === 1)
-            continue;
-        throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        const start = reconciled.indexOf(registrationStart);
+        const registrationEnd = '\n  );';
+        const end = reconciled.indexOf(registrationEnd, start);
+        if (end < 0) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        }
+        let registration = reconciled.slice(start, end + registrationEnd.length);
+        if (registration.length > 64 * 1024) {
+            throw new Error(`Retained Function ${composition.name} registration exceeds its bounded managed shape.`);
+        }
+        const previousRouter = `\n    api,\n    foundation.discovery.alertTopicArn,`;
+        const currentRouter = `\n    api,\n    foundation.router,\n    foundation.discovery.alertTopicArn,`;
+        const previousRouterCount = countExact(registration, previousRouter);
+        const currentRouterCount = countExact(registration, currentRouter);
+        if (previousRouterCount === 1 && currentRouterCount === 0) {
+            registration = registration.replace(previousRouter, currentRouter);
+        }
+        else if (!(previousRouterCount === 0 && currentRouterCount === 1)) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        }
+        const previousAuthorityMatches = exactIndentedStringCallMatches(registration, 'workloadRoleBindings?.extension.function', composition.name);
+        const currentAuthorityMatches = exactIndentedStringCallMatches(registration, 'nativeAuthority.permissions', `${composition.name}-function`);
+        if (previousAuthorityMatches.length === 1 &&
+            currentAuthorityMatches.length === 0) {
+            const [previousAuthority] = previousAuthorityMatches;
+            const authorityIndex = previousAuthority.index;
+            if (authorityIndex === undefined) {
+                throw new Error(`Retained Function ${composition.name} registration authority is not position-bound.`);
+            }
+            const currentAuthority = `    nativeAuthority.permissions('${composition.name}-function'),`;
+            registration =
+                registration.slice(0, authorityIndex) +
+                    currentAuthority +
+                    registration.slice(authorityIndex + previousAuthority[0].length);
+        }
+        else if (!(previousAuthorityMatches.length === 0 &&
+            currentAuthorityMatches.length === 1)) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact native-authority argument shape.`);
+        }
+        reconciled =
+            reconciled.slice(0, start) +
+                registration +
+                reconciled.slice(end + registrationEnd.length);
     }
     return reconciled;
 }
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;
 }
+const DERIVED_API_ARTIFACT_PATHS = [
+    'api/generated/contract.json',
+    'api/generated/openapi.json',
+];
+function preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, targetFiles) {
+    const sourceEntry = currentOwnership.paths.find(({ path }) => path === 'api/contracts/protected.ts');
+    const source = tree.read(node_path_1.posix.join(root, 'api/contracts/protected.ts'), 'utf8');
+    if (sourceEntry?.mode !== 'seeded' || source === null)
+        return targetFiles;
+    const currentEntries = new Map(currentOwnership.paths.map((entry) => [entry.path, entry]));
+    const artifacts = DERIVED_API_ARTIFACT_PATHS.map((path) => ({
+        current: tree.read(node_path_1.posix.join(root, path), 'utf8'),
+        entry: currentEntries.get(path),
+        path,
+    }));
+    const missing = artifacts
+        .filter(({ current }) => current === null)
+        .map(({ path }) => path);
+    if (missing.length > 0) {
+        throw new Error(`Built-in Product Slice ${currentOwnership.slice} is missing derived managed API artifacts:\n${missing.map((path) => `- ${path}`).join('\n')}\nRun pnpm nx run ${currentOwnership.slice}:api-contract-generate before upgrading.`);
+    }
+    const completeCleanPair = artifacts.every(({ current, entry }) => current !== null &&
+        entry?.mode === 'managed' &&
+        entry.origin === 'blueprint' &&
+        entry.managedJsonPointers === undefined &&
+        (0, index_js_5.hashOwnedContent)(current, entry) === entry.sha256);
+    if (!completeCleanPair)
+        return targetFiles;
+    const retained = { ...targetFiles };
+    for (const { current, path } of artifacts) {
+        if (current === null) {
+            throw new Error(`Derived managed API artifact disappeared: ${path}.`);
+        }
+        // The built-in API artifacts are derived from the seeded TypeScript
+        // contract. An upgrade preserves that adopter-owned source, so rendering
+        // fresh artifacts from the uncustomized Blueprint would make the managed
+        // output disagree with its authority. The explicit api-contract-generate
+        // target remains the only operation that recompiles and restamps them.
+        retained[path] = current;
+    }
+    return retained;
+}
 function upgradeConflictMessage(label, report) {
     const ownershipDetails = [
         ...report.conflictingJsonMembers.map((member) => `- conflicting JSON ownership claim: ${member}`),
@@ -490,26 +611,19 @@ function upgradeConflictMessage(label, report) {
 function seededMigrationUpgradeMessage(label, report) {
     return `${label} upgrade cannot rewrite an existing seeded database migration:\n${report.incompatibleSeededMigrations.map((path) => `- ${path}`).join('\n')}\nRegenerate this prerelease workspace instead. Stable-v1 upgrades must add a new migration rather than rewrite migration history.`;
 }
-async function formatRenderedFiles(files, prefix = '') {
-    const canonicalApiArtifacts = new Set([
-        'api/generated/baseline.json',
-        'api/generated/contract.json',
-        'api/generated/openapi.json',
-    ]);
+async function formatRenderedFiles(tree, files, prefix = '') {
+    const changedOptions = (0, formatting_js_1.changedTreePrettierOptions)(tree);
     return Object.fromEntries(await Promise.all(Object.entries(files).map(async ([path, contents]) => {
         const workspacePath = node_path_1.posix.join(prefix, path);
-        if (canonicalApiArtifacts.has(path) ||
-            (0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(workspacePath) ||
-            path.startsWith('database/migrations/')) {
+        if ((0, built_in_plan_js_1.isBuiltInSliceFormatSensitivePath)(path) ||
+            (0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(workspacePath)) {
             return [path, contents];
         }
         try {
+            const options = await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, changedOptions);
             return [
                 path,
-                await (0, prettier_1.format)(contents, {
-                    filepath: workspacePath,
-                    singleQuote: true,
-                }),
+                await (0, formatting_js_1.formatTreeContentsToFixedPoint)(contents, options, workspacePath),
             ];
         }
         catch {
@@ -517,6 +631,12 @@ async function formatRenderedFiles(files, prefix = '') {
         }
     })));
 }
+async function formatOwnershipRecord(tree, path, label) {
+    if (!tree.exists(path)) {
+        throw new Error(`${label} ownership metadata is missing at ${path}.`);
+    }
+    await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, path);
+}
 function readJson(tree, path, label) {
     const contents = tree.read(path, 'utf8');
     if (contents === null)
@@ -618,7 +738,7 @@ function ownershipValidationMessage(label, issues) {
 }
 function requireUpgradePrerequisites(tree, target) {
     const installedVersion = (0, generator_js_1.frameworkPackageVersion)();
-    const workspaceResult = (0, index_js_4.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
+    const workspaceResult = (0, index_js_5.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
     if (!workspaceResult.valid) {
         throw new Error(ownershipValidationMessage('Workspace ownership metadata', workspaceResult.issues));
     }
@@ -627,7 +747,7 @@ function requireUpgradePrerequisites(tree, target) {
     }
     if (target === 'foundation')
         return;
-    const foundationResult = (0, index_js_4.validateFoundationOwnershipRecord)(readJson(tree, 'packages/foundation/.ebk/ownership.json', 'Standard Foundation ownership metadata'));
+    const foundationResult = (0, index_js_5.validateFoundationOwnershipRecord)(readJson(tree, 'packages/foundation/.ebk/ownership.json', 'Standard Foundation ownership metadata'));
     if (!foundationResult.valid) {
         throw new Error(ownershipValidationMessage('Standard Foundation ownership metadata', foundationResult.issues));
     }
@@ -764,7 +884,7 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
                     throw new Error(`Missing seeded reconciliation definition for ${path}.`);
                 }
                 report.seededReconciliation.push({
-                    adopterContentSha256: (0, index_js_4.hashOwnedContent)(current, currentEntry ?? targetEntry),
+                    adopterContentSha256: (0, index_js_5.hashOwnedContent)(current, currentEntry ?? targetEntry),
                     category: reconciliation.category,
                     currentFrameworkSha256: currentEntry?.sha256 ?? null,
                     implications: [...reconciliation.implications],
@@ -779,7 +899,7 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
             report.missing.push(path);
         }
         else if (currentEntry !== undefined &&
-            (0, index_js_4.hashOwnedContent)(current, currentEntry) !== currentEntry.sha256) {
+            (0, index_js_5.hashOwnedContent)(current, currentEntry) !== currentEntry.sha256) {
             report.conflicting.push(path);
         }
         else if (current === target) {
@@ -802,7 +922,7 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
         const current = currentFiles.get(path) ?? null;
         if (current === null)
             continue;
-        if ((0, index_js_4.hashOwnedContent)(current, entry) === sha256) {
+        if ((0, index_js_5.hashOwnedContent)(current, entry) === sha256) {
             report.obsolete.push(path);
         }
         else if (!report.conflicting.includes(path)) {
@@ -857,7 +977,7 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
         if (!targetEntry.managedJsonPointers)
             continue;
         if (currentEntry?.managedJsonPointers) {
-            const transition = (0, index_js_4.analyzeManagedJsonPointerTransition)(current, target, currentEntry.managedJsonPointers, targetEntry.managedJsonPointers);
+            const transition = (0, index_js_5.analyzeManagedJsonPointerTransition)(current, target, currentEntry.managedJsonPointers, targetEntry.managedJsonPointers);
             changes.claimedJsonMembers.push(...transition.claimed.map((pointer) => `${targetEntry.path}#${pointer}`));
             changes.conflictingJsonMembers.push(...transition.conflictingClaims.map((pointer) => `${targetEntry.path}#${pointer}`));
             changes.releasedJsonMembers.push(...transition.released.map((pointer) => `${targetEntry.path}#${pointer}`));
@@ -866,10 +986,26 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
                 continue;
             }
         }
-        files.set(targetEntry.path, (0, index_js_4.mergeManagedJsonContents)(current, target, targetEntry.managedJsonPointers));
+        files.set(targetEntry.path, (0, index_js_5.mergeManagedJsonContents)(current, target, targetEntry.managedJsonPointers));
     }
     return { files, ...changes };
 }
+async function formatMergedManagedJsonFiles(tree, root, merge, ownership) {
+    const files = new Map(merge.files);
+    const changedOptions = (0, formatting_js_1.changedTreePrettierOptions)(tree);
+    await Promise.all(ownership.paths.map(async (entry) => {
+        if (entry.mode !== 'managed' || !entry.managedJsonPointers)
+            return;
+        const contents = files.get(entry.path);
+        if (contents === undefined) {
+            throw new Error(`Target did not render managed JSON ${entry.path}.`);
+        }
+        const workspacePath = node_path_1.posix.join(root, entry.path);
+        const options = await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, changedOptions);
+        files.set(entry.path, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(contents, options, workspacePath));
+    }));
+    return { ...merge, files };
+}
 function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serviceAdapterOwner) {
     const compositionPaths = ownership.paths.filter(({ origin }) => origin === 'composition');
     const files = {};
@@ -888,7 +1024,7 @@ function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serv
                 mode: entry.mode ?? 'managed',
                 origin: 'composition',
                 path: entry.path,
-                sha256: (0, index_js_4.hashOwnedContent)(contents, entry),
+                sha256: (0, index_js_5.hashOwnedContent)(contents, entry),
             });
         }
     };
@@ -950,10 +1086,15 @@ function retainedServiceAdapterOwner(tree, root, ownership) {
     const serviceScenario = serviceScenarios[0];
     const secretAccess = readJson(tree, node_path_1.posix.join(root, 'secrets/workload-access.json'), 'Product Slice secret workload access registry');
     const bindings = record(secretAccess) ? secretAccess['bindings'] : undefined;
-    const logicalName = `${ownership.slice
+    const logicalName = 'GeneratedPerformanceLoadHmacKeys';
+    const prereleaseLogicalName = `${ownership.slice
         .split('-')
         .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
         .join('')}PerformanceLoadHmacKeys`;
+    if (Array.isArray(bindings) &&
+        bindings.some((binding) => record(binding) && binding['logicalName'] === prereleaseLogicalName)) {
+        throw new Error(`Product Slice ${ownership.slice} still uses the prerelease operator HMAC declaration ${prereleaseLogicalName}. Regenerate the prerelease Slice or reconcile secrets/declarations.ts, secrets/metadata.json, and secrets/workload-access.json to GeneratedPerformanceLoadHmacKeys under a reviewed adoption ledger entry before rerunning the upgrade; no automatic prerelease migration is provided.`);
+    }
     const protectedLoadBindings = Array.isArray(bindings)
         ? bindings.filter((binding) => record(binding) &&
             binding['logicalName'] === logicalName &&
@@ -1027,7 +1168,7 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         throw new Error('Standard Foundation upgrades do not accept Blueprint or input options.');
     }
     const root = 'packages/foundation';
-    const ownershipResult = (0, index_js_4.validateFoundationOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateFoundationOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Standard Foundation ownership metadata', ownershipResult.issues));
     }
@@ -1035,15 +1176,17 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         throw new Error('Workspace package.json must declare a name.');
     }
     const currentOwnership = ownershipResult.value;
+    const deployment = readRepositoryDeploymentRenderingOptions(tree);
     const renderedTarget = (0, workspace_files_js_1.renderFoundationFilePlan)({
+        ...deployment,
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
     const target = {
         ...renderedTarget,
-        files: await formatRenderedFiles(renderedTarget.files, root),
+        files: await formatRenderedFiles(tree, renderedTarget.files, root),
     };
-    const targetValidation = (0, index_js_4.validateFoundationOwnershipRecord)(target.ownership);
+    const targetValidation = (0, index_js_5.validateFoundationOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
         throw new Error(`Target Standard Foundation ownership metadata is invalid:\n${targetValidation.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1057,7 +1200,8 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         path,
         tree.read(node_path_1.posix.join(root, path), 'utf8'),
     ]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, root, mergedTarget, target.ownership);
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, target.ownership, mergedTarget);
     output.info(`[ebk-upgrade] foundation ${currentOwnership.frameworkVersion} -> ${target.ownership.frameworkVersion}\n${JSON.stringify(report, null, 2)}`);
     if (!options.apply)
@@ -1083,15 +1227,16 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         }
         tree.write(node_path_1.posix.join(root, path), contents);
     }
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
-    (0, index_js_4.restampFoundationOwnership)(tree);
+    (0, index_js_5.restampFoundationOwnership)(tree);
+    if (!options.skipFormat) {
+        await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation');
+    }
 }
 async function upgradeWorkspace(tree, options, packageJson, output) {
     if (options.blueprint !== undefined || options.inputs !== undefined) {
         throw new Error('Workspace upgrades do not accept Blueprint or input options.');
     }
-    const ownershipResult = (0, index_js_4.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Workspace ownership metadata', ownershipResult.issues));
     }
@@ -1100,15 +1245,17 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
     }
     const sstVersionState = inspectWorkspaceSstVersion(tree, packageJson);
     const currentOwnership = ownershipResult.value;
+    const deployment = readRepositoryDeploymentRenderingOptions(tree);
     const renderedTarget = (0, workspace_files_js_1.renderWorkspaceRootFilePlan)({
+        ...deployment,
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
     const target = {
         ...renderedTarget,
-        files: await formatRenderedFiles(renderedTarget.files),
+        files: await formatRenderedFiles(tree, renderedTarget.files),
     };
-    const targetValidation = (0, index_js_4.validateWorkspaceOwnershipRecord)(target.ownership);
+    const targetValidation = (0, index_js_5.validateWorkspaceOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
         throw new Error('Target workspace ownership metadata is invalid.');
     }
@@ -1117,7 +1264,8 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         ...target.ownership.paths.map(({ path }) => path),
     ]);
     const currentFiles = new Map([...allPaths].map((path) => [path, tree.read(path, 'utf8')]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, '', mergedTarget, target.ownership);
     const developerAgentInstructionAppend = planDeveloperAgentInstructionAppend(currentFiles.get('AGENTS.md') ?? null, target.files['AGENTS.md']);
     if (developerAgentInstructionAppend !== null) {
         mergedTarget.files.set(developerAgentInstructionAppend.path, developerAgentInstructionAppend.contents);
@@ -1160,17 +1308,13 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         }
         tree.write(path, contents);
     }
-    if (!options.skipFormat) {
-        await (0, devkit_1.formatFiles)(tree);
-        for (const [path, contents] of Object.entries(target.files)) {
-            if ((0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(path))
-                tree.write(path, contents);
-        }
-    }
     if (developerAgentInstructionAppend !== null) {
         tree.write(developerAgentInstructionAppend.path, developerAgentInstructionAppend.contents);
     }
-    (0, index_js_4.restampWorkspaceOwnership)(tree);
+    (0, index_js_5.restampWorkspaceOwnership)(tree);
+    if (!options.skipFormat) {
+        await formatOwnershipRecord(tree, '.ebk/ownership.json', 'Workspace');
+    }
 }
 async function executeUpgradeGenerator(tree, options, output = devkit_1.logger, executionOptions = {}) {
     const name = requireName(options.name);
@@ -1184,7 +1328,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     }
     requireUpgradePrerequisites(tree, 'product-slice');
     const root = node_path_1.posix.join('packages', name);
-    const ownershipResult = (0, index_js_4.validateGeneratedOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateGeneratedOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Product Slice ownership metadata', ownershipResult.issues));
     }
@@ -1228,10 +1372,11 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     let externalBlueprintDestinationPaths;
     const scope = workspaceScope(packageJson);
     if (blueprint.source === 'built-in') {
+        const deployment = readRepositoryDeploymentRenderingOptions(tree);
         const runtimeVersion = packageJson.dependencies?.['@empire-builder-kit/runtime'];
         if (!runtimeVersion)
             throw new Error('Workspace must depend on @empire-builder-kit/runtime.');
-        const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value);
+        const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value, undefined, deployment.deploymentProfile);
         targetFiles = Object.fromEntries(Object.entries(plan.files).map(([path, contents]) => {
             const current = tree.read(node_path_1.posix.join(root, path), 'utf8');
             return [
@@ -1295,7 +1440,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             mode,
             origin: 'blueprint',
             path,
-            sha256: (0, index_js_4.hashOwnedContent)(contents, { managedJsonPointers }),
+            sha256: (0, index_js_5.hashOwnedContent)(contents, { managedJsonPointers }),
         }));
         paths.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path));
         targetOwnership = {
@@ -1309,7 +1454,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             inputs: inputResult.value,
             paths,
             projects: generated.projects,
-            schemaVersion: index_js_4.GENERATED_OWNERSHIP_SCHEMA_VERSION,
+            schemaVersion: index_js_5.GENERATED_OWNERSHIP_SCHEMA_VERSION,
             slice: name,
             verification: blueprint.manifest.verification,
         };
@@ -1329,8 +1474,9 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         }
         targetFiles = {
             ...targetFiles,
-            [productPath]: reconcileFunctionRegistrationRouterArguments(productSource, currentOwnership),
+            [productPath]: reconcileFunctionRegistrationArguments(productSource, currentOwnership),
         };
+        targetFiles = preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, targetFiles);
     }
     const targetPathSet = new Set(targetOwnership.paths.map(({ path }) => path));
     const compositionPlan = renderCompositionUpgradePlan(currentOwnership, packageJson.name ?? '', packageJson.dependencies?.['@empire-builder-kit/runtime'] ?? '', serviceAdapterOwner);
@@ -1349,7 +1495,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         }
         targetFiles = { ...targetFiles, [entry.path]: contents };
     }
-    targetFiles = await formatRenderedFiles(targetFiles, root);
+    targetFiles = await formatRenderedFiles(tree, targetFiles, root);
     targetOwnership = {
         ...targetOwnership,
         compositions: currentOwnership.compositions,
@@ -1362,7 +1508,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             if (contents === undefined) {
                 throw new Error(`Target Blueprint did not render ${entry.path}.`);
             }
-            return { ...entry, sha256: (0, index_js_4.hashOwnedContent)(contents, entry) };
+            return { ...entry, sha256: (0, index_js_5.hashOwnedContent)(contents, entry) };
         }),
         projects: [
             ...new Set([...targetOwnership.projects, ...currentOwnership.projects]),
@@ -1372,7 +1518,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         ...targetFiles,
         '.ebk/ownership.json': json(targetOwnership),
     };
-    const targetValidation = (0, index_js_4.validateGeneratedOwnershipRecord)(targetOwnership);
+    const targetValidation = (0, index_js_5.validateGeneratedOwnershipRecord)(targetOwnership);
     if (!targetValidation.valid) {
         throw new Error(`Target ownership metadata is invalid:\n${targetValidation.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1386,7 +1532,8 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         path,
         tree.read(node_path_1.posix.join(root, path), 'utf8'),
     ]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(targetFiles)), targetOwnership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(targetFiles)), targetOwnership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, root, mergedTarget, targetOwnership);
     requireTargetCompositionFeatures(mergedTarget.files, targetOwnership);
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, targetOwnership, mergedTarget);
     output.info(`[ebk-upgrade] ${name} ${currentOwnership.blueprint.name}@${currentOwnership.blueprint.version} -> ${blueprint.manifest.name}@${blueprint.manifest.version}\n${JSON.stringify(report, null, 2)}`);
@@ -1419,10 +1566,18 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             [blueprint.manifest.name]: blueprint.manifest.version,
         };
         tree.write('package.json', json(packageJson));
+        if (!options.skipFormat) {
+            const path = 'package.json';
+            if (!tree.exists(path)) {
+                throw new Error('Workspace package.json disappeared during upgrade.');
+            }
+            await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, path);
+        }
+    }
+    (0, index_js_5.restampProductSliceOwnership)(tree, name, { preserveSeeded: true });
+    if (!options.skipFormat) {
+        await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice');
     }
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
-    (0, index_js_4.restampProductSliceOwnership)(tree, name, { preserveSeeded: true });
     return options.skipInstall
         ? undefined
         : () => (0, devkit_1.installPackagesTask)(tree, true);