@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/generators/upgrade/upgrade.d.ts

@@ -55,7 +55,7 @@ export interface UpgradeReport {
 }
 export interface SeededReconciliationWork {
     adopterContentSha256: string;
-    category: 'async-adapter' | 'async-settings' | 'configuration-contract' | 'configuration-values' | 'feature-controls' | 'frontend-contract' | 'frontend-security' | 'performance-aggregate-provider' | 'performance-policy' | 'reliability-operations' | 'reliability-slo' | 'release-controls';
+    category: 'async-adapter' | 'async-settings' | 'configuration-contract' | 'configuration-values' | 'feature-controls' | 'frontend-contract' | 'frontend-security' | 'performance-aggregate-provider' | 'performance-policy' | 'reliability-operations' | 'reliability-slo' | 'release-controls' | 'secret-contract';
     currentFrameworkSha256: string | null;
     implications: string[];
     markerReference: 'PLAN:5.6/seeded-upgrade-reconciliation';

package/src/generators/upgrade/upgrade.js

@@ -13,7 +13,6 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const node_util_1 = require("node:util");
-const prettier_1 = require("prettier");
 const yaml_1 = require("yaml");
 const index_js_1 = require("../../blueprints/index.js");
 const index_js_2 = require("../../api-contract/index.js");
@@ -26,12 +25,23 @@ const tool_versions_js_1 = require("../preset/tool-versions.js");
 const workspace_files_js_1 = require("../preset/workspace-files.js");
 const built_in_plan_js_1 = require("../slice/built-in-plan.js");
 const workload_js_1 = require("../workload/workload.js");
+const formatting_js_1 = require("../formatting.js");
 const git_inspection_js_1 = require("../../developer-agent/git-inspection.js");
 const context_js_1 = require("../../developer-agent/context.js");
 const model_js_1 = require("../../developer-agent/model.js");
 const preview_source_js_1 = require("../../developer-agent/preview-source.js");
 const preview_changes_js_1 = require("../../developer-agent/preview-changes.js");
 const validation_js_1 = require("../../developer-agent/validation.js");
+const tree_policy_js_1 = require("../repository-policy/tree-policy.js");
+function readRepositoryDeploymentRenderingOptions(tree) {
+    const policy = (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree);
+    return {
+        deploymentAccounts: policy.deploymentAccounts,
+        deploymentProfile: policy.deploymentProfile,
+        deploymentRegion: policy.deploymentRegion,
+        workspaceDeploymentId: policy.workspaceDeploymentId,
+    };
+}
 function requireTargetCompositionFeatures(files, ownership) {
     if (ownership.compositions.length === 0)
         return;
@@ -355,9 +365,29 @@ const SEEDED_RECONCILIATION = {
             'journey-authority',
         ],
     },
+    'secrets/declarations.ts': {
+        category: 'secret-contract',
+        implications: [
+            'generation-authority',
+            'secret-value-ownership',
+            'stage-requirements',
+        ],
+    },
+    'secrets/metadata.json': {
+        category: 'secret-contract',
+        implications: ['logical-identity', 'management-class', 'registry-schema'],
+    },
+    'secrets/workload-access.json': {
+        category: 'secret-contract',
+        implications: [
+            'logical-identity',
+            'runtime-secret-linkage',
+            'workload-iam',
+        ],
+    },
 };
 const SEEDED_RECONCILIATION_MARKER_REFERENCE = 'PLAN:5.6/seeded-upgrade-reconciliation';
-const SEEDED_RECONCILIATION_MARKER = '// EBK-TODO(PLAN:5.6/seeded-upgrade-reconciliation): Review retained seeded async, configuration, feature, frontend, performance, reliability, and release decisions against this framework upgrade before protected promotion.';
+const SEEDED_RECONCILIATION_MARKER = '// EBK-TODO(PLAN:5.6/seeded-upgrade-reconciliation): Review retained seeded async, configuration, feature, frontend, performance, reliability, release, and secret decisions against this framework upgrade before protected promotion.';
 const SEEDED_RECONCILIATION_MARKER_ANCHOR = 'async/recovery-adapters.ts';
 const DEVELOPER_AGENT_AGENTS_HEADING = '## Developer-Agent workflow';
 function developerAgentAgentsAppendix(renderedAgents) {
@@ -431,8 +461,8 @@ const COMPOSITION_REGIONS = [
     'workload-registrations',
     'function-registrations',
     'composition-outputs',
-    'workload-role-extensions',
-    'workload-role-intent-contributions',
+    'native-runtime-extensions',
+    'native-runtime-intent-contributions',
 ];
 function preserveCompositionRegions(current, target) {
     let merged = target;
@@ -457,29 +487,117 @@ function preserveCompositionRegions(current, target) {
     }
     return merged;
 }
-function reconcileFunctionRegistrationRouterArguments(source, ownership) {
+function countExact(source, value) {
+    return source.split(value).length - 1;
+}
+function escapeRegularExpression(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+}
+function exactIndentedStringCallMatches(source, callee, argument) {
+    const pattern = new RegExp(`^    ${escapeRegularExpression(callee)}\\(\\s*(['"])${escapeRegularExpression(argument)}\\1\\s*,?\\s*\\),[ \\t]*$`, 'gmu');
+    return [...source.matchAll(pattern)];
+}
+function reconcileFunctionRegistrationArguments(source, ownership) {
     let reconciled = source;
     for (const composition of ownership.compositions) {
         if (composition.kind !== 'function')
             continue;
         const { register } = (0, function_js_1.createFunctionFilePlan)('unused-workspace', ownership.slice, composition.name, composition.feature);
-        const previous = `  ${register}(\n    api,\n    foundation.discovery.alertTopicArn,`;
-        const current = `  ${register}(\n    api,\n    foundation.router,\n    foundation.discovery.alertTopicArn,`;
-        const previousCount = reconciled.split(previous).length - 1;
-        const currentCount = reconciled.split(current).length - 1;
-        if (previousCount === 1 && currentCount === 0) {
-            reconciled = reconciled.replace(previous, current);
-            continue;
+        const registrationStart = `  ${register}(\n`;
+        if (countExact(reconciled, registrationStart) !== 1) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
         }
-        if (previousCount === 0 && currentCount === 1)
-            continue;
-        throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        const start = reconciled.indexOf(registrationStart);
+        const registrationEnd = '\n  );';
+        const end = reconciled.indexOf(registrationEnd, start);
+        if (end < 0) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        }
+        let registration = reconciled.slice(start, end + registrationEnd.length);
+        if (registration.length > 64 * 1024) {
+            throw new Error(`Retained Function ${composition.name} registration exceeds its bounded managed shape.`);
+        }
+        const previousRouter = `\n    api,\n    foundation.discovery.alertTopicArn,`;
+        const currentRouter = `\n    api,\n    foundation.router,\n    foundation.discovery.alertTopicArn,`;
+        const previousRouterCount = countExact(registration, previousRouter);
+        const currentRouterCount = countExact(registration, currentRouter);
+        if (previousRouterCount === 1 && currentRouterCount === 0) {
+            registration = registration.replace(previousRouter, currentRouter);
+        }
+        else if (!(previousRouterCount === 0 && currentRouterCount === 1)) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        }
+        const previousAuthorityMatches = exactIndentedStringCallMatches(registration, 'workloadRoleBindings?.extension.function', composition.name);
+        const currentAuthorityMatches = exactIndentedStringCallMatches(registration, 'nativeAuthority.permissions', `${composition.name}-function`);
+        if (previousAuthorityMatches.length === 1 &&
+            currentAuthorityMatches.length === 0) {
+            const [previousAuthority] = previousAuthorityMatches;
+            const authorityIndex = previousAuthority.index;
+            if (authorityIndex === undefined) {
+                throw new Error(`Retained Function ${composition.name} registration authority is not position-bound.`);
+            }
+            const currentAuthority = `    nativeAuthority.permissions('${composition.name}-function'),`;
+            registration =
+                registration.slice(0, authorityIndex) +
+                    currentAuthority +
+                    registration.slice(authorityIndex + previousAuthority[0].length);
+        }
+        else if (!(previousAuthorityMatches.length === 0 &&
+            currentAuthorityMatches.length === 1)) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact native-authority argument shape.`);
+        }
+        reconciled =
+            reconciled.slice(0, start) +
+                registration +
+                reconciled.slice(end + registrationEnd.length);
     }
     return reconciled;
 }
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;
 }
+const DERIVED_API_ARTIFACT_PATHS = [
+    'api/generated/contract.json',
+    'api/generated/openapi.json',
+];
+function preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, targetFiles) {
+    const sourceEntry = currentOwnership.paths.find(({ path }) => path === 'api/contracts/protected.ts');
+    const source = tree.read(node_path_1.posix.join(root, 'api/contracts/protected.ts'), 'utf8');
+    if (sourceEntry?.mode !== 'seeded' || source === null)
+        return targetFiles;
+    const currentEntries = new Map(currentOwnership.paths.map((entry) => [entry.path, entry]));
+    const artifacts = DERIVED_API_ARTIFACT_PATHS.map((path) => ({
+        current: tree.read(node_path_1.posix.join(root, path), 'utf8'),
+        entry: currentEntries.get(path),
+        path,
+    }));
+    const missing = artifacts
+        .filter(({ current }) => current === null)
+        .map(({ path }) => path);
+    if (missing.length > 0) {
+        throw new Error(`Built-in Product Slice ${currentOwnership.slice} is missing derived managed API artifacts:\n${missing.map((path) => `- ${path}`).join('\n')}\nRun pnpm nx run ${currentOwnership.slice}:api-contract-generate before upgrading.`);
+    }
+    const completeCleanPair = artifacts.every(({ current, entry }) => current !== null &&
+        entry?.mode === 'managed' &&
+        entry.origin === 'blueprint' &&
+        entry.managedJsonPointers === undefined &&
+        (0, index_js_4.hashOwnedContent)(current, entry) === entry.sha256);
+    if (!completeCleanPair)
+        return targetFiles;
+    const retained = { ...targetFiles };
+    for (const { current, path } of artifacts) {
+        if (current === null) {
+            throw new Error(`Derived managed API artifact disappeared: ${path}.`);
+        }
+        // The built-in API artifacts are derived from the seeded TypeScript
+        // contract. An upgrade preserves that adopter-owned source, so rendering
+        // fresh artifacts from the uncustomized Blueprint would make the managed
+        // output disagree with its authority. The explicit api-contract-generate
+        // target remains the only operation that recompiles and restamps them.
+        retained[path] = current;
+    }
+    return retained;
+}
 function upgradeConflictMessage(label, report) {
     const ownershipDetails = [
         ...report.conflictingJsonMembers.map((member) => `- conflicting JSON ownership claim: ${member}`),
@@ -490,26 +608,19 @@ function upgradeConflictMessage(label, report) {
 function seededMigrationUpgradeMessage(label, report) {
     return `${label} upgrade cannot rewrite an existing seeded database migration:\n${report.incompatibleSeededMigrations.map((path) => `- ${path}`).join('\n')}\nRegenerate this prerelease workspace instead. Stable-v1 upgrades must add a new migration rather than rewrite migration history.`;
 }
-async function formatRenderedFiles(files, prefix = '') {
-    const canonicalApiArtifacts = new Set([
-        'api/generated/baseline.json',
-        'api/generated/contract.json',
-        'api/generated/openapi.json',
-    ]);
+async function formatRenderedFiles(tree, files, prefix = '') {
+    const changedOptions = (0, formatting_js_1.changedTreePrettierOptions)(tree);
     return Object.fromEntries(await Promise.all(Object.entries(files).map(async ([path, contents]) => {
         const workspacePath = node_path_1.posix.join(prefix, path);
-        if (canonicalApiArtifacts.has(path) ||
-            (0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(workspacePath) ||
-            path.startsWith('database/migrations/')) {
+        if ((0, built_in_plan_js_1.isBuiltInSliceFormatSensitivePath)(path) ||
+            (0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(workspacePath)) {
             return [path, contents];
         }
         try {
+            const options = await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, changedOptions);
             return [
                 path,
-                await (0, prettier_1.format)(contents, {
-                    filepath: workspacePath,
-                    singleQuote: true,
-                }),
+                await (0, formatting_js_1.formatTreeContentsToFixedPoint)(contents, options, workspacePath),
             ];
         }
         catch {
@@ -517,6 +628,12 @@ async function formatRenderedFiles(files, prefix = '') {
         }
     })));
 }
+async function formatOwnershipRecord(tree, path, label) {
+    if (!tree.exists(path)) {
+        throw new Error(`${label} ownership metadata is missing at ${path}.`);
+    }
+    await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, path);
+}
 function readJson(tree, path, label) {
     const contents = tree.read(path, 'utf8');
     if (contents === null)
@@ -870,6 +987,22 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
     }
     return { files, ...changes };
 }
+async function formatMergedManagedJsonFiles(tree, root, merge, ownership) {
+    const files = new Map(merge.files);
+    const changedOptions = (0, formatting_js_1.changedTreePrettierOptions)(tree);
+    await Promise.all(ownership.paths.map(async (entry) => {
+        if (entry.mode !== 'managed' || !entry.managedJsonPointers)
+            return;
+        const contents = files.get(entry.path);
+        if (contents === undefined) {
+            throw new Error(`Target did not render managed JSON ${entry.path}.`);
+        }
+        const workspacePath = node_path_1.posix.join(root, entry.path);
+        const options = await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, changedOptions);
+        files.set(entry.path, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(contents, options, workspacePath));
+    }));
+    return { ...merge, files };
+}
 function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serviceAdapterOwner) {
     const compositionPaths = ownership.paths.filter(({ origin }) => origin === 'composition');
     const files = {};
@@ -950,10 +1083,15 @@ function retainedServiceAdapterOwner(tree, root, ownership) {
     const serviceScenario = serviceScenarios[0];
     const secretAccess = readJson(tree, node_path_1.posix.join(root, 'secrets/workload-access.json'), 'Product Slice secret workload access registry');
     const bindings = record(secretAccess) ? secretAccess['bindings'] : undefined;
-    const logicalName = `${ownership.slice
+    const logicalName = 'GeneratedPerformanceLoadHmacKeys';
+    const prereleaseLogicalName = `${ownership.slice
         .split('-')
         .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
         .join('')}PerformanceLoadHmacKeys`;
+    if (Array.isArray(bindings) &&
+        bindings.some((binding) => record(binding) && binding['logicalName'] === prereleaseLogicalName)) {
+        throw new Error(`Product Slice ${ownership.slice} still uses the prerelease operator HMAC declaration ${prereleaseLogicalName}. Regenerate the prerelease Slice or reconcile secrets/declarations.ts, secrets/metadata.json, and secrets/workload-access.json to GeneratedPerformanceLoadHmacKeys under a reviewed adoption ledger entry before rerunning the upgrade; no automatic prerelease migration is provided.`);
+    }
     const protectedLoadBindings = Array.isArray(bindings)
         ? bindings.filter((binding) => record(binding) &&
             binding['logicalName'] === logicalName &&
@@ -1035,13 +1173,15 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         throw new Error('Workspace package.json must declare a name.');
     }
     const currentOwnership = ownershipResult.value;
+    const deployment = readRepositoryDeploymentRenderingOptions(tree);
     const renderedTarget = (0, workspace_files_js_1.renderFoundationFilePlan)({
+        ...deployment,
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
     const target = {
         ...renderedTarget,
-        files: await formatRenderedFiles(renderedTarget.files, root),
+        files: await formatRenderedFiles(tree, renderedTarget.files, root),
     };
     const targetValidation = (0, index_js_4.validateFoundationOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
@@ -1057,7 +1197,8 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         path,
         tree.read(node_path_1.posix.join(root, path), 'utf8'),
     ]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, root, mergedTarget, target.ownership);
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, target.ownership, mergedTarget);
     output.info(`[ebk-upgrade] foundation ${currentOwnership.frameworkVersion} -> ${target.ownership.frameworkVersion}\n${JSON.stringify(report, null, 2)}`);
     if (!options.apply)
@@ -1083,9 +1224,10 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         }
         tree.write(node_path_1.posix.join(root, path), contents);
     }
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
     (0, index_js_4.restampFoundationOwnership)(tree);
+    if (!options.skipFormat) {
+        await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation');
+    }
 }
 async function upgradeWorkspace(tree, options, packageJson, output) {
     if (options.blueprint !== undefined || options.inputs !== undefined) {
@@ -1100,13 +1242,15 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
     }
     const sstVersionState = inspectWorkspaceSstVersion(tree, packageJson);
     const currentOwnership = ownershipResult.value;
+    const deployment = readRepositoryDeploymentRenderingOptions(tree);
     const renderedTarget = (0, workspace_files_js_1.renderWorkspaceRootFilePlan)({
+        ...deployment,
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
     const target = {
         ...renderedTarget,
-        files: await formatRenderedFiles(renderedTarget.files),
+        files: await formatRenderedFiles(tree, renderedTarget.files),
     };
     const targetValidation = (0, index_js_4.validateWorkspaceOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
@@ -1117,7 +1261,8 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         ...target.ownership.paths.map(({ path }) => path),
     ]);
     const currentFiles = new Map([...allPaths].map((path) => [path, tree.read(path, 'utf8')]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, '', mergedTarget, target.ownership);
     const developerAgentInstructionAppend = planDeveloperAgentInstructionAppend(currentFiles.get('AGENTS.md') ?? null, target.files['AGENTS.md']);
     if (developerAgentInstructionAppend !== null) {
         mergedTarget.files.set(developerAgentInstructionAppend.path, developerAgentInstructionAppend.contents);
@@ -1160,17 +1305,13 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         }
         tree.write(path, contents);
     }
-    if (!options.skipFormat) {
-        await (0, devkit_1.formatFiles)(tree);
-        for (const [path, contents] of Object.entries(target.files)) {
-            if ((0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(path))
-                tree.write(path, contents);
-        }
-    }
     if (developerAgentInstructionAppend !== null) {
         tree.write(developerAgentInstructionAppend.path, developerAgentInstructionAppend.contents);
     }
     (0, index_js_4.restampWorkspaceOwnership)(tree);
+    if (!options.skipFormat) {
+        await formatOwnershipRecord(tree, '.ebk/ownership.json', 'Workspace');
+    }
 }
 async function executeUpgradeGenerator(tree, options, output = devkit_1.logger, executionOptions = {}) {
     const name = requireName(options.name);
@@ -1228,10 +1369,11 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     let externalBlueprintDestinationPaths;
     const scope = workspaceScope(packageJson);
     if (blueprint.source === 'built-in') {
+        const deployment = readRepositoryDeploymentRenderingOptions(tree);
         const runtimeVersion = packageJson.dependencies?.['@empire-builder-kit/runtime'];
         if (!runtimeVersion)
             throw new Error('Workspace must depend on @empire-builder-kit/runtime.');
-        const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value);
+        const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value, undefined, deployment.deploymentProfile);
         targetFiles = Object.fromEntries(Object.entries(plan.files).map(([path, contents]) => {
             const current = tree.read(node_path_1.posix.join(root, path), 'utf8');
             return [
@@ -1329,8 +1471,9 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         }
         targetFiles = {
             ...targetFiles,
-            [productPath]: reconcileFunctionRegistrationRouterArguments(productSource, currentOwnership),
+            [productPath]: reconcileFunctionRegistrationArguments(productSource, currentOwnership),
         };
+        targetFiles = preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, targetFiles);
     }
     const targetPathSet = new Set(targetOwnership.paths.map(({ path }) => path));
     const compositionPlan = renderCompositionUpgradePlan(currentOwnership, packageJson.name ?? '', packageJson.dependencies?.['@empire-builder-kit/runtime'] ?? '', serviceAdapterOwner);
@@ -1349,7 +1492,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         }
         targetFiles = { ...targetFiles, [entry.path]: contents };
     }
-    targetFiles = await formatRenderedFiles(targetFiles, root);
+    targetFiles = await formatRenderedFiles(tree, targetFiles, root);
     targetOwnership = {
         ...targetOwnership,
         compositions: currentOwnership.compositions,
@@ -1386,7 +1529,8 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         path,
         tree.read(node_path_1.posix.join(root, path), 'utf8'),
     ]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(targetFiles)), targetOwnership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(targetFiles)), targetOwnership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, root, mergedTarget, targetOwnership);
     requireTargetCompositionFeatures(mergedTarget.files, targetOwnership);
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, targetOwnership, mergedTarget);
     output.info(`[ebk-upgrade] ${name} ${currentOwnership.blueprint.name}@${currentOwnership.blueprint.version} -> ${blueprint.manifest.name}@${blueprint.manifest.version}\n${JSON.stringify(report, null, 2)}`);
@@ -1419,10 +1563,18 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             [blueprint.manifest.name]: blueprint.manifest.version,
         };
         tree.write('package.json', json(packageJson));
+        if (!options.skipFormat) {
+            const path = 'package.json';
+            if (!tree.exists(path)) {
+                throw new Error('Workspace package.json disappeared during upgrade.');
+            }
+            await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, path);
+        }
     }
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
     (0, index_js_4.restampProductSliceOwnership)(tree, name, { preserveSeeded: true });
+    if (!options.skipFormat) {
+        await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice');
+    }
     return options.skipInstall
         ? undefined
         : () => (0, devkit_1.installPackagesTask)(tree, true);