@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/upgrade/upgrade.js

@@ -3,35 +3,57 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeveloperAgentUpgradePreviewBindingError = void 0;
 exports.developerAgentUpgradeExecutionOptions = developerAgentUpgradeExecutionOptions;
 exports.preserveCompositionRegions = preserveCompositionRegions;
+exports.reemitRecordedNativeRuntimeCompositions = reemitRecordedNativeRuntimeCompositions;
 exports.inspectWorkspaceSstVersion = inspectWorkspaceSstVersion;
 exports.createUpgradeReport = createUpgradeReport;
+exports.upgradeFoundationForRequirements = upgradeFoundationForRequirements;
 exports.upgradeGenerator = upgradeGenerator;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
+const capacity_migration_js_1 = require("../../repository-policy/capacity-migration.js");
+const dependency_overrides_js_1 = require("../preset/dependency-overrides.js");
+const workspace_files_adopter_skills_js_1 = require("../preset/workspace-files-adopter-skills.js");
+const sql_seeded_reconciliation_js_1 = require("./sql-seeded-reconciliation.js");
 const devkit_1 = require("@nx/devkit");
 const node_buffer_1 = require("node:buffer");
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const node_util_1 = require("node:util");
-const prettier_1 = require("prettier");
 const yaml_1 = require("yaml");
 const index_js_1 = require("../../blueprints/index.js");
 const index_js_2 = require("../../api-contract/index.js");
 const index_js_3 = require("../../foundation/index.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const persistence_contract_js_1 = require("../slice/persistence-contract.js");
 const index_js_4 = require("../../ownership/index.js");
 const function_js_1 = require("../function/function.js");
+const logging_registry_js_1 = require("../logging-registry.js");
 const feature_registry_js_1 = require("../feature-registry.js");
 const generator_js_1 = require("../preset/generator.js");
 const tool_versions_js_1 = require("../preset/tool-versions.js");
 const workspace_files_js_1 = require("../preset/workspace-files.js");
 const built_in_plan_js_1 = require("../slice/built-in-plan.js");
+const data_policy_review_seed_js_1 = require("../slice/data-policy-review-seed.js");
 const workload_js_1 = require("../workload/workload.js");
+const formatting_js_1 = require("../formatting.js");
 const git_inspection_js_1 = require("../../developer-agent/git-inspection.js");
 const context_js_1 = require("../../developer-agent/context.js");
 const model_js_1 = require("../../developer-agent/model.js");
 const preview_source_js_1 = require("../../developer-agent/preview-source.js");
 const preview_changes_js_1 = require("../../developer-agent/preview-changes.js");
 const validation_js_1 = require("../../developer-agent/validation.js");
+const tree_policy_js_1 = require("../repository-policy/tree-policy.js");
+function readRepositoryDeploymentRenderingOptions(tree) {
+    const policy = (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree);
+    return {
+        ...(policy.deliveryLane ? { deliveryLane: policy.deliveryLane } : {}),
+        deploymentAccounts: policy.deploymentAccounts,
+        deploymentProfile: policy.deploymentProfile,
+        deploymentRegion: policy.deploymentRegion,
+        productionApprovalMode: policy.productionApproval.mode,
+        workspaceDeploymentId: policy.workspaceDeploymentId,
+    };
+}
 function requireTargetCompositionFeatures(files, ownership) {
     if (ownership.compositions.length === 0)
         return;
@@ -327,8 +349,11 @@ const SEEDED_RECONCILIATION = {
         category: 'reliability-operations',
         implications: [
             'alarm-registration',
+            'database-capacity-dynamodb-table-and-pending-events-throttle-metrics',
             'diagnostic-authority',
+            'event-delivery-alarms-and-hourly-outbox-backlog-period',
             'incident-remediation',
+            'performance-load-cleanup-backlog-two-evaluation-periods',
         ],
     },
     'operations/release.json': {
@@ -355,9 +380,29 @@ const SEEDED_RECONCILIATION = {
             'journey-authority',
         ],
     },
+    'secrets/declarations.ts': {
+        category: 'secret-contract',
+        implications: [
+            'generation-authority',
+            'secret-value-ownership',
+            'stage-requirements',
+        ],
+    },
+    'secrets/metadata.json': {
+        category: 'secret-contract',
+        implications: ['logical-identity', 'management-class', 'registry-schema'],
+    },
+    'secrets/workload-access.json': {
+        category: 'secret-contract',
+        implications: [
+            'logical-identity',
+            'runtime-secret-linkage',
+            'workload-iam',
+        ],
+    },
 };
 const SEEDED_RECONCILIATION_MARKER_REFERENCE = 'PLAN:5.6/seeded-upgrade-reconciliation';
-const SEEDED_RECONCILIATION_MARKER = '// EBK-TODO(PLAN:5.6/seeded-upgrade-reconciliation): Review retained seeded async, configuration, feature, frontend, performance, reliability, and release decisions against this framework upgrade before protected promotion.';
+const SEEDED_RECONCILIATION_MARKER = '// EBK-TODO(PLAN:5.6/seeded-upgrade-reconciliation): Review retained seeded async, configuration, feature, frontend, performance, reliability, release, and secret decisions against this framework upgrade before protected promotion.';
 const SEEDED_RECONCILIATION_MARKER_ANCHOR = 'async/recovery-adapters.ts';
 const DEVELOPER_AGENT_AGENTS_HEADING = '## Developer-Agent workflow';
 function developerAgentAgentsAppendix(renderedAgents) {
@@ -372,11 +417,18 @@ function developerAgentAgentsAppendix(renderedAgents) {
     return renderedAgents.slice(start + 1);
 }
 function planDeveloperAgentInstructionAppend(currentAgents, targetAgents) {
-    if (currentAgents === null ||
-        new RegExp(`(?:^|\\r?\\n)${DEVELOPER_AGENT_AGENTS_HEADING}(?:\\r?\\n|$)`).test(currentAgents)) {
+    if (currentAgents === null)
         return null;
+    const additions = [];
+    if (!/(?:^|\r?\n)## Bundled adopter skills(?:\r?\n|$)/u.test(currentAgents)) {
+        additions.push((0, workspace_files_adopter_skills_js_1.renderAdopterSkillIndex)());
+    }
+    if (!new RegExp(`(?:^|\\r?\\n)${DEVELOPER_AGENT_AGENTS_HEADING}(?:\\r?\\n|$)`).test(currentAgents)) {
+        additions.push(developerAgentAgentsAppendix(targetAgents));
     }
-    const appendix = developerAgentAgentsAppendix(targetAgents);
+    if (additions.length === 0)
+        return null;
+    const appendix = additions.join('\n');
     const separator = currentAgents.length === 0
         ? ''
         : currentAgents.endsWith('\n\n')
@@ -431,8 +483,8 @@ const COMPOSITION_REGIONS = [
     'workload-registrations',
     'function-registrations',
     'composition-outputs',
-    'workload-role-extensions',
-    'workload-role-intent-contributions',
+    'native-runtime-extensions',
+    'native-runtime-intent-contributions',
 ];
 function preserveCompositionRegions(current, target) {
     let merged = target;
@@ -457,9 +509,181 @@ function preserveCompositionRegions(current, target) {
     }
     return merged;
 }
+function countExact(source, value) {
+    return source.split(value).length - 1;
+}
+function escapeRegularExpression(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+}
+function quotedLiteral(value, group) {
+    return `(['"])${escapeRegularExpression(value)}\\${group}`;
+}
+const NATIVE_RUNTIME_COMPOSITION_REGIONS = [
+    {
+        isPresent: (body, { kind, name }) => new RegExp(`\\{\\s*id:\\s*${quotedLiteral(name, 1)}\\s*,\\s*kind:\\s*${quotedLiteral(kind, 2)}\\s*,?\\s*\\}`, 'u').test(body),
+        path: 'infra/native-runtime-authority/topology.ts',
+        region: 'native-runtime-extensions',
+        render: ({ kind, name }) => `  { id: '${name}', kind: '${kind}' },`,
+    },
+    {
+        isPresent: (body, { kind, name }) => new RegExp(`extensionWorkloadRoleIntentContributions\\(\\s*context\\s*,\\s*topology\\s*,\\s*${quotedLiteral(name, 1)}\\s*,\\s*${quotedLiteral(kind, 2)}\\s*,?\\s*\\)`, 'u').test(body),
+        path: 'infra/native-runtime-authority/effective-intent.ts',
+        region: 'native-runtime-intent-contributions',
+        render: ({ kind, name }) => `    ...extensionWorkloadRoleIntentContributions(\n      context,\n      topology,\n      '${name}',\n      '${kind}',\n    ),`,
+    },
+];
+/**
+ * Re-emits every recorded composition into the managed native runtime
+ * authority regions of a regenerated Product Slice. Region preservation only
+ * carries a body when the current file exposes the same-named markers, so a
+ * Slice whose compositions predate the native-runtime-authority region names
+ * (or whose regions were emptied by an earlier managed upgrade) would
+ * otherwise lose the recorded workload authority. The recorded compositions in
+ * `.ebk/ownership.json` are the source of truth; compositions already present
+ * in a region are left untouched so a second apply is byte-stable.
+ * (EBK-INT-2026-070)
+ */
+function reemitRecordedNativeRuntimeCompositions(files, ownership) {
+    if (ownership.compositions.length === 0)
+        return files;
+    let result = files;
+    for (const target of NATIVE_RUNTIME_COMPOSITION_REGIONS) {
+        const source = files[target.path];
+        if (source === undefined) {
+            throw new Error(`Target Product Slice does not render ${target.path}.`);
+        }
+        const start = `// <ebk:${target.region}:start>`;
+        const end = `// <ebk:${target.region}:end>`;
+        let lines = source.split('\n');
+        for (const composition of ownership.compositions) {
+            const startIndex = lines.findIndex((line) => line.trim() === start);
+            const endIndex = lines.findIndex((line) => line.trim() === end);
+            if (startIndex < 0 ||
+                endIndex < startIndex ||
+                countExact(source, start) !== 1 ||
+                countExact(source, end) !== 1) {
+                throw new Error(`Target ${target.path} does not expose one exact ${target.region} region to re-emit recorded composition ${composition.kind} ${composition.name}.`);
+            }
+            const body = lines.slice(startIndex + 1, endIndex).join('\n');
+            if (target.isPresent(body, composition))
+                continue;
+            lines = [
+                ...lines.slice(0, endIndex),
+                ...target.render(composition).split('\n'),
+                ...lines.slice(endIndex),
+            ];
+        }
+        const merged = lines.join('\n');
+        if (merged !== source)
+            result = { ...result, [target.path]: merged };
+    }
+    return result;
+}
+function exactIndentedStringCallMatches(source, callee, argument) {
+    const pattern = new RegExp(`^    ${escapeRegularExpression(callee)}\\(\\s*(['"])${escapeRegularExpression(argument)}\\1\\s*,?\\s*\\),[ \\t]*$`, 'gmu');
+    return [...source.matchAll(pattern)];
+}
+function reconcileFunctionRegistrationArguments(source, ownership) {
+    let reconciled = source;
+    for (const composition of ownership.compositions) {
+        if (composition.kind !== 'function')
+            continue;
+        const { register } = (0, function_js_1.createFunctionFilePlan)('unused-workspace', ownership.slice, composition.name, composition.feature);
+        const registrationStart = `  ${register}(\n`;
+        if (countExact(reconciled, registrationStart) !== 1) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        }
+        const start = reconciled.indexOf(registrationStart);
+        const registrationEnd = '\n  );';
+        const end = reconciled.indexOf(registrationEnd, start);
+        if (end < 0) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        }
+        let registration = reconciled.slice(start, end + registrationEnd.length);
+        if (registration.length > 64 * 1024) {
+            throw new Error(`Retained Function ${composition.name} registration exceeds its bounded managed shape.`);
+        }
+        const previousRouter = `\n    api,\n    foundation.discovery.alertTopicArn,`;
+        const currentRouter = `\n    api,\n    foundation.router,\n    foundation.discovery.alertTopicArn,`;
+        const previousRouterCount = countExact(registration, previousRouter);
+        const currentRouterCount = countExact(registration, currentRouter);
+        if (previousRouterCount === 1 && currentRouterCount === 0) {
+            registration = registration.replace(previousRouter, currentRouter);
+        }
+        else if (!(previousRouterCount === 0 && currentRouterCount === 1)) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact Router argument shape.`);
+        }
+        const previousAuthorityMatches = exactIndentedStringCallMatches(registration, 'workloadRoleBindings?.extension.function', composition.name);
+        const currentAuthorityMatches = exactIndentedStringCallMatches(registration, 'nativeAuthority.permissions', `${composition.name}-function`);
+        if (previousAuthorityMatches.length === 1 &&
+            currentAuthorityMatches.length === 0) {
+            const [previousAuthority] = previousAuthorityMatches;
+            const authorityIndex = previousAuthority.index;
+            if (authorityIndex === undefined) {
+                throw new Error(`Retained Function ${composition.name} registration authority is not position-bound.`);
+            }
+            const currentAuthority = `    nativeAuthority.permissions('${composition.name}-function'),`;
+            registration =
+                registration.slice(0, authorityIndex) +
+                    currentAuthority +
+                    registration.slice(authorityIndex + previousAuthority[0].length);
+        }
+        else if (!(previousAuthorityMatches.length === 0 &&
+            currentAuthorityMatches.length === 1)) {
+            throw new Error(`Retained Function ${composition.name} registration does not expose one exact native-authority argument shape.`);
+        }
+        reconciled =
+            reconciled.slice(0, start) +
+                registration +
+                reconciled.slice(end + registrationEnd.length);
+    }
+    return reconciled;
+}
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;
 }
+const DERIVED_API_ARTIFACT_PATHS = [
+    'api/generated/contract.json',
+    'api/generated/openapi.json',
+];
+function preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, targetFiles) {
+    const sourceEntry = currentOwnership.paths.find(({ path }) => path === 'api/contracts/protected.ts');
+    const source = tree.read(node_path_1.posix.join(root, 'api/contracts/protected.ts'), 'utf8');
+    if (sourceEntry?.mode !== 'seeded' || source === null)
+        return targetFiles;
+    const currentEntries = new Map(currentOwnership.paths.map((entry) => [entry.path, entry]));
+    const artifacts = DERIVED_API_ARTIFACT_PATHS.map((path) => ({
+        current: tree.read(node_path_1.posix.join(root, path), 'utf8'),
+        entry: currentEntries.get(path),
+        path,
+    }));
+    const missing = artifacts
+        .filter(({ current }) => current === null)
+        .map(({ path }) => path);
+    if (missing.length > 0) {
+        throw new Error(`Built-in Product Slice ${currentOwnership.slice} is missing derived managed API artifacts:\n${missing.map((path) => `- ${path}`).join('\n')}\nRun pnpm nx run ${currentOwnership.slice}:api-contract-generate before upgrading.`);
+    }
+    const completeCleanPair = artifacts.every(({ current, entry }) => current !== null &&
+        entry?.mode === 'managed' &&
+        entry.origin === 'blueprint' &&
+        entry.managedJsonPointers === undefined &&
+        (0, index_js_4.hashOwnedContent)(current, entry) === entry.sha256);
+    if (!completeCleanPair)
+        return targetFiles;
+    const retained = { ...targetFiles };
+    for (const { current, path } of artifacts) {
+        if (current === null) {
+            throw new Error(`Derived managed API artifact disappeared: ${path}.`);
+        }
+        // The built-in API artifacts are derived from the seeded TypeScript
+        // contract. An upgrade preserves that adopter-owned source, so rendering
+        // fresh artifacts from the uncustomized Blueprint would make the managed
+        // output disagree with its authority. The explicit api-contract-generate
+        // target remains the only operation that recompiles and restamps them.
+        retained[path] = current;
+    }
+    return retained;
+}
 function upgradeConflictMessage(label, report) {
     const ownershipDetails = [
         ...report.conflictingJsonMembers.map((member) => `- conflicting JSON ownership claim: ${member}`),
@@ -470,26 +694,19 @@ function upgradeConflictMessage(label, report) {
 function seededMigrationUpgradeMessage(label, report) {
     return `${label} upgrade cannot rewrite an existing seeded database migration:\n${report.incompatibleSeededMigrations.map((path) => `- ${path}`).join('\n')}\nRegenerate this prerelease workspace instead. Stable-v1 upgrades must add a new migration rather than rewrite migration history.`;
 }
-async function formatRenderedFiles(files, prefix = '') {
-    const canonicalApiArtifacts = new Set([
-        'api/generated/baseline.json',
-        'api/generated/contract.json',
-        'api/generated/openapi.json',
-    ]);
+async function formatRenderedFiles(tree, files, prefix = '') {
+    const changedOptions = (0, formatting_js_1.changedTreePrettierOptions)(tree);
     return Object.fromEntries(await Promise.all(Object.entries(files).map(async ([path, contents]) => {
         const workspacePath = node_path_1.posix.join(prefix, path);
-        if (canonicalApiArtifacts.has(path) ||
-            (0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(workspacePath) ||
-            path.startsWith('database/migrations/')) {
+        if ((0, built_in_plan_js_1.isBuiltInSliceFormatSensitivePath)(path) ||
+            (0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(workspacePath)) {
             return [path, contents];
         }
         try {
+            const options = await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, changedOptions);
             return [
                 path,
-                await (0, prettier_1.format)(contents, {
-                    filepath: workspacePath,
-                    singleQuote: true,
-                }),
+                await (0, formatting_js_1.formatTreeContentsToFixedPoint)(contents, options, workspacePath),
             ];
         }
         catch {
@@ -497,6 +714,12 @@ async function formatRenderedFiles(files, prefix = '') {
         }
     })));
 }
+async function formatOwnershipRecord(tree, path, label) {
+    if (!tree.exists(path)) {
+        throw new Error(`${label} ownership metadata is missing at ${path}.`);
+    }
+    await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, path);
+}
 function readJson(tree, path, label) {
     const contents = tree.read(path, 'utf8');
     if (contents === null)
@@ -821,6 +1044,10 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
         const target = files.get(targetEntry.path);
         if (current === null || target === undefined)
             continue;
+        if (targetEntry.mode === 'seeded') {
+            files.set(targetEntry.path, current);
+            continue;
+        }
         if (currentEntry?.managedJsonPointers && !targetEntry.managedJsonPointers) {
             if (targetEntry.mode === 'managed') {
                 changes.expandedJsonOwnership.push(targetEntry.path);
@@ -846,6 +1073,22 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
     }
     return { files, ...changes };
 }
+async function formatMergedManagedJsonFiles(tree, root, merge, ownership) {
+    const files = new Map(merge.files);
+    const changedOptions = (0, formatting_js_1.changedTreePrettierOptions)(tree);
+    await Promise.all(ownership.paths.map(async (entry) => {
+        if (entry.mode !== 'managed' || !entry.managedJsonPointers)
+            return;
+        const contents = files.get(entry.path);
+        if (contents === undefined) {
+            throw new Error(`Target did not render managed JSON ${entry.path}.`);
+        }
+        const workspacePath = node_path_1.posix.join(root, entry.path);
+        const options = await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, changedOptions);
+        files.set(entry.path, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(contents, options, workspacePath));
+    }));
+    return { ...merge, files };
+}
 function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serviceAdapterOwner) {
     const compositionPaths = ownership.paths.filter(({ origin }) => origin === 'composition');
     const files = {};
@@ -926,10 +1169,15 @@ function retainedServiceAdapterOwner(tree, root, ownership) {
     const serviceScenario = serviceScenarios[0];
     const secretAccess = readJson(tree, node_path_1.posix.join(root, 'secrets/workload-access.json'), 'Product Slice secret workload access registry');
     const bindings = record(secretAccess) ? secretAccess['bindings'] : undefined;
-    const logicalName = `${ownership.slice
+    const logicalName = 'GeneratedPerformanceLoadHmacKeys';
+    const prereleaseLogicalName = `${ownership.slice
         .split('-')
         .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
         .join('')}PerformanceLoadHmacKeys`;
+    if (Array.isArray(bindings) &&
+        bindings.some((binding) => record(binding) && binding['logicalName'] === prereleaseLogicalName)) {
+        throw new Error(`Product Slice ${ownership.slice} still uses the prerelease operator HMAC declaration ${prereleaseLogicalName}. Regenerate the prerelease Slice or reconcile secrets/declarations.ts, secrets/metadata.json, and secrets/workload-access.json to GeneratedPerformanceLoadHmacKeys under a reviewed adoption ledger entry before rerunning the upgrade; no automatic prerelease migration is provided.`);
+    }
     const protectedLoadBindings = Array.isArray(bindings)
         ? bindings.filter((binding) => record(binding) &&
             binding['logicalName'] === logicalName &&
@@ -998,7 +1246,7 @@ function carryRetainedServiceAdapterAuthority(targetFiles, owner) {
         'managed-generated-service-runtime-endpoint';
     return { ...targetFiles, [path]: json(target) };
 }
-async function upgradeFoundation(tree, options, packageJson, output) {
+async function upgradeFoundation(tree, options, packageJson, output, foundationRequirements = []) {
     if (options.blueprint !== undefined || options.inputs !== undefined) {
         throw new Error('Standard Foundation upgrades do not accept Blueprint or input options.');
     }
@@ -1011,13 +1259,17 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         throw new Error('Workspace package.json must declare a name.');
     }
     const currentOwnership = ownershipResult.value;
+    const deployment = readRepositoryDeploymentRenderingOptions(tree);
     const renderedTarget = (0, workspace_files_js_1.renderFoundationFilePlan)({
+        ...deployment,
+        foundationRequirements,
+        foundationDescriptor: readJson(tree, node_path_1.posix.join(root, 'contracts/foundation.json'), 'Existing Foundation resource declaration'),
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
     const target = {
         ...renderedTarget,
-        files: await formatRenderedFiles(renderedTarget.files, root),
+        files: await formatRenderedFiles(tree, renderedTarget.files, root),
     };
     const targetValidation = (0, index_js_4.validateFoundationOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
@@ -1033,7 +1285,8 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         path,
         tree.read(node_path_1.posix.join(root, path), 'utf8'),
     ]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, root, mergedTarget, target.ownership);
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, target.ownership, mergedTarget);
     output.info(`[ebk-upgrade] foundation ${currentOwnership.frameworkVersion} -> ${target.ownership.frameworkVersion}\n${JSON.stringify(report, null, 2)}`);
     if (!options.apply)
@@ -1059,9 +1312,28 @@ async function upgradeFoundation(tree, options, packageJson, output) {
         }
         tree.write(node_path_1.posix.join(root, path), contents);
     }
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
     (0, index_js_4.restampFoundationOwnership)(tree);
+    // Ownership bytes are part of the upgrade result, including agent previews
+    // that skip workspace formatting. Canonicalize before binding those bytes.
+    await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation');
+}
+/** Internal paired-generation path: the ordinary ownership-preserving upgrader owns Foundation writes. */
+async function upgradeFoundationForRequirements(tree, requirements, apply, output = devkit_1.logger) {
+    requireUpgradePrerequisites(tree, 'product-slice');
+    const capabilityPlan = (0, capability_plan_js_1.planFoundationCapabilities)({
+        current: readJson(tree, 'packages/foundation/contracts/foundation.json', 'Standard Foundation descriptor'),
+        requirements,
+    });
+    if (capabilityPlan.migratedFromContract !== null)
+        throw new Error('Paired generation cannot migrate a prerelease Foundation contract. Report and apply the explicit Foundation upgrade first; no files changed.');
+    // A Slice generator is not an implicit Foundation version/formatting upgrade.
+    if (capabilityPlan.added.length === 0)
+        return;
+    const policy = (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree);
+    if (tree.exists('packages/foundation/contracts/costs.json'))
+        (0, capacity_migration_js_1.assertCapacityMigrationChoice)(policy.productionFoundation.profile, readJson(tree, 'packages/foundation/contracts/costs.json', 'Foundation cost contract'));
+    const packageJson = readJson(tree, 'package.json', 'Workspace package.json');
+    await upgradeFoundation(tree, { name: 'foundation', apply, skipFormat: true, skipInstall: true }, packageJson, output, requirements);
 }
 async function upgradeWorkspace(tree, options, packageJson, output) {
     if (options.blueprint !== undefined || options.inputs !== undefined) {
@@ -1076,13 +1348,18 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
     }
     const sstVersionState = inspectWorkspaceSstVersion(tree, packageJson);
     const currentOwnership = ownershipResult.value;
+    const deployment = readRepositoryDeploymentRenderingOptions(tree);
     const renderedTarget = (0, workspace_files_js_1.renderWorkspaceRootFilePlan)({
+        ...deployment,
+        dependencyOverrides: tree.exists(dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH)
+            ? readJson(tree, dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH, 'Dependency overrides')
+            : undefined,
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
     const target = {
         ...renderedTarget,
-        files: await formatRenderedFiles(renderedTarget.files),
+        files: await formatRenderedFiles(tree, renderedTarget.files),
     };
     const targetValidation = (0, index_js_4.validateWorkspaceOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
@@ -1093,7 +1370,8 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         ...target.ownership.paths.map(({ path }) => path),
     ]);
     const currentFiles = new Map([...allPaths].map((path) => [path, tree.read(path, 'utf8')]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(target.files)), target.ownership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, '', mergedTarget, target.ownership);
     const developerAgentInstructionAppend = planDeveloperAgentInstructionAppend(currentFiles.get('AGENTS.md') ?? null, target.files['AGENTS.md']);
     if (developerAgentInstructionAppend !== null) {
         mergedTarget.files.set(developerAgentInstructionAppend.path, developerAgentInstructionAppend.contents);
@@ -1136,26 +1414,50 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         }
         tree.write(path, contents);
     }
-    if (!options.skipFormat) {
-        await (0, devkit_1.formatFiles)(tree);
-        for (const [path, contents] of Object.entries(target.files)) {
-            if ((0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(path))
-                tree.write(path, contents);
-        }
-    }
     if (developerAgentInstructionAppend !== null) {
         tree.write(developerAgentInstructionAppend.path, developerAgentInstructionAppend.contents);
     }
     (0, index_js_4.restampWorkspaceOwnership)(tree);
+    await formatOwnershipRecord(tree, '.ebk/ownership.json', 'Workspace');
 }
 async function executeUpgradeGenerator(tree, options, output = devkit_1.logger, executionOptions = {}) {
     const name = requireName(options.name);
+    // The policy is seeded: never reinterpret an existing warm production choice
+    // as permission to pause it. The operator must make the rename explicitly.
+    const costsPath = 'packages/foundation/contracts/costs.json';
+    if (tree.exists(costsPath)) {
+        (0, capacity_migration_js_1.assertCapacityMigrationChoice)((0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree).productionFoundation.profile, readJson(tree, costsPath, 'Foundation cost contract'));
+    }
     const packageJson = readJson(tree, 'package.json', 'Workspace package.json');
     if (name === 'workspace') {
         return upgradeWorkspace(tree, options, packageJson, output);
     }
     if (name === 'foundation') {
         requireUpgradePrerequisites(tree, 'foundation');
+        // Refuse an unsupported core transition before changing shared contracts.
+        // This is a preflight, not a prerelease migration or compatibility layer.
+        for (const slice of tree.children('packages')) {
+            const root = node_path_1.posix.join('packages', slice);
+            const path = node_path_1.posix.join(root, '.ebk/ownership.json');
+            if (slice === 'foundation' || !tree.exists(path))
+                continue;
+            const recorded = readJson(tree, path, 'Product Slice ownership metadata');
+            if (recorded?.blueprint
+                ?.name !== index_js_1.BUILTIN_BLUEPRINT_NAME)
+                continue;
+            const parsed = (0, index_js_4.validateGeneratedOwnershipRecord)(recorded);
+            if (!parsed.valid)
+                throw new Error(ownershipValidationMessage('Product Slice ownership metadata', parsed.issues));
+            (0, persistence_contract_js_1.standardPersistenceContract)({
+                inputs: parsed.value.inputs,
+                existingStandardRequirement: parsed.value.foundation,
+                ...(tree.exists(node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH))
+                    ? {
+                        current: readJson(tree, node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH), 'Standard persistence declaration'),
+                    }
+                    : {}),
+            });
+        }
         return upgradeFoundation(tree, options, packageJson, output);
     }
     requireUpgradePrerequisites(tree, 'product-slice');
@@ -1184,13 +1486,39 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     if (serviceAdapterOwner !== null && blueprint.source !== 'built-in') {
         throw new Error('External Blueprint upgrades cannot retain the managed generated Service adapter authority; remove or explicitly migrate the elected adapter before changing Blueprint authority.');
     }
-    const inputResult = (0, index_js_1.validateBlueprintInputs)(blueprint.inputSchema, parseInputs(options.inputs, currentOwnership.inputs));
+    const requestedInputs = parseInputs(options.inputs, currentOwnership.inputs);
+    if (blueprint.source === 'built-in') {
+        // Refuse old framework cores before any paired Foundation/Slice changes.
+        // Keeping the old database safe does not imply supporting its old runtime.
+        (0, persistence_contract_js_1.standardPersistenceContract)({
+            inputs: requestedInputs,
+            existingStandardRequirement: currentOwnership.foundation,
+            ...(tree.exists(node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH))
+                ? {
+                    current: readJson(tree, node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH), 'Standard persistence declaration'),
+                }
+                : {}),
+        });
+        if (currentOwnership.foundation.capabilities.includes('postgres') &&
+            !(0, capability_plan_js_1.readStandardSqlDeclaration)(requestedInputs))
+            throw new Error('SQL cannot be retired through an upgrade. Keep the explicit inputs.sql declaration; database retirement requires a separate reviewed operation.');
+    }
+    const inputResult = (0, index_js_1.validateBlueprintInputs)(blueprint.inputSchema, requestedInputs);
     if (!inputResult.valid) {
         throw new Error(`Blueprint inputs are invalid:\n${inputResult.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
             .join('\n')}`);
     }
-    const compatibility = (0, index_js_3.validateFoundationCompatibility)(blueprint.manifest.foundation, readJson(tree, 'packages/foundation/contracts/foundation.json', 'Standard Foundation descriptor'));
+    const requiredFoundation = blueprint.source === 'built-in'
+        ? (0, capability_plan_js_1.standardPersistenceRequirement)(inputResult.value, currentOwnership.compositions)
+        : blueprint.manifest.foundation;
+    const existingFoundation = readJson(tree, 'packages/foundation/contracts/foundation.json', 'Standard Foundation descriptor');
+    const compatibility = (0, index_js_3.validateFoundationCompatibility)(requiredFoundation, blueprint.source === 'built-in'
+        ? (0, capability_plan_js_1.planFoundationCapabilities)({
+            current: existingFoundation,
+            requirements: [requiredFoundation],
+        }).descriptor
+        : existingFoundation);
     if (!compatibility.valid) {
         throw new Error(`Standard Foundation is incompatible with the target Blueprint:\n${compatibility.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1204,10 +1532,19 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     let externalBlueprintDestinationPaths;
     const scope = workspaceScope(packageJson);
     if (blueprint.source === 'built-in') {
+        const deployment = readRepositoryDeploymentRenderingOptions(tree);
         const runtimeVersion = packageJson.dependencies?.['@empire-builder-kit/runtime'];
         if (!runtimeVersion)
             throw new Error('Workspace must depend on @empire-builder-kit/runtime.');
-        const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value);
+        const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value, (0, data_policy_review_seed_js_1.dataPolicyReviewSeed)(tree, root), deployment.deploymentProfile, {
+            existingStandardRequirement: currentOwnership.foundation,
+            compositions: currentOwnership.compositions,
+            ...(tree.exists(node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH))
+                ? {
+                    current: readJson(tree, node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH), 'Standard persistence declaration'),
+                }
+                : {}),
+        });
         targetFiles = Object.fromEntries(Object.entries(plan.files).map(([path, contents]) => {
             const current = tree.read(node_path_1.posix.join(root, path), 'utf8');
             return [
@@ -1217,6 +1554,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
                     : preserveCompositionRegions(current, contents),
             ];
         }));
+        targetFiles = reemitRecordedNativeRuntimeCompositions(targetFiles, currentOwnership);
         targetOwnership = {
             ...plan.ownership,
             contracts: {
@@ -1297,6 +1635,18 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     if (blueprint.source === 'built-in' && serviceAdapterOwner !== null) {
         targetFiles = carryRetainedServiceAdapterAuthority(targetFiles, serviceAdapterOwner);
     }
+    if (blueprint.source === 'built-in') {
+        const productPath = 'infra/product.ts';
+        const productSource = targetFiles[productPath];
+        if (productSource === undefined) {
+            throw new Error('Target Product Slice does not render infra/product.ts.');
+        }
+        targetFiles = {
+            ...targetFiles,
+            [productPath]: reconcileFunctionRegistrationArguments(productSource, currentOwnership),
+        };
+        targetFiles = preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, targetFiles);
+    }
     const targetPathSet = new Set(targetOwnership.paths.map(({ path }) => path));
     const compositionPlan = renderCompositionUpgradePlan(currentOwnership, packageJson.name ?? '', packageJson.dependencies?.['@empire-builder-kit/runtime'] ?? '', serviceAdapterOwner);
     const compositionPaths = compositionPlan.paths.filter(({ path }) => !targetPathSet.has(path));
@@ -1314,7 +1664,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         }
         targetFiles = { ...targetFiles, [entry.path]: contents };
     }
-    targetFiles = await formatRenderedFiles(targetFiles, root);
+    targetFiles = await formatRenderedFiles(tree, targetFiles, root);
     targetOwnership = {
         ...targetOwnership,
         compositions: currentOwnership.compositions,
@@ -1351,24 +1701,56 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         path,
         tree.read(node_path_1.posix.join(root, path), 'utf8'),
     ]));
-    const mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(targetFiles)), targetOwnership);
+    let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(targetFiles)), targetOwnership);
+    mergedTarget = await formatMergedManagedJsonFiles(tree, root, mergedTarget, targetOwnership);
+    const sqlAppends = blueprint.source === 'built-in' &&
+        (0, capability_plan_js_1.readStandardSqlDeclaration)(inputResult.value)
+        ? (0, sql_seeded_reconciliation_js_1.planSqlSeededReconciliation)(currentFiles, targetFiles)
+        : new Map();
+    for (const [path, contents] of sqlAppends) {
+        const workspacePath = node_path_1.posix.join(root, path);
+        mergedTarget.files.set(path, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(contents, await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, (0, formatting_js_1.changedTreePrettierOptions)(tree)), workspacePath));
+    }
     requireTargetCompositionFeatures(mergedTarget.files, targetOwnership);
+    const loggingAppend = blueprint.source === 'built-in'
+        ? (0, logging_registry_js_1.planRequiredSliceLoggingComponents)(currentFiles.get(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH) ?? null, targetFiles[logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH])
+        : null;
+    if (loggingAppend !== null) {
+        const workspacePath = node_path_1.posix.join(root, logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
+        const formatting = await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, (0, formatting_js_1.changedTreePrettierOptions)(tree));
+        mergedTarget.files.set(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(loggingAppend, formatting, workspacePath));
+    }
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, targetOwnership, mergedTarget);
+    if (loggingAppend !== null) {
+        report.preservedSeeded = report.preservedSeeded.filter((path) => path !== logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
+        report.appendedSeeded.push(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
+    }
+    for (const path of sqlAppends.keys()) {
+        report.preservedSeeded = report.preservedSeeded.filter((entry) => entry !== path);
+        report.appendedSeeded.push(path);
+    }
+    report.appendedSeeded.sort(deterministic_order_js_1.compareUtf16);
     output.info(`[ebk-upgrade] ${name} ${currentOwnership.blueprint.name}@${currentOwnership.blueprint.version} -> ${blueprint.manifest.name}@${blueprint.manifest.version}\n${JSON.stringify(report, null, 2)}`);
-    if (!options.apply)
+    if (!options.apply) {
+        if (blueprint.source === 'built-in')
+            await upgradeFoundationForRequirements(tree, [requiredFoundation], false, output);
         return;
+    }
     if (report.incompatibleSeededMigrations.length > 0) {
         throw new Error(seededMigrationUpgradeMessage('Product Slice', report));
     }
     if (report.conflicting.length > 0) {
         throw new Error(upgradeConflictMessage('Product Slice', report));
     }
+    if (blueprint.source === 'built-in')
+        await upgradeFoundationForRequirements(tree, [requiredFoundation], true, output);
     for (const path of report.obsolete)
         tree.delete(node_path_1.posix.join(root, path));
     const writePaths = new Set([
         ...report.changed,
         ...report.missing,
         ...report.addedSeeded,
+        ...report.appendedSeeded,
         '.ebk/ownership.json',
     ]);
     for (const path of writePaths) {
@@ -1384,10 +1766,16 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             [blueprint.manifest.name]: blueprint.manifest.version,
         };
         tree.write('package.json', json(packageJson));
+        if (!options.skipFormat) {
+            const path = 'package.json';
+            if (!tree.exists(path)) {
+                throw new Error('Workspace package.json disappeared during upgrade.');
+            }
+            await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, path);
+        }
     }
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
     (0, index_js_4.restampProductSliceOwnership)(tree, name, { preserveSeeded: true });
+    await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice');
     return options.skipInstall
         ? undefined
         : () => (0, devkit_1.installPackagesTask)(tree, true);
@@ -1395,7 +1783,10 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
 async function upgradeGenerator(tree, options, output = devkit_1.logger, executionOptions = {}) {
     const previewFile = await requireDeveloperAgentPreviewBinding(tree, options, executionOptions);
     if (!previewFile) {
-        return executeUpgradeGenerator(tree, options, output, executionOptions);
+        const deferred = new preview_changes_js_1.DeferredDeveloperAgentTree(tree);
+        const install = await executeUpgradeGenerator(deferred, options, output, executionOptions);
+        deferred.apply();
+        return install;
     }
     const upgradeOptions = { ...options };
     delete upgradeOptions.developerAgentPreview;