@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-workload-role-files.js

@@ -0,0 +1,2356 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderStandardSliceWorkloadRoleFiles = renderStandardSliceWorkloadRoleFiles;
+/** @internal */
+function renderStandardSliceWorkloadRoleFiles(name, workspace) {
+    return {
+        'infra/workload-roles/candidate.ts': `import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';
+import type { WorkloadSecretReferenceInput } from '@empire-builder-kit/nx/secrets';
+import {
+  createStandardSliceWorkloadRoleCandidate,
+  createStandardSliceWorkloadRoleTopology as createWorkloadRoleTopology,
+  type RegisteredWorkloadRoleManifestDocument,
+  type StandardSliceServiceAdapterMetadata,
+  type StandardSliceWorkloadExtension,
+} from '@empire-builder-kit/nx/workload-roles';
+import databaseBindings from '../../database/bindings.json';
+import performanceOperations from '../../operations/performance.json';
+import {
+  createStandardSliceWorkloadRoleIntents,
+  type StandardSliceWorkloadRoleIntentContext,
+} from './effective-intent.js';
+
+export const STANDARD_SLICE_WORKLOAD_EXTENSIONS = [
+  // <ebk:workload-role-extensions:start>
+  // <ebk:workload-role-extensions:end>
+] as const satisfies readonly StandardSliceWorkloadExtension[];
+
+function standardSliceServiceAdapterMetadata(
+  value: unknown,
+): StandardSliceServiceAdapterMetadata {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('Performance operations must be an object.');
+  }
+  const load = (value as { load?: unknown }).load;
+  if (load === null || typeof load !== 'object' || Array.isArray(load)) {
+    throw new Error('Performance operations load authority must be an object.');
+  }
+  const owner = (load as { serviceAdapterOwner?: unknown })
+    .serviceAdapterOwner;
+  const status = (load as { serviceAdapterStatus?: unknown })
+    .serviceAdapterStatus;
+  if (
+    (status === 'requires-adopter-service-runtime-endpoint' &&
+      owner === null) ||
+    (status === 'managed-generated-service-runtime-endpoint' &&
+      typeof owner === 'string' &&
+      owner.length > 0)
+  ) {
+    return { owner, status };
+  }
+  throw new Error(
+    'Performance operations Service adapter authority is inconsistent.',
+  );
+}
+
+const STANDARD_SLICE_SERVICE_ADAPTER =
+  standardSliceServiceAdapterMetadata(performanceOperations);
+
+function provisionedDatabaseIdentifiers(stage: string) {
+  return createDatabaseBindingPlan(databaseBindings, {
+    slice: '${name}',
+    stage,
+  }).provisioned;
+}
+
+export function createStandardSliceWorkloadRoleTopology(stage: string) {
+  return createWorkloadRoleTopology({
+    databaseIdentifiers: provisionedDatabaseIdentifiers(stage),
+    extensions: STANDARD_SLICE_WORKLOAD_EXTENSIONS,
+    serviceAdapter: STANDARD_SLICE_SERVICE_ADAPTER,
+    slice: '${name}',
+  });
+}
+
+export function createStandardSliceCandidate(options: {
+  accountId: string;
+  candidateIdentity: string;
+  intentContext: StandardSliceWorkloadRoleIntentContext;
+  partition: string;
+  secretReferences: readonly WorkloadSecretReferenceInput[];
+  stage: string;
+}) {
+  const topology = createStandardSliceWorkloadRoleTopology(options.stage);
+  return createStandardSliceWorkloadRoleCandidate({
+    accountId: options.accountId,
+    candidateIdentity: options.candidateIdentity,
+    databaseIdentifiers: provisionedDatabaseIdentifiers(options.stage),
+    extensions: STANDARD_SLICE_WORKLOAD_EXTENSIONS,
+    intentsByRole: createStandardSliceWorkloadRoleIntents(
+      options.intentContext,
+      topology,
+      options.secretReferences,
+    ),
+    partition: options.partition,
+    serviceAdapter: STANDARD_SLICE_SERVICE_ADAPTER,
+    slice: '${name}',
+    stage: options.stage,
+  });
+}
+
+export function recreateRegisteredStandardSliceCandidate(
+  document: RegisteredWorkloadRoleManifestDocument,
+  intentContext: StandardSliceWorkloadRoleIntentContext,
+  secretReferences: readonly WorkloadSecretReferenceInput[],
+) {
+  return createStandardSliceCandidate({
+    accountId: document.accountId,
+    candidateIdentity: document.manifest.candidate.identity,
+    intentContext,
+    partition: document.partition,
+    secretReferences,
+    stage: document.manifest.candidate.stage,
+  });
+}
+`,
+        'infra/workload-roles/effective-intent.ts': `import { createHash } from 'node:crypto';
+import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';
+import {
+  createSecretWorkloadAccessPlan,
+  parseSecretWorkloadAccessRegistry,
+  toOperatorSecretMetadataDeclarations,
+  validateSecretWorkloadAccessTargets,
+  type SecretMetadataDeclaration,
+  type SecretWorkloadAccessPlanEntry,
+  type WorkloadSecretReferenceInput,
+} from '@empire-builder-kit/nx/secrets';
+import { containerReleaseRepositoryName } from '@empire-builder-kit/nx/supply-chain';
+import {
+  standardSliceWorkloadRoleName,
+  type StandardSliceWorkloadExtensionKind,
+  type StandardSliceWorkloadRoleTopology,
+  type WorkloadRolePermissionIntent,
+} from '@empire-builder-kit/nx/workload-roles';
+import databaseBindings from '../../database/bindings.json';
+import { Secrets } from '../../secrets/declarations.js';
+import secretWorkloadAccess from '../../secrets/workload-access.json';
+
+export interface StandardSliceWorkloadRoleIntentContribution {
+  intents: readonly WorkloadRolePermissionIntent[];
+  roleId: string;
+}
+
+export interface StandardSliceWorkloadRoleIntentContext {
+  accountId: string;
+  clusterName: string;
+  clusterResourceId: string;
+  eventBusArn: string;
+  identityUserPoolArn: string;
+  masterSecretArn: string;
+  partition: string;
+  region: string;
+  stage: string;
+}
+
+const SECRET_LINKABLE_WORKLOAD_SURFACES = new Set([
+  'api-route',
+  'bootstrap-task',
+  'job-task',
+  'lambda-function',
+  'migration-task',
+  'next-image-optimizer',
+  'next-revalidation-seeder',
+  'next-revalidation-subscriber',
+  'next-server',
+  'queue-consumer',
+  'retirement-task',
+  'service-task',
+]);
+
+function requireSecretAccessBindings(
+  stage: string,
+  topology: StandardSliceWorkloadRoleTopology,
+) {
+  const access = parseSecretWorkloadAccessRegistry(secretWorkloadAccess);
+  const declarations = toOperatorSecretMetadataDeclarations(Secrets);
+  const declarationsByName = new Map(
+    declarations.map((declaration) => [
+      declaration.logicalName,
+      declaration,
+    ]),
+  );
+  const validatedAccess = validateSecretWorkloadAccessTargets({
+    access,
+    allowedWorkloads: topology.roles
+      .filter((role) =>
+        SECRET_LINKABLE_WORKLOAD_SURFACES.has(role.surface),
+      )
+      .map((role) => role.id),
+  });
+  for (const binding of validatedAccess.bindings) {
+    const declaration = declarationsByName.get(binding.logicalName);
+    if (!declaration) {
+      throw new Error(
+        'Secret workload access must select one declared, linkable Standard Slice workload.',
+      );
+    }
+  }
+  return {
+    access: validatedAccess,
+    declarations,
+    declarationsByName,
+  };
+}
+
+export function standardSliceBoundOperatorSecretDeclarations(
+  stage: string,
+  topology: StandardSliceWorkloadRoleTopology,
+): readonly SecretMetadataDeclaration[] {
+  const { access, declarationsByName } = requireSecretAccessBindings(
+    stage,
+    topology,
+  );
+  return Object.freeze(
+    [...new Set(access.bindings.map(({ logicalName }) => logicalName))]
+      .sort((left, right) => (left < right ? -1 : left > right ? 1 : 0))
+      .map((logicalName) => {
+        const declaration = declarationsByName.get(logicalName);
+        if (!declaration) {
+          throw new Error(
+            'Secret workload access references an undeclared operator secret.',
+          );
+        }
+        return declaration;
+      })
+      .filter((declaration) => declaration.requiredStages.includes(stage)),
+  );
+}
+
+export function standardSliceSecretAccessPlan(
+  context: StandardSliceWorkloadRoleIntentContext,
+  topology: StandardSliceWorkloadRoleTopology,
+  references: readonly WorkloadSecretReferenceInput[],
+): readonly SecretWorkloadAccessPlanEntry[] {
+  const { access, declarations } = requireSecretAccessBindings(
+    context.stage,
+    topology,
+  );
+  return createSecretWorkloadAccessPlan({
+    access,
+    declarations,
+    references,
+    stage: context.stage,
+  });
+}
+
+function stableName(maxLength: number, ...parts: string[]): string {
+  const value = parts.join('-').toLowerCase();
+  if (value.length <= maxLength) return value;
+  const digest = createHash('sha256')
+    .update(value, 'utf8')
+    .digest('hex')
+    .slice(0, 12);
+  return value.slice(0, maxLength - digest.length - 1) + '-' + digest;
+}
+
+export function standardSliceResourceNames(context: {
+  accountId: string;
+  stage: string;
+}) {
+  return {
+    asyncRecoveryLedger: stableName(
+      255,
+      'ebk',
+      context.stage,
+      '${name}',
+      'async-recovery-ledger',
+    ),
+    asyncTargetDlq: stableName(
+      80,
+      'ebk',
+      context.stage,
+      '${name}',
+      'async-target-dlq',
+    ),
+    dataExportBucket: stableName(
+      63,
+      'ebk',
+      context.accountId,
+      context.stage,
+      '${name}',
+      'data-export',
+    ),
+    dataExportCleanupRule: stableName(
+      64,
+      'ebk',
+      context.stage,
+      '${name}',
+      'data-export-cleanup',
+    ),
+    dataExportKeyAlias:
+      'alias/' +
+      stableName(
+        250,
+        'ebk',
+        context.stage,
+        '${name}',
+        'data-export',
+      ),
+    dataRetentionTaskFamily: standardSliceExtensionTaskFamily(
+      context.stage,
+      'data-retention',
+      'job',
+    ),
+    dataRetentionMaintenanceTaskFamily: standardSliceExtensionTaskFamily(
+      context.stage,
+      'data-retention-maintenance',
+      'job',
+    ),
+    dataRetentionMaintenanceRule: stableName(
+      64,
+      'ebk',
+      context.stage,
+      '${name}',
+      'data-retention-maintenance',
+    ),
+    databaseTaskFamily(database: string, kind: 'bootstrap' | 'migration' | 'retirement') {
+      return standardSliceDatabaseTaskFamily(context.stage, database, kind);
+    },
+    eventDlq: stableName(80, 'ebk', context.stage, '${name}', 'event-dlq'),
+    eventQueue: stableName(80, 'ebk', context.stage, '${name}', 'event-queue'),
+    providerDlq: stableName(
+      80,
+      'ebk',
+      context.stage,
+      '${name}',
+      'provider-dlq',
+    ),
+    providerQueue: stableName(
+      80,
+      'ebk',
+      context.stage,
+      '${name}',
+      'provider-queue',
+    ),
+    workflowTaskFunction: stableName(
+      64,
+      'ebk',
+      context.stage,
+      '${name}',
+      'async-workflow-task',
+    ),
+    extensionTaskFamily(id: string, kind: 'job' | 'service') {
+      return standardSliceExtensionTaskFamily(context.stage, id, kind);
+    },
+    webAssetsBucket: stableName(
+      63,
+      'ebk',
+      context.accountId,
+      context.stage,
+      '${name}',
+      'web-assets',
+    ),
+    webRevalidationQueue:
+      stableName(
+        75,
+        'ebk',
+        context.stage,
+        '${name}',
+        'web-revalidation',
+      ) + '.fifo',
+    webRevalidationTable: stableName(
+      255,
+      'ebk',
+      context.stage,
+      '${name}',
+      'web-revalidation',
+    ),
+  };
+}
+
+export function standardSliceDatabaseTaskFamily(
+  stage: string,
+  database: string,
+  kind: 'bootstrap' | 'migration' | 'retirement',
+) {
+  return stableName(
+    255,
+    'ebk',
+    stage,
+    '${name}',
+    'database',
+    database,
+    kind,
+  );
+}
+
+export function standardSliceExtensionTaskFamily(
+  stage: string,
+  id: string,
+  kind: 'job' | 'service',
+) {
+  return stableName(255, 'ebk', stage, '${name}', id, kind);
+}
+
+export function standardSliceServicePerformanceReservationTableName(
+  stage: string,
+  id: string,
+) {
+  return stableName(
+    255,
+    'ebk',
+    stage,
+    '${name}',
+    id,
+    'service-performance-reservations',
+  );
+}
+
+const roleId = (resource: string) => '${name}.' + resource;
+const arn = (
+  context: StandardSliceWorkloadRoleIntentContext,
+  service: string,
+  resource: string,
+) =>
+  'arn:' +
+  context.partition +
+  ':' +
+  service +
+  ':' +
+  context.region +
+  ':' +
+  context.accountId +
+  ':' +
+  resource;
+
+function intent(
+  id: string,
+  source: WorkloadRolePermissionIntent['source'],
+  actions: string[],
+  resources: string[],
+  wildcardResourceJustification?: string,
+): WorkloadRolePermissionIntent {
+  return {
+    actions,
+    id,
+    resources,
+    source,
+    ...(wildcardResourceJustification
+      ? { wildcardResourceJustification }
+      : {}),
+  };
+}
+
+function logIntent(
+  context: StandardSliceWorkloadRoleIntentContext,
+  id: string,
+  component: string,
+  resource?: string,
+) {
+  const suffix = resource ? '/' + resource : '';
+  return intent(
+    id + '.structured-logging',
+    { kind: 'framework', name: 'structured-logging' },
+    ['logs:CreateLogStream', 'logs:PutLogEvents'],
+    [
+      arn(
+        context,
+        'logs',
+        'log-group:/ebk/' +
+          context.stage +
+          '/${name}/' +
+          component +
+          suffix +
+          ':*',
+      ),
+    ],
+  );
+}
+
+function lambdaVpcIntent(
+  id: string,
+): WorkloadRolePermissionIntent {
+  return intent(
+    id + '.vpc-network-interface',
+    { kind: 'framework', name: 'lambda-vpc' },
+    [
+      'ec2:AssignPrivateIpAddresses',
+      'ec2:CreateNetworkInterface',
+      'ec2:DeleteNetworkInterface',
+      'ec2:DescribeNetworkInterfaces',
+      'ec2:DescribeSubnets',
+      'ec2:UnassignPrivateIpAddresses',
+    ],
+    ['*'],
+    'Lambda VPC network-interface APIs do not support useful resource scoping.',
+  );
+}
+
+function secretArn(
+  context: StandardSliceWorkloadRoleIntentContext,
+  database: string,
+  kind: 'readonly' | 'readwrite',
+) {
+  return arn(
+    context,
+    'secretsmanager',
+    'secret:ebk/' +
+      context.stage +
+      '/${name}/database/' +
+      database +
+      '/' +
+      kind +
+      '-*',
+  );
+}
+
+function machineAuthorizationSecretArn(
+  context: StandardSliceWorkloadRoleIntentContext,
+) {
+  return arn(
+    context,
+    'secretsmanager',
+    'secret:ebk/' +
+      context.stage +
+      '/${name}/authorization/machine-client-*',
+  );
+}
+
+function dataExportStorageIntents(
+  context: StandardSliceWorkloadRoleIntentContext,
+  id: string,
+  access: 'cleanup' | 'full',
+): WorkloadRolePermissionIntent[] {
+  const names = standardSliceResourceNames(context);
+  const bucketArn =
+    'arn:' + context.partition + ':s3:::' + names.dataExportBucket;
+  const intents: WorkloadRolePermissionIntent[] = [
+    {
+      ...intent(
+        id + '.list-export-versions',
+        { kind: 'permissions', name: 'confidential-data-export' },
+        ['s3:ListBucketVersions'],
+        [bucketArn],
+      ),
+      conditions: {
+        StringLike: {
+          's3:prefix': [
+            'confidential-exports/',
+            'confidential-exports/*',
+          ],
+        },
+      },
+    },
+    intent(
+      id + '.export-objects',
+      { kind: 'permissions', name: 'confidential-data-export' },
+      access === 'full'
+        ? [
+            's3:DeleteObjectVersion',
+            's3:GetObject',
+            's3:GetObjectVersion',
+            's3:PutObject',
+          ]
+        : ['s3:DeleteObjectVersion'],
+      [bucketArn + '/confidential-exports/*'],
+    ),
+  ];
+  if (access === 'full') {
+    intents.push({
+      ...intent(
+        id + '.export-key',
+        { kind: 'permissions', name: 'confidential-data-export' },
+        ['kms:Decrypt', 'kms:Encrypt', 'kms:GenerateDataKey'],
+        [arn(context, 'kms', 'key/*')],
+      ),
+      conditions: {
+        'ForAnyValue:StringEquals': {
+          'kms:ResourceAliases': names.dataExportKeyAlias,
+        },
+      },
+    });
+  }
+  return intents;
+}
+
+function executionIntents(
+  context: StandardSliceWorkloadRoleIntentContext,
+  role: string,
+  component: string,
+  artifactId: string,
+  resource?: string,
+  exactDevelopment = false,
+) {
+  const protectedImage =
+    context.stage === 'staging' ||
+    context.stage === 'production' ||
+    (context.stage === 'development' && exactDevelopment);
+  const repository = protectedImage
+    ? containerReleaseRepositoryName({
+        artifactId,
+        slice: '${name}',
+        stage: context.stage,
+      })
+    : 'sst-asset';
+  return [
+    intent(
+      role + '.ecr-authorization',
+      { kind: 'framework', name: 'container-image-pull' },
+      ['ecr:GetAuthorizationToken'],
+      ['*'],
+      'Amazon ECR authorization tokens are account-scoped and require Resource star.',
+    ),
+    intent(
+      role + '.ecr-image-pull',
+      { kind: 'framework', name: 'sst-container-image' },
+      [
+        'ecr:BatchCheckLayerAvailability',
+        'ecr:BatchGetImage',
+        'ecr:GetDownloadUrlForLayer',
+      ],
+      [arn(context, 'ecr', 'repository/' + repository)],
+    ),
+    logIntent(context, role, component, resource),
+  ];
+}
+
+function roleArn(
+  context: StandardSliceWorkloadRoleIntentContext,
+  resource: string,
+) {
+  return (
+    'arn:' +
+    context.partition +
+    ':iam::' +
+    context.accountId +
+    ':role/' +
+    standardSliceWorkloadRoleName(context.stage, '${name}', resource)
+  );
+}
+
+function passRoleIntent(
+  context: StandardSliceWorkloadRoleIntentContext,
+  id: string,
+  resources: string[],
+  sourceName = 'database-lifecycle-orchestration',
+): WorkloadRolePermissionIntent {
+  return {
+    ...intent(
+      id + '.pass-task-roles',
+      { kind: 'framework', name: sourceName },
+      ['iam:PassRole'],
+      resources,
+    ),
+    conditions: {
+      StringEquals: {
+        'iam:PassedToService': 'ecs-tasks.amazonaws.com',
+      },
+    },
+  };
+}
+
+function stateMachineLoggingIntent(id: string) {
+  return intent(
+    id + '.state-machine-logging',
+    { kind: 'framework', name: 'step-functions-logging' },
+    [
+      'logs:CreateLogDelivery',
+      'logs:DeleteLogDelivery',
+      'logs:DescribeLogGroups',
+      'logs:DescribeResourcePolicies',
+      'logs:GetLogDelivery',
+      'logs:ListLogDeliveries',
+      'logs:PutResourcePolicy',
+      'logs:UpdateLogDelivery',
+    ],
+    ['*'],
+    'CloudWatch Logs delivery control-plane APIs require Resource star.',
+  );
+}
+
+function databaseContributions(
+  context: StandardSliceWorkloadRoleIntentContext,
+  database: string,
+): StandardSliceWorkloadRoleIntentContribution[] {
+  const names = standardSliceResourceNames(context);
+  const identifiers = createDatabaseBindingPlan(databaseBindings, {
+    slice: '${name}',
+    stage: context.stage,
+  }).identifiers[database];
+  if (!identifiers) {
+    throw new Error('Generated database workload-role intent is undeclared.');
+  }
+  const prefix = 'database-' + database;
+  const bootstrapTaskId = roleId(prefix + '-bootstrap-task');
+  const bootstrapExecutionId = roleId(prefix + '-bootstrap-execution');
+  const migrationTaskId = roleId(prefix + '-migration-task');
+  const migrationExecutionId = roleId(prefix + '-migration-execution');
+  const migrationOrchestrationId = roleId(prefix + '-migration-orchestration');
+  const taskDefinition = (kind: 'bootstrap' | 'migration' | 'retirement') =>
+    arn(
+      context,
+      'ecs',
+      'task-definition/' + names.databaseTaskFamily(database, kind) + ':*',
+    );
+  const taskRoleResources = (kind: 'bootstrap' | 'migration' | 'retirement') => [
+    roleArn(context, prefix + '-' + kind + '-execution'),
+    roleArn(context, prefix + '-' + kind + '-task'),
+  ];
+  const databaseUserArn = arn(
+    context,
+    'rds-db',
+    'dbuser:' + context.clusterResourceId + '/' + identifiers.migratorRole,
+  );
+  const migrationOrchestration = [
+    intent(
+      migrationOrchestrationId + '.run-tasks',
+      { kind: 'framework', name: 'database-lifecycle-orchestration' },
+      ['ecs:RunTask'],
+      [taskDefinition('bootstrap'), taskDefinition('migration')],
+    ),
+    intent(
+      migrationOrchestrationId + '.observe-tasks',
+      { kind: 'framework', name: 'database-lifecycle-orchestration' },
+      ['ecs:DescribeTasks', 'ecs:StopTask'],
+      [
+        arn(
+          context,
+          'ecs',
+          'task/' + context.clusterName + '/*',
+        ),
+      ],
+    ),
+    intent(
+      migrationOrchestrationId + '.managed-events-rule',
+      { kind: 'framework', name: 'database-lifecycle-orchestration' },
+      ['events:DescribeRule', 'events:PutRule', 'events:PutTargets'],
+      [
+        arn(
+          context,
+          'events',
+          'rule/StepFunctionsGetEventsForECSTaskRule',
+        ),
+      ],
+    ),
+    passRoleIntent(
+      context,
+      migrationOrchestrationId,
+      [
+        ...taskRoleResources('bootstrap'),
+        ...taskRoleResources('migration'),
+      ],
+    ),
+    stateMachineLoggingIntent(migrationOrchestrationId),
+  ];
+  const contributions: StandardSliceWorkloadRoleIntentContribution[] = [
+    {
+      intents: [
+        intent(
+          bootstrapTaskId + '.database-secrets',
+          { kind: 'permissions', name: 'database-bootstrap' },
+          [
+            'secretsmanager:GetSecretValue',
+            'secretsmanager:PutSecretValue',
+          ],
+          [
+            context.masterSecretArn,
+            secretArn(context, database, 'readonly'),
+            secretArn(context, database, 'readwrite'),
+          ],
+        ),
+        intent(
+          bootstrapTaskId + '.database-connect',
+          { kind: 'permissions', name: 'database-bootstrap' },
+          ['rds-db:connect'],
+          [databaseUserArn],
+        ),
+      ],
+      roleId: bootstrapTaskId,
+    },
+    {
+      intents: executionIntents(
+        context,
+        bootstrapExecutionId,
+        'database-bootstrap',
+        '${name}.job.database-migration',
+        database,
+      ),
+      roleId: bootstrapExecutionId,
+    },
+    {
+      intents: [
+        intent(
+          migrationTaskId + '.database-connect',
+          { kind: 'permissions', name: 'database-migration' },
+          ['rds-db:connect'],
+          [databaseUserArn],
+        ),
+      ],
+      roleId: migrationTaskId,
+    },
+    {
+      intents: executionIntents(
+        context,
+        migrationExecutionId,
+        'database-migration',
+        '${name}.job.database-migration',
+        database,
+      ),
+      roleId: migrationExecutionId,
+    },
+    {
+      intents: migrationOrchestration,
+      roleId: migrationOrchestrationId,
+    },
+  ];
+  if (database !== 'retirement_rehearsal') return contributions;
+
+  const retirementTaskId = roleId(prefix + '-retirement-task');
+  const retirementExecutionId = roleId(prefix + '-retirement-execution');
+  const retirementOrchestrationId = roleId(
+    prefix + '-retirement-orchestration',
+  );
+  const allDatabases = createDatabaseBindingPlan(databaseBindings, {
+    slice: '${name}',
+    stage: context.stage,
+  }).provisioned;
+  contributions.push(
+    {
+      intents: [
+        intent(
+          retirementTaskId + '.master-secret',
+          { kind: 'permissions', name: 'database-retirement-rehearsal' },
+          ['secretsmanager:GetSecretValue'],
+          [context.masterSecretArn],
+        ),
+        intent(
+          retirementTaskId + '.secret-metadata',
+          { kind: 'permissions', name: 'database-retirement-rehearsal' },
+          ['secretsmanager:DescribeSecret'],
+          allDatabases.flatMap((identifier) => [
+            secretArn(context, identifier, 'readonly'),
+            secretArn(context, identifier, 'readwrite'),
+          ]),
+        ),
+        intent(
+          retirementTaskId + '.delete-target-secrets',
+          { kind: 'permissions', name: 'database-retirement-rehearsal' },
+          ['secretsmanager:DeleteSecret'],
+          [
+            secretArn(context, database, 'readonly'),
+            secretArn(context, database, 'readwrite'),
+          ],
+        ),
+        intent(
+          retirementTaskId + '.task-callback',
+          { kind: 'framework', name: 'database-retirement-callback' },
+          ['states:SendTaskFailure', 'states:SendTaskSuccess'],
+          ['*'],
+          'Step Functions callback task-token APIs require Resource star.',
+        ),
+      ],
+      roleId: retirementTaskId,
+    },
+    {
+      intents: executionIntents(
+        context,
+        retirementExecutionId,
+        'database-retirement',
+        '${name}.job.database-retirement',
+        database,
+        true,
+      ),
+      roleId: retirementExecutionId,
+    },
+    {
+      intents: [
+        intent(
+          retirementOrchestrationId + '.run-task',
+          { kind: 'framework', name: 'database-retirement-orchestration' },
+          ['ecs:RunTask'],
+          [taskDefinition('retirement')],
+        ),
+        intent(
+          retirementOrchestrationId + '.observe-task',
+          {
+            kind: 'framework',
+            name: 'database-retirement-orchestration',
+          },
+          ['ecs:DescribeTasks', 'ecs:StopTask'],
+          [arn(context, 'ecs', 'task/' + context.clusterName + '/*')],
+        ),
+        intent(
+          retirementOrchestrationId + '.managed-events-rule',
+          {
+            kind: 'framework',
+            name: 'database-retirement-orchestration',
+          },
+          ['events:DescribeRule', 'events:PutRule', 'events:PutTargets'],
+          [
+            arn(
+              context,
+              'events',
+              'rule/StepFunctionsGetEventsForECSTaskRule',
+            ),
+          ],
+        ),
+        passRoleIntent(
+          context,
+          retirementOrchestrationId,
+          taskRoleResources('retirement'),
+        ),
+        stateMachineLoggingIntent(retirementOrchestrationId),
+      ],
+      roleId: retirementOrchestrationId,
+    },
+  );
+  return contributions;
+}
+
+function dataRetentionContributions(
+  context: StandardSliceWorkloadRoleIntentContext,
+  database: string,
+): StandardSliceWorkloadRoleIntentContribution[] {
+  const names = standardSliceResourceNames(context);
+  const taskId = roleId('data-retention-job-task');
+  const executionId = roleId('data-retention-job-execution');
+  const orchestrationId = roleId('data-retention-job-orchestration');
+  const maintenanceTaskId = roleId(
+    'data-retention-maintenance-job-task',
+  );
+  const maintenanceExecutionId = roleId(
+    'data-retention-maintenance-job-execution',
+  );
+  const maintenanceLauncherId = roleId(
+    'data-retention-maintenance-launcher',
+  );
+  const taskDefinition = arn(
+    context,
+    'ecs',
+    'task-definition/' + names.dataRetentionTaskFamily + ':*',
+  );
+  const maintenanceTaskDefinition = arn(
+    context,
+    'ecs',
+    'task-definition/' + names.dataRetentionMaintenanceTaskFamily + ':*',
+  );
+  return [
+    {
+      intents: [
+        intent(
+          taskId + '.database-secret',
+          { kind: 'secret-link', name: 'primary-database' },
+          ['secretsmanager:GetSecretValue'],
+          [secretArn(context, database, 'readwrite')],
+        ),
+        intent(
+          taskId + '.event-bus',
+          { kind: 'link', name: 'foundation-event-bus' },
+          ['events:PutEvents'],
+          [context.eventBusArn],
+        ),
+        intent(
+          taskId + '.task-callback',
+          { kind: 'framework', name: 'data-retention-callback' },
+          ['states:SendTaskFailure', 'states:SendTaskSuccess'],
+          ['*'],
+          'Step Functions callback task-token APIs require Resource star.',
+        ),
+      ],
+      roleId: taskId,
+    },
+    {
+      intents: executionIntents(
+        context,
+        executionId,
+        'job-data-retention',
+        '${name}.job.data-retention',
+      ),
+      roleId: executionId,
+    },
+    {
+      intents: [
+        intent(
+          orchestrationId + '.run-task',
+          { kind: 'framework', name: 'data-retention-orchestration' },
+          ['ecs:RunTask'],
+          [taskDefinition],
+        ),
+        intent(
+          orchestrationId + '.observe-task',
+          { kind: 'framework', name: 'data-retention-orchestration' },
+          ['ecs:DescribeTasks', 'ecs:StopTask'],
+          [arn(context, 'ecs', 'task/' + context.clusterName + '/*')],
+        ),
+        intent(
+          orchestrationId + '.managed-events-rule',
+          { kind: 'framework', name: 'data-retention-orchestration' },
+          ['events:DescribeRule', 'events:PutRule', 'events:PutTargets'],
+          [
+            arn(
+              context,
+              'events',
+              'rule/StepFunctionsGetEventsForECSTaskRule',
+            ),
+          ],
+        ),
+        passRoleIntent(context, orchestrationId, [
+          roleArn(context, 'data-retention-job-execution'),
+          roleArn(context, 'data-retention-job-task'),
+        ]),
+        stateMachineLoggingIntent(orchestrationId),
+      ],
+      roleId: orchestrationId,
+    },
+    {
+      intents: [
+        logIntent(
+          context,
+          maintenanceLauncherId,
+          'job-data-retention-maintenance-launcher',
+        ),
+        {
+          ...intent(
+            maintenanceLauncherId + '.run-maintenance-task',
+            {
+              kind: 'framework',
+              name: 'data-retention-maintenance-launcher',
+            },
+            ['ecs:RunTask'],
+            [maintenanceTaskDefinition],
+          ),
+          conditions: {
+            ArnEquals: {
+              'ecs:cluster': arn(
+                context,
+                'ecs',
+                'cluster/' + context.clusterName,
+              ),
+            },
+          },
+        },
+        passRoleIntent(
+          context,
+          maintenanceLauncherId,
+          [
+            roleArn(
+              context,
+              'data-retention-maintenance-job-execution',
+            ),
+            roleArn(context, 'data-retention-maintenance-job-task'),
+          ],
+          'data-retention-maintenance-launcher',
+        ),
+      ],
+      roleId: maintenanceLauncherId,
+    },
+    {
+      intents: [
+        intent(
+          maintenanceTaskId + '.database-secret',
+          { kind: 'secret-link', name: 'primary-database' },
+          ['secretsmanager:GetSecretValue'],
+          [secretArn(context, database, 'readwrite')],
+        ),
+      ],
+      roleId: maintenanceTaskId,
+    },
+    {
+      intents: executionIntents(
+        context,
+        maintenanceExecutionId,
+        'job-data-retention-maintenance',
+        '${name}.job.data-retention',
+      ),
+      roleId: maintenanceExecutionId,
+    },
+  ];
+}
+
+export function extensionWorkloadRoleIntentContributions(
+  context: StandardSliceWorkloadRoleIntentContext,
+  topology: StandardSliceWorkloadRoleTopology,
+  id: string,
+  kind: StandardSliceWorkloadExtensionKind,
+): StandardSliceWorkloadRoleIntentContribution[] {
+  if (kind === 'function') {
+    const extensionRoleId = roleId(id + '-function');
+    return [{
+      intents: [logIntent(context, extensionRoleId, 'function-' + id)],
+      roleId: extensionRoleId,
+    }];
+  }
+  const taskRoleId = roleId(id + '-' + kind + '-task');
+  const executionRoleId = roleId(id + '-' + kind + '-execution');
+  const activeConfigurationIntent = {
+    ...intent(
+      taskRoleId + '.active-configuration',
+      { kind: 'link', name: 'active-configuration' },
+      [
+        'appconfig:GetLatestConfiguration',
+        'appconfig:StartConfigurationSession',
+      ],
+      [
+        arn(
+          context,
+          'appconfig',
+          'application/*/environment/*/configuration/*',
+        ),
+      ],
+    ),
+    conditions: {
+      StringEquals: {
+        'aws:ResourceTag/ebk:slice': '${name}',
+        'aws:ResourceTag/ebk:stage': context.stage,
+      },
+    },
+  };
+  const serviceBaseIntents = [
+    activeConfigurationIntent,
+    intent(
+      taskRoleId + '.ecs-exec',
+      { kind: 'framework', name: 'service-ecs-exec' },
+      [
+        'ssmmessages:CreateControlChannel',
+        'ssmmessages:CreateDataChannel',
+        'ssmmessages:OpenControlChannel',
+        'ssmmessages:OpenDataChannel',
+      ],
+      ['*'],
+      'ECS Exec session-channel APIs require Resource star.',
+    ),
+  ];
+  const taskContributions: StandardSliceWorkloadRoleIntentContribution[] =
+    kind === 'service'
+      ? topology.serviceAdapterOwner === id
+        ? [
+          {
+            intents: serviceBaseIntents,
+            roleId: taskRoleId,
+          },
+          {
+            intents: [
+              ...serviceBaseIntents,
+              intent(
+                roleId(id + '-service-performance-task') +
+                  '.performance-reservations',
+                { kind: 'framework', name: 'protected-performance-load' },
+                [
+                  'dynamodb:GetItem',
+                  'dynamodb:PutItem',
+                  'dynamodb:TransactWriteItems',
+                ],
+                [
+                  arn(
+                    context,
+                    'dynamodb',
+                    'table/' +
+                      standardSliceServicePerformanceReservationTableName(
+                        context.stage,
+                        id,
+                      ),
+                  ),
+                ],
+              ),
+            ],
+            roleId: roleId(id + '-service-performance-task'),
+          },
+        ]
+        : [{ intents: serviceBaseIntents, roleId: taskRoleId }]
+      : [{ intents: [activeConfigurationIntent], roleId: taskRoleId }];
+  return [
+    ...taskContributions,
+    {
+      intents: executionIntents(
+        context,
+        executionRoleId,
+        kind + '-' + id,
+        '${name}.' + kind + '.' + id,
+      ),
+      roleId: executionRoleId,
+    },
+  ];
+}
+
+export function createStandardSliceWorkloadRoleIntents(
+  context: StandardSliceWorkloadRoleIntentContext,
+  topology: StandardSliceWorkloadRoleTopology,
+  secretReferences: readonly WorkloadSecretReferenceInput[],
+) {
+  const plan = createDatabaseBindingPlan(databaseBindings, {
+    slice: '${name}',
+    stage: context.stage,
+  });
+  const activeDatabase = plan.active.primary;
+  if (!activeDatabase) {
+    throw new Error('Primary database binding is required for role intent.');
+  }
+  const names = standardSliceResourceNames(context);
+  const lambda = (
+    resource: string,
+    component: string,
+    extra: readonly WorkloadRolePermissionIntent[] = [],
+  ): StandardSliceWorkloadRoleIntentContribution => {
+    const id = roleId(resource);
+    return { intents: [logIntent(context, id, component), ...extra], roleId: id };
+  };
+  const nextTable = arn(
+    context,
+    'dynamodb',
+    'table/' + names.webRevalidationTable,
+  );
+  const nextQueue = arn(context, 'sqs', names.webRevalidationQueue);
+  const contributions: StandardSliceWorkloadRoleIntentContribution[] = [
+    lambda('api-data-rights', 'data-rights', [
+      intent(
+        roleId('api-data-rights') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      intent(
+        roleId('api-data-rights') + '.event-bus',
+        { kind: 'link', name: 'foundation-event-bus' },
+        ['events:PutEvents'],
+        [context.eventBusArn],
+      ),
+      ...dataExportStorageIntents(
+        context,
+        roleId('api-data-rights'),
+        'full',
+      ),
+      lambdaVpcIntent(roleId('api-data-rights')),
+    ]),
+    lambda('api-delegations', 'authorization-delegations', [
+      intent(
+        roleId('api-delegations') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      lambdaVpcIntent(roleId('api-delegations')),
+    ]),
+    lambda('api-health', 'api-health'),
+    lambda(
+      'api-machine-authorization-proof',
+      'machine-authorization-proof-target',
+      [
+        intent(
+          roleId('api-machine-authorization-proof') + '.database-secret',
+          { kind: 'secret-link', name: 'primary-database' },
+          ['secretsmanager:GetSecretValue'],
+          [secretArn(context, activeDatabase, 'readwrite')],
+        ),
+        lambdaVpcIntent(roleId('api-machine-authorization-proof')),
+      ],
+    ),
+    lambda('api-protected', 'api-protected', [
+      intent(
+        roleId('api-protected') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      lambdaVpcIntent(roleId('api-protected')),
+    ]),
+    lambda('api-database-health', 'database-health', [
+      intent(
+        roleId('api-database-health') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      lambdaVpcIntent(roleId('api-database-health')),
+    ]),
+    lambda('api-database-records', 'database-records', [
+      logIntent(
+        context,
+        roleId('api-database-records') + '.data-retention-review',
+        'data-retention-review',
+      ),
+      intent(
+        roleId('api-database-records') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      intent(
+        roleId('api-database-records') + '.event-bus',
+        { kind: 'link', name: 'foundation-event-bus' },
+        ['events:PutEvents'],
+        [context.eventBusArn],
+      ),
+      lambdaVpcIntent(roleId('api-database-records')),
+    ]),
+    lambda('api-publish-created', 'event-publisher', [
+      intent(
+        roleId('api-publish-created') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      intent(
+        roleId('api-publish-created') + '.event-bus',
+        { kind: 'link', name: 'foundation-event-bus' },
+        ['events:PutEvents'],
+        [context.eventBusArn],
+      ),
+      lambdaVpcIntent(roleId('api-publish-created')),
+    ]),
+    lambda('async-outbox-relay', 'async-outbox-relay', [
+      intent(
+        roleId('async-outbox-relay') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      intent(
+        roleId('async-outbox-relay') + '.event-bus',
+        { kind: 'link', name: 'foundation-event-bus' },
+        ['events:PutEvents'],
+        [context.eventBusArn],
+      ),
+      lambdaVpcIntent(roleId('async-outbox-relay')),
+    ]),
+    lambda('async-inbox-cleanup', 'async-inbox-cleanup', [
+      intent(
+        roleId('async-inbox-cleanup') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      lambdaVpcIntent(roleId('async-inbox-cleanup')),
+    ]),
+    lambda('async-provider-worker', 'async-provider-worker', [
+      {
+        ...intent(
+          roleId('async-provider-worker') + '.active-configuration',
+          { kind: 'link', name: 'active-configuration' },
+          [
+            'appconfig:GetLatestConfiguration',
+            'appconfig:StartConfigurationSession',
+          ],
+          [
+            arn(
+              context,
+              'appconfig',
+              'application/*/environment/*/configuration/*',
+            ),
+          ],
+        ),
+        conditions: {
+          StringEquals: {
+            'aws:ResourceTag/ebk:slice': '${name}',
+            'aws:ResourceTag/ebk:stage': context.stage,
+          },
+        },
+      },
+      intent(
+        roleId('async-provider-worker') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      intent(
+        roleId('async-provider-worker') + '.queue-consume',
+        { kind: 'permissions', name: 'provider-queue-subscription' },
+        [
+          'sqs:ChangeMessageVisibility',
+          'sqs:DeleteMessage',
+          'sqs:GetQueueAttributes',
+          'sqs:GetQueueUrl',
+          'sqs:ReceiveMessage',
+        ],
+        [arn(context, 'sqs', names.providerQueue)],
+      ),
+      lambdaVpcIntent(roleId('async-provider-worker')),
+    ]),
+    lambda('async-schedule-target', 'async-schedule-target', [
+      intent(
+        roleId('async-schedule-target') + '.provider-queue',
+        { kind: 'link', name: 'provider-queue' },
+        ['sqs:SendMessage'],
+        [arn(context, 'sqs', names.providerQueue)],
+      ),
+    ]),
+    lambda('async-webhook-ingress', 'async-webhook-ingress', [
+      intent(
+        roleId('async-webhook-ingress') + '.provider-queue',
+        { kind: 'link', name: 'provider-queue' },
+        ['sqs:SendMessage'],
+        [arn(context, 'sqs', names.providerQueue)],
+      ),
+      intent(
+        roleId('async-webhook-ingress') + '.receipt-ledger',
+        { kind: 'framework', name: 'async-webhook-receipt-ledger' },
+        ['dynamodb:GetItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem'],
+        [
+          arn(
+            context,
+            'dynamodb',
+            'table/' + names.asyncRecoveryLedger,
+          ),
+        ],
+      ),
+    ]),
+    {
+      intents: [
+        intent(
+          roleId('async-workflow-orchestration') + '.workflow-task',
+          { kind: 'permissions', name: 'async-workflow-task' },
+          ['lambda:InvokeFunction'],
+          [
+            arn(
+              context,
+              'lambda',
+              'function:' + names.workflowTaskFunction,
+            ),
+          ],
+        ),
+      ],
+      roleId: roleId('async-workflow-orchestration'),
+    },
+    lambda('async-workflow-task', 'async-workflow-task', [
+      intent(
+        roleId('async-workflow-task') + '.cancellation-ledger',
+        { kind: 'framework', name: 'async-workflow-cancellation-ledger' },
+        ['dynamodb:GetItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem'],
+        [
+          arn(
+            context,
+            'dynamodb',
+            'table/' + names.asyncRecoveryLedger,
+          ),
+        ],
+      ),
+    ]),
+    {
+      intents: [
+        intent(
+          roleId('configuration-monitor') + '.describe-alarms',
+          { kind: 'framework', name: 'appconfig-alarm-monitor' },
+          ['cloudwatch:DescribeAlarms'],
+          ['*'],
+          'CloudWatch DescribeAlarms does not support resource-level permissions.',
+        ),
+      ],
+      roleId: roleId('configuration-monitor'),
+    },
+    lambda('data-export-cleanup', 'job-data-export-cleanup', [
+      intent(
+        roleId('data-export-cleanup') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      ...dataExportStorageIntents(
+        context,
+        roleId('data-export-cleanup'),
+        'cleanup',
+      ),
+      lambdaVpcIntent(roleId('data-export-cleanup')),
+    ]),
+    lambda('event-consumer', 'event-consumer', [
+      intent(
+        roleId('event-consumer') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      intent(
+        roleId('event-consumer') + '.queue-consume',
+        { kind: 'permissions', name: 'event-queue-subscription' },
+        [
+          'sqs:ChangeMessageVisibility',
+          'sqs:DeleteMessage',
+          'sqs:GetQueueAttributes',
+          'sqs:GetQueueUrl',
+          'sqs:ReceiveMessage',
+        ],
+        [arn(context, 'sqs', names.eventQueue)],
+      ),
+      lambdaVpcIntent(roleId('event-consumer')),
+    ]),
+    lambda('machine-client-provisioner', 'machine-client-provisioner', [
+      intent(
+        roleId('machine-client-provisioner') + '.cognito-client',
+        {
+          kind: 'permissions',
+          name: 'machine-client-provisioning',
+        },
+        [
+          'cognito-idp:CreateUserPoolClient',
+          'cognito-idp:DeleteUserPoolClient',
+          'cognito-idp:DescribeUserPoolClient',
+          'cognito-idp:ListUserPoolClients',
+        ],
+        [context.identityUserPoolArn],
+      ),
+      intent(
+        roleId('machine-client-provisioner') + '.machine-secret',
+        {
+          kind: 'permissions',
+          name: 'machine-client-provisioning',
+        },
+        [
+          'secretsmanager:GetSecretValue',
+          'secretsmanager:PutSecretValue',
+          'secretsmanager:UpdateSecretVersionStage',
+        ],
+        [machineAuthorizationSecretArn(context)],
+      ),
+    ]),
+    lambda(
+      'machine-authorization-proof',
+      'machine-authorization-proof',
+      [
+        intent(
+          roleId('machine-authorization-proof') + '.machine-secret',
+          {
+            kind: 'permissions',
+            name: 'machine-authorization-proof',
+          },
+          ['secretsmanager:GetSecretValue'],
+          [machineAuthorizationSecretArn(context)],
+        ),
+      ],
+    ),
+    lambda('web-image-optimizer', 'next-image-optimizer', [
+      intent(
+        roleId('web-image-optimizer') + '.assets',
+        { kind: 'framework', name: 'next-image-optimizer' },
+        ['s3:GetObject'],
+        [
+          'arn:' +
+            context.partition +
+            ':s3:::' +
+            names.webAssetsBucket +
+            '/*',
+        ],
+      ),
+    ]),
+    lambda('web-revalidation-seeder', 'next-revalidation-seeder', [
+      intent(
+        roleId('web-revalidation-seeder') + '.tag-cache',
+        { kind: 'framework', name: 'next-revalidation-seeder' },
+        [
+          'dynamodb:BatchWriteItem',
+          'dynamodb:DescribeTable',
+          'dynamodb:PutItem',
+        ],
+        [nextTable],
+      ),
+    ]),
+    lambda(
+      'web-revalidation-subscriber',
+      'next-revalidation-subscriber',
+      [
+        intent(
+          roleId('web-revalidation-subscriber') + '.queue-consume',
+          { kind: 'framework', name: 'next-revalidation-subscriber' },
+          [
+            'sqs:ChangeMessageVisibility',
+            'sqs:DeleteMessage',
+            'sqs:GetQueueAttributes',
+            'sqs:GetQueueUrl',
+            'sqs:ReceiveMessage',
+          ],
+          [nextQueue],
+        ),
+      ],
+    ),
+    lambda('web-server', 'next-server', [
+      {
+        ...intent(
+          roleId('web-server') + '.active-configuration',
+          { kind: 'link', name: 'active-configuration' },
+          [
+            'appconfig:GetLatestConfiguration',
+            'appconfig:StartConfigurationSession',
+          ],
+          [
+            arn(
+              context,
+              'appconfig',
+              'application/*/environment/*/configuration/*',
+            ),
+          ],
+        ),
+        conditions: {
+          StringEquals: {
+            'aws:ResourceTag/ebk:slice': '${name}',
+            'aws:ResourceTag/ebk:stage': context.stage,
+          },
+        },
+      },
+      intent(
+        roleId('web-server') + '.cache-assets',
+        { kind: 'framework', name: 'next-server-cache' },
+        ['s3:DeleteObject', 's3:GetObject', 's3:ListBucket', 's3:PutObject'],
+        [
+          'arn:' + context.partition + ':s3:::' + names.webAssetsBucket,
+          'arn:' + context.partition + ':s3:::' + names.webAssetsBucket + '/*',
+        ],
+      ),
+      intent(
+        roleId('web-server') + '.tag-cache',
+        { kind: 'framework', name: 'next-server-cache' },
+        [
+          'dynamodb:BatchGetItem',
+          'dynamodb:BatchWriteItem',
+          'dynamodb:ConditionCheckItem',
+          'dynamodb:DeleteItem',
+          'dynamodb:DescribeTable',
+          'dynamodb:GetItem',
+          'dynamodb:GetRecords',
+          'dynamodb:GetShardIterator',
+          'dynamodb:PutItem',
+          'dynamodb:Query',
+          'dynamodb:Scan',
+          'dynamodb:UpdateItem',
+        ],
+        [nextTable, nextTable + '/*'],
+      ),
+      intent(
+        roleId('web-server') + '.revalidation-queue',
+        { kind: 'framework', name: 'next-server-cache' },
+        ['sqs:GetQueueAttributes', 'sqs:GetQueueUrl', 'sqs:SendMessage'],
+        [nextQueue],
+      ),
+      intent(
+        roleId('web-server') + '.database-secret',
+        { kind: 'secret-link', name: 'primary-database' },
+        ['secretsmanager:GetSecretValue'],
+        [secretArn(context, activeDatabase, 'readwrite')],
+      ),
+      intent(
+        roleId('web-server') + '.invalidate-cdn',
+        { kind: 'framework', name: 'next-server-cache' },
+        ['cloudfront:CreateInvalidation'],
+        [
+          'arn:' +
+            context.partition +
+            ':cloudfront::' +
+            context.accountId +
+            ':distribution/*',
+        ],
+      ),
+      lambdaVpcIntent(roleId('web-server')),
+    ]),
+    ...plan.provisioned.flatMap((database) =>
+      databaseContributions(context, database),
+    ),
+    ...dataRetentionContributions(context, activeDatabase),
+    // <ebk:workload-role-intent-contributions:start>
+    // <ebk:workload-role-intent-contributions:end>
+  ];
+  const secretAccess = new Map(
+    standardSliceSecretAccessPlan(
+      context,
+      topology,
+      secretReferences,
+    ).map((entry) => [entry.workload, entry]),
+  );
+  const uncomposedSecretAccess = new Set(secretAccess.keys());
+  const contributionsWithSecretAccess = contributions.map((contribution) => {
+    const entries: SecretWorkloadAccessPlanEntry[] = [];
+    const direct = secretAccess.get(contribution.roleId);
+    if (direct) {
+      entries.push(direct);
+      uncomposedSecretAccess.delete(contribution.roleId);
+    }
+    const performanceMatch = /^(.*)-service-performance-task$/.exec(
+      contribution.roleId,
+    );
+    if (performanceMatch?.[1]) {
+      const base = secretAccess.get(
+        performanceMatch[1] + '-service-task',
+      );
+      if (base) entries.push(base);
+    }
+    if (entries.length === 0) return contribution;
+    return {
+      ...contribution,
+      intents: [
+        ...contribution.intents,
+        ...entries.flatMap((entry) => entry.intent.links).map((link) =>
+          intent(
+            'operator-secret.' +
+              createHash('sha256')
+                .update(
+                  contribution.roleId +
+                    '\\0' +
+                    link.link.properties.logicalName,
+                  'utf8',
+                )
+                .digest('hex')
+                .slice(0, 32),
+            {
+              kind: 'secret-link',
+              name: link.link.properties.logicalName,
+            },
+            [...link.permission.Action],
+            [...link.permission.Resource],
+          ),
+        ),
+      ],
+    };
+  });
+  if (uncomposedSecretAccess.size > 0) {
+    throw new Error(
+      'Secret workload access did not compose into an exact Standard Slice role.',
+    );
+  }
+  return composeStandardSliceWorkloadRoleIntentSource(
+    topology,
+    contributionsWithSecretAccess,
+  );
+}
+
+/**
+ * Composes the exact framework/link/permission/secret-link provenance emitted
+ * by resource renderers. Missing, duplicate, and undeclared role IDs fail
+ * before candidate digest construction. An explicit empty intent array is a
+ * valid deny-all policy for a role that calls no AWS APIs.
+ */
+export function composeStandardSliceWorkloadRoleIntentSource(
+  topology: StandardSliceWorkloadRoleTopology,
+  contributions: readonly StandardSliceWorkloadRoleIntentContribution[],
+): Readonly<Record<string, readonly WorkloadRolePermissionIntent[]>> {
+  const expected = new Set(topology.roles.map(({ id }) => id));
+  const source: Record<string, readonly WorkloadRolePermissionIntent[]> = {};
+  for (const contribution of contributions) {
+    if (
+      !expected.has(contribution.roleId) ||
+      Object.prototype.hasOwnProperty.call(source, contribution.roleId)
+    ) {
+      throw new Error(
+        'Standard Slice workload-role intent source is incomplete, duplicated, or substituted.',
+      );
+    }
+    source[contribution.roleId] = contribution.intents;
+  }
+  const missing = [...expected].filter(
+    (roleId) => !Object.prototype.hasOwnProperty.call(source, roleId),
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      'Standard Slice workload-role intent source is missing: ' +
+        missing.sort().join(', '),
+    );
+  }
+  return source;
+}
+`,
+        'infra/workload-roles/injection.ts': `import {
+  createRawAppConfigMonitorRoleInput,
+  createRawStepFunctionsRoleInput,
+  createSstFargateRoleInput,
+  createSstFunctionRoleInput,
+  type ExactProvisionedWorkloadRoleRegistry,
+} from '@empire-builder-kit/nx/workload-roles';
+
+const roleId = (resource: string) => '${name}.' + resource;
+
+export function createStandardSliceWorkloadRoleBindings(
+  registry: ExactProvisionedWorkloadRoleRegistry,
+) {
+  const functionRole = (resource: string) =>
+    createSstFunctionRoleInput(registry, roleId(resource));
+  const fargateRoles = (resource: string, kind: 'bootstrap' | 'job' | 'migration' | 'retirement' | 'service') =>
+    createSstFargateRoleInput(registry, {
+      executionRoleId: roleId(resource + '-' + kind + '-execution'),
+      taskRoleId: roleId(resource + '-' + kind + '-task'),
+    });
+  const servicePerformanceRoles = (resource: string) =>
+    createSstFargateRoleInput(registry, {
+      executionRoleId: roleId(resource + '-service-execution'),
+      taskRoleId: roleId(resource + '-service-performance-task'),
+    });
+  const orchestrationRole = (
+    database: string,
+    kind: 'migration' | 'retirement',
+  ) =>
+    createRawStepFunctionsRoleInput(
+      registry,
+      roleId('database-' + database + '-' + kind + '-orchestration'),
+    );
+
+  return {
+    api: {
+      dataRights: functionRole('api-data-rights'),
+      databaseHealth: functionRole('api-database-health'),
+      databaseRecords: functionRole('api-database-records'),
+      delegations: functionRole('api-delegations'),
+      health: functionRole('api-health'),
+      machineAuthorizationProof: functionRole(
+        'api-machine-authorization-proof',
+      ),
+      protected: functionRole('api-protected'),
+      publishCreated: functionRole('api-publish-created'),
+    },
+    authorization: {
+      provisioner: functionRole('machine-client-provisioner'),
+      proof: functionRole('machine-authorization-proof'),
+    },
+    configuration: {
+      monitor: createRawAppConfigMonitorRoleInput(
+        registry,
+        roleId('configuration-monitor'),
+      ),
+    },
+    async: {
+      inboxCleanup: functionRole('async-inbox-cleanup'),
+      outboxRelay: functionRole('async-outbox-relay'),
+      providerWorker: functionRole('async-provider-worker'),
+      scheduleTarget: functionRole('async-schedule-target'),
+      webhookIngress: functionRole('async-webhook-ingress'),
+      workflowOrchestration: createRawStepFunctionsRoleInput(
+        registry,
+        roleId('async-workflow-orchestration'),
+      ),
+      workflowTask: functionRole('async-workflow-task'),
+    },
+    database(database: string) {
+      const resource = 'database-' + database;
+      const retirement =
+        database === 'retirement_rehearsal'
+          ? {
+              orchestration: orchestrationRole(database, 'retirement'),
+              task: fargateRoles(resource, 'retirement'),
+            }
+          : undefined;
+      return {
+        bootstrap: fargateRoles(resource, 'bootstrap'),
+        migration: fargateRoles(resource, 'migration'),
+        migrationOrchestration: orchestrationRole(database, 'migration'),
+        retirement,
+      };
+    },
+    dataRetention: {
+      maintenance: {
+        launcher: functionRole('data-retention-maintenance-launcher'),
+        task: fargateRoles('data-retention-maintenance', 'job'),
+      },
+      orchestration: createRawStepFunctionsRoleInput(
+        registry,
+        roleId('data-retention-job-orchestration'),
+      ),
+      task: fargateRoles('data-retention', 'job'),
+    },
+    dataExport: {
+      cleanup: functionRole('data-export-cleanup'),
+    },
+    extension: {
+      function(id: string) {
+        return functionRole(id + '-function');
+      },
+      job(id: string) {
+        return fargateRoles(id, 'job');
+      },
+      service(id: string) {
+        return fargateRoles(id, 'service');
+      },
+      servicePerformance(id: string) {
+        return servicePerformanceRoles(id);
+      },
+    },
+    next: {
+      imageOptimizer: functionRole('web-image-optimizer'),
+      revalidationSeeder: functionRole('web-revalidation-seeder'),
+      revalidationSubscriber: functionRole(
+        'web-revalidation-subscriber',
+      ),
+      server: functionRole('web-server'),
+    },
+    queue: {
+      eventConsumer: functionRole('event-consumer'),
+    },
+  };
+}
+`,
+        'infra/workload-roles/report.ts': `import {
+  createRegisteredWorkloadRoleManifestDocument,
+  digestWorkloadRoleManifest,
+  workloadRoleProvisionerAliasArn,
+} from '@empire-builder-kit/nx/workload-roles';
+import { createStandardSliceCandidate } from './candidate.js';
+import { discoverStandardSliceWorkloadRoleCandidate } from './preflight.js';
+
+/**
+ * Builds the exact registered candidate document from generated intent and
+ * read-only AWS discovery. It does not read an existing workload-role
+ * registration and has no mutation client.
+ */
+export async function reportWorkloadRoleCandidate(options: {
+  candidateIdentity: string;
+  region: string;
+  stage: string;
+}) {
+  const discovery =
+    await discoverStandardSliceWorkloadRoleCandidate(options);
+  const candidate = createStandardSliceCandidate({
+    accountId: discovery.accountId,
+    candidateIdentity: discovery.candidateIdentity,
+    intentContext: discovery.intentContext,
+    partition: discovery.partition,
+    secretReferences: discovery.secretReferences,
+    stage: discovery.stage,
+  });
+  const manifestDigest = digestWorkloadRoleManifest(candidate.manifest);
+  return createRegisteredWorkloadRoleManifestDocument({
+    accountId: discovery.accountId,
+    intentsByRole: candidate.intentsByRole,
+    manifest: candidate.manifest,
+    partition: discovery.partition,
+    project: '${name}',
+    provisionerFunctionArn: workloadRoleProvisionerAliasArn({
+      accountId: discovery.accountId,
+      manifestDigest,
+      partition: discovery.partition,
+      project: '${name}',
+      region: discovery.region,
+      stage: discovery.stage,
+    }),
+  });
+}
+`,
+        'infra/workload-roles/preflight.ts': `import {
+  DescribeSecretCommand,
+  SecretsManagerClient,
+} from '@aws-sdk/client-secrets-manager';
+import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
+import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
+import {
+  foundationSsmPath,
+  resolveFoundationStages,
+} from '@empire-builder-kit/nx/foundation';
+import {
+  canonicalOperatorSecretName,
+  canonicalOperatorSecretTags,
+  isExactSecretArn,
+  isRotationCompliant,
+  validateObservedSecretMetadata,
+  type SecretManagementScope,
+  type SecretMetadataDeclaration,
+  type WorkloadSecretReferenceInput,
+} from '@empire-builder-kit/nx/secrets';
+import {
+  digestWorkloadRoleManifest,
+  provisionedWorkloadRoleRegistrationObjectKey,
+  registeredWorkloadRoleManifestObjectKey,
+  requireRegisteredWorkloadRoleManifestDocument,
+  requireWorkloadRoleStorageRegistration,
+  validateWorkloadRolePreflight,
+  workloadRoleStorageRegistrationPath,
+} from '@empire-builder-kit/nx/workload-roles';
+import {
+  createStandardSliceWorkloadRoleTopology,
+  recreateRegisteredStandardSliceCandidate,
+} from './candidate.js';
+import {
+  standardSliceBoundOperatorSecretDeclarations,
+  standardSliceSecretAccessPlan,
+} from './effective-intent.js';
+import { createStandardSliceWorkloadRoleBindings } from './injection.js';
+
+function requiredRegion(): string {
+  const value = (
+    process.env.AWS_REGION ??
+    process.env.AWS_DEFAULT_REGION ??
+    ''
+  ).trim();
+  if (!/^[a-z]{2}(?:-gov)?-[a-z]+-\\d$/.test(value)) {
+    throw new Error(
+      'Protected workload-role preflight requires one explicit AWS Region.',
+    );
+  }
+  return value;
+}
+
+function requiredCandidateIdentity(): string {
+  const value = process.env.EBK_CANDIDATE_IDENTITY?.trim();
+  if (!value || !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(value)) {
+    throw new Error(
+      'EBK_CANDIDATE_IDENTITY must name the exact protected candidate.',
+    );
+  }
+  return value;
+}
+
+async function readParameterValue(
+  ssm: SSMClient,
+  path: string,
+): Promise<string> {
+  const response = await ssm.send(
+    new GetParameterCommand({ Name: path, WithDecryption: false }),
+  );
+  const value = response.Parameter?.Value;
+  if (!value) {
+    throw new Error('Required workload-role registration is absent.');
+  }
+  return value;
+}
+
+async function readFixedParameter(
+  ssm: SSMClient,
+  path: string,
+): Promise<unknown> {
+  const value = await readParameterValue(ssm, path);
+  try {
+    return JSON.parse(value) as unknown;
+  } catch {
+    throw new Error('Required workload-role registration is malformed.');
+  }
+}
+
+async function readFixedObject(
+  s3: S3Client,
+  bucketName: string,
+  key: string,
+): Promise<unknown> {
+  const response = await s3.send(
+    new GetObjectCommand({ Bucket: bucketName, Key: key }),
+  );
+  if (!response.Body) {
+    throw new Error('Required workload-role object is absent.');
+  }
+  try {
+    return JSON.parse(await response.Body.transformToString()) as unknown;
+  } catch {
+    throw new Error('Required workload-role object is malformed.');
+  }
+}
+
+async function observeOperatorSecretReferences(input: {
+  accountId: string;
+  client: SecretsManagerClient;
+  declarations: readonly SecretMetadataDeclaration[];
+  partition: string;
+  region: string;
+  stage: string;
+}): Promise<readonly WorkloadSecretReferenceInput[]> {
+  const scope: SecretManagementScope = {
+    slice: '${name}',
+    stage: input.stage,
+    workspace: '${workspace}',
+  };
+  return Object.freeze(
+    await Promise.all(
+      input.declarations.map(async (declaration) => {
+        const name = canonicalOperatorSecretName(
+          scope,
+          declaration.logicalName,
+        );
+        const response = await input.client.send(
+          new DescribeSecretCommand({ SecretId: name }),
+        );
+        const arn = response.ARN ?? '';
+        const arnPrefix =
+          'arn:' +
+          input.partition +
+          ':secretsmanager:' +
+          input.region +
+          ':' +
+          input.accountId +
+          ':secret:' +
+          name +
+          '-';
+        const suffix = arn.startsWith(arnPrefix)
+          ? arn.slice(arnPrefix.length)
+          : '';
+        const tags: Record<string, string> = {};
+        for (const tag of response.Tags ?? []) {
+          if (
+            !tag.Key ||
+            tag.Value === undefined ||
+            Object.prototype.hasOwnProperty.call(tags, tag.Key)
+          ) {
+            throw new Error(
+              'Protected operator-secret metadata is malformed.',
+            );
+          }
+          tags[tag.Key] = tag.Value;
+        }
+        const versionStages = Object.values(
+          response.VersionIdsToStages ?? {},
+        ).flatMap((stages) => stages ?? []);
+        const observed = {
+          arn,
+          name: response.Name ?? '',
+          rotationEnabled: response.RotationEnabled === true,
+          tags,
+          versionStages,
+        };
+        validateObservedSecretMetadata(observed);
+        const expectedTags = canonicalOperatorSecretTags(
+          scope,
+          declaration,
+        );
+        if (
+          response.DeletedDate ||
+          observed.name !== name ||
+          !isExactSecretArn(arn) ||
+          !/^[A-Za-z0-9]{6}$/.test(suffix) ||
+          !versionStages.includes('AWSCURRENT') ||
+          !isRotationCompliant(declaration, observed) ||
+          Object.entries(expectedTags).some(
+            ([key, value]) => tags[key] !== value,
+          )
+        ) {
+          throw new Error(
+            'Protected operator-secret metadata is not deployment ready.',
+          );
+        }
+        return {
+          logicalName: declaration.logicalName,
+          provider: 'aws-secrets-manager' as const,
+          secretArn: arn,
+        };
+      }),
+    ),
+  );
+}
+
+export async function discoverStandardSliceWorkloadRoleCandidate(options: {
+  candidateIdentity: string;
+  region: string;
+  stage: string;
+}) {
+  if (
+    !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(options.candidateIdentity) ||
+    !/^[a-z]{2}(?:-gov)?-[a-z]+-\\d$/.test(options.region) ||
+    !['development', 'staging', 'production'].includes(options.stage)
+  ) {
+    throw new Error(
+      'Protected workload-role candidate discovery input is invalid.',
+    );
+  }
+  const secrets = new SecretsManagerClient({ region: options.region });
+  const ssm = new SSMClient({ region: options.region });
+  const identity = await new STSClient({ region: options.region }).send(
+    new GetCallerIdentityCommand({}),
+  );
+  const accountId = identity.Account;
+  const partition = /^arn:([^:]+):/.exec(identity.Arn ?? '')?.[1];
+  if (
+    !accountId ||
+    !/^\\d{12}$/.test(accountId) ||
+    !partition ||
+    !['aws', 'aws-cn', 'aws-us-gov'].includes(partition)
+  ) {
+    throw new Error(
+      'Protected workload-role candidate discovery could not prove the current AWS account and partition.',
+    );
+  }
+  const foundationStage = resolveFoundationStages({
+    consumerStage: options.stage,
+    foundationStage: process.env.EBK_FOUNDATION_STAGE,
+  }).foundationStage;
+  const [
+    clusterId,
+    clusterResourceId,
+    eventBusArn,
+    identityUserPoolArn,
+    masterSecretArn,
+  ] = await Promise.all([
+      readParameterValue(
+        ssm,
+        foundationSsmPath(foundationStage, 'clusterId'),
+      ),
+      readParameterValue(
+        ssm,
+        foundationSsmPath(foundationStage, 'databaseClusterResourceId'),
+      ),
+      readParameterValue(
+        ssm,
+        foundationSsmPath(foundationStage, 'eventBusArn'),
+      ),
+      readParameterValue(
+        ssm,
+        foundationSsmPath(foundationStage, 'identityUserPoolArn'),
+      ),
+      readParameterValue(
+        ssm,
+        foundationSsmPath(foundationStage, 'databaseMasterSecretArn'),
+      ),
+    ]);
+  const clusterArnPrefix =
+    'arn:' +
+    partition +
+    ':ecs:' +
+    options.region +
+    ':' +
+    accountId +
+    ':cluster/';
+  if (
+    !clusterId.startsWith(clusterArnPrefix) ||
+    !/^[A-Za-z0-9_-]{1,255}$/.test(clusterId.slice(clusterArnPrefix.length))
+  ) {
+    throw new Error(
+      'Foundation cluster registration differs from the active AWS identity.',
+    );
+  }
+  const userPoolArnPrefix =
+    'arn:' +
+    partition +
+    ':cognito-idp:' +
+    options.region +
+    ':' +
+    accountId +
+    ':userpool/';
+  if (
+    !identityUserPoolArn.startsWith(userPoolArnPrefix) ||
+    !/^[A-Za-z0-9_-]+$/.test(
+      identityUserPoolArn.slice(userPoolArnPrefix.length),
+    )
+  ) {
+    throw new Error(
+      'Foundation identity registration differs from the active AWS identity.',
+    );
+  }
+  const intentContext = {
+    accountId,
+    clusterName: clusterId.slice(clusterArnPrefix.length),
+    clusterResourceId,
+    eventBusArn,
+    identityUserPoolArn,
+    masterSecretArn,
+    partition,
+    region: options.region,
+    stage: options.stage,
+  };
+  const topology = createStandardSliceWorkloadRoleTopology(options.stage);
+  const secretReferences = await observeOperatorSecretReferences({
+    accountId,
+    client: secrets,
+    declarations: standardSliceBoundOperatorSecretDeclarations(
+      options.stage,
+      topology,
+    ),
+    partition,
+    region: options.region,
+    stage: options.stage,
+  });
+  return {
+    accountId,
+    candidateIdentity: options.candidateIdentity,
+    intentContext,
+    partition,
+    region: options.region,
+    secretReferences,
+    stage: options.stage,
+    topology,
+  };
+}
+
+/**
+ * Must run and resolve before importing infra/index.ts or constructing any SST
+ * component. It reads one protected SSM pointer and two digest-keyed S3
+ * objects, then returns the sole role registry, injection bindings, and
+ * ordinary deployment-authority plan.
+ */
+export async function preflightStandardSliceWorkloadRoles(stage: string) {
+  const region = requiredRegion();
+  const s3 = new S3Client({ region });
+  const ssm = new SSMClient({ region });
+  const candidateIdentity = requiredCandidateIdentity();
+  const discovery = await discoverStandardSliceWorkloadRoleCandidate({
+    candidateIdentity,
+    region,
+    stage,
+  });
+  const storageValue = await readFixedParameter(
+    ssm,
+    workloadRoleStorageRegistrationPath(stage, '${name}'),
+  );
+  const storage = requireWorkloadRoleStorageRegistration(storageValue);
+  if (
+    storage.candidateIdentity !== candidateIdentity ||
+    storage.project !== '${name}' ||
+    storage.stage !== stage
+  ) {
+    throw new Error(
+      'Protected workload-role storage registration differs from this deployment.',
+    );
+  }
+  const registeredValue = await readFixedObject(
+    s3,
+    storage.bucketName,
+    registeredWorkloadRoleManifestObjectKey({
+      manifestDigest: storage.manifestDigest,
+      project: '${name}',
+      provisionerFunctionArn: storage.provisionerFunctionArn,
+      stage,
+    }),
+  );
+  const registered =
+    requireRegisteredWorkloadRoleManifestDocument(registeredValue);
+  if (
+    registered.accountId !== discovery.accountId ||
+    registered.partition !== discovery.partition
+  ) {
+    throw new Error(
+      'Protected workload-role registration differs from the active AWS identity.',
+    );
+  }
+  const recreated = recreateRegisteredStandardSliceCandidate(
+    registered,
+    discovery.intentContext,
+    discovery.secretReferences,
+  );
+  if (
+    digestWorkloadRoleManifest(recreated.manifest) !== registered.manifestDigest ||
+    registered.manifestDigest !== storage.manifestDigest ||
+    JSON.stringify(recreated.intentsByRole) !==
+      JSON.stringify(registered.intentsByRole)
+  ) {
+    throw new Error(
+      'Protected workload-role registration differs from generated Standard Slice intent.',
+    );
+  }
+  const provisionedValue = await readFixedObject(
+    s3,
+    storage.bucketName,
+    provisionedWorkloadRoleRegistrationObjectKey({
+      manifestDigest: storage.manifestDigest,
+      project: '${name}',
+      provisionerFunctionArn: storage.provisionerFunctionArn,
+      stage,
+    }),
+  );
+  const preflight = validateWorkloadRolePreflight({
+    expectedCandidateIdentity: candidateIdentity,
+    expectedProject: '${name}',
+    expectedStage: stage,
+    provisionedRegistration: provisionedValue,
+    registeredManifest: registeredValue,
+    storageRegistration: storage,
+  });
+  return {
+    authorityPlan: preflight.authorityPlan,
+    bindings: createStandardSliceWorkloadRoleBindings(preflight.registry),
+    intentContext: discovery.intentContext,
+    registry: preflight.registry,
+    secretAccess: standardSliceSecretAccessPlan(
+      discovery.intentContext,
+      discovery.topology,
+      discovery.secretReferences,
+    ),
+  };
+}
+
+export type StandardSliceWorkloadRolePreflight = Awaited<
+  ReturnType<typeof preflightStandardSliceWorkloadRoles>
+>;
+`,
+        'infra/workload-roles/index.ts': `export * from './candidate.js';
+export * from './effective-intent.js';
+export * from './injection.js';
+export * from './preflight.js';
+export * from './report.js';
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-workload-role-files.js.map