@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-infrastructure-files.js

@@ -0,0 +1,3038 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductInfrastructureFiles = renderProductInfrastructureFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** @internal */
+function renderProductInfrastructureFiles(name, pascalName, workspace) {
+    const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
+    const recordExportWorkflowName = (0, built_in_plan_shared_js_1.stableGeneratedName)(40, name);
+    return {
+        'jobs/data-retention-maintenance-launcher.ts': `import {
+  ECSClient,
+  RunTaskCommand,
+} from '@aws-sdk/client-ecs';
+import { createLogger } from '@empire-builder-kit/runtime/logging';
+
+const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const ECS_CLUSTER_ARN =
+  new RegExp(
+    '^arn:(?:aws|aws-cn|aws-us-gov):ecs:[a-z0-9-]+:' +
+      '[0-9]{12}:cluster/[A-Za-z0-9_./-]{1,255}$',
+  );
+const ECS_TASK_DEFINITION_ARN =
+  /^arn:(?:aws|aws-cn|aws-us-gov):ecs:[a-z0-9-]+:[0-9]{12}:task-definition\\/[A-Za-z0-9_-]{1,255}:[1-9][0-9]*$/;
+const NETWORK_ID = /^(?:sg|subnet)-[0-9a-f]{8,32}$/;
+const CONTAINER_NAME = /^[A-Za-z0-9_-]{1,255}$/;
+
+function required(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(name + ' is required.');
+  return value;
+}
+
+function requiredArn(name: string, pattern: RegExp): string {
+  const value = required(name);
+  if (!pattern.test(value)) {
+    throw new Error(name + ' is not the exact expected ECS ARN.');
+  }
+  return value;
+}
+
+function requiredBoolean(name: string): boolean {
+  const value = required(name);
+  if (value !== 'true' && value !== 'false') {
+    throw new Error(name + ' must be exactly true or false.');
+  }
+  return value === 'true';
+}
+
+function requiredNetworkIds(name: string): string[] {
+  let value: unknown;
+  try {
+    value = JSON.parse(required(name));
+  } catch {
+    throw new Error(name + ' must be one bounded JSON array.');
+  }
+  if (
+    !Array.isArray(value) ||
+    value.length < 1 ||
+    value.length > 16 ||
+    value.some(
+      (entry) => typeof entry !== 'string' || !NETWORK_ID.test(entry),
+    )
+  ) {
+    throw new Error(name + ' must contain only exact AWS network IDs.');
+  }
+  return value;
+}
+
+function requiredScheduledEventId(event: unknown): string {
+  const id =
+    event && typeof event === 'object' && 'id' in event
+      ? (event as { id?: unknown }).id
+      : undefined;
+  if (typeof id !== 'string' || !UUID.test(id)) {
+    throw new Error('Scheduled maintenance requires one exact event ID.');
+  }
+  return id.toLowerCase();
+}
+
+export async function handler(event: unknown) {
+  const stage = required('EBK_STAGE');
+  const logger = createLogger({
+    component: 'job-data-retention-maintenance-launcher',
+    feature: 'data-lifecycle',
+    operation: 'retention-maintenance-launch',
+    slice: '${name}',
+    stage,
+    workspace: required('EBK_WORKSPACE'),
+  });
+  const correlationId = requiredScheduledEventId(event);
+  try {
+    const containerName = required('EBK_MAINTENANCE_CONTAINER_NAME');
+    if (!CONTAINER_NAME.test(containerName)) {
+      throw new Error('Maintenance container name is invalid.');
+    }
+    const response = await new ECSClient({}).send(
+      new RunTaskCommand({
+        cluster: requiredArn('EBK_MAINTENANCE_CLUSTER_ARN', ECS_CLUSTER_ARN),
+        count: 1,
+        enableExecuteCommand: false,
+        launchType: 'FARGATE',
+        networkConfiguration: {
+          awsvpcConfiguration: {
+            assignPublicIp:
+              requiredBoolean('EBK_MAINTENANCE_ASSIGN_PUBLIC_IP')
+                ? 'ENABLED'
+                : 'DISABLED',
+            securityGroups: requiredNetworkIds(
+              'EBK_MAINTENANCE_SECURITY_GROUP_IDS',
+            ),
+            subnets: requiredNetworkIds('EBK_MAINTENANCE_SUBNET_IDS'),
+          },
+        },
+        overrides: {
+          containerOverrides: [
+            {
+              command: [
+                'node',
+                'dist/jobs/data-retention/src/maintenance.js',
+              ],
+              environment: [
+                {
+                  name: 'EBK_MAINTENANCE_CORRELATION_ID',
+                  value: correlationId,
+                },
+              ],
+              name: containerName,
+            },
+          ],
+        },
+        taskDefinition: requiredArn(
+          'EBK_MAINTENANCE_TASK_DEFINITION_ARN',
+          ECS_TASK_DEFINITION_ARN,
+        ),
+      }),
+    );
+    if (
+      (response.failures?.length ?? 0) !== 0 ||
+      response.tasks?.length !== 1 ||
+      !response.tasks[0]?.taskArn
+    ) {
+      throw new Error('ECS did not accept exactly one maintenance task.');
+    }
+    logger.info('Retention maintenance task launched', {
+      attributes: { launchCount: 1 },
+      outcome: 'success',
+    });
+    return { accepted: true };
+  } catch (error) {
+    logger.error('Retention maintenance task launch failed', {
+      attributes: {
+        errorCode:
+          error instanceof Error
+            ? error.name.replace(/[^A-Za-z0-9_.-]/g, '').slice(0, 80)
+            : 'RetentionMaintenanceLaunchError',
+      },
+      outcome: 'failure',
+    });
+    throw error;
+  }
+}
+`,
+        'infra/product.ts': `import {
+  createManagedLogGroupContract,
+  createRouterOriginProofInjection,
+  provisionDatabaseBindings,
+} from '@empire-builder-kit/nx/foundation';
+import { validateReleaseManifest } from '@empire-builder-kit/nx/release';
+import * as random from '@pulumi/random';
+import { createHash } from 'node:crypto';
+import {
+  lstatSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+} from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import {
+  ${identifierPrefix}CleanupRecordExport,
+  ${identifierPrefix}DatabaseHealth,
+  ${identifierPrefix}DecideRecordExport,
+  ${identifierPrefix}DecideRecordDeletion,
+  ${identifierPrefix}DeliverRecordExport,
+  ${identifierPrefix}DeleteRecord,
+  ${identifierPrefix}ExecuteRecordExport,
+  ${identifierPrefix}ExpireRecordHold,
+  ${identifierPrefix}GetRecord,
+  ${identifierPrefix}Health,
+  ${identifierPrefix}IssueRecordDelegation,
+  ${identifierPrefix}IssueRecordHold,
+  ${identifierPrefix}MachineAuthorizationProof,
+  ${identifierPrefix}ProtectedExample,
+  ${identifierPrefix}PublishCreated,
+  ${identifierPrefix}PutRecord,
+  ${identifierPrefix}DecideRetentionApproval,
+  ${identifierPrefix}ReleaseRecordHold,
+  ${identifierPrefix}RequestRecordExport,
+  ${identifierPrefix}RequestRecordDeletion,
+  ${identifierPrefix}RequestRetentionApproval,
+  ${identifierPrefix}ReviewRecordHold,
+  ${identifierPrefix}RevokeRecordDelegation,
+  ${identifierPrefix}UseRecordDelegation,
+} from '../api/contracts/protected.js';
+import lifecycleConsumers from '../data/lifecycle-consumers.json';
+import databaseBindings from '../database/bindings.json';
+import localConfiguration from '../configuration/local-values.json';
+import { ConfigurationDeclarations } from '../configuration/declarations.js';
+import { assertAsyncAdapterDeploymentReady } from '../async/recovery-adapters.js';
+import {
+  getFoundationInfrastructure,
+  registerProductMigration,
+  registerProductRetention,
+} from './foundation.js';
+import {
+  standardSliceDatabaseTaskFamily,
+  standardSliceResourceNames,
+} from './workload-roles/effective-intent.js';
+import type { StandardSliceWorkloadRolePreflight } from './workload-roles/preflight.js';
+import { createStandardSliceSecretLinks } from './personal-secrets.js';
+import { create${pascalName}PerformanceCostControls } from './performance-cost-controls.js';
+import {
+  createStandardSliceMachineAuthorization,
+  standardSliceMachineClientProvisionerPermissions,
+  type MachineCredentialGeneration,
+} from './authorization.js';
+import { createStandardDataExportStore } from './data-export.js';
+import { create${pascalName}Reliability } from './reliability.js';
+import { resolveStandardContainerImage } from './container-images.js';
+import {
+  defineEventConsumerAlarms,
+} from '@empire-builder-kit/runtime/observability';
+// <ebk:composition-imports:start>
+// <ebk:composition-imports:end>
+
+function protectedPerformanceDeploymentAuthority(input: {
+  enabled: string;
+  releaseSourceCommit: string;
+  stage: string;
+}) {
+  if (input.enabled !== 'true' && input.enabled !== 'false') {
+    throw new Error(
+      'EBK_PERFORMANCE_LOAD_ENABLED must equal true or false.',
+    );
+  }
+  if (input.enabled === 'false') return undefined;
+  if (input.stage !== 'staging' && input.stage !== 'production') {
+    throw new Error(
+      'Protected performance load can be deployed only to staging or production.',
+    );
+  }
+  const accountId = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+  const region = process.env.AWS_REGION?.trim() ?? '';
+  if (
+    !/^[0-9]{12}$/.test(accountId) ||
+    !/^(?:(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-(?:gov|iso|isob|isoe|isof))?|eusc-[a-z]{2})-[a-z]+-\\d$/.test(
+      region,
+    )
+  ) {
+    throw new Error(
+      'Protected performance load AWS target is absent or malformed.',
+    );
+  }
+  const candidateBytes = readFileSync(
+    new URL(
+      '../../../.ebk/evidence/release-candidate/packages/${name}/candidate.json',
+      import.meta.url,
+    ),
+  );
+  const candidate = JSON.parse(candidateBytes.toString('utf8')) as {
+    kind?: unknown;
+    schemaVersion?: unknown;
+    slice?: unknown;
+    sourceCommit?: unknown;
+  };
+  if (
+    candidate.kind !== 'ebk-release-candidate' ||
+    candidate.schemaVersion !== 1 ||
+    candidate.slice !== '${name}' ||
+    candidate.sourceCommit !== input.releaseSourceCommit ||
+    !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(input.releaseSourceCommit)
+  ) {
+    throw new Error(
+      'Protected performance load requires the exact deployed release candidate.',
+    );
+  }
+  const releaseManifestDirectory = new URL(
+    '../.ebk/evidence/release-manifests/',
+    import.meta.url,
+  );
+  const releaseManifestNames = readdirSync(releaseManifestDirectory).filter(
+    (entry) => /^release-[a-f0-9]{24}[.]json$/.test(entry),
+  );
+  if (releaseManifestNames.length !== 1) {
+    throw new Error(
+      'Protected performance load requires one exact deployed release manifest.',
+    );
+  }
+  const releaseManifestUrl = new URL(
+    releaseManifestNames[0]!,
+    releaseManifestDirectory,
+  );
+  const releaseManifestPath = fileURLToPath(releaseManifestUrl);
+  const releaseManifestMetadata = lstatSync(releaseManifestPath);
+  if (
+    !releaseManifestMetadata.isFile() ||
+    releaseManifestMetadata.isSymbolicLink() ||
+    releaseManifestMetadata.size <= 0 ||
+    releaseManifestMetadata.size > 10 * 1024 * 1024 ||
+    realpathSync(releaseManifestPath) !== releaseManifestPath
+  ) {
+    throw new Error(
+      'Protected performance load release manifest is not one bounded canonical file.',
+    );
+  }
+  const releaseManifest = validateReleaseManifest(
+    JSON.parse(readFileSync(releaseManifestPath, 'utf8')),
+    {
+      requireSupplyChain: true,
+      sourceCommit: input.releaseSourceCommit,
+    },
+  );
+  if (releaseManifestNames[0] !== releaseManifest.releaseId + '.json') {
+    throw new Error(
+      'Protected performance load release manifest path differs from its identity.',
+    );
+  }
+  return Object.freeze({
+    candidateDigest: createHash('sha256')
+      .update(candidateBytes)
+      .digest('hex'),
+    releaseId: releaseManifest.releaseId,
+    releaseMaterialDigest: releaseManifest.materialDigest,
+    target: Object.freeze({
+      accountFingerprint:
+        'sha256:' +
+        createHash('sha256').update(accountId, 'utf8').digest('hex'),
+      region,
+      slice: '${name}',
+      stage: input.stage as 'production' | 'staging',
+    }),
+  });
+}
+
+function managedLogGroup(
+  logicalName: string,
+  component: string,
+  alertTopicArn: any,
+  resource?: string,
+) {
+  const contract = managedLogContract(component, resource);
+  const logGroup = new aws.cloudwatch.LogGroup(logicalName, {
+    logGroupClass: contract.logGroupClass,
+    name: contract.name,
+    retentionInDays: contract.retentionInDays,
+    tags: contract.tags,
+  });
+  const dataProtection = managedLogDataProtection(
+    logicalName,
+    contract,
+    logGroup.name,
+    [logGroup],
+    alertTopicArn,
+  );
+  return { contract, dataProtection, logGroup };
+}
+
+function managedLogContract(component: string, resource?: string) {
+  return createManagedLogGroupContract({
+    component,
+    ...(resource ? { resource } : {}),
+    slice: '${name}',
+    stage: $app.stage,
+    workspace: '${workspace}',
+  });
+}
+
+function operationalAlarmDescription(input: {
+  businessSymptom: string;
+  id: string;
+  runbook: string;
+}) {
+  return JSON.stringify({
+    businessSymptom: input.businessSymptom,
+    id: input.id,
+    owner: '${name}-product',
+    route: '${name}-on-call',
+    runbook: input.runbook,
+    schemaVersion: 1,
+    slice: '${name}',
+  });
+}
+
+function managedLogDataProtection(
+  logicalName: string,
+  contract: ReturnType<typeof createManagedLogGroupContract>,
+  logGroupName: any,
+  dependsOn: any[],
+  alertTopicArn: any,
+) {
+  const policy = new aws.cloudwatch.LogDataProtectionPolicy(
+    logicalName + 'DataProtection',
+    {
+      logGroupName,
+      policyDocument: JSON.stringify(contract.dataProtectionPolicy),
+    },
+    { dependsOn },
+  );
+  const alarm = new aws.cloudwatch.MetricAlarm(
+    logicalName + 'DataProtectionFindings',
+    {
+      alarmActions: [alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom:
+          'A managed log group contains a protected-data finding.',
+        id: 'data-protection-findings',
+        runbook: 'docs/runbooks/log-investigation.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { LogGroupName: logGroupName },
+      evaluationPeriods: 1,
+      metricName: 'LogEventsWithFindings',
+      namespace: 'AWS/Logs',
+      period: 300,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+    { dependsOn: [policy] },
+  );
+  return { alarm, policy };
+}
+
+function lambdaLogging(logGroupName: any, functionName?: any) {
+  return {
+    logging: { format: 'json' as const, logGroup: logGroupName },
+    transform: {
+      function: {
+        ...(functionName ? { name: functionName } : {}),
+        loggingConfig: {
+          applicationLogLevel: 'TRACE',
+          logFormat: 'JSON',
+          logGroup: logGroupName,
+          systemLogLevel: 'INFO',
+        },
+      },
+    },
+  };
+}
+
+export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
+  if (!$dev && !workloadRoles) {
+    throw new Error(
+      'Protected workload-role preflight must complete before infrastructure construction.',
+    );
+  }
+  const workloadRoleBindings = workloadRoles?.bindings;
+  const asyncAdaptersConfigured = assertAsyncAdapterDeploymentReady();
+  const secretLinks = createStandardSliceSecretLinks({
+    protectedAccess: workloadRoles?.secretAccess,
+  });
+  const performanceHmacLogicalName =
+    '${pascalName}PerformanceLoadHmacKeys';
+  const secretLinksFor = (
+    resource: string,
+    excludeLogicalNames: readonly string[] = [],
+  ) =>
+    secretLinks.linksForWorkload('${name}.' + resource, {
+      excludeLogicalNames,
+    });
+  const secretLinksForWorkloads = (...resources: readonly string[]) => [
+    ...new Set(resources.flatMap((resource) => secretLinksFor(resource))),
+  ];
+  // Workload generators compose multi-role secret bindings through this seam.
+  void secretLinksForWorkloads;
+  const workloadRoleResourceNames = workloadRoles
+    ? standardSliceResourceNames(workloadRoles.intentContext)
+    : undefined;
+  if (workloadRoleResourceNames) {
+    $transform(aws.dynamodb.Table, (args: any, _opts: any, logicalName: string) => {
+      if (logicalName === '${pascalName}WebRevalidationTable') {
+        args.name = workloadRoleResourceNames.webRevalidationTable;
+      }
+    });
+    $transform(aws.sqs.Queue, (args: any, _opts: any, logicalName: string) => {
+      if (logicalName === '${pascalName}WebRevalidationEventsQueue') {
+        args.name = workloadRoleResourceNames.webRevalidationQueue;
+      }
+    });
+  }
+  const devPortInput = $dev ? (process.env.EBK_DEV_PORT ?? '3000') : '3000';
+  if (!/^\\d+$/.test(devPortInput)) {
+    throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
+  }
+  const devPort = Number(devPortInput);
+  if (!Number.isSafeInteger(devPort) || devPort < 1024 || devPort > 65535) {
+    throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
+  }
+  const protectedStage =
+    $app.stage === 'staging' || $app.stage === 'production';
+  const sourceCommit =
+    process.env.EBK_SOURCE_COMMIT ?? (protectedStage ? '' : 'unresolved');
+  const releaseSourceCommit =
+    process.env.EBK_RELEASE_SOURCE_COMMIT ?? sourceCommit;
+  const exactDevelopmentRetirement =
+    $app.stage === 'development' &&
+    Object.values(databaseBindings).some((binding) =>
+      binding.provisioned.includes('retirement_rehearsal'),
+    );
+  if (
+    protectedStage &&
+    (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit) ||
+      !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(releaseSourceCommit))
+  ) {
+    throw new Error(
+      'Protected infrastructure requires exact deployment and release source Git object IDs.',
+    );
+  }
+  const dataRetentionContainer = resolveStandardContainerImage({
+    artifactId: '${name}.job.data-retention',
+    local: {
+      context: '../..',
+      dockerfile: 'packages/${name}/jobs/data-retention/Dockerfile',
+    },
+    sourceCommit: releaseSourceCommit,
+    stage: $app.stage,
+  });
+  const databaseMigrationContainer = resolveStandardContainerImage({
+    artifactId: '${name}.job.database-migration',
+    local: {
+      context: '../..',
+      dockerfile: 'packages/${name}/migration/Dockerfile',
+    },
+    sourceCommit: releaseSourceCommit,
+    stage: $app.stage,
+  });
+  const databaseRetirementContainer = resolveStandardContainerImage({
+    artifactId: '${name}.job.database-retirement',
+    exactDevelopment: exactDevelopmentRetirement,
+    local: {
+      context: '../..',
+      dockerfile: 'packages/${name}/migration/Dockerfile',
+    },
+    sourceCommit: releaseSourceCommit,
+    stage: $app.stage,
+  });
+  const performanceDeploymentAuthority = protectedStage
+    ? protectedPerformanceDeploymentAuthority({
+        enabled: process.env.EBK_PERFORMANCE_LOAD_ENABLED ?? 'false',
+        releaseSourceCommit,
+        stage: $app.stage,
+      })
+    : undefined;
+  const foundation = getFoundationInfrastructure();
+  const performanceCostControls = create${pascalName}PerformanceCostControls({
+    accountCostPolicyDigest: foundation.discovery.accountCostPolicyDigest,
+    accountMonthlyMaximumUsd:
+      foundation.discovery.accountMonthlyMaximumUsd,
+    alertTopicArn: foundation.discovery.alertTopicArn,
+    workspace: '${workspace}',
+  });
+  const databaseProvisions = provisionDatabaseBindings(foundation, {
+    bindings: databaseBindings,
+    slice: '${name}',
+  });
+  const databaseProvision = databaseProvisions.bindings.primary;
+  const { db: database } = databaseProvision;
+  const authClient = foundation.userPool.addClient('${pascalName}WebAuthClient', {
+    transform: {
+      client: {
+        explicitAuthFlows: [
+          'ALLOW_USER_PASSWORD_AUTH',
+          'ALLOW_REFRESH_TOKEN_AUTH',
+        ],
+        preventUserExistenceErrors: 'ENABLED',
+      },
+    },
+  });
+  const machineClientProvisionerLogs = managedLogGroup(
+    '${pascalName}MachineClientProvisionerLogs',
+    'machine-client-provisioner',
+    foundation.discovery.alertTopicArn,
+  );
+  const machineClientProvisioner = new sst.aws.Function(
+    '${pascalName}MachineClientProvisioner',
+    {
+      ...(workloadRoleBindings?.authorization.provisioner ?? {}),
+      ...(workloadRoles
+        ? {}
+        : {
+            permissions:
+              standardSliceMachineClientProvisionerPermissions({
+                userPoolArn:
+                  foundation.discovery.identityUserPoolArn,
+              }),
+          }),
+      environment: {
+        EBK_SLICE: '${name}',
+        EBK_STAGE: $app.stage,
+        EBK_WORKSPACE: '${workspace}',
+      },
+      handler: 'authorization/machine-client-provisioner.handler',
+      link: secretLinksFor('machine-client-provisioner'),
+      runtime: 'python3.12',
+      timeout: '2 minutes',
+      ...lambdaLogging(machineClientProvisionerLogs.logGroup.name),
+    },
+  );
+  const machineAuthorization = createStandardSliceMachineAuthorization({
+    credentialGeneration:
+      (process.env.EBK_MACHINE_CREDENTIAL_GENERATION ??
+        'blue-1') as MachineCredentialGeneration,
+    provisionerFunctionArn: machineClientProvisioner.arn,
+    retirePreviousGeneration:
+      process.env.EBK_MACHINE_RETIRE_PREVIOUS_GENERATION === 'true',
+    tokenEndpoint: foundation.discovery.identityTokenEndpoint,
+    userPoolId: foundation.userPool.id,
+  });
+  const dataExportStore = createStandardDataExportStore({
+    bucketName: workloadRoleResourceNames?.dataExportBucket,
+    keyAliasName: workloadRoleResourceNames?.dataExportKeyAlias,
+    workloadRoleArn: workloadRoleBindings?.api.dataRights.role,
+  });
+
+  const apiHealthLogs = managedLogGroup(
+    '${pascalName}ApiHealthLogs',
+    'api-health',
+    foundation.discovery.alertTopicArn,
+  );
+  const protectedApiLogs = managedLogGroup(
+    '${pascalName}ProtectedApiLogs',
+    'api-protected',
+    foundation.discovery.alertTopicArn,
+  );
+  const machineAuthorizationProofLogs = managedLogGroup(
+    '${pascalName}MachineAuthorizationProofLogs',
+    'machine-authorization-proof',
+    foundation.discovery.alertTopicArn,
+  );
+  const machineAuthorizationProofTargetLogs = managedLogGroup(
+    '${pascalName}MachineAuthorizationProofTargetLogs',
+    'machine-authorization-proof-target',
+    foundation.discovery.alertTopicArn,
+  );
+  const delegationLogs = managedLogGroup(
+    '${pascalName}DelegationLogs',
+    'authorization-delegations',
+    foundation.discovery.alertTopicArn,
+  );
+  const dataRightsLogs = managedLogGroup(
+    '${pascalName}DataRightsLogs',
+    'data-rights',
+    foundation.discovery.alertTopicArn,
+  );
+  const dataRetentionReviewLogs = managedLogGroup(
+    '${pascalName}DataRetentionReviewLogs',
+    'data-retention-review',
+    foundation.discovery.alertTopicArn,
+  );
+  const dataExportCleanupLogs = managedLogGroup(
+    '${pascalName}DataExportCleanupLogs',
+    'job-data-export-cleanup',
+    foundation.discovery.alertTopicArn,
+  );
+  const databaseHealthLogs = managedLogGroup(
+    '${pascalName}DatabaseHealthLogs',
+    'database-health',
+    foundation.discovery.alertTopicArn,
+  );
+  const databaseRecordsLogs = managedLogGroup(
+    '${pascalName}DatabaseRecordsLogs',
+    'database-records',
+    foundation.discovery.alertTopicArn,
+  );
+  const eventPublisherLogs = managedLogGroup(
+    '${pascalName}EventPublisherLogs',
+    'event-publisher',
+    foundation.discovery.alertTopicArn,
+  );
+  const eventConsumerLogs = managedLogGroup(
+    '${pascalName}EventConsumerLogs',
+    'event-consumer',
+    foundation.discovery.alertTopicArn,
+  );
+  const asyncOutboxRelayLogs = managedLogGroup(
+    '${pascalName}AsyncOutboxRelayLogs',
+    'async-outbox-relay',
+    foundation.discovery.alertTopicArn,
+  );
+  const asyncInboxCleanupLogs = managedLogGroup(
+    '${pascalName}AsyncInboxCleanupLogs',
+    'async-inbox-cleanup',
+    foundation.discovery.alertTopicArn,
+  );
+  const asyncProviderWorkerLogs = managedLogGroup(
+    '${pascalName}AsyncProviderWorkerLogs',
+    'async-provider-worker',
+    foundation.discovery.alertTopicArn,
+  );
+  const asyncScheduleTargetLogs = managedLogGroup(
+    '${pascalName}AsyncScheduleTargetLogs',
+    'async-schedule-target',
+    foundation.discovery.alertTopicArn,
+  );
+  const asyncWebhookIngressLogs = managedLogGroup(
+    '${pascalName}AsyncWebhookIngressLogs',
+    'async-webhook-ingress',
+    foundation.discovery.alertTopicArn,
+  );
+  const asyncWorkflowTaskLogs = managedLogGroup(
+    '${pascalName}AsyncWorkflowTaskLogs',
+    'async-workflow-task',
+    foundation.discovery.alertTopicArn,
+  );
+  const nextServerLogs = managedLogGroup(
+    '${pascalName}NextServerLogs',
+    'next-server',
+    foundation.discovery.alertTopicArn,
+  );
+  const nextImageOptimizerLogs = managedLogGroup(
+    '${pascalName}NextImageOptimizerLogs',
+    'next-image-optimizer',
+    foundation.discovery.alertTopicArn,
+  );
+  const nextRevalidationSeederLogs = managedLogGroup(
+    '${pascalName}NextRevalidationSeederLogs',
+    'next-revalidation-seeder',
+    foundation.discovery.alertTopicArn,
+  );
+  const nextRevalidationSubscriberLogs = managedLogGroup(
+    '${pascalName}NextRevalidationSubscriberLogs',
+    'next-revalidation-subscriber',
+    foundation.discovery.alertTopicArn,
+  );
+
+  const api = new sst.aws.ApiGatewayV2('${pascalName}Api', {
+    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } : {}),
+  });
+  const performanceIngress = performanceDeploymentAuthority
+    ? (() => {
+        const originProof = new random.RandomPassword(
+          '${pascalName}PerformanceRouterOriginProof',
+          {
+            keepers: { contract: 'ebk-performance-router-origin-proof-v1' },
+            length: 43,
+            lower: true,
+            numeric: true,
+            special: false,
+            upper: true,
+          },
+        );
+        const router = new sst.aws.Router('${pascalName}PerformanceRouter', {
+          edge: {
+            viewerRequest: {
+              injection: originProof.result.apply(
+                (proof: string) =>
+                  createRouterOriginProofInjection('${name}', proof),
+              ),
+            },
+          },
+        });
+        return { api, originProof: originProof.result, router };
+      })()
+    : undefined;
+  const performanceDeploymentBinding =
+    performanceDeploymentAuthority && performanceIngress
+      ? {
+          ...performanceDeploymentAuthority,
+          target: {
+            ...performanceDeploymentAuthority.target,
+            origin: performanceIngress.router.url,
+          },
+        }
+      : undefined;
+  api.route(${identifierPrefix}Health.method + ' ' + ${identifierPrefix}Health.path, {
+    ...(workloadRoleBindings?.api.health ?? {}),
+    environment: {
+      EBK_SOURCE_COMMIT: releaseSourceCommit,
+      EBK_STAGE: $app.stage,
+    },
+    handler: 'api/health.handler',
+    link: secretLinksFor('api-health'),
+    ...lambdaLogging(apiHealthLogs.logGroup.name),
+  });
+  api.route(
+    ${identifierPrefix}MachineAuthorizationProof.method +
+      ' ' +
+      ${identifierPrefix}MachineAuthorizationProof.path,
+    {
+      ...(workloadRoleBindings?.api.machineAuthorizationProof ?? {}),
+      environment: {
+        AUTH_CLIENT_ID: authClient.id,
+        AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+          machineAuthorization.acceptedClientIdsJson,
+        AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+        AUTH_USER_POOL_ID: foundation.userPool.id,
+        EBK_STAGE: $app.stage,
+      },
+      handler: 'api/machine-authorization.handler',
+      link: [
+        database,
+        ...secretLinksFor('api-machine-authorization-proof'),
+      ],
+      ...lambdaLogging(machineAuthorizationProofTargetLogs.logGroup.name),
+      vpc: foundation.vpc,
+    },
+  );
+  for (const route of [
+    {
+      handler: 'api/delegations.issueHandler',
+      operation: ${identifierPrefix}IssueRecordDelegation,
+    },
+    {
+      handler: 'api/delegations.useHandler',
+      operation: ${identifierPrefix}UseRecordDelegation,
+    },
+    {
+      handler: 'api/delegations.revokeHandler',
+      operation: ${identifierPrefix}RevokeRecordDelegation,
+    },
+  ]) {
+    api.route(route.operation.method + ' ' + route.operation.path, {
+      ...(workloadRoleBindings?.api.delegations ?? {}),
+      environment: {
+        AUTH_CLIENT_ID: authClient.id,
+        AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+          machineAuthorization.acceptedClientIdsJson,
+        AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+        AUTH_USER_POOL_ID: foundation.userPool.id,
+        EBK_STAGE: $app.stage,
+      },
+      handler: route.handler,
+      link: [database, ...secretLinksFor('api-delegations')],
+      ...lambdaLogging(delegationLogs.logGroup.name),
+      vpc: foundation.vpc,
+    });
+  }
+  for (const route of [
+    {
+      handler: 'api/data-rights.requestExportHandler',
+      operation: ${identifierPrefix}RequestRecordExport,
+    },
+    {
+      handler: 'api/data-rights.decideExportHandler',
+      operation: ${identifierPrefix}DecideRecordExport,
+    },
+    {
+      handler: 'api/data-rights.executeExportHandler',
+      operation: ${identifierPrefix}ExecuteRecordExport,
+    },
+    {
+      handler: 'api/data-rights.deliverExportHandler',
+      operation: ${identifierPrefix}DeliverRecordExport,
+    },
+    {
+      handler: 'api/data-rights.cleanupExportHandler',
+      operation: ${identifierPrefix}CleanupRecordExport,
+    },
+    {
+      handler: 'api/data-rights.issueHoldHandler',
+      operation: ${identifierPrefix}IssueRecordHold,
+    },
+    {
+      handler: 'api/data-rights.reviewHoldHandler',
+      operation: ${identifierPrefix}ReviewRecordHold,
+    },
+    {
+      handler: 'api/data-rights.releaseHoldHandler',
+      operation: ${identifierPrefix}ReleaseRecordHold,
+    },
+    {
+      handler: 'api/data-rights.expireHoldHandler',
+      operation: ${identifierPrefix}ExpireRecordHold,
+    },
+  ]) {
+    api.route(route.operation.method + ' ' + route.operation.path, {
+      ...(workloadRoleBindings?.api.dataRights ?? {}),
+      ...(workloadRoles
+        ? {}
+        : { permissions: dataExportStore.dataRightsPermissions }),
+      environment: {
+        AUTH_CLIENT_ID: authClient.id,
+        AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+          machineAuthorization.acceptedClientIdsJson,
+        AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+        AUTH_USER_POOL_ID: foundation.userPool.id,
+        DATA_EXPORT_BUCKET_NAME: dataExportStore.bucket.bucket,
+        DATA_EXPORT_KMS_KEY_ARN: dataExportStore.encryptionKey.arn,
+        EBK_STAGE: $app.stage,
+        EVENT_BUS_NAME: foundation.discovery.eventBusName,
+      },
+      handler: route.handler,
+      link: [
+        database,
+        foundation.eventBus,
+        ...secretLinksFor('api-data-rights'),
+      ],
+      ...lambdaLogging(dataRightsLogs.logGroup.name),
+      vpc: foundation.vpc,
+    });
+  }
+  for (const route of [
+    {
+      handler: 'api/data-retention.requestRetentionApprovalHandler',
+      operation: ${identifierPrefix}RequestRetentionApproval,
+    },
+    {
+      handler: 'api/data-retention.decideRetentionApprovalHandler',
+      operation: ${identifierPrefix}DecideRetentionApproval,
+    },
+  ]) {
+    api.route(route.operation.method + ' ' + route.operation.path, {
+      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+      environment: {
+        AUTH_CLIENT_ID: authClient.id,
+        AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+          machineAuthorization.acceptedClientIdsJson,
+        AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+        AUTH_USER_POOL_ID: foundation.userPool.id,
+        EBK_STAGE: $app.stage,
+      },
+      handler: route.handler,
+      link: [database, ...secretLinksFor('api-database-records')],
+      ...lambdaLogging(dataRetentionReviewLogs.logGroup.name),
+      vpc: foundation.vpc,
+    });
+  }
+  api.route(
+    ${identifierPrefix}ProtectedExample.method +
+      ' ' +
+      ${identifierPrefix}ProtectedExample.path,
+    {
+    ...(workloadRoleBindings?.api.protected ?? {}),
+    environment: {
+      AUTH_CLIENT_ID: authClient.id,
+      AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+        machineAuthorization.acceptedClientIdsJson,
+      AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+      AUTH_USER_POOL_ID: foundation.userPool.id,
+      EBK_STAGE: $app.stage,
+    },
+    handler: 'api/protected.handler',
+    link: [database, ...secretLinksFor('api-protected')],
+    ...lambdaLogging(protectedApiLogs.logGroup.name),
+    vpc: foundation.vpc,
+    },
+  );
+  api.route(
+    ${identifierPrefix}DatabaseHealth.method +
+      ' ' +
+      ${identifierPrefix}DatabaseHealth.path,
+    {
+    ...(workloadRoleBindings?.api.databaseHealth ?? {}),
+    environment: {
+      AUTH_CLIENT_ID: authClient.id,
+      AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+        machineAuthorization.acceptedClientIdsJson,
+      AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+      AUTH_USER_POOL_ID: foundation.userPool.id,
+      EBK_STAGE: $app.stage,
+    },
+    handler: 'database/runtime-health.handler',
+    link: [database, ...secretLinksFor('api-database-health')],
+    ...lambdaLogging(databaseHealthLogs.logGroup.name),
+    vpc: foundation.vpc,
+    },
+  );
+  for (const route of [
+    {
+      handler: 'database/deletions.deleteHandler',
+      operation: ${identifierPrefix}DeleteRecord,
+    },
+    {
+      handler: 'database/records.getHandler',
+      operation: ${identifierPrefix}GetRecord,
+    },
+    {
+      handler: 'database/records.putHandler',
+      operation: ${identifierPrefix}PutRecord,
+    },
+  ]) {
+    api.route(route.operation.method + ' ' + route.operation.path, {
+      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+      environment: {
+        AUTH_CLIENT_ID: authClient.id,
+        AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+          machineAuthorization.acceptedClientIdsJson,
+        AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+        AUTH_USER_POOL_ID: foundation.userPool.id,
+        EBK_STAGE: $app.stage,
+        EVENT_BUS_NAME: foundation.discovery.eventBusName,
+      },
+      handler: route.handler,
+      link: [
+        database,
+        foundation.eventBus,
+        ...secretLinksFor('api-database-records'),
+      ],
+      ...lambdaLogging(databaseRecordsLogs.logGroup.name),
+      vpc: foundation.vpc,
+    });
+  }
+  for (const route of [
+    {
+      handler: 'database/deletions.requestDeletionHandler',
+      operation: ${identifierPrefix}RequestRecordDeletion,
+    },
+    {
+      handler: 'database/deletions.decideDeletionHandler',
+      operation: ${identifierPrefix}DecideRecordDeletion,
+    },
+  ]) {
+    api.route(route.operation.method + ' ' + route.operation.path, {
+      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+      environment: {
+        AUTH_CLIENT_ID: authClient.id,
+        AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+          machineAuthorization.acceptedClientIdsJson,
+        AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+        AUTH_USER_POOL_ID: foundation.userPool.id,
+        EBK_STAGE: $app.stage,
+      },
+      handler: route.handler,
+      link: [database, ...secretLinksFor('api-database-records')],
+      ...lambdaLogging(databaseRecordsLogs.logGroup.name),
+      vpc: foundation.vpc,
+    });
+  }
+  api.route(
+    ${identifierPrefix}PublishCreated.method +
+      ' ' +
+      ${identifierPrefix}PublishCreated.path,
+    {
+    ...(workloadRoleBindings?.api.publishCreated ?? {}),
+    environment: {
+      AUTH_CLIENT_ID: authClient.id,
+      AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
+        machineAuthorization.acceptedClientIdsJson,
+      AUTH_MACHINE_CLIENT_ID: machineAuthorization.clientId,
+      AUTH_USER_POOL_ID: foundation.userPool.id,
+      EBK_STAGE: $app.stage,
+      EVENT_BUS_NAME: foundation.discovery.eventBusName,
+    },
+    handler: 'api/publish-created.handler',
+    link: [
+      database,
+      foundation.eventBus,
+      ...secretLinksFor('api-publish-created'),
+    ],
+    ...lambdaLogging(eventPublisherLogs.logGroup.name),
+    vpc: foundation.vpc,
+    },
+  );
+  const machineAuthorizationProof = new sst.aws.Function(
+    '${pascalName}MachineAuthorizationProof',
+    {
+      ...(workloadRoleBindings?.authorization.proof ?? {}),
+      ...(workloadRoles
+        ? {}
+        : { permissions: machineAuthorization.proof.permissions }),
+      environment: {
+        ...machineAuthorization.proof.environment,
+        AUTH_MACHINE_PROBE_URL:
+          $interpolate\`\${api.url}\${${identifierPrefix}MachineAuthorizationProof.path}\`,
+        EBK_STAGE: $app.stage,
+      },
+      handler: 'authorization/machine-authorization-proof.handler',
+      link: secretLinksFor('machine-authorization-proof'),
+      ...lambdaLogging(machineAuthorizationProofLogs.logGroup.name),
+    },
+  );
+  const dataExportCleanup = new sst.aws.Function(
+    '${pascalName}DataExportCleanup',
+    {
+      ...(workloadRoleBindings?.dataExport.cleanup ?? {}),
+      ...(workloadRoles
+        ? {}
+        : { permissions: dataExportStore.cleanupPermissions }),
+      environment: {
+        DATA_EXPORT_BUCKET_NAME: dataExportStore.bucket.bucket,
+        DATA_EXPORT_KMS_KEY_ARN: dataExportStore.encryptionKey.arn,
+        EBK_STAGE: $app.stage,
+        EBK_WORKLOAD_IDENTITY: '${name}:data-export-cleanup',
+      },
+      handler: 'jobs/data-export-cleanup.handler',
+      link: [
+        database,
+        ...secretLinksFor('data-export-cleanup'),
+      ],
+      ...lambdaLogging(dataExportCleanupLogs.logGroup.name),
+      timeout: '5 minutes',
+      vpc: foundation.vpc,
+    },
+  );
+  const dataExportCleanupRule = new aws.cloudwatch.EventRule(
+    '${pascalName}DataExportCleanupSchedule',
+    {
+      ...(workloadRoleResourceNames
+        ? { name: workloadRoleResourceNames.dataExportCleanupRule }
+        : {}),
+      description:
+        'Hourly authoritative cleanup of expired confidential export versions.',
+      scheduleExpression: 'rate(1 hour)',
+      state: 'ENABLED',
+      tags: {
+        'ebk:management': 'standard-data-export',
+        'ebk:slice': '${name}',
+        'sst:stage': $app.stage,
+      },
+    },
+  );
+  const dataExportCleanupPermission = new aws.lambda.Permission(
+    '${pascalName}DataExportCleanupPermission',
+    {
+      action: 'lambda:InvokeFunction',
+      function: dataExportCleanup.arn,
+      principal: 'events.amazonaws.com',
+      sourceArn: dataExportCleanupRule.arn,
+    },
+  );
+  const dataExportCleanupTarget = new aws.cloudwatch.EventTarget(
+    '${pascalName}DataExportCleanupTarget',
+    {
+      arn: dataExportCleanup.arn,
+      retryPolicy: {
+        maximumEventAgeInSeconds: 3_600,
+        maximumRetryAttempts: 185,
+      },
+      rule: dataExportCleanupRule.name,
+      targetId: 'DataExportCleanup',
+    },
+    { dependsOn: [dataExportCleanupPermission] },
+  );
+  const dataExportCleanupInvocation =
+    new aws.lambda.FunctionEventInvokeConfig(
+      '${pascalName}DataExportCleanupInvocation',
+      {
+        functionName: dataExportCleanup.arn,
+        maximumEventAgeInSeconds: 3_600,
+        maximumRetryAttempts: 2,
+      },
+    );
+  // <ebk:function-registrations:start>
+  // <ebk:function-registrations:end>
+
+  const eventDlq = new sst.aws.Queue('${pascalName}EventDlq', {
+    transform: {
+      queue: {
+        ...(workloadRoleResourceNames
+          ? { name: workloadRoleResourceNames.eventDlq }
+          : {}),
+        messageRetentionSeconds: 14 * 24 * 60 * 60,
+      },
+    },
+  });
+  const eventQueue = new sst.aws.Queue('${pascalName}EventQueue', {
+    dlq: { queue: eventDlq.arn, retry: 5 },
+    transform: {
+      queue: {
+        ...(workloadRoleResourceNames
+          ? { name: workloadRoleResourceNames.eventQueue }
+          : {}),
+        messageRetentionSeconds: 4 * 24 * 60 * 60,
+        visibilityTimeoutSeconds: 120,
+      },
+    },
+  });
+  const asyncRecoveryLedger = new aws.dynamodb.Table(
+    '${pascalName}AsyncRecoveryLedger',
+    {
+      attributes: [{ name: 'report_digest', type: 'S' }],
+      billingMode: 'PAY_PER_REQUEST',
+      hashKey: 'report_digest',
+      ...(workloadRoleResourceNames
+        ? { name: workloadRoleResourceNames.asyncRecoveryLedger }
+        : {}),
+      pointInTimeRecovery: { enabled: true },
+      tags: {
+        'ebk:async-recovery-ledger': 'true',
+        'ebk:slice': '${name}',
+        'ebk:stage': $app.stage,
+      },
+      ttl: {
+        attributeName: 'expires_at_epoch_seconds',
+        enabled: true,
+      },
+    },
+  );
+  eventQueue.subscribe({
+    environment: {
+      EBK_STAGE: $app.stage,
+      EBK_WORKLOAD_IDENTITY: '${name}:event-consumer',
+    },
+    handler: 'api/event-consumer.handler',
+    link: [database, ...secretLinksFor('event-consumer')],
+    ...lambdaLogging(eventConsumerLogs.logGroup.name),
+    timeout: '1 minute',
+    vpc: foundation.vpc,
+  }, {
+    batch: { partialResponses: true },
+    transform: {
+      function: workloadRoleBindings?.queue.eventConsumer,
+    },
+  });
+  foundation.eventBus.subscribeQueue(
+    '${pascalName}CreatedEventRule',
+    eventQueue,
+    {
+      pattern: {
+        detail: { meta: { stage: [$app.stage] } },
+        detailType: ['${pascalName}Created'],
+        source: ['${name}'],
+      },
+    },
+  );
+  foundation.eventBus.subscribeQueue(
+    '${pascalName}DataLifecycleChangedRule',
+    eventQueue,
+    {
+      pattern: {
+        detail: { meta: { stage: [$app.stage] } },
+        detailType: ['DataLifecycleChanged'],
+        source: [...lifecycleConsumers.acceptedSources],
+      },
+    },
+  );
+
+  const eventConsumerAlarmDefinition = defineEventConsumerAlarms({
+    consumer: '${pascalName}Created',
+    dlqName: 'event-dlq',
+    queueName: 'event-queue',
+    slice: '${name}',
+    stage: $app.stage,
+  }).alarms.find(({ severity }) => severity === 'critical');
+  if (!eventConsumerAlarmDefinition) {
+    throw new Error('Generated event-consumer DLQ alarm definition is missing.');
+  }
+  const dlqAlarm = new aws.cloudwatch.MetricAlarm('${pascalName}EventDlqDepth', {
+    alarmActions: [foundation.discovery.alertTopicArn],
+    alarmDescription: operationalAlarmDescription({
+      businessSymptom: 'Domain-event processing has terminal failures.',
+      id: 'event-dlq-depth',
+      runbook: 'docs/runbooks/async-recovery.md',
+    }),
+    name: '${name}-' + $app.stage + '-event-dlq-depth',
+    comparisonOperator: eventConsumerAlarmDefinition.comparisonOperator,
+    dimensions: { QueueName: eventDlq.name },
+    evaluationPeriods: eventConsumerAlarmDefinition.evaluationPeriods,
+    metricName: eventConsumerAlarmDefinition.metricName,
+    namespace: eventConsumerAlarmDefinition.namespace,
+    period: eventConsumerAlarmDefinition.periodSeconds,
+    statistic: 'Maximum',
+    threshold: eventConsumerAlarmDefinition.threshold,
+    treatMissingData: 'notBreaching',
+  });
+  const asyncTargetDlq = new sst.aws.Queue(
+    '${pascalName}AsyncTargetDlq',
+    {
+      transform: {
+        queue: {
+          ...(workloadRoleResourceNames
+            ? { name: workloadRoleResourceNames.asyncTargetDlq }
+            : {}),
+          messageRetentionSeconds: 14 * 24 * 60 * 60,
+          tags: {
+            'ebk:async-recovery-source': 'async-target-dlq',
+            'ebk:slice': '${name}',
+            'ebk:stage': $app.stage,
+          },
+        },
+      },
+    },
+  );
+  const providerDlq = new sst.aws.Queue('${pascalName}ProviderDlq', {
+    transform: {
+      queue: {
+        ...(workloadRoleResourceNames
+          ? { name: workloadRoleResourceNames.providerDlq }
+          : {}),
+        messageRetentionSeconds: 14 * 24 * 60 * 60,
+        tags: {
+          'ebk:async-recovery-source': 'provider-dlq',
+          'ebk:slice': '${name}',
+          'ebk:stage': $app.stage,
+        },
+      },
+    },
+  });
+  const providerQueue = new sst.aws.Queue('${pascalName}ProviderQueue', {
+    dlq: { queue: providerDlq.arn, retry: 5 },
+    transform: {
+      queue: {
+        ...(workloadRoleResourceNames
+          ? { name: workloadRoleResourceNames.providerQueue }
+          : {}),
+        messageRetentionSeconds: 4 * 24 * 60 * 60,
+        tags: {
+          'ebk:async-recovery-destination': 'provider-queue',
+          'ebk:slice': '${name}',
+          'ebk:stage': $app.stage,
+        },
+        visibilityTimeoutSeconds: 120,
+      },
+    },
+  });
+  const reliability = create${pascalName}Reliability({
+    alertTopicArn: foundation.discovery.alertTopicArn,
+    alertTopicName:
+      foundation.discovery.alertTopicArn.split(':').at(-1) ?? '',
+    apiId: api.id,
+    databaseClusterIdentifier: foundation.discovery.databaseClusterId,
+    functionName: dataExportCleanup.name,
+    providerQueueName: providerQueue.name,
+  });
+  const providerDlqAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}ProviderDlqDepth',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'Provider deliveries have terminal failures.',
+        id: 'provider-dlq-depth',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { QueueName: providerDlq.name },
+      evaluationPeriods: 1,
+      metricName: 'ApproximateNumberOfMessagesVisible',
+      name: '${name}-' + $app.stage + '-provider-dlq-depth',
+      namespace: 'AWS/SQS',
+      period: 300,
+      statistic: 'Maximum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const asyncTargetDlqAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}AsyncTargetDlqDepth',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'An asynchronous target has terminal failures.',
+        id: 'async-target-dlq-depth',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { QueueName: asyncTargetDlq.name },
+      evaluationPeriods: 1,
+      metricName: 'ApproximateNumberOfMessagesVisible',
+      name: '${name}-' + $app.stage + '-async-target-dlq-depth',
+      namespace: 'AWS/SQS',
+      period: 300,
+      statistic: 'Maximum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const runtimeConfiguration = protectedStage && !$dev
+    ? (() => {
+        const application = new aws.appconfig.Application(
+          '${pascalName}ConfigurationApplication',
+          {
+            description: '${name} Slice-owned runtime configuration.',
+            name: 'ebk-${name}-' + $app.stage,
+            tags: {
+              'ebk:slice': '${name}',
+              'ebk:stage': $app.stage,
+            },
+          },
+        );
+        const environment = new aws.appconfig.Environment(
+          '${pascalName}ConfigurationEnvironment',
+          {
+            applicationId: application.id,
+            description:
+              '${name} ' + $app.stage + ' runtime configuration.',
+            monitors: [
+              reliability.apiFastBurn,
+              asyncTargetDlqAlarm,
+              dlqAlarm,
+              providerDlqAlarm,
+              reliability.providerDeadline,
+            ].map((alarm) => ({
+              alarmArn: alarm.arn,
+              alarmRoleArn:
+                workloadRoleBindings!.configuration.monitor.roleArn,
+            })),
+            name: $app.stage,
+            tags: {
+              'ebk:slice': '${name}',
+              'ebk:stage': $app.stage,
+            },
+          },
+        );
+        const profile = new aws.appconfig.ConfigurationProfile(
+          '${pascalName}ConfigurationProfile',
+          {
+            applicationId: application.id,
+            locationUri: 'hosted',
+            name: 'runtime',
+            tags: {
+              'ebk:slice': '${name}',
+              'ebk:stage': $app.stage,
+            },
+            type: 'AWS.Freeform',
+            validators: [{
+              content: JSON.stringify({
+                additionalProperties: false,
+                properties: {
+                  schemaVersion: { const: 1 },
+                  values: {
+                    additionalProperties: false,
+                    properties: Object.fromEntries(
+                      ConfigurationDeclarations.map((declaration) => [
+                        declaration.key,
+                        declaration.validation.type === 'number'
+                          ? {
+                              ...(declaration.validation.integer
+                                ? { type: 'integer' }
+                                : { type: 'number' }),
+                              ...(declaration.validation.maximum === undefined
+                                ? {}
+                                : {
+                                    maximum:
+                                      declaration.validation.maximum,
+                                  }),
+                              ...(declaration.validation.minimum === undefined
+                                ? {}
+                                : {
+                                    minimum:
+                                      declaration.validation.minimum,
+                                  }),
+                            }
+                          : declaration.validation,
+                      ]),
+                    ),
+                    required: ConfigurationDeclarations.map(
+                      ({ key }) => key,
+                    ),
+                    type: 'object',
+                  },
+                },
+                required: ['schemaVersion', 'values'],
+                type: 'object',
+              }),
+              type: 'JSON_SCHEMA',
+            }],
+          },
+        );
+        const version = new aws.appconfig.HostedConfigurationVersion(
+          '${pascalName}ConfigurationVersion',
+          {
+            applicationId: application.id,
+            configurationProfileId: profile.configurationProfileId,
+            content: JSON.stringify(localConfiguration),
+            contentType: 'application/json',
+            description:
+              '${name} immutable generated default configuration.',
+            versionLabel: releaseSourceCommit,
+          },
+        );
+        const deploymentStrategy =
+          new aws.appconfig.DeploymentStrategy(
+            '${pascalName}ConfigurationDeploymentStrategy',
+            {
+              deploymentDurationInMinutes: 10,
+              description:
+                '${name} bounded linear runtime configuration rollout.',
+              finalBakeTimeInMinutes: 10,
+              growthFactor: 10,
+              growthType: 'LINEAR',
+              name:
+                'ebk-${name}-bounded-linear-' + $app.stage,
+              replicateTo: 'NONE',
+              tags: {
+                'ebk:slice': '${name}',
+                'ebk:stage': $app.stage,
+              },
+            },
+          );
+        const deployment = new aws.appconfig.Deployment(
+          '${pascalName}ConfigurationDeployment',
+          {
+            applicationId: application.id,
+            configurationProfileId: profile.configurationProfileId,
+            configurationVersion: version.versionNumber.apply(String),
+            deploymentStrategyId: deploymentStrategy.id,
+            description:
+              '${name} generated default configuration deployment.',
+            environmentId: environment.environmentId,
+          },
+        );
+        return {
+          application,
+          deployment,
+          deploymentStrategy,
+          environment,
+          profile,
+          version,
+        };
+      })()
+    : undefined;
+  const configurationApplication = runtimeConfiguration?.application;
+  const configurationDeployment = runtimeConfiguration?.deployment;
+  const configurationDeploymentStrategy =
+    runtimeConfiguration?.deploymentStrategy;
+  const configurationEnvironment = runtimeConfiguration?.environment;
+  const configurationProfile = runtimeConfiguration?.profile;
+  const configurationVersion = runtimeConfiguration?.version;
+  const runtimeConfigurationEnvironment = runtimeConfiguration
+    ? {
+        EBK_APPCONFIG_APPLICATION_ID:
+          runtimeConfiguration.application.id,
+        EBK_APPCONFIG_ENVIRONMENT_ID:
+          runtimeConfiguration.environment.environmentId,
+        EBK_APPCONFIG_PROFILE_ID:
+          runtimeConfiguration.profile.configurationProfileId,
+      }
+    : {};
+  // <ebk:workload-registrations:start>
+  // <ebk:workload-registrations:end>
+
+  if (asyncAdaptersConfigured) {
+    providerQueue.subscribe(
+      {
+        environment: {
+          EBK_STAGE: $app.stage,
+          EBK_WORKLOAD_IDENTITY: '${name}:async-provider-worker',
+          EBK_WORKSPACE: '${workspace}',
+          ...runtimeConfigurationEnvironment,
+        },
+        handler: 'async/provider-worker.handler',
+        link: [
+          database,
+          providerQueue,
+          ...secretLinksFor('async-provider-worker'),
+        ],
+        ...lambdaLogging(asyncProviderWorkerLogs.logGroup.name),
+        timeout: '1 minute',
+        vpc: foundation.vpc,
+      },
+      {
+        batch: { partialResponses: true },
+        transform: {
+          function: workloadRoleBindings?.async.providerWorker,
+        },
+      },
+      configurationDeployment
+        ? { dependsOn: [configurationDeployment] }
+        : {},
+    );
+    api.route('POST /${name}/webhooks/provider', {
+      ...(workloadRoleBindings?.async.webhookIngress ?? {}),
+      environment: {
+        EBK_ASYNC_LEDGER_TABLE: asyncRecoveryLedger.name,
+        EBK_STAGE: $app.stage,
+        EBK_WORKLOAD_IDENTITY: '${name}:async-webhook-ingress',
+        EBK_WORKSPACE: '${workspace}',
+      },
+      handler: 'async/webhook-ingress.handler',
+      link: [
+        providerQueue,
+        ...secretLinksFor('async-webhook-ingress'),
+      ],
+      ...lambdaLogging(asyncWebhookIngressLogs.logGroup.name),
+      timeout: '10 seconds',
+    });
+  }
+  const asyncOutboxRelay = new sst.aws.Function(
+    '${pascalName}AsyncOutboxRelay',
+    {
+      ...(workloadRoleBindings?.async.outboxRelay ?? {}),
+      environment: {
+        EBK_STAGE: $app.stage,
+        EBK_WORKLOAD_IDENTITY: '${name}:async-outbox-relay',
+        EBK_WORKSPACE: '${workspace}',
+        EVENT_BUS_NAME: foundation.discovery.eventBusName,
+      },
+      handler: 'async/outbox-relay.handler',
+      link: [
+        database,
+        foundation.eventBus,
+        ...secretLinksFor('async-outbox-relay'),
+      ],
+      ...lambdaLogging(asyncOutboxRelayLogs.logGroup.name),
+      timeout: '1 minute',
+      vpc: foundation.vpc,
+    },
+  );
+  const asyncInboxCleanup = new sst.aws.Function(
+    '${pascalName}AsyncInboxCleanup',
+    {
+      ...(workloadRoleBindings?.async.inboxCleanup ?? {}),
+      environment: {
+        EBK_STAGE: $app.stage,
+        EBK_WORKLOAD_IDENTITY: '${name}:async-inbox-cleanup',
+        EBK_WORKSPACE: '${workspace}',
+      },
+      handler: 'async/inbox-cleanup.handler',
+      link: [
+        database,
+        ...secretLinksFor('async-inbox-cleanup'),
+      ],
+      ...lambdaLogging(asyncInboxCleanupLogs.logGroup.name),
+      timeout: '5 minutes',
+      vpc: foundation.vpc,
+    },
+  );
+  const asyncScheduleTarget = new sst.aws.Function(
+    '${pascalName}AsyncScheduleTarget',
+    {
+      ...(workloadRoleBindings?.async.scheduleTarget ?? {}),
+      environment: {
+        EBK_STAGE: $app.stage,
+        EBK_WORKLOAD_IDENTITY: '${name}:async-schedule-target',
+        EBK_WORKSPACE: '${workspace}',
+      },
+      handler: 'async/schedule-target.handler',
+      link: [providerQueue, ...secretLinksFor('async-schedule-target')],
+      ...lambdaLogging(asyncScheduleTargetLogs.logGroup.name),
+      timeout: '30 seconds',
+    },
+  );
+  const asyncWorkflowTask = new sst.aws.Function(
+    '${pascalName}AsyncWorkflowTask',
+    {
+      ...(workloadRoleBindings?.async.workflowTask ?? {}),
+      environment: {
+        EBK_ASYNC_LEDGER_TABLE: asyncRecoveryLedger.name,
+        EBK_STAGE: $app.stage,
+        EBK_WORKLOAD_IDENTITY: '${name}:async-workflow-task',
+        EBK_WORKSPACE: '${workspace}',
+      },
+      handler: 'async/workflow-task.handler',
+      link: secretLinksFor('async-workflow-task'),
+      ...lambdaLogging(
+        asyncWorkflowTaskLogs.logGroup.name,
+        workloadRoleResourceNames?.workflowTaskFunction,
+      ),
+      timeout: '15 minutes',
+    },
+  );
+  const providerReconciliationRule = new aws.cloudwatch.EventRule(
+    '${pascalName}ProviderReconciliationSchedule',
+    {
+      description:
+        'Versioned provider reconciliation schedule activated only with configured adapters.',
+      scheduleExpression: 'rate(15 minutes)',
+      state: asyncAdaptersConfigured ? 'ENABLED' : 'DISABLED',
+      tags: {
+        'ebk:slice': '${name}',
+        'ebk:stage': $app.stage,
+      },
+    },
+  );
+  const outboxRelayRule = new aws.cloudwatch.EventRule(
+    '${pascalName}OutboxRelaySchedule',
+    {
+      description: 'Durable outbox relay for committed domain events.',
+      scheduleExpression: 'rate(1 minute)',
+      state: 'ENABLED',
+      tags: {
+        'ebk:slice': '${name}',
+        'ebk:stage': $app.stage,
+      },
+    },
+  );
+  const inboxCleanupRule = new aws.cloudwatch.EventRule(
+    '${pascalName}AsyncInboxCleanupSchedule',
+    {
+      description:
+        'Bounded cleanup of expired async inbox idempotency records.',
+      scheduleExpression: 'rate(1 hour)',
+      state: 'ENABLED',
+      tags: {
+        'ebk:slice': '${name}',
+        'ebk:stage': $app.stage,
+      },
+    },
+  );
+  const providerReconciliationPermission = new aws.lambda.Permission(
+    '${pascalName}ProviderReconciliationPermission',
+    {
+      action: 'lambda:InvokeFunction',
+      function: asyncScheduleTarget.arn,
+      principal: 'events.amazonaws.com',
+      sourceArn: providerReconciliationRule.arn,
+    },
+  );
+  const outboxRelayPermission = new aws.lambda.Permission(
+    '${pascalName}OutboxRelayPermission',
+    {
+      action: 'lambda:InvokeFunction',
+      function: asyncOutboxRelay.arn,
+      principal: 'events.amazonaws.com',
+      sourceArn: outboxRelayRule.arn,
+    },
+  );
+  const inboxCleanupPermission = new aws.lambda.Permission(
+    '${pascalName}AsyncInboxCleanupPermission',
+    {
+      action: 'lambda:InvokeFunction',
+      function: asyncInboxCleanup.arn,
+      principal: 'events.amazonaws.com',
+      sourceArn: inboxCleanupRule.arn,
+    },
+  );
+  const asyncTargetDlqPolicy = new aws.sqs.QueuePolicy(
+    '${pascalName}AsyncTargetDlqPolicy',
+    {
+      policy: aws.iam.getPolicyDocumentOutput({
+        statements: [{
+          actions: ['sqs:SendMessage'],
+          conditions: [{
+            test: 'ArnEquals',
+            values: [
+              inboxCleanupRule.arn,
+              providerReconciliationRule.arn,
+              outboxRelayRule.arn,
+            ],
+            variable: 'aws:SourceArn',
+          }],
+          principals: [{
+            identifiers: ['events.amazonaws.com'],
+            type: 'Service',
+          }],
+          resources: [asyncTargetDlq.arn],
+        }],
+      }).json,
+      queueUrl: asyncTargetDlq.url,
+    },
+  );
+  const providerReconciliationTarget = new aws.cloudwatch.EventTarget(
+    '${pascalName}ProviderReconciliationTarget',
+    {
+      arn: asyncScheduleTarget.arn,
+      deadLetterConfig: { arn: asyncTargetDlq.arn },
+      retryPolicy: {
+        maximumEventAgeInSeconds: 900,
+        maximumRetryAttempts: 2,
+      },
+      rule: providerReconciliationRule.name,
+      targetId: 'ProviderReconciliation',
+    },
+    {
+      dependsOn: [
+        asyncTargetDlqPolicy,
+        providerReconciliationPermission,
+      ],
+    },
+  );
+  const outboxRelayTarget = new aws.cloudwatch.EventTarget(
+    '${pascalName}OutboxRelayTarget',
+    {
+      arn: asyncOutboxRelay.arn,
+      deadLetterConfig: { arn: asyncTargetDlq.arn },
+      retryPolicy: {
+        maximumEventAgeInSeconds: 300,
+        maximumRetryAttempts: 2,
+      },
+      rule: outboxRelayRule.name,
+      targetId: 'OutboxRelay',
+    },
+    { dependsOn: [asyncTargetDlqPolicy, outboxRelayPermission] },
+  );
+  const inboxCleanupTarget = new aws.cloudwatch.EventTarget(
+    '${pascalName}AsyncInboxCleanupTarget',
+    {
+      arn: asyncInboxCleanup.arn,
+      deadLetterConfig: { arn: asyncTargetDlq.arn },
+      retryPolicy: {
+        maximumEventAgeInSeconds: 3600,
+        maximumRetryAttempts: 2,
+      },
+      rule: inboxCleanupRule.name,
+      targetId: 'AsyncInboxCleanup',
+    },
+    { dependsOn: [asyncTargetDlqPolicy, inboxCleanupPermission] },
+  );
+  let recordExportWorkflow: any;
+  if (!$dev && asyncAdaptersConfigured) {
+    recordExportWorkflow = new aws.sfn.StateMachine(
+      '${pascalName}RecordExportWorkflow',
+      {
+        definition: $jsonStringify({
+          Comment: 'Versioned record export with cooperative cancellation and compensation.',
+          StartAt: 'RequireVersionOne',
+          TimeoutSeconds: 86_400,
+          States: {
+            RequireVersionOne: {
+              Choices: [{
+                Next: 'CreateExport',
+                NumericEquals: 1,
+                Variable: '$.workflowVersion',
+              }],
+              Default: 'UnsupportedVersion',
+              Type: 'Choice',
+            },
+            CreateExport: {
+              Catch: [
+                {
+                  ErrorEquals: ['WorkflowEffectReconciliationRequired'],
+                  Next: 'ReconciliationRequired',
+                  ResultPath: '$.failure',
+                },
+                {
+                  ErrorEquals: ['WorkflowEffectNotStartedError'],
+                  Next: 'RetryExhaustedBeforeEffect',
+                  ResultPath: '$.failure',
+                },
+                {
+                  ErrorEquals: ['States.ALL'],
+                  Next: 'CompensateAfterFailure',
+                  ResultPath: '$.failure',
+                },
+              ],
+              Next: 'PostCreateCancellationBoundary',
+              Parameters: {
+                action: 'execute',
+                'executionId.$': '$$.Execution.Id',
+                'input.$': '$',
+                stepId: 'create-export',
+                workflowVersion: 1,
+              },
+              Resource: asyncWorkflowTask.arn,
+              Retry: [{
+                BackoffRate: 2,
+                ErrorEquals: ['WorkflowEffectNotStartedError'],
+                IntervalSeconds: 2,
+                MaxAttempts: 2,
+              }],
+              ResultPath: '$.createExport',
+              TimeoutSeconds: 900,
+              Type: 'Task',
+            },
+            PostCreateCancellationBoundary: {
+              Choices: [{
+                And: [
+                  {
+                    BooleanEquals: true,
+                    Variable: '$.createExport.cancellationRequested',
+                  },
+                  {
+                    BooleanEquals: true,
+                    Variable: '$.createExport.sideEffectCommitted',
+                  },
+                ],
+                Next: 'CompensateAfterCancellation',
+              }, {
+                BooleanEquals: true,
+                Next: 'Cancelled',
+                Variable: '$.createExport.cancellationRequested',
+              }],
+              Default: 'Completed',
+              Type: 'Choice',
+            },
+            CompensateAfterCancellation: {
+              Parameters: {
+                action: 'compensate',
+                'executionId.$': '$$.Execution.Id',
+                'input.$': '$',
+                stepId: 'remove-export',
+                workflowVersion: 1,
+              },
+              Resource: asyncWorkflowTask.arn,
+              Retry: [{
+                BackoffRate: 2,
+                ErrorEquals: ['States.TaskFailed'],
+                IntervalSeconds: 2,
+                MaxAttempts: 2,
+              }],
+              TimeoutSeconds: 300,
+              Type: 'Task',
+              Next: 'Cancelled',
+            },
+            CompensateAfterFailure: {
+              Parameters: {
+                action: 'compensate',
+                'executionId.$': '$$.Execution.Id',
+                'input.$': '$',
+                stepId: 'remove-export',
+                workflowVersion: 1,
+              },
+              Resource: asyncWorkflowTask.arn,
+              Retry: [{
+                BackoffRate: 2,
+                ErrorEquals: ['States.TaskFailed'],
+                IntervalSeconds: 2,
+                MaxAttempts: 2,
+              }],
+              TimeoutSeconds: 300,
+              Type: 'Task',
+              Next: 'FailedAfterCompensation',
+            },
+            Cancelled: { Type: 'Succeed' },
+            Completed: { Type: 'Succeed' },
+            FailedAfterCompensation: {
+              Cause: 'The record export failed and compensation completed.',
+              Error: 'RecordExportFailed',
+              Type: 'Fail',
+            },
+            ReconciliationRequired: {
+              Cause:
+                'The workflow effect outcome is ambiguous and requires operator reconciliation.',
+              Error: 'WorkflowEffectReconciliationRequired',
+              Type: 'Fail',
+            },
+            RetryExhaustedBeforeEffect: {
+              Cause:
+                'The workflow adapter proved no effect began, but its retry budget was exhausted.',
+              Error: 'WorkflowEffectNotStartedError',
+              Type: 'Fail',
+            },
+            UnsupportedVersion: {
+              Cause: 'No exact deployed workflow definition exists.',
+              Error: 'WorkflowVersionUnsupported',
+              Type: 'Fail',
+            },
+          },
+        }),
+        name:
+          'ebk-${recordExportWorkflowName}-' +
+          $app.stage +
+          '-record-export-v1',
+        roleArn:
+          workloadRoleBindings!.async.workflowOrchestration.roleArn,
+        tags: {
+          'ebk:slice': '${name}',
+          'ebk:stage': $app.stage,
+          'ebk:workflow-version': '1',
+        },
+        type: 'STANDARD',
+      },
+    );
+  }
+
+  const web = new sst.aws.Nextjs('${pascalName}Web', {
+    dev: {
+      command: \`pnpm exec next dev web --hostname 127.0.0.1 --port \${devPort}\`,
+      directory: '.',
+      title: '${pascalName} web',
+      url: \`http://127.0.0.1:\${devPort}/${name}\`,
+    },
+    environment: {
+      AUTH_CLIENT_ID: authClient.id,
+      AUTH_USER_POOL_ID: foundation.userPool.id,
+      EBK_SOURCE_COMMIT: releaseSourceCommit,
+      EBK_STAGE: $app.stage,
+      EBK_FLEET_ORIGIN: process.env.EBK_FLEET_ORIGIN ?? '',
+      EBK_PERFORMANCE_ACCOUNT_FINGERPRINT:
+        performanceDeploymentBinding?.target.accountFingerprint ?? '',
+      EBK_PERFORMANCE_CANDIDATE_DIGEST:
+        performanceDeploymentBinding?.candidateDigest ?? '',
+      EBK_PERFORMANCE_LOAD_ENABLED:
+        performanceDeploymentBinding ? 'true' : 'false',
+      EBK_PERFORMANCE_ORIGIN:
+        performanceDeploymentBinding?.target.origin ?? '',
+      EBK_PERFORMANCE_REGION:
+        performanceDeploymentBinding?.target.region ?? '',
+      EBK_PERFORMANCE_RELEASE_ID:
+        performanceDeploymentBinding?.releaseId ?? '',
+      EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST:
+        performanceDeploymentBinding?.releaseMaterialDigest ?? '',
+      EBK_PERFORMANCE_SLICE:
+        performanceDeploymentBinding?.target.slice ?? '',
+      EBK_SECURE_COOKIES: process.env.EBK_SECURE_COOKIES ?? '',
+      EVENT_BUS_NAME: foundation.discovery.eventBusName,
+      ...runtimeConfigurationEnvironment,
+      NEXT_PUBLIC_API_URL: api.url,
+    },
+    link: [database, foundation.userPool],
+    path: 'web',
+    router: { instance: foundation.router, path: '/${name}' },
+    transform: {
+      assets: workloadRoleResourceNames
+        ? {
+            transform: {
+              bucket: {
+                bucket: workloadRoleResourceNames.webAssetsBucket,
+              },
+            },
+          }
+        : undefined,
+      imageOptimizer: {
+        ...(workloadRoleBindings?.next.imageOptimizer ?? {}),
+        link: secretLinksFor('web-image-optimizer'),
+        ...lambdaLogging(nextImageOptimizerLogs.logGroup.name),
+      },
+      revalidationEventsSubscriber: {
+        ...(workloadRoleBindings?.next.revalidationSubscriber ?? {}),
+        link: secretLinksFor('web-revalidation-subscriber'),
+        ...lambdaLogging(nextRevalidationSubscriberLogs.logGroup.name),
+      },
+      revalidationSeeder: {
+        ...(workloadRoleBindings?.next.revalidationSeeder ?? {}),
+        link: secretLinksFor('web-revalidation-seeder'),
+        ...lambdaLogging(nextRevalidationSeederLogs.logGroup.name),
+      },
+      server: {
+        ...(workloadRoleBindings?.next.server ?? {}),
+        link: secretLinksFor(
+          'web-server',
+          performanceDeploymentBinding
+            ? []
+            : [performanceHmacLogicalName],
+        ),
+        ...lambdaLogging(nextServerLogs.logGroup.name),
+      },
+    },
+    vpc: foundation.vpc,
+  }, configurationDeployment
+    ? { dependsOn: [configurationDeployment] }
+    : {});
+  if (performanceIngress) {
+    for (const path of [
+      '/${name}/__ebk/performance/api-lambda',
+      '/${name}/__ebk/performance/async-worker',
+      '/${name}/__ebk/performance/async-worker/cleanup',
+      '/${name}/__ebk/performance/database',
+      '/${name}/__ebk/performance/database/cleanup',
+    ]) {
+      performanceIngress.router.route(path, web.url, {
+        connectionAttempts: 1,
+        connectionTimeout: '3 seconds',
+        readTimeout: '30 seconds',
+      });
+    }
+  }
+
+  const migrationControls: Record<string, any> = {};
+  if (!$dev) {
+    const region = aws.getRegionOutput({}).name;
+    const taskArguments = (task: any) => ({
+      Cluster: task.cluster,
+      LaunchType: 'FARGATE',
+      NetworkConfiguration: {
+        AwsvpcConfiguration: {
+          AssignPublicIp: task.assignPublicIp.apply(
+            (value: boolean) => value ? 'ENABLED' : 'DISABLED',
+          ),
+          SecurityGroups: task.securityGroups,
+          Subnets: task.subnets,
+        },
+      },
+      TaskDefinition: task.taskDefinition,
+    });
+    const lifecycleEnvironment = (task: any, callback: boolean) =>
+      task.containers.apply((containers: string[]) => ({
+        ContainerOverrides: containers.map((containerName) => ({
+          Environment: [
+            {
+              Name: 'EBK_DATABASE_LIFECYCLE_CORRELATION_ID',
+              Value: '{% $states.input.databaseLifecycleCorrelationId %}',
+            },
+            ...(callback
+              ? [
+                  {
+                    Name: 'EBK_CANDIDATE_IDENTITY',
+                    Value: '{% $states.input.candidateIdentity %}',
+                  },
+                  {
+                    Name: 'EBK_EXECUTION_DATABASE_IDENTIFIER',
+                    Value: '{% $states.input.databaseIdentifier %}',
+                  },
+                  {
+                    Name: 'EBK_EXECUTION_SLICE',
+                    Value: '{% $states.input.slice %}',
+                  },
+                  {
+                    Name: 'EBK_EXECUTION_STAGE',
+                    Value: '{% $states.input.stage %}',
+                  },
+                  {
+                    Name: 'EBK_REGISTRATION_DIGEST',
+                    Value: '{% $states.input.registrationDigest %}',
+                  },
+                  {
+                    Name: 'EBK_SOURCE_COMMIT',
+                    Value: '{% $states.input.sourceCommit %}',
+                  },
+                  {
+                    Name: 'EBK_STEP_FUNCTIONS_TASK_TOKEN',
+                    Value: '{% $states.context.Task.Token %}',
+                  },
+                ]
+              : []),
+          ],
+          Name: containerName,
+        })),
+      }));
+    const createRawStateMachine = (
+      logicalName: string,
+      definition: unknown,
+      logGroup: any,
+      roleArn: string,
+    ) =>
+      new aws.sfn.StateMachine(logicalName, {
+        definition: $jsonStringify(definition),
+        loggingConfiguration: {
+          includeExecutionData: false,
+          level: 'ERROR',
+          logDestination: $interpolate\`\${logGroup.arn}:*\`,
+        },
+        roleArn,
+        type: 'STANDARD',
+      });
+
+    if (!databaseProvision.readwriteSecretArn) {
+      throw new Error(
+        'The active primary database is missing its read/write credential reference.',
+      );
+    }
+    const retentionTaskLogs = managedLogContract('job-data-retention');
+    const retentionTask = new sst.aws.Task('${pascalName}DataRetentionTask', {
+      ...workloadRoleBindings!.dataRetention.task,
+      cluster: foundation.cluster,
+      environment: {
+        ...dataRetentionContainer.environment,
+        AWS_REGION: region,
+        EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
+        EBK_DATABASE_NAME: databaseProvision.databaseName,
+        EBK_DATABASE_PORT: $interpolate\`\${foundation.database.port}\`,
+        EBK_DATABASE_USERNAME: databaseProvision.readwriteRole,
+        EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
+        EBK_READWRITE_SECRET_ARN: databaseProvision.readwriteSecretArn,
+        EBK_SLICE: '${name}',
+        EBK_STAGE: $app.stage,
+        EBK_WORKLOAD_IDENTITY: '${name}:data-retention-job',
+        EBK_WORKSPACE: '${workspace}',
+        EVENT_BUS_NAME: foundation.eventBus.name,
+      },
+      image: dataRetentionContainer.image,
+      link: secretLinksFor('data-retention-job-task'),
+      logging: {
+        name: retentionTaskLogs.name,
+        retention: '1 month',
+      },
+      transform: {
+        logGroup: {
+          logGroupClass: retentionTaskLogs.logGroupClass,
+          tags: retentionTaskLogs.tags,
+        },
+        taskDefinition: {
+          family: workloadRoleResourceNames!.dataRetentionTaskFamily,
+        },
+      },
+    });
+    const retentionTaskLogDataProtection = managedLogDataProtection(
+      '${pascalName}DataRetentionTaskLog',
+      retentionTaskLogs,
+      retentionTaskLogs.name,
+      [retentionTask.nodes.taskDefinition],
+      foundation.discovery.alertTopicArn,
+    );
+    const retentionWorkflowLogs = managedLogGroup(
+      '${pascalName}DataRetentionWorkflowLogs',
+      'job-data-retention-orchestration',
+      foundation.discovery.alertTopicArn,
+    );
+    const retentionOverrides = retentionTask.containers.apply(
+      (containers: string[]) => ({
+        ContainerOverrides: containers.map((containerName) => ({
+          Environment: [
+            {
+              Name: 'EBK_RETENTION_APPROVAL_ID',
+              Value: '{% $states.input.approvalRequestId %}',
+            },
+            {
+              Name: 'EBK_RETENTION_CORRELATION_ID',
+              Value: '{% $states.input.correlationId %}',
+            },
+            {
+              Name: 'EBK_RETENTION_AS_OF',
+              Value: '{% $states.input.asOf %}',
+            },
+            {
+              Name: 'EBK_RETENTION_MODE',
+              Value: '{% $states.input.mode %}',
+            },
+            {
+              Name: 'EBK_RETENTION_RUN_ID',
+              Value: '{% $states.input.runId %}',
+            },
+            {
+              Name: 'EBK_STEP_FUNCTIONS_TASK_TOKEN',
+              Value: '{% $states.context.Task.Token %}',
+            },
+          ],
+          Name: containerName,
+        })),
+      }),
+    );
+    const retentionStateMachine = createRawStateMachine(
+      '${pascalName}DataRetention',
+      {
+        StartAt: 'RunDataRetention',
+        States: {
+          DataRetentionSucceeded: {
+            QueryLanguage: 'JSONata',
+            Type: 'Succeed',
+          },
+          RunDataRetention: {
+            Arguments: {
+              ...taskArguments(retentionTask),
+              Overrides: retentionOverrides,
+            },
+            Next: 'DataRetentionSucceeded',
+            QueryLanguage: 'JSONata',
+            Resource: 'arn:aws:states:::ecs:runTask.waitForTaskToken',
+            Retry: [
+              {
+                BackoffRate: 2,
+                ErrorEquals: [
+                  'ECS.AmazonECSException',
+                  'ECS.ECSException',
+                ],
+                IntervalSeconds: 10,
+                MaxAttempts: 2,
+              },
+            ],
+            TimeoutSeconds: 2700,
+            Type: 'Task',
+          },
+        },
+      },
+      retentionWorkflowLogs.logGroup,
+      workloadRoleBindings!.dataRetention.orchestration.roleArn,
+    );
+    const retentionFailureAlarm = new aws.cloudwatch.MetricAlarm(
+      '${pascalName}DataRetentionFailure',
+      {
+        alarmActions: [foundation.discovery.alertTopicArn],
+        alarmDescription: operationalAlarmDescription({
+          businessSymptom:
+            'The built-in retention Job terminated unsuccessfully.',
+          id: 'retention-job-failure',
+          runbook: 'docs/runbooks/database-recovery.md',
+        }),
+        comparisonOperator: 'GreaterThanOrEqualToThreshold',
+        evaluationPeriods: 1,
+        metricQueries: [
+          ...['ExecutionsFailed', 'ExecutionsTimedOut', 'ExecutionsAborted'].map(
+            (metricName, index) => ({
+              id: 'm' + index,
+              metric: {
+                dimensions: {
+                  StateMachineArn: retentionStateMachine.arn,
+                },
+                metricName,
+                namespace: 'AWS/States',
+                period: 60,
+                stat: 'Sum',
+              },
+              returnData: false,
+            }),
+          ),
+          {
+            expression: 'm0+m1+m2',
+            id: 'failures',
+            label: 'Retention terminal execution failures',
+            returnData: true,
+          },
+        ],
+        name: '${name}-' + $app.stage + '-retention-job-failure',
+        threshold: 1,
+        treatMissingData: 'notBreaching',
+      },
+    );
+    const retentionRegistration = registerProductRetention(
+      retentionStateMachine.arn,
+    );
+    migrationControls.dataRetention = {
+      registration: retentionRegistration,
+      retentionFailureAlarm,
+      retentionStateMachine,
+      retentionTask,
+      retentionTaskLogDataProtection,
+      retentionWorkflowLogs,
+    };
+    const retentionMaintenanceTaskLogs = managedLogContract(
+      'job-data-retention-maintenance',
+    );
+    const retentionMaintenanceTask = new sst.aws.Task(
+      '${pascalName}DataRetentionMaintenanceTask',
+      {
+        ...workloadRoleBindings!.dataRetention.maintenance.task,
+        cluster: foundation.cluster,
+        environment: {
+          ...dataRetentionContainer.environment,
+          AWS_REGION: region,
+          EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
+          EBK_DATABASE_NAME: databaseProvision.databaseName,
+          EBK_DATABASE_PORT: $interpolate\`\${foundation.database.port}\`,
+          EBK_DATABASE_USERNAME: databaseProvision.readwriteRole,
+          EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
+          EBK_READWRITE_SECRET_ARN:
+            databaseProvision.readwriteSecretArn,
+          EBK_SLICE: '${name}',
+          EBK_STAGE: $app.stage,
+          EBK_WORKLOAD_IDENTITY: '${name}:data-retention-job',
+          EBK_WORKSPACE: '${workspace}',
+        },
+        image: dataRetentionContainer.image,
+        link: secretLinksFor(
+          'data-retention-maintenance-job-task',
+        ),
+        logging: {
+          name: retentionMaintenanceTaskLogs.name,
+          retention: '1 month',
+        },
+        transform: {
+          logGroup: {
+            logGroupClass:
+              retentionMaintenanceTaskLogs.logGroupClass,
+            tags: retentionMaintenanceTaskLogs.tags,
+          },
+          taskDefinition: {
+            family:
+              workloadRoleResourceNames!
+                .dataRetentionMaintenanceTaskFamily,
+          },
+        },
+      },
+    );
+    const retentionMaintenanceTaskLogDataProtection =
+      managedLogDataProtection(
+        '${pascalName}DataRetentionMaintenanceTaskLog',
+        retentionMaintenanceTaskLogs,
+        retentionMaintenanceTaskLogs.name,
+        [retentionMaintenanceTask.nodes.taskDefinition],
+        foundation.discovery.alertTopicArn,
+      );
+    const retentionMaintenanceLauncherLogs = managedLogGroup(
+      '${pascalName}DataRetentionMaintenanceLauncherLogs',
+      'job-data-retention-maintenance-launcher',
+      foundation.discovery.alertTopicArn,
+    );
+    const retentionMaintenanceContainerName =
+      retentionMaintenanceTask.containers.apply(
+        (containers: string[]) => {
+          if (containers.length !== 1 || !containers[0]) {
+            throw new Error(
+              'Retention maintenance requires exactly one task container.',
+            );
+          }
+          return containers[0];
+        },
+      );
+    const retentionMaintenanceLauncher = new sst.aws.Function(
+      '${pascalName}DataRetentionMaintenanceLauncher',
+      {
+        ...workloadRoleBindings!.dataRetention.maintenance.launcher,
+        environment: {
+          EBK_MAINTENANCE_ASSIGN_PUBLIC_IP:
+            retentionMaintenanceTask.assignPublicIp.apply(
+              (value: boolean) => String(value),
+            ),
+          EBK_MAINTENANCE_CLUSTER_ARN:
+            retentionMaintenanceTask.cluster,
+          EBK_MAINTENANCE_CONTAINER_NAME:
+            retentionMaintenanceContainerName,
+          EBK_MAINTENANCE_SECURITY_GROUP_IDS: $jsonStringify(
+            retentionMaintenanceTask.securityGroups,
+          ),
+          EBK_MAINTENANCE_SUBNET_IDS: $jsonStringify(
+            retentionMaintenanceTask.subnets,
+          ),
+          EBK_MAINTENANCE_TASK_DEFINITION_ARN:
+            retentionMaintenanceTask.taskDefinition,
+          EBK_STAGE: $app.stage,
+          EBK_WORKSPACE: '${workspace}',
+        },
+        handler: 'jobs/data-retention-maintenance-launcher.handler',
+        ...lambdaLogging(
+          retentionMaintenanceLauncherLogs.logGroup.name,
+        ),
+        timeout: '1 minute',
+      },
+    );
+    const retentionMaintenanceRule = new aws.cloudwatch.EventRule(
+      '${pascalName}DataRetentionMaintenanceSchedule',
+      {
+        name:
+          workloadRoleResourceNames!.dataRetentionMaintenanceRule,
+        scheduleExpression: 'rate(1 day)',
+      },
+    );
+    const retentionMaintenancePermission =
+      new aws.lambda.Permission(
+        '${pascalName}DataRetentionMaintenanceSchedulePermission',
+        {
+          action: 'lambda:InvokeFunction',
+          function: retentionMaintenanceLauncher.arn,
+          principal: 'events.amazonaws.com',
+          sourceArn: retentionMaintenanceRule.arn,
+        },
+      );
+    const retentionMaintenanceTarget =
+      new aws.cloudwatch.EventTarget(
+        '${pascalName}DataRetentionMaintenanceTarget',
+        {
+          arn: retentionMaintenanceLauncher.arn,
+          rule: retentionMaintenanceRule.name,
+          targetId: 'DataRetentionMaintenance',
+        },
+        { dependsOn: [retentionMaintenancePermission] },
+      );
+    migrationControls.dataRetentionMaintenance = {
+      retentionMaintenanceLauncher,
+      retentionMaintenanceLauncherLogs,
+      retentionMaintenanceRule,
+      retentionMaintenanceTarget,
+      retentionMaintenanceTask,
+      retentionMaintenanceTaskLogDataProtection,
+    };
+
+    for (const [databaseIdentifier, target] of Object.entries(
+      databaseProvisions.databases,
+    )) {
+      if (!target.readwriteSecretArn || !target.readonlySecretArn) {
+        throw new Error(
+          'Deployed database target ' + databaseIdentifier +
+            ' is missing its generated credential references.',
+        );
+      }
+      const bootstrapLogContract = managedLogContract(
+        'database-bootstrap',
+        databaseIdentifier,
+      );
+      const migrationLogContract = managedLogContract(
+        'database-migration',
+        databaseIdentifier,
+      );
+      const retirementLogContract = managedLogContract(
+        'database-retirement',
+        databaseIdentifier,
+      );
+      const databaseRoleBindings =
+        workloadRoleBindings!.database(databaseIdentifier);
+      const bootstrapTask = new sst.aws.Task(
+        target.resourceName + 'BootstrapTask',
+        {
+          ...databaseRoleBindings.bootstrap,
+          cluster: foundation.cluster,
+          command: ['node', 'jobs/bootstrap-database.mjs'],
+          environment: {
+            ...databaseMigrationContainer.environment,
+            AWS_REGION: region,
+            EBK_BOOTSTRAP_ID:
+              $app.name + ':' + $app.stage + ':' + databaseIdentifier,
+            EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
+            EBK_DATABASE_MIGRATOR_ROLE: target.migratorRole,
+            EBK_DATABASE_NAME: target.databaseName,
+            EBK_DATABASE_PORT:
+              $interpolate\`\${foundation.database.port}\`,
+            EBK_DATABASE_READONLY_ROLE: target.readonlyRole,
+            EBK_DATABASE_READWRITE_ROLE: target.readwriteRole,
+            EBK_DATABASE_ROTATION_TOKEN: target.rotationToken ?? '',
+            EBK_MASTER_SECRET_ARN: foundation.database.masterSecretArn,
+            EBK_READONLY_SECRET_ARN: target.readonlySecretArn,
+            EBK_READWRITE_SECRET_ARN: target.readwriteSecretArn,
+            EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
+            EBK_RUNTIME_DATABASE_HOST: foundation.database.host,
+            EBK_STAGE: $app.stage,
+            EBK_WORKSPACE: '${workspace}',
+          },
+          image: databaseMigrationContainer.image,
+          link: secretLinksFor(
+            'database-' + databaseIdentifier + '-bootstrap-task',
+          ),
+          logging: {
+            name: bootstrapLogContract.name,
+            retention: '1 month',
+          },
+          transform: {
+            logGroup: {
+              logGroupClass: bootstrapLogContract.logGroupClass,
+              tags: bootstrapLogContract.tags,
+            },
+            taskDefinition: {
+              family: standardSliceDatabaseTaskFamily(
+                $app.stage,
+                databaseIdentifier,
+                'bootstrap',
+              ),
+            },
+          },
+        },
+      );
+      const bootstrapLogDataProtection = managedLogDataProtection(
+        target.resourceName + 'BootstrapLog',
+        bootstrapLogContract,
+        bootstrapLogContract.name,
+        [bootstrapTask.nodes.taskDefinition],
+        foundation.discovery.alertTopicArn,
+      );
+      const migrationTask = new sst.aws.Task(
+        target.resourceName + 'MigrationTask',
+        {
+          ...databaseRoleBindings.migration,
+          cluster: foundation.cluster,
+          environment: {
+            ...databaseMigrationContainer.environment,
+            AWS_REGION: region,
+            EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
+            EBK_DATABASE_NAME: target.databaseName,
+            EBK_DATABASE_PORT:
+              $interpolate\`\${foundation.database.port}\`,
+            EBK_DATABASE_READWRITE_ROLE: target.readwriteRole,
+            EBK_DATABASE_USERNAME: target.migratorRole,
+            EBK_MIGRATION_ID:
+              $app.name + ':' + $app.stage + ':' + databaseIdentifier,
+            EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
+            EBK_STAGE: $app.stage,
+            EBK_WORKSPACE: '${workspace}',
+          },
+          image: databaseMigrationContainer.image,
+          link: secretLinksFor(
+            'database-' + databaseIdentifier + '-migration-task',
+          ),
+          logging: {
+            name: migrationLogContract.name,
+            retention: '1 month',
+          },
+          transform: {
+            logGroup: {
+              logGroupClass: migrationLogContract.logGroupClass,
+              tags: migrationLogContract.tags,
+            },
+            taskDefinition: {
+              family: standardSliceDatabaseTaskFamily(
+                $app.stage,
+                databaseIdentifier,
+                'migration',
+              ),
+            },
+          },
+        },
+      );
+      const migrationLogDataProtection = managedLogDataProtection(
+        target.resourceName + 'MigrationLog',
+        migrationLogContract,
+        migrationLogContract.name,
+        [migrationTask.nodes.taskDefinition],
+        foundation.discovery.alertTopicArn,
+      );
+      const migrationWorkflowLogs = managedLogGroup(
+        target.resourceName + 'MigrationWorkflowLogs',
+        'database-migration-orchestration',
+        foundation.discovery.alertTopicArn,
+        databaseIdentifier,
+      );
+      const stateMachine = createRawStateMachine(
+        target.resourceName + 'Migration',
+        {
+          StartAt: 'BootstrapDatabase',
+          States: {
+            BootstrapDatabase: {
+              Arguments: {
+                ...taskArguments(bootstrapTask),
+                Overrides: lifecycleEnvironment(bootstrapTask, false),
+              },
+              Next: 'RunDatabaseMigration',
+              QueryLanguage: 'JSONata',
+              Resource: 'arn:aws:states:::ecs:runTask.sync',
+              TimeoutSeconds: 2700,
+              Type: 'Task',
+            },
+            DatabaseMigrationSucceeded: {
+              QueryLanguage: 'JSONata',
+              Type: 'Succeed',
+            },
+            RunDatabaseMigration: {
+              Arguments: {
+                ...taskArguments(migrationTask),
+                Overrides: lifecycleEnvironment(migrationTask, false),
+              },
+              Next: 'DatabaseMigrationSucceeded',
+              QueryLanguage: 'JSONata',
+              Resource: 'arn:aws:states:::ecs:runTask.sync',
+              TimeoutSeconds: 2700,
+              Type: 'Task',
+            },
+          },
+        },
+        migrationWorkflowLogs.logGroup,
+        databaseRoleBindings.migrationOrchestration.roleArn,
+      );
+      const registration = registerProductMigration(
+        target.resourceName + 'MigrationRegistration',
+        databaseIdentifier,
+        stateMachine.arn,
+      );
+      const retirementTask =
+        $app.stage === 'development' &&
+        databaseIdentifier === 'retirement_rehearsal' &&
+        databaseRoleBindings.retirement
+          ? new sst.aws.Task(target.resourceName + 'RetirementTask', {
+              ...databaseRoleBindings.retirement.task,
+              cluster: foundation.cluster,
+              command: ['node', 'jobs/retire-database.mjs'],
+              environment: {
+                ...databaseRetirementContainer.environment,
+                AWS_REGION: region,
+                EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
+                EBK_DATABASE_IDENTIFIER: databaseIdentifier,
+                EBK_DATABASE_MIGRATOR_ROLE: target.migratorRole,
+                EBK_DATABASE_NAME: target.databaseName,
+                EBK_DATABASE_PORT:
+                  $interpolate\`\${foundation.database.port}\`,
+                EBK_DATABASE_READONLY_ROLE: target.readonlyRole,
+                EBK_DATABASE_READWRITE_ROLE: target.readwriteRole,
+                EBK_MASTER_SECRET_ARN: foundation.database.masterSecretArn,
+                EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
+                EBK_READONLY_SECRET_ARN: target.readonlySecretArn,
+                EBK_READWRITE_SECRET_ARN: target.readwriteSecretArn,
+                EBK_RETIREMENT_ID:
+                  $app.name + ':' + $app.stage + ':' + databaseIdentifier,
+                EBK_RETAINED_SIBLINGS: $jsonStringify(
+                  Object.entries(databaseProvisions.databases)
+                    .filter(([identifier]) => identifier !== databaseIdentifier)
+                    .sort(([left], [right]) =>
+                      left < right ? -1 : left > right ? 1 : 0,
+                    )
+                    .map(([identifier, sibling]) => ({
+                      databaseIdentifier: identifier,
+                      databaseName: sibling.databaseName,
+                      migratorRole: sibling.migratorRole,
+                      readonlyRole: sibling.readonlyRole,
+                      readonlySecretArn: sibling.readonlySecretArn,
+                      readwriteRole: sibling.readwriteRole,
+                      readwriteSecretArn: sibling.readwriteSecretArn,
+                    })),
+                ),
+                EBK_SLICE: '${name}',
+                EBK_STAGE: $app.stage,
+                EBK_WORKSPACE: '${workspace}',
+              },
+              image: databaseRetirementContainer.image,
+              link: secretLinksFor(
+                'database-' + databaseIdentifier + '-retirement-task',
+              ),
+              logging: {
+                name: retirementLogContract.name,
+                retention: '1 month',
+              },
+              transform: {
+                logGroup: {
+                  logGroupClass: retirementLogContract.logGroupClass,
+                  tags: retirementLogContract.tags,
+                },
+                taskDefinition: {
+                  family: standardSliceDatabaseTaskFamily(
+                    $app.stage,
+                    databaseIdentifier,
+                    'retirement',
+                  ),
+                },
+              },
+            })
+          : undefined;
+      const retirementLogDataProtection = retirementTask
+        ? managedLogDataProtection(
+            target.resourceName + 'RetirementLog',
+            retirementLogContract,
+            retirementLogContract.name,
+            [retirementTask.nodes.taskDefinition],
+            foundation.discovery.alertTopicArn,
+          )
+        : undefined;
+      let retirementControl;
+      if (retirementTask) {
+        const retirementWorkflowLogs = managedLogGroup(
+          target.resourceName + 'RetirementWorkflowLogs',
+          'database-retirement-orchestration',
+          foundation.discovery.alertTopicArn,
+          databaseIdentifier,
+        );
+        const retirementStateMachine = createRawStateMachine(
+          target.resourceName + 'MigrationRetirement',
+          {
+            StartAt: 'RetireDatabase',
+            States: {
+              DatabaseRetirementSucceeded: {
+                QueryLanguage: 'JSONata',
+                Type: 'Succeed',
+              },
+              RetireDatabase: {
+                Arguments: {
+                  ...taskArguments(retirementTask),
+                  Overrides: lifecycleEnvironment(retirementTask, true),
+                },
+                Next: 'DatabaseRetirementSucceeded',
+                QueryLanguage: 'JSONata',
+                Resource: 'arn:aws:states:::ecs:runTask.waitForTaskToken',
+                Retry: [
+                  {
+                    BackoffRate: 2,
+                    ErrorEquals: [
+                      'ECS.AmazonECSException',
+                      'ECS.ECSException',
+                    ],
+                    IntervalSeconds: 10,
+                    MaxAttempts: 2,
+                  },
+                ],
+                TimeoutSeconds: 2700,
+                Type: 'Task',
+              },
+            },
+          },
+          retirementWorkflowLogs.logGroup,
+          databaseRoleBindings.retirement!.orchestration.roleArn,
+        );
+        retirementControl = {
+          retirementWorkflowLogs,
+          retirementStateMachine,
+          retirementTask,
+        };
+      }
+      migrationControls[databaseIdentifier] = {
+        bootstrapLogDataProtection,
+        bootstrapTask,
+        migrationLogDataProtection,
+        migrationTask,
+        migrationWorkflowLogs,
+        registration,
+        retirementLogDataProtection,
+        ...(retirementControl ?? {}),
+        stateMachine,
+      };
+    }
+  }
+
+  const outboxRelayAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}OutboxRelayErrors',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'The transactional outbox relay is failing.',
+        id: 'outbox-relay-errors',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { FunctionName: asyncOutboxRelay.name },
+      evaluationPeriods: 1,
+      metricName: 'Errors',
+      name: '${name}-' + $app.stage + '-outbox-relay-errors',
+      namespace: 'AWS/Lambda',
+      period: 300,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const inboxCleanupErrorAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}InboxCleanupErrors',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'The asynchronous inbox cleanup job is failing.',
+        id: 'inbox-cleanup-errors',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { FunctionName: asyncInboxCleanup.name },
+      evaluationPeriods: 1,
+      metricName: 'Errors',
+      name: '${name}-' + $app.stage + '-inbox-cleanup-errors',
+      namespace: 'AWS/Lambda',
+      period: 300,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const dataExportCleanupErrorAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}DataExportCleanupErrors',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom:
+          'The confidential-export cleanup invocation is failing.',
+        id: 'data-export-cleanup-failure',
+        runbook: 'docs/runbooks/database-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { FunctionName: dataExportCleanup.name },
+      evaluationPeriods: 1,
+      metricName: 'Errors',
+      name: '${name}-' + $app.stage + '-data-export-cleanup-failure',
+      namespace: 'AWS/Lambda',
+      period: 300,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const dataExportCleanupInvocationAlarm =
+    new aws.cloudwatch.MetricAlarm(
+      '${pascalName}DataExportCleanupInvocationMissing',
+      {
+        alarmActions: [foundation.discovery.alertTopicArn],
+        alarmDescription: operationalAlarmDescription({
+          businessSymptom:
+            'The scheduled confidential-export cleanup is not running.',
+          id: 'data-export-cleanup-invocation-missing',
+          runbook: 'docs/runbooks/database-recovery.md',
+        }),
+        comparisonOperator: 'LessThanThreshold',
+        dimensions: { FunctionName: dataExportCleanup.name },
+        evaluationPeriods: 2,
+        metricName: 'Invocations',
+        name:
+          '${name}-' +
+          $app.stage +
+          '-data-export-cleanup-invocation-missing',
+        namespace: 'AWS/Lambda',
+        period: 3600,
+        statistic: 'Sum',
+        threshold: 1,
+        treatMissingData: 'breaching',
+      },
+    );
+  const outboxBacklogAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}OutboxBacklog',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'Transactional outbox work is accumulating.',
+        id: 'outbox-backlog',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { Slice: '${name}', Stage: $app.stage },
+      evaluationPeriods: 2,
+      metricName: 'OutboxBacklog',
+      name: '${name}-' + $app.stage + '-outbox-backlog',
+      namespace: 'EBK/Async',
+      period: 300,
+      statistic: 'Maximum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const inboxCleanupBacklogAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}InboxCleanupBacklog',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'Terminal asynchronous inbox records are accumulating.',
+        id: 'inbox-cleanup-backlog',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: {
+        Component: 'inbox-cleanup',
+        Feature: 'async-work',
+        Operation: 'inbox-cleanup',
+        Slice: '${name}',
+        Stage: $app.stage,
+      },
+      evaluationPeriods: 2,
+      metricName: 'InboxCleanupBacklog',
+      name: '${name}-' + $app.stage + '-inbox-cleanup-backlog',
+      namespace: 'EBK/Async',
+      period: 3600,
+      statistic: 'Maximum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const dataExportCleanupDeadlineAlarm =
+    new aws.cloudwatch.MetricAlarm(
+      '${pascalName}DataExportCleanupDeadline',
+      {
+        alarmActions: [foundation.discovery.alertTopicArn],
+        alarmDescription: operationalAlarmDescription({
+          businessSymptom:
+            'Confidential-export residue exceeded its deletion deadline.',
+          id: 'data-export-cleanup-deadline',
+          runbook: 'docs/runbooks/database-recovery.md',
+        }),
+        comparisonOperator: 'GreaterThanOrEqualToThreshold',
+        dimensions: {
+          Component: 'data-export-cleanup',
+          Feature: 'data-lifecycle',
+          Operation: 'expiry-cleanup',
+          Slice: '${name}',
+          Stage: $app.stage,
+        },
+        evaluationPeriods: 1,
+        metricName: 'DataExportCleanupDeadlineBreaches',
+        name:
+          '${name}-' +
+          $app.stage +
+          '-data-export-cleanup-deadline',
+        namespace: 'EBK/DataLifecycle',
+        period: 3600,
+        statistic: 'Maximum',
+        threshold: 1,
+        treatMissingData: 'notBreaching',
+      },
+    );
+  const performanceLoadCleanupBacklogAlarm =
+    new aws.cloudwatch.MetricAlarm(
+      '${pascalName}PerformanceLoadCleanupBacklog',
+      {
+        alarmActions: [foundation.discovery.alertTopicArn],
+        alarmDescription: operationalAlarmDescription({
+          businessSymptom:
+            'Expired protected performance-load evidence is accumulating.',
+          id: 'performance-load-cleanup-backlog',
+          runbook: 'docs/runbooks/performance-capacity-cost.md',
+        }),
+        comparisonOperator: 'GreaterThanOrEqualToThreshold',
+        dimensions: {
+          Component: 'performance-load-cleanup',
+          Feature: 'performance',
+          Operation: 'expiry-cleanup',
+          Slice: '${name}',
+          Stage: $app.stage,
+        },
+        evaluationPeriods: 2,
+        metricName: 'PerformanceLoadCleanupBacklog',
+        name:
+          '${name}-' +
+          $app.stage +
+          '-performance-load-cleanup-backlog',
+        namespace: 'EBK/Performance',
+        period: 3600,
+        statistic: 'Maximum',
+        threshold: 1,
+        treatMissingData: 'notBreaching',
+      },
+    );
+  const performanceLoadCleanupDeadlineAlarm =
+    new aws.cloudwatch.MetricAlarm(
+      '${pascalName}PerformanceLoadCleanupDeadline',
+      {
+        alarmActions: [foundation.discovery.alertTopicArn],
+        alarmDescription: operationalAlarmDescription({
+          businessSymptom:
+            'Protected performance-load residue exceeded its cleanup deadline.',
+          id: 'performance-load-cleanup-deadline',
+          runbook: 'docs/runbooks/performance-capacity-cost.md',
+        }),
+        comparisonOperator: 'GreaterThanOrEqualToThreshold',
+        dimensions: {
+          Component: 'performance-load-cleanup',
+          Feature: 'performance',
+          Operation: 'expiry-cleanup',
+          Slice: '${name}',
+          Stage: $app.stage,
+        },
+        evaluationPeriods: 1,
+        metricName: 'PerformanceLoadCleanupDeadlineBreaches',
+        name:
+          '${name}-' +
+          $app.stage +
+          '-performance-load-cleanup-deadline',
+        namespace: 'EBK/Performance',
+        period: 3600,
+        statistic: 'Maximum',
+        threshold: 1,
+        treatMissingData: 'notBreaching',
+      },
+    );
+  const dashboard = new aws.cloudwatch.Dashboard('${pascalName}Dashboard', {
+    dashboardName: '${name}-' + $app.stage,
+    dashboardBody: JSON.stringify({
+      widgets: [{
+        type: 'text', x: 0, y: 0, width: 24, height: 3,
+        properties: { markdown: '# ${pascalName}\\nOwner: product' },
+      }],
+    }),
+  });
+  return {
+    api,
+    asyncInboxCleanup,
+    dataExportCleanupDeadlineAlarm,
+    dataExportCleanupErrorAlarm,
+    dataExportCleanupInvocationAlarm,
+    inboxCleanupErrorAlarm,
+    inboxCleanupBacklogAlarm,
+    inboxCleanupRule,
+    inboxCleanupTarget,
+    performanceLoadCleanupBacklogAlarm,
+    performanceLoadCleanupDeadlineAlarm,
+    asyncOutboxRelay,
+    asyncRecoveryLedger,
+    asyncScheduleTarget,
+    asyncTargetDlq,
+    asyncTargetDlqAlarm,
+    asyncTargetDlqPolicy,
+    asyncWorkflowTask,
+    authClient,
+    configurationApplication,
+    configurationDeployment,
+    configurationDeploymentStrategy,
+    configurationEnvironment,
+    configurationProfile,
+    configurationVersion,
+    dashboard,
+    dataExportCleanup,
+    dataExportCleanupInvocation,
+    dataExportCleanupRule,
+    dataExportCleanupTarget,
+    dataExportStore,
+    database,
+    dlqAlarm,
+    eventDlq,
+    eventQueue,
+    machineClientProvisioner,
+    migrationControls,
+    outboxBacklogAlarm,
+    outboxRelayAlarm,
+    outboxRelayRule,
+    outboxRelayTarget,
+    performanceCostControls,
+    performanceEndpoint: performanceIngress?.router.url,
+    providerDlq,
+    providerDlqAlarm,
+    providerQueue,
+    reliability,
+    providerReconciliationRule,
+    providerReconciliationTarget,
+    recordExportWorkflow,
+    machineAuthorization,
+    machineAuthorizationProof,
+    web,
+    // <ebk:composition-outputs:start>
+    // <ebk:composition-outputs:end>
+  };
+}
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-infrastructure-files.js.map