@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/generators/slice/built-in-plan-infrastructure-files.js

@@ -2,163 +2,49 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductInfrastructureFiles = renderProductInfrastructureFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const built_in_plan_key_value_retention_infrastructure_js_1 = require("./built-in-plan-key-value-retention-infrastructure.js");
 /** @internal */
-function renderProductInfrastructureFiles(name, pascalName, workspace, protectedRuntimeStages = ['staging', 'production']) {
+function renderProductInfrastructureFiles(name, pascalName, workspace, protectedRuntimeStages = ['staging', 'production'], sql = false, network = sql) {
     const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
     const recordExportWorkflowName = (0, built_in_plan_shared_js_1.stableGeneratedName)(40, name);
-    return {
-        'jobs/data-retention-maintenance-launcher.ts': `import {
-  ECSClient,
-  RunTaskCommand,
-} from '@aws-sdk/client-ecs';
-import { createLogger } from '@empire-builder-kit/runtime/logging';
-
-const UUID =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const ECS_CLUSTER_ARN =
-  new RegExp(
-    '^arn:(?:aws|aws-cn|aws-us-gov):ecs:[a-z0-9-]+:' +
-      '[0-9]{12}:cluster/[A-Za-z0-9_./-]{1,255}$',
-  );
-const ECS_TASK_DEFINITION_ARN =
-  /^arn:(?:aws|aws-cn|aws-us-gov):ecs:[a-z0-9-]+:[0-9]{12}:task-definition\\/[A-Za-z0-9_-]{1,255}:[1-9][0-9]*$/;
-const NETWORK_ID = /^(?:sg|subnet)-[0-9a-f]{8,32}$/;
-const CONTAINER_NAME = /^[A-Za-z0-9_-]{1,255}$/;
-
-function required(name: string): string {
-  const value = process.env[name]?.trim();
-  if (!value) throw new Error(name + ' is required.');
-  return value;
-}
-
-function requiredArn(name: string, pattern: RegExp): string {
-  const value = required(name);
-  if (!pattern.test(value)) {
-    throw new Error(name + ' is not the exact expected ECS ARN.');
-  }
-  return value;
-}
-
-function requiredBoolean(name: string): boolean {
-  const value = required(name);
-  if (value !== 'true' && value !== 'false') {
-    throw new Error(name + ' must be exactly true or false.');
-  }
-  return value === 'true';
-}
-
-function requiredNetworkIds(name: string): string[] {
-  let value: unknown;
-  try {
-    value = JSON.parse(required(name));
-  } catch {
-    throw new Error(name + ' must be one bounded JSON array.');
-  }
+    const files = {
+        'infra/event-subscriptions.ts': `/** Read the existing seeded event contract; never broaden source or stage routing. */
+export function sameSliceEventDetailTypes(value: unknown): string[] {
+  const contract = value as {
+    kind?: unknown;
+    schemaVersion?: unknown;
+    slice?: unknown;
+    events?: unknown;
+  } | null;
   if (
-    !Array.isArray(value) ||
-    value.length < 1 ||
-    value.length > 16 ||
-    value.some(
-      (entry) => typeof entry !== 'string' || !NETWORK_ID.test(entry),
-    )
-  ) {
-    throw new Error(name + ' must contain only exact AWS network IDs.');
-  }
-  return value;
-}
-
-function requiredScheduledEventId(event: unknown): string {
-  const id =
-    event && typeof event === 'object' && 'id' in event
-      ? (event as { id?: unknown }).id
-      : undefined;
-  if (typeof id !== 'string' || !UUID.test(id)) {
-    throw new Error('Scheduled maintenance requires one exact event ID.');
-  }
-  return id.toLowerCase();
-}
-
-export async function handler(event: unknown) {
-  const stage = required('EBK_STAGE');
-  const logger = createLogger({
-    component: 'job-data-retention-maintenance-launcher',
-    feature: 'data-lifecycle',
-    operation: 'retention-maintenance-launch',
-    slice: '${name}',
-    stage,
-    workspace: required('EBK_WORKSPACE'),
-  });
-  const correlationId = requiredScheduledEventId(event);
-  try {
-    const containerName = required('EBK_MAINTENANCE_CONTAINER_NAME');
-    if (!CONTAINER_NAME.test(containerName)) {
-      throw new Error('Maintenance container name is invalid.');
-    }
-    const response = await new ECSClient({}).send(
-      new RunTaskCommand({
-        cluster: requiredArn('EBK_MAINTENANCE_CLUSTER_ARN', ECS_CLUSTER_ARN),
-        count: 1,
-        enableExecuteCommand: false,
-        launchType: 'FARGATE',
-        networkConfiguration: {
-          awsvpcConfiguration: {
-            assignPublicIp:
-              requiredBoolean('EBK_MAINTENANCE_ASSIGN_PUBLIC_IP')
-                ? 'ENABLED'
-                : 'DISABLED',
-            securityGroups: requiredNetworkIds(
-              'EBK_MAINTENANCE_SECURITY_GROUP_IDS',
-            ),
-            subnets: requiredNetworkIds('EBK_MAINTENANCE_SUBNET_IDS'),
-          },
-        },
-        overrides: {
-          containerOverrides: [
-            {
-              command: [
-                'node',
-                'dist/jobs/data-retention/src/maintenance.js',
-              ],
-              environment: [
-                {
-                  name: 'EBK_MAINTENANCE_CORRELATION_ID',
-                  value: correlationId,
-                },
-              ],
-              name: containerName,
-            },
-          ],
-        },
-        taskDefinition: requiredArn(
-          'EBK_MAINTENANCE_TASK_DEFINITION_ARN',
-          ECS_TASK_DEFINITION_ARN,
-        ),
-      }),
-    );
+    !contract || contract.kind !== 'ebk-event-contract-schema' ||
+    contract.schemaVersion !== 1 || contract.slice !== '${name}' ||
+    !Array.isArray(contract.events) || contract.events.length < 2 ||
+    contract.events.length > 32
+  ) throw new Error('Event subscriptions require the bounded seeded ${name} EventContractSchema.');
+  const types = new Set<string>();
+  for (const raw of contract.events) {
+    const event = raw as {
+      detailType?: unknown;
+      source?: unknown;
+      schemaVersion?: unknown;
+      data?: unknown;
+    } | null;
     if (
-      (response.failures?.length ?? 0) !== 0 ||
-      response.tasks?.length !== 1 ||
-      !response.tasks[0]?.taskArn
-    ) {
-      throw new Error('ECS did not accept exactly one maintenance task.');
-    }
-    logger.info('Retention maintenance task launched', {
-      attributes: { launchCount: 1 },
-      outcome: 'success',
-    });
-    return { accepted: true };
-  } catch (error) {
-    logger.error('Retention maintenance task launch failed', {
-      attributes: {
-        errorCode:
-          error instanceof Error
-            ? error.name.replace(/[^A-Za-z0-9_.-]/g, '').slice(0, 80)
-            : 'RetentionMaintenanceLaunchError',
-      },
-      outcome: 'failure',
-    });
-    throw error;
+      !event || typeof event.detailType !== 'string' ||
+      !/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(event.detailType) ||
+      event.source !== '${name}' || typeof event.schemaVersion !== 'number' ||
+      !Number.isSafeInteger(event.schemaVersion) || event.schemaVersion < 1 ||
+      !event.data || typeof event.data !== 'object' || Array.isArray(event.data) ||
+      types.has(event.detailType)
+    ) throw new Error('Event subscriptions require unique literal types, exact Slice sources and valid schemas.');
+    types.add(event.detailType);
   }
+  if (!types.has('${pascalName}Created') || !types.has('DataLifecycleChanged'))
+    throw new Error('The generated event contract must retain its built-in event declarations.');
+  // Lifecycle consumers have their own exact source declaration and rule.
+  types.delete('DataLifecycleChanged');
+  return [...types].sort();
 }
 `,
         'infra/route-function-materialization.ts': `type RouteFunctionArgs = {
@@ -181,7 +67,7 @@ type RouteRegistrar<Result> = (
 
 export function createVpcRouteFunctionMaterializer(input: {
   directHandlers: readonly string[];
-  foundationVpc: unknown;
+  foundationVpc?: unknown;
   output: OutputFactory;
 }) {
   const directHandlerLimit = 2;
@@ -308,7 +194,7 @@ export function createVpcRouteFunctionMaterializer(input: {
     routeFunctions.set(handlerPath, {
       ...handler,
       handler: handlerPath,
-      vpc: input.foundationVpc,
+      ...(input.foundationVpc === undefined ? {} : { vpc: input.foundationVpc }),
     });
     try {
       return register(rawRoute, handlerPath, args);
@@ -502,7 +388,7 @@ export function validateSuccessfulDeploymentReceipt(
         'infra/product.ts': `import {
   createManagedLogGroupContract,
   createRouterOriginProofInjection,
-  provisionDatabaseBindings,
+${sql ? '  provisionDatabaseBindings,\n' : ''}\
 } from '@empire-builder-kit/nx/foundation';
 import * as random from '@pulumi/random';
 import { createHash } from 'node:crypto';
@@ -534,7 +420,12 @@ import {
   ${identifierPrefix}UseRecordDelegation,
 } from '../api/contracts/protected.js';
 import lifecycleConsumers from '../data/lifecycle-consumers.json';
-import databaseBindings from '../database/bindings.json';
+import { EventContractSchema } from '../contracts/events.js';
+import { sameSliceEventDetailTypes } from './event-subscriptions.js';
+${sql ? "import databaseBindings from '../database/bindings.json';\n" : ''}\
+${sql ? "import { createSqlOutboxInfrastructure } from './sql-outbox.js';\n" : ''}\
+${"import { createKeyValueInfrastructure } from './key-value.js';\n"}\
+${"import { createKeyValueRetentionInfrastructure } from './key-value-retention.js';\n"}\
 import localConfiguration from '../configuration/local-values.json';
 import backgroundWorkPolicy from '../operations/background-work.json';
 import { backgroundWorkSchedules } from './background-work.js';
@@ -542,7 +433,7 @@ import { ConfigurationDeclarations } from '../configuration/declarations.js';
 import { assertAsyncAdapterDeploymentReady } from '../async/recovery-adapters.js';
 import {
   getFoundationInfrastructure,
-  registerProductMigration,
+${sql ? '  registerProductMigration,\n' : ''}\
   registerProductRetention,
 } from './foundation.js';
 import { createVpcRouteFunctionMaterializer } from './route-function-materialization.js';
@@ -550,9 +441,12 @@ import { removeFinderMetadataFromBuiltFunction } from './next-build-authority.js
 import {
   createStandardSliceNativeRuntimeAuthority,
 } from './native-runtime-authority/index.js';
-import {
+${sql
+            ? `import {
   standardSliceDatabaseTaskFamily,
 } from './native-runtime-authority/effective-intent.js';
+`
+            : ''}\
 import { createStandardSliceSecretLinks } from './personal-secrets.js';
 import { create${pascalName}PerformanceCostControls } from './performance-cost-controls.js';
 import {
@@ -562,7 +456,7 @@ import {
 } from './authorization.js';
 import { createStandardDataExportStore } from './data-export.js';
 import { create${pascalName}Reliability } from './reliability.js';
-import { resolveStandardContainerImage } from './container-images.js';
+${sql ? "import { resolveStandardContainerImage } from './container-images.js';\n" : ''}\
 import {
   defineEventConsumerAlarms,
 } from '@empire-builder-kit/runtime/observability';
@@ -800,11 +694,14 @@ export function product() {
     process.env.EBK_SOURCE_COMMIT ?? (protectedStage ? '' : 'unresolved');
   const releaseSourceCommit =
     process.env.EBK_RELEASE_SOURCE_COMMIT ?? sourceCommit;
-  const exactDevelopmentRetirement =
+${sql
+            ? `  const exactDevelopmentRetirement =
     $app.stage === 'development' &&
     Object.values(databaseBindings).some((binding) =>
       binding.provisioned.includes('retirement_rehearsal'),
     );
+`
+            : ''}\
   if (
     protectedStage &&
     (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit) ||
@@ -836,16 +733,9 @@ export function product() {
       args.triggers = { version: releaseSourceCommit };
     },
   );
-  const dataRetentionContainer = resolveStandardContainerImage({
-    artifactId: '${name}.job.data-retention',
-    local: {
-      context: '../..',
-      dockerfile: 'packages/${name}/jobs/data-retention/Dockerfile',
-    },
-    sourceCommit: releaseSourceCommit,
-    stage: $app.stage,
-  });
-  const databaseMigrationContainer = resolveStandardContainerImage({
+${''}\
+${sql
+            ? `  const databaseMigrationContainer = resolveStandardContainerImage({
     artifactId: '${name}.job.database-migration',
     local: {
       context: '../..',
@@ -864,6 +754,8 @@ export function product() {
     sourceCommit: releaseSourceCommit,
     stage: $app.stage,
   });
+`
+            : ''}\
   const performanceDeploymentAuthority = protectedStage
     ? protectedPerformanceDeploymentAuthority({
         enabled: process.env.EBK_PERFORMANCE_LOAD_ENABLED ?? 'false',
@@ -872,12 +764,24 @@ export function product() {
       })
     : undefined;
   const foundation = getFoundationInfrastructure();
+${`  const keyValue = createKeyValueInfrastructure({
+    eventBusArn: foundation.discovery.eventBusArn,
+    eventBusName: foundation.discovery.eventBusName,
+    alertTopicArn: foundation.discovery.alertTopicArn,
+    outbox: backgroundSchedules.outbox,
+    managedLogGroup,
+    lambdaLogging,
+  });
+`}\
   const nativeAuthority = createStandardSliceNativeRuntimeAuthority({
-    clusterId: foundation.discovery.clusterId,
+${sql
+            ? `    clusterId: foundation.discovery.clusterId,
     clusterResourceId: foundation.database.clusterResourceId,
+    masterSecretArn: foundation.database.masterSecretArn,
+`
+            : ''}\
     eventBusArn: foundation.discovery.eventBusArn,
     identityUserPoolArn: foundation.discovery.identityUserPoolArn,
-    masterSecretArn: foundation.database.masterSecretArn,
   });
   const runtimeResourceNames = nativeAuthority.resourceNames;
   $transform(aws.dynamodb.Table, (args: any, _opts: any, logicalName: string) => {
@@ -897,12 +801,15 @@ export function product() {
     alertTopicArn: foundation.discovery.alertTopicArn,
     workspace: '${workspace}',
   });
-  const databaseProvisions = provisionDatabaseBindings(foundation, {
+${sql
+            ? `  const databaseProvisions = provisionDatabaseBindings(foundation, {
     bindings: databaseBindings,
     slice: '${name}',
   });
   const databaseProvision = databaseProvisions.bindings.primary;
   const { db: database } = databaseProvision;
+`
+            : ''}\
   const authClient = foundation.userPool.addClient('${pascalName}WebAuthClient', {
     transform: {
       client: {
@@ -922,6 +829,7 @@ export function product() {
   const machineClientProvisioner = new sst.aws.Function(
     '${pascalName}MachineClientProvisioner',
     {
+      dev: false,
       permissions: standardSliceMachineClientProvisionerPermissions({
         userPoolArn: foundation.discovery.identityUserPoolArn,
       }),
@@ -1069,11 +977,11 @@ export function product() {
         'api/health.handler',
         'async/webhook-ingress.handler',
       ],
-      foundationVpc: foundation.vpc,
+${''}\
       output: $output,
     });
   const api = new sst.aws.ApiGatewayV2('${pascalName}Api', {
-    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } : {}),
+${network ? '    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } : {}),\n' : ''}\
     transform: {
       route: {
         handler: vpcRouteFunctionMaterializer.transform,
@@ -1145,6 +1053,7 @@ export function product() {
     {
       permissions: nativeAuthority.permissions('api-machine-authorization-proof'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -1154,7 +1063,7 @@ export function product() {
       },
       handler: 'api/machine-authorization.handler',
       link: [
-        database,
+        ${'keyValue.link'},
         ...secretLinksFor('api-machine-authorization-proof'),
       ],
       ...lambdaLogging(machineAuthorizationProofTargetLogs.logGroup.name),
@@ -1177,6 +1086,7 @@ export function product() {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-delegations'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -1185,7 +1095,7 @@ export function product() {
         EBK_STAGE: $app.stage,
       },
       handler: route.handler,
-      link: [database, ...secretLinksFor('api-delegations')],
+      link: [${'keyValue.link'}, ...secretLinksFor('api-delegations')],
       ...lambdaLogging(delegationLogs.logGroup.name),
     });
   }
@@ -1230,6 +1140,7 @@ export function product() {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-data-rights'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -1242,7 +1153,7 @@ export function product() {
       },
       handler: route.handler,
       link: [
-        database,
+        ${'keyValue.link'},
         foundation.eventBus,
         ...secretLinksFor('api-data-rights'),
       ],
@@ -1262,6 +1173,7 @@ export function product() {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -1270,7 +1182,7 @@ export function product() {
         EBK_STAGE: $app.stage,
       },
       handler: route.handler,
-      link: [database, ...secretLinksFor('api-database-records')],
+      link: [${'keyValue.link'}, ...secretLinksFor('api-database-records')],
       ...lambdaLogging(dataRetentionReviewLogs.logGroup.name),
     });
   }
@@ -1281,6 +1193,7 @@ export function product() {
     {
     permissions: nativeAuthority.permissions('api-protected'),
     environment: {
+${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
         machineAuthorization.acceptedClientIdsJson,
@@ -1289,7 +1202,7 @@ export function product() {
       EBK_STAGE: $app.stage,
     },
     handler: 'api/protected.handler',
-    link: [database, ...secretLinksFor('api-protected')],
+    link: [${'keyValue.link'}, ...secretLinksFor('api-protected')],
     ...lambdaLogging(protectedApiLogs.logGroup.name),
     },
   );
@@ -1300,6 +1213,7 @@ export function product() {
     {
     permissions: nativeAuthority.permissions('api-database-health'),
     environment: {
+${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
         machineAuthorization.acceptedClientIdsJson,
@@ -1308,7 +1222,7 @@ export function product() {
       EBK_STAGE: $app.stage,
     },
     handler: 'database/runtime-health.handler',
-    link: [database, ...secretLinksFor('api-database-health')],
+    link: [${'keyValue.link'}, ...secretLinksFor('api-database-health')],
     ...lambdaLogging(databaseHealthLogs.logGroup.name),
     },
   );
@@ -1329,6 +1243,7 @@ export function product() {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -1339,7 +1254,7 @@ export function product() {
       },
       handler: route.handler,
       link: [
-        database,
+        ${'keyValue.link'},
         foundation.eventBus,
         ...secretLinksFor('api-database-records'),
       ],
@@ -1359,6 +1274,7 @@ export function product() {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -1367,7 +1283,7 @@ export function product() {
         EBK_STAGE: $app.stage,
       },
       handler: route.handler,
-      link: [database, ...secretLinksFor('api-database-records')],
+      link: [${'keyValue.link'}, ...secretLinksFor('api-database-records')],
       ...lambdaLogging(databaseRecordsLogs.logGroup.name),
     });
   }
@@ -1378,6 +1294,7 @@ export function product() {
     {
     permissions: nativeAuthority.permissions('api-publish-created'),
     environment: {
+${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
         machineAuthorization.acceptedClientIdsJson,
@@ -1388,7 +1305,7 @@ export function product() {
     },
     handler: 'api/publish-created.handler',
     link: [
-      database,
+      ${'keyValue.link'},
       foundation.eventBus,
       ...secretLinksFor('api-publish-created'),
     ],
@@ -1415,6 +1332,7 @@ export function product() {
     {
       permissions: dataExportStore.cleanupPermissions,
       environment: {
+${'        ...keyValue.environment,\n'}\
         DATA_EXPORT_BUCKET_NAME: dataExportStore.bucket.bucket,
         DATA_EXPORT_KMS_KEY_ARN: dataExportStore.encryptionKey.arn,
         EBK_STAGE: $app.stage,
@@ -1422,12 +1340,12 @@ export function product() {
       },
       handler: 'jobs/data-export-cleanup.handler',
       link: [
-        database,
+        ${'keyValue.link'},
         ...secretLinksFor('data-export-cleanup'),
       ],
       ...lambdaLogging(dataExportCleanupLogs.logGroup.name),
       timeout: '5 minutes',
-      vpc: foundation.vpc,
+${''}\
     },
   );
   const dataExportCleanupRule = new aws.cloudwatch.EventRule(
@@ -1517,15 +1435,16 @@ export function product() {
   );
   eventQueue.subscribe({
     environment: {
+${'      ...keyValue.environment,\n'}\
       EBK_STAGE: $app.stage,
       EBK_WORKLOAD_IDENTITY: '${name}:event-consumer',
     },
     handler: 'api/event-consumer.handler',
-    link: [database, ...secretLinksFor('event-consumer')],
+    link: [${'keyValue.link'}, ...secretLinksFor('event-consumer')],
     permissions: nativeAuthority.permissions('event-consumer'),
     ...lambdaLogging(eventConsumerLogs.logGroup.name),
     timeout: '1 minute',
-    vpc: foundation.vpc,
+${''}\
   }, {
     batch: { partialResponses: true },
   });
@@ -1535,7 +1454,7 @@ export function product() {
     {
       pattern: {
         detail: { meta: { stage: [$app.stage] } },
-        detailType: ['${pascalName}Created'],
+        detailType: sameSliceEventDetailTypes(EventContractSchema),
         source: ['${name}'],
       },
     },
@@ -1630,7 +1549,7 @@ export function product() {
       (alertTopicArn: string) => alertTopicArn.split(':').at(-1) ?? '',
     ),
     apiId: api.id,
-    databaseClusterIdentifier: foundation.discovery.databaseClusterId,
+${'    databaseTableName: keyValue.table.name,\n'}\
     functionName: dataExportCleanup.name,
     providerQueueName: providerQueue.name,
   });
@@ -1847,6 +1766,7 @@ export function product() {
     providerQueue.subscribe(
       {
         environment: {
+${'          ...keyValue.environment,\n'}\
           EBK_STAGE: $app.stage,
           EBK_WORKLOAD_IDENTITY: '${name}:async-provider-worker',
           EBK_WORKSPACE: '${workspace}',
@@ -1854,14 +1774,14 @@ export function product() {
         },
         handler: 'async/provider-worker.handler',
         link: [
-          database,
+          ${'keyValue.link'},
           providerQueue,
           ...secretLinksFor('async-provider-worker'),
         ],
         permissions: nativeAuthority.permissions('async-provider-worker'),
         ...lambdaLogging(asyncProviderWorkerLogs.logGroup.name),
         timeout: '1 minute',
-        vpc: foundation.vpc,
+${''}\
       },
       {
         batch: { partialResponses: true },
@@ -1892,6 +1812,8 @@ export function product() {
     {
       permissions: nativeAuthority.permissions('async-outbox-relay'),
       environment: {
+${'        ...keyValue.environment,\n'}\
+${''}\
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-outbox-relay',
         EBK_WORKSPACE: '${workspace}',
@@ -1899,32 +1821,45 @@ export function product() {
       },
       handler: 'async/outbox-relay.handler',
       link: [
-        database,
+        ${'keyValue.link'},
         foundation.eventBus,
         ...secretLinksFor('async-outbox-relay'),
       ],
       ...lambdaLogging(asyncOutboxRelayLogs.logGroup.name),
       timeout: '1 minute',
-      vpc: foundation.vpc,
+${''}\
     },
   );
+${sql
+            ? `  const sqlOutbox = createSqlOutboxInfrastructure({
+    workspace: '${workspace}',
+    database, eventBus: foundation.eventBus, eventBusName: foundation.discovery.eventBusName,
+    secretLinks: secretLinksFor('async-outbox-relay'),
+    vpc: foundation.vpc, schedule: backgroundSchedules.sqlOutboxRecovery,
+    alertTopicArn: foundation.discovery.alertTopicArn,
+    managedLogGroup, lambdaLogging,
+${''}\
+  });
+`
+            : ''}\
   const asyncInboxCleanup = new sst.aws.Function(
     '${pascalName}AsyncInboxCleanup',
     {
       permissions: nativeAuthority.permissions('async-inbox-cleanup'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-inbox-cleanup',
         EBK_WORKSPACE: '${workspace}',
       },
       handler: 'async/inbox-cleanup.handler',
       link: [
-        database,
+        ${'keyValue.link'},
         ...secretLinksFor('async-inbox-cleanup'),
       ],
       ...lambdaLogging(asyncInboxCleanupLogs.logGroup.name),
       timeout: '5 minutes',
-      vpc: foundation.vpc,
+${''}\
     },
   );
   const asyncScheduleTarget = new sst.aws.Function(
@@ -1978,7 +1913,7 @@ export function product() {
     '${pascalName}OutboxRelaySchedule',
     {
       description:
-        'Durable outbox relay; nonproduction cadence permits idle database auto-pause.',
+        'Durable DynamoDB outbox relay; cadence and pause are independent of SQL capacity.',
       ...backgroundSchedules.outbox,
       tags: {
         'ebk:slice': '${name}',
@@ -2257,15 +2192,18 @@ export function product() {
     );
   }
 
+  const webServerLogging = lambdaLogging(nextServerLogs.logGroup.name);
   const web = new sst.aws.Nextjs('${pascalName}Web', {
     buildCommand: 'node ../tools/ebk-next-build-environment.mjs',
+    invalidation: { wait: true },
     dev: {
-      command: \`pnpm exec next dev web --hostname 127.0.0.1 --port \${devPort}\`,
+      command: 'node tools/ebk-next-dev.mjs',
       directory: '.',
       title: '${pascalName} web',
       url: \`http://127.0.0.1:\${devPort}/${name}\`,
     },
     environment: {
+${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_USER_POOL_ID: foundation.userPool.id,
       EBK_SOURCE_COMMIT: releaseSourceCommit,
@@ -2292,7 +2230,7 @@ export function product() {
       ...runtimeConfigurationEnvironment,
       NEXT_PUBLIC_API_URL: api.url,
     },
-    link: [database, foundation.userPool],
+    link: [keyValue.link, ${sql ? 'database, foundation.eventBus, ' : ''}foundation.userPool],
     path: 'web',
     router: { instance: foundation.router, path: '/${name}' },
     transform: {
@@ -2323,23 +2261,38 @@ export function product() {
         link: secretLinksFor('web-revalidation-seeder'),
         ...lambdaLogging(nextRevalidationSeederLogs.logGroup.name),
       },
-      server: {
-        permissions: nativeAuthority.permissions('web-server'),
-        hook: {
+      server(args: Record<string, unknown>) {
+        args.permissions = $resolve({
+          inherited: args.permissions,
+          additional: nativeAuthority.permissions('web-server'),
+        }).apply(({ inherited, additional }) => [
+          ...((inherited ?? []) as unknown[]),
+          ...additional,
+        ]);
+        args.hook = {
           async postbuild(directory: string) {
             removeFinderMetadataFromBuiltFunction(directory);
           },
-        },
-        link: secretLinksFor(
-          'web-server',
-          performanceDeploymentBinding
-            ? []
-            : [performanceHmacLogicalName],
-        ),
-        ...lambdaLogging(nextServerLogs.logGroup.name),
+        };
+        // SST applies this transform to both its dev runtime and deployed
+        // server. Preserve native/site links; secret links are additive.
+        args.link = $output(args.link ?? []).apply((links: unknown[]) => [
+          ...links,
+          ...secretLinksFor(
+            'web-server',
+            performanceDeploymentBinding
+              ? []
+              : [performanceHmacLogicalName],
+          ),
+        ]);
+        Object.assign(args, webServerLogging);
+        args.transform = {
+          ...webServerLogging.transform,
+          ...($dev ? { role: { tags: { 'ebk:dev-runtime': 'web' } } } : {}),
+        };
       },
     },
-    vpc: foundation.vpc,
+${sql ? '    vpc: foundation.vpc,\n' : ''}\
   }, configurationDeployment
     ? { dependsOn: [configurationDeployment] }
     : {});
@@ -2360,7 +2313,15 @@ export function product() {
   }
 
   const migrationControls: Record<string, any> = {};
-  if (!$dev) {
+${`  Object.assign(migrationControls, createKeyValueRetentionInfrastructure({
+    keyValue, workspace: '${workspace}', eventBusArn: foundation.discovery.eventBusArn,
+    alertTopicArn: foundation.discovery.alertTopicArn, schedule: backgroundSchedules.retention,
+    scheduleName: runtimeResourceNames.dataRetentionMaintenanceRule,
+    managedLogGroup, lambdaLogging, register: registerProductRetention,
+  }));
+`}\
+${sql
+            ? `  if (!$dev) {
     const region = aws.getRegionOutput({}).name;
     const taskArguments = (task: any) => ({
       Cluster: task.cluster,
@@ -2447,316 +2408,7 @@ export function product() {
       });
     };
 
-    if (!databaseProvision.readwriteSecretArn) {
-      throw new Error(
-        'The active primary database is missing its read/write credential reference.',
-      );
-    }
-    const retentionTaskLogs = managedLogContract('job-data-retention');
-    const retentionTask = new sst.aws.Task('${pascalName}DataRetentionTask', {
-      permissions: nativeAuthority.permissions('data-retention-job-task'),
-      cluster: foundation.cluster,
-      environment: {
-        ...dataRetentionContainer.environment,
-        AWS_REGION: region,
-        EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
-        EBK_DATABASE_NAME: databaseProvision.databaseName,
-        EBK_DATABASE_PORT: $interpolate\`\${foundation.database.port}\`,
-        EBK_DATABASE_USERNAME: databaseProvision.readwriteRole,
-        EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
-        EBK_READWRITE_SECRET_ARN: databaseProvision.readwriteSecretArn,
-        EBK_SLICE: '${name}',
-        EBK_STAGE: $app.stage,
-        EBK_WORKLOAD_IDENTITY: '${name}:data-retention-job',
-        EBK_WORKSPACE: '${workspace}',
-        EVENT_BUS_NAME: foundation.eventBus.name,
-      },
-      image: dataRetentionContainer.image,
-      link: secretLinksFor('data-retention-job-task'),
-      logging: {
-        name: retentionTaskLogs.name,
-        retention: '1 month',
-      },
-      transform: {
-        logGroup: {
-          logGroupClass: retentionTaskLogs.logGroupClass,
-          tags: retentionTaskLogs.tags,
-        },
-        taskDefinition: {
-          family: runtimeResourceNames.dataRetentionTaskFamily,
-        },
-      },
-    });
-    const retentionTaskLogDataProtection = managedLogDataProtection(
-      '${pascalName}DataRetentionTaskLog',
-      retentionTaskLogs,
-      retentionTaskLogs.name,
-      [retentionTask.nodes.taskDefinition],
-      foundation.discovery.alertTopicArn,
-    );
-    const retentionWorkflowLogs = managedLogGroup(
-      '${pascalName}DataRetentionWorkflowLogs',
-      'job-data-retention-orchestration',
-      foundation.discovery.alertTopicArn,
-    );
-    const retentionOverrides = retentionTask.containers.apply(
-      (containers: string[]) => ({
-        ContainerOverrides: containers.map((containerName) => ({
-          Environment: [
-            {
-              Name: 'EBK_RETENTION_APPROVAL_ID',
-              Value: '{% $states.input.approvalRequestId %}',
-            },
-            {
-              Name: 'EBK_RETENTION_CORRELATION_ID',
-              Value: '{% $states.input.correlationId %}',
-            },
-            {
-              Name: 'EBK_RETENTION_AS_OF',
-              Value: '{% $states.input.asOf %}',
-            },
-            {
-              Name: 'EBK_RETENTION_MODE',
-              Value: '{% $states.input.mode %}',
-            },
-            {
-              Name: 'EBK_RETENTION_RUN_ID',
-              Value: '{% $states.input.runId %}',
-            },
-            {
-              Name: 'EBK_STEP_FUNCTIONS_TASK_TOKEN',
-              Value: '{% $states.context.Task.Token %}',
-            },
-          ],
-          Name: containerName,
-        })),
-      }),
-    );
-    const retentionStateMachine = createRawStateMachine(
-      '${pascalName}DataRetention',
-      {
-        StartAt: 'RunDataRetention',
-        States: {
-          DataRetentionSucceeded: {
-            QueryLanguage: 'JSONata',
-            Type: 'Succeed',
-          },
-          RunDataRetention: {
-            Arguments: {
-              ...taskArguments(retentionTask),
-              Overrides: retentionOverrides,
-            },
-            Next: 'DataRetentionSucceeded',
-            QueryLanguage: 'JSONata',
-            Resource: 'arn:aws:states:::ecs:runTask.waitForTaskToken',
-            Retry: [
-              {
-                BackoffRate: 2,
-                ErrorEquals: [
-                  'ECS.AmazonECSException',
-                  'ECS.ECSException',
-                ],
-                IntervalSeconds: 10,
-                MaxAttempts: 2,
-              },
-            ],
-            TimeoutSeconds: 2700,
-            Type: 'Task',
-          },
-        },
-      },
-      retentionWorkflowLogs.logGroup,
-      'data-retention-job-orchestration',
-    );
-    const retentionFailureAlarm = new aws.cloudwatch.MetricAlarm(
-      '${pascalName}DataRetentionFailure',
-      {
-        alarmActions: [foundation.discovery.alertTopicArn],
-        alarmDescription: operationalAlarmDescription({
-          businessSymptom:
-            'The built-in retention Job terminated unsuccessfully.',
-          id: 'retention-job-failure',
-          runbook: 'docs/runbooks/database-recovery.md',
-        }),
-        comparisonOperator: 'GreaterThanOrEqualToThreshold',
-        evaluationPeriods: 1,
-        metricQueries: [
-          ...['ExecutionsFailed', 'ExecutionsTimedOut', 'ExecutionsAborted'].map(
-            (metricName, index) => ({
-              id: 'm' + index,
-              metric: {
-                dimensions: {
-                  StateMachineArn: retentionStateMachine.arn,
-                },
-                metricName,
-                namespace: 'AWS/States',
-                period: 60,
-                stat: 'Sum',
-              },
-              returnData: false,
-            }),
-          ),
-          {
-            expression: 'm0+m1+m2',
-            id: 'failures',
-            label: 'Retention terminal execution failures',
-            returnData: true,
-          },
-        ],
-        name: '${name}-' + $app.stage + '-retention-job-failure',
-        threshold: 1,
-        treatMissingData: 'notBreaching',
-      },
-    );
-    const retentionRegistration = registerProductRetention(
-      retentionStateMachine.arn,
-    );
-    migrationControls.dataRetention = {
-      registration: retentionRegistration,
-      retentionFailureAlarm,
-      retentionStateMachine,
-      retentionTask,
-      retentionTaskLogDataProtection,
-      retentionWorkflowLogs,
-    };
-    const retentionMaintenanceTaskLogs = managedLogContract(
-      'job-data-retention-maintenance',
-    );
-    const retentionMaintenanceTask = new sst.aws.Task(
-      '${pascalName}DataRetentionMaintenanceTask',
-      {
-        permissions: nativeAuthority.permissions(
-          'data-retention-maintenance-job-task',
-        ),
-        cluster: foundation.cluster,
-        environment: {
-          ...dataRetentionContainer.environment,
-          AWS_REGION: region,
-          EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
-          EBK_DATABASE_NAME: databaseProvision.databaseName,
-          EBK_DATABASE_PORT: $interpolate\`\${foundation.database.port}\`,
-          EBK_DATABASE_USERNAME: databaseProvision.readwriteRole,
-          EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
-          EBK_READWRITE_SECRET_ARN:
-            databaseProvision.readwriteSecretArn,
-          EBK_SLICE: '${name}',
-          EBK_STAGE: $app.stage,
-          EBK_WORKLOAD_IDENTITY: '${name}:data-retention-job',
-          EBK_WORKSPACE: '${workspace}',
-        },
-        image: dataRetentionContainer.image,
-        link: secretLinksFor(
-          'data-retention-maintenance-job-task',
-        ),
-        logging: {
-          name: retentionMaintenanceTaskLogs.name,
-          retention: '1 month',
-        },
-        transform: {
-          logGroup: {
-            logGroupClass:
-              retentionMaintenanceTaskLogs.logGroupClass,
-            tags: retentionMaintenanceTaskLogs.tags,
-          },
-          taskDefinition: {
-            family: runtimeResourceNames.dataRetentionMaintenanceTaskFamily,
-          },
-        },
-      },
-    );
-    const retentionMaintenanceTaskLogDataProtection =
-      managedLogDataProtection(
-        '${pascalName}DataRetentionMaintenanceTaskLog',
-        retentionMaintenanceTaskLogs,
-        retentionMaintenanceTaskLogs.name,
-        [retentionMaintenanceTask.nodes.taskDefinition],
-        foundation.discovery.alertTopicArn,
-      );
-    const retentionMaintenanceLauncherLogs = managedLogGroup(
-      '${pascalName}DataRetentionMaintenanceLauncherLogs',
-      'job-data-retention-maintenance-launcher',
-      foundation.discovery.alertTopicArn,
-    );
-    const retentionMaintenanceContainerName =
-      retentionMaintenanceTask.containers.apply(
-        (containers: string[]) => {
-          if (containers.length !== 1 || !containers[0]) {
-            throw new Error(
-              'Retention maintenance requires exactly one task container.',
-            );
-          }
-          return containers[0];
-        },
-      );
-    const retentionMaintenanceLauncher = new sst.aws.Function(
-      '${pascalName}DataRetentionMaintenanceLauncher',
-      {
-        permissions: nativeAuthority.permissions(
-          'data-retention-maintenance-launcher',
-        ),
-        environment: {
-          EBK_MAINTENANCE_ASSIGN_PUBLIC_IP:
-            retentionMaintenanceTask.assignPublicIp.apply(
-              (value: boolean) => String(value),
-            ),
-          EBK_MAINTENANCE_CLUSTER_ARN:
-            retentionMaintenanceTask.cluster,
-          EBK_MAINTENANCE_CONTAINER_NAME:
-            retentionMaintenanceContainerName,
-          EBK_MAINTENANCE_SECURITY_GROUP_IDS: $jsonStringify(
-            retentionMaintenanceTask.securityGroups,
-          ),
-          EBK_MAINTENANCE_SUBNET_IDS: $jsonStringify(
-            retentionMaintenanceTask.subnets,
-          ),
-          EBK_MAINTENANCE_TASK_DEFINITION_ARN:
-            retentionMaintenanceTask.taskDefinition,
-          EBK_STAGE: $app.stage,
-          EBK_WORKSPACE: '${workspace}',
-        },
-        handler: 'jobs/data-retention-maintenance-launcher.handler',
-        ...lambdaLogging(
-          retentionMaintenanceLauncherLogs.logGroup.name,
-        ),
-        timeout: '1 minute',
-      },
-    );
-    const retentionMaintenanceRule = new aws.cloudwatch.EventRule(
-      '${pascalName}DataRetentionMaintenanceSchedule',
-      {
-        name: runtimeResourceNames.dataRetentionMaintenanceRule,
-        ...backgroundSchedules.retention,
-      },
-    );
-    const retentionMaintenancePermission =
-      new aws.lambda.Permission(
-        '${pascalName}DataRetentionMaintenanceSchedulePermission',
-        {
-          action: 'lambda:InvokeFunction',
-          function: retentionMaintenanceLauncher.arn,
-          principal: 'events.amazonaws.com',
-          sourceArn: retentionMaintenanceRule.arn,
-        },
-      );
-    const retentionMaintenanceTarget =
-      new aws.cloudwatch.EventTarget(
-        '${pascalName}DataRetentionMaintenanceTarget',
-        {
-          arn: retentionMaintenanceLauncher.arn,
-          rule: retentionMaintenanceRule.name,
-          targetId: 'DataRetentionMaintenance',
-        },
-        { dependsOn: [retentionMaintenancePermission] },
-      );
-    migrationControls.dataRetentionMaintenance = {
-      retentionMaintenanceLauncher,
-      retentionMaintenanceLauncherLogs,
-      retentionMaintenanceRule,
-      retentionMaintenanceTarget,
-      retentionMaintenanceTask,
-      retentionMaintenanceTaskLogDataProtection,
-    };
-
+${''}\
     for (const [databaseIdentifier, target] of Object.entries(
       databaseProvisions.databases,
     )) {
@@ -3090,6 +2742,8 @@ export function product() {
     }
   }
 
+`
+            : ''}\
   const outboxRelayAlarm = new aws.cloudwatch.MetricAlarm(
     '${pascalName}OutboxRelayErrors',
     {
@@ -3346,6 +3000,7 @@ export function product() {
     performanceLoadCleanupBacklogAlarm,
     performanceLoadCleanupDeadlineAlarm,
     asyncOutboxRelay,
+${sql ? '    sqlOutbox,\n' : ''}\
     asyncRecoveryLedger,
     asyncScheduleTarget,
     asyncTargetDlq,
@@ -3365,7 +3020,8 @@ export function product() {
     dataExportCleanupRule,
     dataExportCleanupTarget,
     dataExportStore,
-    database,
+${sql ? '    database,\n' : ''}\
+${'    keyValue,\n'}\
     dlqAlarm,
     eventDlq,
     eventQueue,
@@ -3393,5 +3049,7 @@ export function product() {
 }
 `,
     };
+    Object.assign(files, (0, built_in_plan_key_value_retention_infrastructure_js_1.renderKeyValueRetentionInfrastructureFiles)(name, pascalName));
+    return files;
 }
 //# sourceMappingURL=built-in-plan-infrastructure-files.js.map