@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-infrastructure-files.js

@@ -2,180 +2,397 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductInfrastructureFiles = renderProductInfrastructureFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const built_in_plan_key_value_retention_infrastructure_js_1 = require("./built-in-plan-key-value-retention-infrastructure.js");
 /** @internal */
-function renderProductInfrastructureFiles(name, pascalName, workspace) {
+function renderProductInfrastructureFiles(name, pascalName, workspace, protectedRuntimeStages = ['staging', 'production'], sql = false, network = sql) {
     const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
     const recordExportWorkflowName = (0, built_in_plan_shared_js_1.stableGeneratedName)(40, name);
-    return {
-        'jobs/data-retention-maintenance-launcher.ts': `import {
-  ECSClient,
-  RunTaskCommand,
-} from '@aws-sdk/client-ecs';
-import { createLogger } from '@empire-builder-kit/runtime/logging';
+    const files = {
+        'infra/event-subscriptions.ts': `/** Read the existing seeded event contract; never broaden source or stage routing. */
+export function sameSliceEventDetailTypes(value: unknown): string[] {
+  const contract = value as {
+    kind?: unknown;
+    schemaVersion?: unknown;
+    slice?: unknown;
+    events?: unknown;
+  } | null;
+  if (
+    !contract || contract.kind !== 'ebk-event-contract-schema' ||
+    contract.schemaVersion !== 1 || contract.slice !== '${name}' ||
+    !Array.isArray(contract.events) || contract.events.length < 2 ||
+    contract.events.length > 32
+  ) throw new Error('Event subscriptions require the bounded seeded ${name} EventContractSchema.');
+  const types = new Set<string>();
+  for (const raw of contract.events) {
+    const event = raw as {
+      detailType?: unknown;
+      source?: unknown;
+      schemaVersion?: unknown;
+      data?: unknown;
+    } | null;
+    if (
+      !event || typeof event.detailType !== 'string' ||
+      !/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(event.detailType) ||
+      event.source !== '${name}' || typeof event.schemaVersion !== 'number' ||
+      !Number.isSafeInteger(event.schemaVersion) || event.schemaVersion < 1 ||
+      !event.data || typeof event.data !== 'object' || Array.isArray(event.data) ||
+      types.has(event.detailType)
+    ) throw new Error('Event subscriptions require unique literal types, exact Slice sources and valid schemas.');
+    types.add(event.detailType);
+  }
+  if (!types.has('${pascalName}Created') || !types.has('DataLifecycleChanged'))
+    throw new Error('The generated event contract must retain its built-in event declarations.');
+  // Lifecycle consumers have their own exact source declaration and rule.
+  types.delete('DataLifecycleChanged');
+  return [...types].sort();
+}
+`,
+        'infra/route-function-materialization.ts': `type RouteFunctionArgs = {
+  ebkRouteMaterialization?: unknown;
+  handler: string;
+  environment?: unknown;
+  link?: unknown;
+  permissions?: unknown;
+} & Record<string, any>;
 
-const UUID =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const ECS_CLUSTER_ARN =
-  new RegExp(
-    '^arn:(?:aws|aws-cn|aws-us-gov):ecs:[a-z0-9-]+:' +
-      '[0-9]{12}:cluster/[A-Za-z0-9_./-]{1,255}$',
-  );
-const ECS_TASK_DEFINITION_ARN =
-  /^arn:(?:aws|aws-cn|aws-us-gov):ecs:[a-z0-9-]+:[0-9]{12}:task-definition\\/[A-Za-z0-9_-]{1,255}:[1-9][0-9]*$/;
-const NETWORK_ID = /^(?:sg|subnet)-[0-9a-f]{8,32}$/;
-const CONTAINER_NAME = /^[A-Za-z0-9_-]{1,255}$/;
+type OutputFactory = (value: any) => {
+  apply(callback: (value: any) => any): unknown;
+};
 
-function required(name: string): string {
-  const value = process.env[name]?.trim();
-  if (!value) throw new Error(name + ' is required.');
-  return value;
-}
+type RouteRegistrar<Result> = (
+  rawRoute: string,
+  handler: string,
+  args?: Record<string, any>,
+) => Result;
 
-function requiredArn(name: string, pattern: RegExp): string {
-  const value = required(name);
-  if (!pattern.test(value)) {
-    throw new Error(name + ' is not the exact expected ECS ARN.');
+export function createVpcRouteFunctionMaterializer(input: {
+  directHandlers: readonly string[];
+  foundationVpc?: unknown;
+  output: OutputFactory;
+}) {
+  const directHandlerLimit = 2;
+  const compositionDirectHandlerLimit = 64;
+  const routeFunctionLimit = 23;
+  if (
+    !Array.isArray(input.directHandlers) ||
+    input.directHandlers.length !== directHandlerLimit ||
+    input.directHandlers.some(
+      (handler) =>
+        typeof handler !== 'string' ||
+        handler.length === 0 ||
+        handler.length > 256,
+    ) ||
+    new Set(input.directHandlers).size !== input.directHandlers.length
+  ) {
+    throw new Error(
+      'Direct API routes require the exact bounded unique handler inventory.',
+    );
   }
-  return value;
-}
+  const directHandlers = new Set(input.directHandlers);
+  const compositionDirectHandlers = new Set<string>();
+  const routeFunctions = new Map<string, RouteFunctionArgs>();
+  const materializedRouteFunctions = new Set<string>();
 
-function requiredBoolean(name: string): boolean {
-  const value = required(name);
-  if (value !== 'true' && value !== 'false') {
-    throw new Error(name + ' must be exactly true or false.');
-  }
-  return value === 'true';
+  const transform = (args: any): void => {
+    if (
+      typeof args !== 'object' ||
+      args === null ||
+      Array.isArray(args) ||
+      typeof args.handler !== 'string' ||
+      args.handler.length === 0
+    ) {
+      throw new Error(
+        'API route handler transforms require one literal handler path.',
+      );
+    }
+    const routeFunction = routeFunctions.get(args.handler);
+    if (!routeFunction) {
+      if (directHandlers.has(args.handler)) {
+        if (args.ebkRouteMaterialization !== undefined) {
+          throw new Error(
+            'Built-in direct API route materialization authority is ambiguous.',
+          );
+        }
+        return;
+      }
+      if (
+        args.ebkRouteMaterialization === 'direct' &&
+        !compositionDirectHandlers.has(args.handler) &&
+        compositionDirectHandlers.size < compositionDirectHandlerLimit
+      ) {
+        delete args.ebkRouteMaterialization;
+        compositionDirectHandlers.add(args.handler);
+        return;
+      }
+      throw new Error(
+        'API route handler lacks registered materialization authority.',
+      );
+    }
+    if (
+      args.ebkRouteMaterialization !== undefined ||
+      routeFunction.handler !== args.handler ||
+      materializedRouteFunctions.has(args.handler)
+    ) {
+      throw new Error(
+        'VPC API route handler materialization authority is ambiguous.',
+      );
+    }
+
+    // SST 4.17.1 resolves the complete FunctionArgs definition before it
+    // calls this transform. Passing imported Foundation Outputs as that
+    // definition can therefore defer the route component itself during
+    // refresh. Keep the definition literal until here, then reproduce
+    // functionBuilder's route-over-default merge exactly.
+    const defaultEnvironment = args.environment;
+    const defaultLink = args.link;
+    const defaultPermissions = args.permissions;
+    Object.assign(args, routeFunction);
+    args.environment = input
+      .output([defaultEnvironment, routeFunction.environment])
+      .apply(([defaults, route]: [any, any]) => ({
+        ...(defaults ?? {}),
+        ...(route ?? {}),
+      }));
+    args.link = input
+      .output([defaultLink, routeFunction.link])
+      .apply(([defaults, route]: [any, any]) => [
+        ...(defaults ?? []),
+        ...(route ?? []),
+      ]);
+    args.permissions = input
+      .output([defaultPermissions, routeFunction.permissions])
+      .apply(([defaults, route]: [any, any]) => [
+        ...(defaults ?? []),
+        ...(route ?? []),
+      ]);
+    materializedRouteFunctions.add(args.handler);
+  };
+
+  const route = <Result>(
+    rawRoute: string,
+    handler: RouteFunctionArgs,
+    args: Record<string, any> | undefined,
+    register: RouteRegistrar<Result>,
+  ): Result => {
+    const handlerPath = handler.handler;
+    if (
+      typeof rawRoute !== 'string' ||
+      rawRoute.length === 0 ||
+      rawRoute.length > 512 ||
+      typeof handlerPath !== 'string' ||
+      handlerPath.length === 0 ||
+      handlerPath.length > 256 ||
+      typeof register !== 'function' ||
+      directHandlers.has(handlerPath) ||
+      routeFunctions.has(handlerPath) ||
+      routeFunctions.size >= routeFunctionLimit
+    ) {
+      throw new Error(
+        'VPC API routes require one bounded unique literal handler registration.',
+      );
+    }
+    routeFunctions.set(handlerPath, {
+      ...handler,
+      handler: handlerPath,
+      ...(input.foundationVpc === undefined ? {} : { vpc: input.foundationVpc }),
+    });
+    try {
+      return register(rawRoute, handlerPath, args);
+    } catch (error) {
+      routeFunctions.delete(handlerPath);
+      throw error;
+    }
+  };
+
+  return Object.freeze({ route, transform });
 }
+`,
+        'infra/next-build-authority.ts': `import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  readdirSync,
+  realpathSync,
+  unlinkSync,
+} from 'node:fs';
+import { join, relative, resolve } from 'node:path';
 
-function requiredNetworkIds(name: string): string[] {
-  let value: unknown;
-  try {
-    value = JSON.parse(required(name));
-  } catch {
-    throw new Error(name + ' must be one bounded JSON array.');
-  }
+const maximumEntries = 65_536;
+const maximumDepth = 64;
+const maximumFinderMetadataFiles = 256;
+const maximumFinderMetadataBytes = 1_048_576n;
+
+// SST 4.17.1 awaits FunctionArgs.hook.postbuild after Runtime.Build has
+// materialized the exact directory that its Lambda zipper consumes. Finder
+// metadata removed only from OpenNext's earlier output can be recreated or
+// copied through package-local node_modules before that boundary. Sanitize the
+// final derived bundle here so the bytes reviewed by the infrastructure plan
+// are the bytes SST packages.
+export function removeFinderMetadataFromBuiltFunction(rootPath: string): number {
+  const root = resolve(rootPath);
+  const rootIdentity = lstatSync(root, { bigint: true });
   if (
-    !Array.isArray(value) ||
-    value.length < 1 ||
-    value.length > 16 ||
-    value.some(
-      (entry) => typeof entry !== 'string' || !NETWORK_ID.test(entry),
-    )
+    !rootIdentity.isDirectory() ||
+    rootIdentity.isSymbolicLink() ||
+    realpathSync(root) !== root
   ) {
-    throw new Error(name + ' must contain only exact AWS network IDs.');
+    throw new Error('The built Function root has an invalid identity.');
   }
-  return value;
-}
 
-function requiredScheduledEventId(event: unknown): string {
-  const id =
-    event && typeof event === 'object' && 'id' in event
-      ? (event as { id?: unknown }).id
-      : undefined;
-  if (typeof id !== 'string' || !UUID.test(id)) {
-    throw new Error('Scheduled maintenance requires one exact event ID.');
+  const pendingDirectories = [{ depth: 0, path: root }];
+  let observedEntries = 0;
+  let removedFinderMetadata = 0;
+  while (pendingDirectories.length > 0) {
+    const current = pendingDirectories.pop();
+    if (!current) break;
+    if (current.depth > maximumDepth) {
+      throw new Error('The built Function tree exceeds its depth bound.');
+    }
+    for (const entry of readdirSync(current.path, { withFileTypes: true }).sort(
+      (left, right) =>
+        left.name < right.name ? -1 : left.name > right.name ? 1 : 0,
+    )) {
+      observedEntries += 1;
+      if (observedEntries > maximumEntries) {
+        throw new Error('The built Function tree exceeds its entry bound.');
+      }
+      const entryPath = join(current.path, entry.name);
+      const identity = lstatSync(entryPath, { bigint: true });
+      if (entry.name === '.DS_Store') {
+        removedFinderMetadata += 1;
+        if (
+          removedFinderMetadata > maximumFinderMetadataFiles ||
+          !identity.isFile() ||
+          identity.isSymbolicLink() ||
+          identity.nlink !== 1n ||
+          identity.size > maximumFinderMetadataBytes
+        ) {
+          throw new Error(
+            'The built Function Finder metadata has an invalid identity.',
+          );
+        }
+        unlinkSync(entryPath);
+        if (existsSync(entryPath)) {
+          throw new Error(
+            'The built Function Finder metadata was not removed.',
+          );
+        }
+        continue;
+      }
+      if (identity.isDirectory() && !identity.isSymbolicLink()) {
+        const confined = relative(root, entryPath);
+        if (
+          confined === '..' ||
+          confined.startsWith('../') ||
+          resolve(root, confined) !== entryPath
+        ) {
+          throw new Error('The built Function entry escapes its root.');
+        }
+        pendingDirectories.push({ depth: current.depth + 1, path: entryPath });
+      }
+    }
+    // Finder can recreate its metadata in the interval between this hook and
+    // SST's asynchronous glob/archive pass. On macOS, close that exact race by
+    // removing only the owner's write bit from each completed derived
+    // directory. The generated build wrapper restores it before the next
+    // OpenNext build. Group/other permission bits remain unchanged.
+    if (process.platform === 'darwin') {
+      const currentIdentity = lstatSync(current.path, { bigint: true });
+      if (
+        !currentIdentity.isDirectory() ||
+        currentIdentity.isSymbolicLink()
+      ) {
+        throw new Error('The built Function directory changed identity.');
+      }
+      chmodSync(
+        current.path,
+        Number((currentIdentity.mode & 0o7_777n) & ~0o200n),
+      );
+      if ((lstatSync(current.path, { bigint: true }).mode & 0o200n) !== 0n) {
+        throw new Error('The built Function directory was not sealed.');
+      }
+      if (existsSync(join(current.path, '.DS_Store'))) {
+        throw new Error(
+          'The built Function Finder metadata raced its final seal.',
+        );
+      }
+    }
   }
-  return id.toLowerCase();
+  return removedFinderMetadata;
+}
+`,
+        'infra/deployment-receipt.ts': `export interface SuccessfulDeploymentReceiptExpectation {
+  account: string;
+  project: string;
+  region: string;
+  sourceCommit: string;
+  stage: 'development' | 'staging' | 'production';
 }
 
-export async function handler(event: unknown) {
-  const stage = required('EBK_STAGE');
-  const logger = createLogger({
-    component: 'job-data-retention-maintenance-launcher',
-    feature: 'data-lifecycle',
-    operation: 'retention-maintenance-launch',
-    slice: '${name}',
-    stage,
-    workspace: required('EBK_WORKSPACE'),
-  });
-  const correlationId = requiredScheduledEventId(event);
-  try {
-    const containerName = required('EBK_MAINTENANCE_CONTAINER_NAME');
-    if (!CONTAINER_NAME.test(containerName)) {
-      throw new Error('Maintenance container name is invalid.');
-    }
-    const response = await new ECSClient({}).send(
-      new RunTaskCommand({
-        cluster: requiredArn('EBK_MAINTENANCE_CLUSTER_ARN', ECS_CLUSTER_ARN),
-        count: 1,
-        enableExecuteCommand: false,
-        launchType: 'FARGATE',
-        networkConfiguration: {
-          awsvpcConfiguration: {
-            assignPublicIp:
-              requiredBoolean('EBK_MAINTENANCE_ASSIGN_PUBLIC_IP')
-                ? 'ENABLED'
-                : 'DISABLED',
-            securityGroups: requiredNetworkIds(
-              'EBK_MAINTENANCE_SECURITY_GROUP_IDS',
-            ),
-            subnets: requiredNetworkIds('EBK_MAINTENANCE_SUBNET_IDS'),
-          },
-        },
-        overrides: {
-          containerOverrides: [
-            {
-              command: [
-                'node',
-                'dist/jobs/data-retention/src/maintenance.js',
-              ],
-              environment: [
-                {
-                  name: 'EBK_MAINTENANCE_CORRELATION_ID',
-                  value: correlationId,
-                },
-              ],
-              name: containerName,
-            },
-          ],
-        },
-        taskDefinition: requiredArn(
-          'EBK_MAINTENANCE_TASK_DEFINITION_ARN',
-          ECS_TASK_DEFINITION_ARN,
-        ),
-      }),
+export function validateSuccessfulDeploymentReceipt(
+  value: unknown,
+  expected: SuccessfulDeploymentReceiptExpectation,
+) {
+  const receipt = value as {
+    account?: unknown;
+    authority?: unknown;
+    children?: Array<{
+      outcome?: unknown;
+      project?: unknown;
+      target?: unknown;
+    }>;
+    kind?: unknown;
+    migrations?: Record<string, unknown>;
+    outcome?: unknown;
+    profile?: unknown;
+    region?: unknown;
+    schemaVersion?: unknown;
+    smoke?: Record<string, unknown>;
+    source?: { clean?: unknown; commit?: unknown };
+    stage?: unknown;
+  };
+  const deploymentChildren = Array.isArray(receipt?.children)
+    ? receipt.children.filter(
+        ({ outcome, project, target }) =>
+          outcome === 'succeeded' &&
+          project === expected.project &&
+          target === 'deploy',
+      )
+    : [];
+  if (
+    receipt?.kind !== 'ebk-deployment-receipt' ||
+    receipt.schemaVersion !== 1 ||
+    receipt.outcome !== 'succeeded' ||
+    !['local', 'github'].includes(String(receipt.authority)) ||
+    !['starter', 'production-isolated', 'fully-isolated'].includes(
+      String(receipt.profile),
+    ) ||
+    receipt.account !== expected.account ||
+    receipt.region !== expected.region ||
+    receipt.stage !== expected.stage ||
+    receipt.source?.clean !== true ||
+    receipt.source.commit !== expected.sourceCommit ||
+    !Array.isArray(receipt.children) ||
+    receipt.children.some(({ outcome }) => outcome !== 'succeeded') ||
+    deploymentChildren.length !== 1 ||
+    receipt.migrations?.[expected.project] !== 'completed-by-deploy-target' ||
+    receipt.smoke?.[expected.project] !== 'passed'
+  ) {
+    throw new Error(
+      'Protected performance load requires one successful exact-source native deployment receipt.',
     );
-    if (
-      (response.failures?.length ?? 0) !== 0 ||
-      response.tasks?.length !== 1 ||
-      !response.tasks[0]?.taskArn
-    ) {
-      throw new Error('ECS did not accept exactly one maintenance task.');
-    }
-    logger.info('Retention maintenance task launched', {
-      attributes: { launchCount: 1 },
-      outcome: 'success',
-    });
-    return { accepted: true };
-  } catch (error) {
-    logger.error('Retention maintenance task launch failed', {
-      attributes: {
-        errorCode:
-          error instanceof Error
-            ? error.name.replace(/[^A-Za-z0-9_.-]/g, '').slice(0, 80)
-            : 'RetentionMaintenanceLaunchError',
-      },
-      outcome: 'failure',
-    });
-    throw error;
   }
+  return Object.freeze(receipt);
 }
 `,
         'infra/product.ts': `import {
   createManagedLogGroupContract,
   createRouterOriginProofInjection,
-  provisionDatabaseBindings,
+${sql ? '  provisionDatabaseBindings,\n' : ''}\
 } from '@empire-builder-kit/nx/foundation';
-import { validateReleaseManifest } from '@empire-builder-kit/nx/release';
 import * as random from '@pulumi/random';
 import { createHash } from 'node:crypto';
-import {
-  lstatSync,
-  readFileSync,
-  readdirSync,
-  realpathSync,
-} from 'node:fs';
-import { fileURLToPath } from 'node:url';
+import { readFileSync } from 'node:fs';
 import {
   ${identifierPrefix}CleanupRecordExport,
   ${identifierPrefix}DatabaseHealth,
@@ -203,20 +420,33 @@ import {
   ${identifierPrefix}UseRecordDelegation,
 } from '../api/contracts/protected.js';
 import lifecycleConsumers from '../data/lifecycle-consumers.json';
-import databaseBindings from '../database/bindings.json';
+import { EventContractSchema } from '../contracts/events.js';
+import { sameSliceEventDetailTypes } from './event-subscriptions.js';
+${sql ? "import databaseBindings from '../database/bindings.json';\n" : ''}\
+${sql ? "import { createSqlOutboxInfrastructure } from './sql-outbox.js';\n" : ''}\
+${"import { createKeyValueInfrastructure } from './key-value.js';\n"}\
+${"import { createKeyValueRetentionInfrastructure } from './key-value-retention.js';\n"}\
 import localConfiguration from '../configuration/local-values.json';
+import backgroundWorkPolicy from '../operations/background-work.json';
+import { backgroundWorkSchedules } from './background-work.js';
 import { ConfigurationDeclarations } from '../configuration/declarations.js';
 import { assertAsyncAdapterDeploymentReady } from '../async/recovery-adapters.js';
 import {
   getFoundationInfrastructure,
-  registerProductMigration,
+${sql ? '  registerProductMigration,\n' : ''}\
   registerProductRetention,
 } from './foundation.js';
+import { createVpcRouteFunctionMaterializer } from './route-function-materialization.js';
+import { removeFinderMetadataFromBuiltFunction } from './next-build-authority.js';
 import {
+  createStandardSliceNativeRuntimeAuthority,
+} from './native-runtime-authority/index.js';
+${sql
+            ? `import {
   standardSliceDatabaseTaskFamily,
-  standardSliceResourceNames,
-} from './workload-roles/effective-intent.js';
-import type { StandardSliceWorkloadRolePreflight } from './workload-roles/preflight.js';
+} from './native-runtime-authority/effective-intent.js';
+`
+            : ''}\
 import { createStandardSliceSecretLinks } from './personal-secrets.js';
 import { create${pascalName}PerformanceCostControls } from './performance-cost-controls.js';
 import {
@@ -226,10 +456,11 @@ import {
 } from './authorization.js';
 import { createStandardDataExportStore } from './data-export.js';
 import { create${pascalName}Reliability } from './reliability.js';
-import { resolveStandardContainerImage } from './container-images.js';
+${sql ? "import { resolveStandardContainerImage } from './container-images.js';\n" : ''}\
 import {
   defineEventConsumerAlarms,
 } from '@empire-builder-kit/runtime/observability';
+import { validateSuccessfulDeploymentReceipt } from './deployment-receipt.js';
 // <ebk:composition-imports:start>
 // <ebk:composition-imports:end>
 
@@ -244,11 +475,12 @@ function protectedPerformanceDeploymentAuthority(input: {
     );
   }
   if (input.enabled === 'false') return undefined;
-  if (input.stage !== 'staging' && input.stage !== 'production') {
+  if (!${JSON.stringify(protectedRuntimeStages)}.includes(input.stage)) {
     throw new Error(
-      'Protected performance load can be deployed only to staging or production.',
+      'Protected performance load requires one active rehearsal or production stage.',
     );
   }
+  const stage = input.stage as 'development' | 'production' | 'staging';
   const accountId = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
   const region = process.env.AWS_REGION?.trim() ?? '';
   if (
@@ -284,60 +516,38 @@ function protectedPerformanceDeploymentAuthority(input: {
       'Protected performance load requires the exact deployed release candidate.',
     );
   }
-  const releaseManifestDirectory = new URL(
-    '../.ebk/evidence/release-manifests/',
-    import.meta.url,
-  );
-  const releaseManifestNames = readdirSync(releaseManifestDirectory).filter(
-    (entry) => /^release-[a-f0-9]{24}[.]json$/.test(entry),
-  );
-  if (releaseManifestNames.length !== 1) {
-    throw new Error(
-      'Protected performance load requires one exact deployed release manifest.',
-    );
-  }
-  const releaseManifestUrl = new URL(
-    releaseManifestNames[0]!,
-    releaseManifestDirectory,
+  const deploymentReceiptBytes = readFileSync(
+    new URL(
+      '../../../.ebk/evidence/deployment/latest.json',
+      import.meta.url,
+    ),
   );
-  const releaseManifestPath = fileURLToPath(releaseManifestUrl);
-  const releaseManifestMetadata = lstatSync(releaseManifestPath);
-  if (
-    !releaseManifestMetadata.isFile() ||
-    releaseManifestMetadata.isSymbolicLink() ||
-    releaseManifestMetadata.size <= 0 ||
-    releaseManifestMetadata.size > 10 * 1024 * 1024 ||
-    realpathSync(releaseManifestPath) !== releaseManifestPath
-  ) {
-    throw new Error(
-      'Protected performance load release manifest is not one bounded canonical file.',
-    );
-  }
-  const releaseManifest = validateReleaseManifest(
-    JSON.parse(readFileSync(releaseManifestPath, 'utf8')),
+  validateSuccessfulDeploymentReceipt(
+    JSON.parse(deploymentReceiptBytes.toString('utf8')),
     {
-      requireSupplyChain: true,
+      account: accountId,
+      project: '${name}',
+      region,
       sourceCommit: input.releaseSourceCommit,
+      stage,
     },
   );
-  if (releaseManifestNames[0] !== releaseManifest.releaseId + '.json') {
-    throw new Error(
-      'Protected performance load release manifest path differs from its identity.',
-    );
-  }
+  const deploymentReceiptDigest = createHash('sha256')
+    .update(deploymentReceiptBytes)
+    .digest('hex');
   return Object.freeze({
     candidateDigest: createHash('sha256')
       .update(candidateBytes)
       .digest('hex'),
-    releaseId: releaseManifest.releaseId,
-    releaseMaterialDigest: releaseManifest.materialDigest,
+    releaseId: 'release-' + deploymentReceiptDigest.slice(0, 24),
+    releaseMaterialDigest: deploymentReceiptDigest,
     target: Object.freeze({
       accountFingerprint:
         'sha256:' +
         createHash('sha256').update(accountId, 'utf8').digest('hex'),
       region,
       slice: '${name}',
-      stage: input.stage as 'production' | 'staging',
+      stage,
     }),
   });
 }
@@ -448,19 +658,15 @@ function lambdaLogging(logGroupName: any, functionName?: any) {
   };
 }
 
-export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
-  if (!$dev && !workloadRoles) {
-    throw new Error(
-      'Protected workload-role preflight must complete before infrastructure construction.',
-    );
-  }
-  const workloadRoleBindings = workloadRoles?.bindings;
+export function product() {
+  const backgroundSchedules = backgroundWorkSchedules(
+    backgroundWorkPolicy,
+    $dev ? 'development' : $app.stage,
+  );
   const asyncAdaptersConfigured = assertAsyncAdapterDeploymentReady();
-  const secretLinks = createStandardSliceSecretLinks({
-    protectedAccess: workloadRoles?.secretAccess,
-  });
+  const secretLinks = createStandardSliceSecretLinks();
   const performanceHmacLogicalName =
-    '${pascalName}PerformanceLoadHmacKeys';
+    'GeneratedPerformanceLoadHmacKeys';
   const secretLinksFor = (
     resource: string,
     excludeLogicalNames: readonly string[] = [],
@@ -473,21 +679,6 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   ];
   // Workload generators compose multi-role secret bindings through this seam.
   void secretLinksForWorkloads;
-  const workloadRoleResourceNames = workloadRoles
-    ? standardSliceResourceNames(workloadRoles.intentContext)
-    : undefined;
-  if (workloadRoleResourceNames) {
-    $transform(aws.dynamodb.Table, (args: any, _opts: any, logicalName: string) => {
-      if (logicalName === '${pascalName}WebRevalidationTable') {
-        args.name = workloadRoleResourceNames.webRevalidationTable;
-      }
-    });
-    $transform(aws.sqs.Queue, (args: any, _opts: any, logicalName: string) => {
-      if (logicalName === '${pascalName}WebRevalidationEventsQueue') {
-        args.name = workloadRoleResourceNames.webRevalidationQueue;
-      }
-    });
-  }
   const devPortInput = $dev ? (process.env.EBK_DEV_PORT ?? '3000') : '3000';
   if (!/^\\d+$/.test(devPortInput)) {
     throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
@@ -496,17 +687,21 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   if (!Number.isSafeInteger(devPort) || devPort < 1024 || devPort > 65535) {
     throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
   }
-  const protectedStage =
-    $app.stage === 'staging' || $app.stage === 'production';
+  const protectedStage = ${JSON.stringify(protectedRuntimeStages)}.includes(
+    $app.stage,
+  );
   const sourceCommit =
     process.env.EBK_SOURCE_COMMIT ?? (protectedStage ? '' : 'unresolved');
   const releaseSourceCommit =
     process.env.EBK_RELEASE_SOURCE_COMMIT ?? sourceCommit;
-  const exactDevelopmentRetirement =
+${sql
+            ? `  const exactDevelopmentRetirement =
     $app.stage === 'development' &&
     Object.values(databaseBindings).some((binding) =>
       binding.provisioned.includes('retirement_rehearsal'),
     );
+`
+            : ''}\
   if (
     protectedStage &&
     (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit) ||
@@ -516,16 +711,31 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       'Protected infrastructure requires exact deployment and release source Git object IDs.',
     );
   }
-  const dataRetentionContainer = resolveStandardContainerImage({
-    artifactId: '${name}.job.data-retention',
-    local: {
-      context: '../..',
-      dockerfile: 'packages/${name}/jobs/data-retention/Dockerfile',
+  $transform(
+    aws.lambda.Invocation,
+    (args: any, _opts: any, logicalName: string) => {
+      if (logicalName !== '${pascalName}WebRevalidationSeed') return;
+      const triggers = args.triggers;
+      if (
+        !triggers ||
+        typeof triggers !== 'object' ||
+        Array.isArray(triggers) ||
+        Object.keys(triggers).length !== 1 ||
+        typeof triggers.version !== 'string'
+      ) {
+        throw new Error(
+          'Pinned SST Next revalidation seed does not expose one exact version trigger.',
+        );
+      }
+      // SST 4.17.1 uses Date.now() here, which makes every preview propose a
+      // replacement even when the immutable application source is unchanged.
+      // Re-seed exactly once per released source instead.
+      args.triggers = { version: releaseSourceCommit };
     },
-    sourceCommit: releaseSourceCommit,
-    stage: $app.stage,
-  });
-  const databaseMigrationContainer = resolveStandardContainerImage({
+  );
+${''}\
+${sql
+            ? `  const databaseMigrationContainer = resolveStandardContainerImage({
     artifactId: '${name}.job.database-migration',
     local: {
       context: '../..',
@@ -544,6 +754,8 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     sourceCommit: releaseSourceCommit,
     stage: $app.stage,
   });
+`
+            : ''}\
   const performanceDeploymentAuthority = protectedStage
     ? protectedPerformanceDeploymentAuthority({
         enabled: process.env.EBK_PERFORMANCE_LOAD_ENABLED ?? 'false',
@@ -552,6 +764,172 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       })
     : undefined;
   const foundation = getFoundationInfrastructure();
+${`  const keyValue = createKeyValueInfrastructure({
+    eventBusArn: foundation.discovery.eventBusArn,
+    eventBusName: foundation.discovery.eventBusName,
+    alertTopicArn: foundation.discovery.alertTopicArn,
+    outbox: backgroundSchedules.outbox,
+    managedLogGroup,
+    lambdaLogging,
+  });
+`}\
+  // Domain delivery is the key-value stream plus scheduled reconciliation; the
+  // async/outbox-relay Function drains only the isolated performance sink.
+  // Observation only: alarms never pause, drop, or retry an event intent.
+  const keyValueStreamDeliveryErrorAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}KeyValueStreamDeliveryErrors',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom:
+          'The key-value stream delivery Function failed an invocation.',
+        id: 'key-value-stream-delivery-errors',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { FunctionName: keyValue.dispatcher.name },
+      evaluationPeriods: 1,
+      metricName: 'Errors',
+      name: '${name}-' + $app.stage + '-key-value-stream-delivery-errors',
+      namespace: 'AWS/Lambda',
+      period: 300,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const keyValueStreamIteratorAgeAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}KeyValueStreamIteratorAge',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom:
+          'Prompt domain-event delivery from the key-value stream is falling behind.',
+        id: 'key-value-stream-iterator-age',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { FunctionName: keyValue.dispatcher.name },
+      evaluationPeriods: 1,
+      metricName: 'IteratorAge',
+      name: '${name}-' + $app.stage + '-key-value-stream-iterator-age',
+      namespace: 'AWS/Lambda',
+      period: 300,
+      statistic: 'Maximum',
+      threshold: 600_000,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const keyValueReconciliationErrorAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}KeyValueReconciliationErrors',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'Durable domain-event recovery is failing.',
+        id: 'key-value-reconciliation-errors',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { FunctionName: keyValue.reconciler.name },
+      evaluationPeriods: 1,
+      metricName: 'Errors',
+      name: '${name}-' + $app.stage + '-key-value-reconciliation-errors',
+      namespace: 'AWS/Lambda',
+      period: 300,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  // Reconciliation gauges are bounded per-run samples (one page per shard),
+  // so hourly periods cover the default and any sub-hourly reconciliation
+  // cadence. A slower configured cadence leaves empty periods, so these alarms
+  // can miss a backlog (see each registration's expectedFalseNegativeRisk).
+  const outboxBacklogAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}OutboxBacklog',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'Durable domain-event intents remain undelivered.',
+        id: 'outbox-backlog',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { Slice: '${name}', Stage: $app.stage },
+      evaluationPeriods: 2,
+      metricName: 'OutboxBacklog',
+      name: '${name}-' + $app.stage + '-outbox-backlog',
+      namespace: 'EBK/Async',
+      period: 3600,
+      statistic: 'Maximum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const eventIntentRejectedAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}EventIntentRejected',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'A retained domain-event intent cannot be delivered.',
+        id: 'event-intent-rejected',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { Slice: '${name}', Stage: $app.stage },
+      evaluationPeriods: 1,
+      metricName: 'EventReconciliationRejected',
+      name: '${name}-' + $app.stage + '-event-intent-rejected',
+      namespace: 'EBK/Async',
+      period: 3600,
+      statistic: 'Maximum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const eventDeliveryAttemptsAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}EventDeliveryAttempts',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom:
+          'A domain-event intent is repeatedly failing delivery.',
+        id: 'event-delivery-attempts',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { Slice: '${name}', Stage: $app.stage },
+      evaluationPeriods: 1,
+      metricName: 'EventDeliveryMaxAttempts',
+      name: '${name}-' + $app.stage + '-event-delivery-attempts',
+      namespace: 'EBK/Async',
+      period: 3600,
+      statistic: 'Maximum',
+      threshold: 10,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const nativeAuthority = createStandardSliceNativeRuntimeAuthority({
+${sql
+            ? `    clusterId: foundation.discovery.clusterId,
+    clusterResourceId: foundation.database.clusterResourceId,
+    masterSecretArn: foundation.database.masterSecretArn,
+`
+            : ''}\
+    eventBusArn: foundation.discovery.eventBusArn,
+    identityUserPoolArn: foundation.discovery.identityUserPoolArn,
+  });
+  const runtimeResourceNames = nativeAuthority.resourceNames;
+  $transform(aws.dynamodb.Table, (args: any, _opts: any, logicalName: string) => {
+    if (logicalName === '${pascalName}WebRevalidationTable') {
+      args.name = runtimeResourceNames.webRevalidationTable;
+    }
+  });
+  $transform(aws.sqs.Queue, (args: any, _opts: any, logicalName: string) => {
+    if (logicalName === '${pascalName}WebRevalidationEventsQueue') {
+      args.name = runtimeResourceNames.webRevalidationQueue;
+    }
+  });
   const performanceCostControls = create${pascalName}PerformanceCostControls({
     accountCostPolicyDigest: foundation.discovery.accountCostPolicyDigest,
     accountMonthlyMaximumUsd:
@@ -559,12 +937,15 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     alertTopicArn: foundation.discovery.alertTopicArn,
     workspace: '${workspace}',
   });
-  const databaseProvisions = provisionDatabaseBindings(foundation, {
+${sql
+            ? `  const databaseProvisions = provisionDatabaseBindings(foundation, {
     bindings: databaseBindings,
     slice: '${name}',
   });
   const databaseProvision = databaseProvisions.bindings.primary;
   const { db: database } = databaseProvision;
+`
+            : ''}\
   const authClient = foundation.userPool.addClient('${pascalName}WebAuthClient', {
     transform: {
       client: {
@@ -584,16 +965,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const machineClientProvisioner = new sst.aws.Function(
     '${pascalName}MachineClientProvisioner',
     {
-      ...(workloadRoleBindings?.authorization.provisioner ?? {}),
-      ...(workloadRoles
-        ? {}
-        : {
-            permissions:
-              standardSliceMachineClientProvisionerPermissions({
-                userPoolArn:
-                  foundation.discovery.identityUserPoolArn,
-              }),
-          }),
+      dev: false,
+      permissions: standardSliceMachineClientProvisionerPermissions({
+        userPoolArn: foundation.discovery.identityUserPoolArn,
+      }),
       environment: {
         EBK_SLICE: '${name}',
         EBK_STAGE: $app.stage,
@@ -601,7 +976,6 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       },
       handler: 'authorization/machine-client-provisioner.handler',
       link: secretLinksFor('machine-client-provisioner'),
-      runtime: 'python3.12',
       timeout: '2 minutes',
       ...lambdaLogging(machineClientProvisionerLogs.logGroup.name),
     },
@@ -617,9 +991,8 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     userPoolId: foundation.userPool.id,
   });
   const dataExportStore = createStandardDataExportStore({
-    bucketName: workloadRoleResourceNames?.dataExportBucket,
-    keyAliasName: workloadRoleResourceNames?.dataExportKeyAlias,
-    workloadRoleArn: workloadRoleBindings?.api.dataRights.role,
+    bucketName: runtimeResourceNames.dataExportBucket,
+    keyAliasName: runtimeResourceNames.dataExportKeyAlias,
   });
 
   const apiHealthLogs = managedLogGroup(
@@ -733,9 +1106,35 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     foundation.discovery.alertTopicArn,
   );
 
+  const vpcRouteFunctionMaterializer =
+    createVpcRouteFunctionMaterializer({
+      directHandlers: [
+        'api/health.handler',
+        'async/webhook-ingress.handler',
+      ],
+${''}\
+      output: $output,
+    });
   const api = new sst.aws.ApiGatewayV2('${pascalName}Api', {
-    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } : {}),
+${network ? '    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } : {}),\n' : ''}\
+    transform: {
+      route: {
+        handler: vpcRouteFunctionMaterializer.transform,
+      },
+    },
   });
+  const routeInVpc = (
+    rawRoute: string,
+    handler: { handler: string } & Record<string, any>,
+    args?: Record<string, any>,
+  ) =>
+    vpcRouteFunctionMaterializer.route(
+      rawRoute,
+      handler,
+      args,
+      (registeredRoute, registeredHandler, registeredArgs) =>
+        api.route(registeredRoute, registeredHandler, registeredArgs),
+    );
   const performanceIngress = performanceDeploymentAuthority
     ? (() => {
         const originProof = new random.RandomPassword(
@@ -773,7 +1172,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         }
       : undefined;
   api.route(${identifierPrefix}Health.method + ' ' + ${identifierPrefix}Health.path, {
-    ...(workloadRoleBindings?.api.health ?? {}),
+    permissions: nativeAuthority.permissions('api-health'),
     environment: {
       EBK_SOURCE_COMMIT: releaseSourceCommit,
       EBK_STAGE: $app.stage,
@@ -782,13 +1181,14 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     link: secretLinksFor('api-health'),
     ...lambdaLogging(apiHealthLogs.logGroup.name),
   });
-  api.route(
+  routeInVpc(
     ${identifierPrefix}MachineAuthorizationProof.method +
       ' ' +
       ${identifierPrefix}MachineAuthorizationProof.path,
     {
-      ...(workloadRoleBindings?.api.machineAuthorizationProof ?? {}),
+      permissions: nativeAuthority.permissions('api-machine-authorization-proof'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -798,11 +1198,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       },
       handler: 'api/machine-authorization.handler',
       link: [
-        database,
+        ${'keyValue.link'},
         ...secretLinksFor('api-machine-authorization-proof'),
       ],
       ...lambdaLogging(machineAuthorizationProofTargetLogs.logGroup.name),
-      vpc: foundation.vpc,
     },
   );
   for (const route of [
@@ -819,9 +1218,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       operation: ${identifierPrefix}RevokeRecordDelegation,
     },
   ]) {
-    api.route(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.delegations ?? {}),
+    routeInVpc(route.operation.method + ' ' + route.operation.path, {
+      permissions: nativeAuthority.permissions('api-delegations'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -830,9 +1230,8 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         EBK_STAGE: $app.stage,
       },
       handler: route.handler,
-      link: [database, ...secretLinksFor('api-delegations')],
+      link: [${'keyValue.link'}, ...secretLinksFor('api-delegations')],
       ...lambdaLogging(delegationLogs.logGroup.name),
-      vpc: foundation.vpc,
     });
   }
   for (const route of [
@@ -873,12 +1272,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       operation: ${identifierPrefix}ExpireRecordHold,
     },
   ]) {
-    api.route(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.dataRights ?? {}),
-      ...(workloadRoles
-        ? {}
-        : { permissions: dataExportStore.dataRightsPermissions }),
+    routeInVpc(route.operation.method + ' ' + route.operation.path, {
+      permissions: nativeAuthority.permissions('api-data-rights'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -891,12 +1288,11 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       },
       handler: route.handler,
       link: [
-        database,
+        ${'keyValue.link'},
         foundation.eventBus,
         ...secretLinksFor('api-data-rights'),
       ],
       ...lambdaLogging(dataRightsLogs.logGroup.name),
-      vpc: foundation.vpc,
     });
   }
   for (const route of [
@@ -909,9 +1305,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       operation: ${identifierPrefix}DecideRetentionApproval,
     },
   ]) {
-    api.route(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+    routeInVpc(route.operation.method + ' ' + route.operation.path, {
+      permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -920,18 +1317,18 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         EBK_STAGE: $app.stage,
       },
       handler: route.handler,
-      link: [database, ...secretLinksFor('api-database-records')],
+      link: [${'keyValue.link'}, ...secretLinksFor('api-database-records')],
       ...lambdaLogging(dataRetentionReviewLogs.logGroup.name),
-      vpc: foundation.vpc,
     });
   }
-  api.route(
+  routeInVpc(
     ${identifierPrefix}ProtectedExample.method +
       ' ' +
       ${identifierPrefix}ProtectedExample.path,
     {
-    ...(workloadRoleBindings?.api.protected ?? {}),
+    permissions: nativeAuthority.permissions('api-protected'),
     environment: {
+${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
         machineAuthorization.acceptedClientIdsJson,
@@ -940,18 +1337,18 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       EBK_STAGE: $app.stage,
     },
     handler: 'api/protected.handler',
-    link: [database, ...secretLinksFor('api-protected')],
+    link: [${'keyValue.link'}, ...secretLinksFor('api-protected')],
     ...lambdaLogging(protectedApiLogs.logGroup.name),
-    vpc: foundation.vpc,
     },
   );
-  api.route(
+  routeInVpc(
     ${identifierPrefix}DatabaseHealth.method +
       ' ' +
       ${identifierPrefix}DatabaseHealth.path,
     {
-    ...(workloadRoleBindings?.api.databaseHealth ?? {}),
+    permissions: nativeAuthority.permissions('api-database-health'),
     environment: {
+${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
         machineAuthorization.acceptedClientIdsJson,
@@ -960,9 +1357,8 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       EBK_STAGE: $app.stage,
     },
     handler: 'database/runtime-health.handler',
-    link: [database, ...secretLinksFor('api-database-health')],
+    link: [${'keyValue.link'}, ...secretLinksFor('api-database-health')],
     ...lambdaLogging(databaseHealthLogs.logGroup.name),
-    vpc: foundation.vpc,
     },
   );
   for (const route of [
@@ -979,9 +1375,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       operation: ${identifierPrefix}PutRecord,
     },
   ]) {
-    api.route(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+    routeInVpc(route.operation.method + ' ' + route.operation.path, {
+      permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -992,12 +1389,11 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       },
       handler: route.handler,
       link: [
-        database,
+        ${'keyValue.link'},
         foundation.eventBus,
         ...secretLinksFor('api-database-records'),
       ],
       ...lambdaLogging(databaseRecordsLogs.logGroup.name),
-      vpc: foundation.vpc,
     });
   }
   for (const route of [
@@ -1010,9 +1406,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       operation: ${identifierPrefix}DecideRecordDeletion,
     },
   ]) {
-    api.route(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+    routeInVpc(route.operation.method + ' ' + route.operation.path, {
+      permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
           machineAuthorization.acceptedClientIdsJson,
@@ -1021,18 +1418,18 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         EBK_STAGE: $app.stage,
       },
       handler: route.handler,
-      link: [database, ...secretLinksFor('api-database-records')],
+      link: [${'keyValue.link'}, ...secretLinksFor('api-database-records')],
       ...lambdaLogging(databaseRecordsLogs.logGroup.name),
-      vpc: foundation.vpc,
     });
   }
-  api.route(
+  routeInVpc(
     ${identifierPrefix}PublishCreated.method +
       ' ' +
       ${identifierPrefix}PublishCreated.path,
     {
-    ...(workloadRoleBindings?.api.publishCreated ?? {}),
+    permissions: nativeAuthority.permissions('api-publish-created'),
     environment: {
+${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
         machineAuthorization.acceptedClientIdsJson,
@@ -1043,21 +1440,17 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     },
     handler: 'api/publish-created.handler',
     link: [
-      database,
+      ${'keyValue.link'},
       foundation.eventBus,
       ...secretLinksFor('api-publish-created'),
     ],
     ...lambdaLogging(eventPublisherLogs.logGroup.name),
-    vpc: foundation.vpc,
     },
   );
   const machineAuthorizationProof = new sst.aws.Function(
     '${pascalName}MachineAuthorizationProof',
     {
-      ...(workloadRoleBindings?.authorization.proof ?? {}),
-      ...(workloadRoles
-        ? {}
-        : { permissions: machineAuthorization.proof.permissions }),
+      permissions: machineAuthorization.proof.permissions,
       environment: {
         ...machineAuthorization.proof.environment,
         AUTH_MACHINE_PROBE_URL:
@@ -1072,11 +1465,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const dataExportCleanup = new sst.aws.Function(
     '${pascalName}DataExportCleanup',
     {
-      ...(workloadRoleBindings?.dataExport.cleanup ?? {}),
-      ...(workloadRoles
-        ? {}
-        : { permissions: dataExportStore.cleanupPermissions }),
+      permissions: dataExportStore.cleanupPermissions,
       environment: {
+${'        ...keyValue.environment,\n'}\
         DATA_EXPORT_BUCKET_NAME: dataExportStore.bucket.bucket,
         DATA_EXPORT_KMS_KEY_ARN: dataExportStore.encryptionKey.arn,
         EBK_STAGE: $app.stage,
@@ -1084,24 +1475,21 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       },
       handler: 'jobs/data-export-cleanup.handler',
       link: [
-        database,
+        ${'keyValue.link'},
         ...secretLinksFor('data-export-cleanup'),
       ],
       ...lambdaLogging(dataExportCleanupLogs.logGroup.name),
       timeout: '5 minutes',
-      vpc: foundation.vpc,
+${''}\
     },
   );
   const dataExportCleanupRule = new aws.cloudwatch.EventRule(
     '${pascalName}DataExportCleanupSchedule',
     {
-      ...(workloadRoleResourceNames
-        ? { name: workloadRoleResourceNames.dataExportCleanupRule }
-        : {}),
+      name: runtimeResourceNames.dataExportCleanupRule,
       description:
         'Hourly authoritative cleanup of expired confidential export versions.',
-      scheduleExpression: 'rate(1 hour)',
-      state: 'ENABLED',
+      ...backgroundSchedules.exportCleanup,
       tags: {
         'ebk:management': 'standard-data-export',
         'ebk:slice': '${name}',
@@ -1146,9 +1534,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const eventDlq = new sst.aws.Queue('${pascalName}EventDlq', {
     transform: {
       queue: {
-        ...(workloadRoleResourceNames
-          ? { name: workloadRoleResourceNames.eventDlq }
-          : {}),
+        name: runtimeResourceNames.eventDlq,
         messageRetentionSeconds: 14 * 24 * 60 * 60,
       },
     },
@@ -1157,9 +1543,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     dlq: { queue: eventDlq.arn, retry: 5 },
     transform: {
       queue: {
-        ...(workloadRoleResourceNames
-          ? { name: workloadRoleResourceNames.eventQueue }
-          : {}),
+        name: runtimeResourceNames.eventQueue,
         messageRetentionSeconds: 4 * 24 * 60 * 60,
         visibilityTimeoutSeconds: 120,
       },
@@ -1171,9 +1555,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       attributes: [{ name: 'report_digest', type: 'S' }],
       billingMode: 'PAY_PER_REQUEST',
       hashKey: 'report_digest',
-      ...(workloadRoleResourceNames
-        ? { name: workloadRoleResourceNames.asyncRecoveryLedger }
-        : {}),
+      name: runtimeResourceNames.asyncRecoveryLedger,
       pointInTimeRecovery: { enabled: true },
       tags: {
         'ebk:async-recovery-ledger': 'true',
@@ -1188,19 +1570,18 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   );
   eventQueue.subscribe({
     environment: {
+${'      ...keyValue.environment,\n'}\
       EBK_STAGE: $app.stage,
       EBK_WORKLOAD_IDENTITY: '${name}:event-consumer',
     },
     handler: 'api/event-consumer.handler',
-    link: [database, ...secretLinksFor('event-consumer')],
+    link: [${'keyValue.link'}, ...secretLinksFor('event-consumer')],
+    permissions: nativeAuthority.permissions('event-consumer'),
     ...lambdaLogging(eventConsumerLogs.logGroup.name),
     timeout: '1 minute',
-    vpc: foundation.vpc,
+${''}\
   }, {
     batch: { partialResponses: true },
-    transform: {
-      function: workloadRoleBindings?.queue.eventConsumer,
-    },
   });
   foundation.eventBus.subscribeQueue(
     '${pascalName}CreatedEventRule',
@@ -1208,7 +1589,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     {
       pattern: {
         detail: { meta: { stage: [$app.stage] } },
-        detailType: ['${pascalName}Created'],
+        detailType: sameSliceEventDetailTypes(EventContractSchema),
         source: ['${name}'],
       },
     },
@@ -1258,9 +1639,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     {
       transform: {
         queue: {
-          ...(workloadRoleResourceNames
-            ? { name: workloadRoleResourceNames.asyncTargetDlq }
-            : {}),
+          name: runtimeResourceNames.asyncTargetDlq,
           messageRetentionSeconds: 14 * 24 * 60 * 60,
           tags: {
             'ebk:async-recovery-source': 'async-target-dlq',
@@ -1274,9 +1653,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const providerDlq = new sst.aws.Queue('${pascalName}ProviderDlq', {
     transform: {
       queue: {
-        ...(workloadRoleResourceNames
-          ? { name: workloadRoleResourceNames.providerDlq }
-          : {}),
+        name: runtimeResourceNames.providerDlq,
         messageRetentionSeconds: 14 * 24 * 60 * 60,
         tags: {
           'ebk:async-recovery-source': 'provider-dlq',
@@ -1290,9 +1667,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     dlq: { queue: providerDlq.arn, retry: 5 },
     transform: {
       queue: {
-        ...(workloadRoleResourceNames
-          ? { name: workloadRoleResourceNames.providerQueue }
-          : {}),
+        name: runtimeResourceNames.providerQueue,
         messageRetentionSeconds: 4 * 24 * 60 * 60,
         tags: {
           'ebk:async-recovery-destination': 'provider-queue',
@@ -1305,10 +1680,11 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   });
   const reliability = create${pascalName}Reliability({
     alertTopicArn: foundation.discovery.alertTopicArn,
-    alertTopicName:
-      foundation.discovery.alertTopicArn.split(':').at(-1) ?? '',
+    alertTopicName: foundation.discovery.alertTopicArn.apply(
+      (alertTopicArn: string) => alertTopicArn.split(':').at(-1) ?? '',
+    ),
     apiId: api.id,
-    databaseClusterIdentifier: foundation.discovery.databaseClusterId,
+${'    databaseTableName: keyValue.table.name,\n'}\
     functionName: dataExportCleanup.name,
     providerQueueName: providerQueue.name,
   });
@@ -1356,6 +1732,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   );
   const runtimeConfiguration = protectedStage && !$dev
     ? (() => {
+        const monitorRole = nativeAuthority.createAppConfigMonitorRole(
+          '${pascalName}ConfigurationMonitorRole',
+        );
         const application = new aws.appconfig.Application(
           '${pascalName}ConfigurationApplication',
           {
@@ -1381,8 +1760,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
               reliability.providerDeadline,
             ].map((alarm) => ({
               alarmArn: alarm.arn,
-              alarmRoleArn:
-                workloadRoleBindings!.configuration.monitor.roleArn,
+              alarmRoleArn: monitorRole.arn,
             })),
             name: $app.stage,
             tags: {
@@ -1523,6 +1901,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     providerQueue.subscribe(
       {
         environment: {
+${'          ...keyValue.environment,\n'}\
           EBK_STAGE: $app.stage,
           EBK_WORKLOAD_IDENTITY: '${name}:async-provider-worker',
           EBK_WORKSPACE: '${workspace}',
@@ -1530,26 +1909,24 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         },
         handler: 'async/provider-worker.handler',
         link: [
-          database,
+          ${'keyValue.link'},
           providerQueue,
           ...secretLinksFor('async-provider-worker'),
         ],
+        permissions: nativeAuthority.permissions('async-provider-worker'),
         ...lambdaLogging(asyncProviderWorkerLogs.logGroup.name),
         timeout: '1 minute',
-        vpc: foundation.vpc,
+${''}\
       },
       {
         batch: { partialResponses: true },
-        transform: {
-          function: workloadRoleBindings?.async.providerWorker,
-        },
       },
       configurationDeployment
         ? { dependsOn: [configurationDeployment] }
         : {},
     );
     api.route('POST /${name}/webhooks/provider', {
-      ...(workloadRoleBindings?.async.webhookIngress ?? {}),
+      permissions: nativeAuthority.permissions('async-webhook-ingress'),
       environment: {
         EBK_ASYNC_LEDGER_TABLE: asyncRecoveryLedger.name,
         EBK_STAGE: $app.stage,
@@ -1568,8 +1945,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const asyncOutboxRelay = new sst.aws.Function(
     '${pascalName}AsyncOutboxRelay',
     {
-      ...(workloadRoleBindings?.async.outboxRelay ?? {}),
+      permissions: nativeAuthority.permissions('async-outbox-relay'),
       environment: {
+${'        ...keyValue.environment,\n'}\
+${''}\
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-outbox-relay',
         EBK_WORKSPACE: '${workspace}',
@@ -1577,38 +1956,117 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       },
       handler: 'async/outbox-relay.handler',
       link: [
-        database,
+        ${'keyValue.link'},
         foundation.eventBus,
         ...secretLinksFor('async-outbox-relay'),
       ],
       ...lambdaLogging(asyncOutboxRelayLogs.logGroup.name),
       timeout: '1 minute',
-      vpc: foundation.vpc,
+${''}\
     },
   );
+${sql
+            ? `  const sqlOutbox = createSqlOutboxInfrastructure({
+    workspace: '${workspace}',
+    database, eventBus: foundation.eventBus, eventBusName: foundation.discovery.eventBusName,
+    secretLinks: secretLinksFor('async-outbox-relay'),
+    vpc: foundation.vpc, schedule: backgroundSchedules.sqlOutboxRecovery,
+    alertTopicArn: foundation.discovery.alertTopicArn,
+    managedLogGroup, lambdaLogging,
+${''}\
+  });
+  const sqlOutboxRelayErrorAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}SqlOutboxRelayErrors',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'Relational event delivery is failing.',
+        id: 'sql-outbox-relay-errors',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { FunctionName: sqlOutbox.relay.name },
+      evaluationPeriods: 1,
+      metricName: 'Errors',
+      name: '${name}-' + $app.stage + '-sql-outbox-relay-errors',
+      namespace: 'AWS/Lambda',
+      period: 300,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  // The relay counts every unpublished intent; Minimum ignores healthy
+  // in-flight batches and alarms only when no run in an hour drained it.
+  const sqlOutboxBacklogAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}SqlOutboxBacklog',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom: 'Relational event intents remain undelivered.',
+        id: 'sql-outbox-backlog',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { Slice: '${name}', Stage: $app.stage },
+      evaluationPeriods: 2,
+      metricName: 'SqlOutboxBacklog',
+      name: '${name}-' + $app.stage + '-sql-outbox-backlog',
+      namespace: 'EBK/Async',
+      period: 3600,
+      statistic: 'Minimum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const sqlOutboxAttemptsAlarm = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}SqlOutboxAttempts',
+    {
+      alarmActions: [foundation.discovery.alertTopicArn],
+      alarmDescription: operationalAlarmDescription({
+        businessSymptom:
+          'A relational event intent is repeatedly failing delivery.',
+        id: 'sql-outbox-attempts',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { Slice: '${name}', Stage: $app.stage },
+      evaluationPeriods: 1,
+      metricName: 'SqlOutboxMaxAttempts',
+      name: '${name}-' + $app.stage + '-sql-outbox-attempts',
+      namespace: 'EBK/Async',
+      period: 3600,
+      statistic: 'Maximum',
+      threshold: 10,
+      treatMissingData: 'notBreaching',
+    },
+  );
+`
+            : ''}\
   const asyncInboxCleanup = new sst.aws.Function(
     '${pascalName}AsyncInboxCleanup',
     {
-      ...(workloadRoleBindings?.async.inboxCleanup ?? {}),
+      permissions: nativeAuthority.permissions('async-inbox-cleanup'),
       environment: {
+${'        ...keyValue.environment,\n'}\
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-inbox-cleanup',
         EBK_WORKSPACE: '${workspace}',
       },
       handler: 'async/inbox-cleanup.handler',
       link: [
-        database,
+        ${'keyValue.link'},
         ...secretLinksFor('async-inbox-cleanup'),
       ],
       ...lambdaLogging(asyncInboxCleanupLogs.logGroup.name),
       timeout: '5 minutes',
-      vpc: foundation.vpc,
+${''}\
     },
   );
   const asyncScheduleTarget = new sst.aws.Function(
     '${pascalName}AsyncScheduleTarget',
     {
-      ...(workloadRoleBindings?.async.scheduleTarget ?? {}),
+      permissions: nativeAuthority.permissions('async-schedule-target'),
       environment: {
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-schedule-target',
@@ -1623,7 +2081,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const asyncWorkflowTask = new sst.aws.Function(
     '${pascalName}AsyncWorkflowTask',
     {
-      ...(workloadRoleBindings?.async.workflowTask ?? {}),
+      permissions: nativeAuthority.permissions('async-workflow-task'),
       environment: {
         EBK_ASYNC_LEDGER_TABLE: asyncRecoveryLedger.name,
         EBK_STAGE: $app.stage,
@@ -1634,7 +2092,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       link: secretLinksFor('async-workflow-task'),
       ...lambdaLogging(
         asyncWorkflowTaskLogs.logGroup.name,
-        workloadRoleResourceNames?.workflowTaskFunction,
+        runtimeResourceNames.workflowTaskFunction,
       ),
       timeout: '15 minutes',
     },
@@ -1655,9 +2113,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const outboxRelayRule = new aws.cloudwatch.EventRule(
     '${pascalName}OutboxRelaySchedule',
     {
-      description: 'Durable outbox relay for committed domain events.',
-      scheduleExpression: 'rate(1 minute)',
-      state: 'ENABLED',
+      description:
+        'Durable DynamoDB outbox relay; cadence and pause are independent of SQL capacity.',
+      ...backgroundSchedules.outbox,
       tags: {
         'ebk:slice': '${name}',
         'ebk:stage': $app.stage,
@@ -1669,8 +2127,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     {
       description:
         'Bounded cleanup of expired async inbox idempotency records.',
-      scheduleExpression: 'rate(1 hour)',
-      state: 'ENABLED',
+      ...backgroundSchedules.inboxCleanup,
       tags: {
         'ebk:slice': '${name}',
         'ebk:stage': $app.stage,
@@ -1778,6 +2235,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   );
   let recordExportWorkflow: any;
   if (!$dev && asyncAdaptersConfigured) {
+    const recordExportWorkflowRole = nativeAuthority.createStepFunctionsRole(
+      '${pascalName}RecordExportWorkflowRole',
+      'async-workflow-orchestration',
+    );
     recordExportWorkflow = new aws.sfn.StateMachine(
       '${pascalName}RecordExportWorkflow',
       {
@@ -1921,8 +2382,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
           'ebk-${recordExportWorkflowName}-' +
           $app.stage +
           '-record-export-v1',
-        roleArn:
-          workloadRoleBindings!.async.workflowOrchestration.roleArn,
+        roleArn: recordExportWorkflowRole.arn,
         tags: {
           'ebk:slice': '${name}',
           'ebk:stage': $app.stage,
@@ -1933,14 +2393,18 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     );
   }
 
+  const webServerLogging = lambdaLogging(nextServerLogs.logGroup.name);
   const web = new sst.aws.Nextjs('${pascalName}Web', {
+    buildCommand: 'node ../tools/ebk-next-build-environment.mjs',
+    invalidation: { wait: true },
     dev: {
-      command: \`pnpm exec next dev web --hostname 127.0.0.1 --port \${devPort}\`,
+      command: 'node tools/ebk-next-dev.mjs',
       directory: '.',
       title: '${pascalName} web',
       url: \`http://127.0.0.1:\${devPort}/${name}\`,
     },
     environment: {
+${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_USER_POOL_ID: foundation.userPool.id,
       EBK_SOURCE_COMMIT: releaseSourceCommit,
@@ -1967,46 +2431,69 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       ...runtimeConfigurationEnvironment,
       NEXT_PUBLIC_API_URL: api.url,
     },
-    link: [database, foundation.userPool],
+    link: [keyValue.link, ${sql ? 'database, foundation.eventBus, ' : ''}foundation.userPool],
     path: 'web',
     router: { instance: foundation.router, path: '/${name}' },
     transform: {
-      assets: workloadRoleResourceNames
-        ? {
-            transform: {
-              bucket: {
-                bucket: workloadRoleResourceNames.webAssetsBucket,
-              },
-            },
-          }
-        : undefined,
+      assets: {
+        transform: {
+          bucket: {
+            bucket: runtimeResourceNames.webAssetsBucket,
+          },
+        },
+      },
       imageOptimizer: {
-        ...(workloadRoleBindings?.next.imageOptimizer ?? {}),
+        permissions: nativeAuthority.permissions('web-image-optimizer'),
+        hook: {
+          async postbuild(directory: string) {
+            removeFinderMetadataFromBuiltFunction(directory);
+          },
+        },
         link: secretLinksFor('web-image-optimizer'),
         ...lambdaLogging(nextImageOptimizerLogs.logGroup.name),
       },
       revalidationEventsSubscriber: {
-        ...(workloadRoleBindings?.next.revalidationSubscriber ?? {}),
+        permissions: nativeAuthority.permissions('web-revalidation-subscriber'),
         link: secretLinksFor('web-revalidation-subscriber'),
         ...lambdaLogging(nextRevalidationSubscriberLogs.logGroup.name),
       },
       revalidationSeeder: {
-        ...(workloadRoleBindings?.next.revalidationSeeder ?? {}),
+        permissions: nativeAuthority.permissions('web-revalidation-seeder'),
         link: secretLinksFor('web-revalidation-seeder'),
         ...lambdaLogging(nextRevalidationSeederLogs.logGroup.name),
       },
-      server: {
-        ...(workloadRoleBindings?.next.server ?? {}),
-        link: secretLinksFor(
-          'web-server',
-          performanceDeploymentBinding
-            ? []
-            : [performanceHmacLogicalName],
-        ),
-        ...lambdaLogging(nextServerLogs.logGroup.name),
+      server(args: Record<string, unknown>) {
+        args.permissions = $resolve({
+          inherited: args.permissions,
+          additional: nativeAuthority.permissions('web-server'),
+        }).apply(({ inherited, additional }) => [
+          ...((inherited ?? []) as unknown[]),
+          ...additional,
+        ]);
+        args.hook = {
+          async postbuild(directory: string) {
+            removeFinderMetadataFromBuiltFunction(directory);
+          },
+        };
+        // SST applies this transform to both its dev runtime and deployed
+        // server. Preserve native/site links; secret links are additive.
+        args.link = $output(args.link ?? []).apply((links: unknown[]) => [
+          ...links,
+          ...secretLinksFor(
+            'web-server',
+            performanceDeploymentBinding
+              ? []
+              : [performanceHmacLogicalName],
+          ),
+        ]);
+        Object.assign(args, webServerLogging);
+        args.transform = {
+          ...webServerLogging.transform,
+          ...($dev ? { role: { tags: { 'ebk:dev-runtime': 'web' } } } : {}),
+        };
       },
     },
-    vpc: foundation.vpc,
+${sql ? '    vpc: foundation.vpc,\n' : ''}\
   }, configurationDeployment
     ? { dependsOn: [configurationDeployment] }
     : {});
@@ -2027,7 +2514,15 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   }
 
   const migrationControls: Record<string, any> = {};
-  if (!$dev) {
+${`  Object.assign(migrationControls, createKeyValueRetentionInfrastructure({
+    keyValue, workspace: '${workspace}', eventBusArn: foundation.discovery.eventBusArn,
+    alertTopicArn: foundation.discovery.alertTopicArn, schedule: backgroundSchedules.retention,
+    scheduleName: runtimeResourceNames.dataRetentionMaintenanceRule,
+    managedLogGroup, lambdaLogging, register: registerProductRetention,
+  }));
+`}\
+${sql
+            ? `  if (!$dev) {
     const region = aws.getRegionOutput({}).name;
     const taskArguments = (task: any) => ({
       Cluster: task.cluster,
@@ -2049,33 +2544,38 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
           Environment: [
             {
               Name: 'EBK_DATABASE_LIFECYCLE_CORRELATION_ID',
-              Value: '{% $states.input.databaseLifecycleCorrelationId %}',
+              Value:
+                '{% $states.context.Execution.Input.databaseLifecycleCorrelationId %}',
             },
             ...(callback
               ? [
                   {
                     Name: 'EBK_CANDIDATE_IDENTITY',
-                    Value: '{% $states.input.candidateIdentity %}',
+                    Value:
+                      '{% $states.context.Execution.Input.candidateIdentity %}',
                   },
                   {
                     Name: 'EBK_EXECUTION_DATABASE_IDENTIFIER',
-                    Value: '{% $states.input.databaseIdentifier %}',
+                    Value:
+                      '{% $states.context.Execution.Input.databaseIdentifier %}',
                   },
                   {
                     Name: 'EBK_EXECUTION_SLICE',
-                    Value: '{% $states.input.slice %}',
+                    Value: '{% $states.context.Execution.Input.slice %}',
                   },
                   {
                     Name: 'EBK_EXECUTION_STAGE',
-                    Value: '{% $states.input.stage %}',
+                    Value: '{% $states.context.Execution.Input.stage %}',
                   },
                   {
                     Name: 'EBK_REGISTRATION_DIGEST',
-                    Value: '{% $states.input.registrationDigest %}',
+                    Value:
+                      '{% $states.context.Execution.Input.registrationDigest %}',
                   },
                   {
                     Name: 'EBK_SOURCE_COMMIT',
-                    Value: '{% $states.input.sourceCommit %}',
+                    Value:
+                      '{% $states.context.Execution.Input.sourceCommit %}',
                   },
                   {
                     Name: 'EBK_STEP_FUNCTIONS_TASK_TOKEN',
@@ -2091,328 +2591,25 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       logicalName: string,
       definition: unknown,
       logGroup: any,
-      roleArn: string,
-    ) =>
-      new aws.sfn.StateMachine(logicalName, {
+      roleResource: string,
+    ) => {
+      const role = nativeAuthority.createStepFunctionsRole(
+        logicalName + 'Role',
+        roleResource,
+      );
+      return new aws.sfn.StateMachine(logicalName, {
         definition: $jsonStringify(definition),
         loggingConfiguration: {
           includeExecutionData: false,
           level: 'ERROR',
           logDestination: $interpolate\`\${logGroup.arn}:*\`,
         },
-        roleArn,
+        roleArn: role.arn,
         type: 'STANDARD',
       });
-
-    if (!databaseProvision.readwriteSecretArn) {
-      throw new Error(
-        'The active primary database is missing its read/write credential reference.',
-      );
-    }
-    const retentionTaskLogs = managedLogContract('job-data-retention');
-    const retentionTask = new sst.aws.Task('${pascalName}DataRetentionTask', {
-      ...workloadRoleBindings!.dataRetention.task,
-      cluster: foundation.cluster,
-      environment: {
-        ...dataRetentionContainer.environment,
-        AWS_REGION: region,
-        EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
-        EBK_DATABASE_NAME: databaseProvision.databaseName,
-        EBK_DATABASE_PORT: $interpolate\`\${foundation.database.port}\`,
-        EBK_DATABASE_USERNAME: databaseProvision.readwriteRole,
-        EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
-        EBK_READWRITE_SECRET_ARN: databaseProvision.readwriteSecretArn,
-        EBK_SLICE: '${name}',
-        EBK_STAGE: $app.stage,
-        EBK_WORKLOAD_IDENTITY: '${name}:data-retention-job',
-        EBK_WORKSPACE: '${workspace}',
-        EVENT_BUS_NAME: foundation.eventBus.name,
-      },
-      image: dataRetentionContainer.image,
-      link: secretLinksFor('data-retention-job-task'),
-      logging: {
-        name: retentionTaskLogs.name,
-        retention: '1 month',
-      },
-      transform: {
-        logGroup: {
-          logGroupClass: retentionTaskLogs.logGroupClass,
-          tags: retentionTaskLogs.tags,
-        },
-        taskDefinition: {
-          family: workloadRoleResourceNames!.dataRetentionTaskFamily,
-        },
-      },
-    });
-    const retentionTaskLogDataProtection = managedLogDataProtection(
-      '${pascalName}DataRetentionTaskLog',
-      retentionTaskLogs,
-      retentionTaskLogs.name,
-      [retentionTask.nodes.taskDefinition],
-      foundation.discovery.alertTopicArn,
-    );
-    const retentionWorkflowLogs = managedLogGroup(
-      '${pascalName}DataRetentionWorkflowLogs',
-      'job-data-retention-orchestration',
-      foundation.discovery.alertTopicArn,
-    );
-    const retentionOverrides = retentionTask.containers.apply(
-      (containers: string[]) => ({
-        ContainerOverrides: containers.map((containerName) => ({
-          Environment: [
-            {
-              Name: 'EBK_RETENTION_APPROVAL_ID',
-              Value: '{% $states.input.approvalRequestId %}',
-            },
-            {
-              Name: 'EBK_RETENTION_CORRELATION_ID',
-              Value: '{% $states.input.correlationId %}',
-            },
-            {
-              Name: 'EBK_RETENTION_AS_OF',
-              Value: '{% $states.input.asOf %}',
-            },
-            {
-              Name: 'EBK_RETENTION_MODE',
-              Value: '{% $states.input.mode %}',
-            },
-            {
-              Name: 'EBK_RETENTION_RUN_ID',
-              Value: '{% $states.input.runId %}',
-            },
-            {
-              Name: 'EBK_STEP_FUNCTIONS_TASK_TOKEN',
-              Value: '{% $states.context.Task.Token %}',
-            },
-          ],
-          Name: containerName,
-        })),
-      }),
-    );
-    const retentionStateMachine = createRawStateMachine(
-      '${pascalName}DataRetention',
-      {
-        StartAt: 'RunDataRetention',
-        States: {
-          DataRetentionSucceeded: {
-            QueryLanguage: 'JSONata',
-            Type: 'Succeed',
-          },
-          RunDataRetention: {
-            Arguments: {
-              ...taskArguments(retentionTask),
-              Overrides: retentionOverrides,
-            },
-            Next: 'DataRetentionSucceeded',
-            QueryLanguage: 'JSONata',
-            Resource: 'arn:aws:states:::ecs:runTask.waitForTaskToken',
-            Retry: [
-              {
-                BackoffRate: 2,
-                ErrorEquals: [
-                  'ECS.AmazonECSException',
-                  'ECS.ECSException',
-                ],
-                IntervalSeconds: 10,
-                MaxAttempts: 2,
-              },
-            ],
-            TimeoutSeconds: 2700,
-            Type: 'Task',
-          },
-        },
-      },
-      retentionWorkflowLogs.logGroup,
-      workloadRoleBindings!.dataRetention.orchestration.roleArn,
-    );
-    const retentionFailureAlarm = new aws.cloudwatch.MetricAlarm(
-      '${pascalName}DataRetentionFailure',
-      {
-        alarmActions: [foundation.discovery.alertTopicArn],
-        alarmDescription: operationalAlarmDescription({
-          businessSymptom:
-            'The built-in retention Job terminated unsuccessfully.',
-          id: 'retention-job-failure',
-          runbook: 'docs/runbooks/database-recovery.md',
-        }),
-        comparisonOperator: 'GreaterThanOrEqualToThreshold',
-        evaluationPeriods: 1,
-        metricQueries: [
-          ...['ExecutionsFailed', 'ExecutionsTimedOut', 'ExecutionsAborted'].map(
-            (metricName, index) => ({
-              id: 'm' + index,
-              metric: {
-                dimensions: {
-                  StateMachineArn: retentionStateMachine.arn,
-                },
-                metricName,
-                namespace: 'AWS/States',
-                period: 60,
-                stat: 'Sum',
-              },
-              returnData: false,
-            }),
-          ),
-          {
-            expression: 'm0+m1+m2',
-            id: 'failures',
-            label: 'Retention terminal execution failures',
-            returnData: true,
-          },
-        ],
-        name: '${name}-' + $app.stage + '-retention-job-failure',
-        threshold: 1,
-        treatMissingData: 'notBreaching',
-      },
-    );
-    const retentionRegistration = registerProductRetention(
-      retentionStateMachine.arn,
-    );
-    migrationControls.dataRetention = {
-      registration: retentionRegistration,
-      retentionFailureAlarm,
-      retentionStateMachine,
-      retentionTask,
-      retentionTaskLogDataProtection,
-      retentionWorkflowLogs,
-    };
-    const retentionMaintenanceTaskLogs = managedLogContract(
-      'job-data-retention-maintenance',
-    );
-    const retentionMaintenanceTask = new sst.aws.Task(
-      '${pascalName}DataRetentionMaintenanceTask',
-      {
-        ...workloadRoleBindings!.dataRetention.maintenance.task,
-        cluster: foundation.cluster,
-        environment: {
-          ...dataRetentionContainer.environment,
-          AWS_REGION: region,
-          EBK_DATABASE_HOST: foundation.database.clusterEndpoint,
-          EBK_DATABASE_NAME: databaseProvision.databaseName,
-          EBK_DATABASE_PORT: $interpolate\`\${foundation.database.port}\`,
-          EBK_DATABASE_USERNAME: databaseProvision.readwriteRole,
-          EBK_RDS_CA_BUNDLE: '/app/rds-global-bundle.pem',
-          EBK_READWRITE_SECRET_ARN:
-            databaseProvision.readwriteSecretArn,
-          EBK_SLICE: '${name}',
-          EBK_STAGE: $app.stage,
-          EBK_WORKLOAD_IDENTITY: '${name}:data-retention-job',
-          EBK_WORKSPACE: '${workspace}',
-        },
-        image: dataRetentionContainer.image,
-        link: secretLinksFor(
-          'data-retention-maintenance-job-task',
-        ),
-        logging: {
-          name: retentionMaintenanceTaskLogs.name,
-          retention: '1 month',
-        },
-        transform: {
-          logGroup: {
-            logGroupClass:
-              retentionMaintenanceTaskLogs.logGroupClass,
-            tags: retentionMaintenanceTaskLogs.tags,
-          },
-          taskDefinition: {
-            family:
-              workloadRoleResourceNames!
-                .dataRetentionMaintenanceTaskFamily,
-          },
-        },
-      },
-    );
-    const retentionMaintenanceTaskLogDataProtection =
-      managedLogDataProtection(
-        '${pascalName}DataRetentionMaintenanceTaskLog',
-        retentionMaintenanceTaskLogs,
-        retentionMaintenanceTaskLogs.name,
-        [retentionMaintenanceTask.nodes.taskDefinition],
-        foundation.discovery.alertTopicArn,
-      );
-    const retentionMaintenanceLauncherLogs = managedLogGroup(
-      '${pascalName}DataRetentionMaintenanceLauncherLogs',
-      'job-data-retention-maintenance-launcher',
-      foundation.discovery.alertTopicArn,
-    );
-    const retentionMaintenanceContainerName =
-      retentionMaintenanceTask.containers.apply(
-        (containers: string[]) => {
-          if (containers.length !== 1 || !containers[0]) {
-            throw new Error(
-              'Retention maintenance requires exactly one task container.',
-            );
-          }
-          return containers[0];
-        },
-      );
-    const retentionMaintenanceLauncher = new sst.aws.Function(
-      '${pascalName}DataRetentionMaintenanceLauncher',
-      {
-        ...workloadRoleBindings!.dataRetention.maintenance.launcher,
-        environment: {
-          EBK_MAINTENANCE_ASSIGN_PUBLIC_IP:
-            retentionMaintenanceTask.assignPublicIp.apply(
-              (value: boolean) => String(value),
-            ),
-          EBK_MAINTENANCE_CLUSTER_ARN:
-            retentionMaintenanceTask.cluster,
-          EBK_MAINTENANCE_CONTAINER_NAME:
-            retentionMaintenanceContainerName,
-          EBK_MAINTENANCE_SECURITY_GROUP_IDS: $jsonStringify(
-            retentionMaintenanceTask.securityGroups,
-          ),
-          EBK_MAINTENANCE_SUBNET_IDS: $jsonStringify(
-            retentionMaintenanceTask.subnets,
-          ),
-          EBK_MAINTENANCE_TASK_DEFINITION_ARN:
-            retentionMaintenanceTask.taskDefinition,
-          EBK_STAGE: $app.stage,
-          EBK_WORKSPACE: '${workspace}',
-        },
-        handler: 'jobs/data-retention-maintenance-launcher.handler',
-        ...lambdaLogging(
-          retentionMaintenanceLauncherLogs.logGroup.name,
-        ),
-        timeout: '1 minute',
-      },
-    );
-    const retentionMaintenanceRule = new aws.cloudwatch.EventRule(
-      '${pascalName}DataRetentionMaintenanceSchedule',
-      {
-        name:
-          workloadRoleResourceNames!.dataRetentionMaintenanceRule,
-        scheduleExpression: 'rate(1 day)',
-      },
-    );
-    const retentionMaintenancePermission =
-      new aws.lambda.Permission(
-        '${pascalName}DataRetentionMaintenanceSchedulePermission',
-        {
-          action: 'lambda:InvokeFunction',
-          function: retentionMaintenanceLauncher.arn,
-          principal: 'events.amazonaws.com',
-          sourceArn: retentionMaintenanceRule.arn,
-        },
-      );
-    const retentionMaintenanceTarget =
-      new aws.cloudwatch.EventTarget(
-        '${pascalName}DataRetentionMaintenanceTarget',
-        {
-          arn: retentionMaintenanceLauncher.arn,
-          rule: retentionMaintenanceRule.name,
-          targetId: 'DataRetentionMaintenance',
-        },
-        { dependsOn: [retentionMaintenancePermission] },
-      );
-    migrationControls.dataRetentionMaintenance = {
-      retentionMaintenanceLauncher,
-      retentionMaintenanceLauncherLogs,
-      retentionMaintenanceRule,
-      retentionMaintenanceTarget,
-      retentionMaintenanceTask,
-      retentionMaintenanceTaskLogDataProtection,
     };
 
+${''}\
     for (const [databaseIdentifier, target] of Object.entries(
       databaseProvisions.databases,
     )) {
@@ -2434,12 +2631,12 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         'database-retirement',
         databaseIdentifier,
       );
-      const databaseRoleBindings =
-        workloadRoleBindings!.database(databaseIdentifier);
       const bootstrapTask = new sst.aws.Task(
         target.resourceName + 'BootstrapTask',
         {
-          ...databaseRoleBindings.bootstrap,
+          permissions: nativeAuthority.permissions(
+            'database-' + databaseIdentifier + '-bootstrap-task',
+          ),
           cluster: foundation.cluster,
           command: ['node', 'jobs/bootstrap-database.mjs'],
           environment: {
@@ -2496,7 +2693,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       const migrationTask = new sst.aws.Task(
         target.resourceName + 'MigrationTask',
         {
-          ...databaseRoleBindings.migration,
+          permissions: nativeAuthority.permissions(
+            'database-' + databaseIdentifier + '-migration-task',
+          ),
           cluster: foundation.cluster,
           environment: {
             ...databaseMigrationContainer.environment,
@@ -2562,6 +2761,18 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
               Next: 'RunDatabaseMigration',
               QueryLanguage: 'JSONata',
               Resource: 'arn:aws:states:::ecs:runTask.sync',
+              // The first bootstrap of a Slice runs minutes after its execution
+              // role is created; ECR can still answer "not found" to the fresh
+              // role and the task never starts (EBK-INT-2026-072). Bootstrap is
+              // idempotent, so a bounded retry is safe.
+              Retry: [
+                {
+                  BackoffRate: 2,
+                  ErrorEquals: ['States.TaskFailed'],
+                  IntervalSeconds: 30,
+                  MaxAttempts: 3,
+                },
+              ],
               TimeoutSeconds: 2700,
               Type: 'Task',
             },
@@ -2583,7 +2794,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
           },
         },
         migrationWorkflowLogs.logGroup,
-        databaseRoleBindings.migrationOrchestration.roleArn,
+        'database-' + databaseIdentifier + '-migration-orchestration',
       );
       const registration = registerProductMigration(
         target.resourceName + 'MigrationRegistration',
@@ -2592,10 +2803,11 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       );
       const retirementTask =
         $app.stage === 'development' &&
-        databaseIdentifier === 'retirement_rehearsal' &&
-        databaseRoleBindings.retirement
+        databaseIdentifier === 'retirement_rehearsal'
           ? new sst.aws.Task(target.resourceName + 'RetirementTask', {
-              ...databaseRoleBindings.retirement.task,
+              permissions: nativeAuthority.permissions(
+                'database-' + databaseIdentifier + '-retirement-task',
+              ),
               cluster: foundation.cluster,
               command: ['node', 'jobs/retire-database.mjs'],
               environment: {
@@ -2709,7 +2921,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
             },
           },
           retirementWorkflowLogs.logGroup,
-          databaseRoleBindings.retirement!.orchestration.roleArn,
+          'database-' + databaseIdentifier + '-retirement-orchestration',
         );
         retirementControl = {
           retirementWorkflowLogs,
@@ -2731,12 +2943,15 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     }
   }
 
+`
+            : ''}\
   const outboxRelayAlarm = new aws.cloudwatch.MetricAlarm(
     '${pascalName}OutboxRelayErrors',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
       alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'The transactional outbox relay is failing.',
+        businessSymptom:
+          'The isolated performance-sink outbox relay is failing.',
         id: 'outbox-relay-errors',
         runbook: 'docs/runbooks/async-recovery.md',
       }),
@@ -2821,27 +3036,6 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         treatMissingData: 'breaching',
       },
     );
-  const outboxBacklogAlarm = new aws.cloudwatch.MetricAlarm(
-    '${pascalName}OutboxBacklog',
-    {
-      alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'Transactional outbox work is accumulating.',
-        id: 'outbox-backlog',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
-      comparisonOperator: 'GreaterThanOrEqualToThreshold',
-      dimensions: { Slice: '${name}', Stage: $app.stage },
-      evaluationPeriods: 2,
-      metricName: 'OutboxBacklog',
-      name: '${name}-' + $app.stage + '-outbox-backlog',
-      namespace: 'EBK/Async',
-      period: 300,
-      statistic: 'Maximum',
-      threshold: 1,
-      treatMissingData: 'notBreaching',
-    },
-  );
   const inboxCleanupBacklogAlarm = new aws.cloudwatch.MetricAlarm(
     '${pascalName}InboxCleanupBacklog',
     {
@@ -2987,6 +3181,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     performanceLoadCleanupBacklogAlarm,
     performanceLoadCleanupDeadlineAlarm,
     asyncOutboxRelay,
+${sql ? '    sqlOutbox,\n    sqlOutboxAttemptsAlarm,\n    sqlOutboxBacklogAlarm,\n    sqlOutboxRelayErrorAlarm,\n' : ''}\
     asyncRecoveryLedger,
     asyncScheduleTarget,
     asyncTargetDlq,
@@ -3006,12 +3201,18 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     dataExportCleanupRule,
     dataExportCleanupTarget,
     dataExportStore,
-    database,
+${sql ? '    database,\n' : ''}\
+${'    keyValue,\n'}\
     dlqAlarm,
     eventDlq,
     eventQueue,
     machineClientProvisioner,
     migrationControls,
+    eventDeliveryAttemptsAlarm,
+    eventIntentRejectedAlarm,
+    keyValueReconciliationErrorAlarm,
+    keyValueStreamDeliveryErrorAlarm,
+    keyValueStreamIteratorAgeAlarm,
     outboxBacklogAlarm,
     outboxRelayAlarm,
     outboxRelayRule,
@@ -3034,5 +3235,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
 }
 `,
     };
+    Object.assign(files, (0, built_in_plan_key_value_retention_infrastructure_js_1.renderKeyValueRetentionInfrastructureFiles)(name, pascalName));
+    return files;
 }
 //# sourceMappingURL=built-in-plan-infrastructure-files.js.map