@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-workload-role-files.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderStandardSliceWorkloadRoleFiles = renderStandardSliceWorkloadRoleFiles;
 /** @internal */
-function renderStandardSliceWorkloadRoleFiles(name, workspace) {
+function renderStandardSliceWorkloadRoleFiles(name, workspace, sql = false) {
     return {
         'infra/workload-roles/candidate.ts': `import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';
 import type { WorkloadSecretReferenceInput } from '@empire-builder-kit/nx/secrets';
@@ -114,11 +114,11 @@ export function recreateRegisteredStandardSliceCandidate(
 }
 `,
         'infra/workload-roles/effective-intent.ts': `import { createHash } from 'node:crypto';
-import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';
+${sql ? "import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';\n" : ''}\
 import {
   createSecretWorkloadAccessPlan,
   parseSecretWorkloadAccessRegistry,
-  toOperatorSecretMetadataDeclarations,
+  toDeployedSecretMetadataDeclarations,
   validateSecretWorkloadAccessTargets,
   type SecretMetadataDeclaration,
   type SecretWorkloadAccessPlanEntry,
@@ -131,7 +131,7 @@ import {
   type StandardSliceWorkloadRoleTopology,
   type WorkloadRolePermissionIntent,
 } from '@empire-builder-kit/nx/workload-roles';
-import databaseBindings from '../../database/bindings.json';
+${sql ? "import databaseBindings from '../../database/bindings.json';\n" : ''}\
 import { Secrets } from '../../secrets/declarations.js';
 import secretWorkloadAccess from '../../secrets/workload-access.json';
 
@@ -142,11 +142,11 @@ export interface StandardSliceWorkloadRoleIntentContribution {
 
 export interface StandardSliceWorkloadRoleIntentContext {
   accountId: string;
-  clusterName: string;
-  clusterResourceId: string;
+  clusterName${sql ? '' : '?'}: string;
+  clusterResourceId${sql ? '' : '?'}: string;
   eventBusArn: string;
   identityUserPoolArn: string;
-  masterSecretArn: string;
+  masterSecretArn${sql ? '' : '?'}: string;
   partition: string;
   region: string;
   stage: string;
@@ -172,7 +172,7 @@ function requireSecretAccessBindings(
   topology: StandardSliceWorkloadRoleTopology,
 ) {
   const access = parseSecretWorkloadAccessRegistry(secretWorkloadAccess);
-  const declarations = toOperatorSecretMetadataDeclarations(Secrets);
+  const declarations = toDeployedSecretMetadataDeclarations(Secrets);
   const declarationsByName = new Map(
     declarations.map((declaration) => [
       declaration.logicalName,
@@ -253,6 +253,39 @@ function stableName(maxLength: number, ...parts: string[]): string {
   return value.slice(0, maxLength - digest.length - 1) + '-' + digest;
 }
 
+function stableNameWithSuffix(
+  maxLength: number,
+  suffix: string,
+  ...parts: string[]
+): string {
+  const prefix = parts.join('-').toLowerCase();
+  const normalizedSuffix = suffix.toLowerCase();
+  const value = prefix + '-' + normalizedSuffix;
+  if (value.length <= maxLength) return value;
+  const digest = createHash('sha256')
+    .update(value, 'utf8')
+    .digest('hex')
+    .slice(0, 12);
+  const retainedPrefixLength =
+    maxLength - digest.length - normalizedSuffix.length - 2;
+  return [
+    prefix.slice(0, retainedPrefixLength),
+    digest,
+    normalizedSuffix,
+  ].join('-');
+}
+
+function taskBucketName(context: { accountId: string; stage: string }, purpose: string): string | undefined {
+  if (!context.stage.startsWith('personal-')) return undefined;
+  if (!/^personal-[a-f0-9]{24}$/.test(context.stage) || !/^[0-9]{12}$/.test(context.accountId)) {
+    throw new Error('Task bucket names require an exact task stage and account.');
+  }
+  // Keep the complete account/task authority prefix within S3's 63-byte limit.
+  // Only the Slice and purpose are compacted; canonical resource names never change.
+  const digest = createHash('sha256').update('${name}' + ':' + purpose, 'utf8').digest('hex').slice(0, 12);
+  return ['ebk', context.accountId, context.stage, digest].join('-');
+}
+
 export function standardSliceResourceNames(context: {
   accountId: string;
   stage: string;
@@ -272,13 +305,13 @@ export function standardSliceResourceNames(context: {
       '${name}',
       'async-target-dlq',
     ),
-    dataExportBucket: stableName(
+    dataExportBucket: taskBucketName(context, 'data-export') ?? stableNameWithSuffix(
       63,
+      'data-export',
       'ebk',
       context.accountId,
       context.stage,
       '${name}',
-      'data-export',
     ),
     dataExportCleanupRule: stableName(
       64,
@@ -313,6 +346,8 @@ export function standardSliceResourceNames(context: {
       '${name}',
       'data-retention-maintenance',
     ),
+    dataRetentionFunction: stableName(64, 'ebk', context.stage, '${name}', 'data-retention'),
+    dataRetentionMaintenanceFunction: stableName(64, 'ebk', context.stage, '${name}', 'data-retention-maintenance'),
     databaseTaskFamily(database: string, kind: 'bootstrap' | 'migration' | 'retirement') {
       return standardSliceDatabaseTaskFamily(context.stage, database, kind);
     },
@@ -342,7 +377,7 @@ export function standardSliceResourceNames(context: {
     extensionTaskFamily(id: string, kind: 'job' | 'service') {
       return standardSliceExtensionTaskFamily(context.stage, id, kind);
     },
-    webAssetsBucket: stableName(
+    webAssetsBucket: taskBucketName(context, 'web-assets') ?? stableName(
       63,
       'ebk',
       context.accountId,
@@ -467,26 +502,32 @@ function logIntent(
   );
 }
 
-function lambdaVpcIntent(
+function defaultVpcIntents(
   id: string,
-): WorkloadRolePermissionIntent {
-  return intent(
-    id + '.vpc-network-interface',
-    { kind: 'framework', name: 'lambda-vpc' },
-    [
-      'ec2:AssignPrivateIpAddresses',
-      'ec2:CreateNetworkInterface',
-      'ec2:DeleteNetworkInterface',
-      'ec2:DescribeNetworkInterfaces',
-      'ec2:DescribeSubnets',
-      'ec2:UnassignPrivateIpAddresses',
-    ],
-    ['*'],
-    'Lambda VPC network-interface APIs do not support useful resource scoping.',
-  );
+): WorkloadRolePermissionIntent[] {
+${`  void id;
+  return [];
+`}\
+}
+
+function defaultStorageIntents(
+  context: StandardSliceWorkloadRoleIntentContext,
+  id: string,
+  database: string | undefined,
+): WorkloadRolePermissionIntent[] {
+${`  void database;
+  return [intent(
+    id + '.key-value',
+    { kind: 'permissions', name: 'slice-key-value' },
+    ['dynamodb:GetItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem',
+      'dynamodb:DeleteItem', 'dynamodb:ConditionCheckItem', 'dynamodb:Query'],
+    [arn(context, 'dynamodb', 'table/${name}-' + context.stage + '-key-value')],
+  )];
+`}\
 }
 
-function secretArn(
+${sql
+            ? `function secretArn(
   context: StandardSliceWorkloadRoleIntentContext,
   database: string,
   kind: 'readonly' | 'readwrite',
@@ -503,6 +544,8 @@ function secretArn(
       '-*',
   );
 }
+`
+            : ''}\
 
 function machineAuthorizationSecretArn(
   context: StandardSliceWorkloadRoleIntentContext,
@@ -614,7 +657,8 @@ function executionIntents(
   ];
 }
 
-function roleArn(
+${sql
+            ? `function roleArn(
   context: StandardSliceWorkloadRoleIntentContext,
   resource: string,
 ) {
@@ -649,6 +693,9 @@ function passRoleIntent(
   };
 }
 
+`
+            : ''}\
+
 function stateMachineLoggingIntent(id: string) {
   return intent(
     id + '.state-machine-logging',
@@ -668,7 +715,8 @@ function stateMachineLoggingIntent(id: string) {
   );
 }
 
-function databaseContributions(
+${sql
+            ? `function databaseContributions(
   context: StandardSliceWorkloadRoleIntentContext,
   database: string,
 ): StandardSliceWorkloadRoleIntentContribution[] {
@@ -906,166 +954,37 @@ function databaseContributions(
   );
   return contributions;
 }
+`
+            : ''}\
 
-function dataRetentionContributions(
+${`function dataRetentionContributions(
   context: StandardSliceWorkloadRoleIntentContext,
-  database: string,
 ): StandardSliceWorkloadRoleIntentContribution[] {
-  const names = standardSliceResourceNames(context);
-  const taskId = roleId('data-retention-job-task');
-  const executionId = roleId('data-retention-job-execution');
-  const orchestrationId = roleId('data-retention-job-orchestration');
-  const maintenanceTaskId = roleId(
-    'data-retention-maintenance-job-task',
-  );
-  const maintenanceExecutionId = roleId(
-    'data-retention-maintenance-job-execution',
-  );
-  const maintenanceLauncherId = roleId(
-    'data-retention-maintenance-launcher',
-  );
-  const taskDefinition = arn(
-    context,
-    'ecs',
-    'task-definition/' + names.dataRetentionTaskFamily + ':*',
-  );
-  const maintenanceTaskDefinition = arn(
-    context,
-    'ecs',
-    'task-definition/' + names.dataRetentionMaintenanceTaskFamily + ':*',
-  );
+  // These IDs remain the stable retention workflow seams. SST owns the actual
+  // runtime resources; default persistence never grants database or VPC access.
   return [
-    {
-      intents: [
-        intent(
-          taskId + '.database-secret',
-          { kind: 'secret-link', name: 'primary-database' },
-          ['secretsmanager:GetSecretValue'],
-          [secretArn(context, database, 'readwrite')],
-        ),
-        intent(
-          taskId + '.event-bus',
-          { kind: 'link', name: 'foundation-event-bus' },
-          ['events:PutEvents'],
-          [context.eventBusArn],
-        ),
-        intent(
-          taskId + '.task-callback',
-          { kind: 'framework', name: 'data-retention-callback' },
-          ['states:SendTaskFailure', 'states:SendTaskSuccess'],
-          ['*'],
-          'Step Functions callback task-token APIs require Resource star.',
-        ),
-      ],
-      roleId: taskId,
-    },
-    {
-      intents: executionIntents(
-        context,
-        executionId,
-        'job-data-retention',
-        '${name}.job.data-retention',
-      ),
-      roleId: executionId,
-    },
-    {
-      intents: [
-        intent(
-          orchestrationId + '.run-task',
-          { kind: 'framework', name: 'data-retention-orchestration' },
-          ['ecs:RunTask'],
-          [taskDefinition],
-        ),
-        intent(
-          orchestrationId + '.observe-task',
-          { kind: 'framework', name: 'data-retention-orchestration' },
-          ['ecs:DescribeTasks', 'ecs:StopTask'],
-          [arn(context, 'ecs', 'task/' + context.clusterName + '/*')],
-        ),
-        intent(
-          orchestrationId + '.managed-events-rule',
-          { kind: 'framework', name: 'data-retention-orchestration' },
-          ['events:DescribeRule', 'events:PutRule', 'events:PutTargets'],
-          [
-            arn(
-              context,
-              'events',
-              'rule/StepFunctionsGetEventsForECSTaskRule',
-            ),
-          ],
-        ),
-        passRoleIntent(context, orchestrationId, [
-          roleArn(context, 'data-retention-job-execution'),
-          roleArn(context, 'data-retention-job-task'),
-        ]),
-        stateMachineLoggingIntent(orchestrationId),
-      ],
-      roleId: orchestrationId,
-    },
-    {
-      intents: [
-        logIntent(
-          context,
-          maintenanceLauncherId,
-          'job-data-retention-maintenance-launcher',
-        ),
-        {
-          ...intent(
-            maintenanceLauncherId + '.run-maintenance-task',
-            {
-              kind: 'framework',
-              name: 'data-retention-maintenance-launcher',
-            },
-            ['ecs:RunTask'],
-            [maintenanceTaskDefinition],
-          ),
-          conditions: {
-            ArnEquals: {
-              'ecs:cluster': arn(
-                context,
-                'ecs',
-                'cluster/' + context.clusterName,
-              ),
-            },
-          },
-        },
-        passRoleIntent(
-          context,
-          maintenanceLauncherId,
-          [
-            roleArn(
-              context,
-              'data-retention-maintenance-job-execution',
-            ),
-            roleArn(context, 'data-retention-maintenance-job-task'),
-          ],
-          'data-retention-maintenance-launcher',
-        ),
-      ],
-      roleId: maintenanceLauncherId,
-    },
-    {
+    ...['data-retention-job-task', 'data-retention-maintenance-job-task'].map((resource) => ({
+      roleId: roleId(resource),
+      intents: [logIntent(context, roleId(resource), resource),
+        ...defaultStorageIntents(context, roleId(resource), undefined)],
+    })),
+    ...['data-retention-job-execution', 'data-retention-maintenance-job-execution'].map((resource) => ({
+      roleId: roleId(resource), intents: [],
+    })),
+    ...['data-retention-job-orchestration', 'data-retention-maintenance-launcher'].map((resource) => ({
+      roleId: roleId(resource),
       intents: [
-        intent(
-          maintenanceTaskId + '.database-secret',
-          { kind: 'secret-link', name: 'primary-database' },
-          ['secretsmanager:GetSecretValue'],
-          [secretArn(context, database, 'readwrite')],
-        ),
-      ],
-      roleId: maintenanceTaskId,
-    },
-    {
-      intents: executionIntents(
-        context,
-        maintenanceExecutionId,
-        'job-data-retention-maintenance',
-        '${name}.job.data-retention',
-      ),
-      roleId: maintenanceExecutionId,
-    },
+        ...(resource === 'data-retention-job-orchestration' ? [stateMachineLoggingIntent(roleId(resource))] : [logIntent(context, roleId(resource), resource)]),
+        intent(roleId(resource) + '.retention-function',
+        { kind: 'permissions', name: 'native-retention' }, ['lambda:InvokeFunction'],
+        [arn(context, 'lambda', 'function:' +
+          (resource === 'data-retention-maintenance-launcher'
+            ? standardSliceResourceNames(context).dataRetentionMaintenanceFunction
+            : standardSliceResourceNames(context).dataRetentionFunction))])],
+    })),
   ];
 }
+`}\
 
 export function extensionWorkloadRoleIntentContributions(
   context: StandardSliceWorkloadRoleIntentContext,
@@ -1177,7 +1096,8 @@ export function createStandardSliceWorkloadRoleIntents(
   topology: StandardSliceWorkloadRoleTopology,
   secretReferences: readonly WorkloadSecretReferenceInput[],
 ) {
-  const plan = createDatabaseBindingPlan(databaseBindings, {
+${sql
+            ? `  const plan = createDatabaseBindingPlan(databaseBindings, {
     slice: '${name}',
     stage: context.stage,
   });
@@ -1185,6 +1105,9 @@ export function createStandardSliceWorkloadRoleIntents(
   if (!activeDatabase) {
     throw new Error('Primary database binding is required for role intent.');
   }
+`
+            : `  const activeDatabase = undefined;
+`}\
   const names = standardSliceResourceNames(context);
   const lambda = (
     resource: string,
@@ -1202,12 +1125,7 @@ export function createStandardSliceWorkloadRoleIntents(
   const nextQueue = arn(context, 'sqs', names.webRevalidationQueue);
   const contributions: StandardSliceWorkloadRoleIntentContribution[] = [
     lambda('api-data-rights', 'data-rights', [
-      intent(
-        roleId('api-data-rights') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
+      ...defaultStorageIntents(context, roleId('api-data-rights'), activeDatabase),
       intent(
         roleId('api-data-rights') + '.event-bus',
         { kind: 'link', name: 'foundation-event-bus' },
@@ -1219,48 +1137,28 @@ export function createStandardSliceWorkloadRoleIntents(
         roleId('api-data-rights'),
         'full',
       ),
-      lambdaVpcIntent(roleId('api-data-rights')),
+      ...defaultVpcIntents(roleId('api-data-rights')),
     ]),
     lambda('api-delegations', 'authorization-delegations', [
-      intent(
-        roleId('api-delegations') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
-      lambdaVpcIntent(roleId('api-delegations')),
+      ...defaultStorageIntents(context, roleId('api-delegations'), activeDatabase),
+      ...defaultVpcIntents(roleId('api-delegations')),
     ]),
     lambda('api-health', 'api-health'),
     lambda(
       'api-machine-authorization-proof',
       'machine-authorization-proof-target',
       [
-        intent(
-          roleId('api-machine-authorization-proof') + '.database-secret',
-          { kind: 'secret-link', name: 'primary-database' },
-          ['secretsmanager:GetSecretValue'],
-          [secretArn(context, activeDatabase, 'readwrite')],
-        ),
-        lambdaVpcIntent(roleId('api-machine-authorization-proof')),
+        ...defaultStorageIntents(context, roleId('api-machine-authorization-proof'), activeDatabase),
+        ...defaultVpcIntents(roleId('api-machine-authorization-proof')),
       ],
     ),
     lambda('api-protected', 'api-protected', [
-      intent(
-        roleId('api-protected') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
-      lambdaVpcIntent(roleId('api-protected')),
+      ...defaultStorageIntents(context, roleId('api-protected'), activeDatabase),
+      ...defaultVpcIntents(roleId('api-protected')),
     ]),
     lambda('api-database-health', 'database-health', [
-      intent(
-        roleId('api-database-health') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
-      lambdaVpcIntent(roleId('api-database-health')),
+      ...defaultStorageIntents(context, roleId('api-database-health'), activeDatabase),
+      ...defaultVpcIntents(roleId('api-database-health')),
     ]),
     lambda('api-database-records', 'database-records', [
       logIntent(
@@ -1268,58 +1166,38 @@ export function createStandardSliceWorkloadRoleIntents(
         roleId('api-database-records') + '.data-retention-review',
         'data-retention-review',
       ),
-      intent(
-        roleId('api-database-records') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
+      ...defaultStorageIntents(context, roleId('api-database-records'), activeDatabase),
       intent(
         roleId('api-database-records') + '.event-bus',
         { kind: 'link', name: 'foundation-event-bus' },
         ['events:PutEvents'],
         [context.eventBusArn],
       ),
-      lambdaVpcIntent(roleId('api-database-records')),
+      ...defaultVpcIntents(roleId('api-database-records')),
     ]),
     lambda('api-publish-created', 'event-publisher', [
-      intent(
-        roleId('api-publish-created') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
+      ...defaultStorageIntents(context, roleId('api-publish-created'), activeDatabase),
       intent(
         roleId('api-publish-created') + '.event-bus',
         { kind: 'link', name: 'foundation-event-bus' },
         ['events:PutEvents'],
         [context.eventBusArn],
       ),
-      lambdaVpcIntent(roleId('api-publish-created')),
+      ...defaultVpcIntents(roleId('api-publish-created')),
     ]),
     lambda('async-outbox-relay', 'async-outbox-relay', [
-      intent(
-        roleId('async-outbox-relay') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
+      ...defaultStorageIntents(context, roleId('async-outbox-relay'), activeDatabase),
       intent(
         roleId('async-outbox-relay') + '.event-bus',
         { kind: 'link', name: 'foundation-event-bus' },
         ['events:PutEvents'],
         [context.eventBusArn],
       ),
-      lambdaVpcIntent(roleId('async-outbox-relay')),
+      ...defaultVpcIntents(roleId('async-outbox-relay')),
     ]),
     lambda('async-inbox-cleanup', 'async-inbox-cleanup', [
-      intent(
-        roleId('async-inbox-cleanup') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
-      lambdaVpcIntent(roleId('async-inbox-cleanup')),
+      ...defaultStorageIntents(context, roleId('async-inbox-cleanup'), activeDatabase),
+      ...defaultVpcIntents(roleId('async-inbox-cleanup')),
     ]),
     lambda('async-provider-worker', 'async-provider-worker', [
       {
@@ -1345,12 +1223,7 @@ export function createStandardSliceWorkloadRoleIntents(
           },
         },
       },
-      intent(
-        roleId('async-provider-worker') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
+      ...defaultStorageIntents(context, roleId('async-provider-worker'), activeDatabase),
       intent(
         roleId('async-provider-worker') + '.queue-consume',
         { kind: 'permissions', name: 'provider-queue-subscription' },
@@ -1363,7 +1236,7 @@ export function createStandardSliceWorkloadRoleIntents(
         ],
         [arn(context, 'sqs', names.providerQueue)],
       ),
-      lambdaVpcIntent(roleId('async-provider-worker')),
+      ...defaultVpcIntents(roleId('async-provider-worker')),
     ]),
     lambda('async-schedule-target', 'async-schedule-target', [
       intent(
@@ -1437,26 +1310,16 @@ export function createStandardSliceWorkloadRoleIntents(
       roleId: roleId('configuration-monitor'),
     },
     lambda('data-export-cleanup', 'job-data-export-cleanup', [
-      intent(
-        roleId('data-export-cleanup') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
+      ...defaultStorageIntents(context, roleId('data-export-cleanup'), activeDatabase),
       ...dataExportStorageIntents(
         context,
         roleId('data-export-cleanup'),
         'cleanup',
       ),
-      lambdaVpcIntent(roleId('data-export-cleanup')),
+      ...defaultVpcIntents(roleId('data-export-cleanup')),
     ]),
     lambda('event-consumer', 'event-consumer', [
-      intent(
-        roleId('event-consumer') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
+      ...defaultStorageIntents(context, roleId('event-consumer'), activeDatabase),
       intent(
         roleId('event-consumer') + '.queue-consume',
         { kind: 'permissions', name: 'event-queue-subscription' },
@@ -1469,7 +1332,7 @@ export function createStandardSliceWorkloadRoleIntents(
         ],
         [arn(context, 'sqs', names.eventQueue)],
       ),
-      lambdaVpcIntent(roleId('event-consumer')),
+      ...defaultVpcIntents(roleId('event-consumer')),
     ]),
     lambda('machine-client-provisioner', 'machine-client-provisioner', [
       intent(
@@ -1617,12 +1480,7 @@ export function createStandardSliceWorkloadRoleIntents(
         ['sqs:GetQueueAttributes', 'sqs:GetQueueUrl', 'sqs:SendMessage'],
         [nextQueue],
       ),
-      intent(
-        roleId('web-server') + '.database-secret',
-        { kind: 'secret-link', name: 'primary-database' },
-        ['secretsmanager:GetSecretValue'],
-        [secretArn(context, activeDatabase, 'readwrite')],
-      ),
+      ...defaultStorageIntents(context, roleId('web-server'), activeDatabase),
       intent(
         roleId('web-server') + '.invalidate-cdn',
         { kind: 'framework', name: 'next-server-cache' },
@@ -1635,12 +1493,15 @@ export function createStandardSliceWorkloadRoleIntents(
             ':distribution/*',
         ],
       ),
-      lambdaVpcIntent(roleId('web-server')),
+      ...defaultVpcIntents(roleId('web-server')),
     ]),
-    ...plan.provisioned.flatMap((database) =>
+${sql
+            ? `    ...plan.provisioned.flatMap((database) =>
       databaseContributions(context, database),
     ),
-    ...dataRetentionContributions(context, activeDatabase),
+`
+            : ''}\
+    ...dataRetentionContributions(context${''}),
     // <ebk:workload-role-intent-contributions:start>
     // <ebk:workload-role-intent-contributions:end>
   ];
@@ -1937,6 +1798,7 @@ import {
   type WorkloadSecretReferenceInput,
 } from '@empire-builder-kit/nx/secrets';
 import {
+  areWorkloadRoleIntentsEquivalent,
   digestWorkloadRoleManifest,
   provisionedWorkloadRoleRegistrationObjectKey,
   registeredWorkloadRoleManifestObjectKey,
@@ -2303,8 +2165,10 @@ export async function preflightStandardSliceWorkloadRoles(stage: string) {
   if (
     digestWorkloadRoleManifest(recreated.manifest) !== registered.manifestDigest ||
     registered.manifestDigest !== storage.manifestDigest ||
-    JSON.stringify(recreated.intentsByRole) !==
-      JSON.stringify(registered.intentsByRole)
+    !areWorkloadRoleIntentsEquivalent(
+      recreated.intentsByRole,
+      registered.intentsByRole,
+    )
   ) {
     throw new Error(
       'Protected workload-role registration differs from generated Standard Slice intent.',