@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/workload/service-performance-files.js

@@ -0,0 +1,1846 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderServicePerformanceFiles = renderServicePerformanceFiles;
+const model_js_1 = require("../../performance/model.js");
+function pascal(value) {
+    return value
+        .split('-')
+        .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
+        .join('');
+}
+function renderServicePerformanceFiles(input) {
+    const sliceClass = pascal(input.slice);
+    const workloadClass = pascal(input.workload);
+    const secretName = `${sliceClass}PerformanceLoadHmacKeys`;
+    const reservationResourceName = `${sliceClass}${workloadClass}PerformanceReservations`;
+    const workloadIdentity = `${input.slice}.${input.workload}-service-performance-task`;
+    const executePath = `/${input.slice}/__ebk/performance/service`;
+    const cleanupPath = `${executePath}/cleanup`;
+    return {
+        [`services/${input.workload}/src/performance.ts`]: `import {
+  DynamoDBClient,
+  GetItemCommand,
+  PutItemCommand,
+  TransactWriteItemsCommand,
+  type GetItemCommandInput,
+  type GetItemCommandOutput,
+  type PutItemCommandInput,
+  type TransactWriteItemsCommandInput,
+} from '@aws-sdk/client-dynamodb';
+import {
+  handleProtectedLoadCleanupEndpoint,
+  handleProtectedLoadScenarioEndpoint,
+  type ProtectedLoadEndpointBindingV1,
+  type ProtectedLoadEndpointResponseV1,
+  type ProtectedLoadRequestAuthorizationV1,
+} from '@empire-builder-kit/runtime/performance';
+import {
+  bindServerSecretRuntime,
+  createAwsSecretsManagerSource,
+  createServerSecretResolver,
+  defineSecrets,
+  secret,
+} from '@empire-builder-kit/runtime/secrets';
+import { randomUUID, timingSafeEqual } from 'node:crypto';
+import {
+  request as httpRequest,
+  type IncomingMessage,
+  type ServerResponse,
+} from 'node:http';
+import { Resource } from 'sst/resource';
+import { DEFAULT_SERVICE_PORT } from './service-runtime.js';
+
+const EXECUTE_PATH = '${executePath}';
+const CLEANUP_PATH = '${cleanupPath}';
+const MAXIMUM_BODY_BYTES = 32 * 1024;
+export const SERVICE_PER_TASK_CONFIGURED_MAXIMUM = ${model_js_1.STANDARD_SERVICE_PER_TASK_CONCURRENCY};
+export const SERVICE_PER_TASK_SATURATION_SIGNAL_REF =
+  'runtime:service-${input.workload}-per-task-concurrency-utilization-percent';
+const RESERVATION_RETENTION_SECONDS = 30 * 24 * 60 * 60;
+const resources = Resource as unknown as Readonly<Record<string, unknown>>;
+
+interface PerformanceHmacKey {
+  id: string;
+  secret: string;
+}
+
+interface PerformanceHmacKeys {
+  current: PerformanceHmacKey;
+  previous?: PerformanceHmacKey;
+}
+
+const performanceHmacKeys = secret.json<PerformanceHmacKeys>({
+  validate(value): value is PerformanceHmacKeys {
+    const validKey = (candidate: unknown): candidate is PerformanceHmacKey => {
+      if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+        return false;
+      }
+      const record = candidate as Record<string, unknown>;
+      const material = typeof record.secret === 'string' ? record.secret : '';
+      const decoded = /^[A-Za-z0-9_-]{43}$/.test(material)
+        ? Buffer.from(material, 'base64url')
+        : Buffer.alloc(0);
+      return Object.keys(record).length === 2 &&
+        typeof record.id === 'string' &&
+        /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(record.id) &&
+        decoded.length === 32 && decoded.toString('base64url') === material;
+    };
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+    const keys = value as Record<string, unknown>;
+    if (Object.keys(keys).some((key) => key !== 'current' && key !== 'previous')) {
+      return false;
+    }
+    if (!validKey(keys.current) || (keys.previous !== undefined && !validKey(keys.previous))) {
+      return false;
+    }
+    return keys.previous === undefined ||
+      (keys.previous.id !== keys.current.id && keys.previous.secret !== keys.current.secret);
+  },
+});
+
+const PerformanceSecrets = defineSecrets({
+  ${secretName}: {
+    cache: { freshTtlMs: 1_000, staleTtlMs: 0 },
+    owner: '${input.slice}',
+    requiredStages: ['staging', 'production'],
+    retention: { mode: 'retain' },
+    rotation: {
+      mode: 'manual',
+      runbook: 'docs/runbooks/performance-capacity-cost.md',
+    },
+    source: 'operator',
+    value: performanceHmacKeys,
+  },
+});
+
+function required(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error('protected-performance-endpoint-disabled');
+  return value;
+}
+
+export function linkedResource(
+  name: string,
+  properties: readonly string[],
+): Record<string, unknown> {
+  const value = resources[name];
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  const record = value as Record<string, unknown>;
+  if (
+    record.type !== 'sst.sst.Linkable' ||
+    Object.keys(record).some(
+      (key) => key !== 'type' && !properties.includes(key),
+    )
+  ) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  return record;
+}
+
+function secretReference() {
+  const resource = linkedResource('${secretName}', [
+    'logicalName',
+    'provider',
+    'secretArn',
+  ]);
+  if (
+    resource.logicalName !== '${secretName}' ||
+    resource.provider !== 'aws-secrets-manager' ||
+    typeof resource.secretArn !== 'string'
+  ) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  return {
+    logicalName: '${secretName}',
+    provider: 'aws-secrets-manager' as const,
+    secretArn: resource.secretArn,
+  };
+}
+
+function reservationTableName(): string {
+  const resource = linkedResource('${reservationResourceName}', ['tableName']);
+  if (typeof resource.tableName !== 'string' || resource.tableName.length === 0) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  return resource.tableName;
+}
+
+type BindingOperation<Result> = (
+  binding: ProtectedLoadEndpointBindingV1,
+) => Promise<Result>;
+
+export interface ProtectedServicePerformanceDependencies {
+  cleanup(authorization: ProtectedLoadRequestAuthorizationV1): Promise<{
+    remainingEffectCount: number;
+    removedEffectCount: number;
+  }>;
+  execute(input: {
+    authorization: ProtectedLoadRequestAuthorizationV1;
+    requestOrdinal: number;
+  }): Promise<{ saturationPercent: number }>;
+  now?: () => Date;
+  reserve(
+    authorization: ProtectedLoadRequestAuthorizationV1,
+  ): Promise<'claimed'>;
+  withBinding<Result>(
+    requestOrigin: string,
+    operation: BindingOperation<Result>,
+  ): Promise<Result>;
+}
+
+const dynamo = new DynamoDBClient({ maxAttempts: 2 });
+
+function assertProtectedServiceAuthorization(
+  authorization: ProtectedLoadRequestAuthorizationV1,
+): URL {
+  let endpoint: URL;
+  try {
+    endpoint = new URL(authorization.target.endpoint);
+  } catch {
+    throw new Error('protected-performance-service-authorization-mismatch');
+  }
+  const expectedPath =
+    authorization.operation === 'cleanup' ? CLEANUP_PATH : EXECUTE_PATH;
+  if (
+    authorization.adapterId !== 'ebk-service-v1' ||
+    authorization.configuredMaximum !== SERVICE_PER_TASK_CONFIGURED_MAXIMUM ||
+    authorization.effectId !== null ||
+    authorization.saturationSignalRef !==
+      SERVICE_PER_TASK_SATURATION_SIGNAL_REF ||
+    authorization.scenarioId !== 'service-extension' ||
+    authorization.target.slice !== '${input.slice}' ||
+    authorization.workload !== 'service' ||
+    endpoint.protocol !== 'https:' ||
+    endpoint.username ||
+    endpoint.password ||
+    endpoint.pathname !== expectedPath ||
+    endpoint.search ||
+    endpoint.hash ||
+    endpoint.href !== authorization.target.endpoint ||
+    !Number.isFinite(Date.parse(authorization.createdAt)) ||
+    !Number.isFinite(Date.parse(authorization.expiresAt))
+  ) {
+    throw new Error('protected-performance-service-authorization-mismatch');
+  }
+  return endpoint;
+}
+
+function runIdentityMaterial(
+  authorization: ProtectedLoadRequestAuthorizationV1,
+): string {
+  const endpoint = assertProtectedServiceAuthorization(authorization);
+  return JSON.stringify({
+    adapterId: authorization.adapterId,
+    configuredMaximum: authorization.configuredMaximum,
+    createdAt: authorization.createdAt,
+    durationSeconds: authorization.durationSeconds,
+    expiresAt: authorization.expiresAt,
+    maximumRequests: authorization.maximumRequests,
+    planMaterialDigest: authorization.planMaterialDigest,
+    release: authorization.release,
+    runId: authorization.runId,
+    saturationSignalRef: authorization.saturationSignalRef,
+    scenarioId: authorization.scenarioId,
+    schemaVersion: 1,
+    stage: authorization.stage,
+    target: {
+      accountFingerprint: authorization.target.accountFingerprint,
+      origin: endpoint.origin,
+      region: authorization.target.region,
+      slice: authorization.target.slice,
+    },
+    workload: authorization.workload,
+  });
+}
+
+function runItem(input: {
+  authorization: ProtectedLoadRequestAuthorizationV1;
+  identityMaterial: string;
+  sortKey: 'cleanup' | 'run';
+}) {
+  const expiresAt =
+    Math.ceil(Date.parse(input.authorization.expiresAt) / 1_000) +
+    RESERVATION_RETENTION_SECONDS;
+  return {
+    expires_at_epoch_seconds: { N: String(expiresAt) },
+    identity_material: { S: input.identityMaterial },
+    pk: { S: 'plan#' + input.authorization.planMaterialDigest },
+    sk: { S: input.sortKey },
+  };
+}
+
+function exactRunPut(input: {
+  authorization: ProtectedLoadRequestAuthorizationV1;
+  identityMaterial: string;
+  sortKey: 'cleanup' | 'run';
+  tableName: string;
+}) {
+  return {
+    ConditionExpression:
+      'attribute_not_exists(pk) OR #identity = :identity',
+    ExpressionAttributeNames: { '#identity': 'identity_material' },
+    ExpressionAttributeValues: {
+      ':identity': { S: input.identityMaterial },
+    },
+    Item: runItem(input),
+    TableName: input.tableName,
+  };
+}
+
+export interface ServicePerformanceReservationTransport {
+  get(input: GetItemCommandInput): Promise<Pick<GetItemCommandOutput, 'Item'>>;
+  put(input: PutItemCommandInput): Promise<void>;
+  transact(input: TransactWriteItemsCommandInput): Promise<void>;
+}
+
+function conditionalCheckFailed(error: unknown): boolean {
+  return Boolean(
+    error &&
+      typeof error === 'object' &&
+      !Array.isArray(error) &&
+      (error as { name?: string }).name === 'ConditionalCheckFailedException',
+  );
+}
+
+function retryableTransactionConflict(error: unknown): boolean {
+  if (!error || typeof error !== 'object' || Array.isArray(error)) return false;
+  const candidate = error as {
+    CancellationReasons?: Array<{ Code?: string }>;
+    name?: string;
+  };
+  return candidate.name === 'TransactionConflictException' ||
+    (candidate.name === 'TransactionCanceledException' &&
+      Array.isArray(candidate.CancellationReasons) &&
+      candidate.CancellationReasons.some(
+        (reason) => reason.Code === 'TransactionConflict',
+      ) &&
+      candidate.CancellationReasons.every(
+        (reason) =>
+          reason.Code === 'None' || reason.Code === 'TransactionConflict',
+      ));
+}
+
+function conditionalTransactionFailed(error: unknown): boolean {
+  if (!error || typeof error !== 'object' || Array.isArray(error)) return false;
+  const candidate = error as {
+    CancellationReasons?: Array<{ Code?: string }>;
+    name?: string;
+  };
+  return candidate.name === 'TransactionCanceledException' &&
+    Array.isArray(candidate.CancellationReasons) &&
+    candidate.CancellationReasons.some(
+      (reason) => reason.Code === 'ConditionalCheckFailed',
+    ) &&
+    candidate.CancellationReasons.every(
+      (reason) =>
+        reason.Code === 'None' || reason.Code === 'ConditionalCheckFailed',
+    );
+}
+
+async function transactWithBoundedConflictRetry(
+  transport: ServicePerformanceReservationTransport,
+  transaction: TransactWriteItemsCommandInput,
+): Promise<void> {
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      await transport.transact(transaction);
+      return;
+    } catch (error) {
+      if (!retryableTransactionConflict(error) || attempt === 2) throw error;
+      await new Promise((resolve) => setTimeout(resolve, 10 * (attempt + 1)));
+    }
+  }
+}
+
+async function assertStoredRunIdentity(input: {
+  authorization: ProtectedLoadRequestAuthorizationV1;
+  identityMaterial: string;
+  tableName: string;
+  transport: ServicePerformanceReservationTransport;
+}): Promise<boolean> {
+  const result = await input.transport.get({
+    ConsistentRead: true,
+    ExpressionAttributeNames: { '#identity': 'identity_material' },
+    Key: {
+      pk: { S: 'plan#' + input.authorization.planMaterialDigest },
+      sk: { S: 'run' },
+    },
+    ProjectionExpression: '#identity',
+    TableName: input.tableName,
+  });
+  if (!result.Item) return false;
+  if (
+    Object.keys(result.Item).length !== 1 ||
+    result.Item.identity_material?.S !== input.identityMaterial
+  ) {
+    throw new Error('protected-performance-service-run-collision');
+  }
+  return true;
+}
+
+async function ensureRunIdentity(input: {
+  authorization: ProtectedLoadRequestAuthorizationV1;
+  identityMaterial: string;
+  tableName: string;
+  transport: ServicePerformanceReservationTransport;
+}): Promise<void> {
+  if (await assertStoredRunIdentity(input)) return;
+  try {
+    await input.transport.put({
+      ConditionExpression: 'attribute_not_exists(pk)',
+      Item: runItem({
+        authorization: input.authorization,
+        identityMaterial: input.identityMaterial,
+        sortKey: 'run',
+      }),
+      TableName: input.tableName,
+    });
+  } catch (error) {
+    if (!conditionalCheckFailed(error)) throw error;
+    if (!(await assertStoredRunIdentity(input))) {
+      throw new Error('protected-performance-service-run-initialization-lost');
+    }
+  }
+}
+
+export function createServicePerformanceReservationStore(input: {
+  tableName: string;
+  transport: ServicePerformanceReservationTransport;
+}) {
+  if (!input.tableName.trim()) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  return {
+    async cleanup(authorization: ProtectedLoadRequestAuthorizationV1) {
+      if (authorization.operation !== 'cleanup') {
+        throw new Error('protected-performance-service-authorization-mismatch');
+      }
+      const identityMaterial = runIdentityMaterial(authorization);
+      try {
+        await transactWithBoundedConflictRetry(input.transport, {
+          ClientRequestToken: randomUUID(),
+          TransactItems: [
+            {
+              Put: exactRunPut({
+                authorization,
+                identityMaterial,
+                sortKey: 'run',
+                tableName: input.tableName,
+              }),
+            },
+            {
+              Put: exactRunPut({
+                authorization,
+                identityMaterial,
+                sortKey: 'cleanup',
+                tableName: input.tableName,
+              }),
+            },
+          ],
+        });
+      } catch (error) {
+        if (!conditionalTransactionFailed(error)) throw error;
+        await assertStoredRunIdentity({
+          authorization,
+          identityMaterial,
+          tableName: input.tableName,
+          transport: input.transport,
+        });
+        throw new Error('protected-performance-service-cleanup-collision');
+      }
+      return { remainingEffectCount: 0, removedEffectCount: 0 };
+    },
+    async reserve(
+      authorization: ProtectedLoadRequestAuthorizationV1,
+    ): Promise<'claimed'> {
+      if (authorization.operation !== 'execute') {
+        throw new Error('protected-performance-service-authorization-mismatch');
+      }
+      const identityMaterial = runIdentityMaterial(authorization);
+      await ensureRunIdentity({
+        authorization,
+        identityMaterial,
+        tableName: input.tableName,
+        transport: input.transport,
+      });
+      const partition = {
+        S: 'plan#' + authorization.planMaterialDigest,
+      };
+      const expiresAt =
+        Math.ceil(Date.parse(authorization.expiresAt) / 1_000) +
+        RESERVATION_RETENTION_SECONDS;
+      await transactWithBoundedConflictRetry(input.transport, {
+        ClientRequestToken: randomUUID(),
+        TransactItems: [
+          {
+            ConditionCheck: {
+              ConditionExpression: 'attribute_not_exists(pk)',
+              Key: { pk: partition, sk: { S: 'cleanup' } },
+              TableName: input.tableName,
+            },
+          },
+          {
+            Put: {
+              ConditionExpression: 'attribute_not_exists(pk)',
+              Item: {
+                expires_at_epoch_seconds: { N: String(expiresAt) },
+                identity_material: { S: identityMaterial },
+                pk: partition,
+                request_ordinal: {
+                  N: String(authorization.requestOrdinal),
+                },
+                sk: { S: 'request#' + authorization.requestOrdinal },
+              },
+              TableName: input.tableName,
+            },
+          },
+        ],
+      });
+      return 'claimed';
+    },
+  };
+}
+
+function reservationStore() {
+  return createServicePerformanceReservationStore({
+    tableName: reservationTableName(),
+    transport: {
+      async get(input) {
+        return dynamo.send(new GetItemCommand(input));
+      },
+      async put(input) {
+        await dynamo.send(new PutItemCommand(input));
+      },
+      async transact(input) {
+        await dynamo.send(new TransactWriteItemsCommand(input));
+      },
+    },
+  });
+}
+
+async function reserveRequest(
+  authorization: ProtectedLoadRequestAuthorizationV1,
+): Promise<'claimed'> {
+  return reservationStore().reserve(authorization);
+}
+
+async function cleanupRun(
+  authorization: ProtectedLoadRequestAuthorizationV1,
+) {
+  return reservationStore().cleanup(authorization);
+}
+
+export interface LocalServicePerformanceHealthObservation {
+  body: unknown;
+  statusCode: number | undefined;
+}
+
+export type LocalServicePerformanceHealthProbe = (
+  port: number,
+) => Promise<LocalServicePerformanceHealthObservation>;
+
+const requestLocalServiceHealth: LocalServicePerformanceHealthProbe =
+  (port) => new Promise((resolve, reject) => {
+    const request = httpRequest(
+      {
+        headers: { accept: 'application/json' },
+        host: '127.0.0.1',
+        method: 'GET',
+        path: '/health',
+        port,
+      },
+      (response) => {
+        const chunks: Uint8Array[] = [];
+        let size = 0;
+        response.on('data', (chunk: Uint8Array) => {
+          size += chunk.byteLength;
+          if (size > 1_024) {
+            request.destroy(
+              new Error('protected-performance-service-probe-invalid'),
+            );
+            return;
+          }
+          chunks.push(chunk);
+        });
+        response.once('error', reject);
+        response.once('end', () => {
+          try {
+            const body = JSON.parse(
+              Buffer.concat(chunks, size).toString('utf8'),
+            ) as unknown;
+            resolve({ body, statusCode: response.statusCode });
+          } catch (error) {
+            reject(error);
+          }
+        });
+      },
+    );
+    request.setTimeout(2_000, () =>
+      request.destroy(
+        new Error('protected-performance-service-probe-timeout'),
+      ),
+    );
+    request.once('error', reject);
+    request.end();
+  });
+
+export async function performLocalServicePerformanceProbe(
+  authorization: ProtectedLoadRequestAuthorizationV1,
+  healthProbe: LocalServicePerformanceHealthProbe = requestLocalServiceHealth,
+): Promise<void> {
+  assertProtectedServiceAuthorization(authorization);
+  const port = Number(process.env.PORT ?? DEFAULT_SERVICE_PORT);
+  if (!Number.isSafeInteger(port) || port <= 0 || port > 65_535) {
+    throw new Error('protected-performance-service-port-invalid');
+  }
+  const observation = await healthProbe(port);
+  const body = observation.body;
+  if (
+    observation.statusCode !== 200 ||
+    !body ||
+    typeof body !== 'object' ||
+    Array.isArray(body) ||
+    Object.keys(body).sort().join() !== 'service,status' ||
+    (body as Record<string, unknown>).service !== '${input.workload}' ||
+    (body as Record<string, unknown>).status !== 'ok'
+  ) {
+    throw new Error('protected-performance-service-probe-invalid');
+  }
+}
+
+interface ServicePerformanceExecutionInput {
+  authorization: ProtectedLoadRequestAuthorizationV1;
+  requestOrdinal: number;
+}
+
+export function createProtectedServicePerformanceExecutor(input: {
+  perform?: (
+    request: ServicePerformanceExecutionInput,
+  ) => Promise<void>;
+} = {}) {
+  const perform = input.perform ?? ((request) =>
+    performLocalServicePerformanceProbe(request.authorization));
+  let activeProtectedRequests = 0;
+  return async (request: ServicePerformanceExecutionInput) => {
+    assertProtectedServiceAuthorization(request.authorization);
+    if (
+      !Number.isSafeInteger(request.requestOrdinal) ||
+      request.requestOrdinal !== request.authorization.requestOrdinal ||
+      activeProtectedRequests >= SERVICE_PER_TASK_CONFIGURED_MAXIMUM
+    ) {
+      throw new Error('protected-performance-service-capacity-refused');
+    }
+    activeProtectedRequests += 1;
+    const observedActiveRequests = activeProtectedRequests;
+    try {
+      await perform(request);
+      return {
+        saturationPercent:
+          (observedActiveRequests /
+            SERVICE_PER_TASK_CONFIGURED_MAXIMUM) *
+          100,
+      };
+    } finally {
+      activeProtectedRequests -= 1;
+    }
+  };
+}
+
+const executeRequest = createProtectedServicePerformanceExecutor();
+
+let resolverStage: 'production' | 'staging' | undefined;
+let resolver: ReturnType<typeof createServerSecretResolver> | undefined;
+
+async function withEndpointBinding<Result>(
+  requestOrigin: string,
+  operation: BindingOperation<Result>,
+): Promise<Result> {
+  const stage = process.env.EBK_STAGE;
+  if (
+    process.env.EBK_PERFORMANCE_LOAD_ENABLED !== 'true' ||
+    (stage !== 'staging' && stage !== 'production')
+  ) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  if (resolverStage !== undefined && resolverStage !== stage) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  resolverStage = stage;
+  resolver ??= createServerSecretResolver({
+    binding: bindServerSecretRuntime({
+      stage,
+      workload: '${workloadIdentity}',
+    }),
+    source: createAwsSecretsManagerSource(),
+  });
+  return resolver.runWithSecret({
+    declaration: PerformanceSecrets.${secretName},
+    isAuthenticationFailure: () => false,
+    operation: (hmacKeys) => operation({
+      adapterId: 'ebk-service-v1',
+      deployedCandidateDigest: required('EBK_PERFORMANCE_CANDIDATE_DIGEST'),
+      deployedReleaseId: required('EBK_PERFORMANCE_RELEASE_ID'),
+      deployedReleaseMaterialDigest: required(
+        'EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST',
+      ),
+      deployedSourceCommit: required('EBK_SOURCE_COMMIT'),
+      hmacKeys,
+      stage,
+      target: {
+        accountFingerprint: required('EBK_PERFORMANCE_ACCOUNT_FINGERPRINT'),
+        origin: requestOrigin,
+        region: required('EBK_PERFORMANCE_REGION'),
+        slice: required('EBK_PERFORMANCE_SLICE'),
+      },
+    }),
+    reference: secretReference(),
+  });
+}
+
+export function createProtectedServicePerformanceHandler(
+  dependencies: ProtectedServicePerformanceDependencies,
+) {
+  return async (request: Request): Promise<Response> => {
+    try {
+      const pathname = new URL(request.url).pathname;
+      const requestOrigin = new URL(request.url).origin;
+      let result: ProtectedLoadEndpointResponseV1;
+      if (pathname === EXECUTE_PATH && request.method === 'GET') {
+        result = await dependencies.withBinding(requestOrigin, (binding) =>
+          handleProtectedLoadScenarioEndpoint({
+            binding,
+            execute: dependencies.execute,
+            now: dependencies.now,
+            request: {
+              headers: Object.fromEntries(request.headers.entries()),
+              method: 'GET',
+              url: request.url,
+            },
+            reserve: dependencies.reserve,
+          }),
+        );
+      } else if (pathname === CLEANUP_PATH && request.method === 'POST') {
+        const bytes = new Uint8Array(await request.arrayBuffer());
+        if (bytes.byteLength === 0 || bytes.byteLength > MAXIMUM_BODY_BYTES) {
+          throw new Error('protected-performance-request-body-invalid');
+        }
+        const body = JSON.parse(
+          new TextDecoder('utf-8', { fatal: true }).decode(bytes),
+        ) as unknown;
+        result = await dependencies.withBinding(requestOrigin, (binding) =>
+          handleProtectedLoadCleanupEndpoint({
+            binding,
+            cleanup: dependencies.cleanup,
+            now: dependencies.now,
+            request: {
+              body,
+              headers: Object.fromEntries(request.headers.entries()),
+              method: 'POST',
+              url: request.url,
+            },
+          }),
+        );
+      } else {
+        throw new Error('protected-performance-endpoint-disabled');
+      }
+      return Response.json(result.body, {
+        headers: { 'cache-control': 'no-store' },
+        status: result.status,
+      });
+    } catch {
+      return Response.json(
+        { kind: 'ebk-protected-load-endpoint-refusal', status: 'not-found' },
+        {
+          headers: { 'cache-control': 'no-store' },
+          status: 404,
+        },
+      );
+    }
+  };
+}
+
+export const runProtectedServicePerformanceEndpoint =
+  createProtectedServicePerformanceHandler({
+    cleanup: cleanupRun,
+    execute: executeRequest,
+    reserve: reserveRequest,
+    withBinding: withEndpointBinding,
+  });
+
+async function incomingBody(request: IncomingMessage): Promise<ArrayBuffer | undefined> {
+  if (request.method !== 'POST') return undefined;
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  for await (const chunk of request) {
+    const bytes = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+    size += bytes.byteLength;
+    if (size > MAXIMUM_BODY_BYTES) {
+      throw new Error('protected-performance-request-body-invalid');
+    }
+    chunks.push(bytes);
+  }
+  if (size === 0) throw new Error('protected-performance-request-body-invalid');
+  const concatenated = Buffer.concat(chunks, size);
+  const body = new ArrayBuffer(concatenated.byteLength);
+  new Uint8Array(body).set(concatenated);
+  return body;
+}
+
+export async function serveProtectedServicePerformanceRequest(
+  request: IncomingMessage,
+  response: ServerResponse,
+  handler = runProtectedServicePerformanceEndpoint,
+): Promise<void> {
+  const configuredOrigin = required('EBK_PERFORMANCE_ORIGIN');
+  let origin: URL;
+  try {
+    origin = new URL(configuredOrigin);
+  } catch {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  const requestTarget = request.url;
+  if (
+    origin.protocol !== 'https:' ||
+    origin.username ||
+    origin.password ||
+    origin.pathname !== '/' ||
+    origin.search ||
+    origin.hash ||
+    origin.origin !== configuredOrigin ||
+    !requestTarget ||
+    !requestTarget.startsWith('/') ||
+    requestTarget.startsWith('//') ||
+    requestTarget.includes('\\\\')
+  ) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  let target: URL;
+  try {
+    target = new URL(requestTarget, origin);
+  } catch {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  if (target.origin !== origin.origin) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  const expectedIngressProof = required('EBK_PERFORMANCE_INGRESS_PROOF');
+  const suppliedIngressProof = request.headers['x-ebk-router-origin-proof'];
+  if (
+    !/^[A-Za-z0-9]{43}$/.test(expectedIngressProof) ||
+    typeof suppliedIngressProof !== 'string' ||
+    suppliedIngressProof.length !== expectedIngressProof.length ||
+    !timingSafeEqual(
+      Buffer.from(suppliedIngressProof, 'utf8'),
+      Buffer.from(expectedIngressProof, 'utf8'),
+    )
+  ) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (name.toLowerCase() === 'x-ebk-router-origin-proof') continue;
+    if (Array.isArray(value)) value.forEach((entry) => headers.append(name, entry));
+    else if (value !== undefined) headers.set(name, value);
+  }
+  const body = await incomingBody(request);
+  const result = await handler(
+    new Request(target.href, {
+      ...(body ? { body } : {}),
+      headers,
+      method: request.method,
+    }),
+  );
+  response.writeHead(result.status, {
+    'cache-control': result.headers.get('cache-control') ?? 'no-store',
+    'content-type': result.headers.get('content-type') ?? 'application/json',
+  });
+  response.end(await result.text());
+}
+`,
+        [`services/${input.workload}/src/performance.spec.ts`]: `import type {
+  GetItemCommandInput,
+  GetItemCommandOutput,
+  PutItemCommandInput,
+  TransactWriteItemsCommandInput,
+} from '@aws-sdk/client-dynamodb';
+import {
+  createProtectedLoadRequestSignature,
+  type ProtectedLoadEndpointBindingV1,
+  type ProtectedLoadRequestAuthorizationV1,
+} from '@empire-builder-kit/runtime/performance';
+import { createLogger } from '@empire-builder-kit/runtime/logging';
+import { once } from 'node:events';
+import { request as httpRequest } from 'node:http';
+import { describe, expect, it, vi } from 'vitest';
+
+vi.mock('sst/resource', () => ({
+  Resource: {
+    ${reservationResourceName}: {
+      tableName: 'performance-reservations',
+      type: 'sst.sst.Linkable',
+    },
+    ${secretName}: {
+      logicalName: '${secretName}',
+      provider: 'aws-secrets-manager',
+      secretArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:performance',
+      type: 'sst.sst.Linkable',
+    },
+    MissingType: { tableName: 'performance-reservations' },
+    SubstitutedType: {
+      tableName: 'performance-reservations',
+      type: 'sst.sst.Secret',
+    },
+    UnexpectedProperty: {
+      tableName: 'performance-reservations',
+      type: 'sst.sst.Linkable',
+      value: 'forbidden',
+    },
+  },
+}));
+
+import { start } from './main.js';
+import {
+  createProtectedServicePerformanceExecutor,
+  createProtectedServicePerformanceHandler,
+  createServicePerformanceReservationStore,
+  linkedResource,
+  performLocalServicePerformanceProbe,
+  SERVICE_PER_TASK_CONFIGURED_MAXIMUM,
+  SERVICE_PER_TASK_SATURATION_SIGNAL_REF,
+  type ServicePerformanceReservationTransport,
+  serveProtectedServicePerformanceRequest,
+} from './performance.js';
+import { DEFAULT_SERVICE_PORT } from './service-runtime.js';
+
+const hmacKey = {
+  id: 'service-current-v1',
+  secret: Buffer.alloc(32, 0x73).toString('base64url'),
+};
+const ingressProof = 'R'.repeat(43);
+const binding: ProtectedLoadEndpointBindingV1 = {
+  adapterId: 'ebk-service-v1',
+  deployedCandidateDigest: 'b'.repeat(64),
+  deployedReleaseId: 'service-release',
+  deployedReleaseMaterialDigest: 'c'.repeat(64),
+  deployedSourceCommit: 'd'.repeat(40),
+  hmacKeys: { current: hmacKey },
+  stage: 'staging',
+  target: {
+    accountFingerprint: 'sha256:' + 'a'.repeat(64),
+    origin: 'https://service.example.test',
+    region: 'us-east-1',
+    slice: '${input.slice}',
+  },
+};
+
+function authorization(operation: 'cleanup' | 'execute'):
+  ProtectedLoadRequestAuthorizationV1 {
+  return {
+    adapterId: 'ebk-service-v1',
+    configuredMaximum: SERVICE_PER_TASK_CONFIGURED_MAXIMUM,
+    createdAt: '2026-08-01T12:00:00.000Z',
+    durationSeconds: 60,
+    effectId: null,
+    expiresAt: '2026-08-01T13:00:00.000Z',
+    hmacKeyId: hmacKey.id,
+    maximumRequests: 10,
+    operation,
+    planMaterialDigest: 'e'.repeat(64),
+    release: {
+      candidateDigest: binding.deployedCandidateDigest,
+      releaseId: binding.deployedReleaseId,
+      releaseMaterialDigest: binding.deployedReleaseMaterialDigest,
+      sourceCommit: binding.deployedSourceCommit,
+    },
+    requestOrdinal: 1,
+    runId: 'service-run',
+    saturationSignalRef: SERVICE_PER_TASK_SATURATION_SIGNAL_REF,
+    scenarioId: 'service-extension',
+    stage: 'staging',
+    target: {
+      ...binding.target,
+      endpoint: 'https://service.example.test' +
+        (operation === 'cleanup' ? '${cleanupPath}' : '${executePath}'),
+    },
+    workload: 'service',
+  };
+}
+
+function signedRequest(operation: 'cleanup' | 'execute') {
+  const material = authorization(operation);
+  const headers = {
+    'x-ebk-performance-account-fingerprint': material.target.accountFingerprint,
+    'x-ebk-performance-candidate': material.release.candidateDigest,
+    'x-ebk-performance-configured-maximum': String(material.configuredMaximum),
+    'x-ebk-performance-created-at': material.createdAt,
+    'x-ebk-performance-duration-seconds': String(material.durationSeconds),
+    'x-ebk-performance-expires-at': material.expiresAt,
+    'x-ebk-performance-hmac-key-id': material.hmacKeyId,
+    'x-ebk-performance-maximum-requests': String(material.maximumRequests),
+    'x-ebk-performance-plan': material.planMaterialDigest,
+    'x-ebk-performance-release-id': material.release.releaseId,
+    'x-ebk-performance-release-material': material.release.releaseMaterialDigest,
+    'x-ebk-performance-request': String(material.requestOrdinal),
+    'x-ebk-performance-region': material.target.region,
+    'x-ebk-performance-run': material.runId,
+    'x-ebk-performance-saturation-signal': material.saturationSignalRef,
+    'x-ebk-performance-scenario': material.scenarioId,
+    'x-ebk-performance-signature': createProtectedLoadRequestSignature({
+      authorization: material,
+      hmacKey,
+    }),
+    'x-ebk-performance-slice': material.target.slice,
+    'x-ebk-performance-source': material.release.sourceCommit,
+    'x-ebk-performance-stage': material.stage,
+  };
+  const body = {
+    planMaterialDigest: material.planMaterialDigest,
+    release: material.release,
+    requestOrdinal: material.requestOrdinal,
+    runId: material.runId,
+    scenarioId: material.scenarioId,
+    workload: material.workload,
+  };
+  return new Request(material.target.endpoint, {
+    ...(operation === 'cleanup'
+      ? { body: JSON.stringify(body), headers: { ...headers, 'content-type': 'application/json' } }
+      : { headers }),
+    method: operation === 'cleanup' ? 'POST' : 'GET',
+  });
+}
+
+type DynamoItem = Record<string, { N?: string; S?: string }>;
+
+class FakeDynamoTransactions implements ServicePerformanceReservationTransport {
+  private rows = new Map<string, DynamoItem>();
+  readonly getCalls: GetItemCommandInput[] = [];
+  readonly putCalls: PutItemCommandInput[] = [];
+  readonly transactionCalls: TransactWriteItemsCommandInput[] = [];
+  successfulInitializations = 0;
+
+  async get(
+    input: GetItemCommandInput,
+  ): Promise<Pick<GetItemCommandOutput, 'Item'>> {
+    this.getCalls.push(input);
+    if (
+      input.ConsistentRead !== true ||
+      input.ProjectionExpression !== '#identity' ||
+      input.ExpressionAttributeNames?.['#identity'] !== 'identity_material'
+    ) {
+      throw new Error('fake-dynamo-read-invalid');
+    }
+    const existing = this.rows.get(
+      this.key(input.Key as unknown as DynamoItem),
+    );
+    const identity = existing?.identity_material?.S;
+    return identity ? { Item: { identity_material: { S: identity } } } : {};
+  }
+
+  async put(input: PutItemCommandInput): Promise<void> {
+    this.putCalls.push(input);
+    if (
+      input.ConditionExpression !== 'attribute_not_exists(pk)' ||
+      !input.Item
+    ) {
+      throw new Error('fake-dynamo-initialization-invalid');
+    }
+    const item = input.Item as unknown as DynamoItem;
+    const key = this.key(item);
+    if (this.rows.has(key)) {
+      throw Object.assign(new Error('fake-dynamo-run-already-exists'), {
+        name: 'ConditionalCheckFailedException',
+      });
+    }
+    this.rows.set(key, item);
+    this.successfulInitializations += 1;
+  }
+
+  async transact(input: TransactWriteItemsCommandInput): Promise<void> {
+    this.transactionCalls.push(input);
+    const next = new Map(this.rows);
+    for (const operation of input.TransactItems ?? []) {
+      if (operation.ConditionCheck) {
+        const key = this.key(
+          operation.ConditionCheck.Key as unknown as DynamoItem,
+        );
+        if (
+          operation.ConditionCheck.ConditionExpression !==
+            'attribute_not_exists(pk)' ||
+          next.has(key)
+        ) {
+          throw new Error('fake-dynamo-conditional-check-failed');
+        }
+        continue;
+      }
+      const put = operation.Put;
+      if (!put?.Item) throw new Error('fake-dynamo-operation-invalid');
+      const item = put.Item as unknown as DynamoItem;
+      const key = this.key(item);
+      const existing = next.get(key);
+      if (put.ConditionExpression === 'attribute_not_exists(pk)') {
+        if (existing) throw new Error('fake-dynamo-request-replayed');
+      } else if (
+        put.ConditionExpression ===
+        'attribute_not_exists(pk) OR #identity = :identity'
+      ) {
+        const expected = (
+          put.ExpressionAttributeValues?.[':identity'] as
+            | { S?: string }
+            | undefined
+        )?.S;
+        if (!expected || (existing && existing.identity_material?.S !== expected)) {
+          const operationIndex = (input.TransactItems ?? []).indexOf(operation);
+          throw Object.assign(new Error('fake-dynamo-run-collision'), {
+            CancellationReasons: (input.TransactItems ?? []).map((_, index) => ({
+              Code:
+                index === operationIndex ? 'ConditionalCheckFailed' : 'None',
+            })),
+            name: 'TransactionCanceledException',
+          });
+        }
+      } else {
+        throw new Error('fake-dynamo-condition-invalid');
+      }
+      next.set(key, item);
+    }
+    this.rows = next;
+  }
+
+  snapshot() {
+    return [...this.rows.entries()]
+      .map(([key, item]) => ({
+        identity: item.identity_material?.S,
+        key,
+        ordinal: item.request_ordinal?.N,
+      }))
+      .sort((left, right) =>
+        left.key < right.key ? -1 : left.key > right.key ? 1 : 0,
+      );
+  }
+
+  private key(item: DynamoItem): string {
+    const pk = item.pk?.S;
+    const sk = item.sk?.S;
+    if (!pk || !sk) throw new Error('fake-dynamo-key-invalid');
+    return pk + '|' + sk;
+  }
+}
+
+class GatedConflictTransactions
+  implements ServicePerformanceReservationTransport {
+  private readonly backing = new FakeDynamoTransactions();
+  private released = false;
+  private readonly waiting: Array<{
+    input: TransactWriteItemsCommandInput;
+    reject(error: unknown): void;
+    resolve(value: void | PromiseLike<void>): void;
+  }> = [];
+  readonly tokens: Array<{
+    operation: 'cleanup' | 'reserve';
+    token: string;
+  }> = [];
+
+  constructor(private readonly first: 'cleanup' | 'reserve') {}
+
+  async get(
+    input: GetItemCommandInput,
+  ): Promise<Pick<GetItemCommandOutput, 'Item'>> {
+    return this.backing.get(input);
+  }
+
+  async put(input: PutItemCommandInput): Promise<void> {
+    return this.backing.put(input);
+  }
+
+  async transact(input: TransactWriteItemsCommandInput): Promise<void> {
+    this.tokens.push({
+      operation: input.TransactItems?.some((item) => item.ConditionCheck)
+        ? 'reserve'
+        : 'cleanup',
+      token: String(input.ClientRequestToken),
+    });
+    if (this.released) return this.backing.transact(input);
+    return new Promise<void>((resolve, reject) => {
+      this.waiting.push({ input, reject, resolve });
+      if (this.waiting.length === 2) void this.releaseConflict();
+    });
+  }
+
+  snapshot() {
+    return this.backing.snapshot();
+  }
+
+  private async releaseConflict(): Promise<void> {
+    const reserve = this.waiting.find(({ input }) =>
+      input.TransactItems?.some((item) => item.ConditionCheck),
+    );
+    const cleanup = this.waiting.find(({ input }) =>
+      input.TransactItems?.every((item) => !item.ConditionCheck),
+    );
+    if (!reserve || !cleanup) throw new Error('fake-dynamo-race-invalid');
+    const winner = this.first === 'reserve' ? reserve : cleanup;
+    const loser = this.first === 'reserve' ? cleanup : reserve;
+    await this.backing.transact(winner.input);
+    this.released = true;
+    winner.resolve(undefined);
+    const conflict = Object.assign(
+      new Error('fake-dynamo-transaction-conflict'),
+      {
+        CancellationReasons: loser.input.TransactItems?.map((_, index) => ({
+          Code: index === 1 ? 'TransactionConflict' : 'None',
+        })),
+        name: 'TransactionCanceledException',
+      },
+    );
+    loser.reject(conflict);
+  }
+}
+
+class OneShotCancellationTransactions
+  implements ServicePerformanceReservationTransport {
+  private readonly backing = new FakeDynamoTransactions();
+  private failed = false;
+  readonly tokens: string[] = [];
+
+  constructor(private readonly reasonCodes: readonly string[]) {}
+
+  async get(
+    input: GetItemCommandInput,
+  ): Promise<Pick<GetItemCommandOutput, 'Item'>> {
+    return this.backing.get(input);
+  }
+
+  async put(input: PutItemCommandInput): Promise<void> {
+    return this.backing.put(input);
+  }
+
+  async transact(input: TransactWriteItemsCommandInput): Promise<void> {
+    this.tokens.push(String(input.ClientRequestToken));
+    if (!this.failed) {
+      this.failed = true;
+      throw Object.assign(new Error('fake-dynamo-transaction-cancelled'), {
+        CancellationReasons: this.reasonCodes.map((Code) => ({ Code })),
+        name: 'TransactionCanceledException',
+      });
+    }
+    return this.backing.transact(input);
+  }
+}
+
+describe('${input.workload} protected Service performance runtime', () => {
+  it('accepts only exact SST 4.17.1 Linkable resource payloads', () => {
+    expect(
+      linkedResource('${reservationResourceName}', ['tableName']),
+    ).toEqual({
+      tableName: 'performance-reservations',
+      type: 'sst.sst.Linkable',
+    });
+    for (const name of [
+      'MissingType',
+      'SubstitutedType',
+      'UnexpectedProperty',
+    ]) {
+      expect(() => linkedResource(name, ['tableName'])).toThrow(
+        'protected-performance-endpoint-disabled',
+      );
+    }
+  });
+
+  it('initializes one immutable run before 32 independent reservations', async () => {
+    const transport = new FakeDynamoTransactions();
+    const store = createServicePerformanceReservationStore({
+      tableName: 'performance-reservations',
+      transport,
+    });
+    const execute = {
+      ...authorization('execute'),
+      maximumRequests: SERVICE_PER_TASK_CONFIGURED_MAXIMUM,
+    };
+    await expect(
+      Promise.all(
+        Array.from(
+          { length: SERVICE_PER_TASK_CONFIGURED_MAXIMUM },
+          (_, index) =>
+            store.reserve({ ...execute, requestOrdinal: index + 1 }),
+        ),
+      ),
+    ).resolves.toEqual(
+      Array.from(
+        { length: SERVICE_PER_TASK_CONFIGURED_MAXIMUM },
+        () => 'claimed',
+      ),
+    );
+    expect(transport.successfulInitializations).toBe(1);
+    expect(transport.putCalls).toHaveLength(
+      SERVICE_PER_TASK_CONFIGURED_MAXIMUM,
+    );
+    expect(
+      transport.getCalls.every(({ ConsistentRead }) => ConsistentRead === true),
+    ).toBe(true);
+    expect(transport.transactionCalls).toHaveLength(
+      SERVICE_PER_TASK_CONFIGURED_MAXIMUM,
+    );
+    expect(
+      transport.transactionCalls.every(
+        ({ TransactItems }) =>
+          TransactItems?.length === 2 &&
+          (TransactItems[0]?.ConditionCheck?.Key?.sk as
+            | { S?: string }
+            | undefined)?.S === 'cleanup' &&
+          (TransactItems[1]?.Put?.Item?.sk as
+            | { S?: string }
+            | undefined)?.S?.startsWith('request#') === true &&
+          TransactItems.every(
+            (item) =>
+              (item.Put?.Item?.sk as { S?: string } | undefined)?.S !== 'run',
+          ),
+      ),
+    ).toBe(true);
+    expect(
+      new Set(
+        transport.transactionCalls.map(
+          ({ TransactItems }) =>
+            (TransactItems?.[1]?.Put?.Item?.sk as
+              | { S?: string }
+              | undefined)?.S,
+        ),
+      ).size,
+    ).toBe(SERVICE_PER_TASK_CONFIGURED_MAXIMUM);
+    expect(transport.snapshot().map(({ key }) => key)).toEqual([
+      ...Array.from(
+        { length: SERVICE_PER_TASK_CONFIGURED_MAXIMUM },
+        (_, index) =>
+          'plan#' + 'e'.repeat(64) + '|request#' + (index + 1),
+      ).sort(),
+      'plan#' + 'e'.repeat(64) + '|run',
+    ].sort());
+  });
+
+  it('atomically binds one immutable run and rejects replay or cross-pair substitution', async () => {
+    const transport = new FakeDynamoTransactions();
+    const store = createServicePerformanceReservationStore({
+      tableName: 'performance-reservations',
+      transport,
+    });
+    const execute = authorization('execute');
+    await expect(
+      store.reserve({
+        ...execute,
+        configuredMaximum: SERVICE_PER_TASK_CONFIGURED_MAXIMUM + 1,
+      }),
+    ).rejects.toThrow('protected-performance-service-authorization-mismatch');
+    await expect(
+      store.reserve({
+        ...execute,
+        saturationSignalRef: 'runtime:substituted-signal',
+      }),
+    ).rejects.toThrow('protected-performance-service-authorization-mismatch');
+    expect(transport.snapshot()).toEqual([]);
+    await expect(store.reserve(execute)).resolves.toBe('claimed');
+    const afterClaim = transport.snapshot();
+    await expect(store.reserve(execute)).rejects.toThrow(
+      'fake-dynamo-request-replayed',
+    );
+    expect(transport.snapshot()).toEqual(afterClaim);
+
+    const substitutedCleanup = {
+      ...authorization('cleanup'),
+      release: {
+        ...authorization('cleanup').release,
+        releaseMaterialDigest: 'f'.repeat(64),
+      },
+      runId: 'other-service-run',
+    };
+    await expect(store.cleanup(substitutedCleanup)).rejects.toThrow(
+      'protected-performance-service-run-collision',
+    );
+    expect(transport.snapshot()).toEqual(afterClaim);
+
+    const cleanup = authorization('cleanup');
+    await expect(store.cleanup(cleanup)).resolves.toEqual({
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+    });
+    const afterCleanup = transport.snapshot();
+    await expect(store.cleanup(cleanup)).resolves.toEqual({
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+    });
+    expect(transport.snapshot()).toEqual(afterCleanup);
+    await expect(
+      store.reserve({ ...execute, requestOrdinal: 2 }),
+    ).rejects.toThrow('fake-dynamo-conditional-check-failed');
+  });
+
+  it('tombstones cleanup before the first request and recovers after a process crash', async () => {
+    const beforeFirstTransport = new FakeDynamoTransactions();
+    const beforeFirst = createServicePerformanceReservationStore({
+      tableName: 'performance-reservations',
+      transport: beforeFirstTransport,
+    });
+    await expect(beforeFirst.cleanup(authorization('cleanup'))).resolves.toEqual({
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+    });
+    await expect(beforeFirst.reserve(authorization('execute'))).rejects.toThrow(
+      'fake-dynamo-conditional-check-failed',
+    );
+
+    const crashTransport = new FakeDynamoTransactions();
+    const beforeCrash = createServicePerformanceReservationStore({
+      tableName: 'performance-reservations',
+      transport: crashTransport,
+    });
+    await beforeCrash.reserve(authorization('execute'));
+    const afterRestart = createServicePerformanceReservationStore({
+      tableName: 'performance-reservations',
+      transport: crashTransport,
+    });
+    await expect(afterRestart.cleanup(authorization('cleanup'))).resolves.toEqual({
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+    });
+    expect(crashTransport.snapshot().map(({ key }) => key)).toEqual([
+      'plan#' + 'e'.repeat(64) + '|cleanup',
+      'plan#' + 'e'.repeat(64) + '|request#1',
+      'plan#' + 'e'.repeat(64) + '|run',
+    ]);
+  });
+
+  it('linearizes concurrent reserve and cleanup transactions in either order', async () => {
+    const reserveFirstTransport = new GatedConflictTransactions('reserve');
+    const reserveFirst = createServicePerformanceReservationStore({
+      tableName: 'performance-reservations',
+      transport: reserveFirstTransport,
+    });
+    await expect(
+      Promise.all([
+        reserveFirst.reserve(authorization('execute')),
+        reserveFirst.cleanup(authorization('cleanup')),
+      ]),
+    ).resolves.toEqual([
+      'claimed',
+      { remainingEffectCount: 0, removedEffectCount: 0 },
+    ]);
+    expect(reserveFirstTransport.tokens).toHaveLength(3);
+    const cleanupTokens = reserveFirstTransport.tokens.filter(
+      ({ operation }) => operation === 'cleanup',
+    );
+    expect(cleanupTokens).toHaveLength(2);
+    expect(cleanupTokens[0]?.token).toBe(cleanupTokens[1]?.token);
+    await expect(
+      reserveFirst.reserve({ ...authorization('execute'), requestOrdinal: 2 }),
+    ).rejects.toThrow('fake-dynamo-conditional-check-failed');
+
+    const cleanupFirstTransport = new GatedConflictTransactions('cleanup');
+    const cleanupFirst = createServicePerformanceReservationStore({
+      tableName: 'performance-reservations',
+      transport: cleanupFirstTransport,
+    });
+    const results = await Promise.allSettled([
+      cleanupFirst.cleanup(authorization('cleanup')),
+      cleanupFirst.reserve(authorization('execute')),
+    ]);
+    expect(results.map(({ status }) => status)).toEqual([
+      'fulfilled',
+      'rejected',
+    ]);
+    expect(cleanupFirstTransport.tokens).toHaveLength(3);
+    const reserveTokens = cleanupFirstTransport.tokens.filter(
+      ({ operation }) => operation === 'reserve',
+    );
+    expect(reserveTokens).toHaveLength(2);
+    expect(reserveTokens[0]?.token).toBe(reserveTokens[1]?.token);
+  });
+
+  it('retries only AWS transaction conflicts with one stable idempotency token', async () => {
+    const conflict = new OneShotCancellationTransactions([
+      'None',
+      'TransactionConflict',
+      'None',
+    ]);
+    const conflictStore = createServicePerformanceReservationStore({
+      tableName: 'performance-reservations',
+      transport: conflict,
+    });
+    await expect(
+      conflictStore.reserve(authorization('execute')),
+    ).resolves.toBe('claimed');
+    expect(conflict.tokens).toHaveLength(2);
+    expect(conflict.tokens[0]).toBe(conflict.tokens[1]);
+
+    for (const reasonCodes of [
+      ['None', 'ConditionalCheckFailed', 'None'],
+      ['TransactionConflict', 'ProvisionedThroughputExceeded', 'None'],
+    ]) {
+      const rejected = new OneShotCancellationTransactions(reasonCodes);
+      const rejectedStore = createServicePerformanceReservationStore({
+        tableName: 'performance-reservations',
+        transport: rejected,
+      });
+      await expect(
+        rejectedStore.reserve(authorization('execute')),
+      ).rejects.toMatchObject({ name: 'TransactionCanceledException' });
+      expect(rejected.tokens).toHaveLength(1);
+    }
+  });
+
+  it('enforces the exact per-task admission maximum and signal', async () => {
+    const releases: Array<() => void> = [];
+    const perform = vi.fn(
+      () => new Promise<void>((resolve) => releases.push(resolve)),
+    );
+    const execute = createProtectedServicePerformanceExecutor({ perform });
+    const base = {
+      ...authorization('execute'),
+      maximumRequests: SERVICE_PER_TASK_CONFIGURED_MAXIMUM + 1,
+    };
+    const active = Array.from(
+      { length: SERVICE_PER_TASK_CONFIGURED_MAXIMUM },
+      (_, index) =>
+        execute({
+          authorization: { ...base, requestOrdinal: index + 1 },
+          requestOrdinal: index + 1,
+        }),
+    );
+    expect(releases).toHaveLength(SERVICE_PER_TASK_CONFIGURED_MAXIMUM);
+    await expect(
+      execute({
+        authorization: {
+          ...base,
+          requestOrdinal: SERVICE_PER_TASK_CONFIGURED_MAXIMUM + 1,
+        },
+        requestOrdinal: SERVICE_PER_TASK_CONFIGURED_MAXIMUM + 1,
+      }),
+    ).rejects.toThrow('protected-performance-service-capacity-refused');
+    releases.forEach((release) => release());
+    const telemetry = await Promise.all(active);
+    expect(Math.max(...telemetry.map(({ saturationPercent }) =>
+      saturationPercent))).toBe(100);
+
+    const rejectedPerform = vi.fn(async () => undefined);
+    const exactExecutor = createProtectedServicePerformanceExecutor({
+      perform: rejectedPerform,
+    });
+    await expect(
+      exactExecutor({
+        authorization: {
+          ...authorization('execute'),
+          configuredMaximum: SERVICE_PER_TASK_CONFIGURED_MAXIMUM + 1,
+        },
+        requestOrdinal: 1,
+      }),
+    ).rejects.toThrow('protected-performance-service-authorization-mismatch');
+    await expect(
+      exactExecutor({
+        authorization: {
+          ...authorization('execute'),
+          saturationSignalRef: 'runtime:substituted-signal',
+        },
+        requestOrdinal: 1,
+      }),
+    ).rejects.toThrow('protected-performance-service-authorization-mismatch');
+    expect(rejectedPerform).not.toHaveBeenCalled();
+  });
+
+  it('reports independent per-task utilization across two Service processes', async () => {
+    let releaseFirst: () => void = () => undefined;
+    let releaseSecond: () => void = () => undefined;
+    const first = createProtectedServicePerformanceExecutor({
+      perform: () => new Promise<void>((resolve) => {
+        releaseFirst = () => resolve();
+      }),
+    });
+    const second = createProtectedServicePerformanceExecutor({
+      perform: () => new Promise<void>((resolve) => {
+        releaseSecond = () => resolve();
+      }),
+    });
+    const request = {
+      authorization: authorization('execute'),
+      requestOrdinal: 1,
+    };
+    const firstResult = first(request);
+    const secondResult = second(request);
+    releaseFirst();
+    releaseSecond();
+    await expect(Promise.all([firstResult, secondResult])).resolves.toEqual([
+      { saturationPercent: 100 / SERVICE_PER_TASK_CONFIGURED_MAXIMUM },
+      { saturationPercent: 100 / SERVICE_PER_TASK_CONFIGURED_MAXIMUM },
+    ]);
+    expect(SERVICE_PER_TASK_SATURATION_SIGNAL_REF).toContain('per-task');
+  });
+
+  it('probes the deployed Service default when PORT is absent', async () => {
+    const previousPort = process.env.PORT;
+    delete process.env.PORT;
+    const healthProbe = vi.fn(async () => ({
+      body: { service: '${input.workload}', status: 'ok' },
+      statusCode: 200,
+    }));
+    try {
+      await expect(
+        performLocalServicePerformanceProbe(
+          authorization('execute'),
+          healthProbe,
+        ),
+      ).resolves.toBeUndefined();
+      expect(healthProbe).toHaveBeenCalledTimes(1);
+      expect(healthProbe).toHaveBeenCalledWith(DEFAULT_SERVICE_PORT);
+    } finally {
+      if (previousPort === undefined) delete process.env.PORT;
+      else process.env.PORT = previousPort;
+    }
+  });
+
+  it('serves a signed request through the generated Node Service route', async () => {
+    const handler = createProtectedServicePerformanceHandler({
+      cleanup: async () => ({
+        remainingEffectCount: 0,
+        removedEffectCount: 0,
+      }),
+      execute: async () => ({ saturationPercent: 25 }),
+      now: () => new Date('2026-08-01T12:30:00.000Z'),
+      reserve: async () => 'claimed',
+      withBinding: (requestOrigin, operation) => {
+        expect(requestOrigin).toBe(binding.target.origin);
+        return operation(binding);
+      },
+    });
+    const previousPort = process.env.PORT;
+    const previousIngressProof = process.env.EBK_PERFORMANCE_INGRESS_PROOF;
+    const previousOrigin = process.env.EBK_PERFORMANCE_ORIGIN;
+    process.env.PORT = '0';
+    process.env.EBK_PERFORMANCE_INGRESS_PROOF = ingressProof;
+    process.env.EBK_PERFORMANCE_ORIGIN = binding.target.origin;
+    const server = await start(
+      createLogger({
+        component: 'service-${input.workload}',
+        feature: 'performance',
+        operation: 'serve',
+        sink: () => undefined,
+        slice: '${input.slice}',
+        stage: 'test',
+        workspace: 'generated-service-test',
+      }),
+      (request, response) =>
+        serveProtectedServicePerformanceRequest(
+          request,
+          response,
+          handler,
+        ),
+    );
+    try {
+      if (!server.listening) await once(server, 'listening');
+      const address = server.address();
+      if (!address || typeof address === 'string') {
+        throw new Error('Generated Service did not bind a TCP port.');
+      }
+      process.env.PORT = String(address.port);
+      await expect(
+        performLocalServicePerformanceProbe(authorization('execute')),
+      ).resolves.toBeUndefined();
+      const signed = signedRequest('execute');
+      const response = await new Promise<{
+        body: unknown;
+        cacheControl: string | undefined;
+        status: number | undefined;
+      }>((resolve, reject) => {
+        const request = httpRequest({
+          headers: {
+            ...Object.fromEntries(signed.headers.entries()),
+            host: 'untrusted-proxy.invalid',
+            'x-ebk-router-origin-proof': ingressProof,
+            'x-forwarded-proto': 'http',
+          },
+          hostname: '127.0.0.1',
+          method: 'GET',
+          path: '${executePath}',
+          port: address.port,
+        }, (incoming) => {
+          const chunks: Uint8Array[] = [];
+          incoming.on('data', (chunk: Uint8Array) => chunks.push(chunk));
+          incoming.once('error', reject);
+          incoming.once('end', () => resolve({
+            body: JSON.parse(Buffer.concat(chunks).toString('utf8')),
+            cacheControl: incoming.headers['cache-control'],
+            status: incoming.statusCode,
+          }));
+        });
+        request.once('error', reject);
+        request.end();
+      });
+      expect(response.status).toBe(200);
+      expect(response.cacheControl).toBe('no-store');
+      expect(response.body).toMatchObject({
+        kind: 'ebk-protected-load-telemetry',
+        saturation: { percent: 25 },
+      });
+    } finally {
+      await new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      );
+      if (previousPort === undefined) delete process.env.PORT;
+      else process.env.PORT = previousPort;
+      if (previousIngressProof === undefined) {
+        delete process.env.EBK_PERFORMANCE_INGRESS_PROOF;
+      } else {
+        process.env.EBK_PERFORMANCE_INGRESS_PROOF = previousIngressProof;
+      }
+      if (previousOrigin === undefined) delete process.env.EBK_PERFORMANCE_ORIGIN;
+      else process.env.EBK_PERFORMANCE_ORIGIN = previousOrigin;
+    }
+  });
+
+  it('executes the signed Service request and exact run cleanup endpoints', async () => {
+    const reserve = vi.fn(async () => 'claimed' as const);
+    const cleanup = vi.fn(async () => ({
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+    }));
+    const handler = createProtectedServicePerformanceHandler({
+      cleanup,
+      execute: async ({ authorization: requestAuthorization }) => ({
+        saturationPercent: 100 / requestAuthorization.configuredMaximum,
+      }),
+      now: () => new Date('2026-08-01T12:30:00.000Z'),
+      reserve,
+      withBinding: (_requestOrigin, operation) => operation(binding),
+    });
+
+    const execution = await handler(signedRequest('execute'));
+    expect(execution.status).toBe(200);
+    await expect(execution.json()).resolves.toMatchObject({
+      kind: 'ebk-protected-load-telemetry',
+      saturation: {
+        percent: 100 / SERVICE_PER_TASK_CONFIGURED_MAXIMUM,
+        signalRef: SERVICE_PER_TASK_SATURATION_SIGNAL_REF,
+      },
+      workload: 'service',
+    });
+    expect(reserve).toHaveBeenCalledOnce();
+
+    const cleaned = await handler(signedRequest('cleanup'));
+    expect(cleaned.status).toBe(200);
+    await expect(cleaned.json()).resolves.toMatchObject({
+      kind: 'ebk-protected-load-cleanup-result',
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+      status: 'run-absent',
+    });
+    expect(cleanup).toHaveBeenCalledOnce();
+  });
+
+  it.each([
+    'https://substituted.example.test${executePath}',
+    '//substituted.example.test${executePath}',
+    '/${input.slice}\\\\__ebk/performance/service',
+  ])('rejects a non-origin-form Node request target %s', async (url) => {
+    const handler = vi.fn();
+    const request = {
+      headers: { 'x-ebk-router-origin-proof': ingressProof },
+      method: 'GET',
+      url,
+      async *[Symbol.asyncIterator]() {},
+    } as unknown as import('node:http').IncomingMessage;
+    const response = {} as import('node:http').ServerResponse;
+    const previousIngressProof = process.env.EBK_PERFORMANCE_INGRESS_PROOF;
+    const previousOrigin = process.env.EBK_PERFORMANCE_ORIGIN;
+    process.env.EBK_PERFORMANCE_INGRESS_PROOF = ingressProof;
+    process.env.EBK_PERFORMANCE_ORIGIN = binding.target.origin;
+    try {
+      await expect(
+        serveProtectedServicePerformanceRequest(request, response, handler),
+      ).rejects.toThrow('protected-performance-endpoint-disabled');
+      expect(handler).not.toHaveBeenCalled();
+    } finally {
+      if (previousIngressProof === undefined) {
+        delete process.env.EBK_PERFORMANCE_INGRESS_PROOF;
+      } else {
+        process.env.EBK_PERFORMANCE_INGRESS_PROOF = previousIngressProof;
+      }
+      if (previousOrigin === undefined) delete process.env.EBK_PERFORMANCE_ORIGIN;
+      else process.env.EBK_PERFORMANCE_ORIGIN = previousOrigin;
+    }
+  });
+
+  it('rejects a direct origin request without the Router-injected proof', async () => {
+    const handler = vi.fn();
+    const request = {
+      headers: {},
+      method: 'GET',
+      url: '${executePath}',
+      async *[Symbol.asyncIterator]() {},
+    } as unknown as import('node:http').IncomingMessage;
+    const response = {} as import('node:http').ServerResponse;
+    const previousIngressProof = process.env.EBK_PERFORMANCE_INGRESS_PROOF;
+    const previousOrigin = process.env.EBK_PERFORMANCE_ORIGIN;
+    process.env.EBK_PERFORMANCE_INGRESS_PROOF = ingressProof;
+    process.env.EBK_PERFORMANCE_ORIGIN = binding.target.origin;
+    try {
+      await expect(
+        serveProtectedServicePerformanceRequest(request, response, handler),
+      ).rejects.toThrow('protected-performance-endpoint-disabled');
+      expect(handler).not.toHaveBeenCalled();
+    } finally {
+      if (previousIngressProof === undefined) {
+        delete process.env.EBK_PERFORMANCE_INGRESS_PROOF;
+      } else {
+        process.env.EBK_PERFORMANCE_INGRESS_PROOF = previousIngressProof;
+      }
+      if (previousOrigin === undefined) delete process.env.EBK_PERFORMANCE_ORIGIN;
+      else process.env.EBK_PERFORMANCE_ORIGIN = previousOrigin;
+    }
+  });
+
+  it('fails closed before callbacks for a substituted release or effect body', async () => {
+    const reserve = vi.fn(async () => 'claimed' as const);
+    const cleanup = vi.fn(async () => ({
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+    }));
+    const handler = createProtectedServicePerformanceHandler({
+      cleanup,
+      execute: async () => ({ saturationPercent: 1 }),
+      now: () => new Date('2026-08-01T12:30:00.000Z'),
+      reserve,
+      withBinding: (_requestOrigin, operation) => operation(binding),
+    });
+    const substituted = signedRequest('execute');
+    substituted.headers.set('x-ebk-performance-release-id', 'other-release');
+    expect((await handler(substituted)).status).toBe(404);
+
+    const cleanupMaterial = authorization('cleanup');
+    const cleanupRequest = signedRequest('cleanup');
+    const body = JSON.parse(await cleanupRequest.text()) as Record<string, unknown>;
+    const effectRequest = new Request(cleanupMaterial.target.endpoint, {
+      body: JSON.stringify({ ...body, effectId: 'f'.repeat(64) }),
+      headers: cleanupRequest.headers,
+      method: 'POST',
+    });
+    expect((await handler(effectRequest)).status).toBe(404);
+    expect(reserve).not.toHaveBeenCalled();
+    expect(cleanup).not.toHaveBeenCalled();
+  });
+});
+`,
+        [`services/${input.workload}/PERFORMANCE.md`]: `# Protected Service performance
+
+The managed \`${input.workload}\` endpoint admits at most 32 concurrent protected
+performance requests in each generated Service process. The
+\`runtime:service-${input.workload}-per-task-concurrency-utilization-percent\`
+signal reports that per-task admission utilization only. It is not whole-fleet
+or application saturation evidence. The adopted performance policy must keep
+\`configuredMaximum\` at 32 while independently supplying and reviewing the
+downstream and quota ceilings before protected load can run.
+
+Each admitted request executes the Service's real local \`GET /health\` codepath.
+The DynamoDB reservation transaction binds one immutable run identity, rejects
+replayed ordinals, and creates an idempotent cleanup tombstone that blocks every
+late request for that exact plan digest.
+`,
+    };
+}
+//# sourceMappingURL=service-performance-files.js.map