@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/preset/workspace-files-performance-cost.js

@@ -0,0 +1,866 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTECTED_AGGREGATE_COUNT_TARGET = exports.PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH = exports.PROTECTED_AGGREGATE_COUNT_WORKFLOW_NAME = exports.PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH = void 0;
+exports.validateProtectedAggregateCountSourceAuthority = validateProtectedAggregateCountSourceAuthority;
+exports.renderProtectedAggregateCountWorkflow = renderProtectedAggregateCountWorkflow;
+exports.validateProtectedPerformanceCostSourceAuthority = validateProtectedPerformanceCostSourceAuthority;
+exports.renderProtectedPerformanceCostWorkflow = renderProtectedPerformanceCostWorkflow;
+const index_js_1 = require("../../git-policy/index.js");
+const tool_versions_js_1 = require("./tool-versions.js");
+exports.PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH = '.github/workflows/performance-cost-actual.yml';
+exports.PROTECTED_AGGREGATE_COUNT_WORKFLOW_NAME = 'Protected aggregate counts';
+exports.PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH = '.github/workflows/performance-aggregate-counts.yml';
+exports.PROTECTED_AGGREGATE_COUNT_TARGET = 'performance-aggregate-counts';
+/**
+ * Treats the selected Deploy run as a locator only. The run and its exact
+ * release-evidence artifact must independently prove the current protected
+ * branch candidate before generated aggregate code is allowed to execute.
+ */
+function validateProtectedAggregateCountSourceAuthority(input) {
+    const refuse = (detail) => {
+        throw new Error(`Protected aggregate-count source authority is invalid: ${detail}.`);
+    };
+    const branch = input.stage === 'staging'
+        ? 'develop'
+        : input.stage === 'production'
+            ? 'main'
+            : refuse('stage is unsupported');
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(input.project)) {
+        refuse('Product Slice identity is not normalized');
+    }
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(input.candidate) ||
+        !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(input.repository) ||
+        !/^[1-9]\d{0,19}$/.test(input.runId)) {
+        refuse('repository, candidate, or run identity is malformed');
+    }
+    const runAttempt = String(input.run.run_attempt ?? '');
+    if (String(input.run.id ?? '') !== input.runId ||
+        input.run.name !== 'Deploy' ||
+        input.run.path !== '.github/workflows/deploy.yml' ||
+        input.run.status !== 'completed' ||
+        input.run.conclusion !== 'success' ||
+        !['push', 'workflow_dispatch'].includes(input.run.event ?? '') ||
+        input.run.head_branch !== branch ||
+        input.run.head_repository?.full_name !== input.repository ||
+        input.run.head_sha !== input.candidate ||
+        !/^[1-9]\d*$/.test(runAttempt)) {
+        refuse('Deploy run does not match the current protected candidate');
+    }
+    const artifactName = [
+        'release-evidence',
+        input.stage,
+        input.runId,
+        runAttempt,
+    ].join('-');
+    if (!Number.isSafeInteger(input.artifactTotal) ||
+        input.artifactTotal < 1 ||
+        input.artifactTotal > 100 ||
+        input.artifacts.length !== input.artifactTotal ||
+        input.artifacts.filter(({ expired, name }) => expired === false && name === artifactName).length !== 1) {
+        refuse('exact release-evidence artifact is absent, expired, or ambiguous');
+    }
+    return Object.freeze({ artifactName, runAttempt });
+}
+function renderProtectedAggregateCountWorkflow() {
+    const checkout = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.checkout);
+    const configureAws = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.configureAwsCredentials);
+    const downloadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.downloadArtifact);
+    const pnpmSetup = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.pnpmSetup);
+    const setupNode = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.setupNode);
+    const uploadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.uploadArtifact);
+    const sourceAuthority = Buffer.from(validateProtectedAggregateCountSourceAuthority.toString(), 'utf8').toString('base64');
+    return {
+        [exports.PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH]: `name: ${exports.PROTECTED_AGGREGATE_COUNT_WORKFLOW_NAME}
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Exact protected aggregate cohort stage
+        required: true
+        type: choice
+        options: [staging, production]
+      project:
+        description: Exact Product Slice project
+        required: true
+        type: string
+      candidate:
+        description: Exact current protected-ref Git object ID
+        required: true
+        type: string
+      release_run_id:
+        description: Exact successful generated Deploy workflow run
+        required: true
+        type: string
+      period_start:
+        description: Closed billing period start as YYYY-MM-DD
+        required: true
+        type: string
+      period_end:
+        description: Closed billing period end as YYYY-MM-DD
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: protected-performance-aggregate-\${{ inputs.stage }}-\${{ inputs.project }}
+  cancel-in-progress: false
+
+jobs:
+  collect:
+    environment: performance-aggregate-\${{ inputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PERFORMANCE_AGGREGATE_ROLE_ARN: \${{ secrets.AWS_PERFORMANCE_AGGREGATE_ROLE_ARN }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_APPROVED_REGION: \${{ vars.AWS_REGION }}
+      EBK_AGGREGATE_PERIOD_END: \${{ inputs.period_end }}T00:00:00.000Z
+      EBK_AGGREGATE_PERIOD_START: \${{ inputs.period_start }}T00:00:00.000Z
+      EBK_PROJECT: \${{ inputs.project }}
+      EBK_RELEASE_ARTIFACT_RUN_ID: \${{ inputs.release_run_id }}
+      EBK_SOURCE_COMMIT: \${{ inputs.candidate }}
+      EBK_STAGE: \${{ inputs.stage }}
+      NX_DAEMON: 'false'
+    steps:
+      - name: Validate exact protected aggregate request
+        env:
+          EBK_PROTECTED_REF: \${{ github.ref }}
+          EBK_WORKFLOW_COMMIT: \${{ github.sha }}
+        run: |
+          set -euo pipefail
+          case "$EBK_STAGE:$EBK_PROTECTED_REF" in
+            staging:refs/heads/develop|production:refs/heads/main) ;;
+            *) echo 'Aggregate stage does not match its protected branch'; exit 1 ;;
+          esac
+          case "$EBK_PROJECT" in
+            ''|-*|*-|*--*|*[!a-z0-9-]*) echo 'Project must be one normalized Product Slice name'; exit 1 ;;
+          esac
+          case "$EBK_SOURCE_COMMIT" in *[!0-9a-f]*|'') exit 1 ;; esac
+          case "\${#EBK_SOURCE_COMMIT}" in 40|64) ;; *) exit 1 ;; esac
+          test "$EBK_SOURCE_COMMIT" = "$EBK_WORKFLOW_COMMIT" ||
+            { echo 'Candidate must equal the current protected-ref commit'; exit 1; }
+          case "$EBK_RELEASE_ARTIFACT_RUN_ID" in 0|*[!0-9]*|'') exit 1 ;; esac
+          test "\${#EBK_RELEASE_ARTIFACT_RUN_ID}" -le 20 || exit 1
+          for instant in \
+            "$EBK_AGGREGATE_PERIOD_START" \
+            "$EBK_AGGREGATE_PERIOD_END"; do
+            case "$instant" in
+              [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T00:00:00.000Z) ;;
+              *) echo 'Aggregate period boundaries must use UTC-midnight instants'; exit 1 ;;
+            esac
+          done
+          case "$AWS_EXPECTED_ACCOUNT_ID" in
+            [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]) ;;
+            *) echo 'Aggregate environment account is invalid'; exit 1 ;;
+          esac
+          case "$AWS_REGION" in
+            ''|*[!a-z0-9-]*|*-|*--) echo 'Aggregate environment Region is invalid'; exit 1 ;;
+            *) ;;
+          esac
+          test -n "$AWS_PERFORMANCE_AGGREGATE_ROLE_ARN" ||
+            { echo 'Protected aggregate-read role is absent'; exit 1; }
+          case "$AWS_REGION" in
+            cn-*) aws_partition=aws-cn ;;
+            us-gov-*) aws_partition=aws-us-gov ;;
+            us-isob-*) aws_partition=aws-iso-b ;;
+            us-isoe-*) aws_partition=aws-iso-e ;;
+            us-isof-*) aws_partition=aws-iso-f ;;
+            us-iso-*) aws_partition=aws-iso ;;
+            eusc-*) aws_partition=aws-eusc ;;
+            *) aws_partition=aws ;;
+          esac
+          case "$AWS_PERFORMANCE_AGGREGATE_ROLE_ARN" in
+            arn:$aws_partition:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
+            *) echo 'Aggregate-read role belongs to another account'; exit 1 ;;
+          esac
+      - id: source_authority
+        name: Reconcile current protected Deploy run and artifact
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          node -e '
+            const { execFileSync } = require("node:child_process");
+            const { appendFileSync } = require("node:fs");
+            const source = Buffer.from(
+              "${sourceAuthority}",
+              "base64",
+            ).toString("utf8");
+            const validateProtectedAggregateCountSourceAuthority =
+              Function("return (" + source + ");")();
+            const api = (route) => JSON.parse(execFileSync(
+              "gh",
+              ["api", route],
+              { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 },
+            ));
+            const repository = process.env.GITHUB_REPOSITORY;
+            const runId = process.env.EBK_RELEASE_ARTIFACT_RUN_ID;
+            const run = api(
+              "/repos/" + repository + "/actions/runs/" + runId,
+            );
+            const artifacts = api(
+              "/repos/" + repository +
+                "/actions/runs/" + runId + "/artifacts?per_page=100",
+            );
+            const result =
+              validateProtectedAggregateCountSourceAuthority({
+                artifacts: artifacts.artifacts ?? [],
+                artifactTotal: artifacts.total_count,
+                candidate: process.env.EBK_SOURCE_COMMIT,
+                project: process.env.EBK_PROJECT,
+                repository,
+                run,
+                runId,
+                stage: process.env.EBK_STAGE,
+              });
+            appendFileSync(
+              process.env.GITHUB_OUTPUT,
+              "artifact_name=" + result.artifactName + "\\n" +
+                "run_attempt=" + result.runAttempt + "\\n",
+            );
+          '
+      - uses: ${checkout}
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+          ref: \${{ inputs.candidate }}
+      - uses: ${pnpmSetup}
+      - uses: ${setupNode}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        run: pnpm nx run "$(node -p 'require("./package.json").name'):workspace-health"
+      - name: Download exact active protected release
+        uses: ${downloadArtifact}
+        with:
+          github-token: \${{ github.token }}
+          name: \${{ steps.source_authority.outputs.artifact_name }}
+          path: packages/\${{ inputs.project }}/.ebk/performance-aggregate-input/release-artifact
+          run-id: \${{ inputs.release_run_id }}
+      - name: Validate aggregate authority before AWS
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_RELEASE_RUN_ATTEMPT: \${{ steps.source_authority.outputs.run_attempt }}
+        run: >-
+          node --experimental-strip-types
+          "packages/$EBK_PROJECT/scripts/performance-aggregate-counts.mjs"
+          --validate-authority
+      - uses: ${configureAws}
+        with:
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-performance-aggregate-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ secrets.AWS_PERFORMANCE_AGGREGATE_ROLE_ARN }}
+      - name: Withhold OIDC request bearer from aggregate execution
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          {
+            echo 'ACTIONS_ID_TOKEN_REQUEST_URL='
+            echo 'ACTIONS_ID_TOKEN_REQUEST_TOKEN='
+          } >> "$GITHUB_ENV"
+      - name: Verify exact aggregate-read account and Region
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          actual_account="$(aws sts get-caller-identity --query Account --output text)"
+          test "$actual_account" = "$AWS_EXPECTED_ACCOUNT_ID" ||
+            { echo 'Aggregate-read account differs from its protected environment'; exit 1; }
+          test "$AWS_REGION" = "$EBK_APPROVED_REGION" ||
+            { echo 'Aggregate-read Region differs from its protected environment'; exit 1; }
+          printf 'EBK_AGGREGATE_ACTUAL_ACCOUNT_ID=%s\\n' "$actual_account" >> "$GITHUB_ENV"
+      - name: Produce canonical aggregate-count evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_RELEASE_RUN_ATTEMPT: \${{ steps.source_authority.outputs.run_attempt }}
+        run: pnpm nx run "$EBK_PROJECT:${exports.PROTECTED_AGGREGATE_COUNT_TARGET}"
+      - name: Clear current aggregate-read AWS session credentials
+        if: always()
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          {
+            echo 'AWS_ACCESS_KEY_ID='
+            echo 'AWS_SECRET_ACCESS_KEY='
+            echo 'AWS_SESSION_TOKEN='
+            echo 'AWS_SECURITY_TOKEN='
+          } >> "$GITHUB_ENV"
+      - name: Verify one bounded aggregate-count artifact
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          evidence_root="packages/$EBK_PROJECT/.ebk/evidence"
+          evidence="$evidence_root/aggregate-count-evidence.json"
+          test "$(find "$evidence_root" -mindepth 1 -maxdepth 1 -type f | wc -l | tr -d ' ')" = 1
+          test "$(find "$evidence_root" -mindepth 1 -maxdepth 1 ! -type f | wc -l | tr -d ' ')" = 0
+          test -f "$evidence" && test ! -L "$evidence"
+          test "$(wc -c < "$evidence" | tr -d ' ')" -le 1048576
+      - name: Retain canonical aggregate-count evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        uses: ${uploadArtifact}
+        with:
+          name: aggregate-count-\${{ inputs.stage }}-\${{ inputs.project }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90
+          path: packages/\${{ inputs.project }}/.ebk/evidence/aggregate-count-evidence.json
+`,
+    };
+}
+/**
+ * Treats caller-supplied run IDs and artifact names only as selectors. The
+ * selected producer runs and artifacts must independently match the fixed
+ * protected workflow contracts before AWS authority is introduced.
+ */
+function validateProtectedPerformanceCostSourceAuthority(input) {
+    const refuse = (detail) => {
+        throw new Error(`Protected cost source authority is invalid: ${detail}.`);
+    };
+    const branch = input.stage === 'staging'
+        ? 'develop'
+        : input.stage === 'production'
+            ? 'main'
+            : refuse('stage is unsupported');
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(input.project)) {
+        refuse('Product Slice identity is not normalized');
+    }
+    if (!/^[a-f0-9]{40}$/.test(input.candidate) ||
+        !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(input.repository)) {
+        refuse('repository or candidate identity is malformed');
+    }
+    const validateRun = (run, expected, label) => {
+        if (!/^[1-9]\d{0,19}$/.test(expected.id) ||
+            String(run.id ?? '') !== expected.id ||
+            run.name !== expected.name ||
+            run.path !== expected.path ||
+            run.status !== 'completed' ||
+            run.conclusion !== 'success' ||
+            !expected.events.includes(run.event ?? '') ||
+            run.head_branch !== branch ||
+            run.head_repository?.full_name !== input.repository ||
+            run.head_sha !== input.candidate ||
+            !/^[1-9]\d*$/.test(String(run.run_attempt ?? ''))) {
+            refuse(`${label} run does not match its fixed protected producer`);
+        }
+    };
+    validateRun(input.aggregateRun, {
+        events: ['workflow_dispatch'],
+        id: input.aggregateRunId,
+        name: 'Protected aggregate counts',
+        path: '.github/workflows/performance-aggregate-counts.yml',
+    }, 'aggregate-count');
+    validateRun(input.releaseRun, {
+        events: ['push', 'workflow_dispatch'],
+        id: input.releaseRunId,
+        name: 'Deploy',
+        path: '.github/workflows/deploy.yml',
+    }, 'release');
+    const expectedAggregateName = [
+        'aggregate-count',
+        input.stage,
+        input.project,
+        String(input.aggregateRun.id),
+        String(input.aggregateRun.run_attempt),
+    ].join('-');
+    const expectedReleaseName = [
+        'release-evidence',
+        input.stage,
+        String(input.releaseRun.id),
+        String(input.releaseRun.run_attempt),
+    ].join('-');
+    const validateArtifact = (artifacts, total, selected, expected, label) => {
+        if (!Number.isSafeInteger(total) ||
+            total < 1 ||
+            total > 100 ||
+            artifacts.length !== total ||
+            selected !== expected ||
+            artifacts.filter(({ expired, name }) => expired === false && name === expected).length !== 1) {
+            refuse(`${label} artifact is absent, expired, or ambiguous`);
+        }
+    };
+    validateArtifact(input.aggregateArtifacts, input.aggregateArtifactTotal, input.aggregateArtifactName, expectedAggregateName, 'aggregate-count');
+    validateArtifact(input.releaseArtifacts, input.releaseArtifactTotal, input.releaseArtifactName, expectedReleaseName, 'release');
+}
+function renderProtectedPerformanceCostWorkflow() {
+    const checkout = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.checkout);
+    const configureAws = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.configureAwsCredentials);
+    const downloadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.downloadArtifact);
+    const pnpmSetup = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.pnpmSetup);
+    const setupNode = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.setupNode);
+    const uploadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.uploadArtifact);
+    const sourceAuthority = Buffer.from(validateProtectedPerformanceCostSourceAuthority.toString(), 'utf8').toString('base64');
+    return {
+        [exports.PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH]: `name: Protected performance cost actuals
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Exact protected billing cohort stage
+        required: true
+        type: choice
+        options: [staging, production]
+      project:
+        description: Exact Product Slice project
+        required: true
+        type: string
+      candidate:
+        description: Exact protected-ref Git object ID
+        required: true
+        type: string
+      aggregate_run_id:
+        description: Exact fixed protected aggregate-count workflow run
+        required: true
+        type: string
+      aggregate_artifact:
+        description: Exact convention-named aggregate-count artifact
+        required: true
+        type: string
+      aggregate_evidence_digest:
+        description: Independently approved SHA-256 of aggregate-count evidence
+        required: true
+        type: string
+      period_start:
+        description: Independently approved closed billing period start as YYYY-MM-DD
+        required: true
+        type: string
+      period_end:
+        description: Independently approved closed billing period end as YYYY-MM-DD
+        required: true
+        type: string
+      release_run_id:
+        description: Exact generated Deploy workflow run
+        required: true
+        type: string
+      release_artifact:
+        description: Exact convention-named release-evidence artifact
+        required: true
+        type: string
+      release_binding_digest:
+        description: Independently approved SHA-256 of the release binding
+        required: true
+        type: string
+      target_account_fingerprint:
+        description: Exact SHA-256 fingerprint of the approved AWS account
+        required: true
+        type: string
+      target_region:
+        description: Exact approved resource Region
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: protected-performance-cost-\${{ inputs.stage }}-\${{ inputs.project }}
+  cancel-in-progress: false
+
+jobs:
+  collect:
+    environment: performance-cost-\${{ inputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PERFORMANCE_COST_ROLE_ARN: \${{ secrets.AWS_PERFORMANCE_COST_ROLE_ARN }}
+      AWS_REGION: \${{ inputs.target_region }}
+      EBK_APPROVED_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACCOUNT_FINGERPRINT: \${{ inputs.target_account_fingerprint }}
+      EBK_AGGREGATE_ARTIFACT_NAME: \${{ inputs.aggregate_artifact }}
+      EBK_AGGREGATE_ARTIFACT_RUN_ID: \${{ inputs.aggregate_run_id }}
+      EBK_AGGREGATE_COUNT_EVIDENCE_PATH: .ebk/performance-cost-input/aggregate/aggregate-count-evidence.json
+      EBK_EXPECTED_AGGREGATE_COUNT_EVIDENCE_DIGEST: \${{ inputs.aggregate_evidence_digest }}
+      EBK_EXPECTED_BILLING_PERIOD_END: \${{ inputs.period_end }}T00:00:00.000Z
+      EBK_EXPECTED_BILLING_PERIOD_START: \${{ inputs.period_start }}T00:00:00.000Z
+      EBK_EXPECTED_RELEASE_BINDING_DIGEST: \${{ inputs.release_binding_digest }}
+      EBK_PROJECT: \${{ inputs.project }}
+      EBK_RELEASE_ARTIFACT_NAME: \${{ inputs.release_artifact }}
+      EBK_RELEASE_ARTIFACT_RUN_ID: \${{ inputs.release_run_id }}
+      EBK_RELEASE_BINDING_PATH: .ebk/performance-cost-input/release/release-binding.json
+      EBK_SOURCE_COMMIT: \${{ inputs.candidate }}
+      EBK_STAGE: \${{ inputs.stage }}
+      NX_DAEMON: 'false'
+    steps:
+      - name: Validate exact protected collection request
+        env:
+          EBK_PROTECTED_REF: \${{ github.ref }}
+          EBK_WORKFLOW_COMMIT: \${{ github.sha }}
+        run: |
+          set -euo pipefail
+          case "$EBK_STAGE:$EBK_PROTECTED_REF" in
+            staging:refs/heads/develop|production:refs/heads/main) ;;
+            *) echo 'Cost collection stage does not match its protected branch'; exit 1 ;;
+          esac
+          case "$EBK_PROJECT" in
+            ''|-*|*-|*--*|*[!a-z0-9-]*) echo 'Project must be one normalized Product Slice name'; exit 1 ;;
+          esac
+          case "$EBK_SOURCE_COMMIT" in
+            *[!0-9a-f]*|'') echo 'Candidate must be lowercase hexadecimal'; exit 1 ;;
+          esac
+          case "\${#EBK_SOURCE_COMMIT}" in 40|64) ;; *) exit 1 ;; esac
+          test "$EBK_SOURCE_COMMIT" = "$EBK_WORKFLOW_COMMIT" ||
+            { echo 'Candidate must equal the exact workflow ref commit'; exit 1; }
+          for digest in \
+            "$EBK_EXPECTED_AGGREGATE_COUNT_EVIDENCE_DIGEST" \
+            "$EBK_EXPECTED_RELEASE_BINDING_DIGEST"; do
+            case "$digest" in *[!0-9a-f]*|'') exit 1 ;; esac
+            test "\${#digest}" -eq 64 || exit 1
+          done
+          for instant in \
+            "$EBK_EXPECTED_BILLING_PERIOD_START" \
+            "$EBK_EXPECTED_BILLING_PERIOD_END"; do
+            case "$instant" in
+              [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T00:00:00.000Z) ;;
+              *) echo 'Billing period boundaries must use UTC-midnight instants'; exit 1 ;;
+            esac
+          done
+          for run_id in \
+            "$EBK_AGGREGATE_ARTIFACT_RUN_ID" \
+            "$EBK_RELEASE_ARTIFACT_RUN_ID"; do
+            case "$run_id" in 0|*[!0-9]*|'') exit 1 ;; esac
+            test "\${#run_id}" -le 20 || exit 1
+          done
+          for artifact in \
+            "$EBK_AGGREGATE_ARTIFACT_NAME" \
+            "$EBK_RELEASE_ARTIFACT_NAME"; do
+            case "$artifact" in
+              [A-Za-z0-9]*)
+                case "$artifact" in *[!A-Za-z0-9._-]* ) exit 1 ;; esac ;;
+              *) exit 1 ;;
+            esac
+            test "\${#artifact}" -le 128 || exit 1
+          done
+          test -n "$AWS_EXPECTED_ACCOUNT_ID" &&
+            test -n "$AWS_PERFORMANCE_COST_ROLE_ARN" ||
+            { echo 'Protected cost environment is incomplete'; exit 1; }
+          case "$AWS_REGION" in
+            cn-*) aws_partition=aws-cn ;;
+            us-gov-*) aws_partition=aws-us-gov ;;
+            us-isob-*) aws_partition=aws-iso-b ;;
+            us-isoe-*) aws_partition=aws-iso-e ;;
+            us-isof-*) aws_partition=aws-iso-f ;;
+            us-iso-*) aws_partition=aws-iso ;;
+            eusc-*) aws_partition=aws-eusc ;;
+            *) aws_partition=aws ;;
+          esac
+          case "$AWS_PERFORMANCE_COST_ROLE_ARN" in
+            arn:$aws_partition:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
+            *) echo 'Cost collection role belongs to another account'; exit 1 ;;
+          esac
+      - id: source_authority
+        name: Reconcile protected source runs and artifacts
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          node -e '
+            const { execFileSync } = require("node:child_process");
+            const { appendFileSync } = require("node:fs");
+            const source = Buffer.from(
+              "${sourceAuthority}",
+              "base64",
+            ).toString("utf8");
+            const validateProtectedPerformanceCostSourceAuthority =
+              Function("return (" + source + ");")();
+            const api = (route) => JSON.parse(execFileSync(
+              "gh",
+              ["api", route],
+              { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 },
+            ));
+            const repository = process.env.GITHUB_REPOSITORY;
+            const run = (id) => api(
+              "/repos/" + repository + "/actions/runs/" + id,
+            );
+            const artifacts = (id) => api(
+              "/repos/" + repository +
+                "/actions/runs/" + id + "/artifacts?per_page=100",
+            );
+            const aggregateRun = run(
+              process.env.EBK_AGGREGATE_ARTIFACT_RUN_ID,
+            );
+            const releaseRun = run(
+              process.env.EBK_RELEASE_ARTIFACT_RUN_ID,
+            );
+            const aggregateArtifacts = artifacts(
+              process.env.EBK_AGGREGATE_ARTIFACT_RUN_ID,
+            );
+            const releaseArtifacts = artifacts(
+              process.env.EBK_RELEASE_ARTIFACT_RUN_ID,
+            );
+            validateProtectedPerformanceCostSourceAuthority({
+              aggregateArtifactName:
+                process.env.EBK_AGGREGATE_ARTIFACT_NAME,
+              aggregateArtifactTotal: aggregateArtifacts.total_count,
+              aggregateArtifacts: aggregateArtifacts.artifacts ?? [],
+              aggregateRun,
+              aggregateRunId:
+                process.env.EBK_AGGREGATE_ARTIFACT_RUN_ID,
+              candidate: process.env.EBK_SOURCE_COMMIT,
+              project: process.env.EBK_PROJECT,
+              releaseArtifactName:
+                process.env.EBK_RELEASE_ARTIFACT_NAME,
+              releaseArtifactTotal: releaseArtifacts.total_count,
+              releaseArtifacts: releaseArtifacts.artifacts ?? [],
+              releaseRun,
+              releaseRunId:
+                process.env.EBK_RELEASE_ARTIFACT_RUN_ID,
+              repository,
+              stage: process.env.EBK_STAGE,
+            });
+            appendFileSync(
+              process.env.GITHUB_OUTPUT,
+              "release_run_attempt=" +
+                String(releaseRun.run_attempt) +
+                "\\n",
+            );
+          '
+      - uses: ${checkout}
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+          ref: \${{ inputs.candidate }}
+      - uses: ${pnpmSetup}
+      - uses: ${setupNode}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        run: pnpm nx run "$(node -p 'require("./package.json").name'):workspace-health"
+      - name: Download independently produced aggregate counts
+        uses: ${downloadArtifact}
+        with:
+          github-token: \${{ github.token }}
+          name: \${{ inputs.aggregate_artifact }}
+          path: .ebk/performance-cost-input/aggregate
+          run-id: \${{ inputs.aggregate_run_id }}
+      - name: Download exact deployed-release binding
+        uses: ${downloadArtifact}
+        with:
+          github-token: \${{ github.token }}
+          name: \${{ inputs.release_artifact }}
+          path: .ebk/performance-cost-input/release-artifact
+          run-id: \${{ inputs.release_run_id }}
+      - name: Derive exact performance release binding
+        env:
+          EBK_RELEASE_RUN_ATTEMPT: \${{ steps.source_authority.outputs.release_run_attempt }}
+        run: |
+          node -e '
+            const {
+              lstatSync,
+              mkdirSync,
+              readFileSync,
+              readdirSync,
+              writeFileSync,
+            } = require("node:fs");
+            const { join, relative, resolve } = require("node:path");
+            const root = resolve(
+              ".ebk/performance-cost-input/release-artifact",
+            );
+            const files = [];
+            const visit = (directory) => {
+              if (files.length > 4096) {
+                throw new Error("Release artifact is too large.");
+              }
+              for (const name of readdirSync(directory).sort()) {
+                const path = join(directory, name);
+                const metadata = lstatSync(path);
+                if (metadata.isSymbolicLink()) {
+                  throw new Error("Release artifact contains a symlink.");
+                }
+                if (metadata.isDirectory()) visit(path);
+                else if (metadata.isFile()) files.push(path);
+                else {
+                  throw new Error("Release artifact contains a special file.");
+                }
+              }
+            };
+            visit(root);
+            const suffix =
+              "/" +
+              process.env.EBK_PROJECT +
+              "/.ebk/evidence/active-protected-release.json";
+            const matches = files.filter((path) =>
+              ("/" + relative(root, path).replaceAll("\\\\", "/"))
+                .endsWith(suffix),
+            );
+            if (matches.length !== 1) {
+              throw new Error(
+                "Release artifact lacks one exact Slice deployment binding.",
+              );
+            }
+            const metadata = lstatSync(matches[0]);
+            if (
+              metadata.size < 2 ||
+              metadata.size > 1024 * 1024
+            ) {
+              throw new Error("Release binding is outside its size bound.");
+            }
+            const source = JSON.parse(readFileSync(matches[0], "utf8"));
+            const expectedKeys = [
+              "candidateDigest",
+              "deploymentCommit",
+              "kind",
+              "manifestDigest",
+              "releaseId",
+              "releaseMaterialDigest",
+              "releaseSourceCommit",
+              "runAttempt",
+              "runId",
+              "schemaVersion",
+              "stage",
+              "workflow",
+            ].sort().join(",");
+            if (
+              Object.keys(source).sort().join(",") !== expectedKeys ||
+              source.kind !== "ebk-active-protected-release-binding" ||
+              source.schemaVersion !== 1 ||
+              source.stage !== process.env.EBK_STAGE ||
+              source.workflow !== "Deploy" ||
+              String(source.runId) !==
+                process.env.EBK_RELEASE_ARTIFACT_RUN_ID ||
+              String(source.runAttempt) !==
+                process.env.EBK_RELEASE_RUN_ATTEMPT ||
+              source.deploymentCommit !== process.env.EBK_SOURCE_COMMIT ||
+              !/^[a-f0-9]{64}$/.test(source.candidateDigest ?? "") ||
+              !/^[a-f0-9]{64}$/.test(
+                source.releaseMaterialDigest ?? "",
+              ) ||
+              !/^[A-Za-z0-9.][A-Za-z0-9._:/#@+\\-]{0,511}$/.test(
+                source.releaseId ?? "",
+              )
+            ) {
+              throw new Error(
+                "Release binding does not match its protected Deploy run.",
+              );
+            }
+            const binding = {
+              candidateDigest: source.candidateDigest,
+              releaseId: source.releaseId,
+              releaseMaterialDigest: source.releaseMaterialDigest,
+              sourceCommit: source.deploymentCommit,
+            };
+            const destinationRoot = resolve(
+              ".ebk/performance-cost-input/release",
+            );
+            mkdirSync(destinationRoot, {
+              mode: 0o700,
+              recursive: true,
+            });
+            writeFileSync(
+              join(destinationRoot, "release-binding.json"),
+              JSON.stringify(binding, null, 2) + "\\n",
+              { encoding: "utf8", flag: "wx", mode: 0o600 },
+            );
+          '
+      - name: Verify independently approved input bytes
+        run: |
+          set -euo pipefail
+          for root in \
+            .ebk/performance-cost-input/aggregate \
+            .ebk/performance-cost-input/release; do
+            test "$(find "$root" -mindepth 1 -maxdepth 1 -type f | wc -l | tr -d ' ')" = 1
+            test "$(find "$root" -mindepth 1 -maxdepth 1 ! -type f | wc -l | tr -d ' ')" = 0
+          done
+          node -e '
+            const { createHash } = require("node:crypto");
+            const { lstatSync, readFileSync, realpathSync } = require("node:fs");
+            const { relative, resolve } = require("node:path");
+            for (const [path, root, expected] of [
+              [process.argv[1], process.argv[3], process.argv[5]],
+              [process.argv[2], process.argv[4], process.argv[6]],
+            ]) {
+              const metadata = lstatSync(path);
+              if (
+                !metadata.isFile() ||
+                metadata.isSymbolicLink() ||
+                metadata.size <= 0 ||
+                metadata.size > 1024 * 1024 ||
+                relative(realpathSync(root), realpathSync(path)) !==
+                  relative(resolve(root), resolve(path)) ||
+                createHash("sha256").update(readFileSync(path)).digest("hex") !== expected
+              ) process.exit(1);
+            }
+          ' "$EBK_AGGREGATE_COUNT_EVIDENCE_PATH" "$EBK_RELEASE_BINDING_PATH" \
+            .ebk/performance-cost-input/aggregate \
+            .ebk/performance-cost-input/release \
+            "$EBK_EXPECTED_AGGREGATE_COUNT_EVIDENCE_DIGEST" \
+            "$EBK_EXPECTED_RELEASE_BINDING_DIGEST"
+      - uses: ${configureAws}
+        with:
+          aws-region: \${{ inputs.target_region }}
+          role-session-name: ebk-performance-cost-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ secrets.AWS_PERFORMANCE_COST_ROLE_ARN }}
+      - name: Withhold OIDC request bearer from protected execution
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          {
+            echo 'ACTIONS_ID_TOKEN_REQUEST_URL='
+            echo 'ACTIONS_ID_TOKEN_REQUEST_TOKEN='
+          } >> "$GITHUB_ENV"
+      - name: Verify exact protected account and inputs
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID"
+          test "$AWS_REGION" = "$EBK_APPROVED_REGION"
+      - name: Collect exact closed-window AWS billing actuals
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          export EBK_WORKSPACE="$(node -p 'require("./package.json").name')"
+          pnpm nx run "$EBK_PROJECT:performance-cost-collect"
+      - name: Clear current performance-cost AWS session credentials
+        if: always()
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          {
+            echo 'AWS_ACCESS_KEY_ID='
+            echo 'AWS_SECRET_ACCESS_KEY='
+            echo 'AWS_SESSION_TOKEN='
+            echo 'AWS_SECURITY_TOKEN='
+          } >> "$GITHUB_ENV"
+      - name: Retain protected billing evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        uses: ${uploadArtifact}
+        with:
+          name: performance-cost-\${{ inputs.stage }}-\${{ inputs.project }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90
+          path: packages/\${{ inputs.project }}/.ebk/evidence/performance-cost-actual.json
+`,
+    };
+}
+//# sourceMappingURL=workspace-files-performance-cost.js.map