@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/preset/workspace-files-performance-load.js

@@ -0,0 +1,801 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTECTED_PERFORMANCE_LOAD_CLEANUP_TARGET = exports.PROTECTED_PERFORMANCE_LOAD_RUN_TARGET = exports.PROTECTED_PERFORMANCE_LOAD_WORKFLOW_PATH = void 0;
+exports.resolveProtectedPerformanceOrigin = resolveProtectedPerformanceOrigin;
+exports.deriveProtectedPerformanceEndpoint = deriveProtectedPerformanceEndpoint;
+exports.validateProtectedPerformanceHmacMaterial = validateProtectedPerformanceHmacMaterial;
+exports.materializeProtectedPerformanceHmacKey = materializeProtectedPerformanceHmacKey;
+exports.createProtectedPerformanceLoadSliceTargets = createProtectedPerformanceLoadSliceTargets;
+exports.renderProtectedPerformanceLoadWorkflowPlan = renderProtectedPerformanceLoadWorkflowPlan;
+const node_fs_1 = require("node:fs");
+const index_js_1 = require("../../git-policy/index.js");
+const tool_versions_js_1 = require("./tool-versions.js");
+exports.PROTECTED_PERFORMANCE_LOAD_WORKFLOW_PATH = '.github/workflows/performance-load.yml';
+exports.PROTECTED_PERFORMANCE_LOAD_RUN_TARGET = 'performance-run';
+exports.PROTECTED_PERFORMANCE_LOAD_CLEANUP_TARGET = 'performance-load-cleanup';
+/**
+ * Selects one exact deployed performance Router from the protected
+ * environment's fleet map. The map is environment authority rather than a
+ * workflow-dispatch input so callers cannot substitute a target.
+ */
+function resolveProtectedPerformanceOrigin(originsJson, project) {
+    const refuse = () => {
+        throw new Error('Protected performance origin map is invalid.');
+    };
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(project) ||
+        Buffer.byteLength(originsJson, 'utf8') === 0 ||
+        Buffer.byteLength(originsJson, 'utf8') > 48 * 1024) {
+        return refuse();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(originsJson);
+    }
+    catch {
+        return refuse();
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return refuse();
+    }
+    const entries = Object.entries(parsed);
+    const localHostnames = new Set([
+        '0.0.0.0',
+        '127.0.0.1',
+        '::1',
+        '[::1]',
+        'localhost',
+    ]);
+    if (entries.length === 0 ||
+        entries.some(([slice, value]) => {
+            if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(slice) ||
+                typeof value !== 'string') {
+                return true;
+            }
+            try {
+                const origin = new URL(value);
+                return (origin.protocol !== 'https:' ||
+                    Boolean(origin.username) ||
+                    Boolean(origin.password) ||
+                    origin.pathname !== '/' ||
+                    Boolean(origin.search) ||
+                    Boolean(origin.hash) ||
+                    origin.origin !== value ||
+                    localHostnames.has(origin.hostname.toLowerCase()) ||
+                    origin.hostname.toLowerCase().endsWith('.localhost'));
+            }
+            catch {
+                return true;
+            }
+        })) {
+        return refuse();
+    }
+    const selected = parsed[project];
+    return typeof selected === 'string' ? selected : refuse();
+}
+/**
+ * Resolves the one endpoint a protected performance job may call. This
+ * function is deliberately self-contained because its exact implementation is
+ * embedded in the generated workflow and executed again in focused tests.
+ */
+function deriveProtectedPerformanceEndpoint(input) {
+    const refuse = (detail) => {
+        throw new Error(`Protected performance target authority is invalid: ${detail}.`);
+    };
+    const expectedRef = input.stage === 'staging'
+        ? 'refs/heads/develop'
+        : input.stage === 'production'
+            ? 'refs/heads/main'
+            : undefined;
+    if (!expectedRef || input.protectedRef !== expectedRef) {
+        refuse('stage and protected branch do not match');
+    }
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(input.project)) {
+        refuse('Product Slice identity is not normalized');
+    }
+    if (!/^[0-9]{12}$/.test(input.expectedAccountId) ||
+        input.actualAccountId !== input.expectedAccountId) {
+        refuse('assumed account does not match the environment');
+    }
+    if (!/^sha256:[a-f0-9]{64}$/.test(input.actualAccountFingerprint) ||
+        input.actualAccountFingerprint !== input.targetAccountFingerprint) {
+        refuse('account fingerprint does not match the reviewed target');
+    }
+    const regionPattern = /^(?:(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-(?:gov|iso|isob|isoe|isof))?|eusc-[a-z]{2})-[a-z]+-\d$/;
+    if (!regionPattern.test(input.targetRegion) ||
+        input.targetRegion !== input.approvedRegion) {
+        refuse('Region does not match the environment');
+    }
+    const partition = input.targetRegion.startsWith('cn-')
+        ? 'aws-cn'
+        : input.targetRegion.startsWith('us-gov-')
+            ? 'aws-us-gov'
+            : input.targetRegion.startsWith('us-isob-')
+                ? 'aws-iso-b'
+                : input.targetRegion.startsWith('us-isoe-')
+                    ? 'aws-iso-e'
+                    : input.targetRegion.startsWith('us-isof-')
+                        ? 'aws-iso-f'
+                        : input.targetRegion.startsWith('us-iso-')
+                            ? 'aws-iso'
+                            : input.targetRegion.startsWith('eusc-')
+                                ? 'aws-eusc'
+                                : 'aws';
+    const rolePrefix = `arn:${partition}:iam::${input.expectedAccountId}:role/`;
+    if (!input.roleArn.startsWith(rolePrefix) ||
+        !/^[A-Za-z0-9+=,.@_/-]{1,512}$/.test(input.roleArn.slice(rolePrefix.length))) {
+        refuse('OIDC role does not belong to the environment account');
+    }
+    let origin;
+    try {
+        origin = new URL(input.approvedOrigin);
+    }
+    catch {
+        return refuse('environment origin is malformed');
+    }
+    const localHostnames = new Set([
+        '0.0.0.0',
+        '127.0.0.1',
+        '::1',
+        '[::1]',
+        'localhost',
+    ]);
+    if (origin.protocol !== 'https:' ||
+        origin.username ||
+        origin.password ||
+        origin.pathname !== '/' ||
+        origin.search ||
+        origin.hash ||
+        origin.origin !== input.approvedOrigin ||
+        localHostnames.has(origin.hostname.toLowerCase()) ||
+        origin.hostname.toLowerCase().endsWith('.localhost')) {
+        refuse('environment origin is not one exact deployed HTTPS origin');
+    }
+    if (!input.plan ||
+        typeof input.plan !== 'object' ||
+        Array.isArray(input.plan)) {
+        return refuse('plan is not an object');
+    }
+    const plan = input.plan;
+    const target = plan['target'] &&
+        typeof plan['target'] === 'object' &&
+        !Array.isArray(plan['target'])
+        ? plan['target']
+        : undefined;
+    const scenarioContracts = {
+        'api-peak': {
+            suffix: '/__ebk/performance/api-lambda',
+            workload: 'api-lambda',
+        },
+        'async-burst': {
+            suffix: '/__ebk/performance/async-worker',
+            workload: 'async-worker',
+        },
+        'database-cold-resume': {
+            suffix: '/__ebk/performance/database',
+            workload: 'database',
+        },
+        'service-extension': {
+            suffix: '/__ebk/performance/service',
+            workload: 'service',
+        },
+    };
+    const scenario = typeof plan['scenarioId'] === 'string'
+        ? scenarioContracts[plan['scenarioId']]
+        : undefined;
+    if (plan['slice'] !== input.project ||
+        !scenario ||
+        plan['workload'] !== scenario.workload ||
+        !target ||
+        target['accountFingerprint'] !== input.targetAccountFingerprint ||
+        target['region'] !== input.targetRegion ||
+        target['stage'] !== input.stage ||
+        typeof target['endpoint'] !== 'string') {
+        return refuse('plan does not bind the exact Slice, adapter, and target');
+    }
+    let endpoint;
+    try {
+        endpoint = new URL(target['endpoint']);
+    }
+    catch {
+        return refuse('plan endpoint is malformed');
+    }
+    if (endpoint.protocol !== 'https:' ||
+        endpoint.username ||
+        endpoint.password ||
+        endpoint.search ||
+        endpoint.hash ||
+        endpoint.href !== target['endpoint'] ||
+        endpoint.origin !== input.approvedOrigin ||
+        endpoint.pathname !== `/${input.project}${scenario.suffix}` ||
+        localHostnames.has(endpoint.hostname.toLowerCase()) ||
+        endpoint.hostname.toLowerCase().endsWith('.localhost')) {
+        refuse('plan endpoint differs from the environment-approved Slice endpoint');
+    }
+    return endpoint.href;
+}
+/**
+ * Parses the bounded Secrets Manager value without including supplied bytes in
+ * any diagnostic.
+ */
+function validateProtectedPerformanceHmacMaterial(secretBytes) {
+    const refuse = () => {
+        throw new Error('Protected performance HMAC material is invalid.');
+    };
+    const bytes = typeof secretBytes === 'string'
+        ? Buffer.from(secretBytes, 'utf8')
+        : Buffer.from(secretBytes);
+    if (bytes.length === 0 || bytes.length > 64 * 1024)
+        return refuse();
+    let value;
+    try {
+        value = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        return refuse();
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return refuse();
+    }
+    const material = value;
+    const keys = Object.keys(material).sort();
+    const validKey = (candidate) => {
+        if (!candidate ||
+            typeof candidate !== 'object' ||
+            Array.isArray(candidate)) {
+            return false;
+        }
+        const key = candidate;
+        const secret = typeof key['secret'] === 'string' ? key['secret'] : '';
+        const decoded = /^[A-Za-z0-9_-]{43}$/.test(secret)
+            ? Buffer.from(secret, 'base64url')
+            : Buffer.alloc(0);
+        return (Object.keys(key).sort().join(',') === 'id,secret' &&
+            typeof key['id'] === 'string' &&
+            /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(key['id']) &&
+            decoded.length === 32 &&
+            decoded.toString('base64url') === secret);
+    };
+    if ((keys.join(',') !== 'current' && keys.join(',') !== 'current,previous') ||
+        !validKey(material['current']) ||
+        (material['previous'] !== undefined &&
+            (!validKey(material['previous']) ||
+                material['previous'].id === material['current'].id ||
+                material['previous'].secret === material['current'].secret))) {
+        return refuse();
+    }
+    return Object.freeze({
+        id: material['current'].id,
+        secret: material['current'].secret,
+    });
+}
+/**
+ * Creates one job-scoped key file and refuses every pre-existing path,
+ * including symbolic links. The result never returns secret material.
+ */
+function materializeProtectedPerformanceHmacKey(outputPath, secretBytes, fileSystem = { chmodSync: node_fs_1.chmodSync, lstatSync: node_fs_1.lstatSync, rmSync: node_fs_1.rmSync, writeFileSync: node_fs_1.writeFileSync }) {
+    const { chmodSync: chmod, lstatSync: lstat, rmSync: remove, writeFileSync: write, } = fileSystem;
+    const key = validateProtectedPerformanceHmacMaterial(secretBytes);
+    const bytes = Buffer.from(`${JSON.stringify(key)}\n`, 'utf8');
+    let created = false;
+    try {
+        write(outputPath, bytes, {
+            encoding: 'utf8',
+            flag: 'wx',
+            mode: 0o600,
+        });
+        created = true;
+        chmod(outputPath, 0o600);
+        const metadata = lstat(outputPath);
+        if (!metadata.isFile() ||
+            metadata.isSymbolicLink() ||
+            (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) ||
+            (typeof process.getuid === 'function' &&
+                metadata.uid !== process.getuid()) ||
+            metadata.size !== bytes.length ||
+            metadata.size > 2_048) {
+            throw new Error('unsafe output');
+        }
+    }
+    catch {
+        if (created)
+            remove(outputPath, { force: true });
+        throw new Error('Protected performance HMAC key output must be one new private regular file.');
+    }
+    return Object.freeze({ byteLength: bytes.length, id: key.id });
+}
+function sliceName(value) {
+    const normalized = value.trim();
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(normalized)) {
+        throw new Error('Protected performance target metadata requires one normalized Product Slice name.');
+    }
+    return normalized;
+}
+function createProtectedPerformanceLoadSliceTargets(slice) {
+    const project = sliceName(slice);
+    return {
+        [exports.PROTECTED_PERFORMANCE_LOAD_RUN_TARGET]: {
+            cache: false,
+            executor: 'nx:run-commands',
+            options: {
+                command: 'node scripts/performance-load-runner.mjs',
+                cwd: `packages/${project}`,
+                forwardAllArgs: false,
+            },
+            outputs: [
+                '{projectRoot}/.ebk/evidence/performance-load-authorization.json',
+                '{projectRoot}/.ebk/evidence/performance-load-effects.jsonl',
+                '{projectRoot}/.ebk/evidence/performance-load-report.json',
+            ],
+        },
+        [exports.PROTECTED_PERFORMANCE_LOAD_CLEANUP_TARGET]: {
+            cache: false,
+            executor: 'nx:run-commands',
+            options: {
+                command: 'node scripts/performance-load-cleanup.mjs',
+                cwd: `packages/${project}`,
+                forwardAllArgs: false,
+            },
+            outputs: ['{projectRoot}/.ebk/evidence/performance-load-cleanup.json'],
+        },
+    };
+}
+/**
+ * Renders the only workflow allowed to execute a protected load runner.
+ * The caller merges the returned fixed Slice targets into generated project
+ * metadata; neither target forwards user-supplied commands or arguments.
+ */
+function renderProtectedPerformanceLoadWorkflowPlan(sliceForTargetMetadata) {
+    const checkout = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.checkout);
+    const configureAws = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.configureAwsCredentials);
+    const pnpmSetup = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.pnpmSetup);
+    const setupNode = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.setupNode);
+    const uploadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.uploadArtifact);
+    const endpointAuthoritySource = Buffer.from(deriveProtectedPerformanceEndpoint.toString(), 'utf8').toString('base64');
+    const originAuthoritySource = Buffer.from(resolveProtectedPerformanceOrigin.toString(), 'utf8').toString('base64');
+    const hmacMaterializerSource = Buffer.from(`const validateProtectedPerformanceHmacMaterial = (${validateProtectedPerformanceHmacMaterial.toString()});
+return (${materializeProtectedPerformanceHmacKey.toString()});`, 'utf8').toString('base64');
+    return {
+        files: {
+            [exports.PROTECTED_PERFORMANCE_LOAD_WORKFLOW_PATH]: `name: Protected performance load
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Protected target stage; staging is the normal path
+        required: true
+        default: staging
+        type: choice
+        options: [staging, production]
+      project:
+        description: Exact Product Slice project
+        required: true
+        type: string
+      candidate:
+        description: Exact full candidate Git object ID at the protected ref
+        required: true
+        type: string
+      plan:
+        description: Exact repository-relative protected load plan JSON path
+        required: true
+        type: string
+      approval:
+        description: Exact repository-relative protected approval JSON path
+        required: true
+        type: string
+      target_account_fingerprint:
+        description: Exact SHA-256 fingerprint of the approved AWS account ID
+        required: true
+        type: string
+      target_region:
+        description: Exact approved AWS Region
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: protected-performance-load-\${{ inputs.stage }}-\${{ inputs.project }}-\${{ inputs.target_account_fingerprint }}
+  cancel-in-progress: false
+
+jobs:
+  run:
+    environment: performance-load-\${{ inputs.stage }}
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 50
+    env:
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PERFORMANCE_LOAD_ROLE_ARN: \${{ secrets.AWS_PERFORMANCE_LOAD_ROLE_ARN }}
+      AWS_REGION: \${{ inputs.target_region }}
+      EBK_ACCOUNT_FINGERPRINT: \${{ inputs.target_account_fingerprint }}
+      EBK_APPROVED_REGION: \${{ vars.AWS_REGION }}
+      EBK_PERFORMANCE_ORIGINS_JSON: \${{ vars.EBK_PERFORMANCE_ORIGINS_JSON }}
+      EBK_PERFORMANCE_LOAD_HMAC_KEY_PATH: \${{ runner.temp }}/ebk-performance-load-hmac-\${{ github.run_id }}-\${{ github.run_attempt }}.json
+      EBK_PROJECT: \${{ inputs.project }}
+      EBK_PROTECTED_LOAD_APPROVAL_PATH: \${{ inputs.approval }}
+      EBK_PROTECTED_LOAD_PLAN_PATH: \${{ inputs.plan }}
+      EBK_SOURCE_COMMIT: \${{ inputs.candidate }}
+      EBK_STAGE: \${{ inputs.stage }}
+      NX_DAEMON: 'false'
+    steps:
+      - name: Validate exact protected request
+        env:
+          EBK_PROTECTED_REF: \${{ github.ref }}
+          EBK_WORKFLOW_COMMIT: \${{ github.sha }}
+        run: |
+          set -euo pipefail
+          case "$EBK_STAGE:$EBK_PROTECTED_REF" in
+            staging:refs/heads/develop|production:refs/heads/main) ;;
+            *) echo 'Performance load stage does not match its protected branch'; exit 1 ;;
+          esac
+          case "$EBK_PROJECT" in
+            ''|-*|*-|*--*|*[!a-z0-9-]*) echo 'Project must be one normalized Product Slice name'; exit 1 ;;
+          esac
+          test -n "$EBK_PERFORMANCE_ORIGINS_JSON" ||
+            { echo "$EBK_STAGE EBK_PERFORMANCE_ORIGINS_JSON is required"; exit 1; }
+          performance_origin="$(node -e '
+            try {
+              const source = Buffer.from(
+                "${originAuthoritySource}",
+                "base64",
+              ).toString("utf8");
+              const resolveProtectedPerformanceOrigin = Function(
+                "return (" + source + ");",
+              )();
+              process.stdout.write(resolveProtectedPerformanceOrigin(
+                process.env.EBK_PERFORMANCE_ORIGINS_JSON,
+                process.env.EBK_PROJECT,
+              ));
+            } catch {
+              process.exit(1);
+            }
+          ')" ||
+            { echo 'Protected performance origin map is invalid'; exit 1; }
+          printf 'EBK_APPROVED_ORIGIN=%s\\n' "$performance_origin" >> "$GITHUB_ENV"
+          case "$EBK_SOURCE_COMMIT" in
+            *[!0-9a-f]*|'') echo 'Candidate must be a full lowercase Git object ID'; exit 1 ;;
+          esac
+          case "\${#EBK_SOURCE_COMMIT}" in
+            40|64) ;;
+            *) echo 'Candidate must contain exactly 40 or 64 hexadecimal characters'; exit 1 ;;
+          esac
+          test "$EBK_SOURCE_COMMIT" = "$EBK_WORKFLOW_COMMIT" ||
+            { echo 'Candidate must equal the exact workflow ref commit'; exit 1; }
+          plan_prefix="packages/$EBK_PROJECT/.ebk/performance-load/plans/"
+          approval_prefix="packages/$EBK_PROJECT/.ebk/performance-load/approvals/"
+          plan_name="\${EBK_PROTECTED_LOAD_PLAN_PATH#"$plan_prefix"}"
+          approval_name="\${EBK_PROTECTED_LOAD_APPROVAL_PATH#"$approval_prefix"}"
+          case "$EBK_PROTECTED_LOAD_PLAN_PATH:$plan_name" in
+            "$plan_prefix"[a-z0-9]*.json:[a-z0-9]*.json) ;;
+            *) echo 'Plan must be one exact Product Slice protected-load plan file'; exit 1 ;;
+          esac
+          case "$plan_name" in
+            *[!a-z0-9._-]*|*/*) echo 'Plan filename contains unsupported characters'; exit 1 ;;
+          esac
+          case "$EBK_PROTECTED_LOAD_APPROVAL_PATH:$approval_name" in
+            "$approval_prefix"[a-z0-9]*.json:[a-z0-9]*.json) ;;
+            *) echo 'Approval must be one exact Product Slice protected-load approval file'; exit 1 ;;
+          esac
+          case "$approval_name" in
+            *[!a-z0-9._-]*|*/*) echo 'Approval filename contains unsupported characters'; exit 1 ;;
+          esac
+          case "$AWS_REGION" in
+            [a-z][a-z]-[a-z]*-[0-9]) ;;
+            *) echo 'Target Region is invalid'; exit 1 ;;
+          esac
+          case "$EBK_ACCOUNT_FINGERPRINT" in
+            sha256:*) ;;
+            *) echo 'Target account fingerprint must use sha256'; exit 1 ;;
+          esac
+          fingerprint_digest="\${EBK_ACCOUNT_FINGERPRINT#sha256:}"
+          case "$fingerprint_digest" in
+            *[!0-9a-f]*|'') echo 'Target account fingerprint must be lowercase SHA-256'; exit 1 ;;
+          esac
+          test "\${#fingerprint_digest}" -eq 64 ||
+            { echo 'Target account fingerprint must contain exactly 64 hexadecimal characters'; exit 1; }
+          test -n "$AWS_PERFORMANCE_LOAD_ROLE_ARN" ||
+            { echo "$EBK_STAGE AWS_PERFORMANCE_LOAD_ROLE_ARN is required"; exit 1; }
+          test -n "$AWS_EXPECTED_ACCOUNT_ID" ||
+            { echo "$EBK_STAGE AWS_EXPECTED_ACCOUNT_ID is required"; exit 1; }
+          case "$AWS_REGION" in
+            cn-*) aws_partition=aws-cn ;;
+            us-gov-*) aws_partition=aws-us-gov ;;
+            us-isob-*) aws_partition=aws-iso-b ;;
+            us-isoe-*) aws_partition=aws-iso-e ;;
+            us-isof-*) aws_partition=aws-iso-f ;;
+            us-iso-*) aws_partition=aws-iso ;;
+            eusc-*) aws_partition=aws-eusc ;;
+            *) aws_partition=aws ;;
+          esac
+          case "$AWS_PERFORMANCE_LOAD_ROLE_ARN" in
+            arn:$aws_partition:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
+            *) echo 'Performance load role does not belong to the expected account'; exit 1 ;;
+          esac
+      - uses: ${checkout}
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+          ref: \${{ inputs.candidate }}
+      - uses: ${pnpmSetup}
+      - uses: ${setupNode}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        run: pnpm nx run "$(node -p 'require("./package.json").name'):workspace-health"
+      - uses: ${configureAws}
+        with:
+          aws-region: \${{ inputs.target_region }}
+          role-session-name: ebk-performance-load-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ secrets.AWS_PERFORMANCE_LOAD_ROLE_ARN }}
+      - name: Withhold OIDC request bearer from protected execution
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          {
+            echo 'ACTIONS_ID_TOKEN_REQUEST_URL='
+            echo 'ACTIONS_ID_TOKEN_REQUEST_TOKEN='
+          } >> "$GITHUB_ENV"
+      - name: Verify exact protected target
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          actual_account="$(aws sts get-caller-identity --query Account --output text)"
+          test "$actual_account" = "$AWS_EXPECTED_ACCOUNT_ID" ||
+            { echo 'Assumed account does not equal the environment-approved account'; exit 1; }
+          actual_fingerprint="sha256:$(printf '%s' "$actual_account" | sha256sum | cut -d ' ' -f 1)"
+          test "$actual_fingerprint" = "$EBK_ACCOUNT_FINGERPRINT" ||
+            { echo 'Assumed account fingerprint does not equal the reviewed target'; exit 1; }
+          test "$AWS_REGION" = "$EBK_APPROVED_REGION" ||
+            { echo 'Target Region does not equal the environment-approved Region'; exit 1; }
+          test -f "$EBK_PROTECTED_LOAD_PLAN_PATH" ||
+            { echo 'Exact protected load plan is absent from the candidate'; exit 1; }
+          test -f "$EBK_PROTECTED_LOAD_APPROVAL_PATH" ||
+            { echo 'Exact protected load approval is absent from the candidate'; exit 1; }
+          node -e '
+            const { lstatSync, realpathSync } = require("node:fs");
+            const { relative, resolve, sep } = require("node:path");
+            const repository = realpathSync(process.cwd());
+            for (const [path, root] of [
+              [process.argv[1], process.argv[3]],
+              [process.argv[2], process.argv[4]],
+            ]) {
+              const lexicalRoot = resolve(root);
+              const rootChild = relative(repository, lexicalRoot);
+              if (
+                !rootChild ||
+                rootChild === ".." ||
+                rootChild.startsWith(".." + sep)
+              ) process.exit(1);
+              let cursor = repository;
+              for (const component of rootChild.split(sep).filter(Boolean)) {
+                cursor = resolve(cursor, component);
+                const componentMetadata = lstatSync(cursor);
+                if (
+                  !componentMetadata.isDirectory() ||
+                  componentMetadata.isSymbolicLink()
+                ) process.exit(1);
+              }
+              const metadata = lstatSync(path);
+              const child = relative(lexicalRoot, resolve(path));
+              if (
+                !metadata.isFile() ||
+                metadata.isSymbolicLink() ||
+                metadata.size <= 0 ||
+                metadata.size > 1024 * 1024 ||
+                !/^[a-z0-9][a-z0-9._-]*[.]json$/.test(child) ||
+                child.includes(sep) ||
+                relative(realpathSync(lexicalRoot), realpathSync(path)) !== child
+              ) {
+                process.exit(1);
+              }
+            }
+          ' "$EBK_PROTECTED_LOAD_PLAN_PATH" "$EBK_PROTECTED_LOAD_APPROVAL_PATH" \
+            "packages/$EBK_PROJECT/.ebk/performance-load/plans" \
+            "packages/$EBK_PROJECT/.ebk/performance-load/approvals" ||
+            { echo 'Protected load inputs must be regular files below exact managed directories'; exit 1; }
+          target_endpoint="$(EBK_ACTUAL_ACCOUNT_ID="$actual_account" \
+            EBK_ACTUAL_ACCOUNT_FINGERPRINT="$actual_fingerprint" \
+            node -e '
+            const { readFileSync } = require("node:fs");
+            try {
+              const source = Buffer.from(
+                "${endpointAuthoritySource}",
+                "base64",
+              ).toString("utf8");
+              const deriveProtectedPerformanceEndpoint = Function(
+                "return (" + source + ");",
+              )();
+              const plan = JSON.parse(readFileSync(process.argv[1], "utf8"));
+              process.stdout.write(
+                deriveProtectedPerformanceEndpoint({
+                  actualAccountFingerprint:
+                    process.env.EBK_ACTUAL_ACCOUNT_FINGERPRINT,
+                  actualAccountId: process.env.EBK_ACTUAL_ACCOUNT_ID,
+                  approvedOrigin: process.env.EBK_APPROVED_ORIGIN,
+                  approvedRegion: process.env.EBK_APPROVED_REGION,
+                  expectedAccountId: process.env.AWS_EXPECTED_ACCOUNT_ID,
+                  plan,
+                  project: process.env.EBK_PROJECT,
+                  protectedRef: process.env.GITHUB_REF,
+                  roleArn: process.env.AWS_PERFORMANCE_LOAD_ROLE_ARN,
+                  stage: process.env.EBK_STAGE,
+                  targetAccountFingerprint:
+                    process.env.EBK_ACCOUNT_FINGERPRINT,
+                  targetRegion: process.env.AWS_REGION,
+                }),
+              );
+            } catch {
+              process.exit(1);
+            }
+          ' "$EBK_PROTECTED_LOAD_PLAN_PATH")" ||
+            { echo 'Plan target does not equal its environment-approved Slice endpoint'; exit 1; }
+          printf 'EBK_LOAD_ENDPOINT=%s\\n' "$target_endpoint" >> "$GITHUB_ENV"
+          if [ "$EBK_STAGE" = production ]; then
+            node -e '
+              const approval = JSON.parse(
+                require("node:fs").readFileSync(process.argv[1], "utf8"),
+              );
+              const exception = approval.productionException;
+              if (
+                exception?.humanApproved !== true ||
+                typeof exception.reason !== "string" ||
+                !exception.reason.trim() ||
+                typeof exception.evidenceRef !== "string" ||
+                !exception.evidenceRef.trim()
+              ) process.exit(1);
+            ' "$EBK_PROTECTED_LOAD_APPROVAL_PATH" ||
+              { echo 'Production requires explicit human-reviewed exceptional evidence'; exit 1; }
+          fi
+      - name: Materialize the exact Slice HMAC generation
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          logical_name="$(node -e '
+            const project = process.argv[1];
+            const logicalName =
+              project.split("-")
+                .map((part) => part[0].toUpperCase() + part.slice(1))
+                .join("") + "PerformanceLoadHmacKeys";
+            if (!/^[A-Za-z][A-Za-z0-9]{0,63}$/.test(logicalName)) {
+              process.exit(1);
+            }
+            process.stdout.write(logicalName);
+          ' "$EBK_PROJECT")" ||
+            { echo 'Slice HMAC logical name is invalid'; exit 1; }
+          secret_name="ebk/$EBK_STAGE/$EBK_PROJECT/$logical_name"
+          aws secretsmanager get-secret-value \
+            --secret-id "$secret_name" \
+            --version-stage AWSCURRENT \
+            --query SecretString \
+            --output text |
+            node -e '
+              const {
+                chmodSync,
+                lstatSync,
+                rmSync,
+                writeFileSync,
+              } = require("node:fs");
+              const source = Buffer.from(
+                "${hmacMaterializerSource}",
+                "base64",
+              ).toString("utf8");
+              const materializeProtectedPerformanceHmacKey =
+                Function(source)();
+              const chunks = [];
+              let size = 0;
+              let oversized = false;
+              process.stdin.on("data", (chunk) => {
+                size += chunk.byteLength;
+                if (size > 64 * 1024) {
+                  oversized = true;
+                  chunks.length = 0;
+                } else if (!oversized) {
+                  chunks.push(chunk);
+                }
+              });
+              process.stdin.on("end", () => {
+                if (oversized) process.exit(1);
+                try {
+                  materializeProtectedPerformanceHmacKey(
+                    process.argv[1],
+                    Buffer.concat(chunks),
+                    {
+                      chmodSync,
+                      lstatSync,
+                      rmSync,
+                      writeFileSync,
+                    },
+                  );
+                } catch {
+                  process.exit(1);
+                }
+              });
+            ' "$EBK_PERFORMANCE_LOAD_HMAC_KEY_PATH"
+      - name: Clear current performance-load AWS session credentials
+        if: always()
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          {
+            echo 'AWS_ACCESS_KEY_ID='
+            echo 'AWS_SECRET_ACCESS_KEY='
+            echo 'AWS_SESSION_TOKEN='
+            echo 'AWS_SECURITY_TOKEN='
+          } >> "$GITHUB_ENV"
+      - name: Guard and run the exact allowlisted load target
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          evidence_directory="packages/$EBK_PROJECT/.ebk/evidence"
+          mkdir -p "$evidence_directory"
+          chmod 700 "$evidence_directory"
+          export EBK_EVIDENCE_NOW="$(date -u +%Y-%m-%dT%H:%M:%S.000Z)"
+          export EBK_EMERGENCY_STOP_PATH="$evidence_directory/performance-load-emergency-stop"
+          export EBK_PROTECTED_LOAD_AUTHORIZATION_PATH="$evidence_directory/performance-load-authorization.json"
+          emergency_cleanup() {
+            trap - INT TERM
+            : > "$EBK_EMERGENCY_STOP_PATH"
+            chmod 600 "$EBK_EMERGENCY_STOP_PATH"
+            pnpm nx run "$EBK_PROJECT:${exports.PROTECTED_PERFORMANCE_LOAD_CLEANUP_TARGET}" || true
+            exit 130
+          }
+          trap emergency_cleanup INT TERM
+          node "packages/$EBK_PROJECT/scripts/performance-load-guard.mjs" |
+            tee "$EBK_PROTECTED_LOAD_AUTHORIZATION_PATH"
+          pnpm nx run "$EBK_PROJECT:${exports.PROTECTED_PERFORMANCE_LOAD_RUN_TARGET}"
+      - name: Enforce idempotent protected-load cleanup
+        if: always()
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run "$EBK_PROJECT:${exports.PROTECTED_PERFORMANCE_LOAD_CLEANUP_TARGET}"
+      - name: Remove the job-scoped Slice HMAC material
+        if: always()
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node -e '
+            const { existsSync, lstatSync, rmSync } = require("node:fs");
+            const path = process.argv[1];
+            if (!existsSync(path)) process.exit(0);
+            const metadata = lstatSync(path);
+            if (!metadata.isFile() || metadata.isSymbolicLink()) process.exit(1);
+            rmSync(path);
+          ' "$EBK_PERFORMANCE_LOAD_HMAC_KEY_PATH"
+      - name: Retain protected performance evidence
+        if: always()
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        uses: ${uploadArtifact}
+        with:
+          name: performance-load-\${{ inputs.stage }}-\${{ inputs.project }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 30
+          path: |
+            packages/\${{ inputs.project }}/.ebk/evidence/performance-load-authorization.json
+            packages/\${{ inputs.project }}/.ebk/evidence/performance-load-cleanup.json
+            packages/\${{ inputs.project }}/.ebk/evidence/performance-load-effects.jsonl
+            packages/\${{ inputs.project }}/.ebk/evidence/performance-load-report.json
+`,
+        },
+        requiredSliceTargets: createProtectedPerformanceLoadSliceTargets(sliceForTargetMetadata),
+    };
+}
+//# sourceMappingURL=workspace-files-performance-load.js.map