@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-performance-files.js

@@ -0,0 +1,3293 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRODUCT_PERFORMANCE_SEEDED_PATHS = void 0;
+exports.renderProductPerformanceFiles = renderProductPerformanceFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const index_js_1 = require("../../performance/index.js");
+exports.PRODUCT_PERFORMANCE_SEEDED_PATHS = [
+    'docs/runbooks/performance-capacity-cost.md',
+    'performance/aggregate-count-provider.ts',
+    'performance/cost-allocation.json',
+    'performance/cost-collection.json',
+    'performance/load-scenarios.json',
+    'performance/policy.json',
+];
+/** @internal */
+function renderProductPerformanceFiles(name) {
+    const pascalName = name
+        .split('-')
+        .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
+        .join('');
+    return {
+        'infra/performance-cost-controls.ts': `import {
+  createFoundationAccountCostControlPlan,
+  createPerformanceCostControlPlan,
+  requireExactFoundationAccountCostAuthority,
+} from '@empire-builder-kit/nx/performance';
+import accountCostPolicy from '../../foundation/performance/account-cost-policy.json';
+import performancePolicy from '../performance/policy.json';
+
+function budgetNotifications(
+  notifications: readonly {
+    comparisonOperator: 'GREATER_THAN';
+    notificationType: 'ACTUAL' | 'FORECASTED';
+    threshold: number;
+    thresholdType: 'PERCENTAGE';
+  }[],
+  alertTopicArn: any,
+) {
+  return notifications.map((notification) => ({
+    ...notification,
+    subscriberSnsTopicArns: [alertTopicArn],
+  }));
+}
+
+export function create${pascalName}PerformanceCostControls(input: {
+  accountCostPolicyDigest: any;
+  accountMonthlyMaximumUsd: any;
+  alertTopicArn: any;
+  evaluatedAt?: string;
+  workspace: string;
+}) {
+  const evaluatedAt = input.evaluatedAt ?? new Date().toISOString();
+  const foundationAccountCostControl = createFoundationAccountCostControlPlan({
+    evaluatedAt,
+    policy: accountCostPolicy,
+    region: process.env.AWS_REGION,
+    stage: $app.stage,
+    workspace: input.workspace,
+  });
+  const plan = createPerformanceCostControlPlan({
+    accountBudgetAuthority: foundationAccountCostControl.authority,
+    evaluatedAt,
+    policy: performancePolicy,
+    region: process.env.AWS_REGION,
+    stage: $app.stage,
+    workspace: input.workspace,
+  });
+  if (plan.status === 'disabled-non-protected-stage') {
+    return {
+      accountBudgetAuthority: plan.accountBudgetAuthority,
+      anomalyMonitor: undefined,
+      anomalySubscription: undefined,
+      materialDigest: plan.materialDigest,
+      pilotBudget: undefined,
+      policyDigest: plan.policyDigest,
+    };
+  }
+  const deployedAccountBudgetAuthority = input.accountCostPolicyDigest.apply(
+    (policyDigest: string) =>
+      input.accountMonthlyMaximumUsd.apply((monthlyMaximumUsd: number) =>
+        requireExactFoundationAccountCostAuthority({
+          actual: {
+            kind: 'ebk-foundation-account-cost-authority',
+            monthlyMaximumUsd,
+            policyDigest,
+            stage: $app.stage,
+            workspace: input.workspace,
+          },
+          expected: plan.accountBudgetAuthority,
+        }),
+      ),
+  );
+  const tags = {
+    'ebk:account-cost-policy-digest': deployedAccountBudgetAuthority.apply(
+      (authority: { policyDigest: string }) => authority.policyDigest,
+    ),
+    'ebk:cost-control-material-digest': deployedAccountBudgetAuthority.apply(
+      () => plan.materialDigest,
+    ),
+    'ebk:cost-scope':
+      plan.workspace + '/' + plan.slice + '/' + plan.stage,
+    'ebk:cost-policy-digest': plan.policyDigest,
+    'ebk:cost-route': plan.route.semanticRef,
+    'ebk:owner': plan.owner,
+  };
+  const pilotBudget = plan.pilotBudget
+    ? new aws.budgets.Budget('${pascalName}PilotCostBudget', {
+        budgetType: plan.pilotBudget.budgetType,
+        filterExpression: plan.pilotBudget.filterExpression,
+        limitAmount: plan.pilotBudget.limitAmount,
+        limitUnit: plan.pilotBudget.limitUnit,
+        metrics: 'UnblendedCost',
+        name: plan.pilotBudget.name,
+        notifications: budgetNotifications(
+          plan.pilotBudget.notifications,
+          input.alertTopicArn,
+        ),
+        tags,
+        timeUnit: plan.pilotBudget.timeUnit,
+      })
+    : undefined;
+  const anomalyMonitor = plan.anomaly
+    ? new aws.costexplorer.AnomalyMonitor(
+        '${pascalName}CostAnomalyMonitor',
+        {
+          monitorSpecification: plan.anomaly.monitor.monitorSpecification,
+          monitorType: plan.anomaly.monitor.monitorType,
+          name: plan.anomaly.monitor.name,
+          tags,
+        },
+      )
+    : undefined;
+  const anomalySubscription =
+    plan.anomaly && anomalyMonitor
+      ? new aws.costexplorer.AnomalySubscription(
+          '${pascalName}CostAnomalySubscription',
+          {
+            frequency: plan.anomaly.subscription.frequency,
+            monitorArnLists: [anomalyMonitor.arn],
+            name: plan.anomaly.subscription.name,
+            subscribers: [
+              { address: input.alertTopicArn, type: 'SNS' },
+            ],
+            tags,
+            thresholdExpression:
+              plan.anomaly.subscription.thresholdExpression,
+          },
+          { dependsOn: [anomalyMonitor] },
+        )
+      : undefined;
+  return {
+    accountBudgetAuthority: deployedAccountBudgetAuthority,
+    anomalyMonitor,
+    anomalySubscription,
+    materialDigest: plan.materialDigest,
+    pilotBudget,
+    policyDigest: plan.policyDigest,
+  };
+}
+`,
+        'performance/policy.json': (0, built_in_plan_shared_js_1.json)({
+            $schema: '../../../node_modules/@empire-builder-kit/nx/schemas/performance-policy-v1.json',
+            authority: {
+                journeyAuthorityPath: 'docs/reliability/slo.json',
+                operationsAuthorityPath: 'operations/reliability.json',
+                releaseManifestPath: 'operations/release.json',
+                repositoryPolicyPath: '../../ebk.repository-policy.json',
+            },
+            budgets: [
+                {
+                    comparator: 'maximum',
+                    evidenceProvenance: ['test', 'actual'],
+                    id: 'api-warm-p95',
+                    journeyRef: 'journey:replace-with-api-journey',
+                    metric: 'latency-milliseconds',
+                    percentile: 95,
+                    population: 'warm',
+                    scenarioRef: 'scenario:api-peak',
+                    status: 'example',
+                    threshold: 750,
+                    unit: 'milliseconds',
+                },
+                {
+                    comparator: 'maximum',
+                    evidenceProvenance: ['test', 'actual'],
+                    id: 'async-backlog-p99',
+                    journeyRef: 'journey:replace-with-async-journey',
+                    metric: 'backlog-age-seconds',
+                    percentile: 99,
+                    population: 'all',
+                    scenarioRef: 'scenario:async-burst',
+                    status: 'example',
+                    threshold: 300,
+                    unit: 'seconds',
+                },
+                {
+                    comparator: 'maximum',
+                    evidenceProvenance: ['test', 'actual'],
+                    id: 'database-cold-resume-p95',
+                    journeyRef: 'journey:replace-with-database-journey',
+                    metric: 'cold-resume-milliseconds',
+                    percentile: 95,
+                    population: 'cold',
+                    scenarioRef: 'scenario:database-cold-resume',
+                    status: 'example',
+                    threshold: 15_000,
+                    unit: 'milliseconds',
+                },
+                {
+                    comparator: 'maximum',
+                    evidenceProvenance: ['estimate', 'actual'],
+                    id: 'monthly-cost',
+                    journeyRef: 'journey:replace-with-business-outcome',
+                    metric: 'monthly-cost-usd',
+                    population: 'all',
+                    scenarioRef: 'scenario:normal-month',
+                    status: 'example',
+                    threshold: 1_000,
+                    unit: 'usd',
+                },
+            ],
+            capacity: [
+                {
+                    capacityUnit: 'requests-per-second',
+                    configuredMaximum: null,
+                    downstreamMaximum: null,
+                    failureMode: 'api-throttles-or-overloads-database',
+                    id: 'api-lambda',
+                    kind: 'api-lambda',
+                    protectionRef: 'control:api-lambda-concurrency',
+                    quotaMaximum: null,
+                    saturationSignalRef: 'runtime:nodejs-heap-utilization-percent',
+                    status: 'requires-adopter-value',
+                },
+                {
+                    capacityUnit: 'messages-per-second',
+                    configuredMaximum: null,
+                    downstreamMaximum: null,
+                    failureMode: 'backlog-age-grows-or-provider-throttles',
+                    id: 'async-worker',
+                    kind: 'async-worker',
+                    protectionRef: 'control:async-worker-concurrency',
+                    quotaMaximum: null,
+                    saturationSignalRef: 'database:protected-async-backlog-utilization-percent',
+                    status: 'requires-adopter-value',
+                },
+                {
+                    capacityUnit: 'database-connections',
+                    configuredMaximum: null,
+                    downstreamMaximum: null,
+                    failureMode: 'connection-or-capacity-exhaustion',
+                    id: 'database',
+                    kind: 'database',
+                    protectionRef: 'control:database-connections',
+                    quotaMaximum: null,
+                    saturationSignalRef: 'database:connection-utilization-percent',
+                    status: 'requires-adopter-value',
+                },
+                {
+                    capacityUnit: 'concurrent-requests',
+                    configuredMaximum: null,
+                    downstreamMaximum: null,
+                    failureMode: 'service-saturates-or-overloads-dependency',
+                    id: 'service-extension',
+                    kind: 'service',
+                    protectionRef: 'control:service-extension-concurrency',
+                    quotaMaximum: null,
+                    saturationSignalRef: 'adopter:service-saturation-percent',
+                    status: 'requires-adopter-value',
+                },
+            ],
+            cost: {
+                accountMonthlyMaximumUsd: 1_000,
+                actualNotificationThresholdPercent: 80,
+                anomalyRouteRef: 'alarm:cost-anomaly',
+                anomalyThresholdUsd: 50,
+                forecastNotificationThresholdPercent: 100,
+                notificationRoute: 'foundation-alert-topic',
+                pilotMonthlyMaximumUsd: 250,
+                sharedCostAllocationRef: 'performance/cost-allocation.json',
+                status: 'example',
+                testRunMaximumUsd: 25,
+                unitCostRefs: ['completed-business-journey', 'delivered-async-work'],
+            },
+            evidence: {
+                maximumAgeDays: { actual: 45, estimate: 30, test: 14 },
+                protectedEvidenceRequiresExactRelease: true,
+            },
+            kind: 'ebk-performance-policy',
+            load: {
+                allowedProtectedStages: ['staging'],
+                maximumConcurrency: 100,
+                maximumDurationSeconds: 1_800,
+                maximumEstimatedCostUsd: 25,
+                maximumRatePerSecond: 200,
+                maximumRequests: 100_000,
+                productionExceptionalOnly: true,
+            },
+            owner: 'REPLACE_WITH_OWNER',
+            reviewAt: null,
+            schemaVersion: 1,
+            slice: name,
+            tags: {
+                forbiddenKeys: ['ebk:feature'],
+                requiredKeys: [
+                    'ebk:cost-allocation',
+                    'ebk:cost-scope',
+                    'ebk:framework-version',
+                    'ebk:managed-by',
+                    'ebk:owner',
+                    'ebk:production-profile',
+                    'ebk:repository',
+                    'ebk:slice',
+                    'ebk:stage',
+                    'ebk:workspace',
+                ],
+                unsupportedResourcePolicy: 'report-with-reason-and-allocation',
+            },
+        }),
+        'performance/load-scenarios.json': (0, built_in_plan_shared_js_1.json)({
+            kind: 'ebk-protected-load-scenario-catalog',
+            scenarios: [
+                {
+                    adapterStatus: 'managed',
+                    adapterId: 'ebk-api-lambda-v1',
+                    demandShape: 'normal-to-peak-ramp',
+                    disabledUntilAdopted: true,
+                    estimatedCostUsdPerRequest: 0.00001,
+                    id: 'api-peak',
+                    saturationSignalRef: 'runtime:nodejs-heap-utilization-percent',
+                    workload: 'api-lambda',
+                },
+                {
+                    adapterStatus: 'managed',
+                    adapterId: 'ebk-async-worker-v1',
+                    demandShape: 'bounded-flash-burst-and-recovery',
+                    disabledUntilAdopted: true,
+                    estimatedCostUsdPerRequest: 0.00002,
+                    id: 'async-burst',
+                    saturationSignalRef: 'database:protected-async-backlog-utilization-percent',
+                    workload: 'async-worker',
+                },
+                {
+                    adapterStatus: 'managed',
+                    adapterId: 'ebk-database-v1',
+                    demandShape: 'idle-window-then-first-request',
+                    disabledUntilAdopted: true,
+                    estimatedCostUsdPerRequest: 0.0001,
+                    id: 'database-cold-resume',
+                    saturationSignalRef: 'database:connection-utilization-percent',
+                    workload: 'database',
+                },
+                {
+                    adapterStatus: 'requires-adopter-service-endpoint',
+                    adapterId: 'ebk-service-v1',
+                    demandShape: 'bounded-steady-and-saturation-ramp',
+                    disabledUntilAdopted: true,
+                    estimatedCostUsdPerRequest: 0.00002,
+                    id: 'service-extension',
+                    saturationSignalRef: 'adopter:service-saturation-percent',
+                    workload: 'service',
+                },
+            ],
+            schemaVersion: 1,
+            slice: name,
+        }),
+        'performance/cost-allocation.json': (0, built_in_plan_shared_js_1.json)({
+            allocations: [
+                {
+                    capabilityId: 'completed-business-journey',
+                    driver: 'replace-with-reviewed-resource-allocation',
+                    id: 'completed-business-journey',
+                    status: 'requires-adopter-value',
+                },
+                {
+                    capabilityId: 'delivered-async-work',
+                    driver: 'replace-with-reviewed-resource-allocation',
+                    id: 'delivered-async-work',
+                    status: 'requires-adopter-value',
+                },
+            ],
+            actualCostProvider: 'aws-billing-actual',
+            forecastProviders: ['infrastructure-plan', 'aws-price-estimate'],
+            kind: 'ebk-cost-allocation-contract',
+            provenanceLabels: ['estimate', 'test', 'actual'],
+            resourceTagKey: 'ebk:cost-allocation',
+            schemaVersion: 1,
+            sharedCostsRemainExplicit: true,
+            slice: name,
+            unitCosts: [
+                {
+                    aggregateCountRef: 'operations:completed-business-journey',
+                    anomalyIncreasePercent: 20,
+                    id: 'completed-business-journey',
+                    ownerRouteRef: 'alarm:cost-anomaly',
+                    status: 'requires-adopter-value',
+                    unit: 'completed-business-journey',
+                },
+                {
+                    aggregateCountRef: 'operations:delivered-async-work',
+                    anomalyIncreasePercent: 20,
+                    id: 'delivered-async-work',
+                    ownerRouteRef: 'alarm:cost-anomaly',
+                    status: 'requires-adopter-value',
+                    unit: 'delivered-async-work',
+                },
+            ],
+        }),
+        'performance/cost-collection.json': (0, built_in_plan_shared_js_1.json)((0, index_js_1.createExternalCostCollectionContract)({
+            outputPath: '.ebk/evidence/performance-cost-actual.json',
+            owner: `${name}-product`,
+            slice: name,
+        })),
+        'operations/performance.json': (0, built_in_plan_shared_js_1.json)({
+            authorityHooks: {
+                alarmAndRouting: 'operations/reliability.json',
+                journeyAndSlo: 'docs/reliability/slo.json',
+                release: 'operations/release.json',
+                repositoryProfile: '../../ebk.repository-policy.json',
+            },
+            costCollection: {
+                contract: 'performance/cost-collection.json',
+                liveCollectorOwnerRequired: true,
+                operationsConsoleRequired: false,
+            },
+            costControls: {
+                accountBudgetAuthority: 'packages/foundation/performance/account-cost-policy.json',
+                accountBudgetBinding: 'foundation-discovery-schema-v6-policy-digest-and-amount',
+                accountBudgetInfrastructure: 'packages/foundation/infra/foundation.ts',
+                accountBudgetOwner: 'foundation',
+                accountBudgetStages: ['staging', 'production'],
+                anomalyMonitorScope: 'workspace-slice-stage-composite-tag',
+                anomalySubscriptionFrequency: 'IMMEDIATE',
+                automaticSpendActions: 'forbidden',
+                infrastructure: 'infra/performance-cost-controls.ts',
+                owner: 'performance/policy.json#owner',
+                pilotBudgetOwner: 'product-slice',
+                pilotBudgetStage: 'staging',
+                policy: 'performance/policy.json#cost',
+                route: 'foundation-alert-topic',
+                status: 'blocked-until-cost-policy-adopted',
+            },
+            unitCost: {
+                capabilities: ['completed-business-journey', 'delivered-async-work'],
+                evaluator: 'scripts/performance-unit-cost.mjs',
+                liveBillingAndAggregateEvidenceRequired: true,
+                operationsConsoleRequired: false,
+                status: 'incomplete-until-live-evidence',
+            },
+            evidence: {
+                exactReleaseRequiredForProtectedResults: true,
+                provenanceLabels: ['estimate', 'test', 'actual'],
+                stagingIsNotProduction: true,
+            },
+            liveEvidence: {
+                accountBudgetAndAnomalyRoute: 'required-pre-v1',
+                actualBillingAndTwoUnitCosts: 'required-pre-v1',
+                coldAndWarmLambdaNextPaths: 'required-pre-v1',
+                databaseColdResumeAndIdleCost: 'required-pre-v1',
+                profileTransitionRehearsal: 'required-pre-v1',
+                protectedApiAsyncDatabaseLoad: 'required-pre-v1',
+                serviceRuntimeLoad: 'required-pre-v1-adopter-integration',
+                status: 'incomplete',
+            },
+            load: {
+                allowlistedScenarioAdapters: [
+                    'ebk-api-lambda-v1',
+                    'ebk-async-worker-v1',
+                    'ebk-database-v1',
+                ],
+                localProtectedMutationForbidden: true,
+                productionExceptionalOnly: true,
+                protectedGuard: 'scripts/performance-load-guard.mjs',
+                protectedRunner: '.github/workflows/performance-load.yml',
+                runnerStatus: 'managed-fixed-scenario-v1',
+                serviceAdapterOwner: null,
+                serviceAdapterStatus: 'requires-adopter-service-runtime-endpoint',
+            },
+            metricDimensions: [
+                'Stage',
+                'Slice',
+                'Feature',
+                'Component',
+                'Operation',
+                'Outcome',
+            ],
+            prohibitedMetricDimensions: [
+                'release',
+                'user',
+                'tenant',
+                'request',
+                'work-item',
+                'payload',
+                'raw-error',
+            ],
+            schemaVersion: 1,
+            slice: name,
+            workloads: [
+                'api-lambda',
+                'async-worker',
+                'browser',
+                'database',
+                'job',
+                'service',
+            ],
+        }),
+        'scripts/performance-policy-check.mjs': `import { existsSync, readFileSync } from 'node:fs';
+import {
+  assessPerformancePolicyReadiness,
+  evaluateCapacitySafety,
+  unitCostLiveEvidenceStatus,
+  validatePerformancePolicy,
+  verifyPerformanceOperationalHooks,
+} from '@empire-builder-kit/nx/performance';
+
+const policy = validatePerformancePolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../performance/policy.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+const requireReady = process.argv.includes('--require-ready');
+const readAuthority = (authorityPath) => {
+  const [path] = authorityPath.split('#', 1);
+  const url = new URL('../' + path, import.meta.url);
+  return existsSync(url) ? JSON.parse(readFileSync(url, 'utf8')) : undefined;
+};
+for (const path of Object.values(policy.authority)) {
+  if (!readAuthority(path)) {
+    throw new Error('Performance authority is missing: ' + path);
+  }
+}
+if (requireReady) {
+  await verifyPerformanceOperationalHooks(
+    policy,
+    (kind, authorityPath, semanticRef) => {
+      const authority = readAuthority(authorityPath);
+      if (!authority) return false;
+      if (kind === 'journey') {
+        return (
+          typeof semanticRef === 'string' &&
+          Array.isArray(authority.objectives) &&
+          authority.objectives.some(
+            (objective) => 'journey:' + objective?.journey === semanticRef,
+          )
+        );
+      }
+      if (kind === 'alarm') {
+        return (
+          typeof semanticRef === 'string' &&
+          authority.performanceReferences?.alarms?.includes(semanticRef)
+        );
+      }
+      if (kind === 'capacity-control') {
+        return (
+          typeof semanticRef === 'string' &&
+          authority.performanceReferences?.capacityControls?.includes(
+            semanticRef,
+          )
+        );
+      }
+      if (kind === 'capacity-signal') {
+        return (
+          typeof semanticRef === 'string' &&
+          authority.performanceReferences?.capacitySignals?.includes(
+            semanticRef,
+          )
+        );
+      }
+      return true;
+    },
+  );
+}
+const readiness = assessPerformancePolicyReadiness(policy);
+const capacity = evaluateCapacitySafety(policy.capacity);
+const result = {
+  capacity,
+  readiness,
+  schemaVersion: 1,
+  slice: policy.slice,
+  unitCost: unitCostLiveEvidenceStatus(policy),
+};
+process.stdout.write(JSON.stringify(result) + '\\n');
+if (
+  requireReady &&
+  (!readiness.ready || capacity.status !== 'safe')
+) process.exitCode = 2;
+`,
+        'scripts/performance-budget-check.mjs': `import { chmodSync, mkdirSync, writeFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import {
+  collectManagedPrArtifactBudget,
+} from '@empire-builder-kit/nx/performance';
+
+const result = collectManagedPrArtifactBudget({
+  slice: '${name}',
+  sliceRoot: fileURLToPath(new URL('../', import.meta.url)),
+});
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+mkdirSync(evidenceDirectory, { recursive: true, mode: 0o700 });
+chmodSync(evidenceDirectory, 0o700);
+const evidencePath = new URL(
+  'performance-budget.json',
+  evidenceDirectory,
+);
+writeFileSync(evidencePath, JSON.stringify(result, null, 2) + '\\n', {
+  encoding: 'utf8',
+  mode: 0o600,
+});
+chmodSync(evidencePath, 0o600);
+process.stdout.write(JSON.stringify(result) + '\\n');
+if (result.outcome !== 'passed') process.exitCode = 2;
+`,
+        'scripts/performance-evidence-evaluate.mjs': `import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import {
+  evaluatePerformanceBudgets,
+  validatePerformancePolicy,
+} from '@empire-builder-kit/nx/performance';
+
+const observationsPath = process.env.EBK_PERFORMANCE_OBSERVATIONS_PATH?.trim();
+const releasePath = process.env.EBK_RELEASE_BINDING_PATH?.trim();
+const now = process.env.EBK_EVIDENCE_NOW?.trim();
+if (!observationsPath || !releasePath || !now) {
+  throw new Error(
+    'Adopted performance evidence requires exact observation, release-binding, and evidence-time paths.',
+  );
+}
+const policy = validatePerformancePolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../performance/policy.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+const result = evaluatePerformanceBudgets({
+  expectedRelease: JSON.parse(readFileSync(releasePath, 'utf8')),
+  now,
+  observations: JSON.parse(readFileSync(observationsPath, 'utf8')),
+  policy,
+});
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+mkdirSync(evidenceDirectory, { recursive: true, mode: 0o700 });
+chmodSync(evidenceDirectory, 0o700);
+const evidencePath = new URL(
+  'performance-adopted-budget.json',
+  evidenceDirectory,
+);
+writeFileSync(evidencePath, JSON.stringify(result, null, 2) + '\\n', {
+  encoding: 'utf8',
+  mode: 0o600,
+});
+chmodSync(evidencePath, 0o600);
+process.stdout.write(JSON.stringify(result) + '\\n');
+if (result.outcome !== 'passed') process.exitCode = 2;
+`,
+        'scripts/performance-unit-cost.mjs': `import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import {
+  evaluateUnitCostTrends,
+  validateAwsBillingActualEvidence,
+  validateCostAllocationContract,
+  validatePerformancePolicy,
+} from '@empire-builder-kit/nx/performance';
+
+const baselinePath = process.env.EBK_UNIT_COST_BASELINE_PATH?.trim();
+const baselineBillingPath =
+  process.env.EBK_BASELINE_BILLING_EVIDENCE_PATH?.trim();
+const expectedBaselineBillingDigest =
+  process.env.EBK_EXPECTED_BASELINE_BILLING_EVIDENCE_DIGEST?.trim();
+const baselineReleasePath =
+  process.env.EBK_BASELINE_RELEASE_BINDING_PATH?.trim();
+const billingPath = process.env.EBK_BILLING_OBSERVATION_PATH?.trim();
+const expectedBillingDigest =
+  process.env.EBK_EXPECTED_BILLING_EVIDENCE_DIGEST?.trim();
+const currentPath = process.env.EBK_UNIT_COST_CURRENT_PATH?.trim();
+const releasePath = process.env.EBK_RELEASE_BINDING_PATH?.trim();
+const evaluatedAt = process.env.EBK_EVIDENCE_NOW?.trim();
+if (
+  !baselinePath ||
+  !baselineBillingPath ||
+  !expectedBaselineBillingDigest ||
+  !baselineReleasePath ||
+  !billingPath ||
+  !expectedBillingDigest ||
+  !currentPath ||
+  !releasePath ||
+  !evaluatedAt
+) {
+  throw new Error(
+    'Unit-cost evaluation requires independently expected baseline/current billing digests, exact observations, release bindings, and evidence time.',
+  );
+}
+const allocation = validateCostAllocationContract(
+  JSON.parse(
+    readFileSync(
+      new URL('../performance/cost-allocation.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+  { requireAdopted: true },
+);
+const capabilities = allocation.unitCosts.map(
+  ({ anomalyIncreasePercent, id, ownerRouteRef, unit }) => ({
+    anomalyIncreasePercent,
+    id,
+    ownerRouteRef,
+    unit,
+  }),
+);
+const baselineBilling = validateAwsBillingActualEvidence(
+  JSON.parse(readFileSync(baselineBillingPath, 'utf8')),
+);
+const billing = validateAwsBillingActualEvidence(
+  JSON.parse(readFileSync(billingPath, 'utf8')),
+);
+const policy = validatePerformancePolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../performance/policy.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+const result = evaluateUnitCostTrends({
+  baseline: JSON.parse(readFileSync(baselinePath, 'utf8')),
+  baselineBillingEvidence: baselineBilling,
+  capabilities,
+  current: JSON.parse(readFileSync(currentPath, 'utf8')),
+  currentBillingEvidence: billing,
+  evaluatedAt,
+  expectedBaselineBillingEvidenceDigest: expectedBaselineBillingDigest,
+  expectedBaselineRelease: JSON.parse(
+    readFileSync(baselineReleasePath, 'utf8'),
+  ),
+  expectedCurrentBillingEvidenceDigest: expectedBillingDigest,
+  expectedCurrentRelease: JSON.parse(readFileSync(releasePath, 'utf8')),
+  policy,
+});
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+mkdirSync(evidenceDirectory, { recursive: true, mode: 0o700 });
+chmodSync(evidenceDirectory, 0o700);
+const evidencePath = new URL('performance-unit-cost.json', evidenceDirectory);
+writeFileSync(evidencePath, JSON.stringify(result, null, 2) + '\\n', {
+  encoding: 'utf8',
+  mode: 0o600,
+});
+chmodSync(evidencePath, 0o600);
+process.stdout.write(JSON.stringify(result) + '\\n');
+`,
+        'performance/aggregate-count-provider.ts': `export interface ProtectedAggregateCountRequest {
+  authority: Readonly<{
+    mode: 'dedicated-oidc-read-role';
+    permissionContract: 'adopter-owned-least-privilege-read-v1';
+  }>;
+  capabilities: readonly string[];
+  environment: Readonly<{
+    accountFingerprint: string;
+    region: string;
+    slice: string;
+    stage: 'production' | 'staging';
+    workspace: string;
+  }>;
+  period: Readonly<{ end: string; start: string }>;
+  release: Readonly<{
+    candidateDigest: string;
+    releaseId: string;
+    releaseMaterialDigest: string;
+    sourceCommit: string;
+  }>;
+}
+
+export interface ProtectedAggregateCountResult {
+  counts: readonly Readonly<{
+    aggregateId: string;
+    capabilityId: string;
+    count: number;
+    sourceRef: string;
+  }>[];
+  requestId: string;
+}
+
+export async function collectAggregateCounts(
+  request: ProtectedAggregateCountRequest,
+): Promise<ProtectedAggregateCountResult> {
+  void request;
+  throw new Error(
+    'Adopt performance/aggregate-count-provider.ts before protected aggregate collection.',
+  );
+}
+`,
+        'scripts/performance-aggregate-counts.mjs': `import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  writeFileSync,
+} from 'node:fs';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  awsAccountFingerprint,
+  createAggregateCountEvidence,
+  validateAggregateCountEvidence,
+  validateCostAllocationContract,
+} from '@empire-builder-kit/nx/performance';
+import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-reference';
+import { collectAggregateCounts } from '../performance/aggregate-count-provider.ts';
+
+const sliceRoot = fileURLToPath(new URL('../', import.meta.url));
+const workspaceRoot = resolve(sliceRoot, '../..');
+const required = (name) => {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(name + ' is required.');
+  return value;
+};
+const authorityOnly =
+  process.argv.length === 3 && process.argv[2] === '--validate-authority';
+if (process.argv.length > (authorityOnly ? 3 : 2)) {
+  throw new Error('Aggregate-count wrapper received unsupported arguments.');
+}
+const exactKeys = (value, keys, label) => {
+  if (
+    !value ||
+    typeof value !== 'object' ||
+    Array.isArray(value) ||
+    Object.keys(value).sort().join(',') !== [...keys].sort().join(',')
+  ) {
+    throw new Error(label + ' contains unsupported fields.');
+  }
+  return value;
+};
+const readBoundedJson = (path, label) => {
+  const metadata = lstatSync(path);
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    metadata.size < 2 ||
+    metadata.size > 1024 * 1024
+  ) {
+    throw new Error(label + ' must be one bounded regular file.');
+  }
+  return JSON.parse(readFileSync(path, 'utf8'));
+};
+const releaseArtifactRoot = resolve(
+  sliceRoot,
+  '.ebk/performance-aggregate-input/release-artifact',
+);
+const artifactRootMetadata = lstatSync(releaseArtifactRoot);
+const artifactRootRelative = relative(
+  sliceRoot,
+  realpathSync(releaseArtifactRoot),
+);
+if (
+  !artifactRootMetadata.isDirectory() ||
+  artifactRootMetadata.isSymbolicLink() ||
+  artifactRootRelative === '..' ||
+  artifactRootRelative.startsWith('..' + sep) ||
+  isAbsolute(artifactRootRelative)
+) {
+  throw new Error('Release artifact root is unsafe.');
+}
+const releaseFiles = [];
+let releaseBytes = 0;
+const visit = (directory) => {
+  if (releaseFiles.length > 4096 || releaseBytes > 64 * 1024 * 1024) {
+    throw new Error('Release artifact exceeds its traversal bound.');
+  }
+  for (const name of readdirSync(directory).sort()) {
+    const path = resolve(directory, name);
+    const metadata = lstatSync(path);
+    if (metadata.isSymbolicLink()) {
+      throw new Error('Release artifact contains a symbolic link.');
+    }
+    if (metadata.isDirectory()) visit(path);
+    else if (metadata.isFile()) {
+      releaseBytes += metadata.size;
+      releaseFiles.push(path);
+      if (
+        releaseFiles.length > 4096 ||
+        releaseBytes > 64 * 1024 * 1024
+      ) {
+        throw new Error('Release artifact exceeds its traversal bound.');
+      }
+    } else {
+      throw new Error('Release artifact contains a special file.');
+    }
+  }
+};
+visit(releaseArtifactRoot);
+const bindingSuffix =
+  '/packages/${name}/.ebk/evidence/active-protected-release.json';
+const bindingMatches = releaseFiles.filter((path) =>
+  ('/' + relative(releaseArtifactRoot, path).replaceAll('\\\\', '/')).endsWith(
+    bindingSuffix,
+  ),
+);
+if (bindingMatches.length !== 1) {
+  throw new Error(
+    'Release artifact lacks one exact ${name} active protected release binding.',
+  );
+}
+const source = exactKeys(
+  readBoundedJson(bindingMatches[0], 'Active protected release binding'),
+  [
+    'candidateDigest',
+    'deploymentCommit',
+    'kind',
+    'manifestDigest',
+    'releaseId',
+    'releaseMaterialDigest',
+    'releaseSourceCommit',
+    'runAttempt',
+    'runId',
+    'schemaVersion',
+    'stage',
+    'workflow',
+  ],
+  'Active protected release binding',
+);
+const digestPattern = /^[a-f0-9]{64}$/;
+const commitPattern = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const stage = required('EBK_STAGE');
+const sourceCommit = required('EBK_SOURCE_COMMIT');
+if (
+  source.kind !== 'ebk-active-protected-release-binding' ||
+  source.schemaVersion !== 1 ||
+  source.stage !== stage ||
+  source.workflow !== 'Deploy' ||
+  String(source.runId) !== required('EBK_RELEASE_ARTIFACT_RUN_ID') ||
+  String(source.runAttempt) !== required('EBK_RELEASE_RUN_ATTEMPT') ||
+  source.deploymentCommit !== sourceCommit ||
+  !commitPattern.test(source.deploymentCommit ?? '') ||
+  !digestPattern.test(source.candidateDigest ?? '') ||
+  !digestPattern.test(source.manifestDigest ?? '') ||
+  !digestPattern.test(source.releaseMaterialDigest ?? '') ||
+  !commitPattern.test(source.releaseSourceCommit ?? '') ||
+  !isBoundedSafeReference(source.releaseId, 'performance-evidence')
+) {
+  throw new Error(
+    'Active protected release binding does not match its exact Deploy authority.',
+  );
+}
+const release = {
+  candidateDigest: source.candidateDigest,
+  releaseId: source.releaseId,
+  releaseMaterialDigest: source.releaseMaterialDigest,
+  sourceCommit: source.deploymentCommit,
+};
+const workspaceManifest = readBoundedJson(
+  resolve(workspaceRoot, 'package.json'),
+  'Workspace manifest',
+);
+if (
+  !isBoundedSafeReference(
+    workspaceManifest.name,
+    'performance-evidence',
+  )
+) {
+  throw new Error('Workspace manifest lacks one bounded name.');
+}
+const environment = {
+  accountFingerprint: awsAccountFingerprint(
+    required('AWS_EXPECTED_ACCOUNT_ID'),
+  ),
+  region: required('AWS_REGION'),
+  slice: '${name}',
+  stage,
+  workspace: workspaceManifest.name,
+};
+const period = {
+  end: required('EBK_AGGREGATE_PERIOD_END'),
+  start: required('EBK_AGGREGATE_PERIOD_START'),
+};
+const collectionStartedAt = new Date();
+const instantPattern = /^\\d{4}-\\d{2}-\\d{2}T00:00:00\\.000Z$/;
+const durationDays =
+  (Date.parse(period.end) - Date.parse(period.start)) / 86_400_000;
+if (
+  !instantPattern.test(period.start) ||
+  !instantPattern.test(period.end) ||
+  !Number.isSafeInteger(durationDays) ||
+  durationDays < 1 ||
+  durationDays > 370 ||
+  Date.parse(period.end) > collectionStartedAt.getTime() ||
+  !/^(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-gov|-iso|-isob)?-[a-z]+-\\d$/.test(
+    environment.region,
+  ) ||
+  (stage !== 'staging' && stage !== 'production')
+) {
+  throw new Error(
+    'Aggregate environment and closed billing period are invalid.',
+  );
+}
+const allocation = validateCostAllocationContract(
+  readBoundedJson(
+    resolve(sliceRoot, 'performance/cost-allocation.json'),
+    'Cost allocation authority',
+  ),
+  { requireAdopted: true },
+);
+if (allocation.slice !== '${name}') {
+  throw new Error('Cost allocation authority belongs to another Slice.');
+}
+const capabilities = allocation.allocations
+  .map(({ capabilityId }) => capabilityId)
+  .sort();
+if (authorityOnly) {
+  process.stdout.write(
+    JSON.stringify({
+      kind: 'ebk-protected-aggregate-authority-result',
+      outcome: 'passed',
+      release,
+      schemaVersion: 1,
+    }) + '\\n',
+  );
+  process.exit(0);
+}
+if (
+  required('EBK_AGGREGATE_ACTUAL_ACCOUNT_ID') !==
+  required('AWS_EXPECTED_ACCOUNT_ID')
+) {
+  throw new Error(
+    'Aggregate-count provider lacks a verified protected account binding.',
+  );
+}
+const provider = exactKeys(
+  await collectAggregateCounts({
+    authority: {
+      mode: 'dedicated-oidc-read-role',
+      permissionContract: 'adopter-owned-least-privilege-read-v1',
+    },
+    capabilities,
+    environment,
+    period,
+    release,
+  }),
+  ['counts', 'requestId'],
+  'Aggregate-count provider result',
+);
+if (!Array.isArray(provider.counts)) {
+  throw new Error('Aggregate-count provider counts must be an array.');
+}
+const providerCapabilities = provider.counts
+  .map(({ capabilityId }) => capabilityId)
+  .sort();
+if (JSON.stringify(providerCapabilities) !== JSON.stringify(capabilities)) {
+  throw new Error(
+    'Aggregate-count provider must return the exact adopted capability set.',
+  );
+}
+const evidence = createAggregateCountEvidence({
+  collectedAt: new Date().toISOString(),
+  counts: provider.counts,
+  environment,
+  kind: 'ebk-aggregate-count-evidence',
+  period,
+  producer: {
+    access: {
+      mode: 'dedicated-oidc-read-role',
+      permissionContract: 'adopter-owned-least-privilege-read-v1',
+    },
+    authority: 'adopter-protected-aggregate-v1',
+    requestId: provider.requestId,
+  },
+  release,
+  schemaVersion: 1,
+});
+const evidenceRoot = resolve(sliceRoot, '.ebk/evidence');
+for (const directory of [resolve(sliceRoot, '.ebk'), evidenceRoot]) {
+  if (!existsSync(directory)) mkdirSync(directory, { mode: 0o700 });
+  const metadata = lstatSync(directory);
+  if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+    throw new Error('Aggregate-count evidence directory is unsafe.');
+  }
+  chmodSync(directory, 0o700);
+}
+const evidenceRootRelative = relative(sliceRoot, realpathSync(evidenceRoot));
+if (
+  evidenceRootRelative === '..' ||
+  evidenceRootRelative.startsWith('..' + sep) ||
+  isAbsolute(evidenceRootRelative)
+) {
+  throw new Error('Aggregate-count evidence directory escaped its Slice.');
+}
+const evidencePath = resolve(evidenceRoot, 'aggregate-count-evidence.json');
+const evidenceBytes = Buffer.from(
+  JSON.stringify(evidence, null, 2) + '\\n',
+  'utf8',
+);
+if (evidenceBytes.length > 1024 * 1024) {
+  throw new Error('Aggregate-count evidence exceeds its byte bound.');
+}
+writeFileSync(evidencePath, evidenceBytes, {
+  flag: 'wx',
+  mode: 0o600,
+});
+chmodSync(evidencePath, 0o600);
+const outputMetadata = lstatSync(evidencePath);
+if (
+  !outputMetadata.isFile() ||
+  outputMetadata.isSymbolicLink() ||
+  outputMetadata.size !== evidenceBytes.length ||
+  validateAggregateCountEvidence(
+    JSON.parse(readFileSync(evidencePath, 'utf8')),
+  ).materialDigest !== evidence.materialDigest
+) {
+  throw new Error('Aggregate-count evidence output did not remain canonical.');
+}
+process.stdout.write(
+  JSON.stringify({
+    kind: 'ebk-protected-aggregate-count-result',
+    materialDigest: evidence.materialDigest,
+    outcome: 'passed',
+    schemaVersion: 1,
+  }) + '\\n',
+);
+`,
+        'scripts/performance-cost-collect.mjs': `import {
+  CostExplorerClient,
+  GetCostAndUsageCommand,
+  ListCostAllocationTagsCommand,
+} from '@aws-sdk/client-cost-explorer';
+import {
+  GetCallerIdentityCommand,
+  STSClient,
+} from '@aws-sdk/client-sts';
+import { createHash } from 'node:crypto';
+import {
+  chmodSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs';
+import {
+  collectAwsBillingActualEvidence,
+  validateAggregateCountEvidence,
+  validateCostAllocationContract,
+} from '@empire-builder-kit/nx/performance';
+
+const required = (name) => {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(name + ' is required.');
+  return value;
+};
+const digest = (bytes) =>
+  createHash('sha256').update(bytes).digest('hex');
+const readBoundedJson = (path, expectedDigest, label) => {
+  const metadata = lstatSync(path);
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    metadata.size <= 0 ||
+    metadata.size > 1024 * 1024
+  ) {
+    throw new Error(label + ' must be one bounded regular file.');
+  }
+  const bytes = readFileSync(path);
+  if (!/^[a-f0-9]{64}$/.test(expectedDigest) || digest(bytes) !== expectedDigest) {
+    throw new Error(label + ' does not match its independently expected digest.');
+  }
+  return JSON.parse(bytes.toString('utf8'));
+};
+const aggregate = validateAggregateCountEvidence(
+  readBoundedJson(
+    required('EBK_AGGREGATE_COUNT_EVIDENCE_PATH'),
+    required('EBK_EXPECTED_AGGREGATE_COUNT_EVIDENCE_DIGEST'),
+    'Aggregate-count evidence',
+  ),
+);
+const release = readBoundedJson(
+  required('EBK_RELEASE_BINDING_PATH'),
+  required('EBK_EXPECTED_RELEASE_BINDING_DIGEST'),
+  'Release binding',
+);
+if (JSON.stringify(release) !== JSON.stringify(aggregate.release)) {
+  throw new Error('Aggregate counts and reviewed release binding differ.');
+}
+const environment = aggregate.environment;
+if (
+  environment.slice !== '${name}' ||
+  environment.stage !== required('EBK_STAGE') ||
+  environment.region !== required('AWS_REGION') ||
+  environment.workspace !== required('EBK_WORKSPACE') ||
+  environment.accountFingerprint !== required('EBK_ACCOUNT_FINGERPRINT') ||
+  release.sourceCommit !== required('EBK_SOURCE_COMMIT') ||
+  aggregate.period.start !==
+    required('EBK_EXPECTED_BILLING_PERIOD_START') ||
+  aggregate.period.end !== required('EBK_EXPECTED_BILLING_PERIOD_END')
+) {
+  throw new Error('Cost collection escaped its exact reviewed cohort.');
+}
+const allocation = validateCostAllocationContract(
+  JSON.parse(
+    readFileSync(
+      new URL('../performance/cost-allocation.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+  { requireAdopted: true },
+);
+if (allocation.slice !== '${name}') {
+  throw new Error('Cost allocation authority belongs to another Slice.');
+}
+const allocations = allocation.allocations.map(
+  ({ capabilityId, id }) => ({ allocationId: id, capabilityId }),
+);
+const sts = new STSClient({ region: environment.region });
+const costExplorer = new CostExplorerClient({ region: 'us-east-1' });
+const requiredCostAllocationTags = [
+  'ebk:cost-allocation',
+  'ebk:cost-scope',
+  'ebk:slice',
+  'ebk:stage',
+  'ebk:workspace',
+];
+const costAllocationTagResponse = await costExplorer.send(
+  new ListCostAllocationTagsCommand({
+    MaxResults: 100,
+    Status: 'Active',
+    TagKeys: requiredCostAllocationTags,
+    Type: 'UserDefined',
+  }),
+);
+const activeCostAllocationTags = (costAllocationTagResponse.CostAllocationTags ?? [])
+  .map(({ Status, TagKey, Type }) => ({ Status, TagKey, Type }))
+  .sort((left, right) =>
+    (left.TagKey ?? '') < (right.TagKey ?? '')
+      ? -1
+      : (left.TagKey ?? '') > (right.TagKey ?? '')
+        ? 1
+        : 0,
+  );
+if (
+  costAllocationTagResponse.NextToken ||
+  !costAllocationTagResponse.$metadata.requestId ||
+  JSON.stringify(activeCostAllocationTags) !==
+    JSON.stringify(
+      requiredCostAllocationTags.map((TagKey) => ({
+        Status: 'Active',
+        TagKey,
+        Type: 'UserDefined',
+      })),
+    )
+) {
+  throw new Error(
+    'Required Product cost-allocation tags are not all ACTIVE in AWS.',
+  );
+}
+const client = {
+  async getCallerIdentity() {
+    const response = await sts.send(new GetCallerIdentityCommand({}));
+    if (!response.Account || !response.$metadata.requestId) {
+      throw new Error('AWS STS identity response is incomplete.');
+    }
+    return {
+      accountId: response.Account,
+      requestId: response.$metadata.requestId,
+    };
+  },
+  async getCostAndUsage(request) {
+    const filter = {
+      And: request.filter.tags.map(({ key, value }) => ({
+        Tags: {
+          Key: key,
+          MatchOptions: ['EQUALS'],
+          Values: [value],
+        },
+      })),
+    };
+    const response = await costExplorer.send(
+      new GetCostAndUsageCommand({
+        Filter: filter,
+        Granularity: request.granularity,
+        GroupBy: request.groupBy
+          ? [{ Key: request.groupBy.key, Type: request.groupBy.type }]
+          : undefined,
+        Metrics: [request.metric],
+        TimePeriod: {
+          End: request.timePeriod.end,
+          Start: request.timePeriod.start,
+        },
+      }),
+    );
+    if (response.NextPageToken || !response.$metadata.requestId) {
+      throw new Error('AWS Cost Explorer result exceeded its exact page bound.');
+    }
+    return {
+      requestId: response.$metadata.requestId,
+      results: (response.ResultsByTime ?? []).map((result) => ({
+        end: result.TimePeriod?.End ?? '',
+        estimated: result.Estimated ?? true,
+        groups: (result.Groups ?? []).map((group) => {
+          const key = group.Keys?.[0] ?? '';
+          const prefix = 'ebk:cost-allocation$';
+          const metric = group.Metrics?.UnblendedCost;
+          if (
+            group.Keys?.length !== 1 ||
+            !key.startsWith(prefix) ||
+            !metric?.Amount
+          ) {
+            throw new Error('AWS allocation row is incomplete or unallocated.');
+          }
+          return {
+            allocationId: key.slice(prefix.length),
+            amountUsd: metric.Amount,
+            currency: metric.Unit === 'USD' ? 'USD' : metric.Unit,
+          };
+        }),
+        start: result.TimePeriod?.Start ?? '',
+        total: request.groupBy
+          ? null
+          : {
+              amountUsd: result.Total?.UnblendedCost?.Amount ?? '',
+              currency:
+                result.Total?.UnblendedCost?.Unit === 'USD'
+                  ? 'USD'
+                  : result.Total?.UnblendedCost?.Unit,
+            },
+      })),
+    };
+  },
+};
+const report = await collectAwsBillingActualEvidence({
+  aggregateEvidence: aggregate,
+  allocations,
+  client,
+  collectedAt: new Date().toISOString(),
+  collection: {
+    aggregateArtifact: {
+      name: required('EBK_AGGREGATE_ARTIFACT_NAME'),
+      runId: required('EBK_AGGREGATE_ARTIFACT_RUN_ID'),
+      sha256: required('EBK_EXPECTED_AGGREGATE_COUNT_EVIDENCE_DIGEST'),
+    },
+    releaseArtifact: {
+      name: required('EBK_RELEASE_ARTIFACT_NAME'),
+      runId: required('EBK_RELEASE_ARTIFACT_RUN_ID'),
+      sha256: required('EBK_EXPECTED_RELEASE_BINDING_DIGEST'),
+    },
+    repository: required('GITHUB_REPOSITORY'),
+    runAttempt: required('GITHUB_RUN_ATTEMPT'),
+    runId: required('GITHUB_RUN_ID'),
+    sourceCommit: release.sourceCommit,
+    workflow: '.github/workflows/performance-cost-actual.yml',
+  },
+  environment,
+  period: aggregate.period,
+  release,
+});
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+mkdirSync(evidenceDirectory, { recursive: true, mode: 0o700 });
+chmodSync(evidenceDirectory, 0o700);
+const evidencePath = new URL(
+  'performance-cost-actual.json',
+  evidenceDirectory,
+);
+writeFileSync(evidencePath, JSON.stringify(report, null, 2) + '\\n', {
+  encoding: 'utf8',
+  flag: 'wx',
+  mode: 0o600,
+});
+chmodSync(evidencePath, 0o600);
+process.stdout.write(JSON.stringify(report) + '\\n');
+`,
+        'scripts/performance-load-guard.mjs': `import {
+  lstatSync,
+  readFileSync,
+  realpathSync,
+} from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { relative, resolve, sep } from 'node:path';
+import {
+  validateProtectedLoadAuthorization,
+  validatePerformancePolicy,
+} from '@empire-builder-kit/nx/performance';
+
+const requestedPlanPath =
+  process.env.EBK_PROTECTED_LOAD_PLAN_PATH?.trim();
+const requestedApprovalPath =
+  process.env.EBK_PROTECTED_LOAD_APPROVAL_PATH?.trim();
+const currentSourceCommit = process.env.EBK_SOURCE_COMMIT?.trim();
+const expectedAccountFingerprint =
+  process.env.EBK_ACCOUNT_FINGERPRINT?.trim();
+const expectedEndpoint = process.env.EBK_LOAD_ENDPOINT?.trim();
+const expectedRegion = process.env.AWS_REGION?.trim();
+const now = process.env.EBK_EVIDENCE_NOW?.trim();
+if (
+  !requestedPlanPath ||
+  !requestedApprovalPath ||
+  !currentSourceCommit ||
+  !expectedAccountFingerprint ||
+  !expectedEndpoint ||
+  !expectedRegion ||
+  !now
+) {
+  throw new Error(
+    'Protected load guard requires exact plan, approval, source, target, Region, and time inputs.',
+  );
+}
+
+const sliceRoot = realpathSync(
+  fileURLToPath(new URL('../', import.meta.url)),
+);
+
+function managedInput(requestedPath, directory, label) {
+  const root = resolve(sliceRoot, '.ebk/performance-load', directory);
+  const rootChild = relative(sliceRoot, root);
+  let cursor = sliceRoot;
+  for (const component of rootChild.split(sep).filter(Boolean)) {
+    cursor = resolve(cursor, component);
+    const metadata = lstatSync(cursor);
+    if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+      throw new Error(label + ' managed directory contains a symbolic link.');
+    }
+  }
+  const candidate = resolve(process.cwd(), requestedPath);
+  const child = relative(root, candidate);
+  if (
+    !/^[a-z0-9][a-z0-9._-]*\\.json$/.test(child) ||
+    child.includes(sep) ||
+    child === '..' ||
+    child.startsWith('..' + sep)
+  ) {
+    throw new Error(label + ' must be one exact managed JSON file.');
+  }
+  const metadata = lstatSync(candidate);
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) ||
+    (typeof process.getuid === 'function' &&
+      metadata.uid !== process.getuid()) ||
+    metadata.size <= 0 ||
+    metadata.size > 1024 * 1024
+  ) {
+    throw new Error(label + ' must be a regular bounded non-symlink file.');
+  }
+  const realRoot = realpathSync(root);
+  const realCandidate = realpathSync(candidate);
+  if (relative(realRoot, realCandidate) !== child) {
+    throw new Error(label + ' resolves outside its managed directory.');
+  }
+  return realCandidate;
+}
+
+const planPath = managedInput(requestedPlanPath, 'plans', 'Protected plan');
+const approvalPath = managedInput(
+  requestedApprovalPath,
+  'approvals',
+  'Protected approval',
+);
+const policy = validatePerformancePolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../performance/policy.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+const result = validateProtectedLoadAuthorization({
+  approval: JSON.parse(readFileSync(approvalPath, 'utf8')),
+  currentSourceCommit,
+  expectedAccountFingerprint,
+  expectedEndpoint,
+  expectedRegion,
+  now,
+  plan: JSON.parse(readFileSync(planPath, 'utf8')),
+  policy,
+});
+process.stdout.write(JSON.stringify(result) + '\\n');
+`,
+        'scripts/performance-load-runner.mjs': `import {
+  appendFileSync,
+  chmodSync,
+  closeSync,
+  constants,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs';
+import {
+  createProtectedLoadPlan,
+  createProtectedLoadScenarioDriver,
+  runBoundedProtectedLoad,
+  validatePerformancePolicy,
+} from '@empire-builder-kit/nx/performance';
+
+const planPath = process.env.EBK_PROTECTED_LOAD_PLAN_PATH?.trim();
+const authorizationPath =
+  process.env.EBK_PROTECTED_LOAD_AUTHORIZATION_PATH?.trim();
+const hmacKeyPath =
+  process.env.EBK_PERFORMANCE_LOAD_HMAC_KEY_PATH?.trim();
+const emergencyStopPath = process.env.EBK_EMERGENCY_STOP_PATH?.trim();
+if (!planPath || !authorizationPath || !hmacKeyPath || !emergencyStopPath) {
+  throw new Error(
+    'Protected load runner requires exact plan, authorization, job-scoped HMAC-key, and emergency-stop paths.',
+  );
+}
+const readHmacKey = (path) => {
+  const metadata = lstatSync(path);
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) ||
+    (typeof process.getuid === 'function' &&
+      metadata.uid !== process.getuid()) ||
+    metadata.size <= 0 ||
+    metadata.size > 2_048
+  ) {
+    throw new Error('Protected load HMAC key must be one bounded regular file.');
+  }
+  const value = JSON.parse(readFileSync(path, 'utf8'));
+  const secret =
+    value && typeof value.secret === 'string' ? value.secret : '';
+  const decoded = /^[A-Za-z0-9_-]{43}$/.test(secret)
+    ? Buffer.from(secret, 'base64url')
+    : Buffer.alloc(0);
+  if (
+    !value ||
+    typeof value !== 'object' ||
+    Array.isArray(value) ||
+    Object.keys(value).sort().join() !== 'id,secret' ||
+    typeof value.id !== 'string' ||
+    !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(value.id) ||
+    decoded.length !== 32 ||
+    decoded.toString('base64url') !== secret
+  ) {
+    throw new Error('Protected load HMAC key material is invalid.');
+  }
+  return Object.freeze({ id: value.id, secret: value.secret });
+};
+const hmacKey = readHmacKey(hmacKeyPath);
+const policy = validatePerformancePolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../performance/policy.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+if (
+  policy.authority.operationsAuthorityPath !==
+  'operations/reliability.json'
+) {
+  throw new Error(
+    'Protected load requires the exact generated reliability operations authority.',
+  );
+}
+const operationsAuthority = JSON.parse(
+  readFileSync(
+    new URL('../operations/reliability.json', import.meta.url),
+    'utf8',
+  ),
+);
+const providedPlan = JSON.parse(readFileSync(planPath, 'utf8'));
+const plan = createProtectedLoadPlan(policy, providedPlan);
+if (plan.materialDigest !== providedPlan.materialDigest) {
+  throw new Error('Protected load plan material changed after authorization.');
+}
+if (plan.evidencePath !== '.ebk/evidence/performance-load-report.json') {
+  throw new Error('Protected load evidence path is not the managed path.');
+}
+const catalog = JSON.parse(
+  readFileSync(
+    new URL('../performance/load-scenarios.json', import.meta.url),
+    'utf8',
+  ),
+);
+const authorization = JSON.parse(readFileSync(authorizationPath, 'utf8'));
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+mkdirSync(evidenceDirectory, { recursive: true, mode: 0o700 });
+chmodSync(evidenceDirectory, 0o700);
+const effectsPath = new URL('performance-load-effects.jsonl', evidenceDirectory);
+const maximumEffectLineBytes = 2_048;
+const maximumEffectLedgerBytes = Math.min(
+  64 * 1024 * 1024,
+  plan.maximumRequests * maximumEffectLineBytes,
+);
+const effects = new Map();
+let effectLedgerBytes = 0;
+if (existsSync(effectsPath)) {
+  const metadata = lstatSync(effectsPath);
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    metadata.size > maximumEffectLedgerBytes
+  ) {
+    throw new Error('Protected load effect ledger must be a bounded regular file.');
+  }
+  const bytes = readFileSync(effectsPath, 'utf8');
+  effectLedgerBytes = Buffer.byteLength(bytes);
+  if (bytes && !bytes.endsWith('\\n')) {
+    throw new Error('Protected load effect ledger has an incomplete record.');
+  }
+  const lines = bytes ? bytes.slice(0, -1).split('\\n') : [];
+  if (lines.length > plan.maximumRequests) {
+    throw new Error('Protected load effect ledger exceeds the request budget.');
+  }
+  for (const line of lines) {
+    if (Buffer.byteLength(line) > maximumEffectLineBytes) {
+      throw new Error('Protected load effect ledger record is oversized.');
+    }
+    const effect = JSON.parse(line);
+    if (
+      !effect ||
+      typeof effect !== 'object' ||
+      typeof effect.effectId !== 'string' ||
+      effects.has(effect.effectId)
+    ) {
+      throw new Error('Protected load effect ledger identity is invalid.');
+    }
+    effects.set(effect.effectId, effect);
+  }
+}
+const effectLedger = openSync(
+  effectsPath,
+  constants.O_APPEND |
+    constants.O_CREAT |
+    constants.O_WRONLY |
+    constants.O_NOFOLLOW,
+  0o600,
+);
+chmodSync(effectsPath, 0o600);
+const recordEffect = async (effect) => {
+  const prior = effects.get(effect.effectId);
+  if (prior) {
+    if (JSON.stringify(prior) !== JSON.stringify(effect)) {
+      throw new Error('Protected load effect identity contains other material.');
+    }
+    return;
+  }
+  const line = JSON.stringify(effect) + '\\n';
+  const lineBytes = Buffer.byteLength(line);
+  if (
+    lineBytes > maximumEffectLineBytes ||
+    effects.size >= plan.maximumRequests ||
+    effectLedgerBytes + lineBytes > maximumEffectLedgerBytes
+  ) {
+    throw new Error('Protected load effect ledger exceeded its hard bounds.');
+  }
+  appendFileSync(effectLedger, line, 'utf8');
+  effectLedgerBytes += lineBytes;
+  effects.set(effect.effectId, effect);
+};
+const { allowedDriver, driver } = createProtectedLoadScenarioDriver({
+  catalog,
+  hmacKey,
+  operationsAuthority,
+  plan,
+  policy,
+  recordEffect,
+});
+const report = await runBoundedProtectedLoad({
+  abortRequested: () => existsSync(emergencyStopPath),
+  allowedDrivers: [allowedDriver],
+  authorization,
+  driver,
+  plan,
+});
+closeSync(effectLedger);
+const output = new URL('performance-load-report.json', evidenceDirectory);
+const bytes = JSON.stringify(report, null, 2) + '\\n';
+try {
+  writeFileSync(output, bytes, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+} catch {
+  if (readFileSync(output, 'utf8') !== bytes) {
+    throw new Error('Protected load evidence path already contains other bytes.');
+  }
+}
+chmodSync(output, 0o600);
+process.stdout.write(JSON.stringify(report) + '\\n');
+`,
+        'scripts/performance-load-cleanup.mjs': `import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs';
+import {
+  cleanupProtectedLoadScenarioEffects,
+  createProtectedLoadPlan,
+  validatePerformancePolicy,
+} from '@empire-builder-kit/nx/performance';
+
+const planPath = process.env.EBK_PROTECTED_LOAD_PLAN_PATH?.trim();
+const hmacKeyPath =
+  process.env.EBK_PERFORMANCE_LOAD_HMAC_KEY_PATH?.trim();
+if (!planPath || !hmacKeyPath) {
+  throw new Error(
+    'Protected load cleanup requires one exact plan path and job-scoped HMAC key.',
+  );
+}
+const metadata = lstatSync(hmacKeyPath);
+if (
+  !metadata.isFile() ||
+  metadata.isSymbolicLink() ||
+  (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) ||
+  (typeof process.getuid === 'function' &&
+    metadata.uid !== process.getuid()) ||
+  metadata.size <= 0 ||
+  metadata.size > 2_048
+) {
+  throw new Error('Protected load HMAC key must be one bounded regular file.');
+}
+const hmacKey = JSON.parse(readFileSync(hmacKeyPath, 'utf8'));
+const hmacSecret =
+  hmacKey && typeof hmacKey.secret === 'string' ? hmacKey.secret : '';
+const decodedHmacSecret = /^[A-Za-z0-9_-]{43}$/.test(hmacSecret)
+  ? Buffer.from(hmacSecret, 'base64url')
+  : Buffer.alloc(0);
+if (
+  !hmacKey ||
+  typeof hmacKey !== 'object' ||
+  Array.isArray(hmacKey) ||
+  Object.keys(hmacKey).sort().join() !== 'id,secret' ||
+  typeof hmacKey.id !== 'string' ||
+  !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(hmacKey.id) ||
+  decodedHmacSecret.length !== 32 ||
+  decodedHmacSecret.toString('base64url') !== hmacSecret
+) {
+  throw new Error('Protected load HMAC key material is invalid.');
+}
+const policy = validatePerformancePolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../performance/policy.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+if (
+  policy.authority.operationsAuthorityPath !==
+  'operations/reliability.json'
+) {
+  throw new Error(
+    'Protected load cleanup requires the exact generated reliability operations authority.',
+  );
+}
+const operationsAuthority = JSON.parse(
+  readFileSync(
+    new URL('../operations/reliability.json', import.meta.url),
+    'utf8',
+  ),
+);
+const providedPlan = JSON.parse(readFileSync(planPath, 'utf8'));
+const plan = createProtectedLoadPlan(policy, providedPlan);
+if (plan.materialDigest !== providedPlan.materialDigest) {
+  throw new Error('Protected load cleanup plan material is inconsistent.');
+}
+const catalog = JSON.parse(
+  readFileSync(
+    new URL('../performance/load-scenarios.json', import.meta.url),
+    'utf8',
+  ),
+);
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+mkdirSync(evidenceDirectory, { recursive: true, mode: 0o700 });
+chmodSync(evidenceDirectory, 0o700);
+const effectsPath = new URL('performance-load-effects.jsonl', evidenceDirectory);
+const maximumEffectLineBytes = 2_048;
+const maximumEffectLedgerBytes = Math.min(
+  64 * 1024 * 1024,
+  plan.maximumRequests * maximumEffectLineBytes,
+);
+let effects = [];
+if (existsSync(effectsPath)) {
+  const metadata = lstatSync(effectsPath);
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    metadata.size > maximumEffectLedgerBytes
+  ) {
+    throw new Error('Protected load effect ledger must be a bounded regular file.');
+  }
+  const bytes = readFileSync(effectsPath, 'utf8');
+  if (bytes && !bytes.endsWith('\\n')) {
+    throw new Error('Protected load effect ledger has an incomplete record.');
+  }
+  const lines = bytes ? bytes.slice(0, -1).split('\\n') : [];
+  if (
+    lines.length > plan.maximumRequests ||
+    lines.some((line) => Buffer.byteLength(line) > maximumEffectLineBytes)
+  ) {
+    throw new Error('Protected load effect ledger exceeds its hard bounds.');
+  }
+  effects = lines.map((line) => JSON.parse(line));
+}
+const report = await cleanupProtectedLoadScenarioEffects({
+  catalog,
+  effects,
+  hmacKey,
+  operationsAuthority,
+  plan,
+  policy,
+});
+const output = new URL('performance-load-cleanup.json', evidenceDirectory);
+const bytes = JSON.stringify(report, null, 2) + '\\n';
+try {
+  writeFileSync(output, bytes, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+} catch {
+  if (readFileSync(output, 'utf8') !== bytes) {
+    throw new Error('Protected cleanup evidence path contains other bytes.');
+  }
+}
+chmodSync(output, 0o600);
+process.stdout.write(JSON.stringify(report) + '\\n');
+`,
+        'scripts/performance-tag-coverage.mjs': `import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import {
+  deriveExpectedResourceTagInventory,
+  evaluateResourceTagCoverage,
+} from '@empire-builder-kit/nx/performance';
+
+const deploymentPath =
+  process.env.EBK_DEPLOYMENT_RESOURCE_TAG_INVENTORY_PATH?.trim();
+const observedPath =
+  process.env.EBK_OBSERVED_RESOURCE_TAG_INVENTORY_PATH?.trim();
+if (!deploymentPath || !observedPath) {
+  throw new Error(
+    'Exact deployment resource inventory and observed tag inventory paths are required.',
+  );
+}
+const expected = deriveExpectedResourceTagInventory(
+  JSON.parse(readFileSync(deploymentPath, 'utf8')),
+);
+const result = evaluateResourceTagCoverage({
+  expected,
+  observed: JSON.parse(readFileSync(observedPath, 'utf8')),
+});
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+mkdirSync(evidenceDirectory, { recursive: true, mode: 0o700 });
+chmodSync(evidenceDirectory, 0o700);
+const evidencePath = new URL(
+  'performance-tag-coverage.json',
+  evidenceDirectory,
+);
+writeFileSync(evidencePath, JSON.stringify(result, null, 2) + '\\n', {
+  encoding: 'utf8',
+  mode: 0o600,
+});
+chmodSync(evidencePath, 0o600);
+process.stdout.write(JSON.stringify(result) + '\\n');
+if (result.status !== 'complete') process.exitCode = 2;
+`,
+        'web/src/app/%5F%5Febk/performance/handler.ts': `import 'server-only';
+import {
+  handleProtectedLoadCleanupEndpoint,
+  handleProtectedLoadScenarioEndpoint,
+  type ProtectedLoadEndpointBindingV1,
+  type ProtectedLoadEndpointAdapterId,
+  type ProtectedLoadRequestAuthorizationV1,
+} from '@empire-builder-kit/runtime/performance';
+import { randomUUID } from 'node:crypto';
+import { withPrimaryDatabase } from '../../../../../database/runtime-client';
+import { Secrets } from '../../../../../secrets/declarations';
+import { createStandardSliceSecretRuntime } from '../../../../../secrets/runtime';
+
+type ManagedAdapterId = Exclude<
+  ProtectedLoadEndpointAdapterId,
+  'ebk-service-v1'
+>;
+
+function required(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error('protected-performance-endpoint-disabled');
+  return value;
+}
+
+type EndpointSecretRuntime = ReturnType<
+  typeof createStandardSliceSecretRuntime
+>;
+let endpointSecretRuntime: EndpointSecretRuntime | undefined;
+let endpointSecretRuntimeStage: 'production' | 'staging' | undefined;
+
+function performanceSecretRuntime(
+  stage: 'production' | 'staging',
+): EndpointSecretRuntime {
+  if (
+    endpointSecretRuntimeStage !== undefined &&
+    endpointSecretRuntimeStage !== stage
+  ) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  endpointSecretRuntimeStage = stage;
+  endpointSecretRuntime ??= createStandardSliceSecretRuntime({
+    stage,
+    workload: '${name}.web-server',
+  });
+  return endpointSecretRuntime;
+}
+
+async function withEndpointBinding<Result>(
+  adapterId: ManagedAdapterId,
+  operation: (binding: ProtectedLoadEndpointBindingV1) => Promise<Result>,
+): Promise<Result> {
+  const stage = process.env.EBK_STAGE;
+  if (
+    process.env.EBK_PERFORMANCE_LOAD_ENABLED !== 'true' ||
+    (stage !== 'staging' && stage !== 'production')
+  ) {
+    throw new Error('protected-performance-endpoint-disabled');
+  }
+  return performanceSecretRuntime(stage).runWithSecret({
+    declaration: Secrets.${pascalName}PerformanceLoadHmacKeys,
+    isAuthenticationFailure: () => false,
+    operation: (hmacKeys) =>
+      operation({
+        adapterId,
+        deployedCandidateDigest: required(
+          'EBK_PERFORMANCE_CANDIDATE_DIGEST',
+        ),
+        deployedReleaseId: required('EBK_PERFORMANCE_RELEASE_ID'),
+        deployedReleaseMaterialDigest: required(
+          'EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST',
+        ),
+        deployedSourceCommit: required('EBK_SOURCE_COMMIT'),
+        hmacKeys,
+        stage,
+        target: {
+          accountFingerprint: required(
+            'EBK_PERFORMANCE_ACCOUNT_FINGERPRINT',
+          ),
+          origin: required('EBK_PERFORMANCE_ORIGIN'),
+          region: required('EBK_PERFORMANCE_REGION'),
+          slice: required('EBK_PERFORMANCE_SLICE'),
+        },
+      }),
+  });
+}
+
+function requestMaterial(request: Request, body?: unknown) {
+  return {
+    ...(body === undefined ? {} : { body }),
+    headers: Object.fromEntries(request.headers.entries()),
+    method: request.method as 'GET' | 'POST',
+    url: request.url,
+  };
+}
+
+async function boundedRequestBody(request: Request): Promise<unknown> {
+  const maximumBytes = 32 * 1024;
+  const declaredLength = request.headers.get('content-length');
+  if (
+    declaredLength !== null &&
+    (!/^\\d+$/.test(declaredLength) ||
+      Number(declaredLength) <= 0 ||
+      Number(declaredLength) > maximumBytes)
+  ) {
+    throw new Error('protected-performance-request-body-invalid');
+  }
+  if (!request.body) {
+    throw new Error('protected-performance-request-body-invalid');
+  }
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > maximumBytes) {
+        await reader.cancel();
+        throw new Error('protected-performance-request-body-invalid');
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  if (size === 0) {
+    throw new Error('protected-performance-request-body-invalid');
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+}
+
+function memorySaturation(): number {
+  const memory = process.memoryUsage();
+  if (memory.heapTotal <= 0) return 0;
+  return Math.min(100, (memory.heapUsed / memory.heapTotal) * 100);
+}
+
+function effectUuid(effectId: string): string {
+  return [
+    effectId.slice(0, 8),
+    effectId.slice(8, 12),
+    '4' + effectId.slice(13, 16),
+    '8' + effectId.slice(17, 20),
+    effectId.slice(20, 32),
+  ].join('-');
+}
+
+interface ProtectedPerformanceRunRow {
+  adapterId: string;
+  cleanupStartedAt: Date | null;
+  createdAt: Date;
+  expiresAt: Date;
+  maximumRequests: number;
+  releaseMaterialDigest: string;
+  runId: string;
+  scenarioId: string;
+  sourceCommit: string;
+  stage: string;
+}
+
+function matchesProtectedPerformanceRun(
+  actual: ProtectedPerformanceRunRow | undefined,
+  authorization: ProtectedLoadRequestAuthorizationV1,
+): actual is ProtectedPerformanceRunRow {
+  return (
+    actual !== undefined &&
+    actual.adapterId === authorization.adapterId &&
+    actual.createdAt.toISOString() === authorization.createdAt &&
+    actual.expiresAt.toISOString() === authorization.expiresAt &&
+    actual.maximumRequests === authorization.maximumRequests &&
+    actual.releaseMaterialDigest ===
+      authorization.release.releaseMaterialDigest &&
+    actual.runId === authorization.runId &&
+    actual.scenarioId === authorization.scenarioId &&
+    actual.sourceCommit === authorization.release.sourceCommit &&
+    actual.stage === authorization.stage
+  );
+}
+
+export async function reserveRequest(
+  authorization: ProtectedLoadRequestAuthorizationV1,
+) {
+  return withPrimaryDatabase(
+    { correlationId: randomUUID() },
+    'web-server',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        await client.query(
+          \`INSERT INTO performance_load_runs
+             (plan_digest, run_id, adapter_id, scenario_id, stage,
+              source_commit, release_material_digest, maximum_requests,
+              created_at, expires_at)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::timestamptz,
+                   $10::timestamptz)
+           ON CONFLICT (plan_digest) DO NOTHING\`,
+          [
+            authorization.planMaterialDigest,
+            authorization.runId,
+            authorization.adapterId,
+            authorization.scenarioId,
+            authorization.stage,
+            authorization.release.sourceCommit,
+            authorization.release.releaseMaterialDigest,
+            authorization.maximumRequests,
+            authorization.createdAt,
+            authorization.expiresAt,
+          ],
+        );
+        const run = await client.query<ProtectedPerformanceRunRow>(
+          \`SELECT
+             adapter_id AS "adapterId",
+             cleanup_started_at AS "cleanupStartedAt",
+             created_at AS "createdAt",
+             expires_at AS "expiresAt",
+             maximum_requests AS "maximumRequests",
+             release_material_digest AS "releaseMaterialDigest",
+             run_id AS "runId",
+             scenario_id AS "scenarioId",
+             source_commit AS "sourceCommit",
+             stage
+           FROM performance_load_runs
+           WHERE plan_digest = $1
+           FOR UPDATE\`,
+          [authorization.planMaterialDigest],
+        );
+        const actual = run.rows[0];
+        if (
+          !matchesProtectedPerformanceRun(actual, authorization) ||
+          actual.cleanupStartedAt !== null
+        ) {
+          throw new Error('protected-performance-run-collision');
+        }
+        const claimed = await client.query(
+          \`INSERT INTO performance_load_requests
+             (plan_digest, request_ordinal, effect_id)
+           VALUES ($1, $2, $3)
+           ON CONFLICT (plan_digest, request_ordinal) DO NOTHING\`,
+          [
+            authorization.planMaterialDigest,
+            authorization.requestOrdinal,
+            authorization.effectId,
+          ],
+        );
+        if (claimed.rowCount !== 1) {
+          throw new Error('protected-performance-request-replayed');
+        }
+        await client.query('COMMIT');
+        return 'claimed' as const;
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export async function databaseExecution(
+  adapterId: 'ebk-async-worker-v1' | 'ebk-database-v1',
+  effectId: string,
+  authorization: ProtectedLoadRequestAuthorizationV1,
+) {
+  return withPrimaryDatabase(
+    { correlationId: randomUUID() },
+    'web-server',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const run = await client.query<ProtectedPerformanceRunRow>(
+          \`SELECT
+             adapter_id AS "adapterId",
+             cleanup_started_at AS "cleanupStartedAt",
+             created_at AS "createdAt",
+             expires_at AS "expiresAt",
+             maximum_requests AS "maximumRequests",
+             release_material_digest AS "releaseMaterialDigest",
+             run_id AS "runId",
+             scenario_id AS "scenarioId",
+             source_commit AS "sourceCommit",
+             stage
+           FROM performance_load_runs
+           WHERE plan_digest = $1
+           FOR UPDATE\`,
+          [authorization.planMaterialDigest],
+        );
+        const activeRun = run.rows[0];
+        if (
+          !matchesProtectedPerformanceRun(activeRun, authorization) ||
+          activeRun.cleanupStartedAt !== null
+        ) {
+          throw new Error('protected-performance-run-cleaning');
+        }
+        if (adapterId === 'ebk-async-worker-v1') {
+          const inserted = await client.query(
+            \`INSERT INTO performance_load_async_effects
+               (effect_id, plan_digest, run_id, expires_at)
+             VALUES ($1, $2, $3, now() + INTERVAL '24 hours')
+             ON CONFLICT (effect_id) DO NOTHING\`,
+            [
+              effectId,
+              authorization.planMaterialDigest,
+              authorization.runId,
+            ],
+          );
+          const identity = await client.query<{
+            planDigest: string;
+            runId: string;
+          }>(
+            \`SELECT
+               plan_digest AS "planDigest",
+               run_id AS "runId"
+             FROM performance_load_async_effects
+             WHERE effect_id = $1\`,
+            [effectId],
+          );
+          if (
+            identity.rows[0]?.planDigest !==
+              authorization.planMaterialDigest ||
+            identity.rows[0]?.runId !== authorization.runId
+          ) {
+            throw new Error('protected-performance-effect-collision');
+          }
+          const pending = await client.query<{ count: string }>(
+            \`SELECT count(*)::text AS count
+             FROM performance_load_async_effects
+             WHERE processed_at IS NULL AND expires_at > now()\`,
+          );
+          const maximum = authorization.configuredMaximum;
+          if (!Number.isFinite(maximum) || maximum <= 0) {
+            throw new Error('protected-performance-async-maximum-invalid');
+          }
+          const result = {
+            effectState:
+              inserted.rowCount === 1
+                ? ('created' as const)
+                : ('already-existed' as const),
+            saturationPercent: Math.min(
+              100,
+              (Number(pending.rows[0]?.count ?? 0) / maximum) * 100,
+            ),
+          };
+          await client.query('COMMIT');
+          return result;
+        }
+        const id = effectUuid(effectId);
+        const inserted = await client.query(
+          \`INSERT INTO records
+             (id, name, owner_id, run_scope, test_expires_at)
+           VALUES (
+             $1::uuid,
+             'ebk-protected-performance-load',
+             'ebk-performance',
+             $2,
+             now() + INTERVAL '24 hours'
+           )
+           ON CONFLICT (id) DO NOTHING\`,
+          [id, authorization.planMaterialDigest],
+        );
+        const identity = await client.query<{
+          name: string;
+          ownerId: string;
+          runScope: string;
+        }>(
+          \`SELECT
+             name,
+             owner_id AS "ownerId",
+             run_scope AS "runScope"
+           FROM records
+           WHERE id = $1::uuid\`,
+          [id],
+        );
+        if (
+          identity.rows[0]?.name !== 'ebk-protected-performance-load' ||
+          identity.rows[0]?.ownerId !== 'ebk-performance' ||
+          identity.rows[0]?.runScope !== authorization.planMaterialDigest
+        ) {
+          throw new Error('protected-performance-effect-collision');
+        }
+        const activity = await client.query<{
+          active: string;
+          maximum: string;
+        }>(
+          \`SELECT
+             count(*)::text AS active,
+             current_setting('max_connections') AS maximum
+           FROM pg_stat_activity
+           WHERE datname = current_database()\`,
+        );
+        const active = Number(activity.rows[0]?.active ?? 0);
+        const maximum = Number(activity.rows[0]?.maximum ?? 0);
+        if (!Number.isFinite(maximum) || maximum <= 0) {
+          throw new Error('protected-performance-database-maximum-invalid');
+        }
+        const result = {
+          effectState:
+            inserted.rowCount === 1
+              ? ('created' as const)
+              : ('already-existed' as const),
+          saturationPercent: Math.min(100, (active / maximum) * 100),
+        };
+        await client.query('COMMIT');
+        return result;
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export async function cleanupRun(
+  adapterId: 'ebk-async-worker-v1' | 'ebk-database-v1',
+  authorization: ProtectedLoadRequestAuthorizationV1,
+) {
+  return withPrimaryDatabase(
+    { correlationId: randomUUID() },
+    'web-server',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        await client.query(
+          \`INSERT INTO performance_load_runs
+             (plan_digest, run_id, adapter_id, scenario_id, stage,
+              source_commit, release_material_digest, maximum_requests,
+              created_at, expires_at, cleanup_started_at)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::timestamptz,
+                   $10::timestamptz, now())
+           ON CONFLICT (plan_digest) DO NOTHING\`,
+          [
+            authorization.planMaterialDigest,
+            authorization.runId,
+            authorization.adapterId,
+            authorization.scenarioId,
+            authorization.stage,
+            authorization.release.sourceCommit,
+            authorization.release.releaseMaterialDigest,
+            authorization.maximumRequests,
+            authorization.createdAt,
+            authorization.expiresAt,
+          ],
+        );
+        const run = await client.query<ProtectedPerformanceRunRow>(
+          \`SELECT
+             adapter_id AS "adapterId",
+             cleanup_started_at AS "cleanupStartedAt",
+             created_at AS "createdAt",
+             expires_at AS "expiresAt",
+             maximum_requests AS "maximumRequests",
+             release_material_digest AS "releaseMaterialDigest",
+             run_id AS "runId",
+             scenario_id AS "scenarioId",
+             source_commit AS "sourceCommit",
+             stage
+           FROM performance_load_runs
+           WHERE plan_digest = $1
+           FOR UPDATE\`,
+          [authorization.planMaterialDigest],
+        );
+        if (!matchesProtectedPerformanceRun(run.rows[0], authorization)) {
+          throw new Error('protected-performance-run-collision');
+        }
+        await client.query(
+          \`UPDATE performance_load_runs
+           SET cleanup_started_at = COALESCE(cleanup_started_at, now())
+           WHERE plan_digest = $1\`,
+          [authorization.planMaterialDigest],
+        );
+        await client.query('COMMIT');
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+
+      await client.query('BEGIN');
+      try {
+        const removed =
+          adapterId === 'ebk-async-worker-v1'
+            ? await client.query(
+                \`DELETE FROM performance_load_async_effects
+                 WHERE plan_digest = $1
+                   AND run_id = $2\`,
+                [authorization.planMaterialDigest, authorization.runId],
+              )
+            : await client.query(
+                \`DELETE FROM records
+                 WHERE owner_id = 'ebk-performance'
+                   AND name = 'ebk-protected-performance-load'
+                   AND run_scope = $1\`,
+                [authorization.planMaterialDigest],
+              );
+        const remaining =
+          adapterId === 'ebk-async-worker-v1'
+            ? await client.query<{ count: string }>(
+                \`SELECT count(*)::text AS count
+                 FROM performance_load_async_effects
+                 WHERE plan_digest = $1
+                   AND run_id = $2\`,
+                [authorization.planMaterialDigest, authorization.runId],
+              )
+            : await client.query<{ count: string }>(
+                \`SELECT count(*)::text AS count
+                 FROM records
+                 WHERE owner_id = 'ebk-performance'
+                   AND name = 'ebk-protected-performance-load'
+                   AND run_scope = $1\`,
+                [authorization.planMaterialDigest],
+              );
+        const remainingEffectCount = Number(remaining.rows[0]?.count ?? 0);
+        if (
+          !Number.isSafeInteger(remainingEffectCount) ||
+          remainingEffectCount !== 0
+        ) {
+          throw new Error('protected-performance-cleanup-incomplete');
+        }
+        await client.query('COMMIT');
+        return {
+          remainingEffectCount,
+          removedEffectCount: removed.rowCount ?? 0,
+        };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+function refused() {
+  return Response.json(
+    {
+      kind: 'ebk-protected-load-endpoint-refusal',
+      status: 'not-found',
+    },
+    { status: 404 },
+  );
+}
+
+export async function runPerformanceScenarioEndpoint(
+  adapterId: ManagedAdapterId,
+  request: Request,
+) {
+  try {
+    const body =
+      request.method === 'POST'
+        ? await boundedRequestBody(request)
+        : undefined;
+    const result = await withEndpointBinding(adapterId, (binding) =>
+      handleProtectedLoadScenarioEndpoint({
+        binding,
+        execute: async ({ authorization, effectId }) => {
+          if (
+            adapterId === 'ebk-async-worker-v1' ||
+            adapterId === 'ebk-database-v1'
+          ) {
+            if (!effectId) throw new Error('protected-effect-required');
+            return databaseExecution(adapterId, effectId, authorization);
+          }
+          return { saturationPercent: memorySaturation() };
+        },
+        request: requestMaterial(request, body),
+        reserve: reserveRequest,
+      }),
+    );
+    return Response.json(result.body, { status: result.status });
+  } catch {
+    return refused();
+  }
+}
+
+export async function runPerformanceCleanupEndpoint(
+  adapterId: 'ebk-async-worker-v1' | 'ebk-database-v1',
+  request: Request,
+) {
+  try {
+    const body = await boundedRequestBody(request);
+    const result = await withEndpointBinding(adapterId, (binding) =>
+      handleProtectedLoadCleanupEndpoint({
+        binding,
+        cleanup: (authorization) => cleanupRun(adapterId, authorization),
+        request: requestMaterial(request, body),
+      }),
+    );
+    return Response.json(result.body, { status: result.status });
+  } catch {
+    return refused();
+  }
+}
+`,
+        'web/src/app/%5F%5Febk/performance/handler.spec.ts': `import {
+  beforeAll,
+  describe,
+  expect,
+  it,
+  vi,
+} from 'vitest';
+
+const mocks = vi.hoisted(() => {
+  const runWithSecret = vi.fn(async ({ operation }) =>
+    operation({
+      current: {
+        id: 'performance-current-v1',
+        secret: 'current-performance-secret-material-0001',
+      },
+    }),
+  );
+  return {
+    createSecretRuntime: vi.fn(() => ({ runWithSecret })),
+    runWithSecret,
+  };
+});
+
+vi.mock('server-only', () => ({}));
+vi.mock('@empire-builder-kit/runtime/performance', () => ({
+  handleProtectedLoadCleanupEndpoint: vi.fn(),
+  handleProtectedLoadScenarioEndpoint: vi.fn(async ({ binding }) => ({
+    body: {
+      candidateDigest: binding.deployedCandidateDigest,
+      kind: 'ebk-protected-load-endpoint-telemetry',
+      status: 'accepted',
+    },
+    status: 200,
+  })),
+}));
+vi.mock('../../../../../database/runtime-client', () => ({
+  withPrimaryDatabase: vi.fn(),
+}));
+vi.mock('../../../../../secrets/declarations', () => ({
+  Secrets: { ${pascalName}PerformanceLoadHmacKeys: {} },
+}));
+vi.mock('../../../../../secrets/runtime', () => ({
+  createStandardSliceSecretRuntime: mocks.createSecretRuntime,
+}));
+
+import { runPerformanceScenarioEndpoint } from './handler';
+
+describe('${name} protected performance secret cache lifetime', () => {
+  beforeAll(() => {
+    process.env.EBK_PERFORMANCE_ACCOUNT_FINGERPRINT =
+      'sha256:' + 'a'.repeat(64);
+    process.env.EBK_PERFORMANCE_CANDIDATE_DIGEST = 'b'.repeat(64);
+    process.env.EBK_PERFORMANCE_LOAD_ENABLED = 'true';
+    process.env.EBK_PERFORMANCE_ORIGIN =
+      'https://performance.example.test';
+    process.env.EBK_PERFORMANCE_REGION = 'us-east-1';
+    process.env.EBK_PERFORMANCE_RELEASE_ID = 'release-handler-test';
+    process.env.EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST = 'd'.repeat(64);
+    process.env.EBK_PERFORMANCE_SLICE = '${name}';
+    process.env.EBK_SOURCE_COMMIT = 'c'.repeat(40);
+    process.env.EBK_STAGE = 'staging';
+  });
+
+  it('reuses one resolver across requests so declaration TTL is effective', async () => {
+    const endpoint =
+      'https://performance.example.test/${name}/__ebk/performance/api-lambda';
+    await expect(
+      runPerformanceScenarioEndpoint(
+        'ebk-api-lambda-v1',
+        new Request(endpoint),
+      ),
+    ).resolves.toMatchObject({ status: 200 });
+    await expect(
+      runPerformanceScenarioEndpoint(
+        'ebk-api-lambda-v1',
+        new Request(endpoint),
+      ),
+    ).resolves.toMatchObject({ status: 200 });
+    expect(mocks.createSecretRuntime).toHaveBeenCalledTimes(1);
+    expect(mocks.runWithSecret).toHaveBeenCalledTimes(2);
+  });
+});
+`,
+        'integration/performance-load-cleanup.spec.ts': `import { Client } from 'pg';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import type { ProtectedLoadRequestAuthorizationV1 } from '@empire-builder-kit/runtime/performance';
+import { createInboxCleanupHandler } from '../async/inbox-cleanup.js';
+import {
+  cleanupRun,
+  databaseExecution,
+  reserveRequest,
+} from '../web/src/app/%5F%5Febk/performance/handler.js';
+
+vi.mock('server-only', () => ({}));
+vi.mock('../database/runtime-client.js', () => ({
+  withPrimaryDatabase: async (
+    _context: unknown,
+    _workload: unknown,
+    operation: (client: Client) => Promise<unknown>,
+  ) => {
+    const { Client: RuntimeClient } = await import('pg');
+    const client = new RuntimeClient({
+      connectionString: process.env.DATABASE_URL,
+    });
+    await client.connect();
+    try {
+      return await operation(client);
+    } finally {
+      await client.end();
+    }
+  },
+}));
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) {
+  throw new Error(
+    'DATABASE_URL is required for ${name} performance cleanup integration proof.',
+  );
+}
+
+const touchedPlanDigests = new Set<string>();
+
+function authorization(input: {
+  effectId: string | null;
+  operation: 'cleanup' | 'execute';
+  planMaterialDigest: string;
+  requestOrdinal?: number;
+}): ProtectedLoadRequestAuthorizationV1 {
+  return {
+    adapterId: 'ebk-async-worker-v1',
+    configuredMaximum: 100,
+    createdAt: '2026-07-29T12:00:00.000Z',
+    durationSeconds: 60,
+    effectId: input.effectId,
+    expiresAt: '2026-07-29T13:00:00.000Z',
+    hmacKeyId: 'integration-v1',
+    maximumRequests: 10,
+    operation: input.operation,
+    planMaterialDigest: input.planMaterialDigest,
+    release: {
+      candidateDigest: 'c'.repeat(64),
+      releaseId: 'integration-release',
+      releaseMaterialDigest: 'd'.repeat(64),
+      sourceCommit: 'b'.repeat(40),
+    },
+    requestOrdinal: input.requestOrdinal ?? 1,
+    runId: 'integration-run-' + input.planMaterialDigest.slice(0, 8),
+    saturationSignalRef:
+      'database:protected-async-backlog-utilization-percent',
+    scenarioId: 'async-burst',
+    stage: 'staging',
+    target: {
+      accountFingerprint: 'sha256:' + 'e'.repeat(64),
+      endpoint:
+        'https://performance.example.test/${name}/__ebk/performance/async-worker',
+      region: 'us-east-1',
+      slice: '${name}',
+    },
+    workload: 'async-worker',
+  };
+}
+
+async function withClient<Result>(
+  operation: (client: Client) => Promise<Result>,
+): Promise<Result> {
+  const client = new Client({ connectionString: databaseUrl });
+  await client.connect();
+  try {
+    return await operation(client);
+  } finally {
+    await client.end();
+  }
+}
+
+// A loaded-host budget: hosted runners share four cores between Vitest,
+// the proof registry, and the dockerized database.
+async function waitForActiveStatement(
+  client: Client,
+  fragment: string,
+): Promise<void> {
+  const deadline = Date.now() + 15_000;
+  while (Date.now() < deadline) {
+    const active = await client.query<{ count: string }>(
+      \`SELECT count(*)::text AS count
+       FROM pg_stat_activity
+       WHERE datname = current_database()
+         AND pid <> pg_backend_pid()
+         AND state = 'active'
+         AND query LIKE $1\`,
+      ['%' + fragment + '%'],
+    );
+    if (Number(active.rows[0]?.count ?? 0) > 0) return;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  throw new Error('Timed out waiting for the adversarial database statement.');
+}
+
+afterEach(async () => {
+  await withClient(async (client) => {
+    await client
+      .query(
+        'DROP TRIGGER IF EXISTS ebk_performance_delay_effect ON performance_load_async_effects',
+      )
+      .catch(() => undefined);
+    await client
+      .query('DROP FUNCTION IF EXISTS ebk_performance_delay_effect()')
+      .catch(() => undefined);
+    for (const planDigest of touchedPlanDigests) {
+      await client.query('DELETE FROM records WHERE run_scope = $1', [
+        planDigest,
+      ]);
+      await client.query(
+        'DELETE FROM performance_load_async_effects WHERE plan_digest = $1',
+        [planDigest],
+      );
+      await client.query(
+        'DELETE FROM performance_load_requests WHERE plan_digest = $1',
+        [planDigest],
+      );
+      await client.query(
+        'DELETE FROM performance_load_runs WHERE plan_digest = $1',
+        [planDigest],
+      );
+    }
+    await client.query(
+      "DELETE FROM cleanup_deadline_reports WHERE feature = 'performance-load'",
+    );
+  });
+  touchedPlanDigests.clear();
+});
+
+describe('${name} protected performance cleanup integration', () => {
+  it('serializes cleanup behind an in-flight effect and rejects every late effect', async () => {
+    const planMaterialDigest = '1'.repeat(64);
+    const effectId = '2'.repeat(64);
+    touchedPlanDigests.add(planMaterialDigest);
+    const executeAuthorization = authorization({
+      effectId,
+      operation: 'execute',
+      planMaterialDigest,
+    });
+    const cleanupAuthorization = authorization({
+      effectId: null,
+      operation: 'cleanup',
+      planMaterialDigest,
+    });
+
+    await reserveRequest(executeAuthorization);
+    await withClient(async (client) => {
+      await client.query(
+        \`CREATE OR REPLACE FUNCTION ebk_performance_delay_effect()
+         RETURNS trigger
+         LANGUAGE plpgsql
+         AS $$
+         BEGIN
+           PERFORM pg_sleep(1);
+           RETURN NEW;
+         END
+         $$\`,
+      );
+      await client.query(
+        \`CREATE TRIGGER ebk_performance_delay_effect
+         BEFORE INSERT ON performance_load_async_effects
+         FOR EACH ROW EXECUTE FUNCTION ebk_performance_delay_effect()\`,
+      );
+    });
+
+    const observer = new Client({ connectionString: databaseUrl });
+    await observer.connect();
+    try {
+      const effect = databaseExecution(
+        'ebk-async-worker-v1',
+        effectId,
+        executeAuthorization,
+      );
+      await waitForActiveStatement(
+        observer,
+        'INSERT INTO performance_load_async_effects',
+      );
+      const cleanup = cleanupRun(
+        'ebk-async-worker-v1',
+        cleanupAuthorization,
+      );
+      await expect(effect).resolves.toMatchObject({ effectState: 'created' });
+      await expect(cleanup).resolves.toEqual({
+        remainingEffectCount: 0,
+        removedEffectCount: 1,
+      });
+    } finally {
+      await observer.end();
+    }
+
+    await expect(
+      databaseExecution(
+        'ebk-async-worker-v1',
+        '3'.repeat(64),
+        {
+          ...executeAuthorization,
+          effectId: '3'.repeat(64),
+          requestOrdinal: 2,
+        },
+      ),
+    ).rejects.toThrow('protected-performance-run-cleaning');
+    await expect(
+      reserveRequest({
+        ...executeAuthorization,
+        effectId: '3'.repeat(64),
+        requestOrdinal: 2,
+      }),
+    ).rejects.toThrow('protected-performance-run-collision');
+
+    await withClient(async (client) => {
+      const state = await client.query<{
+        cleanupStarted: boolean;
+        effects: string;
+      }>(
+        \`SELECT
+           run.cleanup_started_at IS NOT NULL AS "cleanupStarted",
+           (
+             SELECT count(*)::text
+             FROM performance_load_async_effects AS effect
+             WHERE effect.plan_digest = run.plan_digest
+           ) AS effects
+         FROM performance_load_runs AS run
+         WHERE run.plan_digest = $1\`,
+        [planMaterialDigest],
+      );
+      expect(state.rows).toEqual([
+        { cleanupStarted: true, effects: '0' },
+      ]);
+    });
+  });
+
+  it('tombstones and proves an effect-free run absent without a local ledger', async () => {
+    const planMaterialDigest = '4'.repeat(64);
+    touchedPlanDigests.add(planMaterialDigest);
+    const cleanupAuthorization = authorization({
+      effectId: null,
+      operation: 'cleanup',
+      planMaterialDigest,
+    });
+
+    await expect(
+      cleanupRun('ebk-async-worker-v1', cleanupAuthorization),
+    ).resolves.toEqual({
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+    });
+    await expect(
+      cleanupRun('ebk-async-worker-v1', cleanupAuthorization),
+    ).resolves.toEqual({
+      remainingEffectCount: 0,
+      removedEffectCount: 0,
+    });
+    await expect(
+      reserveRequest({
+        ...cleanupAuthorization,
+        effectId: '5'.repeat(64),
+        operation: 'execute',
+      }),
+    ).rejects.toThrow('protected-performance-run-collision');
+  });
+
+  it('expires only framework-owned due rows and retains fresh audit state', async () => {
+    const oldPlan = '6'.repeat(64);
+    const freshPlan = '7'.repeat(64);
+    const expiredEffectPlan = '8'.repeat(64);
+    const freshEffectPlan = '9'.repeat(64);
+    for (const digest of [
+      oldPlan,
+      freshPlan,
+      expiredEffectPlan,
+      freshEffectPlan,
+    ]) {
+      touchedPlanDigests.add(digest);
+    }
+    const expiredRecordId = '10000000-0000-4000-8000-000000000001';
+    const freshRecordId = '10000000-0000-4000-8000-000000000002';
+    const adopterRecordId = '10000000-0000-4000-8000-000000000003';
+
+    await withClient(async (client) => {
+      await client.query(
+        \`INSERT INTO performance_load_runs
+           (plan_digest, run_id, adapter_id, scenario_id, stage,
+            source_commit, release_material_digest, maximum_requests,
+            created_at, expires_at)
+         VALUES
+           ($1, 'old-run', 'ebk-async-worker-v1', 'async-burst', 'staging',
+            $3, $4, 10, now() - INTERVAL '32 days',
+            now() - INTERVAL '31 days'),
+           ($2, 'fresh-run', 'ebk-async-worker-v1', 'async-burst', 'staging',
+            $3, $4, 10, now() - INTERVAL '30 days',
+            now() - INTERVAL '29 days')\`,
+        [oldPlan, freshPlan, 'b'.repeat(40), 'd'.repeat(64)],
+      );
+      await client.query(
+        \`INSERT INTO performance_load_requests
+           (plan_digest, request_ordinal, effect_id)
+         VALUES ($1, 1, NULL), ($2, 1, NULL)\`,
+        [oldPlan, freshPlan],
+      );
+      await client.query(
+        \`INSERT INTO performance_load_async_effects
+           (effect_id, plan_digest, run_id, expires_at)
+         VALUES
+           ($1, $2, 'expired', now() - INTERVAL '1 minute'),
+           ($3, $4, 'fresh', now() + INTERVAL '1 day')\`,
+        ['a'.repeat(64), expiredEffectPlan, 'f'.repeat(64), freshEffectPlan],
+      );
+      await client.query(
+        \`INSERT INTO records
+           (id, name, owner_id, run_scope, test_expires_at)
+         VALUES
+           ($1::uuid, 'ebk-protected-performance-load', 'ebk-performance',
+            $4, now() - INTERVAL '1 minute'),
+           ($2::uuid, 'ebk-protected-performance-load', 'ebk-performance',
+            $5, now() + INTERVAL '1 day'),
+           ($3::uuid, 'adopter-performance-data', 'adopter-owner',
+            $4, now() - INTERVAL '1 minute')\`,
+        [
+          expiredRecordId,
+          freshRecordId,
+          adopterRecordId,
+          expiredEffectPlan,
+          freshEffectPlan,
+        ],
+      );
+    });
+
+    const emitted: Array<{ metricName?: string; value?: number }> = [];
+    const handler = createInboxCleanupHandler({
+      logger: {
+        error: vi.fn(),
+        info: vi.fn(),
+      } as never,
+      metrics: {
+        emit: (metric: { metricName?: string; value?: number }) => {
+          emitted.push(metric);
+          return {} as never;
+        },
+      } as never,
+      now: Date.now,
+      withDatabase: (async (
+        _context: unknown,
+        _workload: unknown,
+        operation: (client: Client) => Promise<unknown>,
+      ) => withClient(operation)) as never,
+    });
+    await expect(handler({ id: 'performance-expiry-proof' })).resolves.toMatchObject({
+      performanceAuditRetentionDays: 30,
+      performanceCleanupDeadlineHours: 24,
+      reportedPerformanceDeadlineBreaches: 0,
+      remainingPerformanceExpired: 0,
+      removedPerformance: 4,
+    });
+    expect(emitted).toContainEqual(
+      expect.objectContaining({
+        metricName: 'PerformanceLoadCleanupBacklog',
+        value: 0,
+      }),
+    );
+    expect(emitted).toContainEqual(
+      expect.objectContaining({
+        metricName: 'PerformanceLoadCleanupDeadlineBreaches',
+        value: 0,
+      }),
+    );
+
+    await withClient(async (client) => {
+      const effects = await client.query<{ planDigest: string }>(
+        \`SELECT plan_digest AS "planDigest"
+         FROM performance_load_async_effects
+         WHERE plan_digest = ANY($1::text[])
+         ORDER BY plan_digest\`,
+        [[expiredEffectPlan, freshEffectPlan]],
+      );
+      expect(effects.rows).toEqual([{ planDigest: freshEffectPlan }]);
+      const records = await client.query<{ id: string }>(
+        \`SELECT id::text AS id
+         FROM records
+         WHERE id = ANY($1::uuid[])
+         ORDER BY id\`,
+        [[expiredRecordId, freshRecordId, adopterRecordId]],
+      );
+      expect(records.rows).toEqual([
+        { id: freshRecordId },
+        { id: adopterRecordId },
+      ]);
+      const audits = await client.query<{
+        planDigest: string;
+        requests: string;
+      }>(
+        \`SELECT
+           run.plan_digest AS "planDigest",
+           count(request.request_ordinal)::text AS requests
+         FROM performance_load_runs AS run
+         LEFT JOIN performance_load_requests AS request
+           ON request.plan_digest = run.plan_digest
+         WHERE run.plan_digest = ANY($1::text[])
+         GROUP BY run.plan_digest
+         ORDER BY run.plan_digest\`,
+        [[oldPlan, freshPlan]],
+      );
+      expect(audits.rows).toEqual([
+        { planDigest: freshPlan, requests: '1' },
+      ]);
+    });
+  });
+
+  it('durably retries deadline telemetry after deleting stale protected residue', async () => {
+    const stalePlan = 'a'.repeat(64);
+    const staleEffectId = 'b'.repeat(64);
+    const atDeadlinePlan = 'c'.repeat(64);
+    const atDeadlineEffectId = 'd'.repeat(64);
+    const beforeDeadlinePlan = 'e'.repeat(64);
+    const beforeDeadlineEffectId = 'f'.repeat(64);
+    const staleRecordId = '10000000-0000-4000-8000-000000000004';
+    for (const planDigest of [
+      stalePlan,
+      atDeadlinePlan,
+      beforeDeadlinePlan,
+    ]) {
+      touchedPlanDigests.add(planDigest);
+    }
+    await withClient(async (client) => {
+      await client.query(
+        \`INSERT INTO performance_load_async_effects
+           (effect_id, plan_digest, run_id, expires_at)
+         VALUES
+           ($1, $2, 'stale-deadline',
+             clock_timestamp() - INTERVAL '25 hours'),
+           ($3, $4, 'exact-deadline',
+             clock_timestamp() - INTERVAL '24 hours'),
+           ($5, $6, 'before-deadline',
+             clock_timestamp() - INTERVAL '23 hours 59 minutes')\`,
+        [
+          staleEffectId,
+          stalePlan,
+          atDeadlineEffectId,
+          atDeadlinePlan,
+          beforeDeadlineEffectId,
+          beforeDeadlinePlan,
+        ],
+      );
+      await client.query(
+        \`INSERT INTO records
+           (id, name, owner_id, run_scope, test_expires_at)
+         VALUES ($1::uuid, 'ebk-protected-performance-load',
+           'ebk-performance', $2, now() - INTERVAL '25 hours')\`,
+        [staleRecordId, stalePlan],
+      );
+    });
+
+    const failedEmissions: Array<{ metricName?: string; value?: number }> = [];
+    const failedHandler = createInboxCleanupHandler({
+      logger: { error: vi.fn(), info: vi.fn() } as never,
+      metrics: {
+        emit: (metric: { metricName?: string; value?: number }) => {
+          failedEmissions.push(metric);
+          return metric.metricName ===
+            'PerformanceLoadCleanupDeadlineBreaches'
+            ? undefined
+            : ({} as never);
+        },
+      } as never,
+      now: Date.now,
+      withDatabase: (async (
+        _context: unknown,
+        _workload: unknown,
+        operation: (client: Client) => Promise<unknown>,
+      ) => withClient(operation)) as never,
+    });
+    await expect(
+      failedHandler({ id: 'performance-deadline-report-failure' }),
+    ).rejects.toThrow('Performance cleanup deadline metric delivery failed.');
+
+    await withClient(async (client) => {
+      const state = await client.query<{
+        effects: string;
+        records: string;
+        reports: string;
+        resourceRefs: string[];
+      }>(
+        \`SELECT
+           (SELECT count(*)::text
+            FROM performance_load_async_effects
+            WHERE effect_id = ANY($1::text[])) AS effects,
+           (SELECT count(*)::text
+            FROM records
+            WHERE id = $2::uuid) AS records,
+           (SELECT count(*)::text
+            FROM cleanup_deadline_reports
+            WHERE feature = 'performance-load') AS reports,
+           (SELECT array_agg(resource_ref ORDER BY resource_ref)
+            FROM cleanup_deadline_reports
+            WHERE feature = 'performance-load') AS "resourceRefs"\`,
+        [
+          [staleEffectId, atDeadlineEffectId, beforeDeadlineEffectId],
+          staleRecordId,
+        ],
+      );
+      expect(state.rows).toEqual([
+        {
+          effects: '0',
+          records: '0',
+          reports: '3',
+          resourceRefs: [
+            'async-effect:' + staleEffectId,
+            'async-effect:' + atDeadlineEffectId,
+            'record:' + staleRecordId,
+          ].sort(),
+        },
+      ]);
+    });
+    expect(JSON.stringify(failedEmissions)).not.toContain(staleEffectId);
+    expect(JSON.stringify(failedEmissions)).not.toContain(staleRecordId);
+    expect(JSON.stringify(failedEmissions)).not.toContain(atDeadlineEffectId);
+    expect(JSON.stringify(failedEmissions)).not.toContain(
+      beforeDeadlineEffectId,
+    );
+
+    const retryEmissions: Array<{ metricName?: string; value?: number }> = [];
+    const retryHandler = createInboxCleanupHandler({
+      logger: { error: vi.fn(), info: vi.fn() } as never,
+      metrics: {
+        emit: (metric: { metricName?: string; value?: number }) => {
+          retryEmissions.push(metric);
+          return {} as never;
+        },
+      } as never,
+      now: Date.now,
+      withDatabase: (async (
+        _context: unknown,
+        _workload: unknown,
+        operation: (client: Client) => Promise<unknown>,
+      ) => withClient(operation)) as never,
+    });
+    await expect(
+      retryHandler({ id: 'performance-deadline-report-retry' }),
+    ).rejects.toThrow('performance-load-cleanup-deadline-breached');
+    expect(retryEmissions).toContainEqual(
+      expect.objectContaining({
+        metricName: 'PerformanceLoadCleanupDeadlineBreaches',
+        value: 3,
+      }),
+    );
+    expect(JSON.stringify(retryEmissions)).not.toContain(staleEffectId);
+    expect(JSON.stringify(retryEmissions)).not.toContain(staleRecordId);
+    expect(JSON.stringify(retryEmissions)).not.toContain(atDeadlineEffectId);
+    expect(JSON.stringify(retryEmissions)).not.toContain(
+      beforeDeadlineEffectId,
+    );
+
+    await withClient(async (client) => {
+      const reports = await client.query<{ count: string }>(
+        \`SELECT count(*)::text AS count
+         FROM cleanup_deadline_reports
+         WHERE feature = 'performance-load'\`,
+      );
+      expect(reports.rows).toEqual([{ count: '0' }]);
+    });
+    await expect(
+      retryHandler({ id: 'performance-deadline-after-ack' }),
+    ).resolves.toMatchObject({ reportedPerformanceDeadlineBreaches: 0 });
+  });
+});
+`,
+        'web/src/app/%5F%5Febk/performance/api-lambda/route.ts': `import 'server-only';
+import { runPerformanceScenarioEndpoint } from '../handler';
+
+export function GET(request: Request) {
+  return runPerformanceScenarioEndpoint('ebk-api-lambda-v1', request);
+}
+`,
+        'web/src/app/%5F%5Febk/performance/async-worker/route.ts': `import 'server-only';
+import { runPerformanceScenarioEndpoint } from '../handler';
+
+export function POST(request: Request) {
+  return runPerformanceScenarioEndpoint('ebk-async-worker-v1', request);
+}
+`,
+        'web/src/app/%5F%5Febk/performance/async-worker/cleanup/route.ts': `import 'server-only';
+import { runPerformanceCleanupEndpoint } from '../../handler';
+
+export function POST(request: Request) {
+  return runPerformanceCleanupEndpoint('ebk-async-worker-v1', request);
+}
+`,
+        'web/src/app/%5F%5Febk/performance/database/route.ts': `import 'server-only';
+import { runPerformanceScenarioEndpoint } from '../handler';
+
+export function POST(request: Request) {
+  return runPerformanceScenarioEndpoint('ebk-database-v1', request);
+}
+`,
+        'web/src/app/%5F%5Febk/performance/database/cleanup/route.ts': `import 'server-only';
+import { runPerformanceCleanupEndpoint } from '../../handler';
+
+export function POST(request: Request) {
+  return runPerformanceCleanupEndpoint('ebk-database-v1', request);
+}
+`,
+        'docs/runbooks/performance-capacity-cost.md': `# Performance, capacity, and cost
+
+The generated policy is deliberately an unadopted seed. Replace example budgets,
+unknown capacity values, owner, review date, and allocation drivers from actual
+product requirements before protected promotion. Reliability remains authority
+for journey/SLO, alarm, and routing semantics; release and repository policy
+remain authority for candidate and production-profile identity. The performance
+contract consumes those files through explicit hooks and does not duplicate
+their schemas.
+
+Keep warm/cold and cache hit/miss populations separate. Record p50, p95, and p99
+where meaningful, achieved throughput, the first exhausted dependency, quota
+headroom, and the scenario/tool/network limits. Estimates, test measurements,
+and delayed actual billing are different provenance classes. Never label a
+forecast or staging measurement as production actual.
+
+Local commands can validate policy, budgets, capacity, and tag coverage. They
+cannot run protected load. The protected workflow must call
+\`performance-load-guard.mjs\` immediately before an allowlisted runner and
+must bind the exact candidate, target account, Region, endpoint, maximum
+concurrency/rate/requests/duration/cost, stop conditions, cleanup, and emergency
+termination. Production load is exceptional and requires explicit human
+evidence; prefer staging, synthetics, canaries, and production observation.
+The three base-Slice managed adapters use fixed API/Lambda, async-worker, and database
+request/cleanup paths. They remain disabled unless the deployed staging
+environment binds the exact plan, run, release, source commit, scenario, signal,
+adapter, exact Slice URL, and deployment-bound HMAC key ID. The workflow obtains
+only the current per-Slice signer from the exact AWSCURRENT Secrets Manager
+generation after OIDC target verification. Each response must return an
+exact-release JSON telemetry envelope for its reviewed saturation signal.
+Adding a generated Service promotes its reserved scenario to the managed
+Service runtime endpoint, exact per-task admission signal, and cleanup ledger;
+before that generator runs, Service load remains explicitly blocked.
+Next/Lambda heap data is never relabeled as Service evidence. The runner
+computes estimated test cost from the reviewed per-request
+scenario value; target headers are never cost authority. Async and database
+adapters persist a deterministic cleanup identity before each request and
+cleanup must prove every identity absent, including after a runner crash.
+The plan target is the exact fixed adapter request URL—not merely an origin or
+base path—so target approval and the URL actually exercised remain identical.
+The scenario signal must resolve exactly one capacity resource in the
+plan-bound policy; the report binds the adapter and complete scenario-contract
+digest so changed cost, signal, or adoption material cannot reuse evidence.
+
+## Performance load HMAC rotation
+
+The HMAC secret is scoped to one Slice and contains exact \`current\` and
+optional \`previous\` records. The endpoint keeps one resolver for the deployed
+web workload, caches a successful AWSCURRENT read for at most one second, and
+has no stale fallback. Execution accepts only \`current\`; cleanup accepts
+\`current\` or the immediately previous generation so an interrupted old run
+can remove its effects. This control-plane read rate and the corresponding
+Secrets Manager request cost belong in the load cost model.
+
+Each \`secret\` is the canonical unpadded base64url encoding of exactly 32
+cryptographically random bytes (43 characters). Generate a new value with a
+reviewed cryptographic random-byte source; a long passphrase, repeated text, or
+arbitrary 32-character string is rejected.
+
+For routine rotation, disable new performance runs, publish
+\`{ current: new, previous: old }\`, deploy, and prove every endpoint observes
+the new key within the one-second cache bound. Then switch the protected signer
+to the new current key and re-enable new runs. Retain previous until all jobs
+signed by it are terminal, cleanup and expiry backlogs are zero, and both the
+24-hour authorization window and subsequent 24-hour cleanup window have
+elapsed. Do not start another rotation or retire previous during that overlap.
+The hourly worker measures residue at least 24 hours past its
+eligible expiry, emits \`PerformanceLoadCleanupDeadlineBreaches\`, and fails the
+invocation so the dedicated alarm cannot silently clear. This is an executable
+deadline-violation signal, not a claim that deletion succeeds through an AWS or
+database outage. Previous-key retirement remains a protected operator action;
+operators must not retire it while either cleanup metric is nonzero.
+For suspected compromise, disable the workflow and endpoint first, rotate,
+redeploy, and investigate before restoring access.
+
+Evidence retains only the bounded HMAC key ID. Never log, hash, upload, or place
+the secret in GitHub environment output. Live rotation evidence must show
+current execution succeeds, previous execution fails, previous cleanup
+succeeds, retired cleanup fails, cross-Slice substitution fails, and no secret
+sentinel appears in logs or retained artifacts.
+
+## AWS cost controls
+
+Protected deployments fail until the seeded cost policy names a real owner, a
+future review instant, and declares the account, pilot, anomaly, notification,
+and per-test values adopted. Stable v1 provisions these controls only in the
+commercial \`aws\` partition, where the workload account is also the billing
+authority. GovCloud, China, and isolated partitions fail before resource
+construction; a separately modeled commercial billing-account provider is
+required before those partitions can adopt this path. The protected Foundation
+stack is the sole owner of the account monthly actual/forecast Budget. It
+publishes the exact policy digest and monthly maximum through Foundation
+discovery. Every protected Product plan must bind both and adopt the same
+maximum before creating a cost resource. The production Product stack creates
+only the Slice-tag-filtered custom Cost Anomaly monitor plus its immediate SNS
+subscription. The custom monitor avoids the
+one-per-account dimensional-monitor collision when several Slices coexist. The
+staging Product stack creates the lower pilot monthly Budget filtered to the exact
+\`ebk:slice\` and \`ebk:stage=staging\` allocation tags. Personal and
+development stages create none of these global billing resources.
+
+Both Budgets and the anomaly subscription route only to the Foundation alert
+topic and retain the policy digest, semantic route, and named owner in resource
+tags. The Foundation topic policy must allow only \`sns:Publish\` from
+\`budgets.amazonaws.com\`, \`costalerts.amazonaws.com\`, and its existing RDS
+events publisher. These controls notify; generated infrastructure contains no
+BudgetAction, auto-adjustment, stop, throttle, IAM-policy change, or other
+automatic spend-changing response. Investigate through the named owner and
+runbook, then use a separately approved owning tool for any intervention.
+
+Every supported resource must carry the bounded workspace/Slice/stage/owner/
+repository/profile/managed-by/framework tags where AWS supports them.
+Unsupported resources remain visible with a reason and shared-cost allocation
+reference. Never use feature, user, tenant, request, work-item, payload, or raw
+error identifiers as resource tags or metric dimensions.
+Tag coverage compares observations with a nonempty exact resource inventory
+derived from deployment plan/state and bound to the same release; an empty,
+omitted, extra, or cross-release inventory fails. The external cost collection
+contract names its adopter-owned read-only collector and requires canonical
+closed-window AWS Cost Explorer allocation and total queries. Evidence binds
+the STS-derived account fingerprint, Region, stage, workspace, Slice, period,
+release/source, request identities, response digests, reconciled allocation
+rows, and independently sourced aggregate-count evidence. Generation does not
+manufacture live cost values.
+The managed PR budget derives its observation directly from the completed
+Next.js client artifact and does not consume caller-authored measurements.
+Adopter performance budgets remain a separate readiness and exact-release
+evaluation. Unit-cost evaluation validates baseline and current billing
+evidence before it accepts observations. Each of the two capability
+observations must name the exact allocation and aggregate identifiers, amounts,
+counts, evidence digests, account, Region, stage, workspace, Slice, period, and
+release from that validated evidence; clean generation reports the missing live
+evidence as incomplete.
+
+The generated scenarios cover API/Lambda, async worker, database cold resume,
+and a Service extension that becomes managed when its Service is generated,
+but are disabled until deliberately adopted. A clean generated Slice therefore reports incomplete rather than
+claiming capacity, cost, or live load evidence.
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-performance-files.js.map