feat(foundry): productionize Cesium Map Page and platform runtime

2026-07-16 02:25:58 +03:00
parent 1a2ca8c82c
commit 5e8c1cc3fc
41 changed files with 6977 additions and 179 deletions
@@ -0,0 +1,49 @@
+# Foundry Data Product bindings
+
+`NDC Foundry Binding` is a deploy/control-plane operation. Realtime facts do
+not pass through the node: Foundry persists an approved page-slot binding and
+its same-origin BFF reads snapshot + patch from External Data Plane.
+
+## Private workload API
+
+```text
+GET  /internal/foundry/v1/data-products
+POST /internal/foundry/v1/data-product-bindings
+Authorization: Bearer ndc_fndbg_<opaque capability>
+```
+
+The POST body is `nodedc.foundry.binding-upsert/v1`. It contains only
+application, page, binding, Data Product projection and a stable idempotency
+key. Provider, tenant, connection, endpoint, URL, raw payload and credentials
+are rejected.
+
+This credential is not a Foundry MCP `fnd1.*` capability. MCP capabilities are
+short-lived interactive grants for AI Workspace. It is also not
+`NODEDC_INTERNAL_ACCESS_TOKEN`, a browser session, or an EDP writer/reader
+grant.
+
+## Workload grant
+
+The opaque value never enters a Foundry env file or application manifest.
+Foundry hashes it with SHA-256 and resolves a root-owned, non-writable record
+from `NODEDC_FOUNDRY_BINDING_GRANTS_DIR` on every request. Removing or replacing
+the record therefore revokes or rotates access immediately.
+
+A `nodedc.module-foundry.binding-grant.v1` record fixes:
+
+- expiry and actions (`catalog.read`, `map-data-product.upsert`);
+- actor and owner used by the existing replay-safe Foundry write path;
+- exact allowlisted tuples of application, page, binding, slot, Data Product,
+  semantic types and field projection.
+
+No authorization claim is accepted from request headers or workflow data.
+
+Before persisting a binding, Foundry verifies that the target-specific EDP
+reader grant exists, is active, permits the selected product and exposes a
+`snapshot+patch` product. The reader grant filename remains
+`sha256(applicationId/pageId/bindingId)`. If it is not ready, POST fails with
+`409 data_product_reader_grant_not_ready`; an unusable visual binding is never
+saved.
+
+The canonical Map entity-stream slot is `points`. Other templates may define
+their own typed slots, but the workload grant must name them explicitly.