# Foundry Data Product bindings

`NDC Foundry Binding` is a deploy/control-plane operation. Realtime facts do
not pass through the node: Foundry persists an approved page-slot binding and
its same-origin BFF reads snapshot + patch from External Data Plane.

## Private workload API

```text
GET  /internal/foundry/v1/data-products
POST /internal/foundry/v1/data-product-bindings
Authorization: Bearer ndc_fndbg_<opaque capability>
```

The POST body is `nodedc.foundry.binding-upsert/v1`. It contains only
application, page, binding, Data Product projection and a stable idempotency
key. Provider, tenant, connection, endpoint, URL, raw payload and credentials
are rejected.

This credential is not a Foundry MCP `fnd1.*` capability. MCP capabilities are
short-lived interactive grants for AI Workspace. It is also not
`NODEDC_INTERNAL_ACCESS_TOKEN`, a browser session, or an EDP writer/reader
grant.

## Workload grant

The opaque value never enters a Foundry env file or application manifest.
Foundry hashes it with SHA-256 and resolves a root-owned, non-writable record
from `NODEDC_FOUNDRY_BINDING_GRANTS_DIR` on every request. Removing or replacing
the record therefore revokes or rotates access immediately.

A `nodedc.module-foundry.binding-grant.v1` record fixes:

- expiry and actions (`catalog.read`, `map-data-product.upsert`);
- actor and owner used by the existing replay-safe Foundry write path;
- exact allowlisted tuples of application, page, binding, slot, Data Product,
  semantic types and field projection.

No authorization claim is accepted from request headers or workflow data.

Before persisting a binding, Foundry verifies that the target-specific EDP
reader grant exists, is active, permits the selected product and exposes a
`snapshot+patch` product. The reader grant filename remains
`sha256(applicationId/pageId/bindingId)`. If it is not ready, POST fails with
`409 data_product_reader_grant_not_ready`; an unusable visual binding is never
saved.

The canonical Map entity-stream slot is `points`. Other templates may define
their own typed slots, but the workload grant must name them explicitly.