feat(deploy): extend canon for managed EDP and Engine grants

infra/deploy-runner/build-external-data-plane-artifact.mjs

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { cp, lstat, mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const scriptDir = dirname(fileURLToPath(import.meta.url));
 const platformRoot = resolve(scriptDir, "../..");
-const artifactDir = resolve(scriptDir, "../deploy-artifacts");
+const artifactDir = resolve(process.env.NODEDC_DEPLOY_ARTIFACT_DIR || resolve(scriptDir, "../deploy-artifacts"));
 const [patchId = "external-data-plane-20260714-001", ...extra] = process.argv.slice(2);
 
 if (extra.length || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId)) {
@@ -18,13 +18,21 @@ if (extra.length || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId)) {
 const files = [
   ["infra/synology/docker-compose.external-data-plane.yml", "platform/docker-compose.external-data-plane.yml"],
   ["services/external-data-plane", "platform/services/external-data-plane"],
-  ["packages/external-provider-contract", "platform/packages/external-provider-contract"],
+  ["packages/external-provider-contract/package.json", "platform/packages/external-provider-contract/package.json"],
+  ["packages/external-provider-contract/src/contract-version.mjs", "platform/packages/external-provider-contract/src/contract-version.mjs"],
+  ["packages/external-provider-contract/src/data-plane.mjs", "platform/packages/external-provider-contract/src/data-plane.mjs"],
+  ["packages/external-provider-contract/src/data-product.mjs", "platform/packages/external-provider-contract/src/data-product.mjs"],
+  ["packages/external-provider-contract/src/intake-batch.mjs", "platform/packages/external-provider-contract/src/intake-batch.mjs"],
+  ["packages/external-provider-contract/src/sensitive-field-policy.mjs", "platform/packages/external-provider-contract/src/sensitive-field-policy.mjs"],
 ];
 const ignoredBasenames = new Set([".DS_Store", ".git", "node_modules"]);
+const ignoredDirectoryNames = new Set(["test"]);
 const stage = await mkdtemp(join(tmpdir(), "nodedc-external-data-plane-artifact-"));
 const payload = join(stage, "payload");
 const target = join(artifactDir, `nodedc-platform-${patchId}.tgz`);
 
+await assertSourceBoundary();
+
 try {
   await mkdir(payload, { recursive: true });
   for (const [sourceRelative, destinationRelative] of files) {
@@ -34,19 +42,66 @@ try {
   await writeFile(join(stage, "files.txt"), `${files.map(([, destination]) => destination).join("\n")}\n`, "utf8");
   await mkdir(artifactDir, { recursive: true });
 
-  const tar = spawnSync("python3", ["-c", [
-    "import sys, tarfile",
-    "with tarfile.open(sys.argv[1], 'w:gz', format=tarfile.PAX_FORMAT) as archive:",
-    "    [archive.add(name, arcname=name, recursive=True) for name in ('manifest.env', 'files.txt', 'payload')]",
-  ].join("\n"), target], { cwd: stage, encoding: "utf8" });
+  const tar = spawnSync("python3", ["-c", canonicalTarScript(), target, stage], {
+    encoding: "utf8",
+    maxBuffer: 128 * 1024 * 1024,
+  });
   if (tar.status !== 0) throw new Error(`tar_failed:${tar.stderr || tar.stdout}`);
 
-  const digest = createHash("sha256").update(await (await import("node:fs/promises")).readFile(target)).digest("hex");
-  console.log(JSON.stringify({ ok: true, patchId, artifact: target, sha256: digest }, null, 2));
+  const digest = createHash("sha256").update(await readFile(target)).digest("hex");
+  console.log(JSON.stringify({
+    ok: true,
+    patchId,
+    artifact: target,
+    sha256: digest,
+    entries: files.map(([, destination]) => destination),
+    excluded: [
+      ".env*",
+      "node_modules",
+      "services/external-data-plane/test",
+      "private-key.pem",
+      "secrets",
+    ],
+  }, null, 2));
 } finally {
   await rm(stage, { recursive: true, force: true });
 }
 
+async function assertSourceBoundary() {
+  const compose = await readFile(
+    resolve(platformRoot, "infra/synology/docker-compose.external-data-plane.yml"),
+    "utf8",
+  );
+  for (const fragment of [
+    "source: /volume1/docker/nodedc-platform/trust/engine-managed-provisioner",
+    "target: /run/nodedc-trust/engine-managed-provisioner",
+    "EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: /run/nodedc-trust/engine-managed-provisioner/public-key.pem",
+    "create_host_path: false",
+  ]) {
+    if (!compose.includes(fragment)) throw new Error(`platform_compose_boundary_missing:${fragment}`);
+  }
+  if (
+    compose.includes("private-key.pem")
+    || compose.includes("ENGINE_EDP_MANAGED_PROVISIONER_PRIVATE_KEY_FILE")
+  ) throw new Error("platform_artifact_private_key_boundary_violation");
+}
+
+function canonicalTarScript() {
+  return [
+    "import gzip, io, pathlib, sys, tarfile",
+    "root=pathlib.Path(sys.argv[2])",
+    "with open(sys.argv[1], 'wb') as out:",
+    "  with gzip.GzipFile(filename='', mode='wb', fileobj=out, compresslevel=9, mtime=0) as gz:",
+    "    with tarfile.open(fileobj=gz, mode='w', format=tarfile.PAX_FORMAT) as tar:",
+    "      for top in ('manifest.env','files.txt','payload'):",
+    "        p=root/top; paths=[p] + (sorted(p.rglob('*')) if p.is_dir() else [])",
+    "        for x in paths:",
+    "          info=tar.gettarinfo(str(x), arcname=x.relative_to(root).as_posix())",
+    "          info.uid=info.gid=0; info.uname=info.gname='root'; info.mtime=0; info.mode=0o755 if info.isdir() else 0o644",
+    "          with (open(x,'rb') if info.isfile() else io.BytesIO()) as src: tar.addfile(info, src if info.isfile() else None)",
+  ].join("\n");
+}
+
 async function copySafe(source, destination) {
   const sourceStat = await lstat(source);
   if (sourceStat.isSymbolicLink()) throw new Error(`source_symlink_rejected:${source}`);
@@ -60,6 +115,7 @@ async function copySafe(source, destination) {
   await mkdir(destination, { recursive: true });
   for (const entry of await readdir(source, { withFileTypes: true })) {
     if (ignoredBasenames.has(entry.name) || entry.name.startsWith(".env")) continue;
+    if (entry.isDirectory() && ignoredDirectoryNames.has(entry.name)) continue;
     const childSource = join(source, entry.name);
     const childDestination = join(destination, entry.name);
     if (entry.isSymbolicLink()) throw new Error(`source_symlink_rejected:${relative(platformRoot, childSource)}`);