feat(data-plane): add signed managed writer bindings

services/external-data-plane/test/writer-binding.test.mjs

@@ -1,12 +1,14 @@
 import assert from "node:assert/strict";
-import { validateIntakeBatch } from "../../../packages/external-provider-contract/src/index.mjs";
+import { validateIntakeBatch } from "../../../packages/external-provider-contract/src/data-plane.mjs";
 import {
   createWriterToken,
   hashWriterToken,
   materializeDataProductPublish,
   materializeWriterBoundBatch,
+  normalizeManagedWriterBindingRequest,
   normalizeWriterBindingRequest,
   safeWriterBinding,
+  writerBindingRequestHash,
 } from "../src/writer-binding.mjs";
 
 const now = new Date("2026-07-15T12:00:00.000Z");
@@ -34,6 +36,39 @@ assert.match(token, /^ndc_edpwb_[A-Za-z0-9_-]{40,}$/);
 assert.equal(hashWriterToken(token), hashWriterToken(token));
 assert.notEqual(hashWriterToken(token), hashWriterToken(`${token}x`));
 
+const managedPolicy = normalizeManagedWriterBindingRequest({
+  ...request,
+  allowedDataProductIds: ["fleet.positions.current.v1", "asset.status.current.v1"],
+  generation: 1,
+  capabilityDigest: hashWriterToken(token),
+}, { now, maxTtlDays: 90 });
+assert.deepEqual(managedPolicy.allowedDataProductIds, [
+  "asset.status.current.v1",
+  "fleet.positions.current.v1",
+]);
+assert.equal(managedPolicy.generation, 1);
+assert.equal(managedPolicy.capabilityDigest, hashWriterToken(token));
+assert.equal(writerBindingRequestHash(managedPolicy), writerBindingRequestHash({
+  ...managedPolicy,
+  allowedDataProductIds: [...managedPolicy.allowedDataProductIds].reverse(),
+}));
+assert.throws(() => normalizeManagedWriterBindingRequest({
+  ...request,
+  generation: 0,
+  capabilityDigest: hashWriterToken(token),
+}, { now, maxTtlDays: 90 }), /managed_writer_binding_generation_invalid/);
+assert.throws(() => normalizeManagedWriterBindingRequest({
+  ...request,
+  generation: 1,
+  capabilityDigest: "not-a-digest",
+}, { now, maxTtlDays: 90 }), /managed_writer_binding_capability_digest_invalid/);
+assert.throws(() => normalizeManagedWriterBindingRequest({
+  ...request,
+  generation: 1,
+  capabilityDigest: hashWriterToken(token),
+  token,
+}, { now, maxTtlDays: 90 }), /managed_writer_binding_secret_material_forbidden/);
+
 const unscopedBatch = {
   schemaVersion: "nodedc.external-provider-contract/v1",
   source: { providerId: "example-provider" },