feat(reporting-governance): wire profile artifacts into contract and orchestrator

plugins/reporting-governance/src/storage/profile-artifact.mjs

@@ -3,11 +3,58 @@ import path from 'node:path';
 
 const packageRoot = path.resolve(import.meta.dirname, '..', '..');
 const repoRoot = path.resolve(packageRoot, '..', '..');
+const EXPECTED_KIND = 'DeploymentProfileArtifact';
+const EXPECTED_API_VERSION = 'reporting-governance/v1alpha1';
 
 function readJsonFile(filePath) {
   return JSON.parse(fs.readFileSync(filePath, 'utf8'));
 }
 
+function assertNonEmptyString(value, label) {
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw new Error(`${label} must be a non-empty string`);
+  }
+  return value.trim();
+}
+
+function assertObjectRecord(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`${label} must be an object record`);
+  }
+  return value;
+}
+
+export function validateDeploymentProfileArtifact(artifact) {
+  if (!artifact || typeof artifact !== 'object' || Array.isArray(artifact)) {
+    throw new Error('deployment profile artifact must be an object');
+  }
+  if (artifact.kind !== EXPECTED_KIND) {
+    throw new Error(`deployment profile artifact kind must be ${EXPECTED_KIND}`);
+  }
+  if (artifact.apiVersion !== EXPECTED_API_VERSION) {
+    throw new Error(`deployment profile artifact apiVersion must be ${EXPECTED_API_VERSION}`);
+  }
+
+  const bindings = artifact?.spec?.bindings;
+  if (!bindings || typeof bindings !== 'object' || Array.isArray(bindings)) {
+    throw new Error('deployment profile artifact bindings are required');
+  }
+
+  assertNonEmptyString(bindings.entrypoint, 'deployment profile artifact spec.bindings.entrypoint');
+  const scripts = assertObjectRecord(bindings.scripts, 'deployment profile artifact spec.bindings.scripts');
+  const artifactRoots = assertObjectRecord(bindings.artifact_roots, 'deployment profile artifact spec.bindings.artifact_roots');
+  assertNonEmptyString(artifact?.spec?.package?.pluginVersion, 'deployment profile artifact spec.package.pluginVersion');
+
+  for (const [key, relativePath] of Object.entries(scripts)) {
+    assertNonEmptyString(relativePath, `deployment profile artifact spec.bindings.scripts.${key}`);
+  }
+  for (const [key, relativePath] of Object.entries(artifactRoots)) {
+    assertNonEmptyString(relativePath, `deployment profile artifact spec.bindings.artifact_roots.${key}`);
+  }
+
+  return artifact;
+}
+
 export function resolvePackageArtifactPath(...segments) {
   return path.resolve(packageRoot, ...segments);
 }
@@ -17,7 +64,7 @@ export function loadDeploymentProfileArtifact({ artifactPath, profileId } = {})
     artifactPath
       ?? resolvePackageArtifactPath('profiles', `${profileId ?? 'strict-manager-mode'}.profile.json`)
   );
-  const artifact = readJsonFile(resolvedPath);
+  const artifact = validateDeploymentProfileArtifact(readJsonFile(resolvedPath));
   return {
     artifactPath: resolvedPath,
     artifact,
@@ -25,30 +72,30 @@ export function loadDeploymentProfileArtifact({ artifactPath, profileId } = {})
 }
 
 export function createDeploymentBindingContract({ artifact, repoRootOverride } = {}) {
-  if (!artifact?.spec?.bindings) {
-    throw new Error('deployment profile artifact bindings are required');
-  }
-
+  const validatedArtifact = validateDeploymentProfileArtifact(artifact);
   const root = path.resolve(repoRootOverride ?? repoRoot);
   const scripts = Object.fromEntries(
-    Object.entries(artifact.spec.bindings.scripts ?? {}).map(([key, relativePath]) => [key, path.resolve(root, relativePath)])
+    Object.entries(validatedArtifact.spec.bindings.scripts).map(([key, relativePath]) => [key, path.resolve(root, relativePath)])
   );
   const artifactRoots = Object.fromEntries(
-    Object.entries(artifact.spec.bindings.artifact_roots ?? {}).map(([key, relativePath]) => [key, path.resolve(root, relativePath)])
+    Object.entries(validatedArtifact.spec.bindings.artifact_roots).map(([key, relativePath]) => [key, path.resolve(root, relativePath)])
   );
 
   return {
-    runtime: artifact.spec.bindings.runtime ?? artifact.metadata?.runtime ?? 'unknown-runtime',
-    entrypoint: path.resolve(root, artifact.spec.bindings.entrypoint),
-    pluginVersion: artifact.spec?.package?.pluginVersion ?? null,
-    compatibilityMode: artifact.metadata?.compatibility_mode ?? 'strict_envelope',
+    runtime: validatedArtifact.spec.bindings.runtime ?? validatedArtifact.metadata?.runtime ?? 'unknown-runtime',
+    entrypoint: path.resolve(root, validatedArtifact.spec.bindings.entrypoint),
+    pluginVersion: validatedArtifact.spec.package.pluginVersion,
+    compatibilityMode: validatedArtifact.metadata?.compatibility_mode ?? 'strict_envelope',
     scripts,
     artifactRoots,
   };
 }
 
 export const __testables = {
+  EXPECTED_KIND,
+  EXPECTED_API_VERSION,
   packageRoot,
   repoRoot,
   readJsonFile,
+  validateDeploymentProfileArtifact,
 };