@synopackageland/cli 0.4.1 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/jobcontract/contract_test.go

@@ -0,0 +1,436 @@
+package jobcontract
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+)
+
+func opaque(id string) string   { h := sha256.Sum256([]byte(id)); return hex.EncodeToString(h[:]) }
+func ref(id string) RevisionRef { return RevisionRef{ID: opaque(id), Revision: 1} }
+func digest() string            { return strings.Repeat("a", 64) }
+func inputFixture() Input {
+	n := uint64(12)
+	return Input{Steps: []Step{{Action: Read, Segments: []string{"\u5831\u544a<&\U0001f600"}, MaxBytes: &n}}}
+}
+func bindingFixture() Binding {
+	return Binding{Inventory: Inventory{Package: "fixture", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: digest(), RegistryDigest: digest(), DataAccess: "relaxed"}, JobSchema: 1, Epoch: opaque("epoch-1"), Job: ref("job-1"), Worker: ref("worker-1"), ParentGrant: ref("grant-1"), ApprovalBinding: digest(), CapabilityDigest: digest(), InputSchemaDigest: digest(), InputDigest: digest(), Mode: Interactive}
+}
+func controlFixture() Control {
+	return Control{Op: "jobs.submit", Binding: bindingFixture(), Intent: ref("intent-1"), Nonce: opaque("nonce-1"), Ticket: opaque("ticket-1")}
+}
+func workerFixture() Worker {
+	return Worker{RegistrySchema: 2, ID: "worker-1", Revision: 1, Kind: "sdk-read-plan", HandlerBinding: digest(), InputSchemaDigest: digest(), OutputSchemaDigest: digest(), Actions: []Action{List, Stat, Read, ReadStream}, Modes: []Mode{Interactive, Background}, Checkpoints: []string{"before-step", "before-chunk", "before-result"}, Limits: HardLimits()}
+}
+func wire(t *testing.T, v any) []byte {
+	t.Helper()
+	b, e := json.Marshal(v)
+	if e != nil {
+		t.Fatal(e)
+	}
+	return b
+}
+
+func TestStrictInputAndTypedDigest(t *testing.T) {
+	raw := []byte(` { "steps" : [{"maxBytes":12,"segments":["\u5831\u544a<&\ud83d\ude00"],"action":"nas.files.read"}] } `)
+	in, c := DecodeInput(bytes.NewReader(raw))
+	if c != "" {
+		t.Fatal(c)
+	}
+	a, c := InputDigest(in, digest())
+	if c != "" {
+		t.Fatal(c)
+	}
+	b, c := InputDigest(inputFixture(), digest())
+	if c != "" || a != b {
+		t.Fatal("representation changed digest", a, b, c)
+	}
+	if a != "7e811bf2b8253e47a4b85b596c7b7224fa358470868c0fbe02b4bd05c2bf9b8e" {
+		t.Fatal("input v1 golden changed", a)
+	}
+	for _, raw := range []string{
+		`{"steps":[],"extra":1}`, `{"Steps":[]}`, `{"steps":[],"steps":[]}`,
+		`{"steps":[],"st\u0065ps":[]}`, `{"steps":null}`, `{"steps":[]} {}`,
+		`{"steps":[{"action":"nas.files.stat","segments":[],"segments":[]}]}`,
+		`{"steps":[{"action":"nas.files.stat","segments":null}]}`,
+		`{"steps":[{"action":"nas.files.stat","segments":["\ud800"]}]}`,
+		`{"steps":[{"action":"nas.files.stat","segments":["\udc00"]}]}`,
+		`{"steps":[{"action":"nas.files.read","segments":["x"],"maxBytes":null}]}`,
+		`{"steps":[{"action":"nas.files.read","segments":["x"],"maxBytes":18446744073709551616}]}`,
+		`{"steps":[{"action":"nas.files.read","segments":["x"],"maxBytes":-1}]}`,
+		`{"steps":[{"action":"nas.files.read","segments":["x"],"maxBytes":1.5}]}`,
+	} {
+		if _, c := DecodeInput(strings.NewReader(raw)); c == "" {
+			t.Fatalf("accepted invalid input %s", raw)
+		}
+	}
+	invalidUTF8 := append([]byte(`{"steps":[{"action":"nas.files.stat","segments":["`), 0xff)
+	invalidUTF8 = append(invalidUTF8, []byte(`"]}]}`)...)
+	if _, c := DecodeInput(bytes.NewReader(invalidUTF8)); c != Invalid {
+		t.Fatal(c)
+	}
+	if _, c := DecodeInput(strings.NewReader(strings.Repeat(" ", MaxInputBytes) + string(raw))); c != LimitExceeded {
+		t.Fatal(c)
+	}
+	in.Steps[0].Segments = []string{"\u00e9"}
+	x, _ := InputDigest(in, digest())
+	in.Steps[0].Segments = []string{"e\u0301"}
+	y, _ := InputDigest(in, digest())
+	if x == y {
+		t.Fatal("Unicode normalized")
+	}
+	if _, c := InputDigest(in, "bad"); c != Invalid {
+		t.Fatal(c)
+	}
+}
+
+func TestSharedInputDigestVectors(t *testing.T) {
+	b, err := os.ReadFile("testdata/input-digests.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var vectors []struct {
+		Name         string
+		Input        Input
+		SchemaDigest string
+		Digest       string
+	}
+	if err := json.Unmarshal(b, &vectors); err != nil {
+		t.Fatal(err)
+	}
+	if len(vectors) != 6 {
+		t.Fatal("missing canonical vectors")
+	}
+	for _, v := range vectors {
+		t.Run(v.Name, func(t *testing.T) {
+			in, c := DecodeInput(bytes.NewReader(wire(t, v.Input)))
+			if c != "" {
+				t.Fatal(c)
+			}
+			got, c := InputDigest(in, v.SchemaDigest)
+			if c != "" || got != v.Digest {
+				t.Fatal(got, c)
+			}
+		})
+	}
+}
+
+func TestEveryRecordUsesStrictDecoder(t *testing.T) {
+	b := privateFixture()
+	in := inputFixture()
+	b.Binding.InputDigest, _ = InputDigest(in, digest())
+	i := Intent{JobSchema: 1, ID: opaque("intent-1"), Revision: 1, Binding: b, Input: in, SummaryDigest: digest(), CreatedAt: 1000, ExpiresAt: 31000}
+	for _, record := range []struct {
+		name   string
+		value  any
+		decode func([]byte) SafeReason
+	}{
+		{"worker", workerFixture(), func(b []byte) SafeReason { _, c := DecodeWorker(bytes.NewReader(b)); return c }},
+		{"intent", i, func(b []byte) SafeReason { _, c := DecodeIntent(bytes.NewReader(b)); return c }},
+		{"background", backgroundFixture(), func(b []byte) SafeReason { _, c := DecodeBackground(bytes.NewReader(b)); return c }},
+		{"job", jobFixture(), func(b []byte) SafeReason { _, c := DecodeJob(bytes.NewReader(b)); return c }},
+	} {
+		t.Run(record.name, func(t *testing.T) {
+			b := wire(t, record.value)
+			if c := record.decode(b); c != "" {
+				t.Fatal(c)
+			}
+			for _, raw := range []string{`null`, `{}`, `[]`, string(b) + `{}`, `{"extra":1,` + string(b[1:]), `{"extra":null,` + string(b[1:])} {
+				if c := record.decode([]byte(raw)); c != Invalid {
+					t.Fatal("invalid record accepted", c)
+				}
+			}
+			if c := record.decode(append(bytes.Repeat([]byte(" "), MaxArtifactBytes), b...)); c != LimitExceeded {
+				t.Fatal("unbounded record", c)
+			}
+		})
+	}
+}
+
+func TestPlanNarrowsDescriptorAndSafeReasons(t *testing.T) {
+	w, in := workerFixture(), inputFixture()
+	if c := ValidatePlan(w, in, Background); c != "" {
+		t.Fatal(c)
+	}
+	w.Modes = []Mode{Interactive}
+	if c := ValidatePlan(w, in, Background); c != Unsupported {
+		t.Fatal(c)
+	}
+	w = workerFixture()
+	w.Actions = []Action{Stat}
+	if c := ValidatePlan(w, in, Interactive); c != Unsupported {
+		t.Fatal(c)
+	}
+	w = workerFixture()
+	w.Limits.BoundedBytes = 11
+	if c := ValidatePlan(w, in, Interactive); c != LimitExceeded {
+		t.Fatal(c)
+	}
+	w = workerFixture()
+	w.Limits.InputBytes = 1
+	if c := ValidatePlan(w, in, Interactive); c != LimitExceeded {
+		t.Fatal(c)
+	}
+	for _, c := range []SafeReason{Invalid, Incompatible, Unsupported, Replay, Stale, Expired, Denied, Unavailable, Suspended, Revoked, Fenced, Busy, LimitExceeded, ReasonCanceled, Timeout, Partial, CommitUncertain, ReasonCleanupRequired, Internal} {
+		if !c.Valid() || c.Error() != string(c) {
+			t.Fatal(c)
+		}
+	}
+	for _, c := range []SafeReason{"", "/secret/path", "new-native-error"} {
+		if c.Valid() {
+			t.Fatal("open safe reason enum", c)
+		}
+	}
+	for _, from := range []State{Succeeded, Failed, Canceled, Interrupted} {
+		for _, to := range []State{Pending, Running, CancelRequested, Draining, Succeeded, Failed, Canceled, Interrupted, CleanupRequired} {
+			if TransitionAllowed(from, to) {
+				t.Fatal("terminal resurrection", from, to)
+			}
+		}
+	}
+}
+
+func TestFixedPlanActionsPathsAndWholeJobLimits(t *testing.T) {
+	for _, mutate := range []func(*Input){
+		func(x *Input) { x.Steps = nil }, func(x *Input) { x.Steps = []Step{} },
+		func(x *Input) { x.Steps[0].Action = "nas.files.create" },
+		func(x *Input) { x.Steps[0].MaxBytes = nil },
+		func(x *Input) { n := uint64(0); x.Steps[0].MaxBytes = &n },
+		func(x *Input) { n := uint64(1); x.Steps[0].Limit = &n },
+		func(x *Input) { x.Steps[0].Segments = []string{".."} },
+		func(x *Input) { x.Steps[0].Segments = []string{"a/b"} },
+		func(x *Input) { x.Steps[0].Segments = []string{"a\\b"} },
+		func(x *Input) { x.Steps[0].Segments = []string{"\x00"} },
+		func(x *Input) { x.Steps[0].Segments = []string{} },
+		func(x *Input) { x.Steps = make([]Step, MaxSteps+1) },
+	} {
+		x := inputFixture()
+		mutate(&x)
+		if c := ValidateInput(x); c == "" {
+			t.Fatal("invalid plan accepted", x)
+		}
+	}
+	n := uint64(64 << 20)
+	x := Input{Steps: []Step{{Action: ReadStream, Segments: []string{"x"}, MaxBytes: &n}}}
+	if c := ValidateInput(x); c != "" {
+		t.Fatal(c)
+	}
+	x.Steps = append(x.Steps, x.Steps[0])
+	if c := ValidateInput(x); c != LimitExceeded {
+		t.Fatal("per-step reset", c)
+	}
+	x = Input{Steps: []Step{{Action: Stat, Segments: []string{}}}}
+	if c := ValidateInput(x); c != "" {
+		t.Fatal(c)
+	}
+	for _, s := range []string{"%2f", "\u5831\u544a\U0001f600"} {
+		x.Steps[0].Segments = []string{s}
+		if c := ValidateInput(x); c != "" {
+			t.Fatal("literal path changed", c)
+		}
+	}
+}
+
+func TestWorkerDescriptorAndLimits(t *testing.T) {
+	w := workerFixture()
+	if _, c := DecodeWorker(bytes.NewReader(wire(t, w))); c != "" {
+		t.Fatal(c)
+	}
+	for _, mutate := range []func(*Worker){
+		func(w *Worker) { w.RegistrySchema = 1 }, func(w *Worker) { w.Kind = "developer-binary" },
+		func(w *Worker) { w.Actions = append(w.Actions, w.Actions[0]) },
+		func(w *Worker) { w.Modes = append(w.Modes, w.Modes[0]) },
+		func(w *Worker) { w.Checkpoints = []string{"before-step"} },
+		func(w *Worker) { w.Actions = []Action{"nas.files.publish"} },
+		func(w *Worker) { w.Limits.TotalMS++ }, func(w *Worker) { w.Limits.IdleMS = 0 },
+		func(w *Worker) { w.Limits.OutstandingLeases = 2 }, func(w *Worker) { w.Revision = MaxSafeInteger + 1 },
+	} {
+		w := workerFixture()
+		mutate(&w)
+		if _, c := DecodeWorker(bytes.NewReader(wire(t, w))); c == "" {
+			t.Fatal("bad worker accepted", w)
+		}
+	}
+	w = workerFixture()
+	w.Limits.Steps = 1
+	if _, c := DecodeWorker(bytes.NewReader(wire(t, w))); c != "" {
+		t.Fatal("lower ceiling rejected", c)
+	}
+}
+
+func TestControlVersionAndModeSeparation(t *testing.T) {
+	r := controlFixture()
+	if _, c := DecodeControl(bytes.NewReader(wire(t, r))); c != "" {
+		t.Fatal(c)
+	}
+	for _, mutate := range []func(*Control){
+		func(r *Control) { r.Binding.Inventory.Protocol = 1 }, func(r *Control) { r.Binding.JobSchema = 0 },
+		func(r *Control) { r.Binding.Inventory.DataAccess = "unavailable" }, func(r *Control) { r.Binding.Inventory.DataAccess = "strict" },
+		func(r *Control) { r.Binding.Mode = "managed" }, func(r *Control) { d := ref("d"); r.Binding.Delegation = &d },
+		func(r *Control) { r.Binding.Mode = Background }, func(r *Control) { r.Binding.Job.Revision = 0 },
+		func(r *Control) { r.Binding.Job.Revision = MaxSafeInteger + 1 }, func(r *Control) { r.Op = "background.confirm" },
+		func(r *Control) { r.Op = "background.revoke" },
+	} {
+		r := controlFixture()
+		mutate(&r)
+		if _, c := DecodeControl(bytes.NewReader(wire(t, r))); c == "" {
+			t.Fatal("mixed/legacy accepted", r)
+		}
+	}
+	b := string(wire(t, controlFixture()))
+	for _, bad := range []string{strings.Replace(b, `"nonce":`, `"nonce":"other","nonce":`, 1), strings.Replace(b, `"binding":`, `"actor":{"uid":1026},"binding":`, 1), strings.Replace(b, `"ticket":`, `"sessionRef":"private","ticket":`, 1), strings.Replace(b, `"revision":1`, `"revision":null`, 1)} {
+		if _, c := DecodeControl(strings.NewReader(bad)); c != Invalid {
+			t.Fatal(c)
+		}
+	}
+	r = controlFixture()
+	r.Binding.Mode = Background
+	d := ref("delegation-1")
+	r.Binding.Delegation = &d
+	if _, c := DecodeControl(bytes.NewReader(wire(t, r))); c != "" {
+		t.Fatal(c)
+	}
+	r.Op = "background.revoke"
+	if _, c := DecodeControl(bytes.NewReader(wire(t, r))); c != "" {
+		t.Fatal(c)
+	}
+	for _, mutate := range []func(*Binding){
+		func(b *Binding) { b.Inventory.Version = "1.0.1" }, func(b *Binding) { b.Inventory.Package = "other" },
+		func(b *Binding) { b.Inventory.PayloadDigest = strings.Repeat("b", 64) }, func(b *Binding) { b.Inventory.RegistryDigest = strings.Repeat("b", 64) },
+		func(b *Binding) { b.Worker.Revision++ }, func(b *Binding) { b.InputSchemaDigest = strings.Repeat("b", 64) },
+		func(b *Binding) { b.ApprovalBinding = strings.Repeat("b", 64) }, func(b *Binding) { b.CapabilityDigest = strings.Repeat("b", 64) },
+		func(b *Binding) { b.InputDigest = strings.Repeat("b", 64) }, func(b *Binding) { b.Epoch = "epoch-2" },
+		func(b *Binding) { b.ParentGrant.Revision++ }, func(b *Binding) { b.Job.Revision++ },
+		func(b *Binding) { b.Mode = Background; d := ref("d"); b.Delegation = &d },
+	} {
+		b := bindingFixture()
+		mutate(&b)
+		if c := CompareBinding(b, bindingFixture()); c == "" {
+			t.Fatal("partial binding match accepted", b)
+		}
+	}
+	if c := CompareBinding(bindingFixture(), bindingFixture()); c != "" {
+		t.Fatal(c)
+	}
+}
+
+func TestM2InventoryAndOpaqueBindingsAreExact(t *testing.T) {
+	for _, mutate := range []func(*Control){
+		func(r *Control) { r.Binding.Inventory.Package = "bad-package" },
+		func(r *Control) { r.Binding.Inventory.Version = "1.0.0" },
+		func(r *Control) { r.Binding.Epoch = "epoch" },
+		func(r *Control) { r.Binding.ParentGrant.ID = "grant" },
+		func(r *Control) { r.Binding.Job.ID = "job" },
+		func(r *Control) { r.Intent.ID = "intent" },
+		func(r *Control) { r.Nonce = "nonce" },
+		func(r *Control) { r.Ticket = "ticket" },
+	} {
+		r := controlFixture()
+		mutate(&r)
+		if _, c := DecodeControl(bytes.NewReader(wire(t, r))); c != Invalid {
+			t.Fatal("M2 format loosened", c)
+		}
+	}
+}
+
+func privateFixture() PrivateBinding {
+	return PrivateBinding{Binding: bindingFixture(), Actor: Principal{IdentityBasis: "uid-username", UID: 1026, Username: "Name"}, SessionRef: opaque("session-1")}
+}
+func backgroundFixture() BackgroundRecord {
+	b := privateFixture()
+	b.Binding.Mode = Background
+	d := ref("delegation-1")
+	b.Binding.Delegation = &d
+	b.SessionRef = ""
+	return BackgroundRecord{BackgroundSchema: 2, Binding: b, Issuer: b.Actor, CreatedAt: 1000, ExpiresAt: 1000 + DefaultBackgroundTTLMS, NotBefore: 1000, State: "active"}
+}
+func TestPrivateIntentAndBackgroundDiscriminators(t *testing.T) {
+	b := privateFixture()
+	in := inputFixture()
+	b.Binding.InputDigest, _ = InputDigest(in, digest())
+	i := Intent{JobSchema: 1, ID: opaque("intent-1"), Revision: 1, Binding: b, Input: in, SummaryDigest: digest(), CreatedAt: 1000, ExpiresAt: 31000}
+	if _, c := DecodeIntent(bytes.NewReader(wire(t, i))); c != "" {
+		t.Fatal(c)
+	}
+	i.ExpiresAt++
+	if _, c := DecodeIntent(bytes.NewReader(wire(t, i))); c != Invalid {
+		t.Fatal(c)
+	}
+	i.ExpiresAt--
+	i.Binding.Binding.InputDigest = strings.Repeat("b", 64)
+	if _, c := DecodeIntent(bytes.NewReader(wire(t, i))); c != Invalid {
+		t.Fatal(c)
+	}
+	r := backgroundFixture()
+	if _, c := DecodeBackground(bytes.NewReader(wire(t, r))); c != "" {
+		t.Fatal(c)
+	}
+	for _, mutate := range []func(*BackgroundRecord){
+		func(r *BackgroundRecord) { r.BackgroundSchema = 1 }, func(r *BackgroundRecord) { r.Binding.SessionRef = "old-session" },
+		func(r *BackgroundRecord) { r.Binding.Actor.IdentityBasis = "strict" }, func(r *BackgroundRecord) { r.Binding.Actor.UID = 0 },
+		func(r *BackgroundRecord) { r.Issuer.Username = "name" }, func(r *BackgroundRecord) { r.NotBefore = r.ExpiresAt },
+		func(r *BackgroundRecord) { r.ExpiresAt = r.CreatedAt + MaxBackgroundTTLMS + 1 },
+		func(r *BackgroundRecord) { r.State = "consumed" }, func(r *BackgroundRecord) { r.ExecutionKey = "key" },
+		func(r *BackgroundRecord) { r.Reason = "native /secret/file" },
+	} {
+		r := backgroundFixture()
+		mutate(&r)
+		if _, c := DecodeBackground(bytes.NewReader(wire(t, r))); c == "" {
+			t.Fatal("bad background accepted", r)
+		}
+	}
+	r.State = "consumed"
+	r.ExecutionKey = opaque("execution-1")
+	if _, c := DecodeBackground(bytes.NewReader(wire(t, r))); c != "" {
+		t.Fatal(c)
+	}
+	r.State = "revoked"
+	r.Reason = Revoked
+	if _, c := DecodeBackground(bytes.NewReader(wire(t, r))); c != "" {
+		t.Fatal("consumed tombstone lost", c)
+	}
+}
+
+func jobFixture() Job {
+	return Job{Binding: bindingFixture(), State: Pending, Progress: Progress{Phase: "starting"}, AcceptedAt: 1000}
+}
+func TestSafeStateAndProgress(t *testing.T) {
+	j := jobFixture()
+	if _, c := DecodeJob(bytes.NewReader(wire(t, j))); c != "" {
+		t.Fatal(c)
+	}
+	for _, mutate := range []func(*Job){
+		func(j *Job) { j.Reason = "stderr /private" }, func(j *Job) { j.State = "resumed" },
+		func(j *Job) { j.State = Succeeded }, func(j *Job) { j.Progress.Sequence = MaxSafeInteger + 1 },
+		func(j *Job) { n := uint64(0); j.Progress.TotalUnits = &n; j.Progress.CompletedUnits = 1 },
+		func(j *Job) { j.Progress.BytesRead = 64<<20 + 1 }, func(j *Job) { j.Progress.BytesWritten = 1 },
+		func(j *Job) { j.Progress.Phase = "/data/file" }, func(j *Job) { j.Drained = true },
+	} {
+		j := jobFixture()
+		mutate(&j)
+		if _, c := DecodeJob(bytes.NewReader(wire(t, j))); c == "" {
+			t.Fatal("bad job accepted", j)
+		}
+	}
+	start, finish := uint64(1001), uint64(1002)
+	j.StartedAt = &start
+	j.FinishedAt = &finish
+	j.State = Succeeded
+	j.Drained = true
+	if _, c := DecodeJob(bytes.NewReader(wire(t, j))); c != "" {
+		t.Fatal(c)
+	}
+	if TransitionAllowed(Succeeded, Running) || TransitionAllowed(Interrupted, Pending) || TransitionAllowed(CleanupRequired, Running) || !TransitionAllowed(Running, CancelRequested) || !TransitionAllowed(Draining, Canceled) {
+		t.Fatal("state resurrection")
+	}
+	if c := ValidateProgress(Progress{Sequence: 1, Phase: "reading", BytesRead: 10}, &Progress{Sequence: 1, Phase: "starting", BytesRead: 1}); c != Invalid {
+		t.Fatal("duplicate sequence", c)
+	}
+	if c := ValidateProgress(Progress{Sequence: 2, Phase: "reading", BytesRead: 0}, &Progress{Sequence: 1, Phase: "starting", BytesRead: 1}); c != Invalid {
+		t.Fatal("counter reset", c)
+	}
+}

package/dist/templates/native-go/backend/internal/helper/jobcontract/decode.go

@@ -0,0 +1,185 @@
+package jobcontract
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"reflect"
+	"strings"
+	"unicode/utf8"
+)
+
+// Isolated from the runtime helper: this bounded parser has no authority.
+// The ordinary Go decoder accepts case aliases, duplicate keys, nulls and
+// malformed Unicode replacement. A bounded token pass rejects these first.
+func decodeObject(reader io.Reader, dst any, limit int) SafeReason {
+	b, err := io.ReadAll(io.LimitReader(reader, int64(limit)+1))
+	if err != nil {
+		return Invalid
+	}
+	if len(b) > limit {
+		return LimitExceeded
+	}
+	if !validJSONUnicode(b) {
+		return Invalid
+	}
+	d := json.NewDecoder(bytes.NewReader(b))
+	d.UseNumber()
+	if !scanShape(d, reflect.TypeOf(dst).Elem(), 0) {
+		return Invalid
+	}
+	if _, err := d.Token(); err != io.EOF {
+		return Invalid
+	}
+	d = json.NewDecoder(bytes.NewReader(b))
+	d.DisallowUnknownFields()
+	if d.Decode(dst) != nil || d.Decode(new(any)) != io.EOF {
+		return Invalid
+	}
+	return ""
+}
+
+func scanShape(d *json.Decoder, t reflect.Type, depth int) bool {
+	if depth > 64 {
+		return false
+	}
+	for t != nil && t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+	if t == reflect.TypeOf(json.RawMessage{}) {
+		t = nil
+	}
+	token, err := d.Token()
+	if err != nil || token == nil {
+		return false
+	}
+	delim, container := token.(json.Delim)
+	if !container {
+		return t == nil || (t.Kind() != reflect.Struct && t.Kind() != reflect.Slice)
+	}
+	switch delim {
+	case '{':
+		if t != nil && t.Kind() != reflect.Struct {
+			return false
+		}
+		fields := map[string]reflect.Type{}
+		if t != nil {
+			for i := 0; i < t.NumField(); i++ {
+				f := t.Field(i)
+				name := strings.Split(f.Tag.Get("json"), ",")[0]
+				fields[name] = f.Type
+			}
+		}
+		seen := map[string]bool{}
+		for d.More() {
+			k, err := d.Token()
+			if err != nil {
+				return false
+			}
+			key, ok := k.(string)
+			if !ok || seen[key] {
+				return false
+			}
+			seen[key] = true
+			field, known := fields[key]
+			if t != nil && !known {
+				return false
+			}
+			if !scanShape(d, field, depth+1) {
+				return false
+			}
+		}
+		end, err := d.Token()
+		if err != nil || end != json.Delim('}') {
+			return false
+		}
+		if t != nil {
+			for i := 0; i < t.NumField(); i++ {
+				tag := strings.Split(t.Field(i).Tag.Get("json"), ",")
+				if len(tag) == 1 && !seen[tag[0]] {
+					return false
+				}
+			}
+		}
+		return true
+	case '[':
+		if t != nil && t.Kind() != reflect.Slice {
+			return false
+		}
+		var elem reflect.Type
+		if t != nil {
+			elem = t.Elem()
+		}
+		for d.More() {
+			if !scanShape(d, elem, depth+1) {
+				return false
+			}
+		}
+		end, err := d.Token()
+		return err == nil && end == json.Delim(']')
+	}
+	return false
+}
+
+func validJSONUnicode(b []byte) bool {
+	if !utf8.Valid(b) {
+		return false
+	}
+	inString := false
+	for i := 0; i < len(b); i++ {
+		if b[i] == '"' {
+			inString = !inString
+			continue
+		}
+		if !inString || b[i] != '\\' {
+			continue
+		}
+		i++
+		if i >= len(b) {
+			return false
+		}
+		if b[i] != 'u' {
+			continue
+		}
+		if i+4 >= len(b) {
+			return false
+		}
+		r, ok := unicodeEscape(b[i+1 : i+5])
+		if !ok {
+			return false
+		}
+		i += 4
+		if r >= 0xdc00 && r <= 0xdfff {
+			return false
+		}
+		if r >= 0xd800 && r <= 0xdbff {
+			if i+6 >= len(b) || b[i+1] != '\\' || b[i+2] != 'u' {
+				return false
+			}
+			low, ok := unicodeEscape(b[i+3 : i+7])
+			if !ok || low < 0xdc00 || low > 0xdfff {
+				return false
+			}
+			i += 6
+		}
+	}
+	return !inString
+}
+
+func unicodeEscape(b []byte) (uint16, bool) {
+	var r uint16
+	for _, c := range b {
+		r <<= 4
+		switch {
+		case c >= '0' && c <= '9':
+			r += uint16(c - '0')
+		case c >= 'a' && c <= 'f':
+			r += uint16(c - 'a' + 10)
+		case c >= 'A' && c <= 'F':
+			r += uint16(c - 'A' + 10)
+		default:
+			return 0, false
+		}
+	}
+	return r, true
+}

package/dist/templates/native-go/backend/internal/helper/jobcontract/digest.go

@@ -0,0 +1,55 @@
+package jobcontract
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+)
+
+// Canonical input v1: domain NUL, 32 schema bytes, u32 step count;
+// each step is a u32-length UTF-8 action, u32 segment count, u32-length UTF-8
+// segments, then u64 limit/maxBytes (zero for stat). All integers are big-endian.
+// Validation precedes encoding. No JSON ordering/escapes or Unicode normalization
+// enter the digest. A digest is a binding, NOT a signature/authority proof.
+func encodeInput(in Input, schema string) []byte {
+	var b bytes.Buffer
+	b.WriteString("synopkgland/m3/input/v1\x00")
+	s, _ := hex.DecodeString(schema)
+	if schema == "" {
+		s = make([]byte, 32)
+	}
+	b.Write(s)
+	write32 := func(n uint32) { var x [4]byte; binary.BigEndian.PutUint32(x[:], n); b.Write(x[:]) }
+	writeString := func(s string) { write32(uint32(len(s))); b.WriteString(s) }
+	write32(uint32(len(in.Steps)))
+	for _, step := range in.Steps {
+		writeString(string(step.Action))
+		write32(uint32(len(step.Segments)))
+		for _, s := range step.Segments {
+			writeString(s)
+		}
+		var n uint64
+		if step.Limit != nil {
+			n = *step.Limit
+		}
+		if step.MaxBytes != nil {
+			n = *step.MaxBytes
+		}
+		var x [8]byte
+		binary.BigEndian.PutUint64(x[:], n)
+		b.Write(x[:])
+	}
+	return b.Bytes()
+}
+
+func InputDigest(in Input, schemaDigest string) (string, SafeReason) {
+	if !digestPattern.MatchString(schemaDigest) {
+		return "", Invalid
+	}
+	if c := ValidateInput(in); c != "" {
+		return "", c
+	}
+	d := sha256.Sum256(encodeInput(in, schemaDigest))
+	return hex.EncodeToString(d[:]), ""
+}