@adcp/sdk 14.2.0 → 14.3.0

package/dist/lib/reporting/inspection.d.mts

@@ -2,7 +2,7 @@ import { type CanonicalReferenceResolver } from '../canonical-references/index.m
 import { type SsrfFetchOptions } from '../net/ssrf-fetch.mjs';
 import type { ReportingControlTotal } from '../types/tools.generated.mjs';
 import type { ReportingInspectionContext, ReportingObservation } from './reconciliation.mjs';
-export type ReportingInspectionErrorCode = 'UNSUPPORTED_RESOURCE' | 'RESOURCE_READ_FAILED' | 'RESOURCE_NOT_READY' | 'RESOURCE_TOO_LARGE' | 'INSPECTION_TIMEOUT' | 'MANIFEST_DIGEST_MISMATCH' | 'MANIFEST_INVALID' | 'MANIFEST_INCOMPLETE' | 'MANIFEST_IDENTITY_MISMATCH' | 'MANIFEST_TOTAL_MISMATCH' | 'OBJECT_DUPLICATE' | 'OBJECT_SIZE_MISMATCH' | 'OBJECT_DIGEST_MISMATCH' | 'OBJECT_ROW_COUNT_MISMATCH' | 'FORMAT_UNSUPPORTED' | 'COMPRESSION_UNSUPPORTED' | 'ROW_SCHEMA_FETCH_FAILED' | 'ROW_SCHEMA_INVALID' | 'ROW_SCHEMA_VIOLATION' | 'REPORT_DEFINITION_FETCH_FAILED' | 'REPORT_DEFINITION_INVALID' | 'CANONICALIZATION_FETCH_FAILED' | 'CANONICALIZATION_INVALID' | 'ROW_COUNT_MISMATCH' | 'CONTROL_TOTAL_UNSUPPORTED' | 'CONTROL_TOTAL_MISMATCH' | 'CANONICAL_DIGEST_MISMATCH';
+export type ReportingInspectionErrorCode = 'CONSUMER_COMMIT_FAILED' | 'UNSUPPORTED_RESOURCE' | 'RESOURCE_READ_FAILED' | 'RESOURCE_NOT_READY' | 'RESOURCE_TOO_LARGE' | 'INSPECTION_TIMEOUT' | 'MANIFEST_DIGEST_MISMATCH' | 'MANIFEST_INVALID' | 'MANIFEST_INCOMPLETE' | 'MANIFEST_IDENTITY_MISMATCH' | 'MANIFEST_TOTAL_MISMATCH' | 'OBJECT_DUPLICATE' | 'OBJECT_SIZE_MISMATCH' | 'OBJECT_DIGEST_MISMATCH' | 'OBJECT_ROW_COUNT_MISMATCH' | 'FORMAT_UNSUPPORTED' | 'COMPRESSION_UNSUPPORTED' | 'ROW_SCHEMA_FETCH_FAILED' | 'ROW_SCHEMA_INVALID' | 'ROW_SCHEMA_VIOLATION' | 'REPORT_DEFINITION_FETCH_FAILED' | 'REPORT_DEFINITION_INVALID' | 'CANONICALIZATION_FETCH_FAILED' | 'CANONICALIZATION_INVALID' | 'ROW_COUNT_MISMATCH' | 'CONTROL_TOTAL_UNSUPPORTED' | 'CONTROL_TOTAL_MISMATCH' | 'CANONICAL_DIGEST_MISMATCH';
 export declare class ReportingInspectionError extends Error {
     readonly code: ReportingInspectionErrorCode;
     readonly retryable: boolean;
@@ -78,9 +78,9 @@ export interface ReportingManifestInspectorOptions<TCredential = unknown> {
     maxFiles?: number;
     maxRows?: number;
     maxRowBytes?: number;
-    /** Hard wall-clock budget for one inspection attempt, including custom adapters. */
+    /** Aggregate deadline for async work, checked cooperatively during synchronous work. Synchronous callbacks cannot be preempted. */
     maxInspectionMs?: number;
-    /** Maximum wall-clock time permitted for synchronous row-schema compilation. */
+    /** Reject synchronous schema compilation overruns after compilation returns. */
     maxSchemaCompileMs?: number;
 }
 /** Build the SDK-managed manifest/file inspector used by reconcileReporting. */

package/dist/lib/reporting/inspection.d.ts

@@ -2,7 +2,7 @@ import { type CanonicalReferenceResolver } from '../canonical-references';
 import { type SsrfFetchOptions } from '../net/ssrf-fetch';
 import type { ReportingControlTotal } from '../types/tools.generated';
 import type { ReportingInspectionContext, ReportingObservation } from './reconciliation';
-export type ReportingInspectionErrorCode = 'UNSUPPORTED_RESOURCE' | 'RESOURCE_READ_FAILED' | 'RESOURCE_NOT_READY' | 'RESOURCE_TOO_LARGE' | 'INSPECTION_TIMEOUT' | 'MANIFEST_DIGEST_MISMATCH' | 'MANIFEST_INVALID' | 'MANIFEST_INCOMPLETE' | 'MANIFEST_IDENTITY_MISMATCH' | 'MANIFEST_TOTAL_MISMATCH' | 'OBJECT_DUPLICATE' | 'OBJECT_SIZE_MISMATCH' | 'OBJECT_DIGEST_MISMATCH' | 'OBJECT_ROW_COUNT_MISMATCH' | 'FORMAT_UNSUPPORTED' | 'COMPRESSION_UNSUPPORTED' | 'ROW_SCHEMA_FETCH_FAILED' | 'ROW_SCHEMA_INVALID' | 'ROW_SCHEMA_VIOLATION' | 'REPORT_DEFINITION_FETCH_FAILED' | 'REPORT_DEFINITION_INVALID' | 'CANONICALIZATION_FETCH_FAILED' | 'CANONICALIZATION_INVALID' | 'ROW_COUNT_MISMATCH' | 'CONTROL_TOTAL_UNSUPPORTED' | 'CONTROL_TOTAL_MISMATCH' | 'CANONICAL_DIGEST_MISMATCH';
+export type ReportingInspectionErrorCode = 'CONSUMER_COMMIT_FAILED' | 'UNSUPPORTED_RESOURCE' | 'RESOURCE_READ_FAILED' | 'RESOURCE_NOT_READY' | 'RESOURCE_TOO_LARGE' | 'INSPECTION_TIMEOUT' | 'MANIFEST_DIGEST_MISMATCH' | 'MANIFEST_INVALID' | 'MANIFEST_INCOMPLETE' | 'MANIFEST_IDENTITY_MISMATCH' | 'MANIFEST_TOTAL_MISMATCH' | 'OBJECT_DUPLICATE' | 'OBJECT_SIZE_MISMATCH' | 'OBJECT_DIGEST_MISMATCH' | 'OBJECT_ROW_COUNT_MISMATCH' | 'FORMAT_UNSUPPORTED' | 'COMPRESSION_UNSUPPORTED' | 'ROW_SCHEMA_FETCH_FAILED' | 'ROW_SCHEMA_INVALID' | 'ROW_SCHEMA_VIOLATION' | 'REPORT_DEFINITION_FETCH_FAILED' | 'REPORT_DEFINITION_INVALID' | 'CANONICALIZATION_FETCH_FAILED' | 'CANONICALIZATION_INVALID' | 'ROW_COUNT_MISMATCH' | 'CONTROL_TOTAL_UNSUPPORTED' | 'CONTROL_TOTAL_MISMATCH' | 'CANONICAL_DIGEST_MISMATCH';
 export declare class ReportingInspectionError extends Error {
     readonly code: ReportingInspectionErrorCode;
     readonly retryable: boolean;
@@ -78,9 +78,9 @@ export interface ReportingManifestInspectorOptions<TCredential = unknown> {
     maxFiles?: number;
     maxRows?: number;
     maxRowBytes?: number;
-    /** Hard wall-clock budget for one inspection attempt, including custom adapters. */
+    /** Aggregate deadline for async work, checked cooperatively during synchronous work. Synchronous callbacks cannot be preempted. */
     maxInspectionMs?: number;
-    /** Maximum wall-clock time permitted for synchronous row-schema compilation. */
+    /** Reject synchronous schema compilation overruns after compilation returns. */
     maxSchemaCompileMs?: number;
 }
 /** Build the SDK-managed manifest/file inspector used by reconcileReporting. */

package/dist/lib/reporting/inspection.js

@@ -162,6 +162,38 @@ function createReportingManifestInspector(options) {
     "maxSchemaCompileMs",
     6e4
   );
+  const maxManifestBytes = boundedPositiveInteger(
+    options.maxManifestBytes ?? DEFAULT_MAX_MANIFEST_BYTES,
+    "maxManifestBytes",
+    Number.MAX_SAFE_INTEGER
+  );
+  const maxObjectBytes = boundedPositiveInteger(
+    options.maxObjectBytes ?? DEFAULT_MAX_OBJECT_BYTES,
+    "maxObjectBytes",
+    Number.MAX_SAFE_INTEGER
+  );
+  const maxTotalBytes = boundedPositiveInteger(
+    options.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES,
+    "maxTotalBytes",
+    Number.MAX_SAFE_INTEGER
+  );
+  const maxRows = boundedPositiveInteger(options.maxRows ?? DEFAULT_MAX_ROWS, "maxRows", Number.MAX_SAFE_INTEGER);
+  const maxFiles = boundedPositiveInteger(options.maxFiles ?? DEFAULT_MAX_FILES, "maxFiles", Number.MAX_SAFE_INTEGER);
+  const maxDecodedObjectBytes = boundedPositiveInteger(
+    options.maxDecodedObjectBytes ?? maxObjectBytes,
+    "maxDecodedObjectBytes",
+    Number.MAX_SAFE_INTEGER
+  );
+  const maxDecodedTotalBytes = boundedPositiveInteger(
+    options.maxDecodedTotalBytes ?? maxTotalBytes,
+    "maxDecodedTotalBytes",
+    Number.MAX_SAFE_INTEGER
+  );
+  const maxRowBytes = boundedPositiveInteger(
+    options.maxRowBytes ?? DEFAULT_MAX_ROW_BYTES,
+    "maxRowBytes",
+    Number.MAX_SAFE_INTEGER
+  );
   const resolver = options.referenceResolver ?? (0, import_canonical_references.createCanonicalReferenceResolver)();
   const formatDecoders = {
     jsonl: decodeJsonLines,
@@ -179,10 +211,15 @@ function createReportingManifestInspector(options) {
     if (!resource || resource.kind !== "manifest" || !resource.manifest_sha256 || resource.manifest_version !== "1.0") {
       throw inspectionError("UNSUPPORTED_RESOURCE", "Built-in inspection requires a v1 manifest resource");
     }
-    const credential = options.credentialProvider ? await withinInspectionDeadline(options.credentialProvider.getCredentials(context), deadline) : void 0;
-    const maxManifestBytes = options.maxManifestBytes ?? DEFAULT_MAX_MANIFEST_BYTES;
-    const manifestRead = await withinInspectionDeadline(
-      options.reader.read({
+    const credential = options.credentialProvider ? await invokeInspectionAdapter(
+      () => options.credentialProvider.getCredentials(context),
+      deadline,
+      "RESOURCE_READ_FAILED",
+      "Reporting credentials could not be resolved",
+      true
+    ) : void 0;
+    const manifestRead = await invokeInspectionAdapter(
+      () => options.reader.read({
         role: "manifest",
         location: resource.location,
         maxBytes: maxManifestBytes,
@@ -190,8 +227,14 @@ function createReportingManifestInspector(options) {
         context,
         signal: deadlineSignal(deadline)
       }),
-      deadline
+      deadline,
+      "RESOURCE_READ_FAILED",
+      "Reporting manifest could not be read",
+      true
     );
+    if (!isRecord(manifestRead) || !(manifestRead.body instanceof Uint8Array)) {
+      throw inspectionError("RESOURCE_READ_FAILED", "Reporting manifest reader returned invalid bytes");
+    }
     if (manifestRead.body.byteLength > maxManifestBytes) {
       throw inspectionError("RESOURCE_TOO_LARGE", "Reporting manifest exceeds the configured byte budget");
     }
@@ -204,10 +247,7 @@ function createReportingManifestInspector(options) {
     }
     const manifest = parseManifest(manifestRead.body);
     validateManifestBinding(manifest, context);
-    const maxObjectBytes = options.maxObjectBytes ?? DEFAULT_MAX_OBJECT_BYTES;
-    const maxTotalBytes = options.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES;
-    const maxRows = options.maxRows ?? DEFAULT_MAX_ROWS;
-    if (manifest.total_size_bytes > maxTotalBytes || manifest.files.some((file) => file.size_bytes > maxObjectBytes) || manifest.files.length > (options.maxFiles ?? DEFAULT_MAX_FILES) || manifest.row_count > maxRows) {
+    if (manifest.total_size_bytes > maxTotalBytes || manifest.files.some((file) => file.size_bytes > maxObjectBytes) || manifest.files.length > maxFiles || manifest.row_count > maxRows) {
       throw inspectionError(
         "RESOURCE_TOO_LARGE",
         "Manifest declares data beyond the configured inspection byte budget"
@@ -231,6 +271,9 @@ function createReportingManifestInspector(options) {
     const manifestObjectRefs = new Set(manifest.files.map((file) => file.object_ref));
     const evidenceKeys = /* @__PURE__ */ new Set();
     for (const checksum of context.materialization.verification?.physical_checksums ?? []) {
+      if (!isRecord(checksum) || !["sha256", "sha512"].includes(checksum.algorithm) || typeof checksum.value !== "string" || !(checksum.algorithm === "sha256" ? /^[a-fA-F0-9]{64}$/ : /^[a-fA-F0-9]{128}$/).test(checksum.value)) {
+        throw inspectionError("OBJECT_DIGEST_MISMATCH", "Producer checksum evidence is invalid");
+      }
       const key = `${checksum.object_ref}\0${checksum.algorithm}`;
       if (!manifestObjectRefs.has(checksum.object_ref) || evidenceKeys.has(key)) {
         throw inspectionError(
@@ -250,8 +293,8 @@ function createReportingManifestInspector(options) {
       totalBytes += file.size_bytes;
       if (totalBytes > maxTotalBytes) throw inspectionError("RESOURCE_TOO_LARGE", "Manifest exceeds total byte budget");
       assertInspectionDeadline(deadline);
-      const read = await withinInspectionDeadline(
-        options.reader.read({
+      const read = await invokeInspectionAdapter(
+        () => options.reader.read({
           role: "object",
           location: resource.location,
           objectRef: file.object_ref,
@@ -261,16 +304,19 @@ function createReportingManifestInspector(options) {
           context,
           signal: deadlineSignal(deadline)
         }),
-        deadline
+        deadline,
+        "RESOURCE_READ_FAILED",
+        "Reporting object could not be read",
+        true
       );
+      if (!isRecord(read) || !(read.body instanceof Uint8Array)) {
+        throw inspectionError("RESOURCE_READ_FAILED", "Reporting object reader returned invalid bytes");
+      }
       if (read.body.byteLength !== file.size_bytes) {
-        throw inspectionError("OBJECT_SIZE_MISMATCH", `Object ${file.object_ref} size does not match the manifest`);
+        throw inspectionError("OBJECT_SIZE_MISMATCH", "Object size does not match the manifest");
       }
       if (!constantTimeHexEqual(sha256(read.body), file.sha256)) {
-        throw inspectionError(
-          "OBJECT_DIGEST_MISMATCH",
-          `Object ${file.object_ref} checksum does not match the manifest`
-        );
+        throw inspectionError("OBJECT_DIGEST_MISMATCH", "Object checksum does not match the manifest");
       }
       for (const producerChecksum of context.materialization.verification?.physical_checksums?.filter(
         (checksum) => checksum.object_ref === file.object_ref
@@ -279,55 +325,55 @@ function createReportingManifestInspector(options) {
         if (!constantTimeHexEqual(producerChecksum.value, observed) || producerChecksum.algorithm === "sha256" && !constantTimeHexEqual(producerChecksum.value, file.sha256)) {
           throw inspectionError(
             "OBJECT_DIGEST_MISMATCH",
-            `Producer checksum evidence for ${file.object_ref} does not match the delivered object`
+            "Producer checksum evidence does not match the delivered object"
           );
         }
       }
       let decoded;
       try {
-        decoded = await withinInspectionDeadline(
-          Promise.resolve(decompress(read.body, options.maxDecodedObjectBytes ?? maxObjectBytes)),
-          deadline
+        decoded = await invokeInspectionAdapter(
+          () => decompress(read.body, maxDecodedObjectBytes),
+          deadline,
+          "MANIFEST_INVALID",
+          "Could not decode the compressed reporting object"
         );
       } catch (error) {
         if (error instanceof ReportingInspectionError) throw error;
-        throw inspectionError(
-          "MANIFEST_INVALID",
-          `Could not decode ${manifest.compression} object ${file.object_ref}`,
-          false,
-          error
-        );
+        throw inspectionError("MANIFEST_INVALID", "Could not decode the compressed reporting object", false, error);
       }
-      if (decoded.byteLength > (options.maxDecodedObjectBytes ?? maxObjectBytes)) {
-        throw inspectionError("RESOURCE_TOO_LARGE", `Decoded object ${file.object_ref} exceeds the byte budget`);
+      if (!(decoded instanceof Uint8Array)) {
+        throw inspectionError("MANIFEST_INVALID", "Reporting decompressor returned invalid bytes");
+      }
+      if (decoded.byteLength > maxDecodedObjectBytes) {
+        throw inspectionError("RESOURCE_TOO_LARGE", "Decoded reporting object exceeds the byte budget");
       }
       totalDecodedBytes += decoded.byteLength;
-      if (totalDecodedBytes > (options.maxDecodedTotalBytes ?? maxTotalBytes)) {
+      if (totalDecodedBytes > maxDecodedTotalBytes) {
         throw inspectionError("RESOURCE_TOO_LARGE", "Decoded reporting data exceeds the aggregate byte budget");
       }
       let fileRows;
       try {
-        fileRows = await withinInspectionDeadline(
-          Promise.resolve(
-            decoder(decoded, {
-              format: manifest.format,
-              objectRef: file.object_ref,
-              rowSchema: schema,
-              inspection: context,
-              maxRows: maxRows - rows.length
-            })
-          ),
-          deadline
+        fileRows = await invokeInspectionAdapter(
+          () => decoder(decoded, {
+            format: manifest.format,
+            objectRef: file.object_ref,
+            rowSchema: schema,
+            inspection: context,
+            maxRows: maxRows - rows.length
+          }),
+          deadline,
+          "MANIFEST_INVALID",
+          "Could not parse the reporting object"
         );
       } catch (error) {
         if (error instanceof ReportingInspectionError) throw error;
-        throw inspectionError("MANIFEST_INVALID", `Could not parse ${manifest.format} object ${file.object_ref}`);
+        throw inspectionError("MANIFEST_INVALID", "Could not parse the reporting object");
+      }
+      if (!Array.isArray(fileRows) || !fileRows.every(isRecord)) {
+        throw inspectionError("MANIFEST_INVALID", "Reporting decoder returned invalid rows");
       }
       if (fileRows.length !== file.row_count) {
-        throw inspectionError(
-          "OBJECT_ROW_COUNT_MISMATCH",
-          `Object ${file.object_ref} row count does not match the manifest`
-        );
+        throw inspectionError("OBJECT_ROW_COUNT_MISMATCH", "Object row count does not match the manifest");
       }
       if (fileRows.length > maxRows - rows.length) {
         throw inspectionError("RESOURCE_TOO_LARGE", "Reporting row count exceeds the configured inspection budget");
@@ -338,7 +384,7 @@ function createReportingManifestInspector(options) {
       if (index % 256 === 0) assertInspectionDeadline(deadline);
       assertBoundedJsonData(rows[index], "ROW_SCHEMA_VIOLATION");
       assertIJson(rows[index]);
-      if (Buffer.byteLength((0, import_jcs.canonicalize)(rows[index])) > (options.maxRowBytes ?? DEFAULT_MAX_ROW_BYTES)) {
+      if (Buffer.byteLength((0, import_jcs.canonicalize)(rows[index])) > maxRowBytes) {
         throw inspectionError("RESOURCE_TOO_LARGE", `Row ${index} exceeds the configured byte budget`);
       }
       if (!validateRow(rows[index])) {
@@ -353,10 +399,15 @@ function createReportingManifestInspector(options) {
         );
       }
     }
-    const observedTotals = options.controlTotalCalculator ? await withinInspectionDeadline(
-      Promise.resolve(options.controlTotalCalculator(rows, context.revision.control_totals, context)),
-      deadline
+    const observedTotals = options.controlTotalCalculator ? await invokeInspectionAdapter(
+      () => options.controlTotalCalculator(rows, context.revision.control_totals, context),
+      deadline,
+      "CONTROL_TOTAL_UNSUPPORTED",
+      "Reporting control totals could not be calculated"
     ) : calculateNamedControlTotals(rows, context.revision.control_totals, reportDefinition, deadline);
+    if (!Array.isArray(observedTotals) || !observedTotals.every(isControlTotal)) {
+      throw inspectionError("CONTROL_TOTAL_UNSUPPORTED", "Reporting calculator returned invalid control totals");
+    }
     const expectedCanonicalDigest = context.revision.canonical_content_digest;
     let canonicalContentDigest;
     if (expectedCanonicalDigest && context.expected.verificationProfile === "canonical_digest") {
@@ -397,7 +448,18 @@ function createReportingManifestInspector(options) {
         );
       }
     }
-    const commitRef = typeof options.consumerCommitRef === "function" ? options.consumerCommitRef(context) : options.consumerCommitRef;
+    assertInspectionDeadline(deadline);
+    const consumerCommitRef = options.consumerCommitRef;
+    const commitRef = typeof consumerCommitRef === "function" ? await invokeInspectionAdapter(
+      () => consumerCommitRef(context),
+      deadline,
+      "CONSUMER_COMMIT_FAILED",
+      "Reporting consumer commit reference could not be resolved"
+    ) : consumerCommitRef;
+    if (commitRef !== void 0 && typeof commitRef !== "string") {
+      throw inspectionError("CONSUMER_COMMIT_FAILED", "Reporting consumer commit reference is invalid");
+    }
+    assertInspectionDeadline(deadline);
     return {
       rowCount: rows.length,
       controlTotals: observedTotals,
@@ -409,17 +471,26 @@ function createReportingManifestInspector(options) {
 }
 async function resolveRowSchema(context, resolver, allowedOrigins, deadline) {
   assertAllowedReferenceOrigin(context.revision.schema_uri, allowedOrigins, "ROW_SCHEMA_FETCH_FAILED");
-  const result = await withinInspectionDeadline(
-    resolver.resolve({
+  const result = await invokeInspectionAdapter(
+    () => resolver.resolve({
       uri: context.revision.schema_uri,
       digest: `sha256:${context.revision.schema_sha256.toLowerCase()}`
     }),
-    deadline
+    deadline,
+    "ROW_SCHEMA_FETCH_FAILED",
+    "Pinned row schema could not be resolved",
+    true
   );
+  assertReferenceResult(result, "ROW_SCHEMA_FETCH_FAILED");
   if (!result.ok) {
-    throw new ReportingInspectionError("ROW_SCHEMA_FETCH_FAILED", result.error.message, result.error.retryable, {
-      referenceCode: result.error.code
-    });
+    throw new ReportingInspectionError(
+      "ROW_SCHEMA_FETCH_FAILED",
+      "Pinned row schema could not be resolved",
+      result.error.retryable,
+      {
+        referenceCode: result.error.code
+      }
+    );
   }
   requireContentType(result.contentType, ["application/schema+json", "application/json"], "ROW_SCHEMA_INVALID");
   const document = parsePinnedJson(result.body, "ROW_SCHEMA_INVALID");
@@ -487,7 +558,7 @@ function rejectReferenceCycles(schema, refs) {
   const edges = /* @__PURE__ */ new Map();
   for (const ref of refs) {
     const target = ref === "#" ? schema : ref.startsWith("#/") ? resolveJsonPointer(schema, ref.slice(1)) : anchors.get(ref.slice(1));
-    if (target === void 0) throw inspectionError("ROW_SCHEMA_INVALID", `Row schema reference ${ref} is unresolved`);
+    if (target === void 0) throw inspectionError("ROW_SCHEMA_INVALID", "Row schema reference is unresolved");
     const childRefs = /* @__PURE__ */ new Set();
     collectRefs(target, childRefs);
     edges.set(ref, childRefs);
@@ -552,17 +623,26 @@ async function validateReportDefinition(context, resolver, allowedOrigins, deadl
     allowedOrigins,
     "REPORT_DEFINITION_FETCH_FAILED"
   );
-  const result = await withinInspectionDeadline(
-    resolver.resolve({
+  const result = await invokeInspectionAdapter(
+    () => resolver.resolve({
       uri: context.revision.report_definition_uri,
       digest: `sha256:${context.revision.report_definition_sha256.toLowerCase()}`
     }),
-    deadline
+    deadline,
+    "REPORT_DEFINITION_FETCH_FAILED",
+    "Pinned report definition could not be resolved",
+    true
   );
+  assertReferenceResult(result, "REPORT_DEFINITION_FETCH_FAILED");
   if (!result.ok) {
-    throw new ReportingInspectionError("REPORT_DEFINITION_FETCH_FAILED", result.error.message, result.error.retryable, {
-      referenceCode: result.error.code
-    });
+    throw new ReportingInspectionError(
+      "REPORT_DEFINITION_FETCH_FAILED",
+      "Pinned report definition could not be resolved",
+      result.error.retryable,
+      {
+        referenceCode: result.error.code
+      }
+    );
   }
   requireContentType(
     result.contentType,
@@ -595,17 +675,26 @@ async function validateReportDefinition(context, resolver, allowedOrigins, deadl
 async function recomputeCanonicalDigest(rows, context, resolver, allowedOrigins, deadline) {
   const expected = context.revision.canonical_content_digest;
   assertAllowedReferenceOrigin(expected.canonicalization_uri, allowedOrigins, "CANONICALIZATION_FETCH_FAILED");
-  const result = await withinInspectionDeadline(
-    resolver.resolve({
+  const result = await invokeInspectionAdapter(
+    () => resolver.resolve({
       uri: expected.canonicalization_uri,
       digest: `sha256:${expected.canonicalization_sha256.toLowerCase()}`
     }),
-    deadline
+    deadline,
+    "CANONICALIZATION_FETCH_FAILED",
+    "Pinned canonicalization contract could not be resolved",
+    true
   );
+  assertReferenceResult(result, "CANONICALIZATION_FETCH_FAILED");
   if (!result.ok) {
-    throw new ReportingInspectionError("CANONICALIZATION_FETCH_FAILED", result.error.message, result.error.retryable, {
-      referenceCode: result.error.code
-    });
+    throw new ReportingInspectionError(
+      "CANONICALIZATION_FETCH_FAILED",
+      "Pinned canonicalization contract could not be resolved",
+      result.error.retryable,
+      {
+        referenceCode: result.error.code
+      }
+    );
   }
   requireContentType(
     result.contentType,
@@ -625,6 +714,12 @@ async function recomputeCanonicalDigest(rows, context, resolver, allowedOrigins,
   for (const vector of contract.golden_vectors) {
     assertInspectionDeadline(deadline);
     const body = canonicalRows(vector.input_rows, contract.primary_keys, deadline);
+    if (vector.purpose === "ordering_encoding" && (Buffer.from(body).toString("utf8") === (0, import_jcs.canonicalize)(vector.input_rows) || !vector.input_rows.some((row) => JSON.stringify(row) !== (0, import_jcs.canonicalize)(row)))) {
+      throw inspectionError(
+        "CANONICALIZATION_INVALID",
+        "Ordering/encoding vector must exercise both row ordering and object member ordering"
+      );
+    }
     if (Buffer.from(body).toString("base64") !== vector.canonical_utf8_base64 || !constantTimeHexEqual(sha256(body), vector.sha256)) {
       throw inspectionError("CANONICALIZATION_INVALID", `Canonicalization golden vector ${vector.name} failed`);
     }
@@ -633,25 +728,41 @@ async function recomputeCanonicalDigest(rows, context, resolver, allowedOrigins,
 }
 function parseCanonicalizationContract(document, schemaSha256) {
   const allowed = ["contract_version", "media_type", "algorithm", "schema_sha256", "primary_keys", "golden_vectors"];
-  if (!isRecord(document) || !hasOnlyKeys(document, allowed) || document.contract_version !== "1.0" || document.media_type !== "application/vnd.adcp.reporting-canonicalization+json" || document.algorithm !== "adcp_jcs_rows_v1" || typeof document.schema_sha256 !== "string" || !constantTimeHexEqual(document.schema_sha256, schemaSha256) || !Array.isArray(document.primary_keys) || document.primary_keys.length === 0 || !document.primary_keys.every((item) => typeof item === "string" && item.length > 0 && item.length <= 128) || new Set(document.primary_keys).size !== document.primary_keys.length || !Array.isArray(document.golden_vectors) || document.golden_vectors.length < 2) {
+  if (!isRecord(document) || !hasOnlyKeys(document, allowed) || document.contract_version !== "1.0" || document.media_type !== "application/vnd.adcp.reporting-canonicalization+json" || document.algorithm !== "adcp_jcs_rows_v1" || typeof document.schema_sha256 !== "string" || !constantTimeHexEqual(document.schema_sha256, schemaSha256) || !Array.isArray(document.primary_keys) || document.primary_keys.length === 0 || !document.primary_keys.every((item) => typeof item === "string" && item.length > 0 && item.length <= 128) || new Set(document.primary_keys).size !== document.primary_keys.length) {
     throw inspectionError(
       "CANONICALIZATION_INVALID",
       "Pinned canonicalization contract is invalid or not bound to the row schema"
     );
   }
-  for (const vector of document.golden_vectors) {
-    if (!isRecord(vector) || !hasOnlyKeys(vector, ["name", "input_rows", "canonical_utf8_base64", "sha256"]) || typeof vector.name !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(vector.name) || !Array.isArray(vector.input_rows) || !vector.input_rows.every(isRecord) || typeof vector.canonical_utf8_base64 !== "string" || !isCanonicalBase64(vector.canonical_utf8_base64) || typeof vector.sha256 !== "string" || !/^[a-fA-F0-9]{64}$/.test(vector.sha256)) {
+  const named = !Array.isArray(document.golden_vectors);
+  let vectors;
+  if (named) {
+    const golden = document.golden_vectors;
+    if (!isRecord(golden) || !hasOnlyKeys(golden, ["empty_report", "ordering_encoding", "additional"]) || !isRecord(golden.empty_report) || golden.empty_report.purpose !== "empty_report" || !Array.isArray(golden.empty_report.input_rows) || golden.empty_report.input_rows.length !== 0 || !isRecord(golden.ordering_encoding) || golden.ordering_encoding.purpose !== "ordering_encoding" || !Array.isArray(golden.ordering_encoding.input_rows) || golden.ordering_encoding.input_rows.length < 2 || golden.additional !== void 0 && (!Array.isArray(golden.additional) || !golden.additional.every((vector) => isRecord(vector) && vector.purpose === "additional"))) {
+      throw inspectionError("CANONICALIZATION_INVALID", "Canonicalization contract contains invalid named vectors");
+    }
+    vectors = [golden.empty_report, golden.ordering_encoding, ...golden.additional ?? []];
+  } else {
+    vectors = document.golden_vectors;
+  }
+  if (vectors.length < 2) {
+    throw inspectionError("CANONICALIZATION_INVALID", "Canonicalization contract requires at least two golden vectors");
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const vector of vectors) {
+    if (!isRecord(vector) || !hasOnlyKeys(vector, ["name", "input_rows", "canonical_utf8_base64", "sha256", ...named ? ["purpose"] : []]) || typeof vector.name !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(vector.name) || !Array.isArray(vector.input_rows) || !vector.input_rows.every(isRecord) || typeof vector.canonical_utf8_base64 !== "string" || !isCanonicalBase64(vector.canonical_utf8_base64) || typeof vector.sha256 !== "string" || !/^[a-fA-F0-9]{64}$/.test(vector.sha256) || names.has(vector.name)) {
       throw inspectionError("CANONICALIZATION_INVALID", "Canonicalization contract contains an invalid golden vector");
     }
+    names.add(vector.name);
     assertBoundedJsonData(vector.input_rows, "CANONICALIZATION_INVALID");
   }
-  if (!document.golden_vectors.some((vector) => vector.input_rows.length === 0) || !document.golden_vectors.some((vector) => vector.input_rows.length >= 2)) {
+  if (!vectors.some((vector) => isRecord(vector) && vector.input_rows.length === 0) || !vectors.some((vector) => isRecord(vector) && vector.input_rows.length >= 2)) {
     throw inspectionError(
       "CANONICALIZATION_INVALID",
       "Canonicalization vectors must include empty-report and ordering/encoding cases"
     );
   }
-  return document;
+  return { ...document, golden_vectors: vectors };
 }
 function canonicalRows(rows, primaryKeys, deadline) {
   const encoded = rows.map((row, index) => {
@@ -674,6 +785,11 @@ function canonicalRows(rows, primaryKeys, deadline) {
   }
   return Buffer.from(`[${encoded.map((item) => item.row).join(",")}]`, "utf8");
 }
+function assertReferenceResult(value, code) {
+  if (!isRecord(value) || value.ok !== true && value.ok !== false || (value.ok ? !(value.body instanceof Uint8Array) : !isRecord(value.error) || typeof value.error.retryable !== "boolean")) {
+    throw inspectionError(code, "Pinned reference resolver returned an invalid result");
+  }
+}
 function parsePinnedJson(body, code) {
   try {
     return (0, import_strict_json.parseStrictJson)(new TextDecoder("utf-8", { fatal: true }).decode(body));
@@ -829,6 +945,9 @@ function calculateNamedControlTotals(rows, expected, reportDefinition, deadline)
         `Control total ${total.name} needs a custom calculator for its declared aggregation`
       );
     }
+    if (total.unit !== void 0 && metric.unit !== void 0 && metric.unit !== total.unit) {
+      throw inspectionError("CONTROL_TOTAL_MISMATCH", "Control-total unit does not match the pinned report definition");
+    }
     let sum = { coefficient: 0n, scale: 0 };
     for (let index = 0; index < rows.length; index += 1) {
       if (index % 256 === 0) assertInspectionDeadline(deadline);
@@ -862,6 +981,8 @@ function deadlineSignal(deadline) {
   return AbortSignal.timeout(Math.max(1, deadline - Date.now()));
 }
 async function withinInspectionDeadline(operation, deadline) {
+  void operation.catch(() => {
+  });
   assertInspectionDeadline(deadline);
   const remaining = deadline - Date.now();
   let timer;
@@ -885,7 +1006,7 @@ function parseDecimal(value) {
     throw inspectionError("CONTROL_TOTAL_UNSUPPORTED", "Control-total decimal exceeds the precision bound");
   }
   const match = /^(-?)(\d+)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(text);
-  if (!match) throw inspectionError("CONTROL_TOTAL_UNSUPPORTED", `Non-decimal control value ${text}`);
+  if (!match) throw inspectionError("CONTROL_TOTAL_UNSUPPORTED", "Control-total value is not a decimal");
   const fraction = match[3] ?? "";
   const exponent = Number(match[4] ?? 0);
   if (!Number.isSafeInteger(exponent) || Math.abs(exponent) > 1024 || match[2].length + fraction.length > 1024) {
@@ -943,7 +1064,7 @@ function assertIJson(value, seen = /* @__PURE__ */ new Set()) {
       const code = value.charCodeAt(index);
       if (code >= 55296 && code <= 56319) {
         const next = value.charCodeAt(index + 1);
-        if (next < 56320 || next > 57343)
+        if (!Number.isFinite(next) || next < 56320 || next > 57343)
           throw inspectionError("CANONICALIZATION_INVALID", "Lone Unicode surrogate is not I-JSON");
         index += 1;
       } else if (code >= 56320 && code <= 57343) {
@@ -952,9 +1073,13 @@ function assertIJson(value, seen = /* @__PURE__ */ new Set()) {
     }
     return;
   }
-  if (typeof value === "number" && !Number.isFinite(value))
-    throw inspectionError("CANONICALIZATION_INVALID", "Non-finite number is not I-JSON");
-  if (!value || typeof value !== "object") return;
+  if (value === null || typeof value === "boolean") return;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw inspectionError("CANONICALIZATION_INVALID", "Non-finite number is not I-JSON");
+    return;
+  }
+  if (typeof value !== "object" || !Array.isArray(value) && !isRecord(value))
+    throw inspectionError("CANONICALIZATION_INVALID", "Reporting values must be JSON data");
   if (seen.has(value)) throw inspectionError("CANONICALIZATION_INVALID", "Cyclic row is not JSON");
   seen.add(value);
   if (Array.isArray(value)) value.forEach((child) => assertIJson(child, seen));
@@ -993,7 +1118,7 @@ function isValidReportDefinition(value) {
   }
   if (!Array.isArray(value.metrics) || value.metrics.length === 0 || !value.metrics.every(
     (metric) => isRecord(metric) && hasOnlyKeys(metric, ["name", "source_expression", "aggregation", "unit"]) && typeof metric.name === "string" && metric.name.length > 0 && metric.name.length <= 128 && typeof metric.source_expression === "string" && metric.source_expression.length > 0 && metric.source_expression.length <= 2048 && ["sum", "count", "min", "max", "average", "ratio", "last", "custom"].includes(String(metric.aggregation)) && (metric.unit === void 0 || typeof metric.unit === "string" && metric.unit.length > 0 && metric.unit.length <= 64)
-  ) || !Array.isArray(value.dimensions) || !value.dimensions.every(
+  ) || new Set(value.metrics.map((metric) => metric.name)).size !== value.metrics.length || !Array.isArray(value.dimensions) || !value.dimensions.every(
     (dimension) => typeof dimension === "string" && dimension.length > 0 && dimension.length <= 128
   ) || new Set(value.dimensions).size !== value.dimensions.length) {
     return false;
@@ -1089,7 +1214,7 @@ function constantTimeHexEqual(left, right) {
 function requireContentType(raw, allowed, code) {
   const mediaType = raw?.split(";", 1)[0]?.trim().toLowerCase();
   if (!mediaType || !allowed.includes(mediaType)) {
-    throw inspectionError(code, `Pinned document returned unsupported content type ${mediaType ?? "<missing>"}`);
+    throw inspectionError(code, "Pinned document returned an unsupported content type");
   }
 }
 function assertAllowedReferenceOrigin(raw, allowedOrigins, code) {
@@ -1111,8 +1236,28 @@ function sanitizeAjvErrors(errors) {
     message: error.message
   }));
 }
-function inspectionError(code, message, retryable = false, cause) {
-  return new ReportingInspectionError(code, message, retryable, void 0, cause === void 0 ? void 0 : { cause });
+function inspectionError(code, message, retryable = false, _cause) {
+  return new ReportingInspectionError(code, message, retryable);
+}
+async function invokeInspectionAdapter(callback, deadline, code, message, retryable = false) {
+  try {
+    assertInspectionDeadline(deadline);
+    const result = await withinInspectionDeadline(
+      Promise.resolve().then(() => {
+        assertInspectionDeadline(deadline);
+        return callback();
+      }),
+      deadline
+    );
+    assertInspectionDeadline(deadline);
+    return result;
+  } catch (error) {
+    throw error instanceof ReportingInspectionError ? new ReportingInspectionError(
+      error.code,
+      error.code === "INSPECTION_TIMEOUT" ? "Reporting inspection exceeded its configured deadline" : message,
+      error.retryable
+    ) : inspectionError(code, message, retryable);
+  }
 }
 function inspectionMismatch(code, message, observation) {
   return new ReportingInspectionError(code, message, false, void 0, void 0, observation);