coverage-check 0.6.0 → 0.7.1

package/README.md

@@ -51,12 +51,29 @@ The `--suite` flag on `check` tells the tool to use fresh `--artifacts` for the
 **S3 key layout:**
 
 ```text
-<prefix>/<suite>/sha/<sha>/lcov.info          # payload
-<prefix>/<suite>/branch/<encoded-branch>/latest.json  # pointer: { "sha": "...", "timestamp": "..." }
+<prefix>/<suite>/sha/<sha>/lcov.info.gz       # gzip payload for new versioned writes
+<prefix>/<suite>/branch/<encoded-branch>/latest.json  # pointer with sha, payloadKey, encoding, byte counts, timestamp
 ```
 
 S3-backed stores need `s3:PutObject` for writes and `s3:GetObject` for reading branch pointers and baselines. The pointer reader also checks the previous unencoded pointer key (for example `branch/main/latest.json`) so stores written before branch-name encoding remain readable.
 
+Versioned S3 writes (`store-put --sha ... --branch ...`) gzip the LCOV payload and write pointer
+metadata with `payloadKey`, `encoding`, `rawBytes`, and `storedBytes`. Existing raw
+`sha/<sha>/lcov.info` payloads and legacy `<suite>/lcov.info` payloads remain readable. Legacy
+writes without `--sha`/`--branch` keep the old raw `<suite>/lcov.info` layout.
+
+Every S3 operation logs a concise diagnostic line to stderr with the operation name, bucket, key,
+elapsed time, and byte counts where applicable. Use these lines to distinguish payload writes,
+branch-pointer reads, and branch-pointer writes when CI storage stalls.
+
+S3 request bounds are configurable with environment variables:
+
+| Variable                                  | Default | Purpose                                  |
+| ----------------------------------------- | ------- | ---------------------------------------- |
+| `COVERAGE_CHECK_S3_CONNECTION_TIMEOUT_MS` | `5000`  | Socket connection timeout for S3 calls   |
+| `COVERAGE_CHECK_S3_REQUEST_TIMEOUT_MS`    | `30000` | Whole-request timeout for S3 calls       |
+| `COVERAGE_CHECK_S3_MAX_ATTEMPTS`          | `2`     | AWS SDK attempt count, including retries |
+
 ### Suite store with filesystem
 
 For local development or simpler deployments:
@@ -120,6 +137,60 @@ Two common sources of confusion:
 The annotation affects only the stdout failure output. The GitHub PR sticky comment and Actions step
 summary are unchanged.
 
+### Merging LCOV files
+
+Use the `merge` subcommand to fold multiple `lcov.info` files into a single output that preserves function and branch records (`FN`, `FNDA`, `BRDA`) as well as summary counters (`LF/LH/FNF/FNH/BRF/BRH`):
+
+```sh
+coverage-check merge \
+  --artifacts ./coverage-artifacts \
+  --output ./coverage-merged/lcov.info
+```
+
+Hit counts are **summed** across inputs (consistent with the package's internal multi-suite merge). Parent directories of `--output` are created automatically.
+
+### Advisory (non-blocking) mode
+
+Pass `--advisory` to exit `0` even when coverage falls short. The check still runs in full — JSON is written, the PR comment is posted, and uncovered lines are printed — but the process never exits `1`. Useful for pre-push hooks where you want feedback without blocking the push:
+
+```sh
+coverage-check check \
+  --rules .coverage-rules.yml \
+  --artifacts ./coverage-artifacts \
+  --base origin/main \
+  --head HEAD \
+  --advisory
+```
+
+### PR-scoped regression gate
+
+By default, `no_coverage_drop` applies to every rule area regardless of what changed. Pass `--drop-only-changed-areas` to restrict the drop gate to rule areas that contain at least one changed file in the PR diff. Areas with no changed files are reported as `skipped` — they pass non-blockingly:
+
+```sh
+coverage-check check \
+  --rules .coverage-rules.yml \
+  --artifacts ./coverage-artifacts \
+  --base origin/main \
+  --head HEAD \
+  --drop-only-changed-areas
+```
+
+This avoids false positives when a CI run only exercises a subset of areas.
+
+### Required artifacts
+
+Pass `--require-artifact <relpath>` (repeatable) to fail early — exit `2` with a `::error::` annotation — if an expected `lcov.info` is absent from `--artifacts`. This distinguishes a missing coverage upload (CI job didn't run) from genuine uncovered lines:
+
+```sh
+coverage-check check \
+  --rules .coverage-rules.yml \
+  --artifacts ./coverage-artifacts \
+  --require-artifact coverage-backend/lcov.info \
+  --require-artifact coverage-frontend/lcov.info
+```
+
+`--require-artifact` is also accepted by `coverage-check merge`.
+
 ## Rules file
 
 ```yaml
@@ -166,22 +237,36 @@ First-match-wins means that if you have a more specific rule before a broader on
 
 ### `coverage-check check`
 
-| Flag                | Default                | Description                                                                                                |
-| ------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------- |
-| `--rules`           | `.coverage-rules.yml`  | Path to YAML rules file                                                                                    |
-| `--artifacts`       | `./coverage-artifacts` | Directory to scan for `lcov.info` files                                                                    |
-| `--base`            | `origin/main`          | Base git ref for `git diff`                                                                                |
-| `--head`            | `HEAD`                 | Head git ref for `git diff`                                                                                |
-| `--store-fs`        | —                      | Path to a filesystem suite store directory                                                                 |
-| `--store`           | —                      | Alias for `--store-fs`                                                                                     |
-| `--store-s3`        | —                      | S3 suite store spec: `<bucket>[/<prefix>]`                                                                 |
-| `--branch`          | `"main"`               | Branch pointer to follow when reading from the store                                                       |
-| `--suite`           | —                      | Name of the current suite (no `/` or `\\`); fresh artifacts override this suite in the store               |
-| `--strip-prefix`    | —                      | Extra path prefix to strip from LCOV `SF:` lines (repeatable)                                              |
-| `--pr`              | —                      | Pull request number for sticky comment                                                                     |
-| `--repo`            | `$GITHUB_REPOSITORY`   | `owner/repo` for sticky comment                                                                            |
-| `--json`            | —                      | Write JSON result to this path                                                                             |
-| `--annotate-source` | —                      | Print the trimmed source text of each uncovered line in stdout (does not alter PR comment or step summary) |
+| Flag                        | Default                | Description                                                                                                |
+| --------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------- |
+| `--rules`                   | `.coverage-rules.yml`  | Path to YAML rules file                                                                                    |
+| `--artifacts`               | `./coverage-artifacts` | Directory to scan for `lcov.info` files                                                                    |
+| `--base`                    | `origin/main`          | Base git ref for `git diff`                                                                                |
+| `--head`                    | `HEAD`                 | Head git ref for `git diff`                                                                                |
+| `--store-fs`                | —                      | Path to a filesystem suite store directory                                                                 |
+| `--store`                   | —                      | Alias for `--store-fs`                                                                                     |
+| `--store-s3`                | —                      | S3 suite store spec: `<bucket>[/<prefix>]`                                                                 |
+| `--branch`                  | `"main"`               | Branch pointer to follow when reading from the store                                                       |
+| `--suite`                   | —                      | Name of the current suite (no `/` or `\\`); fresh artifacts override this suite in the store               |
+| `--strip-prefix`            | —                      | Extra path prefix to strip from LCOV `SF:` lines (repeatable)                                              |
+| `--pr`                      | —                      | Pull request number for sticky comment                                                                     |
+| `--repo`                    | `$GITHUB_REPOSITORY`   | `owner/repo` for sticky comment                                                                            |
+| `--json`                    | —                      | Write JSON result to this path                                                                             |
+| `--annotate-source`         | —                      | Print the trimmed source text of each uncovered line in stdout (does not alter PR comment or step summary) |
+| `--advisory`                | —                      | Exit `0` even on shortfall; still prints, writes JSON, and posts PR comment                                |
+| `--drop-only-changed-areas` | —                      | Restrict `no_coverage_drop` to rule areas that have ≥1 changed file; others are reported as skipped        |
+| `--require-artifact`        | —                      | Fail (exit `2`) if this relative path is absent under `--artifacts` (repeatable)                           |
+
+### `coverage-check merge`
+
+| Flag                 | Default                | Description                                                   |
+| -------------------- | ---------------------- | ------------------------------------------------------------- |
+| `--artifacts`        | `./coverage-artifacts` | Directory to scan for `lcov.info` files                       |
+| `--output`           | required               | Path to write the merged `lcov.info`                          |
+| `--strip-prefix`     | —                      | Extra path prefix to strip from LCOV `SF:` lines (repeatable) |
+| `--require-artifact` | —                      | Fail (exit `2`) if this relative path is absent (repeatable)  |
+
+Hit counts are summed across all inputs. Function (`FN`/`FNDA`) and branch (`BRDA`) records are preserved; summary counters (`LF/LH/FNF/FNH/BRF/BRH`) are recomputed from the merged data.
 
 ### `coverage-check store-put`
 
@@ -203,7 +288,17 @@ When `--sha` and `--branch` are both provided, `store-put` writes a SHA-addresse
 ## Programmatic API
 
 ```ts
-import { runCheck, runStorePut, FileSystemSuiteStore, S3SuiteStore } from "coverage-check";
+import {
+  runCheck,
+  runMerge,
+  runStorePut,
+  collapseRanges,
+  parseLcovFull,
+  mergeLcovFull,
+  toLcovFull,
+  FileSystemSuiteStore,
+  S3SuiteStore,
+} from "coverage-check";
 
 // FileSystem store
 const fsStore = new FileSystemSuiteStore("/path/to/store");
@@ -223,6 +318,16 @@ await runCheck({
   store: s3Store,
   suite: "backend",
   branch: "main",
+  advisory: false,
+  dropOnlyChangedAreas: false,
+  requireArtifacts: [],
+});
+
+await runMerge({
+  artifacts: "./coverage-artifacts",
+  output: "./coverage-merged/lcov.info",
+  stripPrefixes: [],
+  requireArtifacts: [],
 });
 
 await runStorePut({
@@ -233,6 +338,15 @@ await runStorePut({
   sha: "abc123",
   branch: "main",
 });
+
+// Collapse a sorted line list into a compact range string
+collapseRanges([1, 2, 3, 7, 8]); // → "L1-3, L7-8"
+collapseRanges([1, 2, 3, 7, 8], ""); // → "1-3, 7-8"
+
+// Full-fidelity LCOV (functions + branches + lines)
+const full = parseLcovFull(lcovText, ["/home/runner/work/repo/repo/"]);
+const merged = mergeLcovFull([full1, full2]); // hits are summed
+const output = toLcovFull(merged); // includes FN/FNDA/BRDA and LF/LH/FNF/FNH/BRF/BRH
 ```
 
 You can also implement your own `SuiteStore`:

package/dist/src/cli.mjs

@@ -1,6 +1,7 @@
 import { main as checkMain } from "./commands/check.mjs";
 import { main as storePutMain } from "./commands/store-put.mjs";
 import { main as htmlMain } from "./commands/html.mjs";
+import { main as mergeMain } from "./commands/merge.mjs";
 import { main as summaryMain } from "./commands/summary.mjs";
 const stderr = (msg) => process.stderr.write(`${msg}\n`);
 export async function main(argv) {
@@ -11,6 +12,8 @@ export async function main(argv) {
         return checkMain(argv.slice(1));
     if (sub === "store-put")
         return storePutMain(argv.slice(1));
+    if (sub === "merge")
+        return mergeMain(argv.slice(1));
     if (sub === "html")
         return htmlMain(argv.slice(1));
     if (sub === "summary")

package/dist/src/commands/check-args.d.mts

@@ -18,5 +18,11 @@ export type CheckArgs = {
     summaryFile?: string | null;
     /** Annotate each uncovered line with its trimmed source text in stdout. Default: false. */
     annotateSource?: boolean;
+    /** Exit 0 even on coverage shortfall — compute and print, but never block. Default: false. */
+    advisory?: boolean;
+    /** Apply no_coverage_drop only to rules whose area has changed files in the diff. Default: false. */
+    dropOnlyChangedAreas?: boolean;
+    /** Relative paths under --artifacts that must exist before the check runs (repeatable). */
+    requireArtifacts?: string[];
 };
 export declare function parseCheckArgs(argv: string[]): CheckArgs;

package/dist/src/commands/check-args.mjs

@@ -17,6 +17,9 @@ export function parseCheckArgs(argv) {
         branch: "main",
         summaryFile: process.env["GITHUB_STEP_SUMMARY"] ?? null,
         annotateSource: false,
+        advisory: false,
+        dropOnlyChangedAreas: false,
+        requireArtifacts: [],
     };
     for (let i = 0; i < argv.length; i++) {
         const flag = argv[i];
@@ -80,6 +83,15 @@ export function parseCheckArgs(argv) {
             case "--annotate-source":
                 args.annotateSource = true;
                 break;
+            case "--advisory":
+                args.advisory = true;
+                break;
+            case "--drop-only-changed-areas":
+                args.dropOnlyChangedAreas = true;
+                break;
+            case "--require-artifact":
+                args.requireArtifacts.push(val());
+                break;
             default:
                 throw new Error(`unknown flag: ${flag}`);
         }

package/dist/src/commands/check-output.d.mts

@@ -1,4 +1,9 @@
 import type { DropResult, DiffLines, LcovData } from "../types.mts";
+/**
+ * Verifies that each required artifact path exists under artifactsDir.
+ * Prints `::error::` to stderr for each missing file and returns false if any are absent.
+ */
+export declare function checkRequiredArtifacts(artifactsDir: string, requireArtifacts: string[]): boolean;
 export declare function warnNonContributing(parsedSources: {
     name: string;
     lcov: LcovData;

package/dist/src/commands/check-output.mjs

@@ -1,3 +1,5 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
 const stdout = (msg) => process.stdout.write(`${msg}\n`);
 const stderr = (msg) => process.stderr.write(`${msg}\n`);
 function fmtPct(n) {
@@ -19,6 +21,20 @@ function lcovContributesToDiff(sourceLcov, diff) {
     }
     return false;
 }
+/**
+ * Verifies that each required artifact path exists under artifactsDir.
+ * Prints `::error::` to stderr for each missing file and returns false if any are absent.
+ */
+export function checkRequiredArtifacts(artifactsDir, requireArtifacts) {
+    let ok = true;
+    for (const rel of requireArtifacts) {
+        if (!existsSync(join(artifactsDir, rel))) {
+            stderr(`::error:: missing expected coverage artifact: ${rel}`);
+            ok = false;
+        }
+    }
+    return ok;
+}
 export function warnNonContributing(parsedSources, diff) {
     if (diff.size === 0)
         return;

package/dist/src/commands/check.mjs

@@ -3,7 +3,7 @@ import { parseLcov } from "../lcov-parser.mjs";
 import { mergeLcov } from "../lcov-merge.mjs";
 import { getChangedLines } from "../diff-parser.mjs";
 import { getChangedLineContent } from "../diff-parser-content.mjs";
-import { loadRules } from "../rules.mjs";
+import { loadRules, buildChangedRules } from "../rules.mjs";
 import { computePatchCoverage } from "../patch-coverage.mjs";
 import { computeCoverageDrop } from "../coverage-drop.mjs";
 import { collapseRanges, renderFailureComment } from "../report.mjs";
@@ -11,7 +11,7 @@ import { upsertComment } from "../github-comment.mjs";
 import { collectLcovFiles, buildStripPrefixes } from "../load-artifacts.mjs";
 import { writeSummary } from "../step-summary.mjs";
 import { parseCheckArgs } from "./check-args.mjs";
-import { warnNonContributing, printDropOutput } from "./check-output.mjs";
+import { warnNonContributing, printDropOutput, checkRequiredArtifacts } from "./check-output.mjs";
 const stdout = (msg) => process.stdout.write(`${msg}\n`);
 const stderr = (msg) => process.stderr.write(`${msg}\n`);
 export async function main(argv) {
@@ -34,6 +34,8 @@ export async function runCheck(args) {
         stderr(`coverage-check: failed to load rules: ${err}`);
         return 2;
     }
+    if (!checkRequiredArtifacts(args.artifacts, args.requireArtifacts ?? []))
+        return 2;
     const branch = args.branch ?? "main";
     const stripPrefixes = buildStripPrefixes(args.stripPrefixes);
     const reports = [];
@@ -106,7 +108,8 @@ export async function runCheck(args) {
         }
     }
     const { buckets, informational } = computePatchCoverage(diff, lcov, rules);
-    const drops = computeCoverageDrop(lcov, baseline, rules);
+    const changedRules = (args.dropOnlyChangedAreas ?? false) ? buildChangedRules(diff, rules) : undefined;
+    const drops = computeCoverageDrop(lcov, baseline, rules, changedRules);
     const passed = buckets.every((b) => b.passed) && drops.every((d) => d.passed || d.skipped);
     const result = { buckets, drops, informational, passed };
     if (args.json) {
@@ -166,5 +169,5 @@ export async function runCheck(args) {
             stderr(`coverage-check: failed to post PR comment: ${err}`);
         }
     }
-    return passed ? 0 : 1;
+    return (args.advisory ?? false) || passed ? 0 : 1;
 }

package/dist/src/commands/merge-args.d.mts

@@ -0,0 +1,7 @@
+export type MergeArgs = {
+    artifacts: string;
+    output: string;
+    stripPrefixes: string[];
+    requireArtifacts: string[];
+};
+export declare function parseMergeArgs(argv: string[]): MergeArgs;

package/dist/src/commands/merge-args.mjs

@@ -0,0 +1,38 @@
+export function parseMergeArgs(argv) {
+    const args = {
+        artifacts: "./coverage-artifacts",
+        output: "",
+        stripPrefixes: [],
+        requireArtifacts: [],
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const flag = argv[i];
+        const next = argv[i + 1];
+        const val = () => {
+            if (next === undefined || next.startsWith("--")) {
+                throw new Error(`${flag} requires a value`);
+            }
+            i++;
+            return next;
+        };
+        switch (flag) {
+            case "--artifacts":
+                args.artifacts = val();
+                break;
+            case "--output":
+                args.output = val();
+                break;
+            case "--strip-prefix":
+                args.stripPrefixes.push(val());
+                break;
+            case "--require-artifact":
+                args.requireArtifacts.push(val());
+                break;
+            default:
+                throw new Error(`unknown flag: ${flag}`);
+        }
+    }
+    if (!args.output)
+        throw new Error("--output is required");
+    return args;
+}

package/dist/src/commands/merge.d.mts

@@ -0,0 +1,9 @@
+import type { MergeArgs } from "./merge-args.mts";
+export type { MergeArgs } from "./merge-args.mts";
+export declare function main(argv: string[]): Promise<number>;
+/**
+ * Merges all lcov.info files found under args.artifacts into a single full-fidelity LCOV file.
+ * Preserves FN/FNDA/BRDA records and recomputes summary counters (FNF/FNH/BRF/BRH/LF/LH).
+ * Hit counts are summed across reports (lines, function hits, branch hits).
+ */
+export declare function runMerge(args: MergeArgs): number;

package/dist/src/commands/merge.mjs

@@ -0,0 +1,41 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { collectLcovFiles, buildStripPrefixes } from "../load-artifacts.mjs";
+import { parseLcovFull, mergeLcovFull, toLcovFull } from "../lcov-records.mjs";
+import { checkRequiredArtifacts } from "./check-output.mjs";
+import { parseMergeArgs } from "./merge-args.mjs";
+const stdout = (msg) => process.stdout.write(`${msg}\n`);
+const stderr = (msg) => process.stderr.write(`${msg}\n`);
+export async function main(argv) {
+    let args;
+    try {
+        args = parseMergeArgs(argv);
+    }
+    catch (err) {
+        stderr(`coverage-check merge: ${String(err)}`);
+        return 2;
+    }
+    return runMerge(args);
+}
+/**
+ * Merges all lcov.info files found under args.artifacts into a single full-fidelity LCOV file.
+ * Preserves FN/FNDA/BRDA records and recomputes summary counters (FNF/FNH/BRF/BRH/LF/LH).
+ * Hit counts are summed across reports (lines, function hits, branch hits).
+ */
+export function runMerge(args) {
+    if (!checkRequiredArtifacts(args.artifacts, args.requireArtifacts))
+        return 2;
+    const lcovFiles = collectLcovFiles(args.artifacts);
+    if (lcovFiles.length === 0) {
+        stderr(`coverage-check merge: no lcov.info files found under ${args.artifacts}`);
+        return 1;
+    }
+    const stripPrefixes = buildStripPrefixes(args.stripPrefixes);
+    const reports = lcovFiles.map((f) => parseLcovFull(readFileSync(f, "utf8"), stripPrefixes));
+    const merged = mergeLcovFull(reports);
+    const lcovText = toLcovFull(merged);
+    mkdirSync(dirname(args.output), { recursive: true });
+    writeFileSync(args.output, lcovText, "utf8");
+    stdout(`coverage-check merge: merged ${lcovFiles.length} file(s) → ${args.output}`);
+    return 0;
+}

package/dist/src/coverage-check.d.mts

@@ -1,11 +1,16 @@
 export { runCheck } from "./commands/check.mts";
 export { runStorePut } from "./commands/store-put.mts";
+export { runMerge } from "./commands/merge.mts";
 export { FileSystemSuiteStore } from "./suite-store.mts";
 export { S3SuiteStore } from "./s3-suite-store.mts";
 export { parseDiffWithContent, getChangedLineContent } from "./diff-parser-content.mts";
+export { collapseRanges } from "./report.mts";
+export { parseLcovFull, mergeLcovFull, toLcovFull } from "./lcov-records.mts";
 export type { CheckArgs } from "./commands/check.mts";
 export type { StorePutArgs } from "./commands/store-put.mts";
+export type { MergeArgs } from "./commands/merge.mts";
 export type { SuiteStore, SuiteMeta } from "./suite-store.mts";
 export type { S3SuiteStoreOptions } from "./s3-suite-store.mts";
 export { computeCoverageDrop } from "./coverage-drop.mts";
+export type { FullLcovData, FullFileCoverage } from "./lcov-records.mts";
 export type { CoverageCheckResult, BucketResult, DropResult, FileCoverageResult, LcovData, DiffLines, DiffLineContent, CoverageRule, } from "./types.mts";

package/dist/src/coverage-check.mjs

@@ -1,6 +1,9 @@
 export { runCheck } from "./commands/check.mjs";
 export { runStorePut } from "./commands/store-put.mjs";
+export { runMerge } from "./commands/merge.mjs";
 export { FileSystemSuiteStore } from "./suite-store.mjs";
 export { S3SuiteStore } from "./s3-suite-store.mjs";
 export { parseDiffWithContent, getChangedLineContent } from "./diff-parser-content.mjs";
+export { collapseRanges } from "./report.mjs";
+export { parseLcovFull, mergeLcovFull, toLcovFull } from "./lcov-records.mjs";
 export { computeCoverageDrop } from "./coverage-drop.mjs";

package/dist/src/coverage-drop.d.mts

@@ -1,2 +1,2 @@
 import type { CoverageRule, DropResult, LcovData } from "./types.mts";
-export declare function computeCoverageDrop(current: LcovData, baseline: LcovData | null, rules: CoverageRule[]): DropResult[];
+export declare function computeCoverageDrop(current: LcovData, baseline: LcovData | null, rules: CoverageRule[], changedRules?: Set<CoverageRule>): DropResult[];

package/dist/src/coverage-drop.mjs

@@ -13,11 +13,11 @@ function fileTotals(lcov, targetRule, allRules) {
     }
     return { hit, total };
 }
-export function computeCoverageDrop(current, baseline, rules) {
+export function computeCoverageDrop(current, baseline, rules, changedRules) {
     const dropRules = rules.filter((r) => r.no_coverage_drop);
     return dropRules.map((rule) => {
         const maxDrop = rule.max_coverage_drop ?? 0;
-        if (baseline === null) {
+        if (baseline === null || (changedRules !== undefined && !changedRules.has(rule))) {
             return {
                 rule: rule.paths,
                 currentPct: null,

package/dist/src/diff-parser.mjs

@@ -114,6 +114,9 @@ export function parseDiff(text) {
 }
 /** Runs git merge-base + git diff and returns the raw diff text. Internal shared helper. */
 export async function runGitDiff(baseRef, headRef) {
+    if (baseRef.startsWith("-") || headRef.startsWith("-")) {
+        throw new Error("Git reference cannot start with a hyphen (prevents argument injection)");
+    }
     const { spawn } = await import("node:child_process");
     const spawnProcess = (cmd, args) => new Promise((resolve, reject) => {
         const chunks = [];

package/dist/src/lcov-records.d.mts

@@ -0,0 +1,29 @@
+/**
+ * Full-fidelity LCOV data for one source file.
+ * Preserves function, branch, and line coverage records.
+ */
+export type FullFileCoverage = {
+    /** FN: definitions keyed by function name. */
+    functions: Map<string, {
+        line: number;
+        name: string;
+    }>;
+    /** FNDA: hit counts keyed by function name. */
+    functionHits: Map<string, number>;
+    /** BRDA: hit counts keyed by "lineNo,blockNo,branchNo". */
+    branches: Map<string, number>;
+    /** DA: hit counts keyed by line number. */
+    lines: Map<number, number>;
+};
+/** Map from normalized file path → full LCOV coverage data. */
+export type FullLcovData = Map<string, FullFileCoverage>;
+/**
+ * Parses full-fidelity LCOV, preserving FN/FNDA/BRDA/DA records.
+ * Hits from repeated records for the same line/function/branch are summed.
+ * Summary records (TN/LF/LH/FNF/FNH/BRF/BRH) are skipped and recomputed by toLcovFull.
+ */
+export declare function parseLcovFull(text: string, stripPrefixes?: string[]): FullLcovData;
+/** Merges multiple FullLcovData maps by summing all hit counts per file/line/function/branch. */
+export declare function mergeLcovFull(reports: FullLcovData[]): FullLcovData;
+/** Serializes FullLcovData to LCOV text with recomputed FNF/FNH/BRF/BRH/LF/LH summaries. */
+export declare function toLcovFull(lcov: FullLcovData): string;

package/dist/src/lcov-records.mjs

@@ -0,0 +1,155 @@
+function normalizeSfPath(rawPath, stripPrefixes) {
+    let path = rawPath.replace(/\\/g, "/").replace(/^\.\//, "");
+    for (const prefix of stripPrefixes) {
+        if (path.startsWith(prefix))
+            return path.slice(prefix.length);
+    }
+    if (path.startsWith("/") || /^[A-Z]:\//i.test(path)) {
+        const match = path.match(/^.*?\/_?work\/([^/]+)\/\1\//);
+        if (match)
+            return path.slice(match[0].length);
+    }
+    return path;
+}
+function getOrCreate(data, file) {
+    let cov = data.get(file);
+    if (cov === undefined) {
+        cov = { branches: new Map(), functionHits: new Map(), functions: new Map(), lines: new Map() };
+        data.set(file, cov);
+    }
+    return cov;
+}
+function applyRecord(line, cov) {
+    if (line.startsWith("FN:")) {
+        const comma = line.indexOf(",", 3);
+        if (comma === -1)
+            return;
+        const lineNum = parseInt(line.slice(3, comma), 10);
+        const name = line.slice(comma + 1);
+        if (Number.isFinite(lineNum) && name)
+            cov.functions.set(name, { line: lineNum, name });
+    }
+    else if (line.startsWith("FNDA:")) {
+        const comma = line.indexOf(",", 5);
+        if (comma === -1)
+            return;
+        const hits = parseInt(line.slice(5, comma), 10);
+        const name = line.slice(comma + 1);
+        if (Number.isFinite(hits) && name)
+            cov.functionHits.set(name, (cov.functionHits.get(name) ?? 0) + hits);
+    }
+    else if (line.startsWith("BRDA:")) {
+        const parts = line.slice(5).split(",");
+        if (parts.length !== 4)
+            return;
+        const key = `${parts[0]},${parts[1]},${parts[2]}`;
+        const raw = parts[3];
+        const hits = raw === "-" ? 0 : parseInt(raw, 10);
+        if (Number.isFinite(hits))
+            cov.branches.set(key, (cov.branches.get(key) ?? 0) + hits);
+    }
+    else if (line.startsWith("DA:")) {
+        const comma = line.indexOf(",", 3);
+        if (comma === -1)
+            return;
+        const lineNum = parseInt(line.slice(3, comma), 10);
+        const hits = parseInt(line.slice(comma + 1), 10);
+        if (Number.isFinite(lineNum) && Number.isFinite(hits))
+            cov.lines.set(lineNum, (cov.lines.get(lineNum) ?? 0) + hits);
+    }
+    // TN:, LF:, LH:, FNF:, FNH:, BRF:, BRH: are summary lines — recomputed by toLcovFull
+}
+/**
+ * Parses full-fidelity LCOV, preserving FN/FNDA/BRDA/DA records.
+ * Hits from repeated records for the same line/function/branch are summed.
+ * Summary records (TN/LF/LH/FNF/FNH/BRF/BRH) are skipped and recomputed by toLcovFull.
+ */
+export function parseLcovFull(text, stripPrefixes = []) {
+    const result = new Map();
+    let current = null;
+    let start = 0;
+    while (start < text.length) {
+        let end = text.indexOf("\n", start);
+        if (end === -1)
+            end = text.length;
+        let lineEnd = end;
+        while (lineEnd > start) {
+            const c = text.charCodeAt(lineEnd - 1);
+            if (c === 32 || c === 9 || c === 13) {
+                lineEnd--;
+                continue;
+            }
+            break;
+        }
+        if (text.startsWith("SF:", start)) {
+            current = getOrCreate(result, normalizeSfPath(text.slice(start + 3, lineEnd), stripPrefixes));
+        }
+        else if (lineEnd - start === 13 && text.startsWith("end_of_record", start)) {
+            current = null;
+        }
+        else if (current !== null) {
+            applyRecord(text.slice(start, lineEnd), current);
+        }
+        start = end + 1;
+    }
+    return result;
+}
+/** Merges multiple FullLcovData maps by summing all hit counts per file/line/function/branch. */
+export function mergeLcovFull(reports) {
+    const merged = new Map();
+    for (const report of reports) {
+        for (const [file, cov] of report) {
+            const target = merged.get(file);
+            if (target === undefined) {
+                merged.set(file, {
+                    functions: new Map(cov.functions),
+                    functionHits: new Map(cov.functionHits),
+                    branches: new Map(cov.branches),
+                    lines: new Map(cov.lines),
+                });
+            }
+            else {
+                for (const [name, def] of cov.functions) {
+                    if (!target.functions.has(name))
+                        target.functions.set(name, def);
+                }
+                for (const [name, hits] of cov.functionHits)
+                    target.functionHits.set(name, (target.functionHits.get(name) ?? 0) + hits);
+                for (const [key, hits] of cov.branches)
+                    target.branches.set(key, (target.branches.get(key) ?? 0) + hits);
+                for (const [lineNum, hits] of cov.lines)
+                    target.lines.set(lineNum, (target.lines.get(lineNum) ?? 0) + hits);
+            }
+        }
+    }
+    return merged;
+}
+/** Serializes FullLcovData to LCOV text with recomputed FNF/FNH/BRF/BRH/LF/LH summaries. */
+export function toLcovFull(lcov) {
+    if (lcov.size === 0)
+        return "";
+    const out = [];
+    for (const [file, cov] of [...lcov.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        out.push("TN:", `SF:${file}`);
+        const fns = [...cov.functions.values()].sort((a, b) => a.line - b.line || a.name.localeCompare(b.name));
+        for (const fn of fns)
+            out.push(`FN:${fn.line},${fn.name}`);
+        const fnHits = [...cov.functionHits.entries()].sort(([a], [b]) => a.localeCompare(b));
+        for (const [name, hits] of fnHits)
+            out.push(`FNDA:${hits},${name}`);
+        out.push(`FNF:${cov.functions.size}`);
+        out.push(`FNH:${[...cov.functionHits.values()].filter((h) => h > 0).length}`);
+        const brs = [...cov.branches.entries()].sort(([a], [b]) => a.localeCompare(b));
+        for (const [key, hits] of brs)
+            out.push(`BRDA:${key},${hits}`);
+        out.push(`BRF:${cov.branches.size}`);
+        out.push(`BRH:${[...cov.branches.values()].filter((h) => h > 0).length}`);
+        const lines = [...cov.lines.entries()].sort(([a], [b]) => a - b);
+        for (const [lineNum, hits] of lines)
+            out.push(`DA:${lineNum},${hits}`);
+        out.push(`LF:${cov.lines.size}`);
+        out.push(`LH:${[...cov.lines.values()].filter((h) => h > 0).length}`);
+        out.push("end_of_record");
+    }
+    return `${out.join("\n")}\n`;
+}

package/dist/src/lcov-to-istanbul.mjs

@@ -64,9 +64,16 @@ export function lcovBufferToIstanbul(lcov, stripPrefixes) {
             continue;
         const fileCov = coverage[filePath]; // filePath was validated against coverage when SF: was processed
         if (line.startsWith("DA:")) {
-            const [lineNo, hits] = line.slice(3).split(",", 2);
-            const l = Number.parseInt(lineNo, 10);
-            const h = Number.parseInt(hits ?? "", 10);
+            // Optimization: Instead of using `split(",")`, we use `indexOf` and `slice`
+            // to avoid allocating intermediate arrays, reducing garbage collection pauses.
+            const rest = line.slice(3);
+            const commaIdx = rest.indexOf(",");
+            if (commaIdx === -1)
+                continue;
+            const lineNoStr = rest.slice(0, commaIdx);
+            const hitsStr = rest.slice(commaIdx + 1);
+            const l = Number.parseInt(lineNoStr, 10);
+            const h = Number.parseInt(hitsStr, 10);
             if (!Number.isInteger(l) || !Number.isInteger(h))
                 continue;
             const key = String(l);
@@ -112,11 +119,25 @@ export function lcovBufferToIstanbul(lcov, stripPrefixes) {
             }
         }
         else if (line.startsWith("BRDA:")) {
-            const parts = line.slice(5).split(",", 4);
-            const lineNo = Number.parseInt(parts[0], 10);
-            const blockId = parts[1] ?? "";
-            const branchId = parts[2] ?? "";
-            const taken = parts[3] === "-" ? 0 : Number.parseInt(parts[3] ?? "", 10);
+            // Optimization: Instead of using `split(",")`, we use `indexOf` and `slice`
+            // to avoid allocating intermediate arrays, reducing garbage collection pauses.
+            const rest = line.slice(5);
+            let comma1 = rest.indexOf(",");
+            if (comma1 === -1)
+                continue;
+            let comma2 = rest.indexOf(",", comma1 + 1);
+            if (comma2 === -1)
+                continue;
+            let comma3 = rest.indexOf(",", comma2 + 1);
+            if (comma3 === -1)
+                continue;
+            const lineNoStr = rest.slice(0, comma1);
+            const blockId = rest.slice(comma1 + 1, comma2);
+            const branchId = rest.slice(comma2 + 1, comma3);
+            const comma4 = rest.indexOf(",", comma3 + 1);
+            const takenStr = comma4 === -1 ? rest.slice(comma3 + 1) : rest.slice(comma3 + 1, comma4);
+            const lineNo = Number.parseInt(lineNoStr, 10);
+            const taken = takenStr === "-" ? 0 : Number.parseInt(takenStr, 10);
             if (!Number.isInteger(lineNo) || !blockId || !branchId || !Number.isInteger(taken))
                 continue;
             const blockKey = `${lineNo}-${blockId}`;
@@ -140,7 +161,10 @@ export function lcovBufferToIstanbul(lcov, stripPrefixes) {
     for (const [fp, blocks] of fileBranches) {
         const fileCov = coverage[fp]; // fp was validated against coverage when added to fileBranches
         for (const [blockKey, branches] of blocks) {
-            const lineNo = Number.parseInt(blockKey.split("-")[0], 10); // blockKey is always "N-blockId"
+            // blockKey is always "N-blockId". Optimization: avoid split("-")
+            const dashIdx = blockKey.indexOf("-");
+            const lineNoStr = blockKey.slice(0, dashIdx);
+            const lineNo = Number.parseInt(lineNoStr, 10);
             const branchLoc = loc(lineNo);
             const sorted = [...branches.entries()].sort(([a], [b]) => a.localeCompare(b, undefined, { numeric: true }));
             fileCov.branchMap[blockKey] = {

package/dist/src/report.d.mts

@@ -1,4 +1,4 @@
 import type { CoverageCheckResult } from "./types.mts";
 export declare const COMMENT_MARKER = "<!-- coverage-check -->";
-export declare function collapseRanges(lines: number[]): string;
+export declare function collapseRanges(lines: number[], prefix?: string): string;
 export declare function renderFailureComment(result: CoverageCheckResult, runUrl: string, now?: string): string;

package/dist/src/report.mjs

@@ -1,5 +1,5 @@
 export const COMMENT_MARKER = "<!-- coverage-check -->";
-export function collapseRanges(lines) {
+export function collapseRanges(lines, prefix = "L") {
     if (lines.length === 0)
         return "";
     const sorted = [...lines].sort((a, b) => a - b);
@@ -12,12 +12,12 @@ export function collapseRanges(lines) {
             end = n;
         }
         else {
-            ranges.push(start === end ? `L${start}` : `L${start}-${end}`);
+            ranges.push(start === end ? `${prefix}${start}` : `${prefix}${start}-${end}`);
             start = n;
             end = n;
         }
     }
-    ranges.push(start === end ? `L${start}` : `L${start}-${end}`);
+    ranges.push(start === end ? `${prefix}${start}` : `${prefix}${start}-${end}`);
     return ranges.join(", ");
 }
 function pct(bucket) {

package/dist/src/rules.d.mts

@@ -1,4 +1,9 @@
-import type { CoverageRule } from "./types.mts";
+import type { CoverageRule, DiffLines } from "./types.mts";
 export declare function loadRules(rulesPath: string): CoverageRule[];
 /** Returns the first matching rule for a repo-root-relative file path, or null. */
 export declare function matchRule(file: string, rules: CoverageRule[]): CoverageRule | null;
+/**
+ * Returns the set of rules that have at least one changed file in the diff.
+ * Used by `--drop-only-changed-areas` to scope the coverage-drop gate.
+ */
+export declare function buildChangedRules(diff: DiffLines, rules: CoverageRule[]): Set<CoverageRule>;

package/dist/src/rules.mjs

@@ -44,3 +44,10 @@ export function matchRule(file, rules) {
     }
     return null;
 }
+/**
+ * Returns the set of rules that have at least one changed file in the diff.
+ * Used by `--drop-only-changed-areas` to scope the coverage-drop gate.
+ */
+export function buildChangedRules(diff, rules) {
+    return new Set([...diff.keys()].map((f) => matchRule(f, rules)).filter((r) => r !== null));
+}

package/dist/src/s3-diagnostics.d.mts

@@ -0,0 +1,9 @@
+export type ClientLike = {
+    send(cmd: object): Promise<unknown>;
+};
+export type S3OperationDetails = {
+    rawBytes?: number;
+    storedBytes?: number;
+};
+export declare function createS3Client(region?: string): ClientLike;
+export declare function sendS3(client: ClientLike, bucket: string, operation: string, key: string, command: object, details?: S3OperationDetails): Promise<unknown>;

package/dist/src/s3-diagnostics.mjs

@@ -0,0 +1,60 @@
+import { S3Client } from "@aws-sdk/client-s3";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+export function createS3Client(region) {
+    return new S3Client({
+        maxAttempts: readPositiveIntEnv("COVERAGE_CHECK_S3_MAX_ATTEMPTS", 2),
+        region,
+        requestHandler: new NodeHttpHandler({
+            connectionTimeout: readPositiveIntEnv("COVERAGE_CHECK_S3_CONNECTION_TIMEOUT_MS", 5000),
+            requestTimeout: readPositiveIntEnv("COVERAGE_CHECK_S3_REQUEST_TIMEOUT_MS", 30000),
+        }),
+    });
+}
+export async function sendS3(client, bucket, operation, key, command, details = {}) {
+    const start = performance.now();
+    try {
+        const result = await client.send(command);
+        logS3(bucket, operation, key, "ok", performance.now() - start, details);
+        return result;
+    }
+    catch (err) {
+        logS3(bucket, operation, key, "failed", performance.now() - start, {
+            ...details,
+            error: formatError(err),
+        });
+        throw err;
+    }
+}
+function logS3(bucket, operation, key, status, elapsedMs, details) {
+    const parts = [
+        "coverage-check s3",
+        `operation=${JSON.stringify(operation)}`,
+        `status=${status}`,
+        `bucket=${JSON.stringify(bucket)}`,
+        `key=${JSON.stringify(key)}`,
+        `elapsed_ms=${Math.round(elapsedMs)}`,
+    ];
+    if (details.rawBytes !== undefined)
+        parts.push(`raw_bytes=${details.rawBytes}`);
+    if (details.storedBytes !== undefined)
+        parts.push(`stored_bytes=${details.storedBytes}`);
+    if (details.error !== undefined)
+        parts.push(`error=${JSON.stringify(details.error)}`);
+    process.stderr.write(`${parts.join(" ")}\n`);
+}
+function readPositiveIntEnv(name, fallback) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === "")
+        return fallback;
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value <= 0) {
+        process.stderr.write(`coverage-check s3 invalid ${name}=${JSON.stringify(raw)}; using ${fallback}\n`);
+        return fallback;
+    }
+    return value;
+}
+function formatError(err) {
+    if (err instanceof Error)
+        return `${err.name}: ${err.message}`;
+    return String(err);
+}

package/dist/src/s3-suite-store-reads.d.mts

@@ -0,0 +1,17 @@
+export type StoredPointer = {
+    sha: string;
+    timestamp?: string;
+    payloadKey?: string;
+    encoding?: "gzip";
+    rawBytes?: number;
+    storedBytes?: number;
+};
+type ReadContext = {
+    bucket: string;
+    key(...parts: string[]): string;
+    sendS3(operation: string, key: string, command: object): Promise<unknown>;
+};
+export declare function getLegacy(ctx: ReadContext, suite: string): Promise<Buffer | null>;
+export declare function shouldWritePointer(ctx: ReadContext, suite: string, branch: string, incomingTimestamp: string): Promise<boolean>;
+export declare function readPointer(ctx: ReadContext, suite: string, branch: string): Promise<StoredPointer>;
+export {};

package/dist/src/s3-suite-store-reads.mjs

@@ -0,0 +1,57 @@
+import { GetObjectCommand } from "@aws-sdk/client-s3";
+import { encodeBranchName, isNewerTimestamp } from "./suite-store.mjs";
+import { bodyToBuffer, isNotFound } from "./s3-utils.mjs";
+export async function getLegacy(ctx, suite) {
+    const key = ctx.key(suite, "lcov.info");
+    try {
+        const resp = (await ctx.sendS3("get legacy coverage payload", key, new GetObjectCommand({
+            Bucket: ctx.bucket,
+            Key: key,
+        })));
+        return bodyToBuffer(resp.Body);
+    }
+    catch (err) {
+        if (isNotFound(err))
+            return null;
+        throw err;
+    }
+}
+export async function shouldWritePointer(ctx, suite, branch, incomingTimestamp) {
+    const key = ctx.key(suite, "branch", encodeBranchName(branch), "latest.json");
+    try {
+        const resp = (await ctx.sendS3("get branch pointer for compare", key, new GetObjectCommand({
+            Bucket: ctx.bucket,
+            Key: key,
+        })));
+        if (resp.Body === undefined)
+            return true;
+        const body = await bodyToBuffer(resp.Body);
+        const current = JSON.parse(body.toString("utf8"));
+        return !isNewerTimestamp(current.timestamp, incomingTimestamp);
+    }
+    catch (err) {
+        if (isNotFound(err))
+            return true;
+        throw err;
+    }
+}
+export async function readPointer(ctx, suite, branch) {
+    const keys = [
+        ctx.key(suite, "branch", encodeBranchName(branch), "latest.json"),
+        ctx.key(suite, "branch", branch, "latest.json"),
+    ];
+    let lastNotFound;
+    for (const key of keys) {
+        try {
+            const resp = (await ctx.sendS3("get branch pointer", key, new GetObjectCommand({ Bucket: ctx.bucket, Key: key })));
+            const body = await bodyToBuffer(resp.Body);
+            return JSON.parse(body.toString("utf8"));
+        }
+        catch (err) {
+            if (!isNotFound(err))
+                throw err;
+            lastNotFound = err;
+        }
+    }
+    throw lastNotFound;
+}

package/dist/src/s3-suite-store.d.mts

@@ -1,7 +1,5 @@
+import type { ClientLike, S3OperationDetails } from "./s3-diagnostics.mts";
 import type { SuitePutMeta, SuiteStore } from "./suite-store.mts";
-type ClientLike = {
-    send(cmd: object): Promise<unknown>;
-};
 export type S3SuiteStoreOptions = {
     bucket: string;
     prefix?: string;
@@ -10,19 +8,19 @@ export type S3SuiteStoreOptions = {
     client?: ClientLike;
 };
 export declare class S3SuiteStore implements SuiteStore {
-    private readonly bucket;
+    readonly bucket: string;
     private readonly prefix;
     private readonly client;
     constructor({ bucket, prefix, region, client }: S3SuiteStoreOptions);
-    private key;
+    key(...parts: string[]): string;
     list(): Promise<string[]>;
     get(suite: string, opts?: {
         sha?: string;
         branch?: string;
     }): Promise<Buffer | null>;
     put(suite: string, lcov: Buffer, meta?: SuitePutMeta): Promise<void>;
-    private getLegacy;
-    private shouldWritePointer;
-    private readPointer;
+    sendS3(operation: string, key: string, command: object, details?: S3OperationDetails): Promise<unknown>;
+    private getVersionedPayload;
+    private putLegacyPayload;
+    private putPointer;
 }
-export {};

package/dist/src/s3-suite-store.mjs

@@ -1,5 +1,8 @@
-import { GetObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from "@aws-sdk/client-s3";
-import { assertSafePathComponent, assertValidTimestamp, encodeBranchName, isNewerTimestamp, } from "./suite-store.mjs";
+import { GetObjectCommand, ListObjectsV2Command, PutObjectCommand } from "@aws-sdk/client-s3";
+import { gunzipSync, gzipSync } from "node:zlib";
+import { assertSafePathComponent, assertValidTimestamp, encodeBranchName } from "./suite-store.mjs";
+import { createS3Client, sendS3 } from "./s3-diagnostics.mjs";
+import { getLegacy, readPointer, shouldWritePointer } from "./s3-suite-store-reads.mjs";
 import { bodyToBuffer, isNotFound } from "./s3-utils.mjs";
 export class S3SuiteStore {
     bucket;
@@ -8,7 +11,7 @@ export class S3SuiteStore {
     constructor({ bucket, prefix, region, client }) {
         this.bucket = bucket;
         this.prefix = prefix ? prefix.replace(/\/+$/, "") : "";
-        this.client = client ?? new S3Client({ region });
+        this.client = client ?? createS3Client(region);
     }
     key(...parts) {
         return this.prefix ? [this.prefix, ...parts].join("/") : parts.join("/");
@@ -18,7 +21,7 @@ export class S3SuiteStore {
         const suites = [];
         let continuationToken;
         do {
-            const resp = (await this.client.send(new ListObjectsV2Command({
+            const resp = (await this.sendS3("list suites", this.key(), new ListObjectsV2Command({
                 Bucket: this.bucket,
                 Prefix: pfx,
                 Delimiter: "/",
@@ -36,112 +39,101 @@ export class S3SuiteStore {
         if (opts?.sha !== undefined)
             assertSafePathComponent(opts.sha, "sha");
         let sha = opts?.sha;
+        let pointer = null;
         if (!sha) {
             const branch = opts?.branch ?? "main";
             try {
-                const pointer = await this.readPointer(suite, branch);
+                pointer = await readPointer(this, suite, branch);
                 assertSafePathComponent(pointer.sha, "sha");
                 sha = pointer.sha;
             }
             catch (err) {
                 if (isNotFound(err))
-                    return this.getLegacy(suite);
+                    return getLegacy(this, suite);
                 throw err;
             }
         }
-        try {
-            const resp = (await this.client.send(new GetObjectCommand({
-                Bucket: this.bucket,
-                Key: this.key(suite, "sha", sha, "lcov.info"),
-            })));
-            return bodyToBuffer(resp.Body);
-        }
-        catch (err) {
-            if (isNotFound(err))
-                return null;
-            throw err;
-        }
+        return this.getVersionedPayload(suite, sha, pointer, opts?.sha !== undefined);
     }
     async put(suite, lcov, meta) {
         assertSafePathComponent(suite, "suite");
         if (meta === undefined) {
-            await this.client.send(new PutObjectCommand({
-                Bucket: this.bucket,
-                Key: this.key(suite, "lcov.info"),
-                Body: lcov,
-                ContentType: "text/plain",
-            }));
+            await this.putLegacyPayload(suite, lcov);
             return;
         }
         const { sha, branch } = meta;
         assertSafePathComponent(sha, "sha");
         const ts = meta.timestamp ?? new Date().toISOString();
         assertValidTimestamp(ts);
-        await this.client.send(new PutObjectCommand({
+        const payload = gzipSync(lcov);
+        const payloadKey = this.key(suite, "sha", sha, "lcov.info.gz");
+        await this.sendS3("put coverage payload", payloadKey, new PutObjectCommand({
             Bucket: this.bucket,
-            Key: this.key(suite, "sha", sha, "lcov.info"),
-            Body: lcov,
+            Key: payloadKey,
+            Body: payload,
+            ContentEncoding: "gzip",
             ContentType: "text/plain",
-        }));
-        if (!(await this.shouldWritePointer(suite, branch, ts)))
+        }), { rawBytes: lcov.byteLength, storedBytes: payload.byteLength });
+        if (!(await shouldWritePointer(this, suite, branch, ts)))
             return;
-        await this.client.send(new PutObjectCommand({
-            Bucket: this.bucket,
-            Key: this.key(suite, "branch", encodeBranchName(branch), "latest.json"),
-            Body: Buffer.from(JSON.stringify({ sha, timestamp: ts }), "utf8"),
-            ContentType: "application/json",
-        }));
+        await this.putPointer(suite, branch, sha, ts, payloadKey, lcov.byteLength, payload.byteLength);
     }
-    async getLegacy(suite) {
-        try {
-            const resp = (await this.client.send(new GetObjectCommand({
-                Bucket: this.bucket,
-                Key: this.key(suite, "lcov.info"),
-            })));
-            return bodyToBuffer(resp.Body);
-        }
-        catch (err) {
-            if (isNotFound(err))
-                return null;
-            throw err;
-        }
+    sendS3(operation, key, command, details = {}) {
+        return sendS3(this.client, this.bucket, operation, key, command, details);
     }
-    async shouldWritePointer(suite, branch, incomingTimestamp) {
-        try {
-            const resp = (await this.client.send(new GetObjectCommand({
-                Bucket: this.bucket,
-                Key: this.key(suite, "branch", encodeBranchName(branch), "latest.json"),
-            })));
-            if (resp.Body === undefined)
-                return true;
-            const body = await bodyToBuffer(resp.Body);
-            const current = JSON.parse(body.toString("utf8"));
-            return !isNewerTimestamp(current.timestamp, incomingTimestamp);
+    async getVersionedPayload(suite, sha, pointer, explicitSha) {
+        let candidates;
+        if (pointer?.payloadKey !== undefined) {
+            candidates = [{ key: pointer.payloadKey, encoding: pointer.encoding }];
         }
-        catch (err) {
-            if (isNotFound(err))
-                return true;
-            throw err;
+        else if (explicitSha) {
+            candidates = [
+                { key: this.key(suite, "sha", sha, "lcov.info.gz"), encoding: "gzip" },
+                { key: this.key(suite, "sha", sha, "lcov.info"), encoding: undefined },
+            ];
         }
-    }
-    async readPointer(suite, branch) {
-        const keys = [
-            this.key(suite, "branch", encodeBranchName(branch), "latest.json"),
-            this.key(suite, "branch", branch, "latest.json"),
-        ];
-        let lastNotFound;
-        for (const key of keys) {
+        else {
+            candidates = [{ key: this.key(suite, "sha", sha, "lcov.info"), encoding: undefined }];
+        }
+        for (const candidate of candidates) {
             try {
-                const resp = (await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key })));
+                const resp = (await this.sendS3("get coverage payload", candidate.key, new GetObjectCommand({
+                    Bucket: this.bucket,
+                    Key: candidate.key,
+                })));
                 const body = await bodyToBuffer(resp.Body);
-                return JSON.parse(body.toString("utf8"));
+                return candidate.encoding === "gzip" ? gunzipSync(body) : body;
             }
             catch (err) {
                 if (!isNotFound(err))
                     throw err;
-                lastNotFound = err;
             }
         }
-        throw lastNotFound;
+        return null;
+    }
+    async putLegacyPayload(suite, lcov) {
+        const key = this.key(suite, "lcov.info");
+        await this.sendS3("put legacy coverage payload", key, new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: key,
+            Body: lcov,
+            ContentType: "text/plain",
+        }));
+    }
+    async putPointer(suite, branch, sha, timestamp, payloadKey, rawBytes, storedBytes) {
+        const pointerKey = this.key(suite, "branch", encodeBranchName(branch), "latest.json");
+        await this.sendS3("put branch pointer", pointerKey, new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: pointerKey,
+            Body: Buffer.from(JSON.stringify({
+                sha,
+                timestamp,
+                payloadKey,
+                encoding: "gzip",
+                rawBytes,
+                storedBytes,
+            }), "utf8"),
+            ContentType: "application/json",
+        }));
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coverage-check",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Patch-coverage gate: checks that newly added lines meet per-path coverage thresholds. Supports per-suite LCOV accumulation for conditional CI.",
   "license": "MIT",
   "author": "Jonathan Ong",
@@ -32,6 +32,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1048.0",
+    "@smithy/node-http-handler": "^4.7.7",
     "js-yaml": "^4.1.1",
     "monocart-coverage-reports": "^2.12.11"
   },
@@ -40,7 +41,7 @@
     "@types/node": "^25.8.0",
     "@vitest/coverage-v8": "^4.1.6",
     "husky": "^9.1.7",
-    "oxfmt": "^0.50.0",
+    "oxfmt": "^0.52.0",
     "oxlint": "^1.65.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.6"