vouchington-tooling 0.0.19 → 0.0.20

package/dist/index.d.mts

@@ -8,7 +8,7 @@ export type { GhApiExecutor, RuntimeAuditOptions, RuntimeAuditResult, RuntimeAud
 export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mts';
 export type { InspectedVitestBlobBundle, VitestBlobIdentity, VitestBlobManifest, VitestReportAttempt, VitestReportAttemptIdentity, } from './vitest-blob-manifest/index.mts';
 export { prepareVitestReports } from './vitest-blob-manifest/reports.mts';
-export type { PrepareVitestReportsOptions, SelectedVitestReport, VitestReportExpectation, } from './vitest-blob-manifest/reports.mts';
+export type { PrepareVitestReportsOptions, RejectedVitestReportSource, SelectedVitestReport, VitestReportExpectation, VitestReportRejectionReason, } from './vitest-blob-manifest/reports.mts';
 export { findWorkspaceLinkMismatches, formatReleaseAgeFailure, INSTALL_TERMINATION_FAILED, isReleaseAgeViolation, parseInstallOptions, parseReleaseAgeViolations, runInstallLifecycle, } from './pnpm-install/index.mts';
 export type { InstallOptions, Lifecycle } from './pnpm-install/index.mts';
 export { flattenReleaseAgeSelectors, packageNameFromPnpmLockKey, pnpmLockPackageKeyMatchesSelector, validateReleaseAgeExemptionGroups, validateReleaseAgePolicy, } from './pnpm-install/index.mts';

package/dist/vitest-blob-manifest/bundle-error.d.mts

@@ -0,0 +1,2 @@
+export declare class VitestBlobBundleError extends Error {
+}

package/dist/vitest-blob-manifest/bundle-error.mjs

@@ -0,0 +1,2 @@
+export class VitestBlobBundleError extends Error {
+}

package/dist/vitest-blob-manifest/index.mjs

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { lstatSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { basename, join } from 'node:path';
 import { VITEST_SUITE_PATTERN } from './constants.mjs';
+import { VitestBlobBundleError } from './bundle-error.mjs';
 export * from './report-attempt.mjs';
 export { VITEST_SUITE_PATTERN } from './constants.mjs';
 export const VITEST_BLOB_MANIFEST_FILENAME = 'vitest-blob-manifest.json';
@@ -89,9 +90,7 @@ export function writeVitestBlobManifest(directory, identity) {
         try {
             unlinkSync(temporaryPath);
         }
-        catch {
-            // Successful rename removes the temporary path.
-        }
+        catch { }
     }
     return manifestPath;
 }
@@ -105,11 +104,13 @@ export function vitestBlobBundlePaths(directory, suite) {
     return [manifestPath, reportPath];
 }
 export function inspectVitestBlobBundle(directory) {
-    const entries = readdirSync(directory, { withFileTypes: true });
+    const entries = readdirSync(directory, { withFileTypes: true }), name = basename(directory);
     if (entries.length !== 2 || entries.some((entry) => !entry.isFile())) {
-        throw new Error(`Vitest blob bundle ${basename(directory)} must contain exactly two files`);
+        throw new VitestBlobBundleError(`Vitest blob bundle ${name} must contain exactly two files`);
     }
     const manifestPath = join(directory, VITEST_BLOB_MANIFEST_FILENAME);
+    if (!entries.some((entry) => entry.name === VITEST_BLOB_MANIFEST_FILENAME))
+        throw new VitestBlobBundleError(`Invalid Vitest blob bundle ${name}`);
     assertRegularFile(manifestPath, 'Vitest blob manifest');
     const manifestBytes = readFileSync(manifestPath);
     let manifest;
@@ -117,20 +118,24 @@ export function inspectVitestBlobBundle(directory) {
         manifest = parseVitestBlobManifest(JSON.parse(manifestBytes.toString('utf8')));
     }
     catch (error) {
-        throw new Error(`Invalid Vitest blob bundle ${basename(directory)}`, { cause: error });
+        throw new VitestBlobBundleError(`Invalid Vitest blob bundle ${name}`, { cause: error });
     }
     const reportPath = join(directory, manifest.report.filename);
+    if (!entries.some((entry) => entry.name === manifest.report.filename))
+        throw new VitestBlobBundleError(`Invalid Vitest blob bundle ${name}`);
     assertRegularFile(reportPath, 'Vitest blob report');
     const reportBytes = readFileSync(reportPath);
     if (reportBytes.byteLength !== manifest.report.byteLength ||
         sha256(reportBytes) !== manifest.report.sha256) {
-        throw new Error(`Vitest blob report integrity check failed for ${manifest.suite}`);
+        throw new VitestBlobBundleError(`Vitest blob report integrity check failed for ${manifest.suite}`);
     }
     try {
         JSON.parse(reportBytes.toString('utf8'));
     }
     catch (error) {
-        throw new Error(`Vitest blob report is not valid JSON for ${manifest.suite}`, { cause: error });
+        throw new VitestBlobBundleError(`Vitest blob report is not valid JSON for ${manifest.suite}`, {
+            cause: error,
+        });
     }
     return { directory, manifest, manifestBytes, reportBytes };
 }

package/dist/vitest-blob-manifest/reports-source.d.mts

@@ -0,0 +1,26 @@
+import { type InspectedVitestBlobBundle } from './index.mts';
+export type VitestReportSource = 'primary' | 'fallback';
+export type VitestReportRejectionReason = 'root-not-directory' | 'invalid-archive' | 'unexpected-entry' | 'invalid-bundle' | 'identity-mismatch' | 'future-attempt' | 'intra-source-conflict' | 'unexpected-current-attempt-suite';
+export interface RejectedVitestReportSource {
+    readonly source: VitestReportSource;
+    readonly reason: VitestReportRejectionReason;
+}
+export type Candidate = InspectedVitestBlobBundle & {
+    readonly source: VitestReportSource;
+};
+type SourceOptions = {
+    readonly repository: string;
+    readonly revision: string;
+    readonly run: {
+        readonly id: string;
+        readonly currentAttempt: number;
+    };
+    readonly expectedSuites: readonly {
+        readonly suite: string;
+    }[];
+};
+export declare function inspectVitestReportSource(root: string, source: VitestReportSource, options: SourceOptions): {
+    readonly candidates: readonly Candidate[];
+    readonly rejected?: RejectedVitestReportSource;
+};
+export {};

package/dist/vitest-blob-manifest/reports-source.mjs

@@ -0,0 +1,88 @@
+import { lstatSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { inspectVitestBlobBundle, VITEST_BLOB_MANIFEST_FILENAME, VITEST_SUITE_PATTERN, } from './index.mjs';
+import { VitestBlobBundleError } from './bundle-error.mjs';
+class SourceFailure extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+    }
+}
+function bundle(root, source) {
+    const entries = readdirSync(root, { withFileTypes: true });
+    if (entries.length === 0)
+        return [];
+    if (entries.some((entry) => entry.name === VITEST_BLOB_MANIFEST_FILENAME)) {
+        try {
+            return [{ ...inspectVitestBlobBundle(root), source }];
+        }
+        catch (error) {
+            if (error instanceof VitestBlobBundleError)
+                throw new SourceFailure('invalid-bundle');
+            throw error;
+        }
+    }
+    if (entries.some((entry) => entry.isFile() &&
+        entry.name.startsWith('.invalid-') &&
+        VITEST_SUITE_PATTERN.test(entry.name.slice('.invalid-'.length))))
+        throw new SourceFailure('invalid-archive');
+    if (entries.some((entry) => !entry.isDirectory()))
+        throw new SourceFailure('unexpected-entry');
+    try {
+        return entries
+            .toSorted((left, right) => left.name.localeCompare(right.name))
+            .map((entry) => ({ ...inspectVitestBlobBundle(join(root, entry.name)), source }));
+    }
+    catch (error) {
+        if (error instanceof VitestBlobBundleError)
+            throw new SourceFailure('invalid-bundle');
+        throw error;
+    }
+}
+function validate(candidates, options) {
+    const expected = new Set(options.expectedSuites.map((expectation) => expectation.suite));
+    const first = new Map();
+    for (const candidate of candidates) {
+        const { manifest } = candidate;
+        if (manifest.repository !== options.repository ||
+            manifest.revision !== options.revision ||
+            manifest.run.id !== options.run.id)
+            throw new SourceFailure('identity-mismatch');
+        if (manifest.run.attempt > options.run.currentAttempt)
+            throw new SourceFailure('future-attempt');
+        if (!expected.has(manifest.suite) && manifest.run.attempt === options.run.currentAttempt)
+            throw new SourceFailure('unexpected-current-attempt-suite');
+        const key = `${manifest.suite}\0${manifest.run.attempt}`, prior = first.get(key);
+        if (prior &&
+            (!prior.manifestBytes.equals(candidate.manifestBytes) ||
+                !prior.reportBytes.equals(candidate.reportBytes)))
+            throw new SourceFailure('intra-source-conflict');
+        first.set(key, prior ?? candidate);
+    }
+}
+export function inspectVitestReportSource(root, source, options) {
+    let metadata;
+    try {
+        metadata = lstatSync(root);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            'code' in error &&
+            error.code === 'ENOENT')
+            return { candidates: [] };
+        throw error;
+    }
+    if (!metadata.isDirectory())
+        return { candidates: [], rejected: { source, reason: 'root-not-directory' } };
+    try {
+        const candidates = bundle(root, source);
+        validate(candidates, options);
+        return { candidates };
+    }
+    catch (error) {
+        if (error instanceof SourceFailure)
+            return { candidates: [], rejected: { source, reason: error.reason } };
+        throw error;
+    }
+}

package/dist/vitest-blob-manifest/reports.d.mts

@@ -1,3 +1,4 @@
+import { type RejectedVitestReportSource, type VitestReportSource } from './reports-source.mts';
 export interface PrepareVitestReportsOptions {
     readonly primaryDir: string;
     readonly fallbackDir: string;
@@ -17,12 +18,11 @@ export type VitestReportExpectation = {
 export interface SelectedVitestReport {
     readonly suite: string;
     readonly attempt: number;
-    readonly sources: readonly ('primary' | 'fallback')[];
+    readonly sources: readonly VitestReportSource[];
 }
-/**
- * Validates untrusted blob bundles and atomically publishes one newest report per expected suite.
- * The caller owns artifact transport; this function deliberately has no network or CI-provider API.
- */
+export type { RejectedVitestReportSource, VitestReportRejectionReason } from './reports-source.mts';
+/** Validates untrusted blob bundles and atomically publishes one newest report per expected suite. */
 export declare function prepareVitestReports(options: PrepareVitestReportsOptions): {
     readonly selected: readonly SelectedVitestReport[];
+    readonly rejectedSources: readonly RejectedVitestReportSource[];
 };

package/dist/vitest-blob-manifest/reports.mjs

@@ -1,90 +1,42 @@
-/* eslint-disable max-lines -- untrusted artifact discovery and publication form one security boundary. */
 import { randomUUID } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
-import { inspectVitestBlobBundle, VITEST_BLOB_MANIFEST_FILENAME, VITEST_SUITE_PATTERN, } from './index.mjs';
-function inspectSource(root, source) {
-    if (!existsSync(root))
-        return [];
-    if (!lstatSync(root).isDirectory())
-        throw new Error(`Vitest ${source} root must be a directory`);
-    const entries = readdirSync(root, { withFileTypes: true });
-    if (entries.length === 0)
-        return [];
-    const isFlattened = entries.some((entry) => entry.name === VITEST_BLOB_MANIFEST_FILENAME);
-    if (isFlattened)
-        return [{ ...inspectVitestBlobBundle(root), source }];
-    const invalid = entries.find((entry) => {
-        const suite = entry.name.startsWith('.invalid-') ? entry.name.slice('.invalid-'.length) : '';
-        return entry.isFile() && VITEST_SUITE_PATTERN.test(suite);
-    });
-    if (invalid)
-        throw new Error(`Vitest ${source} root contains an invalid archive marker`);
-    const unexpected = entries.find((entry) => !entry.isDirectory());
-    if (unexpected)
-        throw new Error(`Vitest ${source} root has an unexpected entry`);
-    return entries
-        .toSorted((left, right) => left.name.localeCompare(right.name))
-        .map((entry) => ({ ...inspectVitestBlobBundle(join(root, entry.name)), source }));
-}
+import { VITEST_SUITE_PATTERN } from './index.mjs';
+import { inspectVitestReportSource, } from './reports-source.mjs';
 function validateOptions(options) {
-    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(options.repository)) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(options.repository))
         throw new Error('Invalid Vitest repository');
-    }
     if (!/^[0-9a-f]{40}$/.test(options.revision))
         throw new Error('Invalid Vitest revision');
-    if (!/^[1-9][0-9]*$/.test(options.run.id) || !Number.isSafeInteger(options.run.currentAttempt)) {
-        throw new Error('Invalid Vitest run');
-    }
-    if (options.run.currentAttempt < 1)
+    if (!/^[1-9][0-9]*$/.test(options.run.id) ||
+        !Number.isSafeInteger(options.run.currentAttempt) ||
+        options.run.currentAttempt < 1)
         throw new Error('Invalid Vitest run');
     for (const expectation of options.expectedSuites) {
-        if (!VITEST_SUITE_PATTERN.test(expectation.suite) ||
-            !Number.isSafeInteger(expectation.minimumAttempt)) {
+        if (!VITEST_SUITE_PATTERN.test(expectation.suite))
             throw new Error('Invalid expected Vitest suite');
-        }
-        if (expectation.minimumAttempt < 1 || expectation.minimumAttempt > options.run.currentAttempt) {
+        if (!Number.isSafeInteger(expectation.minimumAttempt) ||
+            expectation.minimumAttempt < 1 ||
+            expectation.minimumAttempt > options.run.currentAttempt)
             throw new Error('Invalid expected Vitest suite attempt');
-        }
-    }
-}
-function validateIdentity(candidate, options) {
-    const { manifest } = candidate;
-    if (manifest.repository !== options.repository ||
-        manifest.revision !== options.revision ||
-        manifest.run.id !== options.run.id) {
-        throw new Error(`Vitest blob identity does not match this run for ${manifest.suite}`);
     }
-    if (manifest.run.attempt > options.run.currentAttempt) {
-        throw new Error(`Vitest blob attempt is from the future for ${manifest.suite}`);
-    }
-}
-function identical(left, right) {
-    return (left.manifestBytes.equals(right.manifestBytes) && left.reportBytes.equals(right.reportBytes));
+    if (new Set(options.expectedSuites.map((expectation) => expectation.suite)).size !==
+        options.expectedSuites.length)
+        throw new Error('Expected Vitest suites must be unique');
 }
-function rejectConflictingCopies(candidates) {
-    const firstByIdentity = new Map();
-    for (const candidate of candidates) {
-        const key = `${candidate.manifest.suite}\0${candidate.manifest.run.attempt}`;
-        const first = firstByIdentity.get(key);
-        if (first && !identical(first, candidate)) {
-            throw new Error(`Conflicting Vitest blobs for ${candidate.manifest.suite} attempt ${candidate.manifest.run.attempt}`);
-        }
-        firstByIdentity.set(key, first ?? candidate);
-    }
+function selectionError(message, rejected) {
+    const context = rejected.map(({ source, reason }) => `${source}=${reason}`).join(', ');
+    return new Error(context ? `${message}; rejected sources: ${context}` : message);
 }
-function selectCandidates(candidates, options) {
-    const expected = new Map(options.expectedSuites.map((expectation) => [expectation.suite, expectation.minimumAttempt]));
-    if (expected.size !== options.expectedSuites.length)
-        throw new Error('Expected Vitest suites must be unique');
-    for (const candidate of candidates)
-        validateIdentity(candidate, options);
-    rejectConflictingCopies(candidates);
+function select(candidates, options, rejected) {
+    const first = new Map();
     for (const candidate of candidates) {
-        if (!expected.has(candidate.manifest.suite) &&
-            candidate.manifest.run.attempt === options.run.currentAttempt) {
-            throw new Error(`Unexpected current-attempt Vitest suite: ${candidate.manifest.suite}`);
-        }
+        const key = `${candidate.manifest.suite}\0${candidate.manifest.run.attempt}`, prior = first.get(key);
+        if (prior &&
+            (!prior.manifestBytes.equals(candidate.manifestBytes) ||
+                !prior.reportBytes.equals(candidate.reportBytes)))
+            throw selectionError(`Conflicting Vitest blobs for ${candidate.manifest.suite} attempt ${candidate.manifest.run.attempt}`, rejected);
+        first.set(key, prior ?? candidate);
     }
     return options.expectedSuites
         .toSorted((left, right) => left.suite.localeCompare(right.suite))
@@ -92,9 +44,9 @@ function selectCandidates(candidates, options) {
         const matches = candidates.filter((candidate) => candidate.manifest.suite === expectation.suite &&
             candidate.manifest.run.attempt >= expectation.minimumAttempt);
         if (matches.length === 0)
-            throw new Error(`Missing expected Vitest suite: ${expectation.suite}`);
-        const latestAttempt = Math.max(...matches.map((candidate) => candidate.manifest.run.attempt));
-        const latest = matches.filter((candidate) => candidate.manifest.run.attempt === latestAttempt);
+            throw selectionError(`Missing expected Vitest suite: ${expectation.suite}`, rejected);
+        const attempt = Math.max(...matches.map((candidate) => candidate.manifest.run.attempt));
+        const latest = matches.filter((candidate) => candidate.manifest.run.attempt === attempt);
         return {
             candidate: latest[0],
             sources: [...new Set(latest.map((candidate) => candidate.source))].toSorted(),
@@ -104,16 +56,14 @@ function selectCandidates(candidates, options) {
 function replaceOutput(outputDir, selected) {
     const parent = dirname(outputDir);
     mkdirSync(parent, { recursive: true });
-    const temporary = mkdtempSync(join(parent, `.${basename(outputDir)}-`));
-    const backup = join(parent, `.${basename(outputDir)}-backup-${randomUUID()}`);
-    let backedUp = false;
+    const temporary = mkdtempSync(join(parent, `.${basename(outputDir)}-`)), backup = join(parent, `.${basename(outputDir)}-backup-${randomUUID()}`);
+    let backedUp = false, published = false;
     try {
-        for (const { candidate } of selected) {
+        for (const { candidate } of selected)
             writeFileSync(join(temporary, `${candidate.manifest.suite}.json`), candidate.reportBytes, {
                 flag: 'wx',
                 mode: 0o600,
             });
-        }
         if (existsSync(outputDir)) {
             if (!lstatSync(outputDir).isDirectory())
                 throw new Error('Vitest report output must be a directory');
@@ -122,33 +72,40 @@ function replaceOutput(outputDir, selected) {
         }
         try {
             renameSync(temporary, outputDir);
+            published = true;
         }
         catch (error) {
-            /* v8 ignore start -- an OS-level rename failure restores the already-tested backup path */
-            if (backedUp)
-                renameSync(backup, outputDir);
-            backedUp = false;
+            if (backedUp) {
+                try {
+                    renameSync(backup, outputDir);
+                    backedUp = false;
+                }
+                catch (restoreError) {
+                    throw new AggregateError([error, restoreError], 'Vitest report output rollback failed');
+                }
+            }
             throw error;
-            /* v8 ignore stop */
         }
     }
     finally {
-        rmSync(temporary, { recursive: true, force: true });
-        if (backedUp)
-            rmSync(backup, { recursive: true, force: true });
+        try {
+            rmSync(temporary, { recursive: true, force: true });
+        }
+        finally {
+            if (backedUp && published)
+                rmSync(backup, { recursive: true, force: true });
+        }
     }
 }
-/**
- * Validates untrusted blob bundles and atomically publishes one newest report per expected suite.
- * The caller owns artifact transport; this function deliberately has no network or CI-provider API.
- */
+/** Validates untrusted blob bundles and atomically publishes one newest report per expected suite. */
 export function prepareVitestReports(options) {
     validateOptions(options);
-    const candidates = [
-        ...inspectSource(options.primaryDir, 'primary'),
-        ...inspectSource(options.fallbackDir, 'fallback'),
+    const inspected = [
+        inspectVitestReportSource(options.primaryDir, 'primary', options),
+        inspectVitestReportSource(options.fallbackDir, 'fallback', options),
     ];
-    const selected = selectCandidates(candidates, options);
+    const rejectedSources = inspected.flatMap(({ rejected }) => (rejected ? [rejected] : []));
+    const selected = select(inspected.flatMap(({ candidates }) => candidates), options, rejectedSources);
     replaceOutput(options.outputDir, selected);
     return {
         selected: selected.map(({ candidate, sources }) => ({
@@ -156,5 +113,6 @@ export function prepareVitestReports(options) {
             attempt: candidate.manifest.run.attempt,
             sources,
         })),
+        rejectedSources,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {