vouchington-tooling 0.0.19 → 0.0.21

package/README.md

@@ -95,7 +95,11 @@ import { runAstGrepRule } from 'vouchington-tooling/ast-grep-rule'
 import { parseReviewPayload, remapReviewComments } from 'vouchington-tooling/gha-review-payload'
 import { runPostReview } from 'vouchington-tooling/gha-post-review'
 import { nextPageUrlFromLinkHeader } from 'vouchington-tooling/http-link-pagination'
-import { cmdUpload, mintPresignedControl } from 'vouchington-tooling/coverage-transport'
+import {
+  cmdUpload,
+  discoverDownloadControl,
+  mintPrefixUploadControl,
+} from 'vouchington-tooling/coverage-transport'
 import { pruneDeployedRuntimeDeps } from 'vouchington-tooling/pnpm-deploy'
 import { parseDockerfileRuntimeImages } from 'vouchington-tooling/dockerfile-parse'
 import { checkSccComplexity } from 'vouchington-tooling/scc-complexity'

package/dist/coverage-transport/control-v2.d.mts

@@ -0,0 +1,42 @@
+export interface PrefixPostTarget {
+    readonly url: string;
+    readonly fields: Readonly<Record<string, string>>;
+    readonly keyPrefix: string;
+    readonly maxObjectBytes: number;
+}
+export interface PrefixUploadTransportControl {
+    readonly version: 2;
+    readonly mode: 'prefix-upload';
+    readonly repository: string;
+    readonly revision: string;
+    readonly run: {
+        readonly id: string;
+        readonly controlAttempt: number;
+    };
+    readonly expiresAt: string;
+    readonly upload: PrefixPostTarget;
+}
+export interface DownloadedTransportObject {
+    readonly key: string;
+    readonly url: string;
+    readonly attempt: number;
+    readonly byteLength: number;
+}
+export interface DiscoveredDownloadTransportControl {
+    readonly version: 2;
+    readonly mode: 'discovered-download';
+    readonly repository: string;
+    readonly revision: string;
+    readonly run: {
+        readonly id: string;
+        readonly controlAttempt: number;
+    };
+    readonly expiresAt: string;
+    readonly coverage: Readonly<Record<string, {
+        readonly lcov: DownloadedTransportObject;
+        readonly manifest: DownloadedTransportObject;
+    }>>;
+    readonly blobs: Readonly<Record<string, DownloadedTransportObject>>;
+}
+export type TransportControlV2 = PrefixUploadTransportControl | DiscoveredDownloadTransportControl;
+export declare function parseTransportControlV2(raw: Record<string, unknown>): TransportControlV2;

package/dist/coverage-transport/control-v2.mjs

@@ -0,0 +1,117 @@
+import { VITEST_SUITE_PATTERN } from '../vitest-blob-manifest/index.mjs';
+import { DEFAULT_MAX_BODY_BYTES } from './constants.mjs';
+import { assertPrefixTransportIdentity, parseTransportObjectKey, transportPrefix, } from './keys.mjs';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+    return Object.keys(value).toSorted().join('\0') === keys.toSorted().join('\0');
+}
+function validUrl(value) {
+    return typeof value === 'string' && URL.canParse(value) && /^https?:/i.test(value);
+}
+function identity(raw) {
+    if (!isRecord(raw.run) || !exactKeys(raw.run, ['id', 'controlAttempt']))
+        return null;
+    if (typeof raw.repository !== 'string' ||
+        typeof raw.revision !== 'string' ||
+        typeof raw.run.id !== 'string' ||
+        typeof raw.run.controlAttempt !== 'number')
+        return null;
+    const result = {
+        repository: raw.repository,
+        revision: raw.revision,
+        runId: raw.run.id,
+        controlAttempt: raw.run.controlAttempt,
+    };
+    try {
+        assertPrefixTransportIdentity(result);
+    }
+    catch {
+        return null;
+    }
+    return result;
+}
+function parseObject(raw, expected, suite, kind) {
+    if (!isRecord(raw) ||
+        !exactKeys(raw, ['attempt', 'byteLength', 'key', 'url']) ||
+        !validUrl(raw.url) ||
+        typeof raw.key !== 'string' ||
+        typeof raw.attempt !== 'number' ||
+        typeof raw.byteLength !== 'number' ||
+        !Number.isSafeInteger(raw.attempt) ||
+        !Number.isSafeInteger(raw.byteLength) ||
+        raw.byteLength < 0 ||
+        raw.byteLength > DEFAULT_MAX_BODY_BYTES)
+        throw new Error('Discovered transport object is invalid');
+    const parsed = parseTransportObjectKey(raw.key, expected);
+    if (!parsed || parsed.suite !== suite || parsed.kind !== kind || parsed.attempt !== raw.attempt)
+        throw new Error('Discovered transport object key is invalid');
+    return raw;
+}
+function parseDownloadMap(raw, expected, kind) {
+    if (!isRecord(raw))
+        throw new Error('Discovered transport object map is invalid');
+    for (const [suite, value] of Object.entries(raw)) {
+        if (!VITEST_SUITE_PATTERN.test(suite))
+            throw new Error('Discovered transport suite is invalid');
+        if (kind === 'blob')
+            parseObject(value, expected, suite, 'blob');
+        else if (!isRecord(value) || !exactKeys(value, ['lcov', 'manifest']))
+            throw new Error('Discovered coverage pair is invalid');
+        else {
+            const lcov = parseObject(value.lcov, expected, suite, 'lcov');
+            const manifest = parseObject(value.manifest, expected, suite, 'manifest');
+            if (lcov.attempt !== manifest.attempt)
+                throw new Error('Discovered coverage pair attempts do not match');
+        }
+    }
+    return raw;
+}
+export function parseTransportControlV2(raw) {
+    const expected = identity(raw);
+    if (!expected ||
+        raw.version !== 2 ||
+        typeof raw.expiresAt !== 'string' ||
+        !Number.isFinite(Date.parse(raw.expiresAt)))
+        throw new Error('Coverage transport control has invalid identity fields');
+    if (raw.mode === 'prefix-upload') {
+        if (!exactKeys(raw, [
+            'expiresAt',
+            'mode',
+            'repository',
+            'revision',
+            'run',
+            'upload',
+            'version',
+        ]) ||
+            !isRecord(raw.upload) ||
+            !exactKeys(raw.upload, ['fields', 'keyPrefix', 'maxObjectBytes', 'url']) ||
+            !validUrl(raw.upload.url) ||
+            typeof raw.upload.keyPrefix !== 'string' ||
+            raw.upload.keyPrefix !== `${transportPrefix(expected)}/` ||
+            typeof raw.upload.maxObjectBytes !== 'number' ||
+            !Number.isSafeInteger(raw.upload.maxObjectBytes) ||
+            raw.upload.maxObjectBytes < 1 ||
+            raw.upload.maxObjectBytes > DEFAULT_MAX_BODY_BYTES ||
+            !isRecord(raw.upload.fields) ||
+            Object.entries(raw.upload.fields).some(([key, value]) => key === 'key' || !key || typeof value !== 'string'))
+            throw new Error('Prefix upload coverage transport control is invalid');
+        return raw;
+    }
+    if (raw.mode !== 'discovered-download' ||
+        !exactKeys(raw, [
+            'blobs',
+            'coverage',
+            'expiresAt',
+            'mode',
+            'repository',
+            'revision',
+            'run',
+            'version',
+        ]))
+        throw new Error('Discovered download coverage transport control is invalid');
+    parseDownloadMap(raw.coverage, expected, 'coverage');
+    parseDownloadMap(raw.blobs, expected, 'blob');
+    return raw;
+}

package/dist/coverage-transport/control.d.mts

@@ -1,3 +1,4 @@
+import { type TransportControlV2 } from './control-v2.mts';
 export interface PresignedCoverageUrls {
     lcovPut: string;
     lcovGet: string;
@@ -27,7 +28,7 @@ export interface FallbackOnlyTransportControl extends TransportControlBase {
     readonly mode: 'fallback-only';
     readonly reason: string;
 }
-export type TransportControl = PresignedTransportControl | FallbackOnlyTransportControl;
+export type TransportControl = PresignedTransportControl | FallbackOnlyTransportControl | TransportControlV2;
 export interface ExpectedTransportIdentity {
     readonly repository: string;
     readonly revision: string;

package/dist/coverage-transport/control.mjs

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { chmodSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { VITEST_SUITE_PATTERN } from '../vitest-blob-manifest/index.mjs';
+import { parseTransportControlV2 } from './control-v2.mjs';
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -25,9 +26,13 @@ function assertUrlMap(raw, fields, label) {
     }
 }
 export function parseTransportControl(raw) {
-    if (!isRecord(raw) || raw.version !== 1 || !isRecord(raw.run)) {
+    if (!isRecord(raw)) {
         throw new Error('Coverage transport control has an unsupported schema');
     }
+    if (raw.version === 2)
+        return parseTransportControlV2(raw);
+    if (raw.version !== 1 || !isRecord(raw.run))
+        throw new Error('Coverage transport control has an unsupported schema');
     if (typeof raw.repository !== 'string' ||
         !raw.repository ||
         typeof raw.revision !== 'string' ||
@@ -105,7 +110,7 @@ export function readTransportControl(path, expected) {
             control.run.controlAttempt > expected.currentAttempt)) {
         throw new Error('Coverage transport control identity does not match this run');
     }
-    if (control.mode === 'presigned' && Date.parse(control.expiresAt) <= Date.now()) {
+    if (control.mode !== 'fallback-only' && Date.parse(control.expiresAt) <= Date.now()) {
         throw new Error('Coverage transport control has expired');
     }
     return control;

package/dist/coverage-transport/discovery.d.mts

@@ -0,0 +1,17 @@
+import type { DiscoveredDownloadTransportControl, PrefixUploadTransportControl } from './control-v2.mts';
+import { type MintPrefixUploadOptions } from './prefix.mts';
+export declare const MAX_DISCOVERED_TRANSPORT_OBJECTS = 1024;
+export interface ObjectGetSigner {
+    signGet(key: string, ttlSeconds: number): Promise<string>;
+}
+export interface ListedTransportObject {
+    readonly key: string;
+    readonly byteLength: number;
+}
+export interface TransportObjectLister {
+    list(prefix: string, continuationToken?: string): Promise<{
+        readonly objects: readonly ListedTransportObject[];
+        readonly continuationToken?: string;
+    }>;
+}
+export declare function discoverDownloadControl(source: PrefixUploadTransportControl, lister: TransportObjectLister, signer: ObjectGetSigner, options?: MintPrefixUploadOptions): Promise<DiscoveredDownloadTransportControl>;

package/dist/coverage-transport/discovery.mjs

@@ -0,0 +1,99 @@
+import { DEFAULT_MAX_BODY_BYTES } from './constants.mjs';
+import { parseTransportControl } from './control.mjs';
+import { parseTransportObjectKey, } from './keys.mjs';
+import { DEFAULT_TRANSPORT_TTL_SECONDS, transportExpiresAt, } from './prefix.mjs';
+export const MAX_DISCOVERED_TRANSPORT_OBJECTS = 1024;
+function identity(control) {
+    return {
+        repository: control.repository,
+        revision: control.revision,
+        runId: control.run.id,
+        controlAttempt: control.run.controlAttempt,
+    };
+}
+async function listCandidates(identity, lister) {
+    const result = [];
+    const tokens = new Set();
+    const keys = new Set();
+    let continuationToken;
+    do {
+        const page = await lister.list(`coverage-transport/${identity.repository}/${identity.runId}/${identity.revision}/`, continuationToken);
+        if (!Array.isArray(page.objects) ||
+            page.objects.length + result.length > MAX_DISCOVERED_TRANSPORT_OBJECTS)
+            throw new Error('Coverage transport discovery exceeds object limit');
+        for (const object of page.objects) {
+            if (!object ||
+                typeof object.key !== 'string' ||
+                !Number.isSafeInteger(object.byteLength) ||
+                object.byteLength < 0 ||
+                object.byteLength > DEFAULT_MAX_BODY_BYTES)
+                throw new Error('Coverage transport discovery object is invalid');
+            if (keys.has(object.key))
+                throw new Error('Coverage transport discovery has duplicate object keys');
+            keys.add(object.key);
+            const parsed = parseTransportObjectKey(object.key, identity);
+            if (!parsed)
+                throw new Error('Coverage transport discovery key is invalid');
+            result.push({ object, parsed });
+        }
+        if (page.continuationToken !== undefined && typeof page.continuationToken !== 'string')
+            throw new Error('Coverage transport discovery continuation token is invalid');
+        continuationToken = page.continuationToken;
+        if (continuationToken) {
+            if (tokens.has(continuationToken))
+                throw new Error('Coverage transport discovery pagination is cyclic');
+            tokens.add(continuationToken);
+        }
+    } while (continuationToken);
+    return result;
+}
+export async function discoverDownloadControl(source, lister, signer, options = {}) {
+    const value = identity(source);
+    const expiresAt = transportExpiresAt(options);
+    const candidates = await listCandidates(value, lister);
+    const suites = new Map();
+    for (const candidate of candidates) {
+        const entries = suites.get(candidate.parsed.suite);
+        if (entries)
+            entries.push(candidate);
+        else
+            suites.set(candidate.parsed.suite, [candidate]);
+    }
+    const coverage = {};
+    const blobs = {};
+    const object = async (candidate) => ({
+        key: candidate.object.key,
+        attempt: candidate.parsed.attempt,
+        byteLength: candidate.object.byteLength,
+        url: await signer.signGet(candidate.object.key, options.ttlSeconds ?? DEFAULT_TRANSPORT_TTL_SECONDS),
+    });
+    await Promise.all([...suites].map(async ([suite, entries]) => {
+        const attempts = [...new Set(entries.map((entry) => entry.parsed.attempt))].toSorted((a, b) => b - a);
+        const pair = attempts
+            .map((attempt) => entries.filter((entry) => entry.parsed.attempt === attempt))
+            .map((entries) => ({
+            lcov: entries.find((entry) => entry.parsed.kind === 'lcov'),
+            manifest: entries.find((entry) => entry.parsed.kind === 'manifest'),
+        }))
+            .find((pair) => pair.lcov && pair.manifest);
+        if (pair?.lcov && pair.manifest) {
+            const [lcov, manifest] = await Promise.all([object(pair.lcov), object(pair.manifest)]);
+            coverage[suite] = { lcov, manifest };
+        }
+        const blob = attempts
+            .map((attempt) => entries.find((entry) => entry.parsed.attempt === attempt && entry.parsed.kind === 'blob'))
+            .find(Boolean);
+        if (blob)
+            blobs[suite] = await object(blob);
+    }));
+    return parseTransportControl({
+        version: 2,
+        mode: 'discovered-download',
+        repository: value.repository,
+        revision: value.revision,
+        run: { id: value.runId, controlAttempt: value.controlAttempt },
+        expiresAt,
+        coverage,
+        blobs,
+    });
+}

package/dist/coverage-transport/http.d.mts

@@ -4,3 +4,4 @@ export declare function coveragePresignFailureLog(error: unknown): string;
 export declare function logTransport(options: RequestOptions, line: string): void;
 export declare function fetchPut(url: string, body: Buffer, options?: RequestOptions): Promise<boolean>;
 export declare function fetchGet(url: string, options?: RequestOptions): Promise<Buffer | null>;
+export declare function fetchPost(url: string, fields: Readonly<Record<string, string>>, key: string, body: Buffer, options?: RequestOptions): Promise<boolean>;

package/dist/coverage-transport/http.mjs

@@ -57,7 +57,7 @@ async function request(method, url, body, options) {
         try {
             const response = await fetch(url, {
                 method,
-                ...(body ? { body: new Uint8Array(body) } : {}),
+                ...(body ? { body: typeof body === 'function' ? body() : new Uint8Array(body) } : {}),
                 signal: controller.signal,
             });
             // A missing presigned object is terminal. Let fetchGet yield null or fetchPut yield false
@@ -97,3 +97,14 @@ export async function fetchGet(url, options = {}) {
         throw new Error('[coverage-transport] GET exhausted');
     return response.body;
 }
+export async function fetchPost(url, fields, key, body, options = {}) {
+    const response = await request('POST', url, () => {
+        const form = new FormData();
+        for (const [name, value] of Object.entries(fields))
+            form.set(name, value);
+        form.set('key', key);
+        form.set('file', new Blob([new Uint8Array(body).slice().buffer]));
+        return form;
+    }, options);
+    return response?.ok === true;
+}

package/dist/coverage-transport/index.d.mts

@@ -1,6 +1,10 @@
 export { DEFAULT_COVERAGE_MANIFEST_FILENAME, cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, } from './lib.mts';
 export { parseTransportControl, readTransportControl, writeTransportControl, type ExpectedTransportIdentity, type FallbackOnlyTransportControl, type PresignedBlobUrls, type PresignedCoverageUrls, type PresignedTransportControl, type RequestOptions, type TransportControl, } from './control.mts';
-export { coveragePresignFailureLog, fetchGet, fetchPut, logTransport, redactTransportLog, } from './http.mts';
+export { type DiscoveredDownloadTransportControl, type DownloadedTransportObject, type PrefixPostTarget, type PrefixUploadTransportControl, } from './control-v2.mts';
+export { coveragePresignFailureLog, fetchGet, fetchPost, fetchPut, logTransport, redactTransportLog, } from './http.mts';
 export { assertCoverageTransportBlobOutcome, assertCoverageTransportOutcome, isBlobPrimaryState, isStepOutcome, writeUploadOutcomeOutput, type AppendOutput, type BlobPrimaryState, type StepOutcome, } from './outcome.mts';
 export { downloadVitestBlobBundles, packVitestBlobBundle } from './vitest-blob-transport.mts';
 export { mintPresignedControl, transportObjectKeys, type MintPresignedControlOptions, type ObjectSigner, type PresignIdentity, } from './presign.mts';
+export { discoverDownloadControl, MAX_DISCOVERED_TRANSPORT_OBJECTS, type ListedTransportObject, type ObjectGetSigner, type TransportObjectLister, } from './discovery.mts';
+export { mintPrefixUploadControl, type MintPrefixUploadOptions, type PrefixPostSigner, } from './prefix.mts';
+export { parseTransportObjectKey, transportObjectKeysV2, transportPrefix, type PrefixTransportIdentity, type TransportObjectKey, type TransportObjectKind, } from './keys.mts';

package/dist/coverage-transport/index.mjs

@@ -1,6 +1,10 @@
 export { DEFAULT_COVERAGE_MANIFEST_FILENAME, cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, } from './lib.mjs';
 export { parseTransportControl, readTransportControl, writeTransportControl, } from './control.mjs';
-export { coveragePresignFailureLog, fetchGet, fetchPut, logTransport, redactTransportLog, } from './http.mjs';
+export {} from './control-v2.mjs';
+export { coveragePresignFailureLog, fetchGet, fetchPost, fetchPut, logTransport, redactTransportLog, } from './http.mjs';
 export { assertCoverageTransportBlobOutcome, assertCoverageTransportOutcome, isBlobPrimaryState, isStepOutcome, writeUploadOutcomeOutput, } from './outcome.mjs';
 export { downloadVitestBlobBundles, packVitestBlobBundle } from './vitest-blob-transport.mjs';
 export { mintPresignedControl, transportObjectKeys, } from './presign.mjs';
+export { discoverDownloadControl, MAX_DISCOVERED_TRANSPORT_OBJECTS, } from './discovery.mjs';
+export { mintPrefixUploadControl, } from './prefix.mjs';
+export { parseTransportObjectKey, transportObjectKeysV2, transportPrefix, } from './keys.mjs';

package/dist/coverage-transport/keys.d.mts

@@ -0,0 +1,16 @@
+export interface PrefixTransportIdentity {
+    readonly repository: string;
+    readonly revision: string;
+    readonly runId: string;
+    readonly controlAttempt: number;
+}
+export type TransportObjectKind = 'lcov' | 'manifest' | 'blob';
+export interface TransportObjectKey {
+    readonly attempt: number;
+    readonly suite: string;
+    readonly kind: TransportObjectKind;
+}
+export declare function assertPrefixTransportIdentity(identity: PrefixTransportIdentity): void;
+export declare function transportPrefix(identity: PrefixTransportIdentity, attempt?: number): string;
+export declare function transportObjectKeysV2(identity: PrefixTransportIdentity, suite: string, attempt?: number): Readonly<Record<TransportObjectKind, string>>;
+export declare function parseTransportObjectKey(key: string, identity: PrefixTransportIdentity): TransportObjectKey | null;

package/dist/coverage-transport/keys.mjs

@@ -0,0 +1,44 @@
+import { VITEST_SUITE_PATTERN } from '../vitest-blob-manifest/index.mjs';
+export function assertPrefixTransportIdentity(identity) {
+    if (identity.repository.includes('..') ||
+        !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(identity.repository) ||
+        !/^[0-9a-f]{40}$/.test(identity.revision) ||
+        !/^[1-9][0-9]*$/.test(identity.runId) ||
+        !Number.isSafeInteger(identity.controlAttempt) ||
+        identity.controlAttempt < 1) {
+        throw new Error('Coverage transport key identity is invalid');
+    }
+}
+export function transportPrefix(identity, attempt = identity.controlAttempt) {
+    assertPrefixTransportIdentity(identity);
+    if (!Number.isSafeInteger(attempt) || attempt < 1 || attempt > identity.controlAttempt) {
+        throw new Error('Coverage transport attempt is invalid');
+    }
+    return `coverage-transport/${identity.repository}/${identity.runId}/${identity.revision}/attempt-${attempt}`;
+}
+export function transportObjectKeysV2(identity, suite, attempt = identity.controlAttempt) {
+    if (!VITEST_SUITE_PATTERN.test(suite))
+        throw new Error('Coverage transport suite is invalid');
+    const prefix = transportPrefix(identity, attempt);
+    return {
+        lcov: `${prefix}/coverage/${suite}/lcov.info`,
+        manifest: `${prefix}/coverage/${suite}/coverage-manifest.json`,
+        blob: `${prefix}/blobs/${suite}.tar.gz`,
+    };
+}
+export function parseTransportObjectKey(key, identity) {
+    const root = `coverage-transport/${identity.repository}/${identity.runId}/${identity.revision}/`;
+    if (!key.startsWith(root) || key.includes('..') || key.includes('\\'))
+        return null;
+    const match = /^attempt-([1-9][0-9]*)\/(?:coverage\/([a-z0-9]+(?:-[a-z0-9]+)*)\/(lcov\.info|coverage-manifest\.json)|blobs\/([a-z0-9]+(?:-[a-z0-9]+)*)\.tar\.gz)$/.exec(key.slice(root.length));
+    if (!match)
+        return null;
+    const attempt = Number(match[1]);
+    if (!Number.isSafeInteger(attempt) || attempt > identity.controlAttempt)
+        return null;
+    const coverageSuite = match[2];
+    if (coverageSuite) {
+        return { attempt, suite: coverageSuite, kind: match[3] === 'lcov.info' ? 'lcov' : 'manifest' };
+    }
+    return { attempt, suite: match[4], kind: 'blob' };
+}

package/dist/coverage-transport/lib.mjs

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { DEFAULT_COVERAGE_MANIFEST_FILENAME, DEFAULT_MAX_BODY_BYTES, assertCoverageManifestFilename, } from './constants.mjs';
 import { readTransportControl, } from './control.mjs';
 import { fetchGet, fetchPut, logTransport } from './http.mjs';
+import { downloadPrefixBlobs, downloadPrefixCoverage, uploadPrefixTransport, } from './prefix-transfer.mjs';
 import { downloadVitestBlobBundles, packVitestBlobBundle } from './vitest-blob-transport.mjs';
 export { DEFAULT_COVERAGE_MANIFEST_FILENAME } from './constants.mjs';
 export async function cmdUpload(controlPath, suite, options) {
@@ -15,6 +16,11 @@ export async function cmdUpload(controlPath, suite, options) {
     const cwd = options.cwd ?? process.cwd();
     const manifestFilename = options.coverageManifestFilename ?? DEFAULT_COVERAGE_MANIFEST_FILENAME;
     assertCoverageManifestFilename(manifestFilename);
+    if (control.mode === 'prefix-upload') {
+        return uploadPrefixTransport(control, suite, cwd, options.expectedIdentity, manifestFilename, options);
+    }
+    if (control.mode === 'discovered-download')
+        throw new Error('Coverage transport download control cannot upload');
     const coverageUrls = control.coverage[suite];
     const lcovPath = join(cwd, 'coverage', 'lcov.info');
     const manifestPath = join(cwd, 'coverage', manifestFilename);
@@ -58,6 +64,11 @@ export async function cmdDownloadCoverage(controlPath, destinationRoot, options)
     }
     const manifestFilename = options.coverageManifestFilename ?? DEFAULT_COVERAGE_MANIFEST_FILENAME;
     assertCoverageManifestFilename(manifestFilename);
+    if (control.mode === 'prefix-upload')
+        throw new Error('Coverage transport upload control cannot download');
+    if (control.mode === 'discovered-download') {
+        return downloadPrefixCoverage(control, destinationRoot, manifestFilename, options);
+    }
     await Promise.all(Object.entries(control.coverage).map(async ([suite, urls]) => {
         const [lcov, manifest] = await Promise.all([
             fetchGet(urls.lcovGet, options),
@@ -80,5 +91,9 @@ export async function cmdDownloadVitestBlobs(controlPath, destinationRoot, optio
         logTransport(options, '[coverage-transport] S3 unavailable; artifact fallback required');
         return;
     }
+    if (control.mode === 'prefix-upload')
+        throw new Error('Coverage transport upload control cannot download');
+    if (control.mode === 'discovered-download')
+        return downloadPrefixBlobs(control, destinationRoot, options);
     await downloadVitestBlobBundles(control.blobs, destinationRoot, options);
 }

package/dist/coverage-transport/prefix-transfer.d.mts

@@ -0,0 +1,8 @@
+import type { DiscoveredDownloadTransportControl, PrefixUploadTransportControl } from './control-v2.mts';
+import type { ExpectedTransportIdentity, RequestOptions } from './control.mts';
+export declare function uploadPrefixTransport(control: PrefixUploadTransportControl, suite: string, cwd: string, expectedIdentity: ExpectedTransportIdentity, manifestFilename: string, options: RequestOptions): Promise<{
+    coverage: boolean;
+    blob: boolean;
+}>;
+export declare function downloadPrefixCoverage(control: DiscoveredDownloadTransportControl, destinationRoot: string, manifestFilename: string, options: RequestOptions): Promise<void>;
+export declare function downloadPrefixBlobs(control: DiscoveredDownloadTransportControl, destinationRoot: string, options: RequestOptions): Promise<void>;

package/dist/coverage-transport/prefix-transfer.mjs

@@ -0,0 +1,69 @@
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { DEFAULT_COVERAGE_MANIFEST_FILENAME } from './constants.mjs';
+import { fetchGet, fetchPost, logTransport } from './http.mjs';
+import { transportObjectKeysV2 } from './keys.mjs';
+import { downloadVitestBlobBundles, packVitestBlobBundle } from './vitest-blob-transport.mjs';
+function identity(control) {
+    return {
+        repository: control.repository,
+        revision: control.revision,
+        runId: control.run.id,
+        controlAttempt: control.run.controlAttempt,
+    };
+}
+export async function uploadPrefixTransport(control, suite, cwd, expectedIdentity, manifestFilename, options) {
+    if (control.run.controlAttempt !== expectedIdentity.currentAttempt)
+        throw new Error('Prefix transport control attempt does not match the producer attempt');
+    if (manifestFilename !== DEFAULT_COVERAGE_MANIFEST_FILENAME)
+        throw new Error('Prefix transport requires the default coverage manifest filename');
+    const keys = transportObjectKeysV2(identity(control), suite);
+    const maxObjectBytes = Math.min(control.upload.maxObjectBytes, options.maxBodyBytes ?? control.upload.maxObjectBytes);
+    const lcovPath = join(cwd, 'coverage', 'lcov.info');
+    const manifestPath = join(cwd, 'coverage', manifestFilename);
+    const lcov = existsSync(lcovPath) && existsSync(manifestPath) ? await readFile(lcovPath) : null;
+    const manifest = lcov === null ? null : await readFile(manifestPath);
+    const storedLcov = lcov !== null && lcov.byteLength <= maxObjectBytes
+        ? await fetchPost(control.upload.url, control.upload.fields, keys.lcov, lcov, options)
+        : false;
+    const coverage = storedLcov && manifest !== null && manifest.byteLength <= maxObjectBytes
+        ? await fetchPost(control.upload.url, control.upload.fields, keys.manifest, manifest, options)
+        : false;
+    if (lcov !== null)
+        logTransport(options, coverage
+            ? `[coverage-transport] Uploaded coverage pair for ${suite}`
+            : `[coverage-transport] Coverage pair upload failed for ${suite}`);
+    const blobData = packVitestBlobBundle(cwd, suite, expectedIdentity, options);
+    const blob = Boolean(blobData &&
+        blobData.byteLength <= maxObjectBytes &&
+        (await fetchPost(control.upload.url, control.upload.fields, keys.blob, blobData, options)));
+    if (blob)
+        logTransport(options, `[coverage-transport] Uploaded vitest blob for ${suite}`);
+    else if (blobData)
+        logTransport(options, `[coverage-transport] Vitest blob upload failed for ${suite}`);
+    return { coverage, blob };
+}
+export async function downloadPrefixCoverage(control, destinationRoot, manifestFilename, options) {
+    if (manifestFilename !== DEFAULT_COVERAGE_MANIFEST_FILENAME)
+        throw new Error('Prefix transport requires the default coverage manifest filename');
+    await Promise.all(Object.entries(control.coverage).map(async ([suite, pair]) => {
+        const [lcov, manifest] = await Promise.all([
+            fetchGet(pair.lcov.url, options),
+            fetchGet(pair.manifest.url, options),
+        ]);
+        if (!lcov || !manifest)
+            return logTransport(options, `[coverage-transport] Skipped incomplete coverage pair for ${suite}`);
+        const destination = join(destinationRoot, `coverage-${suite}`);
+        mkdirSync(destination, { recursive: true });
+        writeFileSync(join(destination, 'lcov.info'), lcov);
+        writeFileSync(join(destination, manifestFilename), manifest, { mode: 0o600 });
+        logTransport(options, `[coverage-transport] Downloaded coverage pair for ${suite}`);
+    }));
+}
+export async function downloadPrefixBlobs(control, destinationRoot, options) {
+    await downloadVitestBlobBundles(Object.fromEntries(Object.entries(control.blobs).map(([suite, object]) => [
+        suite,
+        { get: object.url, put: 'unused' },
+    ])), destinationRoot, options);
+}

package/dist/coverage-transport/prefix.d.mts

@@ -0,0 +1,13 @@
+import type { PrefixPostTarget, PrefixUploadTransportControl } from './control-v2.mts';
+import { type PrefixTransportIdentity } from './keys.mts';
+export interface PrefixPostSigner {
+    signPost(keyPrefix: string, ttlSeconds: number, maxObjectBytes: number): Promise<PrefixPostTarget>;
+}
+export interface MintPrefixUploadOptions {
+    readonly ttlSeconds?: number;
+    readonly maxObjectBytes?: number;
+    readonly now?: () => Date;
+}
+export declare const DEFAULT_TRANSPORT_TTL_SECONDS = 14400;
+export declare function transportExpiresAt(options: MintPrefixUploadOptions): string;
+export declare function mintPrefixUploadControl(value: PrefixTransportIdentity, signer: PrefixPostSigner, options?: MintPrefixUploadOptions): Promise<PrefixUploadTransportControl>;

package/dist/coverage-transport/prefix.mjs

@@ -0,0 +1,30 @@
+import { DEFAULT_MAX_BODY_BYTES } from './constants.mjs';
+import { parseTransportControl } from './control.mjs';
+import { transportPrefix } from './keys.mjs';
+export const DEFAULT_TRANSPORT_TTL_SECONDS = 14_400;
+export function transportExpiresAt(options) {
+    const ttl = options.ttlSeconds ?? DEFAULT_TRANSPORT_TTL_SECONDS;
+    if (!Number.isSafeInteger(ttl) || ttl < 1)
+        throw new Error('Coverage transport TTL is invalid');
+    return new Date((options.now?.() ?? new Date()).getTime() + ttl * 1000).toISOString();
+}
+export async function mintPrefixUploadControl(value, signer, options = {}) {
+    const ttlSeconds = options.ttlSeconds ?? DEFAULT_TRANSPORT_TTL_SECONDS;
+    const maxObjectBytes = options.maxObjectBytes ?? DEFAULT_MAX_BODY_BYTES;
+    if (!Number.isSafeInteger(maxObjectBytes) ||
+        maxObjectBytes < 1 ||
+        maxObjectBytes > DEFAULT_MAX_BODY_BYTES)
+        throw new Error('Coverage transport size limit is invalid');
+    const upload = await signer.signPost(`${transportPrefix(value)}/`, ttlSeconds, maxObjectBytes);
+    if (upload.maxObjectBytes > maxObjectBytes)
+        throw new Error('Coverage transport signer size limit is invalid');
+    return parseTransportControl({
+        version: 2,
+        mode: 'prefix-upload',
+        repository: value.repository,
+        revision: value.revision,
+        run: { id: value.runId, controlAttempt: value.controlAttempt },
+        expiresAt: transportExpiresAt(options),
+        upload,
+    });
+}

package/dist/index.d.mts

@@ -8,7 +8,7 @@ export type { GhApiExecutor, RuntimeAuditOptions, RuntimeAuditResult, RuntimeAud
 export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mts';
 export type { InspectedVitestBlobBundle, VitestBlobIdentity, VitestBlobManifest, VitestReportAttempt, VitestReportAttemptIdentity, } from './vitest-blob-manifest/index.mts';
 export { prepareVitestReports } from './vitest-blob-manifest/reports.mts';
-export type { PrepareVitestReportsOptions, SelectedVitestReport, VitestReportExpectation, } from './vitest-blob-manifest/reports.mts';
+export type { PrepareVitestReportsOptions, RejectedVitestReportSource, SelectedVitestReport, VitestReportExpectation, VitestReportRejectionReason, } from './vitest-blob-manifest/reports.mts';
 export { findWorkspaceLinkMismatches, formatReleaseAgeFailure, INSTALL_TERMINATION_FAILED, isReleaseAgeViolation, parseInstallOptions, parseReleaseAgeViolations, runInstallLifecycle, } from './pnpm-install/index.mts';
 export type { InstallOptions, Lifecycle } from './pnpm-install/index.mts';
 export { flattenReleaseAgeSelectors, packageNameFromPnpmLockKey, pnpmLockPackageKeyMatchesSelector, validateReleaseAgeExemptionGroups, validateReleaseAgePolicy, } from './pnpm-install/index.mts';

package/dist/vitest-blob-manifest/bundle-error.d.mts

@@ -0,0 +1,2 @@
+export declare class VitestBlobBundleError extends Error {
+}

package/dist/vitest-blob-manifest/bundle-error.mjs

@@ -0,0 +1,2 @@
+export class VitestBlobBundleError extends Error {
+}

package/dist/vitest-blob-manifest/index.mjs

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { lstatSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { basename, join } from 'node:path';
 import { VITEST_SUITE_PATTERN } from './constants.mjs';
+import { VitestBlobBundleError } from './bundle-error.mjs';
 export * from './report-attempt.mjs';
 export { VITEST_SUITE_PATTERN } from './constants.mjs';
 export const VITEST_BLOB_MANIFEST_FILENAME = 'vitest-blob-manifest.json';
@@ -89,9 +90,7 @@ export function writeVitestBlobManifest(directory, identity) {
         try {
             unlinkSync(temporaryPath);
         }
-        catch {
-            // Successful rename removes the temporary path.
-        }
+        catch { }
     }
     return manifestPath;
 }
@@ -105,11 +104,13 @@ export function vitestBlobBundlePaths(directory, suite) {
     return [manifestPath, reportPath];
 }
 export function inspectVitestBlobBundle(directory) {
-    const entries = readdirSync(directory, { withFileTypes: true });
+    const entries = readdirSync(directory, { withFileTypes: true }), name = basename(directory);
     if (entries.length !== 2 || entries.some((entry) => !entry.isFile())) {
-        throw new Error(`Vitest blob bundle ${basename(directory)} must contain exactly two files`);
+        throw new VitestBlobBundleError(`Vitest blob bundle ${name} must contain exactly two files`);
     }
     const manifestPath = join(directory, VITEST_BLOB_MANIFEST_FILENAME);
+    if (!entries.some((entry) => entry.name === VITEST_BLOB_MANIFEST_FILENAME))
+        throw new VitestBlobBundleError(`Invalid Vitest blob bundle ${name}`);
     assertRegularFile(manifestPath, 'Vitest blob manifest');
     const manifestBytes = readFileSync(manifestPath);
     let manifest;
@@ -117,20 +118,24 @@ export function inspectVitestBlobBundle(directory) {
         manifest = parseVitestBlobManifest(JSON.parse(manifestBytes.toString('utf8')));
     }
     catch (error) {
-        throw new Error(`Invalid Vitest blob bundle ${basename(directory)}`, { cause: error });
+        throw new VitestBlobBundleError(`Invalid Vitest blob bundle ${name}`, { cause: error });
     }
     const reportPath = join(directory, manifest.report.filename);
+    if (!entries.some((entry) => entry.name === manifest.report.filename))
+        throw new VitestBlobBundleError(`Invalid Vitest blob bundle ${name}`);
     assertRegularFile(reportPath, 'Vitest blob report');
     const reportBytes = readFileSync(reportPath);
     if (reportBytes.byteLength !== manifest.report.byteLength ||
         sha256(reportBytes) !== manifest.report.sha256) {
-        throw new Error(`Vitest blob report integrity check failed for ${manifest.suite}`);
+        throw new VitestBlobBundleError(`Vitest blob report integrity check failed for ${manifest.suite}`);
     }
     try {
         JSON.parse(reportBytes.toString('utf8'));
     }
     catch (error) {
-        throw new Error(`Vitest blob report is not valid JSON for ${manifest.suite}`, { cause: error });
+        throw new VitestBlobBundleError(`Vitest blob report is not valid JSON for ${manifest.suite}`, {
+            cause: error,
+        });
     }
     return { directory, manifest, manifestBytes, reportBytes };
 }

package/dist/vitest-blob-manifest/reports-source.d.mts

@@ -0,0 +1,26 @@
+import { type InspectedVitestBlobBundle } from './index.mts';
+export type VitestReportSource = 'primary' | 'fallback';
+export type VitestReportRejectionReason = 'root-not-directory' | 'invalid-archive' | 'unexpected-entry' | 'invalid-bundle' | 'identity-mismatch' | 'future-attempt' | 'intra-source-conflict' | 'unexpected-current-attempt-suite';
+export interface RejectedVitestReportSource {
+    readonly source: VitestReportSource;
+    readonly reason: VitestReportRejectionReason;
+}
+export type Candidate = InspectedVitestBlobBundle & {
+    readonly source: VitestReportSource;
+};
+type SourceOptions = {
+    readonly repository: string;
+    readonly revision: string;
+    readonly run: {
+        readonly id: string;
+        readonly currentAttempt: number;
+    };
+    readonly expectedSuites: readonly {
+        readonly suite: string;
+    }[];
+};
+export declare function inspectVitestReportSource(root: string, source: VitestReportSource, options: SourceOptions): {
+    readonly candidates: readonly Candidate[];
+    readonly rejected?: RejectedVitestReportSource;
+};
+export {};

package/dist/vitest-blob-manifest/reports-source.mjs

@@ -0,0 +1,88 @@
+import { lstatSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { inspectVitestBlobBundle, VITEST_BLOB_MANIFEST_FILENAME, VITEST_SUITE_PATTERN, } from './index.mjs';
+import { VitestBlobBundleError } from './bundle-error.mjs';
+class SourceFailure extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+    }
+}
+function bundle(root, source) {
+    const entries = readdirSync(root, { withFileTypes: true });
+    if (entries.length === 0)
+        return [];
+    if (entries.some((entry) => entry.name === VITEST_BLOB_MANIFEST_FILENAME)) {
+        try {
+            return [{ ...inspectVitestBlobBundle(root), source }];
+        }
+        catch (error) {
+            if (error instanceof VitestBlobBundleError)
+                throw new SourceFailure('invalid-bundle');
+            throw error;
+        }
+    }
+    if (entries.some((entry) => entry.isFile() &&
+        entry.name.startsWith('.invalid-') &&
+        VITEST_SUITE_PATTERN.test(entry.name.slice('.invalid-'.length))))
+        throw new SourceFailure('invalid-archive');
+    if (entries.some((entry) => !entry.isDirectory()))
+        throw new SourceFailure('unexpected-entry');
+    try {
+        return entries
+            .toSorted((left, right) => left.name.localeCompare(right.name))
+            .map((entry) => ({ ...inspectVitestBlobBundle(join(root, entry.name)), source }));
+    }
+    catch (error) {
+        if (error instanceof VitestBlobBundleError)
+            throw new SourceFailure('invalid-bundle');
+        throw error;
+    }
+}
+function validate(candidates, options) {
+    const expected = new Set(options.expectedSuites.map((expectation) => expectation.suite));
+    const first = new Map();
+    for (const candidate of candidates) {
+        const { manifest } = candidate;
+        if (manifest.repository !== options.repository ||
+            manifest.revision !== options.revision ||
+            manifest.run.id !== options.run.id)
+            throw new SourceFailure('identity-mismatch');
+        if (manifest.run.attempt > options.run.currentAttempt)
+            throw new SourceFailure('future-attempt');
+        if (!expected.has(manifest.suite) && manifest.run.attempt === options.run.currentAttempt)
+            throw new SourceFailure('unexpected-current-attempt-suite');
+        const key = `${manifest.suite}\0${manifest.run.attempt}`, prior = first.get(key);
+        if (prior &&
+            (!prior.manifestBytes.equals(candidate.manifestBytes) ||
+                !prior.reportBytes.equals(candidate.reportBytes)))
+            throw new SourceFailure('intra-source-conflict');
+        first.set(key, prior ?? candidate);
+    }
+}
+export function inspectVitestReportSource(root, source, options) {
+    let metadata;
+    try {
+        metadata = lstatSync(root);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            'code' in error &&
+            error.code === 'ENOENT')
+            return { candidates: [] };
+        throw error;
+    }
+    if (!metadata.isDirectory())
+        return { candidates: [], rejected: { source, reason: 'root-not-directory' } };
+    try {
+        const candidates = bundle(root, source);
+        validate(candidates, options);
+        return { candidates };
+    }
+    catch (error) {
+        if (error instanceof SourceFailure)
+            return { candidates: [], rejected: { source, reason: error.reason } };
+        throw error;
+    }
+}

package/dist/vitest-blob-manifest/reports.d.mts

@@ -1,3 +1,4 @@
+import { type RejectedVitestReportSource, type VitestReportSource } from './reports-source.mts';
 export interface PrepareVitestReportsOptions {
     readonly primaryDir: string;
     readonly fallbackDir: string;
@@ -17,12 +18,11 @@ export type VitestReportExpectation = {
 export interface SelectedVitestReport {
     readonly suite: string;
     readonly attempt: number;
-    readonly sources: readonly ('primary' | 'fallback')[];
+    readonly sources: readonly VitestReportSource[];
 }
-/**
- * Validates untrusted blob bundles and atomically publishes one newest report per expected suite.
- * The caller owns artifact transport; this function deliberately has no network or CI-provider API.
- */
+export type { RejectedVitestReportSource, VitestReportRejectionReason } from './reports-source.mts';
+/** Validates untrusted blob bundles and atomically publishes one newest report per expected suite. */
 export declare function prepareVitestReports(options: PrepareVitestReportsOptions): {
     readonly selected: readonly SelectedVitestReport[];
+    readonly rejectedSources: readonly RejectedVitestReportSource[];
 };

package/dist/vitest-blob-manifest/reports.mjs

@@ -1,90 +1,42 @@
-/* eslint-disable max-lines -- untrusted artifact discovery and publication form one security boundary. */
 import { randomUUID } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
-import { inspectVitestBlobBundle, VITEST_BLOB_MANIFEST_FILENAME, VITEST_SUITE_PATTERN, } from './index.mjs';
-function inspectSource(root, source) {
-    if (!existsSync(root))
-        return [];
-    if (!lstatSync(root).isDirectory())
-        throw new Error(`Vitest ${source} root must be a directory`);
-    const entries = readdirSync(root, { withFileTypes: true });
-    if (entries.length === 0)
-        return [];
-    const isFlattened = entries.some((entry) => entry.name === VITEST_BLOB_MANIFEST_FILENAME);
-    if (isFlattened)
-        return [{ ...inspectVitestBlobBundle(root), source }];
-    const invalid = entries.find((entry) => {
-        const suite = entry.name.startsWith('.invalid-') ? entry.name.slice('.invalid-'.length) : '';
-        return entry.isFile() && VITEST_SUITE_PATTERN.test(suite);
-    });
-    if (invalid)
-        throw new Error(`Vitest ${source} root contains an invalid archive marker`);
-    const unexpected = entries.find((entry) => !entry.isDirectory());
-    if (unexpected)
-        throw new Error(`Vitest ${source} root has an unexpected entry`);
-    return entries
-        .toSorted((left, right) => left.name.localeCompare(right.name))
-        .map((entry) => ({ ...inspectVitestBlobBundle(join(root, entry.name)), source }));
-}
+import { VITEST_SUITE_PATTERN } from './index.mjs';
+import { inspectVitestReportSource, } from './reports-source.mjs';
 function validateOptions(options) {
-    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(options.repository)) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(options.repository))
         throw new Error('Invalid Vitest repository');
-    }
     if (!/^[0-9a-f]{40}$/.test(options.revision))
         throw new Error('Invalid Vitest revision');
-    if (!/^[1-9][0-9]*$/.test(options.run.id) || !Number.isSafeInteger(options.run.currentAttempt)) {
-        throw new Error('Invalid Vitest run');
-    }
-    if (options.run.currentAttempt < 1)
+    if (!/^[1-9][0-9]*$/.test(options.run.id) ||
+        !Number.isSafeInteger(options.run.currentAttempt) ||
+        options.run.currentAttempt < 1)
         throw new Error('Invalid Vitest run');
     for (const expectation of options.expectedSuites) {
-        if (!VITEST_SUITE_PATTERN.test(expectation.suite) ||
-            !Number.isSafeInteger(expectation.minimumAttempt)) {
+        if (!VITEST_SUITE_PATTERN.test(expectation.suite))
             throw new Error('Invalid expected Vitest suite');
-        }
-        if (expectation.minimumAttempt < 1 || expectation.minimumAttempt > options.run.currentAttempt) {
+        if (!Number.isSafeInteger(expectation.minimumAttempt) ||
+            expectation.minimumAttempt < 1 ||
+            expectation.minimumAttempt > options.run.currentAttempt)
             throw new Error('Invalid expected Vitest suite attempt');
-        }
-    }
-}
-function validateIdentity(candidate, options) {
-    const { manifest } = candidate;
-    if (manifest.repository !== options.repository ||
-        manifest.revision !== options.revision ||
-        manifest.run.id !== options.run.id) {
-        throw new Error(`Vitest blob identity does not match this run for ${manifest.suite}`);
     }
-    if (manifest.run.attempt > options.run.currentAttempt) {
-        throw new Error(`Vitest blob attempt is from the future for ${manifest.suite}`);
-    }
-}
-function identical(left, right) {
-    return (left.manifestBytes.equals(right.manifestBytes) && left.reportBytes.equals(right.reportBytes));
+    if (new Set(options.expectedSuites.map((expectation) => expectation.suite)).size !==
+        options.expectedSuites.length)
+        throw new Error('Expected Vitest suites must be unique');
 }
-function rejectConflictingCopies(candidates) {
-    const firstByIdentity = new Map();
-    for (const candidate of candidates) {
-        const key = `${candidate.manifest.suite}\0${candidate.manifest.run.attempt}`;
-        const first = firstByIdentity.get(key);
-        if (first && !identical(first, candidate)) {
-            throw new Error(`Conflicting Vitest blobs for ${candidate.manifest.suite} attempt ${candidate.manifest.run.attempt}`);
-        }
-        firstByIdentity.set(key, first ?? candidate);
-    }
+function selectionError(message, rejected) {
+    const context = rejected.map(({ source, reason }) => `${source}=${reason}`).join(', ');
+    return new Error(context ? `${message}; rejected sources: ${context}` : message);
 }
-function selectCandidates(candidates, options) {
-    const expected = new Map(options.expectedSuites.map((expectation) => [expectation.suite, expectation.minimumAttempt]));
-    if (expected.size !== options.expectedSuites.length)
-        throw new Error('Expected Vitest suites must be unique');
-    for (const candidate of candidates)
-        validateIdentity(candidate, options);
-    rejectConflictingCopies(candidates);
+function select(candidates, options, rejected) {
+    const first = new Map();
     for (const candidate of candidates) {
-        if (!expected.has(candidate.manifest.suite) &&
-            candidate.manifest.run.attempt === options.run.currentAttempt) {
-            throw new Error(`Unexpected current-attempt Vitest suite: ${candidate.manifest.suite}`);
-        }
+        const key = `${candidate.manifest.suite}\0${candidate.manifest.run.attempt}`, prior = first.get(key);
+        if (prior &&
+            (!prior.manifestBytes.equals(candidate.manifestBytes) ||
+                !prior.reportBytes.equals(candidate.reportBytes)))
+            throw selectionError(`Conflicting Vitest blobs for ${candidate.manifest.suite} attempt ${candidate.manifest.run.attempt}`, rejected);
+        first.set(key, prior ?? candidate);
     }
     return options.expectedSuites
         .toSorted((left, right) => left.suite.localeCompare(right.suite))
@@ -92,9 +44,9 @@ function selectCandidates(candidates, options) {
         const matches = candidates.filter((candidate) => candidate.manifest.suite === expectation.suite &&
             candidate.manifest.run.attempt >= expectation.minimumAttempt);
         if (matches.length === 0)
-            throw new Error(`Missing expected Vitest suite: ${expectation.suite}`);
-        const latestAttempt = Math.max(...matches.map((candidate) => candidate.manifest.run.attempt));
-        const latest = matches.filter((candidate) => candidate.manifest.run.attempt === latestAttempt);
+            throw selectionError(`Missing expected Vitest suite: ${expectation.suite}`, rejected);
+        const attempt = Math.max(...matches.map((candidate) => candidate.manifest.run.attempt));
+        const latest = matches.filter((candidate) => candidate.manifest.run.attempt === attempt);
         return {
             candidate: latest[0],
             sources: [...new Set(latest.map((candidate) => candidate.source))].toSorted(),
@@ -104,16 +56,14 @@ function selectCandidates(candidates, options) {
 function replaceOutput(outputDir, selected) {
     const parent = dirname(outputDir);
     mkdirSync(parent, { recursive: true });
-    const temporary = mkdtempSync(join(parent, `.${basename(outputDir)}-`));
-    const backup = join(parent, `.${basename(outputDir)}-backup-${randomUUID()}`);
-    let backedUp = false;
+    const temporary = mkdtempSync(join(parent, `.${basename(outputDir)}-`)), backup = join(parent, `.${basename(outputDir)}-backup-${randomUUID()}`);
+    let backedUp = false, published = false;
     try {
-        for (const { candidate } of selected) {
+        for (const { candidate } of selected)
             writeFileSync(join(temporary, `${candidate.manifest.suite}.json`), candidate.reportBytes, {
                 flag: 'wx',
                 mode: 0o600,
             });
-        }
         if (existsSync(outputDir)) {
             if (!lstatSync(outputDir).isDirectory())
                 throw new Error('Vitest report output must be a directory');
@@ -122,33 +72,40 @@ function replaceOutput(outputDir, selected) {
         }
         try {
             renameSync(temporary, outputDir);
+            published = true;
         }
         catch (error) {
-            /* v8 ignore start -- an OS-level rename failure restores the already-tested backup path */
-            if (backedUp)
-                renameSync(backup, outputDir);
-            backedUp = false;
+            if (backedUp) {
+                try {
+                    renameSync(backup, outputDir);
+                    backedUp = false;
+                }
+                catch (restoreError) {
+                    throw new AggregateError([error, restoreError], 'Vitest report output rollback failed');
+                }
+            }
             throw error;
-            /* v8 ignore stop */
         }
     }
     finally {
-        rmSync(temporary, { recursive: true, force: true });
-        if (backedUp)
-            rmSync(backup, { recursive: true, force: true });
+        try {
+            rmSync(temporary, { recursive: true, force: true });
+        }
+        finally {
+            if (backedUp && published)
+                rmSync(backup, { recursive: true, force: true });
+        }
     }
 }
-/**
- * Validates untrusted blob bundles and atomically publishes one newest report per expected suite.
- * The caller owns artifact transport; this function deliberately has no network or CI-provider API.
- */
+/** Validates untrusted blob bundles and atomically publishes one newest report per expected suite. */
 export function prepareVitestReports(options) {
     validateOptions(options);
-    const candidates = [
-        ...inspectSource(options.primaryDir, 'primary'),
-        ...inspectSource(options.fallbackDir, 'fallback'),
+    const inspected = [
+        inspectVitestReportSource(options.primaryDir, 'primary', options),
+        inspectVitestReportSource(options.fallbackDir, 'fallback', options),
     ];
-    const selected = selectCandidates(candidates, options);
+    const rejectedSources = inspected.flatMap(({ rejected }) => (rejected ? [rejected] : []));
+    const selected = select(inspected.flatMap(({ candidates }) => candidates), options, rejectedSources);
     replaceOutput(options.outputDir, selected);
     return {
         selected: selected.map(({ candidate, sources }) => ({
@@ -156,5 +113,6 @@ export function prepareVitestReports(options) {
             attempt: candidate.manifest.run.attempt,
             sources,
         })),
+        rejectedSources,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.0.19",
+  "version": "0.0.21",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {